基于HIPP的SRTP/SRTCP协议的设计与实现

【作者】 吴斌；

【导师】 潘雪增；

【作者基本信息】 浙江大学 ， 计算机系统结构， 2006， 硕士

【摘要】 随着网络技术的发展和标准的制定,实时音频、视频的应用越来越广泛,这些应用反过来又促进了相关协议标准的发展。1996年IETF在RFC1889中定义了传输实时数据的Internet标准协议RTP,并在2003年制定了升级版本RFC3550。由于网络安全问题日益突出,2004年3月IETF在RFC3711中定义了RTP的一个扩展协议SRTP来提高RTP应用的安全性,SRTP定义了对RTP与RTCP流进行加密、认证以及抗重播攻击检测等的实现框架。HIPP是著名的网络安全公司Hifn研发的安全芯片系列,广泛应用于路由器、交换机以及VPN网关等中间设备以提高安全协议的处理性能。HIPP芯片支持目前最流行的块加密算法(DES/3DES,AES128/AES192/AES256)及加密模式(ECB,CBC,Counter)、流加密算法(ARC4)、压缩算法(LZS,MPPC)、认证算法(HMAC MD5,HMAC_SHA-1),其精心设计的流水体系结构能以非常低的延时并行完成对网络包的压缩、加密、认证、抗重播检测等安全处理。HIPP以其优秀的可扩展性成功的实现了PPTP、IPSec与SSL等多种安全协议,对多协议的支持归功于其“算法处理”与“协议处理”相分离的体系结构:HIPP内部有一个专用的RISC处理器DPU用于“协议处理”,并控制其它安全引擎(如加密、压缩、认证、填充)完成“算法处理”。与IPSec类似,HIPP可以支持SRTP的两种实现方式:Bump-in-the-stack(BITS)与Bump-in-the-wire(BITW)。BITS实现在RTP与UDP之间,BITW实现在IP与链路层之间,它们由不同的DPU代码分别实现。实现的难点是SRTP48位包索引的维护、各协议头的分析与处理、非标准认证标签长度的处理等。本文首先介绍HIPP芯片的体系结构、数据处理模型和会话的概念,在此基础上重点介绍了DPU,包括其工作环境、代码、寄存器组、指令集、标记;然后对SRTP/SRTCP协议进行了分析与讨论;最后详细讨论了如何在HIPP上实现SRTP/SRTCP,并做了总结。更多还原

【Abstract】 With the development of technologies and standards supporting the real-time services, more and more audio/video applications are becoming available on the Internet, which also promote the development of associated standards. In 1996 IETF defined RTP in RFC 1889, which address how to transmit real-time data, and update it as RFC3550 in 2003. Due to the serious network security issue, SRTP was published as RFC3711 in 2004 to improve the security of RTP applications. SRTP provides a framework for encryption, authentication and anti-replay of RTP/RTCP streams.HIPP is a series of network security chip produced by Hifn and is widely used in Routes, Switches, and VPN gateways to enhance the performance of security protocol. HIPP supports the most popular block cipher (DES/3DES,AES128/AES192/AES256) and mode (ECB, CBC, Counter), stream cipher (ARC4), compression algorithm (LZS, MPPC), authentication algorithm (HMAC_MD5, HMAC_SHA-1). The ingenious pipeline architecture of the HIPP can finish the compression, encryption, authentication and anti-replay check simultaneously with low latency.Depends on the excellent scalability, HIPP has been successfully implemented PPTP, IPSec and SSL, etc. Supporting multiple security protocols depends on the architecture that "Algorithm Process" and "Protocol Process" are separated. DPU, a dedicated RISC CPU inside the HIPP, is responsible for the "Protocol Process" and controling other security engine (e.g., encryption, compression, authentication, and padding) to finish the "Algorithm Process".As IPSec, HIPP supports iwo kinds of SRTP implementation: Bump-in-the-stack (BITS) and Bump-in-the-wire (BITW). The former is between RTP and UDP, while the latter is between IP and local link. There are BITS DPU code and BITW DPU code, respectively. The main issues are 48bit SRTP packet index maintance, protocol header analysis and process, non-standard authentication tag length process,etc.This paper firstly have a instruction on the HIPP architecture, packet process modal and the concept of session, based on which is the emphasis DPU, including DPU environment, code, register set, instruction set, token. Then analyse the SRTP/SRTCP protocol, and finally discussed the detailed implementation of them in the HIPP.更多还原