Method and apparatus to reduce errors of a security association

• US 20020166070A1
• Filed: 05/04/2001
• Published: 11/07/2002
• Est. Priority Date: 05/04/2001
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Minnick, Linden, Mualem, Avraham
• Application Number:
  US09/849,126
• Publication Number:
  US 20020166070A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Embodiments of a method and apparatus to reduce errors of security association are described.

Claims

1. A method of transferring a security association (SA) comprising:

verifying that a SA within an information handling apparatus (IHA) prior to being transferred to a network adapter is substantially similar to the SA within the network adapter after being transferred.

2. The method of claim 1, wherein verifying that the SA within the IHA prior to being transferred to the network adapter is substantially similar to the SA within the network adapter after being transferred further comprises:

transferring the SA and an associated integrity indicator to the network adapter from the IHA;

verifying the integrity of the SA after being transferred to the network adapter; and

indicating the integrity of the SA to the IHA.

3. The method of claim 2, wherein verifying the integrity of the SA further comprises computing a computed associated integrity indicator from the SA after transferring;

comparing the computed associated integrity indicator against the associated integrity indicator after transferring; and

wherein indicating the integrity of the SA to the IHA further comprises providing an indication to the IHA in response to the comparing.

4. The method of claim 3, wherein providing the indication comprises setting an integrity error indicator bit in a memory on the IHA.

5. An integrated circuit comprising:

a network adapter operative to receive a security association (SA) and a received associated integrity indicator from an Information Handling Apparatus (IHA), said adapter including an integrity indicator checker operative to verify an integrity of the SA.

6. The integrated circuit of claim 5, wherein said network adapter is coupled to a bus, said bus being coupled to the IHA.

7. The integrated circuit of claim 6, wherein the integrity indicator checker is operative to compute a computed associated integrity indicator from the received SA, and to verify the integrity of the SA by comparing the received associated integrity indicator with the computed associated integrity indicator.

8. The integrated circuit of claim 7, wherein the integrity indicator checker is operative to compute the computed associated integrity indicator from the SA using one of the following integrity checking methods:

a cyclical redundancy checking computations method, a checksum computations method, a parity checking method, a Huffman coding method and a hash computation method.

9. The integrated circuit of claim 7, wherein said adapter further comprises a memory controller operative to indicate the results of the comparing to a memory on the IHA.

10. The integrated circuit of claim 5, further comprising:

a transceiver operative to transfer packets encrypted with the SA to a network, said transceiver being operative to receive packets from the network and to decrypt the packets with the SA.

11. A network adapter comprising:

a memory controller operative to receive a security association (SA) and a received associated integrity indicator from an Information Handling Apparatus (IHA);

a transceiver operative to transmit onto a network, packets encrypted with the SA; and

an integrity indicator checker operative to verify an integrity of the SA using the received associated integrity indicator.

12. The network adapter of claim 11, wherein the integrity indicator checker is operative to compute a computed associated integrity indicator from the received SA, and is operative to verify the integrity of the SA by comparing the received associated integrity indicator with the computed associated integrity indicator.

13. The network adapter of claim 12, wherein said memory controller is operative to transfer a result of the comparing to a memory on the IHA.

14. The network adapter of claim 11, wherein said transceiver is operative to receive packets from the network and to decrypt the packets with the SA.

16. The article of claim 15, wherein the network adapter is operative to determine the integrity of the SA and to transfer the indication of the integrity of the SA to a memory in the IHA, and wherein the instructions further result in:

reading the indication of the integrity of the SA from the memory after the network adapter determines the integrity of the SA.

17. The article of claim 15, wherein the instructions further result in:

computing the associated integrity indicator of the SA before transferring the SA to the network adapter using an integrity checking method.

18. The article of claim 16, wherein the instructions further result in:

transferring a second SA and a second associated integrity indicator from the IHA to the network adapter in response to reading the indication of the integrity of the SA.

20. The network communication system of claim 19, wherein the network adapter is operative to read the transferred SA and associated integrity indicator, and wherein the network adapter is operative verify the integrity of the SA by computing a computed integrity indicator from the transferred SA with an integrity checking method, and determining if the associated integrity indicator and the computed integrity indicator match.

21. The network communications system of claim 20, wherein the network adapter is operative to provide an indication if the associated integrity indicator and the computed integrity indicator match.

22. The network communications system of claim 20, wherein the network adapter is operative to transfer a second SA and a second associated integrity indicator from the IHA to the network adapter in response to an indication that the associated integrity indicator and the computed integrity indicator do not match.

23. The network communications system of claim 19, wherein said network adapter is operative to receive packets from the network and to decrypt the packets with the SA.

15. An article comprising:

a storage medium, said storage medium having stored thereon instructions, that, when executed in an Information Handling Apparatus (IHA) coupled to a network adapter, result in security association (SA) integrity protection by;

transferring a SA from the IHA to the network adapter; and

transferring an associated integrity indicator from the IHA to the network adapter.

19. An network communication system comprising:

an information handling apparatus (IHA) coupled to a network adapter, said IHA being operative to transfer a security association (SA) and an associated integrity indicator to the network adapter;

the network adapter being operative to verify the integrity of the SA, to provide an indication of the integrity of the SA to the IHA and to transmit packets encrypted with the SA via a network.