基于多核处理器的IPSec VPN系统安全策略检索研究  

Security policy searching method research of IPSec VPN based on multicore network processor

作　　者：陈亮[1] 王建[1] 赵勇[1] 

机构地区：[1]西安工程大学计算机科学学院,西安710048

出　　处：《计算机工程与应用》2017年第23期67-71,共5页Computer Engineering and Applications

基　　金：陕西省工业攻关计划(No.2014K05-43);陕西省教育厅专项科研计划(No.14JK1310);西安市技术转移促进工程项目(No.CXY1439(1))

摘　　要：为满足现代高带宽互联网应用环境中的安全性保障要求,提出了一种基于Tilera GX36多核网络处理平台的IPSec VPN系统结构,利用SDN思想设计了系统控制面和数据面的程序功能模块,实现网络流量安全的灵活控制。针对系统中安全策略检索性能要求,提出一种基于Hash的三级安全策略流表存储结构,并以各Tile CPU缓存中的安全关联流表为快速检索数据源设计一种安全策略检索方法。测试结果表明,对于互联网中典型的小包、中包和大包应用场景,该系统均能达到近40 Gb/s的处理性能。In order to meet the security requirements of modern high bandwidth Internet application environment, an IPSec VPN architecture based on Tilera GX36 multi-core network processor is proposed, and program function modules of control plane and data plane are designed according to SDN architecture to achieve flexible security control on network traffic. To meet the security strategy retrieval performance requirement, a three-level security policy flow-table structure based on Hash algorithm is put forward, and a security policy search method is designed using security association flowtable cached on tile CPUs as fast retrieval data source. The test results show that the system can achieve the processing performance in 40 Gb/s Internet applications under the typical short, medium and long package-length circumstance.

关 键 词：多核网络处理器 Tilera GX36 IPSEC VPN 安全策略检索 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]