Methods, systems, and computer program products for processing a packet-object using multiple pipelined processing modules

#The present invention relates to packet processing methods, systems, and computer program products, and, more particularly, to methods, systems, and computer program products for processing packets in parallel.

#The IP Security Protocol (IPSec) is a set of protocols developed by the Internet Engineering Task Force (IETF) to support the secure exchange of packets at the IP layer. IPSec has been widely used to implement virtual private networks (VPNs). IPSec supports two encryption modes: transport and tunnel. In transport mode only the data or payload portion of a packet is encrypted and the packet header is sent as clear text. In tunnel mode, both the packet header and the data/payload are encrypted. Sending and receiving devices use private keys to secure traffic therebetween. These keys along with security associations (SAs), which are unidirectional logical connections between two IPSec devices or systems, are negotiated by an Internet Key Exchange (IKE) function. An inbound SA may be uniquely identified by a Security Parameter Index (SPI), and IP destination address, and a security protocol. An outbound SA may be uniquely defined by a source IP address, a destination IP address, a protocol, a source port, and a destination port. To provide bi-directional communication, two SAs are typically defined, one in each direction.

#IPSec systems manage SAs by maintaining two databases: a Security Policy Database (SPD) and a Security Association Database (SAD). The SPD specifies what security services are to be offered to the IP traffic. Typically, the SPD contains an ordered list of policy entries that are separate for inbound and outbound traffic. These policies may specify, for example, that some traffic must not go through IPSec processing, some traffic must be discarded, and some traffic must be IPSec processed.

#Other features of the present invention will be more readily understood from the following detailed description of specific embodiments thereof when read in conjunction with the accompanying drawings, in which:

#FIG. 1 illustrates a packet co-processor pipeline architecture in accordance with some embodiments of the present invention;

#FIG. 2 illustrates a packet-object header structure in accordance with some embodiments of the present invention;

#While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that there is no intent to limit the invention to the particular forms disclosed, but on the contrary, the invention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention as defined by the claims. Like reference numbers signify like elements throughout the description of the figures.

#Embodiments of the present invention are described herein in the context of processing a packet. It will be understood that the term “packet” means a unit of information that may be transmitted electronically as a whole from one device to another. Accordingly, as used herein, the term “packet” may encompass such terms of art as “frame” or “message,” which may also be used to refer to a unit of transmission.

#The present invention may be embodied as systems, methods, and/or computer program products. Accordingly, the present invention may be embodied in hardware and/or in software (including firmware, resident software, micro-code, etc.). Furthermore, the present invention may take the form of a computer program product on a computer-usable or computer-readable storage medium having computer-usable or computer-readable program code embodied in the medium for use by or in connection with an instruction execution system. In the context of this document, a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.