Product Attributes

How important is programmability to the next generation of security devices?

Digitalization and automation are now a global trend. In the wake of the epidemic, services in all sectors are moving online, and with the rapid implementation of home working, people are relying more and more on internet connectivity for their work and life.

However, as the number of users and connected devices continues to increase and the functions and needs become more diverse, the system architecture becomes increasingly complex and the scope of system functions expands, leading to a large number of potential risks. As a result, downtime is a common occurrence, and “crashes” are frequently in the headlines.

The Xilinx white paper WP526, The Importance of Programmability in Next Generation Security Appliances, explores multiple firewall architectures and the combination of the flexibility and configurability of Xilinx adaptive devices and its IP and tooling offerings to significantly improve security processing performance.

　Security appliances continue to evolve

The next generation of network security implementations is continuing to evolve and undergo an architectural shift from backup to inline implementations. With the start of 5G deployments and the exponential increase in the number of connected devices, there is an urgent need for organizations to revisit and modify the architecture used for security implementations. 5G throughput and latency requirements are transforming access networks, while at the same time requiring additional security. This evolution is driving the following changes in network security.

1. higher L2 (MACSec) and L3 security throughputs.

2. the need for policy-based analysis at the edge/access side

3. application-based security requiring higher throughput and connectivity.

4. the use of AI and machine learning for predictive analytics and malware identification

5. the implementation of new cryptographic algorithms driving the development of post-quantum cryptography (QPC).

Along with the above requirements, network technologies such as SD-WAN and 5G-UPF are increasingly being adopted, which requires the implementation of network slicing, more VPN channels, and deeper packet classification. In the current generation of network security implementations, most application security is handled using software running on the CPU. While CPU performance has increased in terms of the number of cores and processing power, the increasing throughput requirements still cannot be solved by a pure software implementation.

Policy-based application security requirements are constantly changing, so most available off-the-shelf solutions can only handle a fixed set of traffic headers and encryption protocols. Due to these limitations of software and fixed ASIC-based implementations, programmable and flexible hardware provides the perfect solution for implementing policy-based application security and solves the latency challenges of other programmable NPU-based architectures.

The flexible SoC has a fully hardened network interface, cryptographic IP, and programmable logic and memory to implement millions of policy rules through stateful application processing such as TLS and regular expression search engines.