Reconfigurable key search engine

Abstract

A Reconfigurable Key Search Engine is disclosed along with a mobile unit incorporating same and related methods. The RKSE is adapted to efficiently search a memory system storing a plurality of security keys potentially related to multiple networks. One embodiment uses a hierarchical memory system including at least one associative memory.

1 . A mobile unit, comprising: 
 a Key Search Engine (KSE) to receive search criteria from a network, to provide a security key, and comprising a memory system to store a plurality of security keys;    wherein the memory system comprises; an associative memory to provide an index output in response to index data derived from the search criteria, and a memory to output the security key in response to the index output.    
   
   
       2 . The mobile unit of  claim 1 , wherein the KSE comprises a KSE control block to receive the search criteria, and to derive the index data.  
   
   
       3 . The mobile unit of  claim 2 , wherein the search criteria comprises at least one of data packet information related to a data packet received in the mobile unit, and auxiliary information related to an element in the network.  
   
   
       4 . The mobile unit of  claim 3 , wherein the auxiliary information comprises control option information related to a user-defined option selection.  
   
   
       5 . The mobile unit of  claim 2 , wherein the KSE control block further comprises: 
 an Input/Output block to receive the search criteria and output the security key;    an associative memory interface to connect the KSE control block with the associative memory; and,    a memory interface to connect the KSE control block with the memory.    
   
   
       6 . The mobile unit of  claim 2 , wherein the KSE control block further comprises: 
 an index selector to derive the index data in response to the search criteria.    
   
   
       7 . The mobile unit of  claim 6 , wherein the index selector comprises: 
 a register block and a mapper.    
   
   
       8 . The mobile unit of  claim 7 , wherein the register block comprises a reconfigurable register adapted to output index data of varying size or character in response a mapper output.  
   
   
       9 . The mobile unit of  claim 8 , wherein the mapper comprises a mapping table or a finite state machine.  
   
   
       10 . The mobile unit of  claim 1 , wherein the plurality of security keys comprises a default key, and the memory system further comprises a default memory storing the default key.  
   
   
       11 . The mobile unit of  claim 10 , wherein security key comprises multiple components, and the memory comprises multiple memories, each storing one or more of the multiple components.  
   
   
       12 . The mobile unit of  claim 11 , wherein the multiple components comprise at least one of, an encryption/decryption key, a cipher, and an Initialization Vector (IV).  
   
   
       13 . The mobile unit of  claim 1 , wherein security key comprises multiple components, and the memory comprises multiple memories, each storing one or more of the multiple components.  
   
   
       14 . The mobile unit of  claim 13 , wherein the multiple components comprise at least one of; a Security Association Identifier (SAID), a Traffic Encryption Key (TEK), a Security Association (SA) and an Initialization Vector (IV).  
   
   
       15 . The mobile unit of  claim 13 , wherein the associative memory comprises multiple Content Addressable Memories (CAMs).  
   
   
       16 . The mobile unit of  claim 11 , wherein the associative memory comprises multiple Content Addressable Memories (CAMs).  
   
   
       17 . The mobile unit of  claim 1 , wherein the associative memory comprises multiple Content Addressable Memories (CAMs).  
   
   
       18 . The mobile unit of  claim 1 , wherein the KSE comprises: 
 an index operation block to receive index criteria derived from the search criteria and the index output, and to generate a memory address.    
   
   
       19 . The mobile unit of  claim 18 , wherein the index operation block comprises a circuit performing concatenation, a circuit performing a hashing operation, or a circuit performing a logical operation.  
   
   
       20 . The mobile unit of  claim 5 , wherein the KSE control block further comprises: 
 an index selector comprising a register block and a mapper, the index selector to derive the index data from the data packet information and the auxiliary information by operation of the register block and the mapper.    
   
   
       21 . The mobile unit of  claim 20 , wherein the register block comprises a register storing control option information.  
   
   
       22 . The mobile unit of  claim 21 , wherein the index selector further comprises an index operation block to receive index criteria selected from the search criteria and the index output, and to output a memory address applied to the memory.  
   
   
       23 . A Key Search Engine (KSE), comprising: 
 a KSE control block to receive search criteria from a network, to derive index data from the search criteria, and to provide a security key; and,    a memory system to store a plurality of security keys,    wherein the memory system comprises an associative memory to provide an index output in response to the index data, and a memory to output the security key in response to the index output.    
   
   
       24 . The KSE of  claim 23 , wherein the search criteria comprises at least one of data packet information related to a data packet received in the KSE, and auxiliary information related to an element in the network.  
   
   
       25 . The KSE of  claim 24 , wherein the auxiliary information comprises control option information related to a user-defined option selection.  
   
   
       26 . The KSE of  claim 25 , wherein the KSE control block further comprises: 
 an Input/Output block to receive the search criteria and output the security key;    an associative memory interface to connect the KSE control block with the associative memory; and,    a memory interface to connect the KSE control block with the memory.    
   
   
       27 . The KSE of  claim 26 , wherein the KSE control block further comprises: 
 an index selector to derive the index data in response to the search criteria.    
   
   
       28 . The KSE of  claim 27 , wherein the index selector comprises: 
 a register block and a mapper.    
   
   
       29 . The KSE of  claim 28 , wherein the register block comprises a reconfigurable register adapted to output index data of varying size or character in response a mapper output.  
   
   
       30 . The KSE of  claim 29 , wherein the mapper performs a mapping operation in response to one of the search criteria, an associative memory data entry, and a memory data entry.  
   
   
       31 . The KSE of  claim 30 , wherein the mapper comprises a mapping table or a finite state machine.  
   
   
       32 . The KSE of  claim 23 , wherein the plurality of security keys comprises a default key, and the memory system comprises a default memory storing the default key.  
   
   
       33 . The KSE of  claim 32 , wherein the security key comprises multiple components, and the memory comprises multiple memories, each storing one or more of the multiple components.  
   
   
       34 . The KSE of  claim 33 , wherein the multiple components comprise at least one of, an encryption/decryption key, a cipher, and an Initialization Vector (IV).  
   
   
       35 . The KSE of  claim 23 , wherein the security key comprises multiple components, and the memory comprises multiple memories, each storing one or more of the multiple components.  
   
   
       36 . The KSE of  claim 35 , wherein the multiple components comprise at least one of; a Security Association Identifier (SAID), a Traffic Encryption Key (TEK), a Security Association (SA) and an Initialization Vector (IV).  
   
   
       37 . The KSE of  claim 23  further comprising: 
 an index operation block to receive index criteria derived from the search criteria and the index output, and to generate a memory address.    
   
   
       38 . The KSE of  claim 37 , wherein the index operation block comprises a circuit performing concatenation, a circuit performing a hashing operation, or a circuit performing a logical operation.  
   
   
       39 . A mobile unit adapted to connect within a first network communicating data in accordance with a first protocol and a second network communicating data in accordance with a second protocol, the mobile unit comprising: 
 a Reconfigurable Key Search Engine (RKSE), comprising:    a memory system storing a plurality of security keys related the first and second networks; and,    a control block outputting a security key selected from the plurality of security keys in response to search criteria comprising data packet information received by the mobile unit.    
   
   
       40 . The mobile unit of  claim 39 , wherein the first network is a Wireless Local Area Network (WLAN), and the second network is a Wireless Metropolitan Area Network (WMAN) or an Ad-hoc network.  
   
   
       41 . The mobile unit of  claim 40 , wherein the memory system comprises: 
 an associative memory receiving index data derived from the search criteria and outputting an index output; and,    a memory receiving a memory address derived from the index output and outputting the security key in response to the memory address.    
   
   
       42 . The mobile unit of  claim 41 , wherein the index output indicates a HIT condition if the index data identifies an associative memory entry, or a MISS condition if the index data fails to identify an associative memory entry.  
   
   
       43 . The mobile unit of  claim 42 , wherein the memory system further comprises: 
 a default memory receiving the memory address when a MISS condition is indicated; and,    wherein the memory receives the memory address when a HIT condition is indicated.    
   
   
       44 . The mobile unit of  claim 43 , wherein the default memory is a hierarchical memory comprising multiple default memories, each storing related components of the security key; and, 
 wherein the multiple default memories are responsive to the received memory address.    
   
   
       45 . The mobile unit of  claim 43 , wherein the memory is a hierarchical memory comprising multiple memories, each storing related components of the security key; and, 
 wherein the multiple memories are responsive to the received memory address.    
   
   
       46 . The mobile unit of  claim 44 , wherein the memory is a hierarchical memory comprising multiple memories, each storing related components of the security key; and, 
 wherein the multiple memories are responsive to the received memory address.    
   
   
       47 . The mobile unit of  claim 41 , wherein the RKSE further comprises: 
 an index operation block receiving the index output and index criteria; and,    wherein the memory address is derived by performing a logical operation on the index output and the index criteria.    
   
   
       48 . The mobile unit of  claim 47 , wherein the logical operation is a concatenation or a hash.  
   
   
       49 . The mobile unit of  claim 47 , wherein the index criteria is derived from the search criteria.  
   
   
       50 . The mobile unit of  claim 49 , wherein the search criteria comprises auxiliary information related to the mobile unit.  
   
   
       51 . The mobile unit of  claim 50 , wherein the auxiliary information comprises control option information related to user-defined option selections.  
   
   
       52 . The mobile unit of  claim 50 , wherein the index criteria is defined at least in part in relation to the control option information.  
   
   
       53 . The mobile unit of  claim 40 , wherein the control block further comprises: 
 an Input/Output block to receive the search criteria and output the security key;    an associative memory interface to connect the control block with the associative memory; and,    a memory interface to connect the control block with the memory.    
   
   
       54 . The mobile unit of  claim 53 , wherein the memory system comprises: 
 a first Content Addressable Memory (CAM) receiving first index data from the control block and outputting a first index output;    a first memory receiving a first memory address derived from the first index output and outputting a first security key component output;    a second CAM receiving second index data derived from the first security key component output and outputting a second index output; and,    a second memory receiving the second index data and outputting a second security key component output.    
   
   
       55 . The mobile unit of  claim 54 , wherein the first security key component output is a Security Association Identifier (SAID), and the second security key component output comprises a Traffic Encryption Key (TEK) and a corresponding Initialization Vector (IV).  
   
   
       56 . The mobile unit of  claim 40 , further comprising: 
 first circuitry adapted to communicate with a WLAN and second circuitry adapted to communicate with a WMAN or an Ad-hoc network, wherein the first and second circuitry commonly access the RKSE to obtain a respective security key.    
   
   
       57 . The mobile unit of  claim 41 , wherein the first network is a WLAN, and the second network is a WMAN or an Ad-hoc network, 
 wherein the plurality of security keys comprises a plurality of WLAN-related security keys, and a plurality of WMAN-related security keys or a plurality of AD-hoc network-related security keys;    wherein the mobile unit comprises a radio frequency receiver receiving a data packet; and,    wherein the RKSE outputs a WLAN-related security key selected from the plurality of WLAN-related security keys where the received data packet originates from the WLAN,    outputs a WMAN-related security key selected from the plurality of WMAN-related security keys where the received data packet originates from the WMAN, or    outputs an Ad-hoc network-related security key selected from the plurality of Ad-hoc network-related security keys where the received data packet originates from the Ad-hoc network.    
   
   
       58 . The mobile unit of  claim 57 , wherein the memory system further comprises a default memory storing selected at least one WLAN security key comprising a default key.  
   
   
       59 - 103 . (canceled)