Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The DPDK security presentation held at DPDK Summit Bangalore on March 9, 2018 introduced rte_security, a framework for managing and provisioning hardware acceleration for security protocols. Presented by Hemant Agrawal of NXP AG and Akhil Goyal of NXP Semiconductors, the session focused on moving cryptographic operations and protocol processing such as IPsec from general-purpose CPU cores to inline or lookaside hardware.
When and where was the presentation held?
The session was part of DPDK Summit Bangalore, India, on March 9, 2018. The official event listing identifies it as “Rte_Security: A New Crypto Offload Framework in DPDK.” Hemant Agrawal, Software Architect at NXP AG, and Akhil Goyal, Software Engineer at NXP Semiconductors, presented it. The DPDK 2018 India video playlist uses the same title and presenter names.
As an Amazon Associate I earn from qualifying purchases.
What problem was rte_security designed to solve?
The presentation described rte_security as a “Framework for management and provisioning of hardware acceleration of security protocols.” Its purpose was to give DPDK applications a common way to configure security processing in specialized hardware instead of implementing every device-specific mechanism themselves.
The event abstract states that the framework could offload cryptographic operations and protocol processing such as IPsec to hardware. The stated benefit was reducing the CPU cycles required for packet processing. The sources for this presentation do not publish a throughput result, latency figure, CPU-percentage reduction or other numerical benchmark.
#1 Best Overall
How the framework was organized
Generic security-session APIs
The slide material describes generic APIs for managing security sessions. A session represents the security context that an application provisions for a protocol or transformation, allowing the application to use a common interface while the underlying hardware and driver handle device-specific details.
Integration with DPDK devices
rte_security was presented alongside DPDK network and cryptodevice integration. This connected security-session management with the poll-mode drivers (PMDs) that expose packet-processing and cryptographic hardware to a DPDK application.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Protocol scope shown in 2018
IP Security (IPsec) was the concrete protocol identified in both the event abstract and the slide text. The presentation also listed possible application areas including enterprise and small-business VPNs, wireless backhaul, data-center SSL, WLAN backhaul using CAPWAP or DTLS, and control-plane functions such as PKCS and random-number generation.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchInline versus lookaside offload
The talk explicitly covered both inline and lookaside hardware offload. These terms describe where security processing sits in the packet path and how the network and cryptographic devices cooperate.
Rank #4
| Aspect | Inline offload | Lookaside offload |
|---|---|---|
| Where processing occurs | Security processing is placed in the network data path, typically within hardware associated with packet I/O. | Packets or security operations are handed to a separate cryptographic or security accelerator, then returned to the application or packet path. |
| Device relationship | The network device and its security context are closely coordinated because packet handling and cryptographic processing occur as one path. | The application coordinates network processing with a distinct crypto device through the security and cryptodevice interfaces. |
| Typical design emphasis | Minimizing software work per packet and avoiding extra movement between processing stages. | Using a dedicated accelerator for cryptographic work while retaining more packet-path control in software. |
| API requirement | The framework must describe security capabilities and context that the network hardware can apply directly. | The framework must provision the security session and express how operations are submitted to and completed by the separate accelerator. |
| Expected CPU effect | Less host-CPU involvement in packet security when the NIC or inline engine supports the required operation. | Less host-CPU cryptographic work, although the application still manages submission, completion and packet integration. |
The presentation explains the architectural distinction; it does not provide a universal performance ranking. Actual gains depend on the hardware, protocol, packet sizes, traffic pattern, driver support and configuration.
How IPsec fits the model
IPsec was the session’s clearest example of protocol offload. In a DPDK application, an IPsec security association and related parameters would be represented through the security framework, then provisioned in hardware that supports the required mode. Packet encryption, authentication or decryption could consequently be performed by an inline engine or by a lookaside accelerator, rather than entirely on the CPU.
Best Value
- ADD WI-FI TO YOUR YALE ASSURE LOCK OR LEVER: No hub or Connect needed. Note: This product only works on 2.4 GHz Wi-Fi in the U.S. and Canada.
- SIMPLE TO ADD: Simply insert the Yale Wi-Fi Smart Module in the slot above the batteries. Add the module as an accessory in the Yale Access app.
- UPGRADE YALE ASSURE LOCKS: Add Wi-Fi to your Yale Assure Lock or Lever with no hub or Connect needed.
- ACCESS FROM ANYWHERE: Lock, unlock, share access and see who comes and goes from anywhere using the Yale Access app.
- AUTO-UNLOCK: Your Assure Lock/Lever will automatically unlock as you get home and relock for you.
The exact cipher and authentication combinations, hardware models and driver capabilities were not specified in the supplied 2018 event material. Those details should therefore be checked against documentation for the particular DPDK release and device being deployed.
Why the presentation mattered to DPDK users
- Common abstraction: applications could target security-session concepts instead of writing separate control logic for every accelerator.
- Protocol-aware offload: the proposal addressed not only raw cryptographic primitives but also specific protocol processing, with IPsec as the named example.
- Multiple hardware models: inline and lookaside support acknowledged that DPDK systems expose security through different device architectures.
- Broader deployment targets: the listed use cases ranged from VPN gateways and wireless backhaul to data-center and WLAN security functions.
What this 2018 source does not establish
This is a historical conference presentation, not a current DPDK API reference. The available material does not establish present-day API names or behavior, a complete supported-protocol list, a particular vendor device, or a measured CPU or throughput improvement. Those points vary by DPDK release, PMD and hardware generation and require current, device-specific documentation.
The Bottom Line
DPDK’s India 2018 security talk introduced rte_security as a common framework for provisioning hardware security acceleration, using IPsec to illustrate both inline and lookaside offload. Its central promise was to reduce CPU work in packet processing, not to prescribe one universal hardware design or publish a benchmark.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
