STATELESS CRYPTOGRAPHIC PROTOCOL-BASED HARDWARE ACCELERATION

• US 20110113244A1
• Filed: 07/31/2006
• Published: 05/12/2011
• Est. Priority Date: 07/31/2006
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Nambiar, Brijesh, Chou, Randy
• Granted Patent: US 7,966,646 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/122 Hardware reduction or efficient architectures
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 52/281 taking into account user or data type priority

Abstract

According to one embodiment of the invention, a network device comprises a first processing element and a second processing element. The first processing element is adapted to handle an authentication handshaking protocol, such as the SSL/TLS Handshake, and upon receipt of a Client Key Exchange message, passes control of the authentication handshaking protocol to the second processing element. The second processing element completes the authentication handshaking protocol.

Claims

1. A network device comprising:

a first processing element to handle an authentication handshaking protocol and to pass control of the authentication handshaking protocol upon receipt of a Client Key Exchange message; and

a second processing element to control and complete the authentication handshaking protocol.

2. The network device of claim 1, wherein the authentication handshaking protocol is any protocol that uses either a Secure Socket Layer (SSL) Handshaking Protocol or Transport Layer Security (TLS) Handshaking protocol as a basis for authentication.

3. The network device of claim 1, wherein the authentication handshaking protocol is a Transport Layer Security (TLS) Handshaking Protocol.

4. The network device of claim 1, wherein the first processing element is a data path (DP) processor and a second processing element is a control path (CP) processor.

5. The network device of claim 1, wherein the first processing element is a first processor core and the second processing element is a second processor core, the first processor core and the second processor core implemented within a multi-core processor.

6. The network device of claim 1, wherein the first processing element passes (i) a first value that is generated by a remotely located network device and encrypted with a public key associated with the network device and (ii) at least one hash value associated with messages received and transmitted by the network device during the authentication handshaking protocol.

7. The network device of claim 6, wherein the first processing element further passes a first random number generated by the remotely located network device and a second random number generated internally within the network device to the second processing element.

8. The network device of claim 7, wherein the second processing element to generate a Master key based on the first value, the first random number and the second random number, the Master key to be used as a key for secure communications with the remotely located network device in accordance with a symmetric key communication scheme.

9. The network device of claim 6, wherein the first processing element further passes information for the second processing element to fetch a first random number generated by the remotely located network device and a second random number generated internally within the network device in order to produce a Master key based on the first value, the first random number and the second random number, the Master key to be used as a key for secure communications with the remotely located network device in accordance with a symmetric key communication scheme.

10. A method comprising:

commencing an authentication handshaking protocol controlled solely by a first processing element;

passing control of the authentication handshaking protocol by the first processing element upon receipt of a Client Key Exchange message; and

completing the authentication handshaking protocol by the second processing element.

11. The method of claim 10, wherein the authentication handshaking protocol is a Secure Socket Layer (SSL) Handshaking Protocol.

12. The method of claim 10, wherein the authentication handshaking protocol is a Transport Layer Security (TLS) Handshaking Protocol.

13. The method of claim 12, wherein the commencing of the authentication handshaking protocol comprises performing initial stages of the TLS Handshaking Protocol by the first processing element being a data path (DP) processor.

14. The method of claim 13, wherein the completing of the authentication handshaking protocol comprises completing the TLS Handshaking Protocol by the second processing element being a control path (CP) processor by computing a symmetric key that is used to maintain cryptographically secure communications with a network device physically separated from a network device including the DP processor and the CP processor.

15. The method of claim 11, wherein the passing of control of the authentication handshaking protocol upon receipt of the Client Key Exchange message comprises the first processing element passing (i) a first value that is generated by a network device remotely located from a network device including the first processing element and the second processing element and is encrypted with a public key associated with the network device, and (ii) at least one hash value associated with messages received and transmitted by the network device during the authentication handshaking protocol.

16. The method of claim 15, wherein the passing of control of the authentication handshaking protocol upon receipt of the Client Key Exchange message further comprises the first processing element passing a first random number generated by the remotely located network device and a second random number generated internally within the network device to the second processing element.

17. The network device of claim 16, wherein the completing of the authentication handshaking protocol further comprises computing a symmetric key based on the first value, the first random number and the second random number, the symmetric key being used as a key for secure communications with the remotely located network device in accordance with a symmetric key communication scheme.

18. Software stored on a device storage medium and executed by multiple processing elements to perform the following operations:

commencing an authentication handshaking protocol based on execution of the software by a first processing element; and

upon receipt of a specific message, passing control of the authentication handshaking protocol from the first processing element to the second processing element, the second processing element completing the authentication handshaking protocol.

19. The software of claim 18, wherein the first processing element and the second processing element are executing software to support the authentication handshaking protocol being a Transport Layer Security (TLS) Handshaking Protocol.

20. The software of claim 18 being instructions executed by a multi-core processor including a first processor core operating as the first processing element and a second processor core operating as the second processing element.