Two Parallel Engines for High Speed Transmit IPSEC Processing

• US 20100071055A1
• Filed: 11/24/2009
• Published: 03/18/2010
• Est. Priority Date: 03/02/2004
• Status: Active Grant

• Current Assignee: Advanced Micro Devices, Inc.
• Original Assignee: Advanced Micro Devices, Inc.
• Inventors: Maniar, Mohammmed Y., Dwork, Jeffrey, Kaniz, Marufa, Viswanath, Somnath, Williams, Robert Alan
• Granted Patent: US 9,106,625 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The network interface offloads IPsec processing from the host processor. According to the invention, the security system includes two processors for encrypting and authenticating the outgoing data. Outgoing data packets are sent alternately to one or the other processor, whereby transmission processing can be accelerated relative to receive processing.

Claims

1-10. -10. (canceled)

11. A single integrated circuit, comprising:

a security system adapted to perform transmit IPsec processing on data for transmission to a network, wherein the security system comprises two processors in parallel for performing the transmit IPsec processing.

12. The single integrated circuit of claim 11, wherein the two processors are functionally identical.

13. The single integrated circuit of claim 11, wherein the security system further comprises two input buffers each being coupled to one of the processors, and the security system is adapted to direct outgoing data packets alternatively to one or the other input buffer.

14. The single integrated circuit of claim 11, wherein the security system further comprises two output buffers, each output buffer being coupled to one of the processors, the processors being configured to write processed data packets to the output buffers, and the security system being configured to transmit the processed data packets from the output buffers in the same order the data packets were read into the security system prior to processing.

15. The single integrated circuit of claim 11, wherein the processors each comprise pipelines for ESP encryption, ESP authentication, and AH authentication.

16. The single integrated circuit of claim 11, wherein the processors comprise pipelines implementing an algorithm selected from the group consisting of the HMAC-MD5-96 algorithm and the HMAC-SHA-1-96 algorithm.

17. The single integrated circuit of claim 11, wherein the processors comprise pipelines implementing an algorithm selected from the group consisting of the DES-CBC, the 3DES-CBC, and the AES-CBC encryption algorithm.

18. The single integrated circuit of claim 11, wherein the security system further comprises a processor to selectively decrypt incoming data, wherein the security system comprises more processors for encrypting and authenticating incoming data than for decrypting outgoing data.