Abstract
Advances in network technology stimulate an enormous growth in the number of applications. These also lead to a growing demand for handling a considerable number of packets over the Internet. High-end network equipment is usually used to confront the traffic problem. If the equipment is required to deal with sensitive network traffic from electronic commerce or secure audio/video services, it must be equipped with security processing functions. This means that one or more powerful security processors for cryptographic algorithms and network security protocols are needed in the network equipment. For product development, it is important to know how to design such an advanced cryptographic processor in an innovative and efficient way, and how to integrate multiple processors into a single chip cost-effectively. This thesis describes design details for advanced security processors and scalable architectures which tackle the performance problem at reasonable cost. The details are divided into three major parts. The first part presents hash and HMAC processors, which are used for purposes of data integrity and authentication. In this part, a novel hash processor core with integrated SHA-1 and MD5 algorithms is proposed for cost-oriented and performance-oriented applications. Based on a shift-register approach, word expansion steps for both MD5 and SHA-1 can be performed at lower cost. The hybrid hash core has a similar performance with a lower hardware cost in comparison with existing designs. A pipeline version is also developed for high-speed network systems and has been integrated into an IPsec processor. Based on the non-pipelined hash processor core, we also design an HMAC processor for message authentication required by network security protocols such as IPsec and SSL/TLS. The HMAC design has automatic word padding and supports key scheduling for successive HMAC tasks using the same key (removing key computation time). The second part is the design of a multi-core configurable crypto architecture including several configurable AES processor cores which implement AES algorithm and extended AES version. Each configurable AES processor core, providing such a flexibility to configure parameters defined in the AES algorithm, is used to reinforce the security in data communication. With the multi-core configurable AES architecture, both high encryption throughput and enhancing security level are achieved. In the architecture, a linked-list data structure is exploited to reduce the interrupt handling load of the host processor. Also, the management of the architecture is simplified by a shared control interface. For 128-bit AES in the CBC mode, the architecture obtains better Gbps/Kgates ratio than conventional methods. The proposed architecture with four security properties leads to higher security than other AES architectures. The final part describes the design of a mesh-structured IPsec processor, which plays an important role in dealing with complex cryptographic operations of IP security protocol suite. The proposed IPsec processor, consisting of dozens of AES and hash cores, can handle at most 72 IP packets simultaneously. It provides a general scheme that handles IPsec crypto functions, including a combination of protocols and algorithms. It also employs multi-level parallelism to enhance performance. Besides, a tile and interconnection architecture is designed to solve both handshake and contention issues induced by bus architectures. In the architecture, the low-latency IPsec-specific routing hardware has lower gate count than four kinds of routers used in NoCs (Networks-on-Chips). Also, the IPsec processor has higher Mbps/Kgates ratio than previous work. Regular structure provides high scalability, so multiple IPsec processors can be connected directly to raise the performance. An automated procedure is also developed to reduce the verification effort.