Secure network processing

• US 7,373,500 B2
• Filed: 04/15/2003
• Issued: 05/13/2008
• Est. Priority Date: 04/15/2003
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Metzger, Stephen, Vaidheswarra, Rajesh, Ramelson, Brian, Phillips, Paul
• Primary Examiner(s): TRAN, ELLEN C
• Application Number:
  US10/414,459
• Publication Number:
  US 20040250059A1
• Time in Patent Office: 1,855 Days
• Field of Search: 713/150, 713/153, 713/151, 713/192, 713/154
• US Class Current: 713/150
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

In one general aspect, a network communication unit is disclosed that includes a cryptographic record parsing offload engine that has an input and an output. The unit also includes a processor that includes cryptographic handshake logic and has an input operatively connected to the output of the cryptographic record parsing offload engine.

Claims

1. A network communication unit, comprising:

decision logic operative to determine whether at least one secure message contained in at least one cryptographic record should be routed through a cryptographic record parsing engine or whether to bypass the cryptographic record parsing engine via a message passing system comprising a higher priority queue and a lower priority queue,

upon a determination to route the at least one cryptographic record to the cryptographic record parsing engine, the cryptographic record parsing engine receiving and parsing the at least one cryptographic record, said cryptographic record parsing engine having an input and an output,

message-length-detection logic operative to store an amount of message data even if the message is encoded in a plurality of different cryptographic record, wherein said amount of message data corresponds to a message length obtained from the at least one cryptographic record to be stored, and

a processor including cryptographic handshake logic for performing cryptographic handshaking, said processor having an input operatively connected to the output of the cryptographic record parsing engine so as to receive the cryptographic records that have been parsed by the cryptographic record parsing engine.

2. The network communication unit of claim 1 wherein the cryptographic record parsing engine is an SSL/TLS parsing engine.

3. The network communication unit of claim 1 wherein the message-length detection logic is operative to cause the amount of message data to be stored independent of any interactions with the processor.

4. The network communication unit of claim 1 further including a handshake cryptographic acceleration engine operatively connected to a port of the processor.

5. The network communication unit of claim 4 wherein operative connections between the processor and the cryptographic record parsing engine are of a different type than are operative connections between the processor and the cryptographic acceleration engine.

6. The network communication unit of claim 4 further including a bulk cryptographic acceleration engine operatively connected to a port of the processor, wherein the handshake cryptographic acceleration engine includes handshake acceleration logic, and wherein the bulk cryptographic acceleration engine includes encryption and decryption acceleration logic.

7. The network communication unit of claim 1 wherein the cryptographic record parsing engine includes validation logic operative to validate format information in a cryptographic records received from the network.

8. The network communication unit of claim 7 wherein the validation logic includes type validation logic for validating message types.

9. The network communication unit of claim 7 wherein the validation logic includes protocol version validation logic for validating version fields.

10. The network communication unit of claim 7 wherein the validation logic is operative to invalidate cryptographic records independent of any interactions with the processor.

11. The unit of claim 1, wherein the message passing system comprises at least one portion of at lest one secure message in the higher priority queue and at least one portion of at least one second secure message in the lower priority queue, the portion of the secure message in the higher priority queue passes the portion of the secure second message in the lower priority queue where the higher priority queue is serviced prior to the lower priority queue when the higher priority queue is non-empty.