Design and Implementation of Embedded VPN Gateway System

Hang Liu

2007-01-01

Abstract:After analyzing the principles of IPSec data processing, a proposal that the control plane tasks in IPSec was processed by host processor, as well as the data plane tasks by slave processor was put forward. Based on S3C2510 network processor and μCLinux operating system, the embedded IPSec VPN gateway system was also implemented.

What problem does this paper attempt to address?

Fastpath-based VPN Gateway over Network Processor

Bo Ji,Jinfang Zhou,Junda Zhu,Liping Qian

DOI: https://doi.org/10.1049/cp:20061251

2006-01-01

Abstract:Networks, along with the explosive growth of the Internet, developed quickly and make our lives more convenient and efficient. However, at the same time, people will face much more network security problems such as illegal observation, modification, IP Spoofing, etc. This article proposes a novel type of universal software architecture named Fastpath which is purposely designed and optimized for Network Element (NE) in the Next Generation Networks (NGN), under Linux. Furthermore, it illustrates the experience in developing IPSec-based VPN gateway over IXP425, and offloading IPSec processing to NPEs and coprocessors by using APIs of software AccessLibrary through Open Crypto Framework (OCF). Finally, we investigate the performance issues both internally and externally. Through the benchmarks, we analyze the performance of the system and identify that Fastpath and network processor together can construct a universal and high-functional platform for NE which focuses on network processing.
Design of GAP-based network security device

HUANG Hao-you,LU Jian-gang

2006-01-01

Abstract:The GAP principles is briefly introduced.A novel implementation method based on FPGA technology is presented.The SCSI protocol controller,SDRAM controller and core controller are integrated in the FPGA chip.It has been proved that the reliability and compatibility of this novel method are superior to those of MCU+SCSI protocol controller.
An Implementation Scheme of Embedded IP Gateway Based on SOPC

LUO Wu,LIU An,LI Yi

DOI: https://doi.org/10.3969/j.issn.1003-3106.2007.10.004

2007-01-01

Abstract:A scheme of embedded IP gateway based on SOPC is proposed for wideband satellite data communication.HDLC(High-level Data Link Control Procedures)is one of the most widely used Data-Link layer protocols in satellite data communication system.A high-speed HDLC IP CORE is designed and implemented on a single chip and an embedded linux software environment is set up.Compared to common scheme,this scheme is more flexible and efficient.The throughput of this scheme is also higher.The design idea,key point and the structure of both hardware and software of the proposed scheme is presented.A prototype of this scheme is given and it is proved that this prototype has high performance.
VPN Test System Based on IPSec Network Protocol

陆敏锋,平玲娣,李卓

DOI: https://doi.org/10.3969/j.issn.1000-3428.2010.03.051

2010-01-01

Abstract:Aiming at the problem that the IPSec-based VPN product, this paper designs and achieves a IPSec-based VPN test system running on the Linux platform. This paper introduces the IPSec protocol and its architecture, and presents the design and achievement of the test system through analyzing the principle of the IPSec protocol. Experiment result shows that this test system is feasible and effective.
Implementation of Nios Embedded System in IP-CATV/CATV-IP Gateway

Kuang Wang

2004-01-01

Abstract:In this article we provide a new model of IP-CATV/CAVT-IP gateway based on the Cyclone device and embedded soft processor Nios and introduce the conversion of IP data in Ethernet Network and TS data in CATV network by down broadcast transmission card based on Nios protocol stack and FPGA logic. Also we provide protocol stack model and FPGA logic timing.
Implementation of Embedded VPN Gateway Based Hardware Data Encryption

YANG Li-bin,MU De-jun,CAI Xiao-yan,LIU Hang

DOI: https://doi.org/10.3321/j.issn:1002-8331.2007.04.037

2007-01-01

Computer Engineering and Applications Journal

Abstract:With increasing requirements of network applications,software data encryption/decryption for VPN gateway becomes bottleneck of the processing speeds.In this paper,a novel architecture for embedded VPN Gateway based on network processor,coupled with Cryptography card is proposed.The main idea is that the significant and computing intensive portion of the computation,such as encryption/decryption and hash calculation of IPSec data,are implemented by the hardware Cryptography card,while the network processor is dedicated to encapsulating IPSec data.The experimental results show that the architecture can work steadily and has a good performance in high speed.
A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Yan Shen,Qi-fei Zhang,Ling-di Ping,Yan-Fei Wang,Wen-juan Li

DOI: https://doi.org/10.1109/trustcom.2012.41

2012-01-01

Abstract:In the existing large-scale performance test of IPsec tunnel, it often needs special software and hardware. To solve the problem, this article proposed a new method, in which packet was encapsulated in user space, and a multi-tunnel controller was designed and implemented with the method of FSM(finite state machine), which controlled the negotiation and establishment of multiple tunnel, including L2tp, IKEv1, IKEv2, IKEv2+EAP and L2tp Over IPsec. Libpcap was used as the bottom layer driver of package, and the application of zero copy technique had reduced system cost immensely. At last, the result of the experiment verified the performance of the IKEv1 tunnel on Tunnel-mode and Transport-mode.
Design and Implementtationg of an IPsec VPN Gateway Base on OpenWRT

Hua Jiang,Qingrui Wang,Gang Zhang,Jinpo Fan

DOI: https://doi.org/10.1088/1742-6596/1176/4/042007

2019-03-01

Journal of Physics: Conference Series

Abstract:IPSec VPN is a virtual private network technology implemented using the IPSec protocol. Aiming at the problem that the national secret algorithm is relatively less applied to network security products, a gateway based on Openwrt system equipment is designed. The OpenWRT system includes the complete strongswan software, making it easy to set up a VPN. The design replaces the aes algorithm, the sha256 algorithm and the ECDSA algorithm used in the IPSec VPN in the StrongSwan source code with the SM4, SM3 and SM2 algorithms respectively, and replaces the ECDSA-SHA256 certificate with the SM2-SM3 certificate according to the X509 certificate standard to achieve the national secret standard. The SM4, SM3 and SM2 algorithms are provided by the SSX0912 encryption chip, and the certificate is placed in the SSX0912 encryption chip for dense storage. It is proved that the scheme is completely feasible, and the IPSec VPN that can be realized can run stably for a long time and has high practical value. By setting up the development environment test, the gateway runs stably, has small delay, and has higher security, and the device has high communication speed, small occupation volume, high flexibility, and strong specificity.
Design and Implementation of IPsec VPN IoT Gateway System in National Secret Algorithm

Yan Jiang,Jing Huang,Yunsong Fan,Xiaobin Zhu

DOI: https://doi.org/10.13052/jcsm2245-1439.1345

2024-06-14

Journal of Cyber Security and Mobility

Abstract:With the development of Internet of Things technology, the security threats faced by the industrial control field are increasing, and strengthening the security protection capabilities of intelligent systems on IoT highways is becoming increasingly important. IPSec VPN tunneling technology can achieve identity authentication and encrypted data transmission, and is an important means to achieve secure data transmission in intelligent systems on Expressway intelligent tunnel system. The commonly used IPSec VPN gateway uses a traditional Linux protocol stack-based approach for data capture, which requires multiple data copies and context switching, resulting in low efficiency of IPSec services. In addition, the commonly used IPSec VPN security gateway is implemented on the basis of the open-source IPSec framework, using internationally recognized algorithms for encryption and decryption, which poses security risks. This article is based on the IPSec protocol, and studies the high-speed network packet capture framework PFRING technology, the fusion technology of national secret algorithm and IPSec protocol. It designs and implements an IPSec VPN IoT security gateway based on national secret algorithm. After experimental verification, the IPSec VPN gateway system constructed in this article has complete functions and better performance than the common open-source IPSec frameworks OpenSwan and strongSwan, and can meet the application requirements of IoT data encryption transmission.
Study of Implementing IPSec under the Linux Platform

ge qingeng,wang haihang,tan chengxiang

DOI: https://doi.org/10.3321/j.issn:1002-8331.2002.10.055

2002-01-01

Abstract:As one main research focus of network security,VPN puts forward a new solution of network-layer security architecture,and VPN based on the IPSec become more and more popular.In this paper,IPSec protocol architecture and Linux kernel structure are studied carefully.Then the paper presents the scheme of designing and implementing IPSec on the Linux-making changes to TCP/IP stack of Linux and implementing IPSec there.Also the key technique to accomplish this system is discussed in the paper in detail.
Research of the Implementation of IPSec Protocol Based Network Prosessor

HU Ning,WANG Yongjun

DOI: https://doi.org/10.3969/j.issn.1000-3428.2006.05.035

2006-01-01

Abstract:This article summarizes the implementation framework of the IPSec protocol,and then describes the main mechanism of network processor such as tree search engine.Finally,it discusses the IPSec protocol key component’s implementation using network processor and gives a conclusion.
Implementation of Embedded Anti-Virus Firewall Based on IXP2800 and VxWorks

Xiaoyan Cai

2008-01-01

Abstract:Focusing on the attack hided in network data stream,this paper proposed a novel architecture for embedded anti-virus firewall based on IXP2800 and VxWorks.The architecture included two sublayers: low hardware packet filtering layer and real-time anti-virus application layer.The former was responsible for processing of low layer packets,such as real-time responsing,filtering and forwarding,these functions were accomplished by the micro engine of IXP2800.As for anti-virus application layer,the XSCALE main processor was applied to be dedicated to scanning and filtering virus hided in high layer.The experimental results show that the architecture can work steadily and efficiently.
Design and Implementation of Embedded Ethernet Interface Based on Greenhouse Control

张保华,李士宁,于超,张要伟

DOI: https://doi.org/10.16208/j.issn1000-7024.2008.12.083

2008-01-01

Abstract:The function and work principle of the sink-node in wireless sensor network are analyzed.Based on embedded micro-processor PXA270 and Ethernet controller CS8900A,the hardware is designed,and the Ethernet interface driver of sink-node is developed based on the study of design framework of Linux platform Ethernet interface driver and related development technology.With convenient rea-lization and better utility,this design meet the needs of greenhouse monitoring and control system.
Design of implementation of MPLS VPN security

AN Ji-yong,XIA Shi-xiong

DOI: https://doi.org/10.3969/j.issn.2095-6835.2010.27.018

2010-01-01

Abstract:By analyzing MPLS VPN can not fully ensure security and integrity of data and it’s difficult to access to VPN for the mobile user. Taking advantage of MPLS VPN and IPSec VPN, and forwarding a new project of IPSec based MPLS VPN and IPSec VPN based CE device for ensuring data security and accessing to VPN for mobile users. The project can share the advantages of IPSec’s high security and mobility and MPLS’S high speed switching, QOS guarantee and flow engineering as well as expand ability.
Research and Implementation of one Kind of IPSec -based VPN in Linux

XU Ming-liang,TAN Cheng-xiang,WANG Hai-hang

DOI: https://doi.org/10.3969/j.issn.1671-0428.2007.11.014

2007-01-01

Abstract:Virtual Private Network(VPN) is an important technique transfer private information under public networks. It can set up a temporary but safe connection to a public network (normally an internet) by data packing and encrypted transferring, and then achieve the aim of transferring private information on public network. Recently, two technologies are mainly used by enterprise to set up internal VPN: IPSec VPN and SSL VPN. This paper introduces the concept of IPSec technique and describes IPSec protocol architecture, communication steps, and finally discusses implementation of VPN based on IPSec by Openswan in detail.
A High Performance Parallel Ipsec-Vpn Gateway Design

Weiming Li,Zhitang Li,Yunfeng Xie

DOI: https://doi.org/10.1117/12.688171

2006-01-01

Abstract:IPSec (IP Security) provides a standard, robust, and extensible mechanism in which to provide security to IP and upper-layer protocols. But the encryption and message authentication services provided by IPsec require significant computation time. Consequently, IPsec can degrade performance obviously. The paper presents a parallel hardware structure of high performance IPSec VPN gateway to speed up the IPSec packets process, and introduces the IPSec software design in detail includes modified FreeS/WAN IPSec implementation and extended Internet Key Exchange protocol. The result of network performance test proves that the structure can fulfill the need of gigabit fast network. The paper also proposes multiple small packets assembling algorithm which is used to accelerate small packets process. The algorithm significantly improves the performance of small packets.
A Novel DSP Based VPN Security Gateway:Design & Implementation

杭强伟,陆菊康,谭成翔,王珏,朱肇中

2004-01-01

Abstract:The realtime performance is one top concern of VPN Gateway. In order to solve the problem, a novel approach to design VPN security gateway based on DSP was prsented . With dual TMS320C62x chips, a applicable broadband VPN Gateway has been implemented. The functional framework of the presented VPN gateway, the communication between Linux kernel and DSP,the implementation method for encryption algorithm, etc. were given in detail.
Design and Implementation of Security Router Based on MPC180 and MPC8260

刘刚,张德运,丁会宁,李金库,廖明涛

DOI: https://doi.org/10.3969/j.issn.1000-3428.2005.01.045

2005-01-01

Abstract:To meet the challenge of line rate security, a design of security router using MPC180 and MPC8260 is accomplished. MPC8260 is a communications processor and MPC180 is a security processor that can interface to MPC8260s local bus gluelessly. The router provides up to three 10/100Base-Tx(Fx) interfaces, three high-speed serials and one channelled E1. All of the algorithms associated with IPSec,IKE and SSL/TLS are also implemented through MPC180. Test for the router shows that the throughput in various security algorithms can achieve more than 95% of the theoretic limits of MPC180.
Implementation of A Security Router Based on Hardware

刘刚,张德运,李金库,廖明涛

DOI: https://doi.org/10.3969/j.issn.1000-7180.2004.07.036

2004-01-01

Abstract:Current security router was almost implemented using general hardware plus security software. This method cannot meet the challenge of line rate security. To solve the problem, a designing of security router is accomplished by using MPC180 MPC8260. We use MPC8260 to provide functions of router interface and central process. MPC180 is a security processor that can encrypt data in a way of hardware and it can improve the efficiency of implementing Virtual Private Network(VPN). Test for the router shows that our designing can meet the demand of VPN for medium-scaled enterprise.
Implementation and Performance Evaluation of IPSec VPN Based on Netfilter

Zhao Da-yuan,Jiang Yi-xin,Lin Chuang,Li Yan-xi

DOI: https://doi.org/10.1007/bf02828626

2005-01-01

Wuhan University Journal of Natural Sciences

Abstract:We mainly explore two problems when combining IPSec module into TCP/IP stack by porting the famous IPSec software (FreeS/WAN) into a security gateway. One is how to implement the IPSec module based on Netfilter in Linux 2.4. x kernel. The other problem is the performance evaluation. We test the throughput of our security gateway before and after applying IPSec with different encryption/decryption algorithms, including the software-based and hardware-based method. With these testing data, we analyze further system performance bottleneck. In the end, we also infer the quantitative relation between the system throughput and the speed of encryption/decryption algorithm and propose some valuable conclusions for improving performance.

Design and Implementation of Embedded VPN Gateway System

Fastpath-based VPN Gateway over Network Processor

Design of GAP-based network security device

An Implementation Scheme of Embedded IP Gateway Based on SOPC

VPN Test System Based on IPSec Network Protocol

Implementation of Nios Embedded System in IP-CATV/CATV-IP Gateway

Implementation of Embedded VPN Gateway Based Hardware Data Encryption

A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Design and Implementtationg of an IPsec VPN Gateway Base on OpenWRT

Design and Implementation of IPsec VPN IoT Gateway System in National Secret Algorithm

Study of Implementing IPSec under the Linux Platform

Research of the Implementation of IPSec Protocol Based Network Prosessor

Implementation of Embedded Anti-Virus Firewall Based on IXP2800 and VxWorks

Design and Implementation of Embedded Ethernet Interface Based on Greenhouse Control

Design of implementation of MPLS VPN security

Research and Implementation of one Kind of IPSec -based VPN in Linux

A High Performance Parallel Ipsec-Vpn Gateway Design

A Novel DSP Based VPN Security Gateway:Design & Implementation

Design and Implementation of Security Router Based on MPC180 and MPC8260

Implementation of A Security Router Based on Hardware

Implementation and Performance Evaluation of IPSec VPN Based on Netfilter