Implementing Ipsec Using the Five-Layer Security Framework and Fpgas

University of Windsor Scholarship at UWindsor Electronic Theses and Dissertations Theses, Dissertations, and Major Papers 1-1-2007 Implementing IPsec using the Five-layer security framework and FPGAs. James Wiebe University of Windsor Follow this and additional works at: https://scholar.uwindsor.ca/etd Recommended Citation Wiebe, James, "Implementing IPsec using the Five-layer security framework and FPGAs." (2007). Electronic Theses and Dissertations. 6985. https://scholar.uwindsor.ca/etd/6985 This online database contains the full-text of PhD dissertations and Masters’ theses of University of Windsor students from 1954 forward. These documents are made available for personal study and research purposes only, in accordance with the Canadian Copyright Act and the Creative Commons license—CC BY-NC-ND (Attribution, Non-Commercial, No Derivative Works). Under this license, works must always be attributed to the copyright holder (original author), cannot be used for any commercial purposes, and may not be altered. Any other use would require the permission of the copyright holder. Students may inquire about withdrawing their dissertation and/or thesis from this database. For additional inquiries, please contact the repository administrator via email ([email protected]) or by telephone at 519-253-3000ext. 3208. Implementing IPsec using the Five-Layer Security Framework and FPGAs by James Wiebe A Thesis Submitted to the Faculty of Graduate Studies through Electrical and Computer Engineering in Partial Fulfillment of the Requirements for the Degree of Master of Applied Science at the University of Windsor Windsor, Ontario, Canada 2007 © 2007 James Wiebe Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. Library and Bibliotheque et Archives Canada Archives Canada Published Heritage Direction du Branch Patrimoine de I'edition 395 Wellington Street 395, rue Wellington Ottawa ON K1A 0N4 Ottawa ON K1A 0N4 Canada Canada Your file Votre reference ISBN: 978-0-494-35010-2 Our file Notre reference ISBN: 978-0-494-35010-2 NOTICE: AVIS: The author has granted a non L'auteur a accorde une licence non exclusive exclusive license allowing Library permettant a la Bibliotheque et Archives and Archives Canada to reproduce, Canada de reproduire, publier, archiver, publish, archive, preserve, conserve, sauvegarder, conserver, transmettre au public communicate to the public by par telecommunication ou par I'lnternet, preter, telecommunication or on the Internet,distribuer et vendre des theses partout dans loan, distribute and sell theses le monde, a des fins commerciales ou autres, worldwide, for commercial or non sur support microforme, papier, electronique commercial purposes, in microform, et/ou autres formats. paper, electronic and/or any other formats. The author retains copyright L'auteur conserve la propriete du droit d'auteur ownership and moral rights in et des droits moraux qui protege cette these. this thesis. Neither the thesis Ni la these ni des extraits substantiels de nor substantial extracts from it celle-ci ne doivent etre imprimes ou autrement may be printed or otherwise reproduits sans son autorisation. reproduced without the author's permission. In compliance with the Canadian Conformement a la loi canadienne Privacy Act some supporting sur la protection de la vie privee, forms may have been removed quelques formulaires secondaires from this thesis. ont ete enleves de cette these. While these forms may be included Bien que ces formulaires in the document page count, aient inclus dans la pagination, their removal does not represent il n'y aura aucun contenu manquant. any loss of content from the thesis. i * i Canada Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. ABSTRACT ( A VHDL implementation of 128-bit AES on a Xilinx Virtex-4 FPGA (lowest speed grade) and ML403 development board is developed from a Verilog design that adheres to the FIPS-197 standard, adding innovative features: automatic start of transform, CBC mode, key permutation value readout and store, and output of each intermediate state value. Core processing rate achieves 640 Mbps; 27 Mbps is achieved in practice, via peripheral register access. A non-linear, cryptographically secure LFSR- CASR pseudo-random number generator with a cycle length of 280-243-237+l is translated into C and C++ from Verilog and evaluated. A C design and implementation of IPsec, based on the Five-layer security framework, using these primitives, is presented. The rate of IPsec packet processing achieved is 2 Mbps, determined by direct pulse measurement. A PC-based GUI drives the IPsec implementation and serves it policies, with a framework for flexibly choosing services, mechanisms and primitives using the SMIB. Index Terms: IPsec, Virtex-4, FPGA, AES, pseudo-random number generator, Software Design, Cryptography iii Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. DEDICATION To my mother, for a staggering amount of love, that is so great, that it is as difficult to comprehend as the most involved scientific theory. IV Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. ACKNOWLEDGEMENTS I would like to thank the members of my thesis committee, Dr. Shervin Erfani, Dr. Huapeng Wu, and Dr. Arunita Jaekel, for their support, advice and encouragement and patience in arranging the times of my seminars! My advisor, Dr. Erfani, also provided funding and printed and read all of my published and presented work done during the time of my Master’s project work; as well, he helped me bum my seminar CDs on a last-minute basis. Dr. Wu also kindly printed a copy of my thesis for me. I gratefully acknowledge the assistance of the department technologists, Mr. Frank Cicchello and Mr. Don Tersigni, for support in ordering and providing equipment and tools, and setting up presentations. The University of Windsor ECE (Electrical and Computer Engineering) department secretary, Andria Turner, was absolutely wonderful in chairing my defence, in providing other support during the time of my defence that I needed due to an extensive power failure that occurred that day, and in providing much other support during the time of my Master’s work. Also, Dr. Roberto Muscedere provided equipment. Liviu Danaila, and George Granata, the FAEs (Field Applications Engineers) employed by the ML403 development board vendor, Nu Horizons, were invaluable. Liviu was the local FAE, and helped me considerably. Jennie, the Nu Horizons sales representative, made sure that I received the ML403 board by keeping track of the order. The following Xilinx technical support personnel were helpful with “webcases”: Jonney Zhao, James Broadhead, Enda Behan, Yolanda Xu, Ricky Su and Zhaojin (“Michael”) Ye. “KJ” on the comp.arch.fpga Usenet “newsgroup” helped me set simulation timing values so that the “post-map” simulation of my AES encryptor succeeded. Some of my initial training was done on the Xilinx “Microblaze” boards using Xilinx training “lab” exercises from Xilinx and also as hosted by Dr. Paul Chow on his website at the University of Toronto [UTXILT]. The various tutorial documents provided by Xilinx were very useful - see the “Books, General Papers and other Resources” sub section in the References section: the reference codes beginning with “XIL”, particularly the “EDK 8.2 PowerPC Tutorial in Virtex-4” [XILML403T]. v Reproduced with permission of the copyright owner. Further reproduction prohibited without permission. Thanks are due to my fellow students, Nima Bayan, Fang Chen, Amir Yazdanshenas, Raymond Lee, Kevin Banovic, Ian Anderson, Mohammed Tarique and Wenying Zheng, for technical assistance and advice and encouragement. Dr. Mohammed Khalid also provided advice and support, and his course, “Reconfigurable Computing,” provided some useful background. Dr. Xiang Chen provided advice and encouragement that helped lead me to pursue this area of study. This work is largely based on the Five-Layer framework for designing security systems, patented by Dr. S. Erfani. The AES implementation presented is based on the design by Rudolf Usselmann on the “Open Cores” website [USS2002], [OPENCORES]. The module hierarchy figure, used in section 3.1.7., “AES Design Done in this Work,” was modified from Figures 6 and 7 in [USS2002], The pseudo-random number generator implementation presented is a translation from the Verilog design by Javier Villar on the “Open Cores” website [VILL2005]. This material found on the “Open Cores” website is in the public domain. The serial communication package used with MSVC++ V 6.0 (Microsoft Visual C++ Version 6.0) is from “The Code Project” website, is by Ramon de Klein, and is used under the terms of the LGPL (Lesser GNU Public License) [KLE2003]. The “E-Business Security” figure used in section 2.3.1., “Other Management Proposals”, is redrawn from [TRC2003] with permission from Elsevier. The “C-ISCAP” figure used in section 2.3.1. is reproduced (redrawn) with kind permission of Springer Science and Business Media ([PAR2002], Figure 1, pg. 383, © Springer-Verlag Berlin Heidelberg 2002). The figure illustrating the Xilinx system architecture in section 3.1.4., “Architecture Provided by Xilinx” ([XILUT2003] pg 21), was published by Xilinx in order that it “may be used in any form that would benefit the professor and students,” [XILTMAT]. The figures illustrating AES in section 3.1.1.1., “Overview

Load more