Full Text:   <1831>

Summary:  <814>

CLC number: TN918

On-line Access: 2013-08-02

Received: 2012-12-22

Revision Accepted: 2013-04-22

Crosschecked: 2013-07-12

Cited: 2

Clicked: 3305

Citations:  Bibtex RefMan EndNote GB/T7714

-   Go to

Article info.
1. Reference List
Open peer comments

Journal of Zhejiang University SCIENCE C 2013 Vol.14 No.8 P.642-651


A 10 Gbps in-line network security processor based on configurable hetero-multi-cores

Author(s):  Yun Niu, Li-ji Wu, Yang Liu, Xiang-min Zhang, Hong-yi Chen

Affiliation(s):  National Laboratory for Information Science and Technology, Tsinghua University, Beijing 100084, China; more

Corresponding email(s):   niuy08@mails.tsinghua.edu.cn, lijiwu@mail.tsinghua.edu.cn

Key Words:  10 Gbps Ethernet, Network security processor (NSP), Internet Protocol Security (IPSec), Crossbar

Yun Niu, Li-ji Wu, Yang Liu, Xiang-min Zhang, Hong-yi Chen. A 10 Gbps in-line network security processor based on configurable hetero-multi-cores[J]. Journal of Zhejiang University Science C, 2013, 14(8): 642-651.

@article{title="A 10 Gbps in-line network security processor based on configurable hetero-multi-cores",
author="Yun Niu, Li-ji Wu, Yang Liu, Xiang-min Zhang, Hong-yi Chen",
journal="Journal of Zhejiang University Science C",
publisher="Zhejiang University Press & Springer",

%0 Journal Article
%T A 10 Gbps in-line network security processor based on configurable hetero-multi-cores
%A Yun Niu
%A Li-ji Wu
%A Yang Liu
%A Xiang-min Zhang
%A Hong-yi Chen
%J Journal of Zhejiang University SCIENCE C
%V 14
%N 8
%P 642-651
%@ 1869-1951
%D 2013
%I Zhejiang University Press & Springer
%DOI 10.1631/jzus.C1200370

T1 - A 10 Gbps in-line network security processor based on configurable hetero-multi-cores
A1 - Yun Niu
A1 - Li-ji Wu
A1 - Yang Liu
A1 - Xiang-min Zhang
A1 - Hong-yi Chen
J0 - Journal of Zhejiang University Science C
VL - 14
IS - 8
SP - 642
EP - 651
%@ 1869-1951
Y1 - 2013
PB - Zhejiang University Press & Springer
ER -
DOI - 10.1631/jzus.C1200370

This paper deals with an in-line network security processor (NSP) design that implements the internet Protocol Security (IPSec) protocol processing for the 10 Gbps Ethernet. The 10 Gbps high speed data transfer, the IPSec processing including the crypto-operation, the database query, and IPSec header processing are integrated in the design. The in-line NSP is implemented using 65 nm CMOS technology and the layout area is 2.5 mm×3 mm with 360 million gates. A configurable crossbar data transfer skeleton implementing an iSLIP scheduling algorithm is proposed, which enables simultaneous data transfer between the heterogeneous multiple cores. There are, in addition, a high speed input/output data buffering mechanism and design of high performance hardware structures for modules, wherein the transfer efficiency and the resource utilization are maximized and the IPSec protocol processing achieves 10 Gbps line speed. A high speed and low power hardware look-up method is proposed, which effectively reduces the area and power dissipation. The post simulation results demonstrate that the design gives a peak throughput for the Authentication Header (AH) transport mode of 10.06 Gbps with the average test packet length of 512 bytes under the clock rate of 250 MHz, and power dissipation less than 1 W is obtained. An FPGA prototype is constructed to verify the function of the design. A test bench is being set up for performance and function verification.

Darkslateblue:Affiliate; Royal Blue:Author; Turquoise:Article


[1]Chen, Z.H., 2011. Research on Pattern Matching Algorithm in 40Gbps Application Awareness System. MS Thesis, PLA Information Engineering University, Zhengzhou, China (in Chinese).

[2]Cho, Y.H., Mangione-Smith, W.H., 2005. Fast Reconfiguring Deep Packet for 1+ Gigabit Network. Proc. 13th Annual IEEE Symp. on Field Programmable Custom Computing Machine, p.215-224.

[3]Fang, Y.T., Huang, T.C., Wang, P.C., 2008. Ternary CAM Compaction for IP Address Lookup. 22nd Int. Conf. on Advanced Information Networking and Applications, p.1462-1467.

[4]Ferrante, A., Piuri, V., 2007. High-Level Architecture of an IPSec-Dedicated System on Chip. 3rd EuroNGI Conf. on Next Generation Internet Networks, p.159-166.

[5]Ferrante, A., Piuri, V., Owen, J., 2005. IPSec Hardware Resource Requirements Evaluation. Next Generation Internet Networks, p.240-246.

[6]Ferrante, A., Satish, C., Piuri, V., 2007. IPSec Database Query Acceleration. 4th Int. Conf. on E-Business and Telecommunications, p.188-200.

[7]Gupta, P., McKeown, N., 1999. Designing and implementing a fast crossbar scheduler. IEEE Micro, 19(1):20-28.

[8]Ha, C.S., Lee, J.H., Leem, D.S., 2004. ASIC Design of IPSec Hardware Accelerator for Network Security. IEEE Asia-Pacific Conf. on Advanced System Integrated Circuits, p.168-171.

[9]Hifn, 2008. Flow Through Security Processor. Available from http://www.acaltechnology.com/_files/legacy_news/HifnPB-9150-5.pdf

[10]IEEE Std 802.3-2012. IEEE Standard for Ethernet. IEEE Computer Society, NY, USA.

[11]Jain, R., 1992. A comparison of hashing schemes for address lookup in computer networks. IEEE Trans. Commun., 40(10):1570-1573.

[12]Khan, E., El-Kharashi, M.W., Rafiq, A.N.M.E., Gebali, F., Abd-El-Barr, M., 2003. Network Processors for Communication Security: a Review. IEEE Pacific Rim Conf. on Communications Computers and Signal Processing, p.173-176.

[13]Liu, A.X., Meiners, C.R., Torng, E., 2010. TCAM razor: a systematic approach towards minimizing packet classifiers in TCAMs. IEEE/ACM Trans. Network., 18(2):490-500.

[14]Liu, Y., Wu, L.J., Niu, Y., Zhang, X.M., Gao, Z.Q., 2012. A High-Speed SHA-1 IP Core for 10 Gbps Ethernet Security Processor. 8th Int. Conf. on Computational Intelligence and Security, p.237-241.

[15]McKeown, N., 1999. iSLIP scheduling algorithm for input-queued switches. IEEE/ACM Trans. Network., 7(2):188-201.

[16]Nishida, Y., Kawai, K., Koike, K., 2010. A 2Gbs Network Processor with a 24mW IPsec Offload for Residential Gateways. IEEE Int. Solid-State Circuits Conf., p.280-281.

[17]Pape, J.D., 2006. Implementation of an On-Chip Interconnect Using the i-SLIP Scheduling Algorithm. MS Thesis, the University of Texas, Austin, USA.

[18]Potlapally, N.R., Ravi, S., Raghunalhan, A., Lee, R.B., Jha, N.K., 2006. Impact of Configurability and Extensibility on IPSec Protocol Execution on Embedded Processors. 19th Int. Conf. on VLSI Design, p.299-304.

[19]RFC2401:1998. Security Architecture for the Internet Protocol. Internet Engineering Task Force (IETF), Washington D.C., USA.

[20]Wang, C.H., Lo, C.Y., Lee, M.S., Yeh, J.C., Huang, C.T., Wu, C.W., Huang, S.Y., 2006. A Network Security Processor Design Based on an Integrated SOC Design and Test Platform. Proc. 43rd Annual Design Automation Conf., p.490-495.

[21]Wang, H.X., Bai, G.Q., Chen, H.Y., 2008. Zodiac: System Architecture Implementation for a High-Performance Network Security Processor. IEEE 19th Int. Conf. on Application-Specific Systems, Architectures and Processors, p.91-96.

[22]Wang, H.X., Bai, G.Q., Chen, H.Y., 2010. Design and implementation of a high performance network security processor. Int. J. Electron., 97(3):309-325.

[23]Wang, L., Niu, Y., Wu, L.J., Zhang, X.M., 2010. Design of an IPSec IP-Core for 10 Gigabit Ethernet Security Processor. Proc. 10th IEEE Int. Conf. on Solid-State and Integrated Circuit Technology, p.539-541.

[24]Wu, L.J., Ji, Y.J., Zhang, X.M., Li, X.Y., Yang, Y.S., 2009. Power analysis resistant AES crypto engine design for a network security co-processor. J. Tsinghua Univ. (Sci. Tech.), 49(S2):2097-2102 (in Chinese).

Open peer comments: Debate/Discuss/Question/Opinion


Please provide your name, email address and a comment

Journal of Zhejiang University-SCIENCE, 38 Zheda Road, Hangzhou 310027, China
Tel: +86-571-87952783; E-mail: cjzhang@zju.edu.cn
Copyright © 2000 - Journal of Zhejiang University-SCIENCE