For the most part, encryption and packet processing have been handled separately. But recent security processors have adopted a flow-through architecture that simplifies system design but requires the security chip to perform some packet classification and header modification-tasks that are often handled by an NPU.

With the 2850, Intel took the opposite approach: adding security functions to the NPU. The 2850 includes a pair of encryption units that take up a modest amount of silicon area. The remaining portions of the IPSec protocol, such as classification and header modification, are handled in software using the programmable IXP packet engines.

The encryption units together operate at about 10 Gbits/second, the same speed as the packet engines. One would expect the IPSec software to slow the packet engines, but it does not. The extra IPSec headers actually reduce the maximum packet rate from 15 million packets a second to fewer than 9 for a 10 Gigabit Ethernet connection. With fewer packets to process, the 2850 can keep up with wire speed even with IPSec turned on.

At this speed, the 2850 looks like a good deal. Intel's list price is $725, about a $200 premium over the IXP2800, which is identical except for lacking the crypto units. A separate 10-Gbit/s IPSec accelerator is likely to cost hundreds (no such device is available today) and dissipate more than the 2 W required by the 2850's crypto units.

Few customers, however, need 10 Gbits/s of IPSec encryption. IPSec is the primary protocol for virtual private networks (VPN); even a large corporation is unlikely to have more than 2 Gbits/s of VPN support in the data center. The 2850 can be used in these slower systems, but it then competes against less expensive NPUs and security processors.

Intel hopes that, by making encryption a simple add-in, more OEMs will offer it in their systems. As the cost of security falls, IPSec may be used to secure LAN as well as WAN traffic; in fact, IPSec is required for IP storage systems, which send storage data across a LAN. Over time, these trends will increase demand for the 2850 and other NPUs with integrated encryption.

Linley Gwennap is Founder and Principal Analyst of the Linley Group (www.linleygroup.com/npu).