Cryptographic data communication apparatus

Data communication apparatus, comprising:

• packet processing circuitry configured to:
• receive data from a memory responsively to a data transfer request;
• cryptographically process the received data in units of data blocks using a block cipher so as to add corresponding cryptographically processed data blocks to a sequence of data packets, the sequence including respective ones of the cryptographically processed data blocks having block boundaries that are not aligned with payload boundaries of respective one of the packets, such that respective ones of the cryptographically processed data blocks are divided into two respective segments, which are contained in successive respective ones of the packets in the sequence;
• read cryptographic parameters registered in the memory by a processing unit, the cryptographic parameters including an initial cryptographic key and an initial value;
• compute a first cryptographic key responsively to the initial cryptographic key and the initial value;
• cryptographically process a first block of the received data responsively to the first cryptographic key;
• compute an updated value responsively to the initial value and a size of the first block;
• compute a second cryptographic key responsively to the initial cryptographic key and the updated value;
• cryptographically process a second block of the received data blocks responsively to the second cryptographic key;
• and
• packetize the first and second block in at least one packet;
• and
• a network interface which comprises one or more ports for connection to a packet data network and is configured to send the at least one packet to a remote device over the packet data network via the one or more ports.

Data communication method, comprising:

• receiving a sequence of data packets from a remote device over a packet data network via one or more ports responsively to a data transfer request, the received sequence including received data blocks;
• reading cryptographic parameters from a memory in which the parameters were registered by a processing unit, the cryptographic parameters including an initial cryptographic key and an initial value;
• computing a first cryptographic key responsively to the initial cryptographic key and the initial value;
• cryptographically processing a first block of the received data blocks responsively to the first cryptographic key;
• computing an updated value responsively to the initial value and a size of the first block;
• computing a second cryptographic key responsively to the initial cryptographic key and the updated value;
• cryptographically processing a second block of the received data blocks responsively to the second cryptographic key, ones of the received data blocks having block boundaries that are not aligned with payload boundaries of the packets, such that respective ones of the received data blocks are divided into two respective segments contained in successive respective ones of the packets in the sequence;
• cryptographically processing the received data blocks using a block cipher so as to write corresponding cryptographically processed data blocks to the memory, while holding segments of respective ones of the received data blocks in the memory, such that the packet processing circuitry stores a first segment of a respective one of the received data blocks of a first one of the packets in the memory until a second one of the packets is received via the network interface, and then cryptographically processes the first and second segments together so as to write a corresponding cryptographically processed data block to the memory;
• and
• writing the cryptographically processed first block and second block to the memory.

Data communication method, comprising:

• receiving data from a memory responsively to a data transfer request;
• processing the received data in units of data blocks using a block cipher so as to add corresponding cryptographically processed data blocks to a sequence of data packets, the sequence including respective ones of the cryptographically processed data blocks having block boundaries that are not aligned with payload boundaries of respective one of the packets, such that respective ones of the cryptographically processed data blocks are divided into two respective segments, which are contained in successive respective ones of the packets in the sequence;
• reading cryptographic parameters registered in the memory by a processing unit, the cryptographic parameters including an initial cryptographic key and an initial value;
• computing a first cryptographic key responsively to the initial cryptographic key and the initial value;
• cryptographically processing a first block of the received data responsively to the first cryptographic key;
• computing an updated value responsively to the initial value and a size of the first block;
• computing a second cryptographic key responsively to the initial cryptographic key and the updated value;
• cryptographically processing a second block of the received data blocks responsively to the second cryptographic key;
• packetizing the first and second block in at least one packet;
• and
• sending the at least one packet to a remote device over a packet data network via one or more ports.