US 2026/0312941 A1 · HARDWARE ARCHITECTURE FOR EFFICIENT INLINE IPSEC IN HYBRID PLATFORM

Abstract

A system and method are provided using a hybrid platform that combines hardware and software solutions for securely processing data packets at high data rates. A classifier (e.g., content addressable memory (CAM) for inbound traffic or packet processing elements (PPE) software on a core processor for outbound traffic) classifies the security association (SA) of a data packet based on characteristics of the data packet (e.g., 5-tuple, etc.) and encodes the SA in a customized header of the data packet before the packet is sent to a crypto device (CD). The CD uses the SA in the customized header to perform a cryptography operation and then removes the customized header or clips the SA from the customized header before forwarding the packet to its destination.

Claims20

Dependent claims

A method for efficiently processing network data packets, the method comprising:

classifying, at a classification processor, a security association of a data packet based on one or more characteristics of the data packet;
encoding, in a header of the data packet, cryptograph information representing the security association;
sending, to a crypto device from the classification processor, the data packet together with the cryptograph information in the header of the data packet;
performing, by a cryptography processor of the crypto device, a cryptography operation on the data packet based on the cryptograph information in the header of the data packet;
and
removing the cryptograph information from the header of the data packet before transmitting the data packet to a destination of the data packet.

3 more elements

A computing system comprising:

one or more processors;
and
a memory storing instructions that, when executed by the one or more processors, configure the computing system to:
classify, at a classification processor, a security association of a data packet based on one or more characteristics of the data packet;
encode, in a header of the data packet, cryptograph information representing the security association;
send, to a crypto device from the classification processor, the data packet together with the cryptograph information in the header of the data packet;
perform, by a cryptography processor of the crypto device, a cryptography operation on the data packet based on the cryptograph information in the header of the data packet;
and
remove the cryptograph information from the header of the data packet before transmit the data packet to a destination of the data packet.

6 more elements

A non-transitory computer-readable storage medium comprising instructions that when executed by a computing system, cause the computing system to:

classify, at a classification processor, a security association of a data packet based on one or more characteristics of the data packet;
encode, in a header of the data packet, cryptograph information representing the security association;
send, to a crypto device from the classification processor, the data packet together with the cryptograph information in the header of the data packet;
perform, by a cryptography processor of the crypto device, a cryptography operation on the data packet based on the cryptograph information in the header of the data packet;
and
remove the cryptograph information from the header of the data packet before transmit the data packet to a destination of the data packet.

3 more elements

Dependencies are inferred from the claim text.

Hardware architecture for efficient inline ipsec in hybrid platform

Life of this patent

Hardware architecture for efficient inline ipsec in hybrid platform

Life of this patent

Abstract

Claims20