High performance IPSEC hardware accelerator for packet classification

An accelerator device, comprising:

• an input buffer connected to a packet source and configured to accept and store packets from the packet source;
• a scanner configured to scan predetermined fields of the accepted/stored packets;
• a modifier configured to modify fields of packets in said input buffer based on the scanned predetermined fields;
• a FIFO configured to store predetermined data from the scanned predetermined fields;
• and
• a state machine configured to
• retrieve data from the FIFO for a particular packet,
• read the particular packet from said buffer;
• scan additional fields in the particular packet if a flag indicating additional scanning is included in the retrieved FIFO data;
• program said modifier to perform one of encryption and decryption of the fields of the packet to be modified according to the retrieved FIFO data and scanned additional fields, and
• modify the packet stored in said buffer according to the encrypted or decrypted fields produced by said modifier.

A hardware accelerator device, comprising:

• parser means connected to an input packet source for parsing predetermined fields of an inbound packet;
• hash means for determining a security identification of the inbound packet;
• storage means for temporarily storing the parsed predetermined fields and said security identification;
• decryption mechanism for deciphering encrypted data of the inbound packet based on programming;
• security database means for storing retrievable security associations;
• and
• Control/Data means for,
• retrieving security associations from said database,
• programming the decryption mechanism based on at least one of the stored security information, other data contained in the incoming packet corresponding to the stored security information, and the retrieved security association, and
• modifying fields of the incoming packet based on deciphered output of said decryption mechanism;
• and
• a state machine;
• wherein the storage means comprises a FIFO configured to store predetermined data from the parsed predetermined fields and the state machine is configured to retrieve the stored data and program said decryption mechanism according to the stored data.

A method of performing IPSEC processing, comprising:

• scanning a packet for IPSEC related information
• programming an IPSEC services device to perform IPSEC processing based on the scanned IPSEC information;
• and
• providing data from said packet for processing by the IPSEC services device;
• and
• modifying said packet based on an output from the IPSEC security services device;
• wherein:
• said steps of scanning, programming, providing, and modifying are performed by a hardware device at an IP layer of a network connected device;
• said hardware device includes a FIFO configured to store the at least part of the data read between said steps of reading and providing;
• and
• said hardware device further includes a state machine configured to retrieve the stored data and program said IPSEC services device according to the stored data.