Contents 1 Introduction 1 1.1 Issues in Network Security and Performance 1 1.2 Previous Works 2 1.3 Proposed Scalable Architecture 3 1.4 Organization 3 2 IP Security (IPSec) 5 2.1 IP Security Overview 5 2.1.1 Security Services 6 2.2 Seucirty Assoication and Policy 6 2.2.1 Security Policy Database (SPD) 7 2.2.2 Security Association Database (SAD) 8 2.3 IPSec Protocol 9 2.3.1 Encapsulating Security Payload (ESP) 9 2.3.2 Transport Mode and Tunnel Mode 10 2.4 Packet Processing Flow 12 2.4.1 Outbound Processing Flow 12 2.4.2 Inbound Processing Flow 12 3 Proposed Architecture and Performance Analysis 16 3.1 Overall Architecture 16 3.2 Performance Analysis 17 3.2.1 IPSec Header Processing 17 3.2.2 CE Processing 19 3.2.2.1 AES 19 3.2.2.2 HMAC 20 3.2.2.3 Discussion with Different Packets Types 20 3.2.3 Data Transfer 21 3.2.3.1 AHB Bus Interconnection 21 3.2.3.2 Crypto-DMA Interconnection 25 3.2.3.3 Discussion 26 3.2.4 Overall Architecture Analysis 27 3.2.4.1 Packet Selection Method 27 3.2.4.2 Multi-IPSec Processing Block 28 3.2.4.3 Multi-Clock Domain 29 3.2.4.4 Discussion 30 4 Design and Implementation 31 4.1 Overall Architecture 31 4.1.1 Outbound Processing Flow 32 4.1.2 Inbound Processing Flow 33 4.2 Packet Buffer Module 40 4.2.1 Input Packet Buffer 40 4.2.2 Output Packet Buffer 43 4.3 SPD and SAD Module 43 4.4 IPSec Processing Block Module 44 4.4.1 Checksum Module 44 4.4.2 Anti-Replay Module 47 4.4.3 Main Controller Module 47 4.4.4 Flow Table 49 4.4.5 AHB Master Interface 51 4.5 Crypto-Engines (CEs) 54 4.5.1 Address Map 54 4.5.2 AES Engine 54 4.5.3 HMAC Engine 58 4.6 External Block Controller 59 5 Experimental Result 61 5.1 Design Flow 61 5.2 Simulation Flow 61 5.2.1 Source of Packet Information 61 5.2.2 Packet Generator 62 5.3 Simulation Results 62 5.3.1 Performance 63 5.3.2 Area 71 5.4 Analysis and Discussion 73 5.4.1 Analysis 73 5.4.2 Deviation and Improvement 73 5.5 Comparison with Commercial Products 73 6 Conclusion and Future Work 77 6.1 Conclusion 77 6.2 Future Work 78 List of Tables 3.1 Throughput of IPSec header processing19 3.2 The Throughput of AES20 3.3 The Throughput of HMAC21 3.4 The parameters of TSMC 0.13 um process standard cell22 3.5 The calculation result of bus gate delay for different Width and Kslave(ns) 23 3.6 The synthesis result of bus gate delay for different Width and Kslave(ns) 24 3.7 The synthesis result of max frequency for different Width and Kslave(MHz) 25 3.8 The synthesis result of throughput in single-layer bus for different Width and Kslave(Gbps) 25 3.9 The synthesis result of throughput in two-layer bus for different Width and Kslave(Gbps) 25 4.1 IO signals of SAD and SPD module 46 4.2 Signals of flow table 51 4.3 Relations between AHB master interface and packet flow 53 4.4 Address map of CE 55 4.5 Address map of CE (continued) 56 4.6 AES Control Register 57 4.7 HMAC Control Register 58 4.8 IO signals of external block controller 60 5.1 Throughput (Gbps) of simulation results between different MPBs and packets type 67 5.2 Area reduction and throughput reduction in different memory architectures 72 5.3 Comparison of throughput (Mbps) with BCM5841 for different packet sizes 74 5.4 Comparison of throughput (Mbps) with BCM5841 for different packet sizes (HMAC double version) 75 List of Figures 2.1 ESP packet format 10 2.2 IP packets protected by ESP in transport mode and tunnel mode 11 2.3 Outbound packet processing flow chart 13 2.4 Inbound packet processing flow chart 14 3.1 Proposed architecture for IPSec 16 3.2 Cycles of outbound and inbound processing 18 3.3 The overall CE throughput in best case 22 3.4 The overall CE throughput in worst case 22 3.5 Single-layer AHB interconnection method in proposed architecture 23 3.6 Two-layer AHB interconnection method in proposed architecture 24 3.7 Crypto-DMA interconnection method in proposed architecture 26 3.8 AHB data transfer throughput for different percentage of various packet types 27 3.9 Multi-IPSec processing block architecture 28 3.10 Overall architecture in multi-clock domain 29 4.1 Overall architecture 33 4.2 Outbound processing flow of Pre CE processing 34 4.3 Outbound processing flow of CE(AES) processing 34 4.4 Outbound processing flow of CE(HMAC) processing 35 4.5 Outbound processing flow of Post CE processing 35 4.6 Inbound processing flow of Pre CE 1 processing 37 4.7 Inbound processing flow of Pre CE 2 processing 37 4.8 Inbound processing flow of CE(HMAC) processing 38 4.9 Inbound processing flow of CE(AES) processing 38 4.10 Inbound processing flow of Post CE 1 processing 39 4.11 Inbound processing flow of Post CE 2 processing 39 4.12 Data structure of s packet (stored packet) module 41 4.13 Block diagram of input buffer module 41 4.14 Flow chart of packet selection method 42 4.15 Data structure of output buffer 43 4.16 Block diagram of output buffer module 44 4.17 Block diagram of SAD and SPD module 45 4.18 Block diagram of Checksum module 47 4.19 Block diagram of Anti-Replay module 48 4.20 Block diagram of Main Controller module 48 4.21 Finite State Machine (part1) of Main Controller module 49 4.22 Finite State Machine (part2) of Main Controller module 50 4.23 Finite state machine of AHB Master interface 52 4.24 Block diagram of AHB Master interface 52 4.25 Multi-layer AHB-Lite bus interface 53 4.26 External block controller 59 4.27 Round-Robin method graph 60 5.1 Simulation flow 62 5.2 Packet input format 63 5.3 Waveform that number of MPB is 1 64 5.4 Waveform that number of MPB is 8 64 5.5 Console screen of execution results 65 5.6 Console screen of execution results 65 5.7 Multi-clock domain in overall architecture 66 5.8 Simulation results between different number of MPBs and packets type 68 5.9 Performance of evaluation model for different packet type 68 5.10 Performance of simulation results for different packet type 69 5.11 Percentage of CEs block status 70 5.12 Graph of Percentage of CEs block status 70 5.13 Original memory architecture 71 5.14 SA sharing memory architecture 72 5.15 Comparison between BCM5841 for different packet sizes (HMAC double version) 75 5.16 SafeXcel-1842 Architecture Overview 76