Patent ID: 7848325
Filing Date: 2010-12-07
Classification: H04L

Abstract:
1. An IPsec processor for performing IPsec processing of traffic packets, the IPsec processor comprising: a network processing module; and a hardware co-processing module coupled to the network processing module via an interface, the hardware co-processing module comprising a policy check processor, and a packet transform processor; wherein, the network processing module comprises: a storing unit for storing a packet in a queue; a first communicating unit for communicating a header of the packet, comprising a minimal amount of packet data necessary for performing policy check processing, to the policy check processor via the interface; a second communicating unit for, if IPsec processing of the packet is required based on a result signaled by a signaling unit of the policy check processor, communicating the packet including a remainder of the packet not communicated via the first communicating unit to the packet transform processor from the queue via the interface; and a first scheduling unit for scheduling an IPsec processed packet which is processed by the packet transform processor based on the packet communicated by the second communicating unit, received from the packet transform processor via the interface, for forwarding from the queue; wherein the policy check processor comprises: a checking unit for checking the header of the packet communicated by the first communicating unit to determine if IPsec processing of the packet is required; and a signaling unit for signaling a result of the checking by the checking unit to the network processing module, wherein said checking unit and said signaling unit can process a plurality of successive packet headers while the packet transform processor is applying IPsec processing to said packet; and the packet transform processor comprises: a reading unit for reading the packet from the queue via the interface based upon the result of the checking; an applying unit for applying IPsec processing to the packet; and a third communicating means unit for communicating the IPsec processed packet processed by the applying unit to the queue of the network processing module via the interface.