Patent ID: 7389357

Claim:
A method in a router having at least one outbound interface, the method comprising: establishing, on the outbound interface, a plurality of Internet Protocol (IP)-based secure connections with respective destinations based on receiving encrypted packets generated by a cryptographic module, each encrypted packet successively output from the cryptographic module having a corresponding successively-unique sequence number; controlling supply of unencrypted data packets to the cryptographic module by: (1) assigning, for each secure connection, a corresponding queuing module, (2) reordering, in each queuing module, a corresponding group of the unencrypted data packets associated with the corresponding secure connection according to a determined quality of service policy and based on a corresponding assigned maximum output bandwidth for the corresponding queuing module, and (3) outputting to the cryptographic module the group of unencrypted data packets, from each corresponding queuing module according to the corresponding assigned maximum output bandwidth, for generation of the encrypted packets; and second outputting the encrypted packets from the cryptographic module to the outbound interface for transport via their associated secure connections; wherein the reordering step includes, in each queuing module, reordering the corresponding group of the unencrypted data packets according to the determined quality of service policy in response to detection of a congestion condition in the outbound interface.