Method and apparatus for performing an authentication after cipher operation in a network processor

• US 20050138368A1
• Filed: 12/19/2003
• Published: 06/23/2005
• Est. Priority Date: 12/19/2003
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Wolrich, Gilbert M., Feghali, Wajdi, Sydir, Jaroslaw J., Koshy, Kamal J., Burres, Bradley A.
• Granted Patent: US 7,543,142 B2
• Time in Patent Office: Days
• US Class Current: 713/161
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC

Abstract

A method and apparatus is described for processing of network data packets by a network processor having cipher processing cores and authentication processing cores which operate on data within the network data packets, in order to provide a one-pass ciphering and authentication processing of the network data packets.

Claims

1. A network processor, comprising:

an authentication buffer to store authentication data including at least one of ciphered-network-packet data subject to authentication, network packet data subject only to authentication, and network-packet data subject to ciphering and authentication, wherein the authentication buffer includes a circular first-in-first-out (FIFO) arrangement; and

at least one authentication core coupled to the authentication buffer to authenticate the authentication data from the authentication buffer.

2. The network processor of claim 1, wherein the circular FIFO arrangement includes a moveable start of data pointer and a moveable end of data pointer.

3. The network processor of claim 1, wherein the network processor further includes at least one cipher core adapted to operate with a cipher algorithm and the at least one authentication core is adapted to operate with an authentication algorithm, and a size of the authentication buffer is selected in accordance with a data block size associated with the cipher algorithm and a data block size associated with the authentication algorithm.

4. The network processor of claim 1, wherein the authentication core is adapted to authenticate the authentication data from the authentication buffer as blocks of authentication data.

5. A network, comprising:

a network processor having;

an authentication buffer to store authentication data including at least one of ciphered-network-packet data subject to authentication, network packet data subject only to authentication, and network packet data subject to ciphering and authentication, wherein the authentication buffer includes a circular first-in-first-out (FIFO) arrangement; and

at least one authentication core coupled to the authentication buffer to authenticate the authentication data from the authentication buffer.

6. The network of claim 5, wherein the circular FIFO arrangement includes a moveable start of data pointer and a moveable end of data pointer

7. The network of claim 5, wherein the network processor further includes at least one cipher core adapted to operate with a cipher algorithm and the at least one authentication core is adapted to operate with an authentication algorithm, and a size of the authentication buffer is selected in accordance with a data block size associated with the cipher algorithm and a data block size associated with the authentication algorithm.

8. The network of claim 5, wherein the authentication core is adapted to authenticate the authentication data from the authentication buffer as blocks of authentication data.

9. A method of authenticating network packet data, comprising:

moving to an authentication buffer authentication data including at least one of ciphered-network-packet data subject to authentication, network packet data subject only to authentication, and network packet data subject to ciphering and authentication, wherein the authentication buffer includes a circular first-in-first-out (FIFO) arrangement; and

moving to an authentication core a block of data from the authentication buffer.

10. The method of claim 9, wherein the moving to an authentication buffer authentication data comprises selecting the authentication buffer from among a plurality of authentication buffers.

11. The method of claim 9, further including:

setting a start of data pointer and an end of data pointer to respective initial locations;

setting the end of data pointer in accordance with the moving the authentication data to the authentication buffer; and

setting the start of data pointer in accordance with the moving to the authentication core the block of data from the authentication buffer.

12. The method of claim 9, wherein the authentication buffer includes a circular first-in-first-out (FIFO) arrangement.

13. The method of claim 9, further including:

providing a cipher core adapted to operate with a cipher algorithm;

providing the authentication core adapted to operate with an authentication algorithm, and

sizing the authentication buffer in accordance with a data block size associated with the cipher algorithm and a data block size associated with the authentication algorithm.

14. A computer program medium having computer readable code thereon to authenticate network packet data, the medium comprising:

instructions for moving to an authentication buffer authentication data including at least one of ciphered-network-packet data subject to authentication, network packet data subject only to authentication, and network packet data subject to ciphering and authentication, wherein the authentication buffer includes a circular first-in-first-out (FIFO) arrangement; and

instructions for moving to an authentication core a block of data from the authentication buffer.

15. The method of claim 14, wherein the instructions for moving to an authentication buffer authentication data comprises instructions for selecting the authentication buffer from among a plurality of authentication buffers.

16. The method of claim 14, further including:

instructions for setting a start of data pointer and an end of data pointer to respective initial locations;

instructions for setting the end of data pointer in accordance with the moving the authentication data to the authentication buffer; and

instructions for setting the start of data pointer in accordance with the instructions for moving to the authentication core the block of data from the authentication buffer.

17. The computer program medium of claim 14, wherein the authentication buffer includes a circular first-in-first-out (FIFO) arrangement.

18. The computer program medium of claim 14, further including:

instructions for providing a cipher core adapted to operate with a cipher algorithm;

instructions for providing the authentication core adapted to operate with an authentication algorithm, and

instructions for sizing the authentication buffer in accordance with a data block size associated with the cipher algorithm and a data block size associated with the authentication algorithm.