Cost-efficient architecture of IPsec classification engine with TCAM

This paper presents an IPsec Protocol Processing Engine with TCAM Optimized for cost and performance multiple packet classification and filtering on the next generation IP networks. The proposed architecture can accelerate the process of IP layer security protocol, by using common TCAM architecture shared for inbound and outbound packet filters. It can substantially reduce the size of TCAM, while maintaining the speed of the searching and matching process. The proposed IPsec classification engine has been implemented in an NS-3 simulator for functional verification, and also in Verilog for performance and cost analysis. We demonstrate that the proposed architecture can reduce the TCAM by 60% compared with conventional individual TCAM architecture. In addition, the proposed architecture can speed up the classification process by 15 times over software based IPsec classification.