Queuing system using dual receive FIFO

• US 6,944,688 B1
• Filed: 05/18/2001
• Issued: 09/13/2005
• Est. Priority Date: 05/18/2001
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Batcher, Kenneth W.
• Primary Examiner(s): Gaffin, Jeffrey
• Assistant Examiner(s): Schneider, Joshua D.
• Application Number:
  US09/861,149
• Time in Patent Office: 1,579 Days
• Field of Search: H04/L02.9/06, 375/136, 380/44, 370/342, 714/798, 713/193, 713/168, 455/21.1, 710/52, 710/54, 710/55, 710/7, 710/57, 712/227
• US Class Current: 710/55
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 49/901 using storage descriptor, e.g. read or write pointers
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation

Abstract

A queuing system utilizing dual first-in, first-out (FIFO) memories is provided. The present queuing system is configured to use a first FIFO memory to receive and transfer a plurality of frames to a second FIFO memory wherein the frames include encrypted frame contents. The first FIFO memory is configured to transfer an interrupt to an associated processor in response to completion of the receipt of a valid frame. Next, the processor is configured to reinitialize the first FIFO memory for receipt of a subsequent frame.

Additionally, the second FIFO memory is suitably adapted to concurrently store a plurality of frames transferred from the first FIFO memory. Finally, the present system is configured to transfer one of the stored frames out of the second FIFO memory in response to the completion of a data processing operation (e.g. initialization of a decryption algorithm).

Claims

1. A queuing system comprising:

a first FIFO memory for receiving a frames comprised of a header and encrypted frame contents;

a second FIFO memory for receiving the header and encrypted frame contents from the first FIFO memory, wherein the second FIFO is adapted to concurrently store a plurality of frames; and

a stream cipher engine for decrypting the encrypted frame contents stored in the second FIFO memory; and

wherein the frame propagates through the first FIFO to the second FIFO while it is being received;

wherein after a portion of the header that includes data indicative of a lookup key for the frame is processed by the first FIFO memory and while at least a portion of the frame contents is being propagated from the first FIFO memory to the second FIFO memory, the stream cipher engine responsive to the data indicative of a lookup key performs a key lookup to decrypt the frame.

2. A queuing system according to claim 1, wherein said encrypted frame contents are read out of the second FIFO in response to completion of a data processing operation.

3. A queuing system according to claim 2, wherein said data processing operation includes initialization of a decryption algorithm.

4. A queuing system according to claim 3, wherein the frame contents that are encrypted are decrypted as read out of the second FIFO memory.

5. A queuing system according to claim 2, wherein the encrypted frame contents are periodically received by said first FIFO memory at a rate that is higher than the rate of the data processing operation.

6. A queuing system according to claim 1, wherein said first FIFO memory is smaller in size than said second FIFO memory.

7. A queuing system according to claim 1, wherein said second FIFO memory stores identifier data for identifying frame content associated with the end of a frame.

8. A queuing system according to claim 1, wherein a key is identified and a decryption algorithm is initialized for each frame in order to perform decryption of encrypted frame content, wherein said key is identified using a header portion of a frame.

9. A queuing system according to claim 1, wherein said second FIFO memory stores a flag indicative of at least one of:

end of a frame and frame validity.

10. The queuing system of claim 1, further comprising a processor receiving the decrypted contents from the cipher engine.

11. The queuing system of claim 10, wherein the cipher engine sends a signal to the processor once it has completed initialization and key loading.

12. The queuing system of claim 11, wherein the processor retrieves the frame from the cipher engine responsive to the signal from the cipher engine.

13. The queuing system of claim 1, further comprising a CRC register for performing a data validity check for received frames, wherein the CRC register outputs signal to the second FIFO indicative the validity of the frame.

14. The queuing system of claim 13, wherein said first FIFO memory transmits an interrupt to the processor in response to completing receipt of a valid frame, said processor re-initializing said first FIFO memory for receipt of a subsequent.

15. The queuing system of claim 14, wherein the interrupt is a high priority interrupt that preempts other processes.

16. The queuing system of claim 15, wherein processing of first frame continues even while the interrupt is being processed.

17. A queuing system comprising:

a register for performing a data validity check for received frames;

first memory means for receiving frames comprised of a header and encrypted frame contents, wherein said first memory means transmits an interrupt to an associated processing means in response to completing receipt of a valid frame, said processor re-initializing said first memory means for receipt of a subsequent frame;

second memory means for receiving the encrypted frame contents from the first memory means wherein the second memory means is adapted to concurrently store a plurality of frames; and

a stream cipher engine for decrypting the encrypted frame contents received from the second memory means in response to the data validity check;

wherein after a portion of the header that includes data indicative of a lookup key for the frame is processed by the first memory means and while at least a portion of the frame contents is being propagated from the first memory means to the second memory means, the stream cipher engine responsive to the data indicative of a lookup key performs a key lookup to decrypt the frame.

18. A queuing system according to claim 17, wherein said encrypted frame contents are read out of the second memory means in response to completion of a data processing operation.

19. A queuing system according to claim 18, wherein said data processing operation includes initialization of a decryption algorithm.

20. A queuing system according to claim 19, wherein the frame contents that are encrypted are decrypted as read out of the second memory means.

21. A queuing system according to claim 18, wherein the encrypted frame contents are periodically received by said first memory means at a rate that is higher than the rate of the data processing operation.

22. A queuing system according to claim 17, wherein said first memory means is smaller in size than said second memory means.

23. A queuing system according to claim 17, wherein said second memory means stores identifier data for identifying frame content associated with at least one of:

end of a frame and frame validity.

24. A queuing system according to claim 17, wherein a key is identified and a decryption algorithm is initialized for each frame in order to perform decryption of encrypted frame content, wherein said key is identified using a header portion of a frame.

25. A queuing system according to claim 17, wherein said second memory means stores a flag indicative of at least one of:

end of a frame and frame validity.

26. A queuing method comprising:

performing a data validity check for frames;

writing the frames comprised of encrypted frame contents into a first memory, wherein said first memory transmits an interrupt to an associated processor in response to completing receipt of a valid frame;

re-initializing said first memory for receipt of a subsequent frame in response to the interrupt;

transferring the encrypted frame contents from the first memory to a second memory wherein the second memory is adapted to concurrently store a plurality of frames; and

decrypting the encrypted frame contents received from the second memory in response to the data validity check;

searching for a key for decrypting the encrypted frame contents while the encrypted frame contents are being transferred from the first memory to the second memory.

27. A queuing method according to claim 26, wherein said encrypted frame contents are read out of the second memory in response to completion of a data processing operation.

28. A queuing method according to claim 27, wherein said data processing operation includes a step of initializing a decryption algorithm.

29. A queuing method according to claim 28, wherein said method further comprises decrypting encrypted frame contents when read out of said second memory.

30. A queuing method according to claim 27, wherein the encrypted frame contents are periodically received by said first memory at a rate that is higher than the rate of the data processing operation.

31. A queuing method according to claim 26, wherein said first memory is smaller in size than said second memory.

32. A queuing method according to claim 26, wherein said second memory stores identifier data for identifying frame content associated with at least one of:

end of a frame and frame validity.

33. A queuing method according to claim 26, wherein a key is identified and a decryption algorithm is initialized for each frame in order to perform decryption of encrypted frame content, wherein said key is identified using a header portion of a frame.

34. A queuing method according to claim 26, wherein said second memory stores a flag indicative of at least one of:

end of a frame and frame validity.