Systems and methods for implementing host-based security in a computer network

• US 20030061505A1
• Filed: 08/30/2002
• Published: 03/27/2003
• Est. Priority Date: 08/31/2001
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Adaptec Incorporated (Steel Partners Holdings LP)
• Inventors: Mukund, Shridhar, Munnangi, Sivakumar, Sperry, Todd
• Granted Patent: US 7,162,630 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/193 at the transport layer, e.g. TCP related
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/289 Intermediate processing functionally located close to the data consumer application, e.g. in same machine, in same home or in same sub-network
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/5651 Reducing the amount or size of exchanged application data
• CPC Class Codes: H04L 69/10 Streamlined, light-weight or high-speed protocols, e.g. express transfer protocol [XTP] or byte stream
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures
• CPC Class Codes: H04L 69/166 IP fragmentation; TCP segmentation
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

An architecture for implementing host-based security such that data security may be applied whenever the confidential data leaves a host computer or a networked device. The improved method and architecture may be implemented in a single integrated circuit for speed, power consumption, and space-utilization reasons. Within the integrated circuit, a combination of hardware-implemented, network processor-implemented, and software-implemented functions may be provided. The innovative host-based security architecture may offer line-rate IPSec acceleration, TCP acceleration, or both.

Claims

1. An integrated circuit for facilitating data communication between two network nodes, said integrated circuit being configured to be associated with a first network node of said two network nodes and disposed in a data communication path between said two network nodes during said data communication, comprising:

an embedded processor for performing a first plurality of TCP acceleration functions for packets sent from said first network node to a second one of said two network nodes and for performing a first plurality of security functions for said packets;

at least one network processor for performing a second plurality of said TCP acceleration functions for said packets and for performing a second plurality of said security functions for said packets, said second plurality of said TCP acceleration functions being different from said first plurality of said TCP acceleration functions, said second plurality of said security functions being different from said first plurality of said security functions;

hardware circuitry for performing a third plurality of said TCP acceleration functions for said packets and for performing a third plurality of said security functions for said packets, said third plurality of said TCP acceleration functions being different from said second plurality of said TCP acceleration functions and said first plurality of said TCP acceleration functions, said third plurality of said security functions being different from said second plurality of said security functions and said first plurality of said security functions,

wherein said packets traverse said embedded processor, then said at least one network processor, and then said hardware circuitry in a substantially inline manner during said data communication from said first network node to said second network node.