Patent ID: 7733862
Filing Date: 2010-06-08
Classification: H04L

Abstract:
1. An apparatus for implementing an IPSec engine in IXDP2851 which is an IXP2850 network processor development platform having a computer-readable storage medium, the apparatus comprising: a memory; the IXP2850 network processor, wherein the computer readable storage medium includes computer instructions which are configured for use in implementing the IPSec engine in the IXDP2851; a packet classifier/forwarding microblock receiving a plurality of packets, and classifying at least one packet into an inbound packet in which a destination address of an IP header of the inbound packet indicates the packet classifier/forwarding microblock, and classifying at least one packet into an outbound packet in which a destination address of an IP header of the outbound packet does not indicate the packet classifier/forwarding microblock, using received packet information, determining whether IPSec processing should be performed on the inbound packet and the outbound packet, and performing packet forwarding on a packet not requiring the IPSec processing; an outbound IPSec processing microblock performing IPSec processing on an outbound packet requiring IPSec processing according to packet information received from the packet classifier/forwarding microblock; an inbound IPSec processing microblock performing IPSec processing on an inbound packet requiring IPSec processing according to the packet information received from the packet classifier/forwarding microblock; and an IPSec forwarding microblock receiving packet information of a packet subjected to IPSec processing from the outbound IPSec processing microblock and/or the inbound IPSec processing microblock, and performing forwarding on the corresponding packet, wherein the performed packet forwarding on the packet not requiring the IPSec processing comprises: storing the packet in a first DRAM and transmitting the packet from the first DRAM without influencing the packet's processing speed and without having to identify whether the packet requires IPSec processing for the performed forwarding on the corresponding packet; and wherein the packet classifier/forwarding microblock comprises a microengine that: receives the packet information from the packet receiving microblock, and if the packet information indicates an inbound packet, a protocol of an IP header corresponds to ESP or AH, and the inbound packet requires IPSec processing, transmits the packet information of the inbound packet to the inbound IPSec processing microblock, if the packet information indicates an outbound packet and the outbound packet requires IPSec processing, transmit the packet information of the outbound packet to the outbound IPSec processing microblock, if the packet information indicates the inbound packet and the protocol of the IP header corresponds to neither ESP nor AH, performs packet forwarding on the inbound packet and adds an Ethernet header to the inbound packet subjected to the packet forwarding, if the packet information indicates the outbound packet and the outbound packet does not require IPSec processing, performs packet forwarding on the outbound packet, adds an Ethernet header to the outbound packet subjected to the packet forwarding, and transmits the packet information of the outbound packet to the packet queue management microblock, wherein the outbound IPSec processing microblock and the inbound IPSec processing microblock each fetch information required for the IPSec processing from a Security Association (SA) table stored in an SRAM of the IXDP2851, and each use an encryrtion engine of the IXP2850 network processor as an encryrtion algorithm for the packet.