Mellanox Innova IPsec Offload Overview
Rev 1.8
21
Mellanox Technologies
4
Mellanox Innova IPsec Offload Overview
The Mellanox Innova IPsec EN adapter is pre-programmed with a Mellanox IPsec offload FPGA
logic, offering encryption, decryption and authentication for IPsec security protocol suite.
The IPsec offload solution offers three major benefits:
1. Offloads compute intensive crypto algorithms from the host CPU, thus freeing up the CPU
and easing network bottlenecks.
2. Since the crypto process occurs on the FPGA, which acts as a 'bump-in-the-wire', the traffic
reaches the ConnectX-4 Lx plain so that the various ConnectX-4 Lx networking and stateless
offloads can be applied to that traffic.
3. The existing IPsec implementation in Linux kernel requires the network stack to process the
packet before and after the crypto processing of the packet. As 'bump-in-the-wire', Mellanox
Innova IPsec prevents traffic from undergoing the kernel network stacks process more than
once.
With these benefits, IPsec offload allows the adapter to reach full wire speed with IPsec secured
traffic on the wire while reducing CPU utilization.
IPsec offload is supported in two modes - kernel mode (
Section 4.2, “IPsec Offload Kernel and
) and DPDK mode (
Section 4.3, “IPsec Offload for DPDK Applications,” on
4.1
Security Engines and IPsec Protocols
The crypto algorithms in the Mellanox Innova IPsec adapter is a symmetric encryption and
authentication using either the AES-GCM mechanism (described in
), the encryption
) and/or the authentication by:
• HMAC-SHA-1
• HMAC-SHA2 (256, 384, 512)
Please refer to
for further details.
The crypto engines are designed to deliver full wire speed operation in a wire rate of 40G. These
crypto engines are integrated with IPsec-ESP protocol mechanism which is elaborated in
, or with IPsec-AH, as described in
.
For list of supported crypto algorithms please refer to
Mellanox Innova IPsec EN Release
Notes.
Additional crypto algorithms can be added based on business needs.
