Anti-replay protection with quality of services (QoS) queues

An article of manufacture comprising:

• a machine-accessible storage medium including information that, when accessed by a machine, cause the machine to perform operations comprising:
• maintaining a single global anti-replay window having global lowest and highest sequence numbers for an Internet protocol security (IPSec) security association (SA), the single global anti-replay window being associated with individual differentiated services code point (DSCP) or DSCP group, the individual DSCP or DSCP group corresponding to individual per-DSCP anti-replay windows;
• pre-processing a received packet having a sequence number before packet processing using the single global anti-replay window;
• and
• post-processing the received packet after packet processing using the individual per-DSCP anti-replay windows.

An apparatus comprising:

• a global window maintaining module to maintain a single global anti-replay window having global lowest and highest sequence numbers for an Internet protocol security (IPSec) security association (SA), the single global anti-replay window being associated with individual differentiated services code point (DSCP) or DSCP group, the individual DSCP or DSCP group corresponding to individual per-DSCP anti-replay windows;
• a pre-processor is coupled to the global window maintaining module to pre-process a received packet having a sequence number before packet processing by a packet processor using the single global anti-replay window;
• and
• a post-processor coupled to the packet processor to post-process the received packet after packet processing using the individual per-DSCP anti-replay windows.

A system comprising:

• a sending server coupled to a network to send a packet through a virtual private network;
• and
• a receiving server coupled to the VPN to receive the packet, the receiving server having a VPN gateway, the VPN gateway including a QoS anti-replay processor, the QoS anti-replay processor comprising:
• a global window maintaining module to maintain a single global anti-replay window having global lowest and highest sequence numbers for an Internet protocol security (IPSec) security association (SA), the single global anti-replay window being associated with individual differentiated services code point (DSCP) or DSCP group, the individual DSCP or DSCP group corresponding to individual per-DSCP anti-replay windows,
• a pre-processor is coupled to the global window maintaining module to pre-process a received packet having a sequence number before packet processing by a packet processor using the single global anti-replay window, and
• a post-processor coupled to the packet processor to post-process the received packet after packet processing using the individual per-DSCP anti-replay windows.