A 10G IPsec device based on SOC and FPGA and its method

Abstract

The present invention belongs to the technical field of electronic digital data processing, and more specifically, relates to a 10G IPsec device based on SOC and FPGA and a method thereof. The device includes an intranet FPGA, an extranet FPGA, an algorithm FPGA and a management SOC; the intranet FPGA is connected to the intranet through a 10G network port, connected to the algorithm FPGA through a GT interface, and connected to the PL end of the management SOC through the GT interface; the extranet FPGA is connected to the extranet through a 10G network port, connected to the algorithm FPGA and the PL end of the management SOC through a GT interface; the algorithm FPGA is connected to the intranet FPGA through an interface, connected to the extranet FPGA and the management SOC through a GT interface; the PL end of the management SOC is connected to the intranet FPGA through a GT interface, the PL end is connected to the extranet FPGA and the algorithm FPGA through a GT interface, and the PL end is connected to the extranet through a GT interface. The present invention reduces the risk of data leakage, achieves 10G network speed and reduces device power consumption.

Description

Technical Field

[0001] The present invention belongs to the technical field of electronic digital data processing, and more specifically, relates to a 10G IPsec device based on SOC and FPGA and a method thereof. Background Art

[0002] IPsec is a set of protocols and services that provide security for IP networks. IPsec devices can provide encryption and authentication services for data transmission, thereby preventing data from being eavesdropped or tampered with during transmission. Currently, 100M and 1000M IPsec devices are more common, but their speed is slow and can only cover simple usage scenarios. 10G IPsec devices are also available on the market, but they are large in size, high in power consumption, and expensive. There is an urgent need for a low-power, fast, and lightweight 10G IPsec device. At the same time, both parties of IPsec devices usually establish SAs through manual configuration, IKE negotiation, etc. to obtain the keys of encryption and authentication algorithms, but the encryption and authentication algorithms are usually not dynamically changed during the IPsec working process, which poses a risk of data leakage to a certain extent.

[0003] Chinese patent document CN112286862A discloses a data transmission platform and transmission method based on SOC and FPGA. The platform consists of a main control board, a signal acquisition board, and a signal processing board, which are interconnected through a backplane bus. The key components of the data transmission platform on the main control board are implemented as follows: Zynq-7000SOC and FPGAxcvu095 exchange data through the AXI bus, and FPGAxcvu095 is equipped with a 5GB DDR4 chip for temporary data caching or storage. Zynq-7000SOC is interconnected with the PC at the outside of the device through Gigabit Ethernet to realize data acquisition and data upload at the PC end. The signal acquisition board provides raw data to the main control board, and the signal acquisition board and the main control board are interconnected through the backplane bus, and the protocol interface is Serdes. The signal processing board receives data sent by the main control board, and the signal processing board and the main control board are interconnected through the backplane bus, and the protocol interface is Serdes. The effect is to realize an efficient data transmission platform, reduce the difficulty of product design, reduce the cost of hardware selection, make full use of chip resources, and cleverly realize two-way data transmission, but it can still only achieve gigabit transmission.

[0004] In view of this, the present invention designs a 10G IPsec device based on SOC and FPGA and a method thereof to reduce the risk of data leakage, achieve 10G network speed and reduce device power consumption. Summary of the invention

[0005] The present invention aims to overcome at least one defect of the above-mentioned prior art and provide a 10G IPsec device based on SOC and FPGA, which adopts a dual-network isolation architecture and supports dynamic replacement algorithm to ensure data security and ensure low power consumption on the basis of realizing 10G IPsec processing.

[0006] The invention also discloses a method of 10G IPsec equipment based on SOC and FPGA.

[0007] The detailed technical scheme of the present invention is as follows:

[0008] A 10G IPsec device based on SOC and FPGA, the device comprising an intranet FPGA, an extranet FPGA, an algorithm FPGA and a management SOC;

[0009] The intranet FPGA is connected to the intranet through a group of 10 Gigabit network ports for transmitting intranet data; connected to the algorithm FPGA through a group of GT interfaces for transmitting algorithm plaintext data; connected to the management SOC through two groups of GT interfaces for transmitting outbound and inbound security policy database SPD query data respectively;

[0010] The external network FPGA is connected to the external network through a 10 Gigabit network port for transmitting data from the external network; is connected to the algorithm FPGA through a group of GT interfaces for transmitting ciphertext data of the algorithm; is connected to the PL end of the management SOC through a group of GT interfaces for forwarding IKE negotiation messages;

[0011] The algorithm FPGA is connected to the intranet FPGA through a group of GT interfaces to transmit the plaintext data of the algorithm; connected to the external network FPGA through a group of GT interfaces to transmit the ciphertext data of the algorithm; connected to the management SOC through two groups of GT interfaces to transmit the query data of the outbound and inbound security association database SAD respectively; connected to the management SOC through a group of GT signals to transmit IKE negotiation and algorithm-related data;

[0012] The management SOC includes a PL end and a PS end. The PL end is connected to the intranet FPGA through two groups of GT interfaces, which are used to transmit the query data of the outbound SPD and the inbound SPD respectively; the PL end is connected to the algorithm FPGA through two groups of GT interfaces, which are used to transmit the query data of the outbound SAD and the inbound SAD respectively; the PL end is connected to the external network FPGA through one group of GT interfaces, which is used to forward IKE negotiation messages;

[0013] Preferably, according to the present invention, the intranet FPGA includes a hardware network protocol stack, an outbound SPD query module, and an inbound SPD query module.

[0014] Preferably according to the present invention, the algorithm FPGA includes an outbound SAD query module, an outbound ESP encapsulation module, an outbound algorithm core allocation module, an outbound ESP calculation module, an outbound packet sequence maintenance module, an inbound SAD query module, an inbound algorithm core allocation module, an inbound ESP calculation module, an inbound packet sequence maintenance module, and an inbound ESP decapsulation module.

[0015] Preferably according to the present invention, the external network FPGA includes a hardware network protocol stack, an outbound ESP message fragmentation module, and an inbound ESP message reassembly module.

[0016] Preferably according to the present invention, the management SOC includes a PL end and a PS end, the PL end includes an outbound SPD module, an inbound SPD module, an outbound SAD module, an inbound SAD module, an algorithm self-check module, and an IKE message processing module; the PS end includes a CPU, which is responsible for executing IKE negotiation interaction, SAD management, SPD management, and local configuration.

[0017] On the PS side of the management SOC, the interaction of the IKE negotiation refers to the processing of IKE negotiation data, including the processing of the two stages of IKE negotiation; the SAD management refers to the establishment, update and deletion of outbound and inbound SADs; the SPD management refers to the establishment, update and deletion of outbound and inbound SPDs; the local configuration refers to receiving the configuration information of the IPsec device.

[0018] A method for a 10G IPsec device based on the SOC and FPGA, the method comprising an outbound process and an inbound process, wherein:

[0019] The outbound process includes the following steps:

[0020] S1, the 10G Ethernet port of the intranet FPGA receives the intranet message and sends it to the hardware network protocol stack of the intranet FPGA;

[0021] S2, the hardware network protocol stack of the intranet FPGA parses the message into five tuples and performs abnormal message detection;

[0022] S3, the outbound SPD query module of the intranet FPGA queries the outbound SPD module of the management SOC PL for the current message. The possible results of the query are using IPsec processing, bypassing IPsec, and discarding;

[0023] S4. If the query result of the outbound SPD module is to use IPsec processing, the outbound SAD query module of the algorithm FPGA queries the outbound SAD module of the management SOC PL end for the current message to check whether there is a valid outbound security association SA; if no valid outbound security association SA is found, the current message is discarded and IKE negotiation is initiated;

[0024] S5, the outbound ESP encapsulation module of the algorithm FPGA encapsulates the current message according to the queried security association SA;

[0025] S6. The outbound algorithm core allocation module of the algorithm FPGA allocates an idle algorithm core to the encapsulated message according to the algorithm type in the outbound security association SA, and writes the number of the algorithm core as a new field into the message header to label the message;

[0026] S7, the outbound ESP calculation module of the algorithm FPGA performs authentication calculation and encryption calculation on the message at the same time;

[0027] S8. After the algorithm core calculation is completed, the packet sequence maintenance module dynamically adjusts the output sequence of each algorithm core channel according to the label to keep the packet sequence unchanged, and then transmits the message to the external network FPGA;

[0028] S9, the ESP message fragmentation module of the external network FPGA fragments the ESP message whose length exceeds the maximum transmission unit MTU, and allows other messages to pass through;

[0029] S10. The hardware network protocol stack of the external network FPGA outputs the message to the external network through the 10 Gigabit network port of the external network FPGA.

[0030] The inbound process includes the following steps:

[0031] S1, the 10G network port of the external network FPGA receives the external network message and sends it to the hardware network protocol stack of the external network FPGA;

[0032] S2. The hardware network protocol stack of the external network FPGA parses the fields in the message header and performs abnormal message detection; if the message is an IKE negotiation message, the message is forwarded to the IKE message processing module of the management SOC PL end; if the message is not an IKE negotiation message, the message is sent to the ESP message reassembly module of the external network FPGA;

[0033] S3. The ESP message reassembly module of the external network FPGA does not process non-ESP messages or non-fragmented ESP messages, and allows them to pass through. If the message is a fragmented ESP message, the ESP message reassembly module reassembles the fragmented ESP message and then sends it to the algorithm FPGA.

[0034] S4. If it is a non-fragmented ESP message, it directly enters the inbound SAD query module in the algorithm FPGA to query the inbound SAD module of the management SOC PL end for the current message. For messages that cannot find a valid inbound security association SA, they are discarded; if it is a non-ESP message, it directly passes through the inbound SAD query module;

[0035] S5. The inbound algorithm core allocation module of the algorithm FPGA allocates an idle algorithm core to the current message according to the algorithm type in the inbound security association SA, and writes the number of the algorithm core as a new field into the message header, thereby labeling the message;

[0036] S6, the inbound ESP calculation module of the algorithm FPGA performs authentication calculation and decryption calculation on the message at the same time, and discards the message that fails the authentication; if it is a non-ESP message, it directly passes through the inbound ESP calculation module;

[0037] S7, the inbound packet sequence maintenance module of the algorithm FPGA dynamically adjusts the output sequence of each algorithm core channel according to the label to keep the packet sequence unchanged;

[0038] S8, the inbound ESP decapsulation module of the algorithm FPGA performs five-tuple parsing on the message and re-encapsulates it into the network message format; if it is a non-ESP message, it directly passes through the inbound ESP message decapsulation module;

[0039] S9, the inbound SPD query module of the intranet FPGA queries the inbound SPD module of the management SOC PL end for the current message, and the possible results of the query are pass or discard;

[0040] S10. The hardware network protocol stack of the intranet FPGA outputs the message passed by the inbound SPD module to the intranet through the 10 Gigabit network port.

[0041] Preferably, according to the present invention, the IKE negotiation refers to two IPsec devices generating a security association SA through IKE message interaction, and the IKE negotiation is processed in the CPU of the management SOC PS end, including a process of the management SOC PS end CPU receiving a negotiation message and a process of the management SOC PS end CPU sending a negotiation message:

[0042] The process of the PS-side CPU of the management SOC receiving the negotiation message is as follows:

[0043] S1, the 10G network port of the external network FPGA receives the external network message and sends it to the hardware network protocol stack of the external network FPGA;

[0044] S2, the hardware network protocol stack of the external network FPGA parses and detects the message; if the message is an IKE negotiation message, it forwards the message to the IKE message processing module of the management SOC PL end;

[0045] S3, the IKE message processing module managing the SOC PL side parses the message and forwards the payload part of the message to the CPU of the PS side through DMA;

[0046] The process of the PS-side CPU that manages the SOC sending negotiation messages is as follows:

[0047] S1, the management SOC PS sends the IKE negotiation data to the IKE message processing module of the PL through DMA;

[0048] S2, the IKE message processing module managing the SOC PL end encapsulates the IKE data as a payload into a network message and sends it to the external network FPGA;

[0049] S3. The hardware network protocol stack of the external network FPGA outputs the message to the external network through the 10 Gigabit network port of the external network FPGA.

[0050] Compared with the prior art, the present invention has the following beneficial effects:

[0051] (1) The present invention adopts a dual-network isolation architecture based on FPGA; the algorithm FPGA and management SOC are isolated from the intranet by using the intranet FPGA, and the algorithm FPGA and management SOC are isolated from the extranet by using the extranet FPGA, so as to prevent sensitive resources such as algorithms and keys (concentrated in the algorithm FPGA and management SOC) from being exposed to the intranet and extranet.

[0052] (2) Conventional IPsec devices cannot change algorithms or can only change algorithms through local configuration. The present invention can dynamically change algorithms. In the algorithm FPGA, the corresponding encryption algorithm and authentication algorithm are matched according to the algorithm type in the queried SA, so that the algorithm in the IPsec processing process is in a dynamic change state during long-term operation, further reducing the risk of data leakage and having high security.

[0053] (3) The present invention achieves the line speed of 10 Gigabit network. The protocol parsing and encapsulation in the internal and external network FPGAs of the present invention are completed by hardware, and a multi-level pipeline cache mechanism is adopted to enable the internal network FPGA and the external network FPGA to fully match the line speed of 10 Gigabit network; in the algorithm FPGA, the parallel processing characteristics of FPGA are utilized, and multiple algorithm cores are integrated to work together. At the same time, the algorithm core allocation module and the packet sequence maintenance module are used to ensure the packet sequence of the message, thereby achieving the line speed of 10 Gigabit network.

[0054] (4) The present invention uses three FPGAs and one SOC, which reduces the power consumption of the device. Traditional 10G IPsec devices mostly adopt the server architecture of "multi-core CPU + 10G network card". The "3FPGA + SOC" architecture of the device of the present invention has the advantage of low power consumption of FPGA, so the present invention has a huge advantage in power consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1The present invention discloses an overall functional block diagram of a 10G IPsec device based on SOC and FPGA. DETAILED DESCRIPTION

[0056] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0057] Embodiment 1,

[0058] Ginseng Figure 1 , This embodiment provides a 10G IPsec device based on SOC and FPGA, the device includes an intranet FPGA, an extranet FPGA, an algorithm FPGA and a management SOC;

[0059] The intranet FPGA is connected to the intranet through a group of 10 Gigabit network ports for transmitting intranet data; connected to the algorithm FPGA through a group of GT interfaces for transmitting algorithm plaintext data; connected to the management SOC through two groups of GT interfaces for transmitting outbound and inbound security policy database SPD query data respectively;

[0060] The external network FPGA is connected to the external network through a 10 Gigabit network port for transmitting data from the external network; is connected to the algorithm FPGA through a group of GT interfaces for transmitting ciphertext data of the algorithm; is connected to the PL end of the management SOC through a group of GT interfaces for forwarding IKE negotiation messages;

[0061] The algorithm FPGA is connected to the intranet FPGA through a group of GT interfaces to transmit the plaintext data of the algorithm; connected to the external network FPGA through a group of GT interfaces to transmit the ciphertext data of the algorithm; connected to the management SOC through two groups of GT interfaces to transmit the query data of the outbound and inbound security association database SAD respectively; connected to the management SOC through a group of GT signals to transmit IKE negotiation and algorithm-related data;

[0062] The management SOC includes a PL end and a PS end. The PL end is connected to the intranet FPGA through two groups of GT interfaces, which are used to transmit the query data of the outbound SPD and the inbound SPD respectively; the PL end is connected to the algorithm FPGA through two groups of GT interfaces, which are used to transmit the query data of the outbound SAD and the inbound SAD respectively; the PL end is connected to the external network FPGA through one group of GT interfaces, which is used to forward IKE negotiation messages;

[0063] The intranet FPGA includes a hardware network protocol stack, an outbound SPD query module, and an inbound SPD query module.

[0064] The algorithm FPGA includes an outbound SAD query module, an outbound ESP encapsulation module, an outbound algorithm core allocation module, an outbound ESP calculation module, an outbound packet sequence maintenance module, an inbound SAD query module, an inbound algorithm core allocation module, an inbound ESP calculation module, an inbound packet sequence maintenance module, and an inbound ESP decapsulation module.

[0065] The external network FPGA includes a hardware network protocol stack, an outbound ESP message fragmentation module, and an inbound ESP message reassembly module.

[0066] The management SOC includes a PL end and a PS end. The PL end includes an outbound SPD module, an inbound SPD module, an outbound SAD module, an inbound SAD module, an algorithm self-check module, and an IKE message processing module; the PS end includes a CPU, which is responsible for executing IKE negotiation interaction, SAD management, SPD management, and local configuration.

[0067] On the PS side of the management SOC, the interaction of the IKE negotiation refers to the processing of IKE negotiation data, including the processing of the two stages of IKE negotiation; the SAD management refers to the establishment, update and deletion of outbound and inbound SADs; the SPD management refers to the establishment, update and deletion of outbound and inbound SPDs; the local configuration refers to receiving the configuration information of the IPsec device.

[0068] Embodiment 2,

[0069] A method for a 10G IPsec device based on SOC and FPGA, the method is as follows:

[0070] In the present invention, the process of sending data from the intranet to the external network is called "outbound", and the process of sending data from the external network to the intranet is called "inbound".

[0071] Ginseng Figure 1 , the outbound process includes the following steps:

[0072] S1, the 10G Ethernet port of the intranet FPGA receives the intranet message and sends it to the hardware network protocol stack of the intranet FPGA;

[0073] S2, the hardware network protocol stack of the intranet FPGA parses the message into five tuples and performs abnormal message detection;

[0074] S3, the outbound SPD query module of the intranet FPGA queries the outbound SPD module of the management SOC PL for the current message. The possible results of the query are using IPsec processing, bypassing IPsec, and discarding;

[0075] S4. If the query result of the outbound SPD module is to use IPsec processing, the outbound SAD query module of the algorithm FPGA queries the outbound SAD module of the management SOC PL end for the current message to check whether there is a valid outbound security association SA; if no valid outbound security association SA is found, the current message is discarded and IKE negotiation is initiated;

[0076] S5, the outbound ESP encapsulation module of the algorithm FPGA encapsulates the current message according to the queried security association SA;

[0077] S6. The outbound algorithm core allocation module of the algorithm FPGA allocates an algorithm core in an idle state to the encapsulated message according to the algorithm type in the outbound security association SA. Among them, multiple algorithm cores work at the same time, and some algorithm cores may not have finished processing the message and are still in the working state, and some algorithm cores have finished processing the message and entered the idle state; at the same time, the number of the algorithm core is written as a new field into the message header to label the message;

[0078] S7, the outbound ESP calculation module of the algorithm FPGA performs authentication calculation and encryption calculation on the message at the same time;

[0079] S8. After the algorithm core calculation is completed, the packet sequence maintenance module dynamically adjusts the output sequence of each algorithm core channel according to the label to keep the packet sequence unchanged, and then transmits the message to the external network FPGA;

[0080] S9, the ESP message fragmentation module of the external network FPGA fragments the ESP message whose length exceeds the maximum transmission unit MTU, and allows other messages to pass through;

[0081] S10. The hardware network protocol stack of the external network FPGA outputs the message to the external network through the 10 Gigabit network port of the external network FPGA.

[0082] The inbound process includes the following steps:

[0083] S1, the 10G network port of the external network FPGA receives the external network message and sends it to the hardware network protocol stack of the external network FPGA;

[0084] S2. The hardware network protocol stack of the external network FPGA parses the fields in the message header and performs abnormal message detection; if the message is an IKE negotiation message, the message is forwarded to the IKE message processing module of the management SOC PL end; if the message is not an IKE negotiation message, the message is sent to the ESP message reassembly module of the external network FPGA;

[0085] S3. The ESP message reassembly module of the external network FPGA does not process non-ESP messages or non-fragmented ESP messages, and allows them to pass through. If the message is a fragmented ESP message, the ESP message reassembly module reassembles the fragmented ESP message and then sends it to the algorithm FPGA.

[0086] S4. If it is a non-fragmented ESP message, it directly enters the inbound SAD query module in the algorithm FPGA to query the inbound SAD module of the management SOC PL end for the current message. For messages that cannot find a valid inbound security association SA, they are discarded; if it is a non-ESP message, it directly passes through the inbound SAD query module;

[0087] S5. The inbound algorithm core allocation module of the algorithm FPGA allocates an idle algorithm core to the current message according to the algorithm type in the inbound security association SA, and writes the number of the algorithm core as a new field into the message header, thereby labeling the message;

[0088] S6, the inbound ESP calculation module of the algorithm FPGA performs authentication calculation and decryption calculation on the message at the same time, and discards the message that fails the authentication; if it is a non-ESP message, it directly passes through the inbound ESP calculation module;

[0089] S7, the inbound packet sequence maintenance module of the algorithm FPGA dynamically adjusts the output sequence of each algorithm core channel according to the label to keep the packet sequence unchanged;

[0090] S8, the inbound ESP decapsulation module of the algorithm FPGA performs five-tuple parsing on the message and re-encapsulates it into the network message format; if it is a non-ESP message, it directly passes through the inbound ESP message decapsulation module;

[0091] S9, the inbound SPD query module of the intranet FPGA queries the inbound SPD module of the management SOC PL end for the current message, and the possible results of the query are pass or discard;

[0092] S10. The hardware network protocol stack of the intranet FPGA outputs the message passed by the inbound SPD module to the intranet through the 10 Gigabit network port.

[0093] The IKE negotiation refers to the generation of a security association SA by two IPsec devices through IKE message interaction. The IKE negotiation is processed in the CPU of the management SOC PS side, including the process of the management SOC PS side CPU receiving the negotiation message and the process of the management SOC PS side CPU sending the negotiation message:

[0094] The process of the PS-side CPU of the management SOC receiving the negotiation message is as follows:

[0095] S1, the 10G network port of the external network FPGA receives the external network message and sends it to the hardware network protocol stack of the external network FPGA;

[0096] S2, the hardware network protocol stack of the external network FPGA parses and detects the message; if the message is an IKE negotiation message, it forwards the message to the IKE message processing module of the management SOC PL end;

[0097] S3, the IKE message processing module managing the SOC PL side parses the message and forwards the payload part of the message to the CPU of the PS side through DMA;

[0098] The process of the PS-side CPU that manages the SOC sending negotiation messages is as follows:

[0099] S1, the management SOC PS sends the IKE negotiation data to the IKE message processing module of the PL through DMA;

[0100] S2, the IKE message processing module managing the SOC PL end encapsulates the IKE data as a payload into a network message and sends it to the external network FPGA;

[0101] S3. The hardware network protocol stack of the external network FPGA outputs the message to the external network through the 10 Gigabit network port of the external network FPGA.

[0102] The content of the security association SA includes the IPsec mode, namely the tunnel mode and the transmission mode, the security parameter index SPI, the algorithm type, the algorithm key, the sequence number SN, the SA life cycle, and the anti-replay window; the security association SA is obtained by the PS-side CPU of the management SOC executing IKE negotiation, and the SPD is also established, updated, and deleted by the PS-side CPU of the management SOC.

Claims

1. A 10G IPsec device based on SOC and FPGA, characterized in that: The equipment includes an intranet FPGA, an extranet FPGA, an algorithm FPGA, and a management SOC; The intranet FPGA is connected to the intranet through a group of 10 Gigabit network ports for transmitting intranet data; connected to the algorithm FPGA through a group of GT interfaces for transmitting algorithm plaintext data; connected to the management SOC through two groups of GT interfaces for transmitting outbound and inbound security policy database SPD query data respectively; The external network FPGA is connected to the external network through a 10 Gigabit network port for transmitting data from the external network; is connected to the algorithm FPGA through a group of GT interfaces for transmitting ciphertext data of the algorithm; is connected to the PL end of the management SOC through a group of GT interfaces for forwarding IKE negotiation messages; The algorithm FPGA is connected to the intranet FPGA through a group of GT interfaces to transmit the plaintext data of the algorithm; connected to the external network FPGA through a group of GT interfaces to transmit the ciphertext data of the algorithm; connected to the management SOC through two groups of GT interfaces to transmit the query data of the outbound and inbound security association database SAD respectively; connected to the management SOC through a group of GT signals to transmit IKE negotiation and algorithm-related data; The management SOC includes a PL end and a PS end. The PL end is connected to the intranet FPGA through two groups of GT interfaces, which are used to transmit the query data of the outbound SPD and the inbound SPD respectively; The PL end is connected to the algorithm FPGA through two groups of GT interfaces, which are used to transmit the query data of outbound SAD and inbound SAD respectively; The PL end is connected to the external network FPGA through a group of GT interfaces to forward IKE negotiation messages.

2. A 10G IPsec device based on SOC and FPGA according to claim 1, characterized in that The intranet FPGA includes a hardware network protocol stack, an outbound SPD query module, and an inbound SPD query module.

3. The 10G IPsec device based on SOC and FPGA according to claim 2, characterized in that: The algorithm FPGA includes an outbound SAD query module, an outbound ESP encapsulation module, an outbound algorithm core allocation module, an outbound ESP calculation module, an outbound packet sequence maintenance module, an inbound SAD query module, an inbound algorithm core allocation module, an inbound ESP calculation module, an inbound packet sequence maintenance module, and an inbound ESP decapsulation module.

4. The 10G IPsec device based on SOC and FPGA according to claim 3, characterized in that: The external network FPGA includes a hardware network protocol stack, an outbound ESP message fragmentation module, and an inbound ESP message reassembly module.

5. The 10G IPsec device based on SOC and FPGA according to claim 4, characterized in that: The management SOC includes a PL end and a PS end, wherein the PL end includes an outbound SPD module, an inbound SPD module, an outbound SAD module, an inbound SAD module, an algorithm self-checking module, and an IKE message processing module; the PS end includes a CPU, which is responsible for executing IKE negotiation interaction, SAD management, SPD management, and local configuration; The interaction of the IKE negotiation refers to processing the IKE negotiation data, including processing of the two phases of the IKE negotiation; The SAD management refers to the establishment, update and deletion of outbound and inbound SADs; the SPD management refers to the establishment, update and deletion of outbound and inbound SPDs; the local configuration refers to receiving the configuration information of the IPsec device.

6. A method for using a 10G IPsec device based on SOC and FPGA as claimed in claim 1, characterized in that: The method includes an outbound process and an inbound process, wherein: The outbound process includes the following steps: S1, the 10G Ethernet port of the intranet FPGA receives the intranet message and sends it to the hardware network protocol stack of the intranet FPGA; S2, the hardware network protocol stack of the intranet FPGA parses the message into five tuples and performs abnormal message detection; S3, the outbound SPD query module of the intranet FPGA queries the outbound SPD module of the management SOC PL end for the current message; S4. If the query result of the outbound SPD module is to use IPsec processing, the outbound SAD query module of the algorithm FPGA queries the outbound SAD module of the management SOC PL end for the current message to check whether there is a valid outbound security association SA; if no valid outbound security association SA is found, the current message is discarded and IKE negotiation is initiated; S5, the outbound ESP encapsulation module of the algorithm FPGA encapsulates the current message according to the queried security association SA; S6. The outbound algorithm core allocation module of the algorithm FPGA allocates an idle algorithm core to the encapsulated message according to the algorithm type in the outbound security association SA, and writes the number of the algorithm core as a new field into the message header to label the message; S7, the outbound ESP calculation module of the algorithm FPGA performs authentication calculation and encryption calculation on the message at the same time; S8. After the algorithm core calculation is completed, the packet sequence maintenance module dynamically adjusts the output sequence of each algorithm core channel according to the label to keep the packet sequence unchanged, and then transmits the message to the external network FPGA; S9, the ESP message fragmentation module of the external network FPGA fragments the ESP message whose length exceeds the maximum transmission unit MTU, and allows other messages to pass through; S10, the hardware network protocol stack of the external network FPGA outputs the message to the external network through the 10 Gigabit network port of the external network FPGA; The inbound process includes the following steps: S1, the 10G network port of the external network FPGA receives the external network message and sends it to the hardware network protocol stack of the external network FPGA; S2. The hardware network protocol stack of the external network FPGA parses the fields in the message header and performs abnormal message detection; if the message is an IKE negotiation message, the message is forwarded to the IKE message processing module of the management SOC PL end; if the message is not an IKE negotiation message, the message is sent to the ESP message reassembly module of the external network FPGA; S3. If the message is a fragmented ESP message, the ESP message reassembly module reassembles the fragmented ESP message and then sends it to the algorithm FPGA; S4. If it is a non-fragmented ESP message, it directly enters the inbound SAD query module in the algorithm FPGA to query the inbound SAD module of the management SOC PL end for the current message. For messages that cannot find a valid inbound security association SA, they are discarded; if it is a non-ESP message, it directly passes through the inbound SAD query module; S5. The inbound algorithm core allocation module of the algorithm FPGA allocates an idle algorithm core to the current message according to the algorithm type in the inbound security association SA, and writes the number of the algorithm core as a new field into the message header, thereby labeling the message; S6, the inbound ESP calculation module of the algorithm FPGA performs authentication calculation and decryption calculation on the message at the same time, and discards the message that fails the authentication; if it is a non-ESP message, it directly passes through the inbound ESP calculation module; S7, the inbound packet sequence maintenance module of the algorithm FPGA dynamically adjusts the output sequence of each algorithm core channel according to the label to keep the packet sequence unchanged; S8, the inbound ESP decapsulation module of the algorithm FPGA performs five-tuple parsing on the message and re-encapsulates it into the network message format; if it is a non-ESP message, it directly passes through the inbound ESP message decapsulation module; S9, the inbound SPD query module of the intranet FPGA queries the inbound SPD module of the management SOC PL end for the current message, and the possible results of the query are pass or discard; S10. The hardware network protocol stack of the intranet FPGA outputs the message passed by the inbound SPD module to the intranet through the 10 Gigabit network port.

7. The method of a 10G IPsec device based on SOC and FPGA according to claim 6, characterized in that: The IKE negotiation refers to the generation of a security association SA by two IPsec devices through IKE message interaction. The IKE negotiation is processed in the CPU of the management SOC PS side, including the process of the management SOC PS side CPU receiving the negotiation message and the process of the management SOC PS side CPU sending the negotiation message: The process of the PS-side CPU of the management SOC receiving the negotiation message is as follows: S1, the 10G network port of the external network FPGA receives the external network message and sends it to the hardware network protocol stack of the external network FPGA; S2, the hardware network protocol stack of the external network FPGA parses and detects the message; if the message is an IKE negotiation message, it forwards the message to the IKE message processing module of the management SOC PL end; S3, the IKE message processing module managing the SOC PL side parses the message and forwards the payload part of the message to the CPU of the PS side through DMA; The process of the PS-side CPU that manages the SOC sending negotiation messages is as follows: S1, the management SOC PS sends the IKE negotiation data to the IKE message processing module of the PL through DMA; S2, the IKE message processing module managing the SOC PL end encapsulates the IKE data as a payload into a network message and sends it to the external network FPGA; S3. The hardware network protocol stack of the external network FPGA outputs the message to the external network through the 10 Gigabit network port of the external network FPGA.

Images