Patent ID: 8131994
Filing Date: 2012-03-06
Classification: H04L

Abstract:
1. A non-transitory computer-readable medium comprising executable instructions operable, when executed, to: responsive to an initial session key negotiation, store a first security association information, comprising a first encryption key, for a tunnel in a security association memory; responsive to a session key renegotiation, store a second security association information different from the first security association, comprising a second encryption key, for the same tunnel in a cache; prior to an expiration condition, decrypt received packets associated with the tunnel conditionally using the second security association information in the cache or the first security association information in the security association memory based on identifiers associated with each of the received packets; and upon the expiration condition, overwrite the security association information, for the tunnel, in the security association memory with the security association information, for the tunnel, copied from the cache; wherein, before storing security association information for the tunnel in a cache, if the cache is full and if one or more expiration conditions have occurred, the executable instructions further operable, when executed, to: select an expired entry in the security association memory; and write the security association data from a corresponding cache entry to the selected expired entry in the security association memory.