Session

Multi-core IPsec tunnels

Speakers

Daniel Xu
Vlad Dumitrescu
Antony Antony

Label

Nuts and Bolts

Session Type

Talk

Contents

Description

Single pair Child Security Association (SA) IPsec tunnels, while being the de facto standard in network security, have a notable limitation: their design constrains them to a single CPU. This fails to take advantage of modern multi-core systems.

Our solution uses multiple identical child SAs which has the benefit that each stream has its own Sequence Number Counter, ensuring that CPUs don’t have to synchronize their crypto state or disable their packet replay protection.

This presentation will dive into the design, implementation, and performance of multi-child-SA IPsec tunnels.