High-speed IPSec gateway optimization method and device based on combination of VPP and FPGA

Abstract

The invention discloses a high-speed IPSec gateway optimization method and device based on combination of a VPP and an FPGA, and the method comprises the steps: receiving a data packet from a network card drive program through a VPP processing module in a CPU, and carrying out the primary processing; the VPP processing module identifies the data stream processed by the IPSec to form a target data packet; the VPP processing module triggers an IKE daemon process according to a security policy matching result, performs IKE negotiation and creates data transmission security association; the VPP processing module preprocesses a target data packet needing to be encrypted and decrypted and transmits the target data packet to the FPGA through the 10-gigabit network card chip / PCIe channel; the FPGA carries out encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the target data packet, and returns the processed target data packet to the CPU; and the CPU performs recombination processing according to the fragmentation state of the target data packet, and forwards the target data packet to the application program for subsequent processing. According to the invention, the problems of performance bottleneck and security of the existing IPSec gateway equipment are solved, and an efficient and safe data encryption and decryption solution is provided.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to a high-speed IPSec gateway optimization method and device based on the combination of VPP and FPGA. Background Art

[0002] With the continuous growth of network security needs, IPSec (Internet Protocol Security) has become an important means to protect network communications.

[0003] At present, traditional IPSec implementations usually rely on the CPU for encryption and decryption operations and process data packets through the operating system kernel protocol stack. However, this approach has gradually exposed the following significant deficiencies in high-bandwidth, low-latency application scenarios:

[0004] First, packet processing is delayed and system throughput is low; packet processing in the operating system kernel protocol stack introduces additional context switching and system call overhead, resulting in higher packet processing latency; when the CPU processes a large number of encryption / decryption operations, computing resources will be heavily occupied, affecting the overall system throughput. For example, in a 10Gbps network environment, traditional CPUs may not be able to meet the needs of real-time processing.

[0005] Second, security is low; performing encryption and decryption operations on the CPU may increase the risk of sensitive data exposure, especially in a multi-tasking environment, where malware or unauthorized access may lead to key leakage; encryption and decryption operations on the CPU are vulnerable to side-channel attacks, such as cache attacks and timing attacks, which can exploit the microarchitecture characteristics of the CPU to steal key information.

[0006] Third, the scalability is poor. As network bandwidth continues to increase, the processing power of traditional CPUs has gradually become a bottleneck, while the cost of upgrading the CPU is high and the effect is limited.

[0007] Fourth, the energy consumption is high; when the CPU is processing a large number of encryption / decryption operations, the power consumption is high, especially in large-scale applications such as data centers, the energy consumption problem is particularly prominent.

[0008] Therefore, how to invent a high-speed IPSec gateway optimization method to solve the obvious performance bottlenecks, security issues, poor scalability and high energy consumption of IPSec gateway devices in high-bandwidth, low-latency application scenarios has become an urgent problem to be solved. Summary of the invention

[0009] To this end, the present invention provides a high-speed IPSec gateway optimization method and device based on the combination of VPP and FPGA. By combining VPP and FPGA technology, the performance bottleneck and security issues of existing IPSec gateway devices in high-bandwidth, low-latency application scenarios are solved, and an efficient and secure data encryption and decryption solution is provided.

[0010] In order to achieve the above object, the present invention provides the following technical solution: a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA, comprising:

[0011] The data packet is transmitted to the CPU through the physical network interface. The VPP processing module in the CPU receives the data packet from the network card driver and performs preliminary processing on the data packet. The VPP processing module identifies the data stream processed by IPSec from the data packet after preliminary processing according to the set rules to form a target data packet. The VPP processing module triggers the IKE daemon process and performs IKE negotiation according to the security policy matching result of the target data packet. A data transmission security association is created through the IKE negotiation. The VPP processing module pre-processes the target data packet that needs to be encrypted and decrypted, and transmits the pre-processed target data packet to the FPGA through the 10G network card chip / PCIe channel.

[0012] The FPGA performs encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the received target data packet; the FPGA returns the target data packet after the encryption and decryption processing to the CPU;

[0013] The CPU reassembles the target data packet according to the fragmentation status of the target data packet; the CPU forwards the reassembled target data packet to the application program for subsequent processing.

[0014] As a preferred solution of a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA, in the process of the VPP processing module performing preliminary processing on the data packet, the preliminary processing includes classification and filtering processing.

[0015] As a preferred solution of a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA, during the IKE negotiation performed by the VPP processing module, the IKE negotiation process includes a first IKE negotiation stage and a second IKE negotiation stage;

[0016] In the first IKE negotiation phase, the IPSec gateway device and the external communication device authenticate each other through a pre-shared key and a digital certificate; after the identity authentication is completed, a shared key is generated by setting a key exchange policy; the VPP processing module creates a protection communication security association;

[0017] In the second IKE negotiation phase, the VPP processing module constructs a data transmission security association according to the communication security association; and the VPP processing module distributes key materials in the data transmission security association to the IPSec module.

[0018] As a preferred solution of a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA, in the process of FPGA performing encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the received target data packet, if the target data packet is an outbound data packet, the FPGA uses the encryption algorithm set in the ESP / AH protocol to encrypt the target data packet; if the target data packet is an inbound data packet, the FPGA uses the decryption algorithm set in the ESP / AH protocol to decrypt the target data packet.

[0019] As a preferred solution of a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA, when the CPU reassembles the target data packet according to the fragmentation status of the target data packet, if the target data packet has been fragmented before encryption and decryption, the CPU reassembles the target data packet; if the target data packet has not been fragmented before encryption and decryption, the CPU forwards the target data packet.

[0020] The present invention also provides a high-speed IPSec gateway optimization device based on the combination of VPP and FPGA, based on the above high-speed IPSec gateway optimization method based on the combination of VPP and FPGA, including:

[0021] The CPU processing unit is used to transfer the data packet to the CPU through the physical network interface. The VPP processing module in the CPU receives the data packet from the network card driver and performs preliminary processing on the data packet. The VPP processing module identifies the data stream processed by IPSec from the data packet after preliminary processing according to the set rules to form a target data packet. The VPP processing module triggers the IKE daemon process according to the security policy matching result of the target data packet to perform IKE negotiation. A data transmission security association is created through the IKE negotiation. The VPP processing module pre-processes the target data packet that needs to be encrypted and decrypted, and transfers the pre-processed target data packet to the FPGA through the 10G network card chip / PCIe channel. After receiving the target data packet that has completed the encryption and decryption processing, the CPU reassembles the target data packet according to the fragmentation status of the target data packet. The CPU forwards the reassembled target data packet to the application for subsequent processing.

[0022] The FPGA processing unit is used for the FPGA to perform encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the received target data packet; the FPGA returns the target data packet after the encryption and decryption processing to the CPU.

[0023] As a preferred solution of a high-speed IPSec gateway optimization device based on the combination of VPP and FPGA, in the CPU processing unit, during the process in which the VPP processing module performs preliminary processing on the data packet, the preliminary processing includes classification and filtering processing.

[0024] As a preferred solution of a high-speed IPSec gateway optimization device based on the combination of VPP and FPGA, in the CPU processing unit, during the IKE negotiation performed by the VPP processing module, the IKE negotiation process includes a first IKE negotiation stage and a second IKE negotiation stage;

[0025] In the first IKE negotiation phase, the IPSec gateway device and the external communication device authenticate each other through a pre-shared key and a digital certificate; after the identity authentication is completed, a shared key is generated by setting a key exchange policy; the VPP processing module creates a protection communication security association;

[0026] In the second IKE negotiation phase, the VPP processing module constructs a data transmission security association according to the communication security association; and the VPP processing module distributes key materials in the data transmission security association to the IPSec module.

[0027] As a preferred solution of a high-speed IPSec gateway optimization device based on the combination of VPP and FPGA, in the FPGA processing unit, when the FPGA performs encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the received target data packet, if the target data packet is an outbound data packet, the FPGA uses the encryption algorithm set in the ESP / AH protocol to encrypt the target data packet; if the target data packet is an inbound data packet, the FPGA uses the decryption algorithm set in the ESP / AH protocol to decrypt the target data packet.

[0028] As a preferred solution of a high-speed IPSec gateway optimization device based on the combination of VPP and FPGA, in the CPU processing unit, when the CPU reassembles the target data packet according to the fragmentation status of the target data packet, if the target data packet has been fragmented before encryption and decryption, the CPU reassembles the target data packet; if the target data packet has not been fragmented before encryption and decryption, the CPU forwards the target data packet.

[0029] The present invention has the following advantages: the present invention has a high VPP performance for processing network data packets. In a traditional solution without VPP, the average throughput can usually only reach about 5Gbps in a 10Gbps network environment, and the delay may be as high as tens of microseconds. After using VPP, the delay of data packet processing is significantly reduced, and the average throughput is much higher than the traditional solution, close to the line speed. The present invention has a high FPGA processing encryption and decryption performance. The FPGA implements efficient encryption algorithms such as AES and DES through a hardware accelerator. In a 10Gbps network environment, the FPGA can process encryption and decryption operations at a speed close to the line speed, and the average throughput is significantly higher than the traditional CPU solution, and the delay is also greatly reduced. The present invention improves the comprehensive performance of the IPSec gateway. The solution combining VPP and FPGA can achieve an overall throughput close to the line speed in a 10Gbps network environment, and the total delay is controlled within a few microseconds, which is significantly better than the traditional solution based on the CPU and kernel protocol stack. The present invention has high security. By isolating the encryption and decryption process to the FPGA, the risk of sensitive data exposure is reduced, and the security of the system is improved. The parallel processing capability and dedicated hardware accelerator of the FPGA make the system more resistant to side channel attacks, such as cache attacks and time attacks. The present invention has strong flexibility and is easy to update and expand: FPGA can be configured and optimized according to different encryption algorithms and security requirements, which is convenient for future function expansion and algorithm update. At the same time, it has good scalability and can adapt to changes in future network bandwidth and security requirements. The present invention has low energy consumption, and the parallel processing capability of FPGA makes it more energy-efficient than CPU when processing encryption and decryption tasks, reducing the energy consumption of the overall system. By combining VPP and FPGA technology, the present invention solves the performance bottleneck and security problems of existing IPSec equipment in high-bandwidth, low-latency application scenarios, and provides an efficient and secure data encryption and decryption solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0031] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment in size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0032] Figure 1 This is an application scenario of a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA provided in Embodiment 1 of the present invention;

[0033] Figure 2 A schematic flow chart of a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA provided in Embodiment 1 of the present invention;

[0034] Figure 3 This is a schematic diagram of the IPSec negotiation process provided in Example 1 of the present invention;

[0035] Figure 4 After the IPSec negotiation provided in Embodiment 1 of the present invention is completed, the encryption and decryption process that the service data needs to go through after entering from the network card;

[0036] Figure 5 This is a schematic diagram of the architecture of a high-speed IPSec gateway optimization device based on the combination of VPP and FPGA provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0037] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] See also Figure 1 , illustrates the overall architecture of the IPSec system, including the main components and the interaction between the components. The IPSec system architecture consists of a CPU processing unit and an FPGA hardware accelerator to achieve efficient and secure communication. The components include:

[0039] First, the CPU processing unit. The functions of the CPU processing unit are as follows:

[0040] a1) Data preprocessing: responsible for receiving the original data packets and performing preliminary processing.

[0041] b1) Memory read and write: Perform necessary memory operations to support data packet processing.

[0042] c1) SA management and key distribution: Manage and maintain security associations (SAs), and be responsible for the generation and distribution of key materials.

[0043] d1) IKE daemon: As an independently running software entity, it handles the Internet Key Exchange Protocol (IKE) negotiation process and provides security for establishing IPSec tunnels.

[0044] e1) IPSec processing module: performs the core functions in the IPSec protocol stack, including but not limited to the encryption / decryption of Encapsulating Security Payload (ESP), the calculation of Authentication Header (AH), and the selection and application of SAs.

[0045] f1) IKE negotiation: Participate in the negotiation process of IKE phase 1 and phase 2 to ensure that both parties can securely exchange key information and establish and maintain security associations.

[0046] Second, the 10G network card / PcLe channel is used to transmit data packets between the CPU and FPGA at high speed to ensure low-latency data exchange.

[0047] Third, FPGA, the functions of FPGA are as follows:

[0048] a2) Key and data reception: Receive the data packet to be encrypted / decrypted and the corresponding key information from the CPU.

[0049] b2) Data encryption and decryption engine: uses the received key information to perform encryption or decryption operations on data packets.

[0050] Example 1

[0051] See also Figure 2 Embodiment 1 of the present invention provides a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA, comprising the following steps:

[0052] S1, the CPU receives and processes the data packet and creates a data transmission security association; the CPU passes the processed target data packet to the FPGA;

[0053] S2, FPGA performs encryption and decryption processing on the target data packet, and returns the target data packet after encryption and decryption processing to the CPU;

[0054] S3. The CPU reassembles and forwards the target data packet.

[0055] In this embodiment, in step S1, the CPU receives and processes the data packet and creates a data transmission security association; the CPU transmits the processed target data packet to the FPGA;

[0056] Specifically, the CPU processes the data packet in the following steps:

[0057] S11, the VPP initialization module in the CPU initializes the VPP processing module;

[0058] S12, the VPP processing module processes the data packet;

[0059] Specifically, the VPP processing module processes the data packet in the following steps:

[0060] S121, the data packet is transmitted to the CPU through the physical network interface, the VPP processing module in the CPU receives the data packet from the network card driver, and performs preliminary processing on the data packet;

[0061] Specifically, the data packet reaches the CPU through the physical network interface (10 Gigabit network card), and the VPP processing module receives the data packet directly from the network card driver, bypassing the traditional kernel network stack; after receiving the data packet, the VPP processing module performs preliminary processing on the data packet, such as classification and filtering.

[0062] S122, the VPP processing module identifies the data flow processed by IPSec from the data packet after preliminary processing according to the set rules to form a target data packet;

[0063] S123, the VPP processing module triggers the IKE daemon process according to the security policy matching result of the target data packet, and performs IKE negotiation; and creates a data transmission security association through the IKE negotiation;

[0064] Specifically, if the security policy matches successfully and there is no corresponding security association or the existing security association has expired / invalid, the VPP processing module will trigger the IKE daemon and start IKE negotiation.

[0065] The IKE negotiation process includes the first IKE negotiation phase and the second IKE negotiation phase;

[0066] In the first IKE negotiation phase, both parties authenticate each other through a pre-shared key and a digital certificate; after the identity authentication is completed, the VPP processing module generates a shared key by setting a key exchange strategy; the VPP processing module creates a security association for protecting communications;

[0067] In the second IKE negotiation phase, the VPP processing module constructs a data transmission security association according to the communication security association; and the VPP processing module distributes key materials in the data transmission security association to the IPSec module.

[0068] S124, the VPP processing module pre-processes the target data packet that needs to be encrypted and decrypted, and transmits the pre-processed target data packet to the FPGA through the 10 Gigabit network card chip / PCIe channel;

[0069] Specifically, if the target data packet needs to be encrypted and decrypted, the VPP processing module pre-processes the target data packet that needs to be encrypted and decrypted, and transmits the pre-processed target data packet and related key materials and security parameters to the FPGA through the 10G network card chip / PCIe channel;

[0070] The preprocessing of the target data packet includes fragmentation reorganization, verification and calculation, and other processing.

[0071] S125, the VPP processing module continuously monitors and maintains the status of the data transmission security association; the IKE daemon continuously monitors the validity of the communication security association and renegotiates the communication security association before it expires.

[0072] Specifically, the VPP processing module continuously monitors and maintains the status of data transmission security associations, and renegotiates new SAs when necessary to ensure the security of the connection. The IKE daemon continuously monitors the validity of communication security associations and renegotiates before the communication security association expires.

[0073] S13. The FPGA initialization module in the CPU initializes the FPGA processing module.

[0074] In one possible embodiment, see Figure 3 , illustrates the IPSec negotiation process, from the network card receiving the request data to the VPP bypassing the kernel state to receive the data, and then to the negotiation of the key and policy. This process usually involves the IKE protocol to establish a security association (SA):

[0075] A1. Data packet arrival: Data packets arrive at the system through the physical network interface (10 Gigabit network card).

[0076] A2.VPP packet processing:

[0077] a3) VPP receives packets directly from the NIC driver, bypassing the traditional kernel network stack.

[0078] b3) VPP performs preliminary processing on data packets, such as classification and filtering.

[0079] A3. Identify IPSec traffic: VPP identifies data flows that require IPSec processing based on preset rules or policies.

[0080] A4. Trigger IKE negotiation: If it is a new connection or the existing security association has expired / invalid, VPP will trigger the IKE daemon to start IKE negotiation.

[0081] A5.IKE Phase 1:

[0082] a4) Authentication: Both parties use pre-shared keys (PSK), digital certificates, etc. to authenticate each other’s identities.

[0083] b4) Key exchange: Generate a shared key using the Diffie-Hellman algorithm or other key exchange techniques.

[0084] c4) Establish IKE SA: Create a security association (IKE SA) to protect subsequent communications, including parameters such as encryption algorithm, hash function, life cycle, etc.

[0085] A6.IKE Phase 2:

[0086] a5) Create IPSec SA: Based on IKE SA, both parties negotiate and establish a security association (IPSec SA) for actual data transmission, which includes the specific configuration of ESP / AH.

[0087] b5) Key distribution: Distribute the negotiated key material to relevant IPSec modules.

[0088] A7.Continuous monitoring and maintenance:

[0089] a6) The program continuously monitors the status of the IPSec SA and renegotiates a new SA when necessary to ensure the security of the connection.

[0090] b6) The IKE daemon periodically checks the validity of the IKE SA and renegotiates before it expires.

[0091] A8. End the session: When the IPSec tunnel is no longer needed, you can terminate it manually or wait for it to expire and close automatically.

[0092] In this embodiment, in step S2, the FPGA performs encryption and decryption processing on the target data packet, and returns the target data packet after the encryption and decryption processing to the CPU;

[0093] Specifically, the steps for FPGA to encrypt and decrypt the target data packet are as follows:

[0094] S21, FPGA performs encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the received target data packet;

[0095] Specifically, if the target data packet is an outbound data packet, the FPGA uses the encryption algorithm set in the ESP / AH protocol to encrypt the target data packet; if the target data packet is an inbound data packet, the FPGA uses the decryption algorithm set in the ESP / AH protocol to decrypt the target data packet.

[0096] S22, FPGA returns the target data packet after encryption and decryption processing to the CPU.

[0097] In this embodiment, in step S3, the CPU reassembles and forwards the target data packet.

[0098] Specifically, if the target data packet has been fragmented before encryption and decryption, the CPU reassembles the target data packet; if the target data packet has not been fragmented before encryption and decryption, the CPU forwards the target data packet.

[0099] Among them, during the process of CPU forwarding the target data packet, if the target data packet is an encrypted outbound data packet, it is forwarded back to the network card through VPP and sent to the target network; if the target data packet is a decrypted inbound data packet, it is forwarded to the corresponding application or further processed through VPP.

[0100] In one possible embodiment, see Figure 4 , which shows the encryption and decryption process that business data needs to go through after entering the network card after IPSec negotiation is completed:

[0101] B1. Data packet arrival: Business data packets arrive at the system through the physical network interface (10 Gigabit network card).

[0102] B2.VPP data packet processing:

[0103] a7) VPP receives packets directly from the NIC driver, bypassing the traditional kernel network stack.

[0104] b7) VPP performs preliminary processing on the data packets, such as classification and filtering.

[0105] B3. Identify IPSec traffic:

[0106] a8) VPP identifies data flows that require IPSec processing based on preset rules or policies.

[0107] b8) If the data packet belongs to the established IPSecSA, proceed to the next step; otherwise, IKE negotiation needs to be re-triggered.

[0108] B4. Find the security association (SA):

[0109] a9) VPP queries the existing IPSecSA database to find a security association that matches the data flow.

[0110] b9) Security association includes information such as encryption algorithm, authentication algorithm, key material, etc.

[0111] B5. Packet preprocessing: Perform necessary preprocessing on the data packet, such as fragmentation reassembly, checksum calculation, etc.

[0112] B6. Data packet transmission to FPGA:

[0113] a10) VPP transmits the data packets that need to be encrypted and decrypted to FPGA through the 10G network card chip / PCIe channel.

[0114] b10) At the same time, VPP passes the relevant key materials and security parameters to FPGA.

[0115] B7.FPGA data encryption and decryption:

[0116] a11) Encryption: If the data packet is an outbound data packet (about to be sent out), the FPGA encrypts the data packet using the encryption algorithm specified in the ESP / AH protocol (such as AES).

[0117] i. Calculate an authentication code (such as HMAC-SHA256) to ensure data integrity.

[0118] ii. Encapsulate the encrypted data packet and add an ESP header or AH header.

[0119] b11) Decryption: If the data packet is an inbound data packet (i.e., just received), the FPGA decrypts the data packet using the decryption algorithm specified in the ESP / AH protocol.

[0120] i. Verify the authentication code to ensure data integrity and has not been tampered with.

[0121] ii. Remove the ESP header or AH header and restore the original data packet.

[0122] B8. Data packet returns to CPU:

[0123] a12) The encrypted or decrypted data packets are transmitted from the FPGA back to the CPU through the 10G network card chip / PCIe channel.

[0124] b12) VPP receives the processed data packet.

[0125] B9. Packet reassembly: If the data packet was fragmented before encryption, the decrypted data packet now needs to be reassembled into a complete data packet.

[0126] B10. Packet forwarding:

[0127] a13) The encrypted outbound data packet is forwarded back to the network card through VPP and sent to the target network.

[0128] b13) The decrypted inbound data packets are forwarded to the corresponding applications or further processed through VPP.

[0129] B11. Continuous monitoring and maintenance:

[0130] a14) The system continuously monitors the status of IPSec SA and renegotiates a new SA when necessary to ensure the security of the connection.

[0131] b14) The IKE daemon periodically checks the validity of the IKESA and renegotiates before it expires.

[0132] In one possible embodiment, VPP is used as the data plane to process network data packets in an efficient manner in user space, bypassing the operating system kernel protocol stack and reducing the delay of data packet processing. Design and implement an FPGA module for IPSec encryption and decryption, and use the parallel processing capability of FPGA to perform efficient encryption and decryption operations. Develop an efficient communication mechanism so that the CPU can quickly pass data packets to FPGA for encryption and decryption processing and receive the processing results. Specific communication means may include PCIe, 10 Gigabit network card chips, etc. Implement support for IKEv1 or IKEv2 protocols in the VPP framework to establish and manage IPSec SA. This can be achieved through a VPP plug-in or by calling an external IKE daemon (such as strongSwan). Keep the control plane (IKE negotiation) and the data plane (data packet processing) separate to ensure that the two can work independently but can work effectively together. Develop a custom driver or library to simplify the communication interface between the CPU and FPGA and provide a unified API for VPP to call. When the FPGA completes the processing, it notifies the CPU through an interrupt so that the CPU can obtain the processing results in a timely manner.

[0133] In summary, the present invention has a high VPP performance in processing network data packets. In a 10Gbps network environment, the average throughput of the traditional solution without VPP can usually only reach about 5Gbps, and the delay may be as high as tens of microseconds. After using VPP, the delay of data packet processing is significantly reduced, and the average throughput is much higher than the traditional solution, close to the line speed. The present invention has a high FPGA processing encryption and decryption performance. The FPGA implements efficient encryption algorithms such as AES and DES through a hardware accelerator. In a 10Gbps network environment, the FPGA can process encryption and decryption operations at a speed close to the line speed, and the average throughput is significantly higher than the traditional CPU solution, and the delay is also greatly reduced. The present invention improves the comprehensive performance of the IPSec gateway. The solution combining VPP and FPGA can achieve an overall throughput close to the line speed in a 10Gbps network environment, and the total delay is controlled within a few microseconds, which is significantly better than the traditional solution based on the CPU and kernel protocol stack. The present invention has high security. By isolating the encryption and decryption process to the FPGA, the risk of sensitive data exposure is reduced and the security of the system is improved. The parallel processing capability and dedicated hardware accelerator of the FPGA make the system more resistant to side channel attacks, such as cache attacks and time attacks. The present invention has strong flexibility and is easy to update and expand: FPGA can be configured and optimized according to different encryption algorithms and security requirements, which is convenient for future function expansion and algorithm update. At the same time, it has good scalability and can adapt to changes in future network bandwidth and security requirements. The present invention has low energy consumption, and the parallel processing capability of FPGA makes it more energy-efficient than CPU when processing encryption and decryption tasks, reducing the energy consumption of the overall system. By combining VPP and FPGA technology, the present invention solves the performance bottleneck and security problems of existing IPSec equipment in high-bandwidth, low-latency application scenarios, and provides an efficient and secure data encryption and decryption solution.

[0134] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0135] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0136] Example 2

[0137] See also Figure 5 Embodiment 2 of the present invention further provides a high-speed IPSec gateway optimization device based on the combination of VPP and FPGA, including:

[0138] CPU processing unit 001 is used to transmit data packets to CPU through physical network interface, and VPP processing module in CPU receives the data packets from network card driver and performs preliminary processing on the data packets; the VPP processing module identifies the data stream processed by IPSec from the data packets after preliminary processing according to set rules to form target data packets; the VPP processing module triggers IKE daemon process and performs IKE negotiation according to the security policy matching result of the target data packets; creates data transmission security association through IKE negotiation; the VPP processing module pre-processes the target data packets that need to be encrypted and decrypted, and transmits the pre-processed target data packets to FPGA through 10G network card chip / PCIe channel; after receiving the target data packets that have completed encryption and decryption processing, the CPU reassembles the target data packets according to the fragmentation status of the target data packets; the CPU forwards the reassembled target data packets to the application for subsequent processing;

[0139] The FPGA processing unit 002 is used for the FPGA to perform encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the received target data packet; the FPGA returns the target data packet after the encryption and decryption processing to the CPU.

[0140] In this embodiment, in the CPU processing unit 001, the data packet processing module includes:

[0141] VPP initialization module 011, used to initialize the VPP processing module;

[0142] VPP processing module 012, used for processing data packets;

[0143] Among them, in the VPP processing module 012, the submodule for processing the data packet includes:

[0144] The data packet preliminary processing submodule 0121 is used to transfer the data packet to the CPU through the physical network interface, and the VPP processing module in the CPU receives the data packet from the network card driver and performs preliminary processing on the data packet;

[0145] The data flow identification submodule 0122 is used for the VPP processing module to identify the data flow processed by IPSec from the data packet after preliminary processing according to the set rules to form a target data packet;

[0146] IKE negotiation submodule 0123, used for the VPP processing module to trigger the IKE daemon process and perform IKE negotiation according to the security policy matching result of the target data packet;

[0147] The data packet preprocessing submodule 0124, the VPP processing module preprocesses the target data packet that needs to be encrypted and decrypted, and transmits the preprocessed target data packet to the FPGA through the 10G network card chip / PCIe channel;

[0148] The monitoring and maintenance submodule 0125 is used for the VPP processing module to continuously monitor and maintain the status of the data transmission security association; the IKE daemon process continuously monitors the validity of the communication security association and renegotiates the communication security association before it expires;

[0149] The data packet reassembly submodule 0126 is used for the CPU to reassemble the target data packet according to the fragmentation status of the target data packet;

[0150] The data packet forwarding submodule 0127 is used for the CPU to forward the target data packet after the reorganization process to the application program for subsequent processing.

[0151] The FPGA initialization module 013 is used to initialize the FPGA processing module.

[0152] In this embodiment, in the FPGA processing unit 002, the module for performing encryption and decryption processing on the data packet includes:

[0153] The encryption and decryption processing module 021 is used to perform encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the received target data packet;

[0154] The data packet returning module 022 is used to return the target data packet that has completed the encryption and decryption processing to the CPU.

[0155] In this embodiment, in the data packet preliminary processing submodule 0121 of the CPU processing unit 001, during the process in which the VPP processing module performs preliminary processing on the data packet, the preliminary processing includes classification and filtering processing.

[0156] In this embodiment, in the IKE negotiation submodule 0123 of the CPU processing unit 001, during the process of the VPP processing module performing IKE negotiation, the IKE negotiation process includes a first IKE negotiation phase and a second IKE negotiation phase;

[0157] In the first IKE negotiation phase, the IPSec gateway device and the external communication device authenticate each other through a pre-shared key and a digital certificate; after the identity authentication is completed, a shared key is generated by setting a key exchange policy; the VPP processing module creates a protection communication security association;

[0158] In the second IKE negotiation phase, the VPP processing module constructs a data transmission security association according to the communication security association; and the VPP processing module distributes key materials in the data transmission security association to the IPSec module.

[0159] In this embodiment, in the encryption and decryption processing module 021 of the FPGA processing unit 002, when the FPGA performs encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the received target data packet, if the target data packet is an outbound data packet, the FPGA uses the encryption algorithm set in the ESP / AH protocol to encrypt the target data packet; if the target data packet is an inbound data packet, the FPGA uses the decryption algorithm set in the ESP / AH protocol to decrypt the target data packet.

[0160] In this embodiment, in the data packet reassembly submodule 0125 of the CPU processing unit 001, when the CPU reassembles the target data packet according to the fragmentation status of the target data packet, if the target data packet has been fragmented before encryption and decryption, the CPU reassembles the target data packet; if the target data packet has not been fragmented before encryption and decryption, the CPU forwards the target data packet.

[0161] It should be noted that the information interaction, execution process and other contents between the modules of the above-mentioned system are based on the same concept as the method embodiment in Example 1 of the present application, and the technical effects they bring are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown above in the present application, and will not be repeated here.

[0162] Example 3

[0163] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which a program code of a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA is stored, and the program code includes instructions for executing embodiment 1 or any possible implementation method thereof, a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA.

[0164] The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0165] Example 4

[0166] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0167] The processor and the memory communicate with each other through a bus; the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA in embodiment 1 or any possible implementation thereof.

[0168] Specifically, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor implemented by reading software codes stored in a memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0169] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable systems. The computer instructions can be stored in a computer-readable storage medium, or transmitted from a computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0170] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing system, they can be concentrated on a single computing system, or distributed on a network composed of multiple computing systems, and optionally, they can be implemented by a program code executable by a computing system, so that they can be stored in a storage system and executed by the computing system, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0171] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A high-speed IPSec gateway optimization method based on VPP and FPGA, characterized in that: include: The data packet is transmitted to the CPU through the physical network interface, and the VPP processing module in the CPU receives the data packet from the network card driver and performs preliminary processing on the data packet; The VPP processing module identifies the data flow processed by IPSec from the data packet after preliminary processing according to the set rules to form a target data packet; The VPP processing module triggers the IKE daemon process to perform IKE negotiation according to the security policy matching result of the target data packet; Creating a data transmission security association through the IKE negotiation; The VPP processing module pre-processes the target data packet that needs to be encrypted and decrypted, and transmits the pre-processed target data packet to the FPGA through the 10G network card chip / PCIe channel; The FPGA performs encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the received target data packet; the FPGA returns the target data packet after the encryption and decryption processing to the CPU; The CPU reassembles the target data packet according to the fragmentation status of the target data packet; the CPU forwards the reassembled target data packet to the application program for subsequent processing.

2. According to claim 1, a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA is characterized in that: In the process that the VPP processing module performs preliminary processing on the data packet, the preliminary processing includes classification and filtering processing.

3. According to claim 2, a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA is characterized in that: During the IKE negotiation performed by the VPP processing module, the IKE negotiation process includes a first IKE negotiation phase and a second IKE negotiation phase; In the first IKE negotiation phase, the IPSec gateway device and the external communication device perform identity authentication through a pre-shared key and a digital certificate to authenticate each other's identity; After identity authentication is completed, a shared key is generated by setting a key exchange strategy; the VPP processing module creates a protection communication security association; In the second IKE negotiation phase, the VPP processing module constructs a data transmission security association according to the communication security association; and the VPP processing module distributes key materials in the data transmission security association to the IPSec module.

4. According to claim 3, a high-speed IPSec gateway optimization method based on the combination of VPP and FPGA is characterized in that: In the process of FPGA performing encryption and decryption processing by setting the encryption and decryption algorithm according to the type of the received target data packet, if the target data packet is an outbound data packet, the FPGA uses the encryption algorithm set in the ESP / AH protocol to encrypt the target data packet; if the target data packet is an inbound data packet, the FPGA uses the decryption algorithm set in the ESP / AH protocol to decrypt the target data packet.

5. A high-speed IPSec gateway optimization method based on the combination of VPP and FPGA according to claim 4, characterized in that: In the process of the CPU reassembling the target data packet according to the fragmentation status of the target data packet, if the target data packet has been fragmented before encryption and decryption, the CPU reassembles the target data packet; if the target data packet has not been fragmented before encryption and decryption, the CPU forwards the target data packet.

6. A high-speed IPSec gateway optimization device based on the combination of VPP and FPGA, using the high-speed IPSec gateway optimization method based on the combination of VPP and FPGA as described in any one of claims 1-5, characterized in that: include: A CPU processing unit is used to transmit a data packet to the CPU through a physical network interface. A VPP processing module in the CPU receives the data packet from a network card driver and performs preliminary processing on the data packet. The VPP processing module identifies a data stream processed by IPSec from the data packet after preliminary processing according to a set rule to form a target data packet. The VPP processing module triggers the IKE daemon process to perform IKE negotiation according to the security policy matching result of the target data packet; Creating a data transmission security association through the IKE negotiation; The VPP processing module pre-processes the target data packet that needs to be encrypted and decrypted, and transmits the pre-processed target data packet to the FPGA through the 10G network card chip / PCIe channel; After receiving the target data packet that has completed the encryption and decryption processing, the CPU reassembles the target data packet according to the fragmentation status of the target data packet; The CPU forwards the reassembled target data packet to the application program for subsequent processing; The FPGA processing unit is used for the FPGA to perform encryption and decryption processing by setting an encryption and decryption algorithm according to the type of the received target data packet; the FPGA returns the target data packet after the encryption and decryption processing to the CPU.

7. A high-speed IPSec gateway optimization device based on the combination of VPP and FPGA according to claim 6, characterized in that: In the CPU processing unit, during the process in which the VPP processing module performs preliminary processing on the data packet, the preliminary processing includes classification and filtering processing.

8. A high-speed IPSec gateway optimization device based on the combination of VPP and FPGA according to claim 7, characterized in that: In the CPU processing unit, during the IKE negotiation performed by the VPP processing module, the IKE negotiation process includes a first IKE negotiation phase and a second IKE negotiation phase; In the first IKE negotiation phase, the IPSec gateway device and the external communication device perform identity authentication through a pre-shared key and a digital certificate to authenticate each other's identity; After identity authentication is completed, a shared key is generated by setting a key exchange strategy; the VPP processing module creates a protection communication security association; In the second IKE negotiation phase, the VPP processing module constructs a data transmission security association according to the communication security association; and the VPP processing module distributes key materials in the data transmission security association to the IPSec module.

9. A high-speed IPSec gateway optimization device based on the combination of VPP and FPGA according to claim 8, characterized in that: In the FPGA processing unit, when the FPGA performs encryption and decryption processing according to the type of the received target data packet by setting the encryption and decryption algorithm, if the target data packet is an outbound data packet, the FPGA uses the encryption algorithm set in the ESP / AH protocol to encrypt the target data packet; if the target data packet is an inbound data packet, the FPGA uses the decryption algorithm set in the ESP / AH protocol to decrypt the target data packet.

10. A high-speed IPSec gateway optimization device based on the combination of VPP and FPGA according to claim 9, characterized in that: In the CPU processing unit, when the CPU reassembles the target data packet according to the fragmentation status of the target data packet, if the target data packet has been fragmented before encryption and decryption, the CPU reassembles the target data packet; if the target data packet has not been fragmented before encryption and decryption, the CPU forwards the target data packet.

Images