SeGW function offload 1/4 SeGW VNF SmGW VNF Virtual Switch Other VNF VNFs NFVI Network Processor Offload “programming” 1)VNF need to talk to Packet Processor to do the job on its behalf 2)Protocol can be OpenFlow or Netconf or…. 3)HW independent API can probably be defined 4)Should happen without checking if hardware supports it

SeGW function offload 2/4: path change SeGW VNF SmGW VNF Virtual Switch Other VNF Network Processor VNFs NFVI 1)If hardware fully supports program then full offload 2)If partial offload, offload whatever hardware supports, complements in software in vSwitch 3)Is it a Forwarding Graph change ? 4)Lawfull intercept in hardware ?

SeGW function offload 3/4 SeGW VNF SmGW VNF Virtual Switch Other VNF VNFs NFVI Network Processor Offload “programming” 1)VNF need to talk to Packet Processor to do the job on its behalf 2)Protocol can be OpenFlow or Netconf or…. 3)HW independent API can probably be defined 4)Should happen without checking if hardware supports it Virtual Switch

SeGW function offload 4/4 SeGW VNF SmGW VNF Virtual Switch Other VNF VNFs NFVI Network Processor 1)VNF need to talk to Packet Processor to do the job on its behalf 2)Protocol can be OpenFlow or Netconf or…. 3)HW independent API can probably be defined 4)Should happen without checking if hardware supports it Virtual Switch

SeGW Crypto offload: with or without HW SeGW VNF SmGW VNF Virtual Switch Other VNF VNFs NFVI NIC 1)VNF receives encrypted IPSec, leverages synthetic device for decryption 2)Crypto front end passes to backend 3)Backend implements in hardware or software Decrypted IPSec traffic Crypto Accel Crypto Accel Crypto Accel-Bk Crypto Accel-Bk

SeGW Crypto by cpu instructions SeGW VNF SmGW VNF Virtual Switch Other VNF VNFs NFVI NIC Decrypted IPSec traffic Crypto Accel-Bk Crypto Accel-Bk 1)At startup, crypt Accel back-end sends crypto plugin to front end 2)VNF receives encrypted IPSec, leverages synthetic device for decryption 3)Crypto front end does the decryption in VNF Crypto Accel Crypto Accel

vRouter Forwarding Graph SmGW VNF Virtual Router Other VNF IPSec Packet Processor VNFs NFVI 1)No need of a SecGW VNF 2)VNFD describes the need of IPSec termination for SmGW 3)If hardware fully supports program then full offload 4)If partial offload, offload whatever hardware supports, complements in software in vSwitch 5)No need for standardization