# Wireless and Fiber-Based Post-Quantum-Cryptography-Secured IPsec Tunnel
## 3 IPsec Protocol
#### IPsec Hardware Acceleration  
IPsec is a widely used protocol suite for securing Internet Protocol (IP) communications by authenticating and encrypting each IP packet in a data stream. BlueField-2 DPUs offer hardware acceleration for IPsec, enabling efficient packet processing and encryption/decryption without burdening the host CPU. The software framework that is used to program the DPU is called Data Center-on-a-Chip Architecture (DOCA). By design, DOCA is very similar to NVIDIA's Compute Unified Device Architecture (CUDA) that is used for the programming of a Graphic Processing Unit (GPU). Like in CUDA, using the Application Programming Interfaces (APIs) enables the user to access on-board hardware accelerators of the device. Figure 2 presents the workflow of DOCA IPsec, detailing the steps involved in setting up IIPsec policies and processing network traffic within the BlueField environment. We configure the NIC similar to the procedure presented on the NVIDIA DOCA webpage ([[https://docs.nvidia.com/doca/sdk/nvidia+doca+east-west+](https://docs.nvidia.com/doca/sdk/nvidia+doca+east-west+)]([https://docs.nvidia.com/doca/sdk/nvidia+doca+east-west+](https://docs.nvidia.com/doca/sdk/nvidia+doca+east-west+)) overlay+encryption+application/index.html, accessed on 15 July 2024) regarding the acceleration of east-west traffic. Hence, the DPU offloads the complex cryptographic operations to the hardware accelerators that are accessible via DOCA. When the IPsec connection is configured, the process begins by initializing the DOCA device for the secure port. This step ensures that the network interface is ready to handle incoming and outgoing traffic securely. To prepare the infrastructure for packet processing  
Figure 2: Overview of DOCA IPsec workflow. The sequential steps involved in setting up IPSec policies and processing network traffic within the BlueField environment are illustrated. and flow management, DPDK ports are probed to identify available network interfaces. This is followed by initializing DOCA Flow ([[https://docs.nvidia.com/doca/archive/doca-v1.2/flow-programming-guide/index.html](https://docs.nvidia.com/doca/archive/doca-v1.2/flow-programming-guide/index.html)]([https://docs.nvidia.com/doca/archive/doca-v1.2/flow-programming-guide/index.html](https://docs.nvidia.com/doca/archive/doca-v1.2/flow-programming-guide/index.html)) accessed on 10 January 2024) and DOCA Flow ports. DOCA Flow pipes are then constructed to define the flow of packets through various stages of processing. These pipes facilitate actions such as the filtering, forwarding, and manipulation of packet headers. A Unix Domain Socket (UDS) is created to establish a communication channel for receiving incoming data. This socket serves as the interface for interacting with external systems and applications. The system periodically checks for new IPsec policies. Upon receiving a new policy, it is parsed to extract relevant information such as encryption and decryption rules. If the policy corresponds to an encryption rule, an IPsec SA shared resource is created. This resource manages encryption parameters and states for packets matching the specified criteria. The encryption rule is then inserted into the appropriate DOCA Flow pipes. This ensures that packets matching the encryption criteria undergo the specified encryption process before further processing or transmission. After processing the IPsec policy, the system resumes listening for incoming data on the UDS. This allows it to continue handling network traffic while enforcing the defined security policies. As shown in Figure 3, the IPsec offload process on BlueField begins with the initialization and configuration of the DPU. This involves opening and initializing a DOCA device for the unsecured port and setting up the control pipe as the root for packet processing. Incoming packets are classified based on the protocol type (TCP or UDP) and IP version (IPv4 or IPv6).