System on a chip for network storage devices

• US 20030131228A1
• Filed: 04/01/2002
• Published: 07/10/2003
• Est. Priority Date: 01/10/2002
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Twomey, John E.
• Granted Patent: US 7,246,245 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

In one embodiment, an apparatus includes a first integrated processor, a second integrated processor, and a security processor. The first integrated processor has one or more network interfaces for receiving packets and also has a second interface. The second integrated processor is coupled to the second interface. A security processor is coupled to the second integrated processor. Also, a storage switch is contemplated employing one or more line cards which include the apparatus. The storage switch further includes at least one switch fabric card coupled to the at least one line card, wherein the switch fabric card is configured to route packets from the at least one line card and from one or more storage devices on a switch fabric. In another embodiment, the integrated processors may be systems on a chip (SOCs).

Claims

1. An apparatus comprising:

a first integrated processor having one or more network interfaces for receiving packets and also having a second interface;

a second integrated processor coupled to the second interface; and

a security processor coupled to the second integrated processor.

2. The apparatus as recited in claim 1 wherein the first integrated processor is configured to process unencrypted packets and to transmit encrypted packets to the second integrated processor for processing.

3. The apparatus as recited in claim 2 further comprising a memory coupled to the second integrated processor, wherein the memory is configured to store one or more security databases during use.

4. The apparatus as recited in claim 3 wherein the security databases include a security association database storing security associations, wherein the second integrated processor is configured to lookup a first security association corresponding to a first encrypted packet in the security association database, and wherein the second integrated processor is configured to transmit the first encrypted packet and the first security association to the security processor for decryption.

5. The apparatus as recited in claim 4 wherein the security processor includes a security association cache configured to store security associations, and wherein the second integrated processor is configured to transmit an identifier of the first security association within the security association cache to the security processor instead of the first security association if the first security association is stored in the security association cache.

6. The apparatus as recited in claim 4 wherein the security processor is configured to transmit a first decrypted packet corresponding to the first encrypted packet to the second integrated processor, and wherein the second integrated processor is configured to transmit the first decrypted packet on a third interface.

7. The apparatus as recited in claim 6 wherein the second integrated processor is configured to receive a second unencrypted packet on the third interface, and wherein the second integrated processor is configured to lookup a second security association in the security association database and to transmit the second unencrypted packet and the second security association to the security processor for encryption.

8. The apparatus as recited in claim 7 wherein the second integrated processor is configured to receive a second encrypted packet corresponding to the second unencrypted packet from the security processor, and wherein the second integrated processor is configured to transmit the second encrypted packet on the second interface to the first integrated processor for transmission on one of the network interfaces.

9. The apparatus as recited in claim 1 wherein the network interfaces comprise Ethernet interfaces.

10. The apparatus as recited in claim 1 wherein the security processor is configured to perform authentication processing on the packets.

11. A storage switch comprising:

at least one line card, each line card comprising;

a first integrated processor having one or more network interfaces for receiving packets and also having a second interface, the network interfaces comprising interfaces of the line card;

a second integrated processor coupled to the second interface; and

a security processor coupled to the second integrated processor;

at least one switch fabric card coupled to the at least one line card, wherein the switch fabric card is configured to route packets from the at least one line card and from one or more storage devices on a switch fabric.

12. The storage switch as recited in claim 11 wherein the first integrated processor is configured to process unencrypted packets and to transmit encrypted packets to the second integrated processor for processing.

13. The storage switch as recited in claim 12 wherein the first integrated processor is configured to transmit processed packets through the second integrated processor to the switch fabric.

14. The storage switch as recited in claim 12 wherein the second integrated processor is configured, in cooperation with the security processor, to decrypt encrypted packets and to transmit decrypted packets on the switch fabric.

15. The storage switch as recited in claim 12 wherein the unencrypted packets and the encrypted packets include commands to the storage devices.

16. The storage switch as recited in claim 11 wherein the security processor is configured to perform authentication processing on the packets.

17. An apparatus comprising:

a first system on a chip (SOC) including one or more network interface circuits, a second interface circuit, and at least a first processor, the first processor programmed, during use, to process unencrypted packets received on the one or more network interface circuits and programmed to detect encrypted packets received on the one or more network interface circuits and to route the encrypted packets to the second interface circuit;

a second SOC including the second interface circuit coupled to the second interface circuit of the first SOC, the second SOC including one or more network interface circuits configurable as a packet interface and at least a second processor; and

a security processor coupled to the packet interface, wherein the second processor is programmed, during use, to decrypt encrypted packets in cooperation with the security processor.

18. The apparatus as recited in claim 17 further comprising a memory coupled to the second SOC, wherein the memory is configured to store one or more security databases during use.

19. The apparatus as recited in claim 18 wherein the security databases include a security association database storing security associations, wherein the second processor is programmed, during use, to lookup a first security association corresponding to a first encrypted packet in the security association database, and wherein the second processor is programmed, during use, to transmit the first encrypted packet and the first security association to the security processor for decryption.

20. The apparatus as recited in claim 19 wherein the security processor includes a security association cache configured to store security associations, and wherein the second processor is programmed, during use, to transmit an identifier of the first security association within the security association cache to the security processor instead of the first security association if the first security association is stored in the security association cache.

21. The apparatus as recited in claim 19 wherein the security processor is configured to transmit a first decrypted packet corresponding to the first encrypted packet to the second SOC, and wherein the second SOC includes a second one or more network circuits configurable as a second packet interface, and wherein the second processor is programmed, during use, to transmit the first decrypted packet on the second packet interface.

22. The apparatus as recited in claim 21 wherein the second SOC is configured to receive a second unencrypted packet on the second packet interface, and wherein the second processor is programmed, during use, to lookup a second security association in the security association database and to transmit the second unencrypted packet and the second security association to the security processor for encryption.

23. The apparatus as recited in claim 22 wherein the second SOC is configured to receive a second encrypted packet corresponding to the second unencrypted packet from the security processor, and wherein the second processor is programmed, during use, to transmit the second encrypted packet on the second interface to the first SOC for transmission on one of the network interfaces.

24. The apparatus as recited in claim 17 wherein the network interface circuits are configured to communicate as Ethernet interfaces.

25. The apparatus as recited in claim 17 wherein the security processor is configured to perform authentication processing on the packets.