KR20200075723A - High-speed cryptographic communication system and method using data plane acceleration technology and hardware encryption processing device - Google Patents

Abstract

Disclosed are a high-speed cryptographic communication system using a data plane acceleration technology and a hardware encryption processing device, and a method thereof. According to an embodiment of the present invention, the high-speed cryptographic communication system comprises: a packet processing unit for processing a network packet received; a security processing unit connected in hardware to the packet processing unit and performing Internet protocol security (IPsec) on the processed network packet; and an acceleration unit which bypasses the kernel and delivers the network packet for which IPsec is performed by the security processing unit or the network packet processed by the packet processing unit to a user space application.

Description

High-speed cryptographic communication system and its method using data plane acceleration technology and hardware encryption processing device

The present invention relates to an ultra-fast cryptographic communication technology, and more specifically, by applying IPsec (IP security protocol) in an ultra-high-speed network environment using Data Plane Acceleration (DPA), it is possible to improve packet processing speed and security. It relates to a high-speed cryptographic communication system and method.

In modern times, due to the rapidly increasing online transactions and the expansion of various Internet services, many people can easily exchange information through the Internet. As the number of users and services on the Internet increases, cyber terrorism such as viruses or hacks that target them can threaten not only personal privacy information leakage but also national security. In addition, due to the increase in network communication, a need for a communication technology capable of rapidly processing a large amount of data increases.

However, it is very difficult to provide safe and high-speed data communication in a modern network environment. This is because the amount of work required to process each packet increases as security functions are strengthened for safety in a network environment.

Currently, the mainstream of Internet security is a virtual private network (VPN), a firewall, and an intrusion detection system. Among them, VPN uses a suitable encryption technology to form a channel through which the internal users of an organization can safely communicate with each other through the Internet (public network) and also provides access control functions necessary for security. Tunneling protocols used in VPNs include PPTP, L2TP, and IPsec. Currently, the most popular IPsec is an industry standard because it can provide a strong and flexible security environment, and the latest VPN security equipment should basically support it.

However, unlike a dedicated line, VPN is based on a public network that is difficult for the company to directly control, so it is important to guarantee QoS (Quality of Service), and when using IPsec, it is appropriate to reduce the overall network performance due to encryption and increase the maintenance cost. I need a solution. This is because IPsec basically needs to send packets larger than the size of the original data due to the encryption and key distribution for packet protection, and the throughput increases significantly due to the additional communication procedure for mutual authentication.

Recently, as the interface processing speed of many server/network equipment exceeded 10 Gbps, the server NIC connected to the interface of the network equipment also began to be replaced with 10 Gbps class equipment. More efficient packet processing is required for high-performance packet processing. However, the packet processing speed is limited due to the structural limitations of the packet processing method provided by the conventional OS.

In general, the existing interrupt-based packet processing method is known to require a 1Hz CPU cycle for 1-bit processing (transmission/reception). For example, two 2.5GHz CPU cores are required for 5Gbps packet processing. Several techniques have been proposed to overcome this limitation, but essentially still require high latency and high CPU utilization for packet processing.

In addition to this, problems such as context switching overhead, CPU cache rate degradation (performance degradation for MMU), duplicate memory copy between kernel space and user space, and lock structure used by shared resources in kernel network stack processing are scattered in the kernel. Doing. Because of these many bottlenecks, the kernel is unable to process packets as fast as the NIC supports.

Due to the ease of designing, implementing, modifying and updating, most security modules are made and used in software. IPsec also has many open source programs (FreeS/WAN, Openswan, strongSwan, etc.) that are implemented and provided like this. The problem, however, is that these programs are implemented in an operating system dependent fashion. Therefore, it is bound to be affected by the bottleneck caused by the operating system, and it is difficult to fully utilize computing resources for communication processing. In general, it is known that about 95% of CPU computing power is used when IPSec is implemented in software to implement a virtual private network function in a general-purpose server. Because of this problem, hardware devices that handle all or part of IPsec are used for some network equipment that requires high-speed processing or embedded equipment that has low computing power or no operating system.

SUMMARY Embodiments of the present invention provide an ultra-fast cryptographic communication system and method for improving packet processing speed and security by applying IPsec in an ultra-high-speed network environment using data plane acceleration (DPA).

A high-speed cryptographic communication system according to an embodiment of the present invention includes a packet processing unit for processing received network packets; A security processing unit hardware-connected to the packet processing unit and performing Internet protocol security (IPsec) for the processed network packets; And an accelerating unit that bypasses the kernel and transmits the network packet processed by the security processing unit to the Internet packet or the network packet processed by the packet processing unit to a user space application.

The security processing unit analyzes the header of the network packet processed by the packet processing unit to determine whether Internet protocol security is performed, and if it is determined that the Internet protocol security is necessary, performs Internet protocol security for the processed network packet. can do.

The security processing unit may be directly connected in hardware with the packet processing unit or may have a form mounted inside the packet processing unit in the form of a system-on-chip (SOC).

An ultra-fast cryptographic communication method according to an embodiment of the present invention includes processing a network packet received from a network interface controller (NIC); Performing Internet protocol security for the processed network packets in an Internet protocol security processor (IPsec) hardware-connected to the network interface controller; And bypassing the kernel to which the Internet protocol security is performed or the processed network packet is delivered to a user space application.

In the step of performing the Internet protocol security, the header of the processed network packet is analyzed to determine whether Internet protocol security is performed, and if it is determined that the execution of the Internet protocol security is necessary, the Internet protocol security for the processed network packet is secured. It can be done.

The step of performing the Internet protocol security may be performed by the Internet protocol security processor having a form directly connected in hardware with the network interface controller or mounted inside the network interface controller in the form of a system-on-chip (SOC).

According to embodiments of the present invention, by applying IPsec in an ultra-high-speed network environment using data plane acceleration, it is possible to improve packet processing speed and security.

According to the embodiments of the present invention, by configuring the high-speed secure communication processing system by efficiently utilizing the existing technologies that have presented only one solution, it is possible to increase the network processing speed of the server without the risk of hacking.

The present invention can be applied to high-speed network data processing devices such as routers and servers, computers for servers, and ultra-high-speed communication equipment requiring computing for packet processing rather than a hub for simple data transmission.

1 shows an exemplary diagram comparing a system model and an existing system model according to an embodiment of the present invention.
FIG. 2 is a flowchart illustrating an embodiment of the operation of the system of the present invention shown in FIG. 1.

Advantages and features of the present invention, and methods for achieving them will be clarified with reference to embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various different forms, and only the present embodiments allow the disclosure of the present invention to be complete, and common knowledge in the art to which the present invention pertains. It is provided to completely inform the person having the scope of the invention, and the present invention is only defined by the scope of the claims.

The terminology used herein is for describing the embodiments, and is not intended to limit the present invention. In the present specification, the singular form also includes the plural form unless otherwise specified in the phrase. As used herein, "comprises" and/or "comprising" refers to the elements, steps, operations and/or elements mentioned above, the presence of one or more other components, steps, operations and/or elements. Or do not exclude additions.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present specification may be used as meanings commonly understood by those skilled in the art to which the present invention pertains. In addition, terms defined in the commonly used dictionary are not ideally or excessively interpreted unless explicitly defined.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. The same reference numerals are used for the same components in the drawings, and duplicate descriptions for the same components are omitted.

Due to the development of high-quality content, a lot of work is required to process large amounts of data. With the development of hardware, a stepping stone for physically improving the speed of speed has been prepared, but the overall processing speed has been reduced due to the bottleneck of the software dealing with it. Data Plane Acceleration (DPA) technology has been developed and used to solve the bottleneck, but the technology focuses only on speed improvement and lacks security considerations. Therefore, there is a high possibility that a third party with malicious intention can easily perform an attack such as intercepting or modifying data.

It is an object of the present invention to improve packet processing speed and security by applying IP security protocol (IPsec) in a high-speed network environment using DPA.

1 shows an exemplary diagram comparing a system model and an existing system model according to an embodiment of the present invention.

As shown in FIG. 1, in the existing method in which DPA is not applied, IPsec is configured in the kernel space, and packet data received in the NIC is processed by the kernel and delivered to the user application application, and the existing method in which DPA is applied is DPA For example, IPsec is processed by the software stage applied by Intel's DPDK, so the packet processing speed may be reduced.

On the other hand, the model of the present invention increases the packet processing speed by applying DPA and increases security by applying IPsec. However, in the step of applying IPsec, avoid processing at the software stage using the existing open source program and connect the hardware optimized for IPsec processing directly to the NIC (Network Interface Controller/Card) or in the form of a system-on-chip (SOC) inside the NIC. Use the form mounted on.

Through this, in the existing operating system, a high-speed network environment can be constructed at the same speed as that of processing a normal packet that has been processed, that is, not encrypted.

In the present invention, DPA may use Intel's DPDK, but is not limited thereto, and any available DPA may be used. Here, DPDK is a technology that does not work without a supported NIC, but using an NIC equipped with the corresponding Intel chipset provides an optimized program code to create an environment that can operate close to the maximum speed of the NIC.

DPDK allows the packet data received by the NIC to be bypassed without being processed by the kernel through the abstract environment called EAL, and is directly delivered to the user application level. This behavior avoids bottlenecks in the operating system.

In addition, the present invention can be implemented to enable communication between the NIC and the IPsec processing hardware by partially modifying the corresponding code, and by implementing this, the system can be configured by utilizing existing tools with minimal modification.

That is, the ultra-fast cryptographic communication system according to an embodiment of the present invention includes a packet processing unit corresponding to a hardware NIC, a security processing unit corresponding to a hardware IPsec, and an acceleration unit corresponding to a DPDK.

The packet processing unit processes the received network packet and provides it to the security processing unit.

The security processing unit analyzes the header of the network packet processed by the packet processing unit to determine whether to process IPsec packets, performs IPsec packet processing when IPsec packet processing is required, and does not perform IPsec packet processing when IPsec packet processing is not required. Does not.

The accelerator performs user space application processing by bypassing the kernel and forwarding packets in which IPsec packet processing has been performed or packets without IPsec packet processing to the user space application by the security processing unit.

FIG. 2 is a flowchart illustrating an embodiment of the operation of the system of the present invention shown in FIG. 1.

Referring to FIG. 2, in the ultra-fast cryptographic communication method according to an embodiment of the present invention, a network packet is received by a NIC, and the received network packet is processed by the NIC (S210, S220).

When the network packet is processed by step S220, it is determined whether IPsec processing is required for the corresponding network packet through the header of the processed network packet (S230).

As a result of the determination in step S230, when it is determined that IPsec processing is necessary, the NIC transmits the processed network packet to the IPsec hardware through the driver IPC, and performs IPsec processing on the network packet in the IPsec hardware (S240, S250).

By bypassing the kernel through the UIO driver and passing the network packet processed in step S250 to the DPDK, the user space application processes the network packet (S260, S270).

On the other hand, if it is determined in step S230 that IPsec processing is unnecessary, the kernel is bypassed through the EAL implemented as the UIO of DPDK to pass packet data to the user space application (S260, S270).

As described above, embodiments of the present invention can improve packet processing speed and security by applying IPsec in an ultra-high-speed network environment using data plane acceleration, and specifically, directly connect hardware optimized for IPsec processing to the NIC or By using the system-on-chip (SOC) type mounted inside the NIC, the server's network processing speed can be increased without the risk of hacking.

Although the description of the method of FIG. 2 is omitted, the method of FIG. 2 may include all of the contents described in FIG. 1, which is obvious to those skilled in the art.

The system or device described above may be implemented with hardware components, software components, and/or combinations of hardware components and software components. For example, the systems, devices, and components described in embodiments include, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors (micro signal processors), microcomputers, and field programmable arrays (FPAs). ), a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose computers or special purpose computers. The processing device may run an operating system (OS) and one or more software applications running on the operating system. Further, the processing device may access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of understanding, a processing device may be described as one being used, but a person having ordinary skill in the art, the processing device may include a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that may include. For example, the processing device may include a plurality of processors or a processor and a controller. In addition, other processing configurations, such as parallel processors, are possible.

The software may include a computer program, code, instruction, or a combination of one or more of these, and configure the processing device to operate as desired, or process independently or collectively You can command the device. Software and/or data may be interpreted by a processing device, or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. , Or permanently or temporarily embodied in the signal wave being transported. The software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

As described above, although the embodiments have been described by a limited embodiment and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques are performed in a different order than the described method, and/or the components of the described system, structure, device, circuit, etc. are combined or combined in a different form from the described method, or other components Alternatively, proper results can be achieved even if replaced or substituted by equivalents.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (6)

A packet processing unit that processes received network packets;
A security processing unit hardware-connected to the packet processing unit and performing Internet protocol security (IPsec) for the processed network packets; And
An accelerator for bypassing the kernel to a network packet in which Internet protocol security has been performed by the security processor or a network packet processed by the packet processor to a user space application.
High-speed cryptographic communication system comprising a.
According to claim 1,
The security processing unit
It is characterized by analyzing the header of the network packet processed by the packet processing unit to determine whether or not Internet protocol security is performed, and if it is determined that Internet protocol security is required, Internet protocol security is performed on the processed network packet. High-speed cryptographic communication system.
According to claim 1,
The security processing unit
An ultra-fast cryptographic communication system, characterized in that it has a form that is directly connected in hardware with the packet processing unit or mounted inside the packet processing unit in the form of a system-on-chip (SOC).
Processing network packets received at the network interface controller (NIC);
Performing Internet protocol security for the processed network packets in an Internet protocol security processor (IPsec) hardware-connected to the network interface controller; And
Bypassing the network packet with the Internet protocol security or the processed network packet to the user space application by bypassing the kernel
Super fast encryption communication method comprising a.
According to claim 4,
The step of performing the Internet protocol security is
High-speed cryptographic communication characterized in that it is determined whether Internet protocol security is performed by analyzing the header of the processed network packet, and if it is determined that Internet protocol security is required, Internet protocol security is performed on the processed network packet. Way.
According to claim 4,
The step of performing the Internet protocol security is
A high-speed cryptographic communication system, characterized in that it is performed in the Internet protocol security processor having a form directly connected in hardware with the network interface controller or mounted in the network interface controller in the form of a system-on-chip (SOC).

Images