Processing Multiple Wireless Communications Security Policies

• US 20090193248A1
• Filed: 11/24/2008
• Published: 07/30/2009
• Est. Priority Date: 01/24/2001
• Status: Abandoned Application

• Current Assignee: Avago Technologies General IP PTE Limited (Broadcom, Inc.)
• Original Assignee: Avago Technologies General IP PTE Limited (Broadcom, Inc.)
• Inventors: CARR, Jeffrey D.
• Application Number:
  US12/276,737
• Publication Number:
  US 20090193248A1
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/166 IP fragmentation; TCP segmentation
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level

Abstract

A computer program product for processing wireless data packets allows for processing packets to consolidate security processing. Security processing is performed in accordance with multiple security policies. This processing is done in a single front end processing block. Different security processes can be performed in parallel. Processing overhead is reduced by eliminating the need to redundantly check packet characteristics to assess the different security requirements imposed by security policies. Further, the present invention also substantially reduces the CPU cycles required to transport data back and forth from memory to a cryptographic coprocessor.

Claims

1. A computer program product comprising a computer useable medium having computer program logic recorded thereon for enabling a processor to process a wirelessly-received data packet having a plurality of layers, comprising:

a first function that enables a processor to process a first layer in accordance with a first protocol; and

a second function that enables a processor to process a second layer in accordance with a second protocol in parallel with processing of said first layer when processing of said first layers uncovers sufficient information to support processing of said second layer.

2. A computer program product comprising a computer useable medium having computer program logic recorded thereon for processing a wirelessly-received data packet according to a plurality of security policies, comprising:

a first function that enables a processor to receive the packet;

a second function that enables a processor to identify a first security policy;

a third function that enables a processor to process the packet according to the first security policy;

a fourth function that enables a processor to identify a second security policy when information associated with said identification of the second security policy becomes available; and

a fifth function that enables a processor to process the packet according to the second security policy, concurrently with third function.

3. The computer program product of claim 2, wherein said third function comprises decryption of data in the packet.

4. The computer program product of claim 3, wherein said decryption is performed according to the data encryption standard (DES).

5. The computer program product of claim 3, wherein said decryption is performed according to the triple data encryption standard (3DES).

6. The computer program product of claim 3, wherein said decryption is performed according to the ARC4 algorithm.

7. The computer program product of claim 2, wherein said fifth function comprises decryption of data in the packet.

8. The computer program product of claim 7, wherein said decryption is performed according to the DES.

9. The computer program product of claim 7, wherein said decryption is performed according to the 3DES.

10. The computer program product of claim 7, wherein said decryption is performed according to the ARC4 standard.

11. The computer program product of claim 2, wherein said fifth function comprises authentication of the data packet.

12. The computer program product of claim 11, wherein said authentication comprises application of the Multilayer Modular Hashing (MMH) algorithm.

13. The computer program product of claim 11, wherein said authentication comprises application of the Hash-based Message Authentication Code (HMAC) Secure Hash Algorithm (SHA)-1.

14. The computer program product of claim 2, wherein said fifth function comprises re-encryption of decrypted data from the packet.

15. The computer program product of claim 14, wherein said re-encryption comprises encryption performed according to the Advanced Encryption Standard (AES).