Scheduler, security context cache, packet processor, and authentication, encryption modules

• US 9,141,831 B2
• Filed: 06/21/2011
• Issued: 09/22/2015
• Est. Priority Date: 07/08/2010
• Status: Active Grant

• Current Assignee: Texas Instruments, Inc.
• Original Assignee: Texas Instruments, Inc.
• Inventors: Mundra, Amritpal Singh, Beaudoin, Denis Roland
• Primary Examiner(s): CHANG, KENNETH W
• Application Number:
  US13/165,190
• Publication Number:
  US 20120011351A1
• Time in Patent Office: 1,554 Days
• Field of Search: 713/160
• US Class Current: 1/1
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 7/588 Random number generators, i.e. based on natural stochastic processes
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0625 with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3013 involving the discrete logarithm problem, e.g. ElGamal or Diffie-Hellman systems
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys

Abstract

An electronic circuit (200) includes one or more programmable control-plane engines (410, 460) operable to process packet header information and form at least one command, one or more programmable data-plane engines (310, 320, 370) selectively operable for at least one of a plurality of cryptographic processes selectable in response to the at least one command, and a programmable host processor (100) coupled to such a data-plane engine (310) and such a control-plane engine (410). Other processors, circuits, devices and systems and processes for their operation and manufacture are disclosed.

Claims

1. A packet-processing electronic subsystem comprising:

a first data interface having an input for accepting first streaming data and having an output;

a second data interface having an input for accepting second streaming data and having an output;

a third data interface having an output for egress of third streaming data and having an input;

a fourth data interface having an output for egress of fourth streaming data and having an input, the first, second, third, and fourth data interfaces being separate from one another;

scheduler circuitry having inputs coupled to the outputs of the first and second interfaces, having outputs coupled to the inputs of the third, and fourth data interfaces, and including a packet memory, the scheduler circuitry having a security context cache interface, a packet header processor interface, an authentication interface, and an encryption interface;

a security context cache coupled to the security context cache interface of the scheduler circuitry and including a cache controller and cache storage for a security context, the security context cache on a demand basis fetching and later evicting a control data structure for the security context;

a packet header processor coupled to the packet header processor interface of the scheduler circuitry;

an authentication module coupled to the authentication interface of the scheduler circuitry; and

an encryption module coupled to the encryption interface of the scheduler circuitry, the encryption module including control circuitry and encryption accelerators responding to the security context in the cache storage.

2. The subsystem of claim 1 in which the first interface is a packet accelerator ingress Communication Processor Peripheral Interface (CPPI) streaming interface.

3. The subsystem of claim 1 in which the second interface is a code division multiple access (CDMA) ingress Communication Processor Peripheral Interface (CPPI) streaming interface.

4. The subsystem of claim 1 in which the third interface is a packet accelerator egress Communication Processor Peripheral Interface (CPPI) streaming interface.

5. The subsystem of claim 1 in which the fourth interface is a code division multiple access (CDMA) egress Communication Processor Peripheral Interface (CPPI) streaming interface.