Security performance of the cavium octeon Network Processor

In the increasingly complex communication networks and the emergence of a large number of new businesses, the network traffic control capabilities and network security have also put forward higher requirements, as the core unit of network equipment, the network service processor is bound to face greater challenges. On the one hand, more and more access users and more diverse business needs make all kinds of network devices have to provide sufficient throughput. On the other hand, due to the constant updates and changes of network applications, new services are constantly emerging, this requires service providers to quickly meet user needs and increase the profit model, so as to consolidate and improve competitiveness. Therefore, a new generation of processor products and solutions that are easy to program, upgrade to market needs, and provide powerful throughput have become the focus of the market.

As a leading supplier of all-round Chip Solutions in the security and smart network fields, cavium certainly understands the value of business opportunities and is ready to launch the octeon processor series, provides highly integrated and low-cost 64-bit computing solutions for network, wireless, control, and storage applications. Relying on its experienced high-end microprocessor design team and embedded systems and application software team, the new octeon processor launched by cavium is widely designed into various network devices, including routers, switches, UTM (Unified Threat Management) devices, application-aware gateways, triple-play gateways, and WLAN), 3G Access and aggregation devices, and network storage devices. Its distinctive design concepts include: focusing more on providing outstanding application performance; reducing power consumption through extensive, conditional clock control; built-in hardware accelerators at the core of the processor; using multi-core technology, instead of simply increasing the CPU frequency, an integrated dedicated coprocessor for different applications, and a simple software model using a standard instruction set.

In order to break through the features and cost-effectiveness requirements of next-generation networks, wireless networks, control and storage applications, the new SOC (system on chip) it integrates the customized mips64 processor and the industry's most advanced multi-layer applications (multi-layer applications) acceleration and Security processing hardware, as well as a wide range of configurable network interfaces. Because the existing processing does not have enough horsepower to meet the current network needs, the current solution is to use a gihz (GHz) processor with a variety of coprocessor and FPGA, the final result is high cost and high power consumption. The octeon cn31xx and cn30xx processors launched by cavium successfully meet various requirements of the Next Generation IPv4 and IPv6 networks, it integrates a wide range of hardware acceleration options from L3-L7 data, content and security services, which share many of the MIPs CPU's tasks and reduce the CPU clock speed needed to get a gigabit line rate, this reduces power consumption and costs. The emergence of octeon processors makes the Secure Application cognitive network a common configuration.

The new octeon product family includes octeon 31xx processors for small and medium-sized enterprises, enterprise and control layer applications, and octeon 30xx processors for SOHO/SME and control layer applications. The octeon cn31xx and cn30xx processors are based on the cnmips64 CPU cores that are the same as the existing cn38xx and cn36xx processors. The CPU core is specifically designed for the best network and service performance, and the power consumption is very small. The core of cnmips is the implementation of the industry's first version of mips64, a 5-level pipeline, dual-instruction over-Standard Architecture, mature prefetch and optimized cache and memory latency. Each processor has one or two cnmips cores with a maximum of KB L2 cache and rich interfaces, these I/O interfaces include Gigabit Ethernet interfaces, PCI/PCI-X, DDR2, SPI, UART, and extended bus. The processor clock speed ranges from 550 MHz to MHz. The maximum power consumption ranges from 2 watt to 7 Watt, and the performance ranges from several hundred megabytes to 2 Gbps.

In addition, the cn31xx and cn30xx processors also have a wide range of hardware acceleration options, each of which has CP (communication processor, communication processor), SCP (secure communication processor, secure communication processor) and NSP (network service processor, network services processor, only cn31xx has NSP version. The CP version includes hardware acceleration functions such as packet processing, TCP, queue/Scheduling (queuing/scheduling), and QoS, SCP provides acceleration for IPSEC/SSL, SRTP, and WLAN Security. In NSP, deep packet inspection and compression/decompression are added).

The specific application acceleration functions are as follows:

Rich L2-L4 hardware-based packet processing and Buffer Management Engine for IPv4 and IPv6 Packets
· TCP hardware acceleration includes comprehensive check, tag-generation, checksum, timer, and buffer management.
· The queue/scheduling and service quality hardware implements the queue/Scheduling Based on DiffServ, QoS/TOS, input port or a combination of the above for input packets, fixed Priority (fixed prioritization) or weighted fair queue (weighted fair queuing, wfq)
· Full offload (hardware acceleration) is used to handle IPSec, SSL, SRTP, and WLAN 802.11i security protocols, supports all standard algorithms including DES/3DES, AES supports up to 256bit, AES-GCM, AES-xcbc, arc4, MD5, SHA-1, SHA-2 supports up to SHA-512, RSA supports up to 4096bit, Diffie -Hellman and real hardware random number generator
· Hardware acceleration for compression/Decompression implements gzip, PKZIP, and various protocols to provide the best codecombits in the industry
· The Deep Packet check is implemented by matching the hardware acceleration engine in eight modes, these engines can be used to provide stateful Pattern Analysis for intrusion detection, anti-virus, and content-based exchange, routing, and filtering applications ).

Octeon processors support standard operating systems such as Linux kernel, montavista kernel Linux, and Wind River kernel VxWorks kernel, and support a fast-Path) the software's thin Execution System (thin executive ). Cavium networks provides a complete software development kit, including Linux, software examples, GNU tool chain, GDB development environment, and third-party tool chain and development support, this makes it easy for thousands of mips32, mips64, and other C/C ++ applications to be migrated to octeon. In addition, cavium networks also provides APIs and software tools for IPSec, SSL, and TCP protocol stacks to make it possible to make it available to users quickly.

Octeon series network service processor for high-speed data flow L4-L7 processing, through the execution environment, memory, hardware accelerator, bus structure, network application development interface integrated optimization, A flexible software system provides key features for hardware-level processing performance. The next-generation network device with network service processor as its core features high performance and flexibility. It can meet the technical needs of networks and market in the future and has a huge space for development, as the leading supplier of all-round Chip Solutions in the smart network field, cavium networks is bound to win a cup of cake in this field.

(Comprehensive e-forum)