基于FPGA的安全策略搜索设计与实现  

Design and Implementation of Security Policy Search Based on FPGA

作　　者：吴云军 温玉屏 纪巍 魏华 WU Yunjun;WEN Yuping;JI Wei;WEI Hua(The Second Military Representative Office of Rocket Army Equipment Department in Wuhan,Wuhan 430000;Wuhan Maritime Communication Institute,Wuhan 430205)

机构地区：[1]火箭军装备部驻武汉地区第二军事代表室,武汉430000 [2]武汉船舶通信研究所,武汉430205

出　　处：《舰船电子工程》2022年第7期116-120,共5页Ship Electronic Engineering

摘　　要：在网络通信日益发达的今天,通信安全变得越来越重要。Ipsec在IP层对IP报文提供安全服务来保证IP数据包的完整性、私有性和真实性。在IPsec协议实现过程中如何快速地根据报文特征搜索到相应的安全策略是影响高速网络数据包处理性能的关键技术。目前TCAM芯片以其优异的性能广泛用于Ipsec协议的安全策略搜索,但是TCAM存在造价高且功耗高的缺点。针对微型IPsec设备体积小、功耗低的特点,采用并行查找及流水线的思路,提出了一种基于FPGA的安全策略搜索设计方法,该方法不仅实现简单且易于扩展,可实现1K条以上的模糊安全策略搜索,性能达到1Gbps以上。该设计在FPGA上已经实现,经过仿真测试性能达到设计目标。With the development of network communication,communication security becomes more and more important.IP⁃Sec provides security services for IP packets in IP layer to ensure the integrity,privacy and authenticity of IP packets.In the process of implementing IPSec protocol,how to quickly search the corresponding security policy according to the message characteristics is the key technology that affects the packet processing performance of high-speed network.At present,TCAM chip is widely used in security policy search of IPSec protocol because of its excellent performance.However,TCAM has the disadvantages of high cost and high power consumption.Aiming at the small size and low power consumption of micro IPSec device,the paper presents a de⁃sign method of security policy search based on FPGA,which adopts the idea of parallel search and pipeline.This method is not only simple and easy to expand,but also can realize more than 1K security policy searches,with the performance of more than 1Gbps.The design has been implemented on FPGA,and the performance of simulation test has reached the design goal.

关 键 词：IPSEC TCAM 安全策略 FPGA 

分 类 号：TN911[电子电信—通信与信息系统]