Methods and associated systems are disclosed for providing secured data transmission over a data network. Data to be encrypted and encryption information may be sent to a security processor via a packet network so that the security processor may extract the encryption information and use it to encrypt the data. The encryption information may include flow information, security association and/or other cryptographic information, and/or one or more addresses associated with such information. The encryption information may consist of a tag in a header that is appended to packets to be encrypted before the packets are sent to the security processor. The packet and tag header may be encapsulated into an Ethernet packet and routed via an Ethernet connection to the security processor.

Tagging mechanism for data path security processing

A method and apparatus to apply aggregate ACL/QoS features using a redirect cause is disclosed. According to one embodiment of the present invention, a control processor configured to support a plurality of virtual interfaces is provided, wherein each of the plurality of virtual interfaces is associated with a quality of service level. According to another embodiment, each quality of service level is associated with a processing bandwidth of the control processor. According to yet another embodiment, a control processor interface is provided coupled to the control processor which is configured to select a virtual interface of the plurality of virtual interfaces using data of a received data unit, and to transfer the received data unit to the selected virtual interface.

Method and apparatus to apply aggregate access control list/quality of service features using a redirect cause

Methods and associated systems provide secured data transmission over a data network. A security device provides security processing in the data path of a packet network. The device may include at least one network interface to send packets to and receive packets from a data network and at least one cryptographic engine for performing encryption, decryption and/or authentication operations. The device may be configured as an in-line security processor that processes packets that pass through the device as the packets are routed to/from the data network.

Data path security processing

Provided is an architecture for a cryptography accelerator chip that allows significant performance improvements over previous prior art designs. In various embodiments, the architecture enables parallel processing of packets through a plurality of cryptography engines and includes a classification engine configured to efficiently process encryption/decryption of data packets. Cryptography acceleration chips in accordance may be incorporated on network line cards or service modules and used in applications as diverse as connecting a single computer to a WAN, to large corporate networks, to networks servicing wide geographic areas (e.g., cities). The present invention provides improved performance over the prior art designs, with much reduced local memory requirements, in some cases requiring no additional external memory. In some embodiments, the present invention enables sustained full duplex Gigabit rate security processing of IPSec protocol data packets.

Classification engine in a cryptography acceleration chip

Distributed processing in a cryptography acceleration chip

An architecture for a high performance IPSEC accelerator. The architecture includes components for scanning fields of packets, programming an IPSEC services device according to the scanned fields, and modifying the scanned packet with an output from the IPSEC security services device. Preferably, the architecture is implemented in hardware, and attached to a host machine. Hardware devices, fast in comparison to software processing and network speeds, allows the computationally intensive IPSEC processes to be completed in real-time and reduce or eliminate bottlenecks in the path of a packet being sent or received to/from a network.

High performance IPSEC hardware accelerator for packet classification

A hardware packet accelerator parses incoming packets to retrieve header data for building a frame status and for verifying the incoming packets are part of an established connection with a host. The accelerator includes a connection database that allows retrieval of connection information based on an index constructed from a hashed TCP connection address. The frame status comprises information needed to perform packet re-assembly and is stored in a memory that is local (directly accessible) by a processing device that performs the packet re-assembly. Among other advantages, the processing device does not need to read packet header data from a packet buffer, saving large amounts of header data retrieval time.

Method and apparatus for hardware assisted TCP packet re-assembly

A plurality of virtual paths in a network interface between a host port and a network port are managed according to respective priorities. Thus, multiple levels of quality of service are supported through a single physical network port. Variant processes are applied for handling packets which have been downloaded to a network interface, prior to transmission onto the network. The network interface also includes memory used as a transmit buffer, that stores data packets received from the host computer on the first port, and provides data to the second port for transmission on the network. A control circuit in the network interface manages the memory as a plurality of first-in-first-out FIFO queues having respective priorities. Logic places a packet received from the host processor into one of the plurality of FIFO queues according to a quality of service parameter associated with the packets. Logic transmits the packets in the plurality of FIFO queues according to respective priorities. The transmit packet buffer may be statically or dynamically allocated memory.

Chi-Lie Wang

Papers

High performance IPSEC hardware accelerator for packet classification

Method and apparatus for hardware assisted TCP packet re-assembly

Network interface supporting virtual paths for quality of service