IKE hardware engine based on CAM for concurrent processing of massive user sessions
Shimaa Abdel Naby, Saad Arslan, HyungWon Kim · 2017
A Virtual Private Network (VPN) is considered as a secure solution for enterprises to support private communications over public networks like the internet. A VPN solution addresses a vast number of security issues, and the key management is among the critical ones. Nowadays, most of the VPN solutions utilize the Internet Key Exchange protocol version 2 (IKEv2) as one of the key management and negotiation protocols. Software Security gateways suffer from performance degradation while serving a large number of VPN users concurrently. In this paper, we propose a novel IKEv2 hardware engine that executes the key exchange process efficiently at the wire speed. In our design, we employ a content-addressable memory (CAM) to implement the Security Association Database (SAD). The CAM-SRAM pair can provide an instant lookup speed for existing IKE sessions and reduces the excessive processing time required to add, identify or remove multiple sessions. The IKEv2 CAM-based multi-user processing engine has been modeled using ns-3 simulator, and then also implemented using Verilog HDL. Using the ns-3 simulator, we estimated the performance of the proposed IKEv2 engine for the concurrent processing of multiple IKE sessions. Using the Verilog implementation, we demonstrated cycle-accurate evaluation of the proposed IKEv2 engine in its speed enhancement. Our simulation experiment shows that the proposed IKEv2 engine can speed up 10,000 IKE sessions by up to two times compared with conventional IKE implementations.