Feasibility of FPGA accelerated IPsec on cloud

Vajaranta, Markku; Oinonen, Arto; Hämäläinen, Timo D.; Viitamäki, Vili; Markunmäki, Jouni; Kulmala, Ari

doi:10.1016/j.micpro.2019.102861

Cited by 7 publications

(2 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While a VXLAN decapsulation offload may not take much area, this is only one example. Cloud applications may require emerging hardware offloads such as IPSec [15,41,80], which are area-demanding [117]. FLD can use them transparently in the NIC, without reimplementing them in the accelerator.…”

Section: Applicationsmentioning

confidence: 99%

FlexDriver: a network driver for your accelerator

Eran¹,

Fudim

Malka

et al. 2022

Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems

View full text Add to dashboard Cite

We propose a new system design for connecting hardware and FPGA accelerators to the network, allowing the accelerator to directly control commodity Network Interface Cards (NICs) without using the CPU. This enables us to solve the key challenge of leveraging existing NIC hardware offloads such as virtualization, tunneling, and RDMA for accelerator networking. Our approach supports a diverse set of use cases, from direct network access for disaggregated accelerators to inline-acceleration of the network stack, all without the complex networking logic in the accelerator.To demonstrate the feasibility of this approach, we build Flex-Driver (FLD), an on-accelerator hardware module that implements a NIC data-plane driver. Our main technical contribution is a mechanism that compresses the NIC control structures by two orders of magnitude, allowing FLD to achieve high networking scalability with low die area cost and no bandwidth interference with the accelerator logic.The prototype for NVIDIA Innova-2 FPGA SmartNICs showcases our design's utility for three different accelerators: a disaggregated LTE cipher, an IP-defragmentation inline accelerator, and an IoT cryptographic-token authentication offload. These accelerators reach 25 Gbps line rate and leverage the NIC for RDMA processing, VXLAN tunneling, and traffic shaping without CPU involvement. CCS CONCEPTS• Hardware → Hardware accelerators; Networking hardware; • Computer systems organization → Heterogeneous (hybrid) systems; Distributed architectures.

show abstract

Section: Applicationsmentioning

confidence: 99%

FlexDriver: a network driver for your accelerator

Eran¹,

Fudim

Malka

et al. 2022

Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems

View full text Add to dashboard Cite

show abstract

“…hardware accelerators are available as ASIC [68], [69], NPU [70], [71], accellerated processing unit (APU) [72], or FPGA [73], [74].…”

Section: ) Software Implementations With Hardware Accelerationmentioning

confidence: 99%

P4-IPsec: Site-to-Site and Host-to-Site VPN With IPsec in P4-Based SDN

et al. 2020

View full text Add to dashboard Cite

In this work, we present P4-IPsec, a concept for IPsec in software-defined networks (SDN) using P4 programmable data planes. The prototype implementation features ESP in tunnel mode and supports different cipher suites. P4-capable switches are programmed to serve as IPsec tunnel endpoints. We also provide a client agent to configure tunnel endpoints on Linux hosts so that site-to-site and host-tosite application scenarios can be supported which are the base for virtual private networks (VPNs). While traditional VPNs require complex key exchange protocols like IKE to set up and renew tunnel endpoints, P4-IPsec benefits from an SDN controller to accomplish these tasks. One goal of this experimental work is to investigate how well P4-IPsec can be implemented on existing P4 switches. We present a prototype for the BMv2 P4 software switch, evaluate its performance, and publish its source code on GitHub [1]. We explain why we could not provide a useful implementation with the NetFPGA SUME board. For the Edgecore Wedge 100BF-32X Tofino-based switch, we presented two prototype implementations to cope with a missing crypto unit. As another contribution of this paper, we provide technological background of P4 and IPsec and give a comprehensive review of security applications in P4, IPsec in SDN, and IPsec data plane implementations. According to our knowledge, P4-IPsec is the first implementation of IPsec for P4-based SDN.

show abstract

RETRACTED: Simulation of basketball motion image resolution based on FPGA and gaussian mixture model

Liu

2021

Microprocessors and Microsystems

View full text Add to dashboard Cite

Feasibility of FPGA accelerated IPsec on cloud

Cited by 7 publications

References 3 publications

FlexDriver: a network driver for your accelerator

FlexDriver: a network driver for your accelerator

P4-IPsec: Site-to-Site and Host-to-Site VPN With IPsec in P4-Based SDN

RETRACTED: Simulation of basketball motion image resolution based on FPGA and gaussian mixture model

Contact Info

Product

Resources

About