Apparatus and method for high speed IPSec processing

Abstract

An IPSec processor is a network security device. It is designed primary for an environment requesting for a throughput of Gigabits per second. By using a new architecture, the parallel processing and pipeline processing become more efficient, thereof higher performance. An IPSec Core in the IPSec processor employs the sharing structure, which raise the utility of the Encryption Engine and Authentication Engine. Moreover, the IPSec Core can be duplicated, allowing a parallel processing. Because the IPSec Core deals with IPSec processing, the Pre_Operation, operation, and post_operation, it becomes a complete set of processing unit and easy for duplicating. In addition, several features have been created for a hardware base implementation, including the processing of the bundled SA case, early verification of the packet, and no need to build an additional context in order to perform a crypto operation.

I claim:  
     
         1 . An IPSec processor for high speed IPSec processing, comprising an inbound IPSec processor and an outbound IPSec processor, each of them further comprising: 
 an External IN Buffer for storing at least one packet data from an Input/Output Interface;    a Parser for parsing the packet data to obtain a set of parameters from the packet data;    a Classification unit being used to lookup a SP for outbound service or an SA for inbound service from the packet data and the set of parameters given by the Parser;    a Database for storing the SA or the SP;    a Database Manager being used to maintain the Database;    at least one IPSec Core for processing the packet data from the External IN Buffer with the SA or the SP information in the Database;    an External OUT Buffer for buffering the packet data after being processed from the IPSec Cores to the Input/Output Interface; and    an External controller for controlling the packet data and SA data being inputted to the IPSec Core or the packet data outputted from the IPSec Cores.    
     
     
         2 . The IPSec processor of  claim 1 , wherein the IPSec Core can be to a stand-alone product.  
     
     
         3 . The IPSec processor of  claim 1 , wherein the Classification unit, the Database, or the Database Manager can be implemented in the IPSec processor or as external parts.  
     
     
         4 . The IPSec processor of  claim 1 , if the Database is implemented as an external part, the SA data have to be sent along with the packet data to the IPSec Core.  
     
     
         5 . The IPSec processor of  claim 1 , wherein the IPSec Core can be duplicated so that the inputted packet data can be processed in parallel, the IPSec Core deals with total IPSec processing, namely a Pre_Operation, an Operation, and a Post_Operation.  
     
     
         6 . An IPSec Core for executing IPSec processing, which comprises: 
 an Encryption Engine fore encrypting part of formed packet data for outbound service or decrypting part of decapsulated packet data for the inbound service;    an Authentication Engine for authenticating the packet data or the processed packet data;    a Device unit for providing miscellaneous calculations to process the packet data or the processed packet data;    two modules, each module comprising: 
 a buffer for storing the packet data or the processed packet data;  
 a BUS for transferring the packet data or the processed packet data in the IPSec Core;  
 a multiplexer for entering the packet data or the processed data being transferred into the buffer from the Encryption Engine, the Authentication Engine, the Device unit, the buffer or the external source;  
 an Output FIFO for outputting the processed packet data; and  
 a Control Unit for controlling the IPSec processes.  
   
     
     
         7 . The IPSec Core of  claim 6 , wherein the packet data is from the IN Buffer of the IPSec processor and the processed data means that the data have been processed by the Encryption Engine, the Authentication Engine or the Device unit.  
     
     
         8 . The IPSec Core of  claim 6 , wherein the Encryption Engine and the Authentication Engine are independent of each other so that one can perform an encryption for a first packet data and an authentication for a second packet data at the same time.  
     
     
         9 . The IPSec Core of  claim 6 , wherein the Device unit provides required information for a crypto operation so that no additional context is needed.  
     
     
         10 . The IPSec Core of  claim 6 , wherein the buffers in the modules acts as an input data buffer, as a working buffer, and as an output buffer; the total buffer size is the same as if the buffers are moved to the External IN Buffer or the External OUT Buffer.  
     
     
         11 . The IPSec Core of  claim 6 , wherein the BUSes could be merged into one for the two modules with a BUS data controller.  
     
     
         12 . The IPSec Core of  claim 6 , wherein the Control Unit further comprises: 
 two sequence controllers for controlling at least one processing sequence of the packet data or the processed packet data;    an Input controller for controlling the packet data, the processed packet data or the SA data being inputted to the IPSec Core;    a Pre_Operation controller for forming an IPSec Packet, part of that packet is used for crypto operation including the encryption, the authentication, or both the encryption and the authentication;    an Encryption controller for controlling the packet data or the processed packet data transferring to/from the Encryption Engine;    an Authentication controller for controlling the packet data or the processed packet data transferring to/from the Authentication Engine;    a Post_Operation controller for dealing with the processed packet data after the crypto operation; and    an Output controller for outputting the processed packet data.    
     
     
         13 . The IPSec Core of  claim 12 , wherein the two sequence controllers share the Input controller, the Pre_Operation controller, the Post_Operation controller, the Encryption controller, the Authentication controller and the Output controller with each other, the two sequence controllers can not both call the same function at the same time.  
     
     
         14 . The IPSec Core of  claim 12 , wherein the two sequence to controllers run their own sequence, therefore, two different packet data can be processed at the same time; in addition, it allows that one of the sequence controllers calls encryption for a first packet and the other sequence controller calls authentication for a second packet.  
     
     
         15 . The IPSec Core of  claim 12 , wherein the sequence controllers allow the processing of the bundled SA case, the processing sequence continues the processes for the bundled SA without moving the processed results of the previous SA and the whole processing is done when all the bundled SAs have been processed.  
     
     
         16 . The IPSec Core of  claim 12 , wherein the sequence controllers allow an early verification of the packet data or the processed packet data, and do not need to perform the verification after the finish of the decryption operation.  
     
     
         17 . The IPSec Core of  claim 12 , wherein the sequence controllers can call both the encryption and the authentication operations simultaneously.  
     
     
         18 . The IPSec Core of  claim 12 , wherein the encryption controller to and the authentication controller are designed to be able chained together by controlling the data transferred from buffer to the encryption engine and to the authentication engine; the transfer from buffer to the authentication engine steals the transfer cycle from buffer to the authentication engine.  
     
     
         19 . An operation method of an IPSec Core for excuting IPSec processing, the IPSec Core having an Encryption Engine, an Authentication Engine, a Device Unit, an Output FIFO, a Control Unit and two module with a buffer individually, comprising: 
 at most two packet data allowed by the Control Unit to enter the modules at a time;    transferring the packet data to the Authentication (Encryption) Engine controlled by the Control Unit and using the Authentication (Encryption) Engine when the packet data needs authentication (encryption);    keeping the packet data in the buffer for waiting controlled by the Control Unit when the packet data needs authentication (encryption) but the Authentication (Encryption) Engine is not available; and    transferring a packet data to the Output FIFO for packet out when the packet data needs no more processing.