Transparent IPSec processing inline between a framer and a network component
AssigneeCavium Networks, Inc.
InventorsRichard E. Kessler, Muhammad R. Hussain
Life of this patent
Estimating the term…
Abstract
A method and apparatus for transparent processing of IPsec network traffic by a security processor in line between a framer and a network processor. Security processor parses packet header and tail information to determine if encryption or decryption is required. After encryption or decryption is completed packet header and tail information is modified to reflect the changes in the packet such as length of the packet. The modified packet is then passed on to the network processor or framer.
Claims24
An apparatus comprising:
- a security processor to be inline between a framer and a network processor, the security processor to intercept data traffic between the framer and network processor and to process an IPsec protocol layer in the data traffic transparent to the framer or network processor without terminating any other protocol layer in the data traffic and to identify IPsec frames within the data traffic to process.
An apparatus comprising:
- a first circuit to determine a protocol type of a packet;
- at least one execution unit coupled to the first circuit, the at least one execution unit to decrypt an encrypted protocol layer of the packet;
- a second circuit to correct protocol layer data after decryption to reflect changes to the packet caused by the decryption;
- and
- a third circuit coupled to second circuit to communicate with a framer.
A method comprising:
- receiving a packet;
- parsing the packet to determine the level two protocol information in the packet;
- processing an IPsec protocol layer of the packet;
- altering the packet to correct header information to reflect the processing of the IPsec protocol;
- and
- sending the packet to a framer device.
An apparatus comprising:
- means for receiving a packet;
- means for parsing the packet to determine the level two protocol information in the packet;
- means for processing an IPsec protocol layer of the packet;
- means for correcting protocol layer information after processing the IPsec protocol layer to reflect changes based on the processing;
- and
- means for sending a packet to a framer device.
A system comprising:
- a framer device;
- a network processor;
- and
- a security processor couple between the framer device and the network processor, the security processor to process an IPsec protocol layer transparent to the network device and framer without terminating any other protocol layer and to adjust header data to reflect IPsec processing.
A machine-readable medium that provides instructions, which when executed by a machine cause the machine to perform operations comprising:
- processing a packet received from a framer device by a security processor coupled to the framer to determine a type of protocol layers including identifying an IPsec protocol layer in the packet;
- processing the packet to decrypt the IPsec protocol layer;
- modifying the packet to generate a modified packet including a decrypted IP protocol layer and protocol layer information based on the decrypted IP protocol layer and
- sending the modified packet from the security processor to a network processor.
Dependencies are inferred from the claim text.