Patent ID: 8191134

Claim:
A method for lockless Internet Protocol Security (IPsec) processing performed on a network element, comprising: receiving a plurality of IPsec packets each belonging to a single IPsec tunnel; distributing different ones of the plurality of IPsec packets to different ones of a plurality of processing cores of the network element for processing; and processing at least some of those IPsec packets in parallel and without taking a lock on a Security Association (SA) data structure storing a SA associated with each of the plurality of IPsec packets, wherein the processing includes: for each processing core that is processing one of the plurality of IPsec packets, atomically accessing the SA associated with that IPsec packet, wherein the atomically accessing the SA includes accessing a SA pointer structure, which stores a pointer to the SA, with an atomic read operation, atomically read a sequence map and a last sequence number for that IPsec packet, wherein if the sequence number of that IPSec packet is not within the range of the sequence map, the processing core to drop that IPSec packet, using values of the SA during processing of that IPsec packet, and atomically updating at least certain values of that SA.