A 10 Gbit/s IPSEC Gateway Implementation

Internet Security (IPSEC) protocol is part of a design consideration in Virtual Private Networks (VPN). In this paper, we design and implement a 10 Gbit/s gateway router for IPSEC processing using the Intel network processor IXP2850. In particular, using software and hardware partitioning on a complex multi processor system, i.e., selecting appropriate processors to offload computational intensive tasks, we are able to accelerate the IPSEC data path. We also highlight the performance issues with IPSEC protocol implementation using the cryptography engines in IXP2850, and propose efficient data structure for key management in the buffer when large number of security associations are re-keyed at line speed. Key-Words: IPSEC hardware support, virtual private networks, network processor, high-speed networks