C H A P T E R 1 |
Product Overview |
This chapter provides an overview of the Sun Crypto Accelerator 4000 board, and contains the following sections:
The Sun Crypto Accelerator 4000 board is a Gigabit Ethernet-based network interface card that supports cryptographic hardware acceleration for IPsec and SSL (both symmetric and asymmetric) on Sun servers. In addition to operating as a standard Gigabit Ethernet network interface card for unencrypted network traffic, the board contains cryptographic hardware to support a higher throughput for encrypted IPsec traffic than the standard software solution.
Once installed, the board is initialized and configured with the vcaadm utility which manages the keystore and user information and determines the level of security in which the board operates. Once a keystore and security officer account are configured, Java and PKCS11 applications such as Sun ONE server software, and OpenSSL applications such as Apache can be configured to use the board for cryptographic acceleration.
Note - Solaris 10 or future compatible versions of the Solaris Operating System are required to use version 2.0 of the board. |
![]() |
Caution - Do not use the Sun Crypto Accelerator 4000 board as a boot device. |
The Sun Crypto Accelerator 4000 version 2.0 adds the following features to what was provided in previous releases:
The Sun Crypto Accelerator 4000 board is interoperable with existing Ethernet equipment assuming standard Ethernet minimum and maximum frame size (64 to 1518 bytes), frame format, and compliance with the following standards and protocols:
The Sun Crypto Accelerator 4000 boards are designed to comply with the security requirements for cryptographic modules as documented in the Federal Information Processing Standard (FIPS) 140-2, Level 3.
The board supports the following protocols:
The board accelerates the following IPsec functions:
* When configured for in-line IPsec acceleration (See In-Line IPsec Hardware Acceleration)The board accelerates the following SSL functions:
Together with the Solaris Cryptographic Framework, the board accelerates cryptographic algorithms in both hardware and software. The reason for this complexity is that the cost of accelerating cryptographic algorithms is not uniform across all algorithms. Some cryptographic algorithms were designed specifically to be implemented in hardware, others were designed to be implemented in software. For hardware acceleration, there is the additional cost of moving data from the user application to the hardware acceleration device, and moving the results back to the user application. Note that a few cryptographic algorithms can be performed by highly tuned software as quickly as they can be performed in dedicated hardware.
The Sun Crypto Accelerator 4000 driver (vca) examines each cryptographic request and determines the best location for the acceleration (host processor or Sun Crypto Accelerator 4000), to achieve maximum throughput. Load distribution is based on the cryptographic algorithm, the current job load, and the data size.
The board accelerates the following IPsec algorithms.
The board accelerates the following SSL algorithms.
Diffie-Hellman (Apache only) and RSA (up to 2048 bit key), DSA |
The board supports two forms of IPsec acceleration: out-of-band and in-line. Both configurations offload high-overhead cryptographic operations from the SPARC® processor to the board. See IPsec Hardware Acceleration Configuration.
When the board is configured for out-of-band IPsec acceleration, supported encryption and decryption operations are accelerated in hardware. All IPsec specific packet processing is performed by the host Solaris IPsec software. See Enabling Out-of-Band IPsec Acceleration.
Note - No IPsec configuration or tuning is required to use the board for out-of-band IPsec acceleration in Solaris 10. You simply install the Sun Crypto Accelerator 4000 packages and reboot. |
When configured for in-line IPsec acceleration, supported encryption, decryption, and authentication operations are accelerated in hardware. Portions of the IPsec specific packet processing are performed directly by the board. See Enabling In-Line IPsec Acceleration for instructions on how to configure the board for in-line IPsec acceleration.
TABLE 1-4 shows which SSL accelerated algorithms may be off-loaded to hardware and which software algorithms are provided for Sun ONE and Apache Web Servers.
The Sun Crypto Accelerator 4000 hardware is a full-size (4.2 inches x 12.283 inches) cryptographic accelerator PCI Gigabit Ethernet adapter that enhances the performance of IPsec and SSL on Sun servers.
The Sun Crypto Accelerator 4000 MMF adapter is a single-port Gigabit Ethernet fiber optics PCI bus card. It operates in 1000 Mbps Ethernet networks only.
On when the board is in the HALTED (fatal error) state or low-level hardware initialization failed. |
||
On in POST, DIAGNOSTICS, and FAILSAFE (firmware not upgraded) state. |
||
On in POST, DIAGNOSTICS, and DISABLED (driver not attached) state. |
||
On if the security officer has initialized the board with vcaadm. See Initializing the Board With vcaadm. |
||
On when operating in FIPS 140-2 level 3 certified mode. Off when in non-FIPS mode. |
||
The Sun Crypto Accelerator 4000 UTP adapter is a single-port Gigabit Ethernet copper-based PCI bus card. It can be configured to operate in 10, 100, or 1000 Mbps Ethernet networks.
On when the board is in the HALTED (fatal error) state or low level hardware initialization failed. |
||
On in POST, DIAGNOSTICS, and FAILSAFE (firmware not upgraded) state. |
||
On in POST, DIAGNOSTICS, and DISABLED (driver not attached) state. |
||
On if the security officer has initialized the board with vcaadm. See Initializing the Board With vcaadm. |
||
On when operating in FIPS 140-2 level 3 certified mode. Off when in non-FIPS mode. |
||
The Sun Crypto Accelerator 4000 hardware and associated software provides the capability to work effectively on Sun platforms supporting Dynamic Reconfiguration (DR) and hot-plugging. During a DR or hot-plug operation, the Sun Crypto Accelerator 4000 software layer automatically detects the addition or removal of a board, and adjusts the scheduling algorithms to accommodate the change in hardware resources.
For High Availability (HA) configurations, multiple Sun Crypto Accelerator 4000 boards can be installed within a system or domain to insure that hardware acceleration is continuously available. In the unlikely event of a Sun Crypto Accelerator 4000 hardware failure, the software layer detects the failure and removes the failed board from the list of available hardware cryptographic accelerators. Sun Crypto Accelerator 4000 software adjusts the scheduling algorithms to accommodate the reduction in hardware resources. Subsequent cryptographic requests are scheduled to the remaining boards.
Note that the Sun Crypto Accelerator 4000 hardware provides a source for high-quality entropy for the generation of long-term keys. If all the Sun Crypto Accelerator 4000 boards within a domain or system are removed, long-term keys are generated with lower-quality entropy.
The Sun Crypto Accelerator 4000 software allows for the distribution of load across as many boards as are installed within the Solaris domain or system. Incoming cryptographic requests are distributed across the boards based on fixed-length work queues. Cryptographic requests are directed to the first board, and subsequent requests stay directed to the first board until it is running at full capacity. Once the first board is running at full capacity, further requests are queued to the next board available that can accept the request of this type. The queueing mechanism is designed to optimize throughput by facilitating request coalescing at the board.
TABLE 1-7 provides a summary of the hardware and software requirements for the Sun Crypto Accelerator 4000 adapter.
Refer to the Sun Crypto Accelerator 4000 Board Version 2.0 Release Notes for detailed required patch information.
Copyright © 2005, Sun Microsystems, Inc. All Rights Reserved.