A QUERY UNIT FOR THE IPSEC DATABASES

Alberto Ferrante, Sathish Chandra, Vincenzo Piuri

2007

Abstract

IPSec is a suite of protocols that adds security to communications at the IP level. Protocols within IPSec make extensive use of two databases, namely the Security Policy Database (SPD) and the Security Association Database (SAD). The ability to query the SPD quickly is fundamental as this operation needs to be done for each incoming or outgoing IP packet, even if no IPSec processing needs to be applied on it. This may easily result in millions of query per second in gigabit networks. Since the databases may be of several thousands of records on large secure gateways, a dedicated hardware solution is needed to support high throughput. In this paper we discuss an architecture for these query units, we propose different query methods for the two databases, and we compare them through simulation. Two different versions of the architecture are presented: the basic version is modified to support multithreading. As shown by the simulations, this technique is very effective in this case. The architecture that supports multithreading allows for 11 million queries per second in the best case.

References

  1. Alberto Ferrante, Giuseppe Piscopo, and Stefano Scaldaferri (2005a). Application-driven Optimization of VLIW Architectures: a Hardware-Software Approach. In Real-Time and Embedded Technology Applications, pages 128-137, San Francisco, CA, USA. IEEE Computer Society.
  2. Alberto Ferrante and Vincenzo Piuri (2007). High-level Architecture of an IPSec-dedicated System on Chip. In NGI 2007, Trondheim, Norway. IEEE Press.
  3. Alberto Ferrante, Vincenzo Piuri, and Jeff Owen (2005b). IPSec Hardware Resource Requirements Evaluation. In NGI 2005, Rome, Italy. EuroNGI.
  4. Ariga, S., Nagahashi, K., Minami, M., Esaki, H., and Murai, J. (2000). Performance Evaluation of Data Transmission Using IPSec Over IPv6 Networks. In INET, Yokohama, Japan.
  5. Feghhi, J. and Feghhi, J. (2001). Secure Networking with Windows 2000 and Trust Services. Addison Wesley.
  6. Harkins, D. and Carrell, D. (1998). The Internet Key Exchange (IKE) - RFC2409. IETF RFC.
  7. Henry Hong-Yi Tzeng and Tony Przygienda (1999). On Fast Address-Lookup Algorithms. IEEE Journal on Selected Areas in Communications, 17(6):1067-1082.
  8. John Hennessy and Dave Patterson (2002). Computer Architecture: a Quantitative Approach. Morgan Kaufmann Pub, 3rd edition.
  9. Kent, S. (2005a). IP Authentication Header - RFC4302. IETF RFC.
  10. Kent, S. (2005b). IP Encapsulating Security Payload (ESP) - RFC4303. IETF RFC.
  11. Kent, S. and Atkinson, R. (1998a). IP Authentication Header - RFC2402. IETF RFC.
  12. Kent, S. and Atkinson, R. (1998b). IP Encapsulating Security Payload (ESP) - RFC2406. IETF RFC.
  13. Kent, S. and Atkinson, R. (1998c). Security Architecture for the Internet Protocol - RFC2401. IETF RFC.
  14. Yuan, R. and Strayer, W. T. (2001). Virtual Private Networks. Addison Wesley.
Download


Paper Citation


in Harvard Style

Ferrante A., Chandra S. and Piuri V. (2007). A QUERY UNIT FOR THE IPSEC DATABASES . In Proceedings of the Second International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2007) ISBN 978-989-8111-12-8, pages 133-139. DOI: 10.5220/0002119901330139


in Bibtex Style

@conference{secrypt07,
author={Alberto Ferrante and Sathish Chandra and Vincenzo Piuri},
title={A QUERY UNIT FOR THE IPSEC DATABASES},
booktitle={Proceedings of the Second International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2007)},
year={2007},
pages={133-139},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0002119901330139},
isbn={978-989-8111-12-8},
}


in EndNote Style

TY - CONF
JO - Proceedings of the Second International Conference on Security and Cryptography - Volume 1: SECRYPT, (ICETE 2007)
TI - A QUERY UNIT FOR THE IPSEC DATABASES
SN - 978-989-8111-12-8
AU - Ferrante A.
AU - Chandra S.
AU - Piuri V.
PY - 2007
SP - 133
EP - 139
DO - 10.5220/0002119901330139