基于多核处理器的IPSec VPN系统安全策略检索研究

Security policy searching method research of IPSec VPN based on multicore network processor

为满足现代高带宽互联网应用环境中的安全性保障要求,提出了一种基于Tilera GX36多核网络处理平台的IPSec VPN系统结构,利用SDN思想设计了系统控制面和数据面的程序功能模块,实现网络流量安全的灵活控制。针对系统中安全策略检索性能要求,提出一种基于Hash的三级安全策略流表存储结构,并以各Tile CPU缓存中的安全关联流表为快速检索数据源设计一种安全策略检索方法。测试结果表明,对于互联网中典型的小包、中包和大包应用场景,该系统均能达到近40 Gb/s的处理性能。

In order to meet the security requirements of modern high bandwidth Internet application environment, an IPSec VPN architecture based on Tilera GX36 multi-core network processor is proposed, and program function modules of control plane and data plane are designed according to SDN architecture to achieve flexible security control on network traffic. To meet the security strategy retrieval performance requirement, a three-level security policy flow-table structure based on Hash algorithm is put forward, and a security policy search method is designed using security association flowtable cached on tile CPUs as fast retrieval data source. The test results show that the system can achieve the processing performance in 40 Gb/s Internet applications under the typical short, medium and long package-length circumstance.