Patent ID: 7017042

Claim:
An apparatus, comprising: an inbound IPSec packet processing path, comprising: i) inbound network interface logic circuitry to present an inbound IPSec packet to said inbound IPSec packet processing path after said inbound IPSec packet has been received at said apparatus; ii) inbound IPSec decryption logic circuitry to perform IPSec decryption processing on said inbound IPSec packet if said inbound IPSec packet warrants said IPSec decryption processing; iii) a first region of memory coupled to said inbound IPSec decryption logic circuitry, said first region of memory to store security policy information that indicates whether or not said inbound IPSec packet warrants said IPSec decryption processing; iv) a second region of memory coupled to said inbound IPSec decryption logic circuitry, said second region of memory to store IPSec security association information that indicates what said IPSec decryption processing entails; v) inbound DMA controller logic circuitry to place said inbound IPSec packet into an offload memory, said offload memory not being a memory where instructions and data evicted from said apparatus's Central Processing Unit's cache are initially stored; vi) a first inbound buffer coupled between said inbound network interface logic circuitry and said inbound IPSec decryption logic, said first buffer to hold said inbound IPSec packet before it is presented to said inbound IPSec decryption logic circuitry; vii) a second inbound buffer coupled between said inbound IPSec decryption logic circuitry and said inbound DMA controller, said second inbound buffer to present said inbound IPSec packet to said DMA controller; and, viii) a first path from said first inbound buffer to said second inbound buffer that flows through said IPSec decryption logic circuitry, a second path from said first inbound buffer to said second inbound buffer that does not flow through said IPSec decryption logic circuitry, said inbound IPSec packet to flow along said first path if said security policy information indicates that said inbound IPSec packet warrants said IPSec decryption processing, said inbound IPSec packet to flow along said second path if said security policy information indicates that said inbound IPSec packet does not warrant said IPSec decryption processing.