We consider IPsec as a means to provide security for a bare (OS-less) PC in a networked environment. We first present the underlying bare computing architecture that includes IPsec components. We then describe our design and implementation of IPsec with ESP and IKEv2 support for a bare PC. Bare PC optimizations that provide higher efficiency include application and protocol intertwining, and minimization of inter-layer communication and data copying. We also evaluate IPsec performance on a bare PC and compare it with a similar Linux system. Our experimental results indicate that 1) the cost of ESP processing is approximately 6% more for incoming versus outgoing packets; 2) an approximately linear relationship between ESP processing time and packet size exists for both tunnel and transport modes; 3) ICMP and HTTP response times with IPsec are less on a bare PC than on a Linux system. In this paper, we consider the design and implementation of IPsec on a bare PC and evaluate its performance. We also provide some performance comparison with applications that run on Linux. Due to the novel characteristics of bare machine computing and its unique architecture, the design and implementation of IPsec for an AO is different from a conventional implementation of IPsec in an OS-based system. IPsec can be efficiently implemented on a bare PC by using optimizations not easily achieved in conventional systems. Examples are intertwining the application with network protocols within an AO, minimizing the cost of inter-layer communication, and eliminating data copying between application and network buffers. The main contributions of this research are: 1) an implementation of IPsec for a bare (OS-less) PC; 2) experimental results related to the cost of IPsec processing on a bare PC; and 3) experimental results related to the increase in response time of applications when IPsec is present for a bare PC and for a conventional OS-based (Linux) PC. These results can serve as a baseline for designing future versions of IPsec for high-performance or high-security applications and security gateways running on bare machines.
['N. Kazemi', 'Alexander L. Wijesinha', 'Ramesh K. Karne']
Design and Implementation of IPsec on a Bare PC