IPSec Implementation on Xilinx Virtex-II Pro FPGA and Its Application

In this paper, we propose an IPSec implementation on Xilinx Virtex-II Pro FPGA1. We move the key management and negotiation into software function calls that run on the PowerPC processor core. On the data path, reconfigurable hardware logic implements time-critical functions for AES encryption and HMAC authentication. In our approach, the fast hardware processing is quasi-independent of the software processing. In traditional hardware systems, it is often the case that fast hardware modules wait for slow softwares to feed input data and retrieve output data. This causes the hardware component to stay in idle and suffer low utilization. Our contribution in this paper is to separate the IPSec data path from the control path, where the hardware has a full control of data processing and invokes the control software only when necessary. We illustrate the use of the IPSec implementation on a reconfigurable network device to secure the control and configuration channel.