IPsec performance optimization
AssigneeCavium Networks, Inc.
InventorsGregg A. Bouchard, Richard E. Kessler, Muhammad R. Hussain
Life of this patent
Estimating the term…
Abstract
A method and apparatus for optimizing IPsec processing by providing execution units with windowing data during prefetch and managing coherency of security association data by management of security association accesses. Providing execution units with windowing data allows initial parallel processing of IPsec packets. The security association access ordering apparatus serializes access to the dynamic section of security association data according to packet order arrival while otherwise allowing parallel processing of the IPsec packet by multiple execution units in a security processor.
Claims27
An apparatus comprising:
- a first execution unit to process a first IPsec packet;
- a second execution unit to process a second IPsec packet in parallel with the first execution unit;
- and
- a process order unit to order security association data access according to IPsec packet arrival order.
A method comprising:
- processing a first IPsec packet and a second IPsec packet in parallel;
- requesting to access security association data;
- determining if a security association data access request is next to be processed;
- and
- executing the security association data access request.
An apparatus comprising:
- a means for processing multiple packets in parallel;
- a means for requesting an access to context information to process a packet;
- a means for determining if a context information request is next to be processed according to packet order arrival;
- and
- a means for executing the context information request.
A system comprising:
- a framer device;
- a network processor;
- and
- a security processor coupled to the framer device and the network processor, the security processor including at least two execution units to process at least two Ipsec packets in parallel and a process order unit to order security association access by packet arrival order.
A machine-readable medium that provides instructions, which when executed by a machine cause the machine to perform operations comprising:
- processing at least two Ipsec packets in parallel;
- requesting to access security association data;
- determining if a security association data access request is next to be processed according to Ipsec packet arrival order;
- and
- executing the security association data access request.
A method comprising:
- processing a first IPsec packet and a second IPsec packet in parallel;
- receiving a base window number;
- and
- calculating a first sequence number for the first IPsec packet and a second sequence number for the second IPsec packet in parallel.
Dependencies are inferred from the claim text.