Back to results
US 7,454,610 B2Granted
Security association updates in a packet load-balanced system
AssigneeBroadcom Corporation
InventorsMark L. Buer, Timothy R. Paaske, Zheng Qi
Life of this patent
Estimating the term…
Abstract
Methods and associated systems for providing secured data transmission over a data network are disclosed. Security association updates may be provided in a load-balanced system. Before encryption, the system may calculate values for header fields that need to be updated as a result of an encryption process. Encrypted packets may be decrypted by a parallel decryption system. After decryption, the system may calculates value for fields in the header information that need to be updated as a result of the decryption process.
Claims23
A packet processing method comprising:
- receiving a plurality of packets;
- receiving a security association handle for each packet in the plurality of packets, wherein the security association handle includes a set of selectors;
- for each packet, identifying a flow entry for the packet, including:
- determining a flow element address for the packet,
- retrieving a first flow element using the flow element address, wherein the first flow element includes a plurality of flow entries,
- determining whether a selector in the set of security association handle selectors is present in one of the plurality of flow entries, and
- retrieving a second flow element if a selector in the set of security association handle selectors is not present in one of the plurality of flow entries;
- retrieving security association information for each packet using the identified flow entry;
- generating header information for each of the plurality of packets;
- adding the header information to each of the plurality of packets to generate encapsulated packets;
- and
- distributing the encapsulated packets to a plurality of cryptographic processors.
9 more elements
A packet processing method comprising:
- receiving a plurality of packets comprising header information and encrypted data;
- receiving a security association handle for each packet in the plurality of packets, wherein the security association handle includes a set of selectors;
- for each packet, identifying a flow entry for the packet, including:
- determining a flow element address for the packet,
- retrieving a first flow element using the flow element address, wherein the first flow element includes a plurality of flow entries,
- determining whether a selector in the set of security association handle selectors is present in one of the plurality of flow entries, and
- retrieving a second flow element if a selector in the set of security association handle selectors is not present in one of the plurality of flow entries;
- retrieving security association information for each packet using the identified flow entry;
- distributing the packets to a plurality of cryptographic processors;
- decrypting the encrypted portion of each packet based on a portion of the security association information retrieved for the packet;
- modifying, by a common processing component, at least a portion of the header information of the decrypted packets;
- and
- transmitting the decrypted packets.
10 more elements
A packet processing system comprising:
- at least one media access controller for receiving a plurality of packets;
- at least one data memory for storing security association information;
- and
- a cryptographic processing module, wherein the cryptographic processing module includes:
- a policy lookup unit configured to identify a flow associated with each of the received plurality of packets by determining a flow element address for the packet, retrieving a first flow element using the flow element address, wherein the first flow element includes a plurality of flow entries, determining whether a selector in the set of security association handle selectors is present in one of the plurality of flow entries, and retrieving a second flow element if a selector in the set of security association handle selectors is not present in one of the plurality of flow entries and further configured to retrieve a security association for each identified flow;
- a merge data unit coupled to the policy lookup unit configured to merge a portion of the security association retrieved by the policy lookup unit with the associated packet,
- a plurality of cryptographic processors, each coupled to the merge data unit for performing cryptographic operations on the merged packets.
4 more elements
A method for determining security association information in a cryptographic processor comprising:
- receiving a security association handle for a packet, wherein the security association handle includes a set of selectors;
- identifying a flow entry for the packet, including:
- determining a flow element address for the packet,
- retrieving a first flow element using the flow element address, wherein the first flow element includes a plurality of flow entries, and
- determining whether a selector matching a selector in the set of security association handle selectors is present in one of the plurality of flow entries,
- retrieving a second flow element if a selector in the set of security association handle selectors is not present in one of the plurality of flow entries;
- retrieving security association information using the identified flow entry;
- and
- transmitting at least a portion of the retrieved security association information to a cryptographic processing engine.
6 more elements
Dependencies are inferred from the claim text.