Zero Trust Cloud VPN Based on VPP and WireGuard
summary
A Zero Trust Cloud VPN is built around VPP dataplane and WireGuard tunnels with a controller for service discovery and key distribution, SGX-based TEE for attestation, and wgsd for service discovery. Crypto is accelerated with AVX‑512 via Intel IPsec Multi‑buffer (+~20% vs AVX2), batching + prefetching (+~50%), and Intel QuickAssist offload (≈3× throughput gain). Implementation supports Linux/Windows/iOS/Android endpoints, DPDK/VPP user‑space NICs, FRR routing, and Kubernetes integration.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:36Agenda
- 1:17Industry Challenges
- 3:10Architecture
- 9:16Reference Architecture
- 12:29Roadmap
- 15:32Data Flow
- 17:56Edge
- 23:01Fan Zhang
- 29:50WireGuard
- 34:11CPU Architecture
- 35:54VPP Architecture
- 44:56Thank you
related talks
32mZero Trust Network Turnkey Solution to Support Zero Trust Service Mesh
40mClarifying Zero Trust: The Model, the Philosophy, the Ethos
40mZero Trust, Zero Pain: A Practical Implementation with Intrinsic Security
32mBuilding Zero Trust with Envoy
34mZeroTrust Microservices with Wasm & WireGuard
35mDemystifying Zero-Trust for Cloud Native Technologies
32mImplementing Zero Trust
48mWireGuard: Next Generation Abuse-Resistant Kernel Network Tunnel