Patent ID: 7962741

Claim:
A network device for processing a data packet, the network device comprising: at least one network interface to: receive the data packet, the data packet requiring encryption-related processing, and forward the data packet; a forwarding module to: receive information regarding the data packet, identify security association information for the data packet, include the security association information with the information regarding the data packet, and forward the information regarding the data packet including the security association information; and an encryption services module, which is separate from the forwarding module, to: receive the information regarding the data packet including the security association information, and process the data packet in accordance with the security association information, where the encryption services module comprises a plurality of hardware-implemented logic engines corresponding to stages in a pipeline, where: a first one of the plurality of hardware-implemented logic engines is to at least one of add a field to the data packet or add padding to the data packet, a second one of the plurality of hardware-implemented logic engines is to receive the data packet from the first one of the plurality of hardware-implemented logic engines and rewrite a header of the data packet, a third one of the plurality of hardware-implemented logic engines is to receive the data packet from the second one of the plurality of hardware-implemented logic engines and remove at least one field from the data packet, a fourth one of the plurality of hardware-implemented logic engines is to receive the data packet from the third one of the plurality of hardware-implemented logic engines and at least one of encrypt or decrypt the data packet, and is to add, to the data packet, status information to be used by a down stream hardware-implemented logic engine to determine whether to accept or drop the data packet, a fifth one of the plurality of hardware-implemented logic engines is to receive the data packet after processing by the fourth hardware-implemented logic engine, and remove at least one field from the data packet, a sixth one of the plurality of hardware-implemented logic engines is to receive the data packet from the fifth one of the plurality of hardware-implemented logic engines and at least one of error check the data packet or perform anti-replay checking, and a seventh one of the plurality of hardware-implemented logic engines is to receive the data packet from the sixth one of the plurality of hardware-implemented logic engines and remove padding from the data packet.