Research And Implementation On IPSec ESP And AH Protocol On The IXP2850 Network Processor

Most of the application are based on IP(Internet Protocol) as Internet has become the infrastructure of information society. But IP protocol is not secure, there is only a 16 bits checksum in IP header to validate data integrity. IPSec(IP Security Protocol) provides a solution for protecting the security of communication. It deploys two sub-protocols to protect the integrity and confidentiality of communication, which are AH protocol(Authentication Header) and ESP protocol(Encapsulation Security Payload).Intel IXP2850 is the second-generation of high-speed programmable network processor. It deploys the architecture of distributed computing, multi-processor and multi-thread. Its programmability and high-speed processing ability provides a new hardware platform for network application development.The research of this dissertation is based on Sci-tech Planning Projects of Guangdong Province, "VPN System Integrated in 3G intelligent Firewall". This dissertation studies on the implementation of IPSec ESP and AH protocol on the IXP2850 network processor. It first gives the overall solution, then describes the SA look-up of ESP/AH processing block, outbound/inbound packet processsing and the IPsec dataflow. The whole system is tested with Spirent TestCenter network tester, the result shows the system has comprehensive ESP/AH function and carrier-grade processing performance.There are two main advantages of this research:1. The test result shows the system has a throughput of 8Gbps and a delay of about only 10 microsecond. This means it has carrier-grade processing performance.2. Compared with other ASIC(Application Specific Integrated Circuit) network processor, this system is programmable. We only need to modify the programm to satisfy new demand, and software algorithm can be optimized to enhance the performance.