Two parallel engines for high speed transmit IPSEC processing

• US 9,106,625 B2
• Filed: 11/24/2009
• Issued: 08/11/2015
• Est. Priority Date: 03/02/2004
• Status: Active Grant

• Current Assignee: Advanced Micro Devices, Inc.
• Original Assignee: Advanced Micro Devices, Inc.
• Inventors: Kaniz, Marufa, Dwork, Jeffrey, Williams, Robert Alan, Maniar, Mohammad Y., Viswanath, Somnath
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US12/625,086
• Publication Number:
  US 20100071055A1
• Time in Patent Office: 2,086 Days
• Field of Search: 713/151
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The network interface offloads IPsec processing from the host processor. According to the invention, the security system includes two processors for encrypting and authenticating the outgoing data. Outgoing data packets are sent alternately to one or the other processor, whereby transmission processing can be accelerated relative to receive processing.

Claims

1. A single integrated circuit, comprising:

a memory system configured to store incoming and outgoing data packets being transferred between a network and a host system;

a security system adapted to perform transmit IPsec processing on data packets for transmission to a network, wherein the security system comprises two processors in parallel for performing the transmit IPsec processing to generate encrypted data packets;

two output buffers, each output buffer being coupled to one of the processors, the processors being configured to write the encrypted data packets to the output buffers;

a transmit output data flow controller configured to control the flow of encrypted data packets from the two output buffers to the memory system in the same order in which the data packets are read from the memory system.

2. The single integrated circuit of claim 1, wherein the two processors are functionally identical.

3. The single integrated circuit of claim 1, wherein the security system further comprises two input buffers each being coupled to one of the processors, and the security system is adapted to direct outgoing data packets alternatively to one or the other input buffer.

4. The single integrated circuit of claim 1, wherein the processors each comprise pipelines for ESP encryption, ESP authentication, and AH authentication.

5. The single integrated circuit of claim 1, wherein the processors comprise pipelines implementing an algorithm selected from the group consisting of the HMAC-MD5-96 algorithm and the HMAC-SHA-1-96 algorithm.

6. The single integrated circuit of claim 1, wherein the processors comprise pipelines implementing an algorithm selected from the group consisting of the DES-CBC, the 3DES-CBC, and the AES-CBC encryption algorithm.

7. The single integrated circuit of claim 1, wherein the security system further comprises a processor to selectively decrypt incoming data packets, wherein the security system comprises more processors for encrypting and authenticating outgoing data packets than for decrypting incoming data packets.