A method of offloading data intensive tasks from a processor, comprises, at a processor, preparing a TCP packet comprising a TCP header and a data payload, transmitting the TCP packet to a configurable logic device (CLD); and at the CLD, receiving the TCP packet, generating set of TCP segment packets containing, a copy of the TCP header, an incrementing segment sequence identifier, and a portion of the data payload, and transmitting the set of TCP segment packets on an external network interface.

High-speed CLD-based TCP segmentation offload

Providing communications between operating system partitions and a computer network. In one aspect, an apparatus for distributing network communications among multiple operating system partitions includes a physical port allowing communications between the network and the computer system, and logical ports associated with the physical port, where each logical port is associated with one of the operating system partitions. Each of the logical ports enables communication between a physical port and the associated operating system partition and allows configurability of network resources of the system. Other aspects include a logical switch for logical and physical ports, and packet queues for each connection and for each logical port.

Network communications for operating system partitions

A method is provided in one example embodiment and includes communicating location and access network information for an end user to a policy and charging rules function (PCRF) element that is coupled to a network element. The network element receives packets for a communications flow from the end user if the flow is initiated through a wireless network and through a wireline network. In more specific embodiments, the location and access network information is used to initiate one or more applications for the end user. The method could also include communicating to an application function that the end user has attached to one of the networks, has been assigned an Internet Protocol (IP) address, and the location and access network information for the end user.

System and method for providing location and access network information support in a network environment

Methodologies developed in the Internet Engineering Task Force (IETF) Internet Protocol Security (IPSEC) Working Group can be incorporated into asynchronous transfer mode (ATM) and frame relay (FR) signaling to provide message integrity and origin authentication. In turn, these mechanisms can provide a virtual private network (VPN) infrastructure with call control message integrity, origin verification, and transit network filtering. In this paper, we describe a set of control messages based on the IPSEC authentication header (AH) methodology that provide these security mechanisms for ATM and FR network switching equipment and signaling protocols.

Authenticaiton Mechanisms for Call Control Message Integrity and Origin Verification

Embodiments of methods and apparatus for providing an insertion and integrity protection system associated with a wireless communication platform are generally described herein. Other embodiments may be described and claimed.

Methods and apparatus for providing an insertion and integrity protection system associated with a wireless communication platform

One aspect of the invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The security system selectively perform security processing on data incoming from the network based on security associations stored in a memory external to the network interface system, typically a host system memory. The security association for any given frame, when available, is fetched from the external memory after the frame begins to arrive in the network interface system based in part on information contained in the frame. Preferably, the fetch begins before the frame is fully received and the security association is queued whereby security processing can begin without having to wait for the security association to be fetched.

Network interface with security association data prefetch for high speed offloaded security processing

The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The network interface offloads IPsec processing from the host processor. According to the invention, the security system includes two processors for encrypting and authenticating the outgoing data. Outgoing data packets are sent alternately to one or the other processor, whereby transmission processing can be accelerated relative to receive processing.

Two Parallel Engines for High Speed Transmit IPSEC Processing

A security association architecture system of the present invention facilitates network data transfer by providing an internal portion of a security association database that can be quickly accessed to obtain security associations as well as an external component that stores the complete security association database. As a result, at least some security associations for incoming received frames and outgoing transmitted frames can be obtained from the internal portion located on a network interface device without accessing system memory, a host computer, and the like in order to obtain the security associations to perform security processing.

Security association table lookup architecture and method of operation

A circuit for controlling external bipolar buffers for an MOS peripheral device capable of operating in master and slave modes. The circuit provides for a slave mode logic block (40A) and a master mode logic (40B) block for generating a DATA TRANSMIT ENABLE SIGNAL to permit the bipolar buffer (17) to transmit data signals from the peripheral device (21) to a system bus (14, 15). The circuit also provides for a second slave mode logic block (60A) and a master mode logic block (60B) for generating a DATA RECEIVE ENABLE block to permit the bipolar buffer (17) to transmit data signals from the system bus (14, 15) to the peripheral device (21). Each slave mode logic block is responsive to condition signals, such as CHIP SELECT and READ/WRITE. Each master mode logic block is responsive to timing signals and signals generated internally within the peripheral device (21) so that the master mode DATA RECEIVE and DATA TRANSMIT signals occur only in predetermined timing cycles.

Circuit for controlling external bipolar buffers from an mos peripheral device.

The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The security system is operative to selectively authenticate incoming and outgoing data. The security system includes a pipeline that masks mutable fields from incoming data prior to authentication.

Mohammad Y. Maniar

Papers

Network interface with security association data prefetch for high speed offloaded security processing

Two Parallel Engines for High Speed Transmit IPSEC Processing

Security association table lookup architecture and method of operation

Circuit for controlling external bipolar buffers from an mos peripheral device.

Receive IPSEC in-line processing of mutable fields for AH algorithm