Patent ID: 8190877

Claim:
A cryptographic processor for redundantly-processing cryptographic operations, the cryptographic processor comprising: a first input port and a second input port, wherein at least one of the first or second input ports is configured to accept a first plaintext packet and a first ciphertext packet; a first output port and a second output port; a first cryptographic engine coupled to both the first and second input ports and configured to perform a first instance of an encryption process to produce a first ciphertext output by processing the first plaintext packet, and to perform a first instance of a decryption process to produce a first plaintext output by processing the first ciphertext packet; a second cryptographic engine coupled to both the first and second input ports and configured to perform a second instance of the encryption process to produce a second ciphertext output by processing the first plaintext packet, and to perform a second instance of the decryption process to produce a second plaintext output by processing the first ciphertext packet; a first arbitration logic and a second arbitration logic configured to redundantly open either the first input port or the second input port and to redundantly direct the first plaintext packet along a first one of a plurality of paths to be processed redundantly by the first and second cryptographic engines, and to redundantly direct the first ciphertext packet along a second one of the plurality of paths to be processed redundantly by the first and second cryptographic engines, the first one of the plurality of paths and the second one of the plurality of paths being different paths, wherein either the first input port or the second input port is only opened if the first arbitration logic and the second arbitration logic are in agreement as to which ort to open, and wherein the first arbitration logic and the second arbitration logic are configured to direct the first plaintext packet and the first ciphertext packet along the plurality of paths in a time multiplexed fashion such that only one of the first plaintext packet or the first ciphertext packet is directed to the first and second cryptographic engines at any one time; and comparison logic, wherein the comparison logic is configured to determine if the first and second ciphertext outputs match and to determine if the first and second plaintext outputs match, wherein at least one of the first or second output ports is configured to produce a second plaintext packet and a second ciphertext packet, wherein the first arbitration logic and the second arbitration logic are configured to redundantly ensure that only one of the first or second input ports is open at a time and that only one of the first or second output ports is open at a time, wherein after the second plaintext packet and the second ciphertext packet are produced, the first arbitration logic and the second arbitration logic are configured to close the first and second input ports and the first and second output ports.