Patent ID: 8396985

Claim:
A method of preventing replay attacks on a network processor coupled to a packet-switched network, the method comprising: initializing an anti-replay window for recording sequence numbers of received data packets; storing the anti-replay window in a security memory having R data words, wherein the anti-replay window has N bits, and wherein each of the R data words has a width W bits, where R, W and N are positive integers, and R*W=N; receiving a data packet having a sequence number appended to the data packet; determining whether the received sequence number is within a range of the anti-replay window, wherein the range of the anti-replay window is determined by a maximum sequence number of the anti-replay window and a minimum sequence number of the anti-replay window; i) if the received sequence number is within the range of the anti-replay window: determining, based on a value of the anti-replay window corresponding to the received sequence number, whether the received sequence number corresponds to a replayed data packet; if the received sequence number is not of a replayed data packet, updating the value of the anti-replay window corresponding to the received sequence number to indicate receipt of the sequence number; setting a word valid bit corresponding to a data word including the updated value to indicate that the data word includes valid data; and providing the data packet for further processing by the network processor; otherwise, discarding the received data packet as a replayed data packet; ii) if the received sequence number is greater than the maximum sequence number of the anti-replay window range: shifting the anti-replay window by the received sequence number adjusted for a length of the anti-replay window by setting the word valid bits corresponding to the first X data words of the anti-replay window equal to zero, to indicate that the data word is invalid, wherein X equals the quotient of the received sequence number minus N, the difference divided by W; updating the bit of the anti-replay window corresponding to the received sequence number to indicate that the sequence number is received; setting the word valid bit corresponding to the data word including the updated bit to indicate that the data word includes valid data; and providing the data packet for further processing by the network processor; wherein the step of updating the bit corresponding to the received sequence number comprises writing a bit mask to the anti-replay data window, wherein the bit corresponding to the received sequence number is equal to the received sequence number minus N, and wherein each bit of the bitmask is zero except for the bit corresponding to the received sequence number, and wherein the steps of i) shifting the anti-replay window, ii) updating the bit corresponding to the received sequence number, and iii) setting the word valid bits are performed in a single clock cycle of the network processor, and the bitmask is written to the anti-replay memory in a single write access of the anti-replay memory.