Advertisement

Optimizations for High-Performance IPsec Execution

  • Michael G. Iatrou
  • Artemios G. Voyiatzis
  • Dimitrios N. Serpanos
Part of the Communications in Computer and Information Science book series (CCIS, volume 130)

Abstract

The requirement for accessing, through the public Internet, private resources in a secure fashion from anywhere has turned Virtual Private Network (VPN) connectivity into a necessity. Internet Protocol Security (IPsec) is the de facto standardized VPN technology with support for multiple connectivity scenarios. The cryptographic transformations of IPsec are widely considered as a performance bottleneck and the usual target for optimization. We present a set of system configuration optimizations on Linux that achieve significant throughput gains, supported by extensive measurements. Our work demonstrates that IPsec performance can be significantly improved without altering the implementation of the cryptographic algorithms.

Keywords

IPsec Performance Networking Security Protocol optimization 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Bellovin, S.: A look back at “security problems in the TCP/IP protocol suite”. In: Proceedings of the 20th Annual Computer Security Applications Conference, ACSAC 2004, Washington, DC, USA, pp. 229–249. IEEE Computer Society, Los Alamitos (2004)Google Scholar
  2. 2.
    Bellovin, S.M.: Problem areas for the IP security protocols. In: Proceedings of the Sixth USENIX Security Symposium, pp. 205–214 (1996)Google Scholar
  3. 3.
    Degabriele, J.P., Paterson, K.G.: Attacking the IPsec standards in encryption-only configurations. Cryptology ePrint Archive, Report 2007/125 (2007)Google Scholar
  4. 4.
    Eastlake 3rd, D.: Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH). RFC 4305 (Proposed Standard) (December 2005); Obsoleted by RFC 4835 Google Scholar
  5. 5.
    Hoffman, P.: Cryptographic Suites for IPsec. RFC 4308 (Proposed Standard) (December 2005)Google Scholar
  6. 6.
    McDonald, D., Metz, C., Phan, B.: PF_KEY Key Management API, Version 2. RFC 2367 (Informational) (July 1998)Google Scholar
  7. 7.
    Shue, C., Shin, Y., Gupta, M., Choi, J.Y.: Analysis of IPSec overheads for VPN servers. In: IEEE ICNPs NPSec Workshop (2005)Google Scholar
  8. 8.
    Bellows, P., Flidr, J., Gharai, L., Perkins, C., Chodowiec, P., Gaj, K.: IPsec-protected transport of HDTV over IP (2003)Google Scholar
  9. 9.
    Shue, C.A., Gupta, M., Myers, S.A.: IPSec: Performance Analysis and Enhancements. In: IEEE Conference on Communications, ICC (2007)Google Scholar
  10. 10.
    Elkeelany, O., Matalgah, M., Sheikh, K., Thaker, M., Chaudhry, G., Medhi, D., Qaddour, J.D.: Performance analysis of IPSec protocol: encryption and authentication (2002)Google Scholar
  11. 11.
    Jones, R.: Netperf (2009), http://www.netperf.org (retrieved April 27, 2009)
  12. 12.
    Levon, J.: OProfile - A System Profiler for Linux (2008), http://oprofile.sourceforge.net/ (retrieved April 27, 2009)
  13. 13.
    Mogul, J., Deering, S.: Path MTU discovery. RFC 1191 (Draft Standard) (November 1990)Google Scholar
  14. 14.
    Mathis, M., Heffner, J.: Packetization Layer Path MTU Discovery. RFC 4821 (Proposed Standard) (March 2007)Google Scholar
  15. 15.
    Jacobson, V., Braden, R., Borman, D.: TCP Extensions for High Performance. RFC 1323 (Proposed Standard) (May 1992)Google Scholar
  16. 16.
    Mathis, M., Mahdavi, J., Floyd, S., Romanow, A.: TCP Selective Acknowledgment Options. RFC 2018 (Proposed Standard) (October 1996)Google Scholar
  17. 17.
    Salim, J.H., Olsson, R., Kuznetsov, A.: Beyond softnet. In: Proceedings of the 5th Annual Linux Showcase & Conference, ALS 2001, p. 18. USENIX Association, Berkeley (2001)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Michael G. Iatrou
    • 1
  • Artemios G. Voyiatzis
    • 1
    • 2
  • Dimitrios N. Serpanos
    • 2
    • 1
  1. 1.Department of Electrical and Computer EngineeringUniversity of PatrasPatrasGreece
  2. 2.Industrial Systems InstituteBuilding of the Patras Science ParkPlataniGreece

Personalised recommendations