METHOD AND APPARATUS FOR ESTABLISHING SECURE SESSIONS

• US 20030020621A1
• Filed: 12/19/2001
• Published: 01/30/2003
• Est. Priority Date: 07/24/2001
• Status: Active Grant

• Current Assignee: Marvell Asia Pte Limited (Marvell Technology Group Limited)
• Original Assignee: Cavium, LLC (Marvell Technology Group Limited)
• Inventors: Kessler, Richard E., Ahmed, Khaja E., Sanzone, Robert A., Carlson, David A., Hussain, Muhammad Raghib, Varga, Michael D.
• Granted Patent: US 7,240,203 B2
• Time in Patent Office: Days
• US Class Current: 340/635
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A method and apparatus for processing security operations are described. In one embodiment, a processor includes a number of execution units to process a number of requests for security operations. The number of execution units are to output the results of the number of requests to a number of output data structures associated with the number of requests within a remote memory based on pointers stored in the number of requests. The number of execution units can output the results in an order that is different from the order of the requests in a request queue. The processor also includes a request unit coupled to the number of execution units. The request unit is to retrieve a portion of the number of requests from the request queue within the remote memory and associated input data structures for the portion of the number of requests from the remote memory. Additionally, the request unit is to distribute the retrieved requests to the number of execution units based on availability for processing by the number of execution units.

Claims

1. A computer implemented method comprising:

calling an operation from a first processor;

executing a plurality of primitive security operations at a second processor in response to the operation call;

generating a set of data from executing the plurality of primitive security operations; and

establishing a secure session with the set of data.

2. The computer implemented method of claim 1 wherein the set of data comprises:

a set of decrypted data;

a set of encrypted data; and

a set of hashed messages.

3. The computer implemented method of claim 2 further comprising a set of random numbers.

4. The computer implemented method of claim 1 further comprising the first processor calling a second operation to establish a second secure session.

5. The computer implemented method of claim 1 wherein the secure session is an SSL 3.0 session, a TLS session, or an IPSec session.

6. A computer implemented method comprising:

calling a macro security operation;

performing a set of operations in response to the macro security operation, the set of operations comprising

generating a secret and a key material,

creating a first finished hash for a client message,

creating a second finished hash for a server message,

creating a finished message; and

establishing a secure session.

7. The computer implemented method of claim 6 wherein the set of operations further comprises

decrypting a pre-master secret;

and

decrypting a client finished message.

8. The computer implemented method of claim 6 wherein the set of operations further comprises generating a set of random numbers.

9. The computer implemented method of claim 6 wherein the set of operations further comprises creating an expected finished message.

10. The computer implemented method of claim 6 further comprising calling a second macro security operation to establish a second secure session.

11. A system comprising:

a first network element to request a secure session; and

a second network element networked to the first network element, the second network element to call a macro security operation from a first processor, to execute a plurality of primitive security operations at a second processor in response to the macro security operation cal and to generate a set of data from the execution of the plurality of primitive security operations.

12. The system of claim 11 wherein the set of data comprises:

a set of decrypted data;

a set of encrypted data; and

a set of hashed data.

13. The system of claim 11 wherein the first network element to request the secure session comprises the first network element to transmit a set of messages to the second network element, to execute a second macro security operation, and to generate a second set of data from the execution of the second macro security operation.

14. The system of claim 11 further comprising a third network element networked to the second network element, the third network element to request a second secure session with the second network element.

15. The system of claim 11 further comprising:

the first network element to request a second secure session with the second network element; and

the second network element to execute a second macro security operation to establish the second secure session with the first network element.

16. An apparatus comprising:

a first processor to call a macro security operation to establish a secure session;

a second processor coupled to the first processor, the second processor to perform a plurality of primitive security operations in response to the macro security operation call; and

a memory coupled to the first and the second processor, the memory to store a set of data generated by the second processor.

17. The apparatus of claim 16 wherein the second processor comprises:

a request unit to fetch and to distribute the macro security operation; and

a plurality of execution units coupled to the request unit, one of the plurality of execution units to execute the plurality of primitive security operations.

18. The apparatus of claim 17 further comprising:

the first processor to call a second macro security operation after calling the first macro security operation; and

a second one of the plurality of execution units to execute a second plurality of primitive security operations corresponding to the second macro security operation before the one of the plurality of execution units completes execution of the plurality of primitive security operations.

19. The apparatus of claim 17 wherein the one of the plurality of execution units comprises:

a microcode unit to translate the macro security operation into a plurality of primitive security operations;

an execution queue unit coupled to the microcode unit, the execution queue unit to queue the plurality of primitive security operations;

a plurality of primitive security operation units coupled to the execution queue unit, the plurality of primitive security operation units to perform the plurality of primitive security operations; and

a bus coupled to the plurality of primitive security operation units, the bus to transmit data.

20. The apparatus of claim 16 further comprising the memory to store a set of source data.

21. An apparatus comprising:

a first processor to call a macro security operation;

a second processor coupled to the first processor, the second processor comprising

a request unit to retrieve the macro security operation,

a plurality of execution units coupled to the request unit, one of the plurality of execution units to perform a plurality of primitive security operations, the plurality of primitive security operations corresponding to the macro security operation; and

a memory coupled to the first and second processor, the memory to store a set of data generated by the second processor.

22. The apparatus of claim 21 further comprising the memory to store a set of source data from the host processor.

23. The apparatus of claim 21 wherein each of the plurality of execution units comprises:

a microcode unit to translate the macro security operation into the plurality of primitive security operations;

an execution queue unit coupled to the microcode unit, the execution queue unit to queue the plurality of primitive security operations;

a plurality of primitive security operation units coupled to the execution queue unit, the plurality of primitive security operation units to perform the plurality of primitive security operations; and

a bus coupled to the plurality of primitive security operation units, the bus to transmit the set of generated data.

24. The apparatus of claim 21 further comprising:

the first processor to call a primitive security operation; and

a second one of the plurality of execution units to execute the primitive security operations.

25. A machine-readable medium that provides instructions, which when executed by a set of one or more processors, cause said set of processors to perform operations comprising:

executing a macro security operation at a first one of the set of processors;

executing a plurality of primitive security operations at a second one of the set of processors in response to the macro security operation call;

generating a set of data from executing the plurality of primitive security operations; and

establishing a secure session with the set of data.

26. The machine-readable medium of claim 25 wherein the set of data comprises:

a set of decrypted data;

a set of encrypted data; and

a set of hashed messages.

27. The machine-readable medium of claim 26 wherein the set of data further comprises a set of random numbers.

28. The machine-readable medium of claim 25 further comprising the first processor calling a second operation to establish a second secure session.

29. The machine-readable medium of claim 25 wherein the secure session is an SSL 3.0 session, a TLS session, or an IPSec session.

30. A machine-readable medium that provides instructions, which when executed by a set of one or more processors, cause said set of processors to perform operations comprising:

calling a macro security operation from a first one of the set of processors;

performing a set of operations at a second one of the set of processors in response to the macro security operation, the set of operations comprising

generating a secret and a key material,

creating a first finished hash for a client message,

creating a second finished hash for a server message,

creating a finished message; and

establishing a secure session.

31. The machine-readable medium of claim 30 wherein the set of operations further comprises decrypting a pre-master secret and a client finished message.

32. The machine-readable medium of claim 30 wherein the set of operations further comprises generating a set of random numbers.

33. The machine-readable medium of claim 30 the set of operations further comprising creating an expected finished message.

34. The machine-readable medium of claim 30 further comprising calling a second macro security operation to establish a second secure session.