Ikhadi le-crypto le-VPN gateway: ukudluliswa okune ngaphambi kokuthenga

Ama-accelerator amadala e-cryptographic avela ohlwini lwe-PCI, futhi kucatshangwa ukuthi i-VPN manje izobhala ngokushesha. Ukudluliswa okune okuhlukene kufanele kuphumelele ngaphambi kokuba lokho kube yiqiniso: uhlelo luthola idivayisi, isiqhubezi esigcinwayo siyayiqondisa, i-interface iveza umsebenzi odingwa yi-VPN, futhi i-backend esebenzayo ye-VPN iyawufuna. Uma kube khona okwehlulekayo, ikhadi lihlala ngaphandle komzila wangempela womhubhe.

Ukutholwa ukudluliswa kokuqala, hhayi okokugcina

Ukutholwa kufakazela kuphela ukuthi ibhasi ibona idivayisi nokuthi i-kernel inombono othile wokuthi iyini. Ukusekelwa kwesiqhubezi kuyisango elilandelayo, futhi kuncike enguqulweni: imojuli eyayikhona enguqulweni endala ingase ingabikho ngokuphelele kusikhwama se-kernel samanje. Ngaphezu kwalokho, isiqhubezi kufanele sibhalise i-algorithm nemodi ethile esetshenziswa yisiteshi sedatha. Ikhadi elisheshisa i-AES-CBC alenzi lutho ekuhlelweni okuxoxisana nge-AES-GCM.

Shono ukudluliswa ngakunye ngokwehlukana ekuhloleni, ngoba ukwehluleka kwesine kubonakala ngaphandle kufana nokwehluleka kokokuqala.

Funda uhlu lwama-algorithm e-kernel

Qala ngokuqoqa lokho umsingathi asekwazi ngodivayisi nangama-algorithm akubhalisile.

lspci -nn | grep -i -E "crypt|hifn|soekris"
grep -E "^(name|driver|priority)" /proc/crypto | head -40

Umugqa we-PCI unikeza izikhombisi zomenzi nedivayisi ezidingekayo kunoma yikuphi ukuseshwa kwesiqhubezi, futhi/proc/crypto uhlu lwezinhlelo zokusebenza ezibhalisiwe kanye neziqhubezi zazo nokubaluleka kwazo. Inani lokubaluleka lihlela ukukhethwa phakathi kwezinhlelo zokusebenza ze-algorithm efanayo, okungafani nokuthi uhlelo lokusebenza lukhethe olulodwa kuzo. Uma i-algorithm yekhadi ingavela lapho, isiqhubezi asikaze siyibhalise futhi akukho shintsho endaweni yomsebenzisi elizoyibiza. Bhala izikhombisi namagama ezinhlelo zokusebenza esikhundleni sesithombe sesikrini sekhadi.

I-VPN kufanele ikhethe lolo hlelo lokusebenza

Ukutholakala ku-kernel kuwumenyu, hhayi isiqinisekiso sokuthi inqubo ye-VPN ya-oda kusuka kuwo. Hlola lokho i-backend ekusebenzisayo ngempela.

openssl speed -evp aes-256-gcm
openssl engine -t -c

Umyalo wejubane uvivinya indlela yelabhulali uqobo futhi unikeza umugqa oyisisekelo womshini njengoba uhleliwe, kuyilapho uhlu lwama-injini lubonisa ukuthi ngabe ikhona yini iphrovayida yokuzikhethela etholakalayo ku-OpenSSL nakanye. I-VPN esendaweni yomsebenzisi enelabhulali yayo ye-crypto idlula ngokuphelele izinhlelo zokusebenza ze-kernel, ngakho isiqhubezi esibhalisiwe singase singabi nandaba nayo. Ukwehliswa komthwalo wesiteshi sedatha kungenye indlela yesithathu, eshintsha ukucutshungulwa kwamaphakethe esikhundleni sokuthumela izicelo ze-cipher ekhadini lokunweba. Thola ukuthi yikuphi kwalokhu kuthathu okuchaza ukusatshalaliswa kwakho ngaphambi kokuthenga i-hardware kwesine.

Qhathanisa nendlela ye-CPU osunayo kakade

Amaprosesa esimanjemanje anezimiyalo ze-AES ezisetshenziswa yilabhulali egcinwayo ngaphandle kwehardware eyengeziwe, futhi agwema ukudluliswa kwebhasi namakhophi engeziwe. I-accelerator endala ingahlulwa yileyo ndlela ngenkathi isabika izinombolo eziyisisekelo ze-cipher ezimangalisayo. Linganisa umthwalo wangempela womsebenzi: ithrafikhi efanayo, izilungiselelo zokuvikela ezifanayo, umugqa oyisisekelo uma kuqhathaniswa nomuntu ozobhalwa, nomthwalo we-CPU kanye nokugeleza kohlelo lokusebenza kubhalwa ndawonye. Faka ekunqumeni ukuziphatha kokubuyekeza nokubuyisela, ngoba imojuli engagcinwa ikhulisa ingozi yokunakekelwa kwesango kukho konke ukuphila kwayo.

Isizathu sokuthenga iwuchungechunge olusekelwayo kanye nenzuzo elinganisiwe. Ikhadi elitholiwe, noma imojuli umuntu ayihlanganisayo ngesikhathi esithile, akusona isizathu sokwenza isango elinakekelwayo lincike ku-hardware edlule.