IPSec data stream high-speed processing system and method based on FPGA

Abstract

The invention provides an IPSec data stream high-speed processing system based on an FPGA. The system comprises a key negotiation module and the FPGA. The key negotiation module is finished in a master control CPU in a software mode. The FPGA part comprises an input processing module, an output processing module, an SADB module, an SPDB module and an encryption / decryption and authentication processing module. The encryption / decryption and authentication processing module comprises an authentication processing module and an ESP encryption / decryption processing module. The authentication processing module comprises an ESP authentication processing module and an AH authentication processing module. According to the IPSec data stream high-speed processing system and method based on the FPGA, a processing rate is high, the integration degree is high and the expansion of an algorithm is supported.

Description

technical field [0001] The invention relates to the field of network communication, in particular to an FPGA-based IPSec data flow high-speed processing system, and also relates to an FPGA-based IPSec data flow high-speed processing method. Background technique [0002] Security is very important to network communication. IPSec is a protocol framework for secure data transmission at the IP layer. Its processing flow mainly includes key negotiation, SA (Security Association), SP (Security Policy) management, and AH (Authentication Header), ESP (Encapsulating Security Payload) protocol processing. Among them, the key agreement and the management of SA and SP are not required for each communication data message, so they are not the key to affect the processing speed of IPSec; while AH and ESP protocols must be processed for each communication data message, so The processing speed of AH and ESP is the bottleneck that affects the processing speed of IPSec. [0003] AH provides ...

AI Technical Summary

Problems solved by technology

The software-based form has the advantages of flexibility and low cost, but the processing speed is low and cannot support high-speed encrypted communication needs; while the hardware-based form is more expensive than the software-based form, but the processing speed is fast and can meet High-speed encrypted communication requires

Hardware-based forms mainly include dedicated security processing chips, which are currently the mainstream high-speed encrypted communication solutions. However, one disadvantage of this type of chip is that the algorithm is fixed and cannot support dynamic expansion.

Images