Network node with network-attached stateless security offload device employing out-of-band processing

• US 8,918,634 B2
• Filed: 02/21/2012
• Issued: 12/23/2014
• Est. Priority Date: 02/21/2012
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Gearhart, Curtis Matthew, Meyer, Christopher, Moonen, Scott Christopher, Overby, Linwood Hugh Jr.
• Primary Examiner(s): SHEHNI, GHAZAL B
• Application Number:
  US13/400,577
• Publication Number:
  US 20130219168A1
• Time in Patent Office: 1,036 Days
• Field of Search: 709238-244
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up

Abstract

A network node for communicating data packets secured with a security protocol over a communications network includes a host information handling system (IHS) and one or more external security offload devices coupled by a secure data link. The host IHS communicates state information about data packets, and the external offload security device provides stateless secure data encapsulation and decapsulation of packets using a security protocol. An external network interface controller or internal network interface controller communicates encapsulated data packets over the communications network to a final destination. Encapsulation and decapsulation of packets by the external security offload device reduces network latency and reduces the computational load on the processor in the host IHS. Maintaining state information in the host IHS allows hot-swapping of external security offload devices without information loss. The external security offload device may be included in a firewall, or intrusion detection device, and may implement IPsec protocol.

Claims

1. A network node, comprising:

a host information handling system (IHS) including an internal network interface controller;

a secure data link coupled to the host IHS;

a stateless network-attached external security offload device, coupled to the host IHS via the secure data link, the stateless network-attached external security offload device being external to the host IHS; and

the host IHS being configured to store security metadata that is associated with a data packet, the host IHS being further configured to offload the data packet and the associated security metadata and static security association (SA) information via the secure data link to the stateless network-attached external security offload device, thus providing an offloaded data packet;

the stateless network-attached external security offload device being configured to;

receive the offloaded data packet and the associated security metadata and the static security association (SA) information;

store the offloaded data packet and the static security association (SA) information;

encrypt and encapsulate the offloaded data packet thus providing an encapsulated encrypted data packet; and

transmit the encapsulated encrypted data packet back to the host IHS for further processing;

the host IHS being further configured to;

transmit the encapsulated encrypted data packet via the internal network interface controller of the host IHS to a communications network for communication to an IHS other than the host IHS.

2. The network node of claim 1, wherein the stateless network-attached external security offload device employs IPsec protocol.

3. The network node of claim 1, wherein the security metadata includes state data.

4. The network node of claim 1, wherein the encrypting and encapsulating of the data packet is performed by the stateless network-attached external security offload device as instructed by the associated security metadata that the stateless network-attached external security offload device receives from the host IHS.

5. A network node, comprising:

a host information handling system (IHS) including an internal network interface controller;

a secure data link coupled to the host IHS;

a stateless network-attached external security offload device, coupled to the host IHS via the secure data link, the stateless network-attached external security offload device being external to the host IHS; and

the host IHS being configured to;

receive a data packet from a communications network via the internal interface controller, thus providing a received data packet;

determine if the received data packet is an encapsulated encrypted data packet that requires security processing;

forward the received data packet to an application in the host IHS for processing if the host IHS determines that the received data packet is not the encapsulated encrypted data packet that requires security processing;

offload the received data packet and static security association (SA) information via the secure data link to the stateless network-attached external security offload device, thus providing an offloaded data packet and static security association (SA) information if the host IHS determines that the received data packet is the encapsulated encrypted data packet that requires security processing;

the stateless network-attached external security offload device being configured to;

receive the offloaded data packet and the static security association (SA) information;

store the offloaded data packet and the static security association (SA) information;

decapsulate and decrypt the offloaded data packet, thus providing a decapsulated decrypted data packet; and

transmit, via the secure data link, the decapsulated decrypted data packet back to the host IHS for further processing by the application in the host IHS.

6. The network node of claim 5, wherein the stateless network-attached external security offload device employs IPsec protocol.

7. The network node of claim 5, wherein the stateless network-attached external security offload device is further configured to add security metadata to the decapsulated decrypted data packet.

8. The network node of claim 5, wherein the host IHS is further configured to performing state checking for the decapsulated decrypted data packet.

9. The network node of claim 5, wherein the stateless network-attached external security offload device is further configured to provide at least one of firewall services and intrusion detection services.