Lifm algorithm for security association database lookup in IPSEC application
AssigneeADMtek Incorporated
InventorsFang-cheng Liu, Ding-jyan Syu
Life of this patent
Estimating the term…
Abstract
Current applications used in security system for encryption/decryption/authentication require intense CPU computation for an SAD search. Therefore, a part of the SAD is planted into an ASIC in order to lessen the load of the CPU. The invention provides a high-performance lookup method that is “LIFM” adapted to the ASIC. Initially, the ASIC makes a perfect match by comparing the SAD_index field of all items allocated in the ASIC with an incoming packet to fetch the required SAD_key. If there is no match, the software and hardware are started by issuing an interrupt from the ASIC until the CPU finds a perfectly matched item. Then, the software level updates the perfectly matched item in the ASIC.
Claims1
A lookup method applied to an SAD in an IPSEC, wherein a complete SAD stored in a software level is handled by a CPU and a part of the SAD includes M+1 (M is a positive integer) items of data in which every item comprises an SAD_index field and an SAD_key field, the M+1 items of data are allocated in an ASIC in numerical order (from item 0 to item M), the lookup method comprising the following steps:
- (1) Receive an incoming packet;
- (2) Assign a default value “0” to a variable i;
- (3) The ASIC compares the packet with the SAD_index field of item i, if perfectly matched, then jump to step 6;
- (4) Identify whether the numerical value of the variable i is equal to M, if “YES”, then jump to step 7;
- (5) Set the numerical value of the variable i to equal the previous value plus 1, then return to step 3;
- (6) Read out the SAD_index field of item i, and store the data of item i in an intermediate storage, then move respective items (i−1), (i−2) . . . , 1, 0 to locations i, (i−1), . . . 2, 1 in sequence, and finally, move the data stored in an intermediate storage to location 0 and jump to step 9;
- (7) The ASIC issues an interrupt to inform the CPU, and after receiving the interrupt, the CPU enters the aforementioned software level and successively compares each item being allocated in the software level with the aforementioned packet in terms of each bit of the SAD_index field until the CPU finds the perfectly matched item;
- (8) Read out the SAD_index field of the aforementioned item that makes a perfect match with the packet, then respectively move items (M−1), (M−2) . . . , 1, 0 to locations M, (M−1), . . . 2, 1 in sequence. Finally, move the aforementioned item that makes a perfect match with the packet to location 0;
- and
- (9) End.
Dependencies are inferred from the claim text.