An encryption/decryption device for secure communications between a protected network and an unprotected network, the encryption/decryption device comprising: a plaintext unit; a ciphertext unit; and a cryptographic unit connected between the plaintext unit and the ciphertext unit; the plaintext unit comprising a first logic device, i.e. LD, for interfacing with the protected network to perform encapsulation of data from the protectednetwork to define outgoing datagrams, and to perform decapsulation of incoming datagrams from the cryptographic unit; the ciphertext unit comprising a second LD for interfacing with the unprotected network to perform routing of incoming encrypted datagrams from the unprotected network to the cryptographic unit, and to perform routing of outgoing encrypted datagrams from the cryptographic unit to the unprotected network; the cryptographic unit adapted to perform encryption of outgoing datagrams from the plaintext unit, and to perform decryption of incoming encrypted datagrams from the ciphertext unit to define the incoming datagrams; characterized in that the first logic device of plaintext unit comprising: an egress directional component adapted to perform the encapsulation of data from the protected network to define the outgoing datagrams, said egress directional component comprising: a policy lookup and security association acquisition block comprising a security policy database and a cached subset of a security associations database, said policy lookup and security association acquisition block adapted to compare the characteristics of the outgoing datagram against security policies and security associations; and an ingress directional component adapted to perform the decapsulation of the incoming datagrams from the cryptographic unit, said ingress directional component further comprising: a policy verification anti-replay service block comprising a security policy database and a cached subset of the security association database; and said policy verification anti-replay service block adapted to compare the characteristics of the incoming datagram against security policies and security associations. a plaintext unit; a ciphertext unit; and a cryptographic unit connected between the plaintext unit and the ciphertext unit; the plaintext unit comprising a first logic device, i.e. LD, for interfacing with the protected network to perform encapsulation of data from the protectednetwork to define outgoing datagrams, and to perform decapsulation of incoming datagrams from the cryptographic unit; the ciphertext unit comprising a second LD for interfacing with the unprotected network to perform routing of incoming encrypted datagrams from the unprotected network to the cryptographic unit, and to perform routing of outgoing encrypted datagrams from the cryptographic unit to the unprotected network; the cryptographic unit adapted to perform encryption of outgoing datagrams from the plaintext unit, and to perform decryption of incoming encrypted datagrams from the ciphertext unit to define the incoming datagrams; characterized in that the first logic device of plaintext unit comprising: an egress directional component adapted to perform the encapsulation of data from the protected network to define the outgoing datagrams, said egress directional component comprising: a policy lookup and security association acquisition block comprising a security policy database and a cached subset of a security associations database, said policy lookup and security association acquisition block adapted to compare the characteristics of the outgoing datagram against security policies and security associations; and an egress directional component adapted to perform the encapsulation of data from the protected network to define the outgoing datagrams, said egress directional component comprising: a policy lookup and security association acquisition block comprising a security policy database and a cached subset of a security associations database, said policy lookup and security association acquisition block adapted to compare the characteristics of the outgoing datagram against security policies and security associations; and a policy lookup and security association acquisition block comprising a security policy database and a cached subset of a security associations database, said policy lookup and security association acquisition block adapted to compare the characteristics of the outgoing datagram against security policies and security associations; and an ingress directional component adapted to perform the decapsulation of the incoming datagrams from the cryptographic unit, said ingress directional component further comprising: a policy verification anti-replay service block comprising a security policy database and a cached subset of the security association database; and said policy verification anti-replay service block adapted to compare the characteristics of the incoming datagram against security policies and security associations. a policy verification anti-replay service block comprising a security policy database and a cached subset of the security association database; and said policy verification anti-replay service block adapted to compare the characteristics of the incoming datagram against security policies and security associations.