Patent ID: 8438641

Claim:
A method of preventing replay attacks on a network processor coupled to a packet-switched network, the method comprising: extracting, by a security processor of the network processor, a current sequence number of a data packet; retrieving, to a memory of the security processor a wrapping anti-replay window corresponding to the data packet, wherein the wrapping anti-replay window comprises a range of sequence numbers and the range of sequence numbers comprises a first minimum sequence number having a position adjacent to a first maximum sequence number, wherein the wrapping anti-replay window comprises N bits, wherein the memory comprises R data words, each data word having a width W, wherein R*W=N, and wherein N, R, and W are positive integers: determining, by the security processor, a pointer based on the current sequence number, wherein the pointer identifies a bit in the wrapping anti-replay window corresponding to the current sequence number; classifying, by the security processor, the current sequence number depending on a relative position of the current sequence number to the range of sequence numbers; storing, by the security processor, the classification in a data register; reading, the security processor the classification from the data register, if the classification indicates that the current sequence number is greater than the first maximum sequence number: shifting the wrapping anti-replay window; and accepting the data packet as a valid packet; wherein the security processor is implemented as a hardware accelerator of the network processor, and wherein the steps of (i) shifting the anti-replay window and (ii) accepting the data packet as a valid packet are performed in a single clock cycle of the security processor.