US6708218B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
IpSec performance enhancement using a hardware-based parallel process
Assignee: Cavium International
•
Filing: 2000-06-05
•
Granted: 2004-03-16
•
Expires: 2020-06-05
Abstract
Abstract A hardware function performed in the data link control layer first determines if a received frame is an IP frame requiring IPSec processing, and if it is, places the IPSec frame on a separate receive queue for subsequent inbound processing. The hardware function further determines if a frame to be transmitted is an IP frame requiring IPSec outbound processing, and if it is, places the IPSec frame on a separate transmit queue for subsequent outbound processing. To determine if an IP frame is an IPSec frame, the hardware function examines both the type field in the Medium Access Control (MAC) header and the protocol field in the IP header, both at the data link control layer. Once IPSec and non-IPSec traffic are separated at the data link layer into different receive or transmit queues, a hardware assist component processes the IPSec data frames in parallel with the processing of non-IPSec data frames by the processor in the network device. The hardware assist component performs the IPSec functions of encryption and decryption, security association management, and key exchange.
Inventors
- 👤 William Woollcott Ellington, Jr.
- 👤 Charles Steven Lingafelt
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-06 14:20
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0272; H04L63/04; H04L63/0428; H04L63/0485; H04L63/10; H04L63/16; H04L63/164; H04L9/00; H04L9/40; H04L69/00; H04L69/22
Claims Analysis
Total Claims: 40
Claim 1
Independent Claim
112 words
A system for enhancing the performance of a network device in a communications network wherein the network device processes a plurality of data frame traffic of various types, comprising: a network interface card including a data link layer component that determines if a data frame has a security extension associated with it and places each data frame with an associated security extension on a separate processing queue; a hardware assist component that processes each data frame with a security extension on the separate processing queue; and a processor component that processes each data frame not having a security extension in parallel with the processing that is performed by the hardware assist component.
Claim 2
Independent Claim
112 words
A system for enhancing the performance of a network device in a communications network wherein the network device processes a plurality of data frame traffic of various types, comprising: a network interface card including a data link layer component that determines if a data frame has a security extension associated with it and places each data frame with an associated security extension on a separate processing queue; a hardware assist component that processes each data frame with a security extension on the separate processing queue; and a processor component that processes each data frame not having a security extension in parallel with the processing that is performed by the hardware assist component.
Claim 3
Dependent Claim
72 words
The system for enhancing the performance of a network device in a communications network of claim 1 further comprising: a higher priority frame processing receive queue for placing incoming data frames without a security extension for normal data frame processing by the processor component; and a lower priority frame processing receive queue for placing incoming data frames with a security extension for preprocessing of the security extension by the hardware assist component.
Claim 4
Dependent Claim
72 words
The system for enhancing the performance of a network device in a communications network of claim 1 further comprising: a higher priority frame processing transmit queue for placing outbound data frames without a security extension for normal data frame processing by the processor component; and a lower priority frame processing transmit queue for placing outbound data frames with a security extension for postprocessing of the security extension by the hardware assist component.
Claim 5
Dependent Claim
85 words
The system for enhancing the performance of a network device in a communications network of claim 1 wherein the data link layer component further comprises a logic component that evaluates whether the data frame has the security extension by first evaluating a Media Access Control (MAC) address of the data frame to determine if the data frame has an Internet Protocol (IP) header, and then evaluates the data frame's IP header to determine if the data frame has a security extension for the data frame.
Claim 6
Dependent Claim
31 words
The system for enhancing the performance of a network device in a communications network of claim 4 wherein the value in the type field in the MAC header is hexadecimal ‘0800’.
Claim 7
Dependent Claim
46 words
The system for enhancing the performance of a network device in a communications network of claim 5 wherein a value in a protocol field of the IP header is hexadecimal ‘50’ or ‘51’ represents an IP Security (IPSec) data frame in tunnel mode or transport mode.
Claim 8
Dependent Claim
32 words
The system for enhancing the performance of a network device in a communications network of claim 1 wherein the network interface card is a High Speed Token Ring or a Gigabit Token-Ring.
Claim 9
Dependent Claim
24 words
The system for enhancing the performance of a network device in a communications network of claim 1 wherein the data frames are Token-Ring frames.
Claim 10
Dependent Claim
42 words
The system for enhancing the performance of a network device in a communications network of claim 2 wherein the preprocessing of the security extension by the hardware assist component for the incoming data frames includes decapsulation and decryption of the data frames.
Claim 11
Dependent Claim
42 words
The system for enhancing the performance of a network device in a communications network of claim 3 wherein the postprocessing of the security extension by the hardware assist component for the outbound data frames includes encryption and encapsulation of the data frames.
Claim 12
Dependent Claim
41 words
The system for enhancing the performance of a network device in a communications network of claim 1 wherein the network device is any one of a server computer, a client computer, a router, a switch, a hub and a network processor.
Claim 13
Dependent Claim
33 words
The system for enhancing the performance of a network device in a communications network of claim 1 wherein the hardware assist component provides security association management for data frames having a security extension.
Claim 14
Dependent Claim
42 words
The system for enhancing the performance of a network device in a communications network of claim 1 wherein the hardware assist component performs a key exchange with another network device associate with an establishment of a security tunnel between the network devices.
Claim 15
Independent Claim
121 words
A method for enhancing the performance of a network device in a communications network wherein the network device processes a plurality of data frame traffic of various types, comprising the acts of: determining, by a data link layer component of network interface card, if a data frame has a security extension associated with it; placing each data frame with an associated security extension on a separate processing queue from, each data frame without a security extension; processing each data frame with a security extension on the separate processing queues by a hardware assist component; and processing each data frame not having a security extension by a processor component in parallel with the processing that is performed by the hardware assist component.
Claim 16
Independent Claim
121 words
A method for enhancing the performance of a network device in a communications network wherein the network device processes a plurality of data frame traffic of various types, comprising the acts of: determining, by a data link layer component of network interface card, if a data frame has a security extension associated with it; placing each data frame with an associated security extension on a separate processing queue from, each data frame without a security extension; processing each data frame with a security extension on the separate processing queues by a hardware assist component; and processing each data frame not having a security extension by a processor component in parallel with the processing that is performed by the hardware assist component.
Claim 17
Dependent Claim
75 words
The method for enhancing the performance of a network device in a communications network of claim 14 further comprising the acts of: placing incoming data frames without a security extension on a higher priority frame processing receive queue for normal data frame processing by the processor component; and placing incoming data frames with a security extension on a lower priority frame processing receive queue for preprocessing of the security extension by the hardware assist component.
Claim 18
Dependent Claim
73 words
The method for enhancing the performance of a network device in a communications network of claim 14 further comprising: placing outbound data frames without a security extension on a higher priority frame processing transmit queue for normal data frame processing by the processor component; and placing outbound data frames with a security extension on a lower priority frame processing queue transmit queue for postprocessing of the security extension by the hardware assist component.
Claim 19
Dependent Claim
88 words
The method for enhancing the performance of a network device in a communications network of claim 14 wherein the act of determining by the data link layer component further comprises determining whether the data frame has the security extension by first evaluating a Media Access Control (MAC) address of the data frame to determine if the data frame has an Internet Protocol ( 1 P) header, and then evaluating the data frame's IP header to determine if the data frame has a security extension for the data frame.
Claim 20
Dependent Claim
31 words
The method for enhancing the performance of a network device in a communications network of claim 17 wherein the value in the type field in the MAC header is hexadecimal ‘0800’.
Claim 21
Dependent Claim
46 words
The method for enhancing the performance of a network device in a communications network of claim 17 wherein a value in a protocol field of the IP header is hexadecimal ‘50’ or ‘51’ represents an IP Security (IPSec) data frame in tunnel mode or transport mode.
Claim 22
Dependent Claim
31 words
The method for enhancing the performance of a network device in a communications network of claim 14 wherein the network interface card is a High Speed Token-Ring or a Gigabit Token-Ring.
Claim 23
Dependent Claim
24 words
The method for enhancing the performance of a network device in a communication network of claim 14 wherein the data frames are Token-Ring frames.
Claim 24
Dependent Claim
42 words
The method for enhancing the performance of a network device in a communications network of claim 15 wherein the preprocessing of the security extension by the hardware assist component for the incoming data frames includes decapsulation and decryption of the data frames.
Claim 25
Dependent Claim
42 words
The method for enhancing the performance of a network device in a communications network of claim 16 wherein the postprocessing of the security extension by the hardware assist component for the outbound data frames includes encryption and encapsulation of the data frames.
Claim 26
Dependent Claim
41 words
The method for enhancing the performance of a network device in a communications network of claim 14 wherein the network device is any one of a server computer, a client computer, a router, a switch, a hub and a network processor.
Claim 27
Dependent Claim
35 words
The method for enhancing the performance of a network device in a communications network of claim 14 further comprising providing security association management by the hardware assist component for data frames having a security extension.
Claim 28
Dependent Claim
39 words
The method for enhancing the performance of a network device in a communications network of claim 14 further comprising performing a key exchange with another network device associated with an establishment of a security tunnel between the network devices.
Claim 29
Dependent Claim
118 words
A computer readable medium containing instructions for enhancing the performance of a network device in a communications network wherein the network device processes a plurality of data frame traffic of various types, by: determining, by a data link layer component of a network interface card, if a data frame has a security extension associated with it; placing each data frame with an associated security extension on a separate processing queue from each data frame without a security extension; processing each data frame with a security extension on a separate processing queue; and processing each data frame not having a security extension by a processor component in parallel with the processing that is performed by the hardware assist component.
Claim 30
Dependent Claim
118 words
A computer readable medium containing instructions for enhancing the performance of a network device in a communications network wherein the network device processes a plurality of data frame traffic of various types, by: determining, by a data link layer component of a network interface card, if a data frame has a security extension associated with it; placing each data frame with an associated security extension on a separate processing queue from each data frame without a security extension; processing each data frame with a security extension on a separate processing queue; and processing each data frame not having a security extension by a processor component in parallel with the processing that is performed by the hardware assist component.
Claim 31
Dependent Claim
67 words
The computer readable medium containing instructions for enhancing the performance of a network device in a communications network of claim 27 , by: placing incoming data frames without a security extension on a higher priority frame processing receive queue for normal data frame processing; and placing incoming data frames with a security extension for preprocessing of the security extension on a lower priority frame processing receive queue.
Claim 32
Dependent Claim
67 words
The computer readable medium containing instructions for enhancing the performance of a network device in a communications network of claim 27 , by: placing outbound data frames without a security extension on a higher priority frame processing transmit queue for normal data frame processing; and placing outbound data frames with a security extension for postprocessing of the security extension on a lower priority frame processing transmit queue.
Claim 33
Dependent Claim
79 words
The computer readable medium containing instructions for enhancing the performance of a network device in a communications network of claim 27 , by evaluating whether the data frame has the security extension by first evaluating a Media Access Control (MAC) address of the data frame to determine if the data frame has an Internet Protocol (IP) header, and then evaluating the data frame's IP header to determine if the data frame has a security extension for the data frame.
Claim 34
Dependent Claim
35 words
The computer readable medium containing instructions for enhancing the performance of a network device in a communications network of claim 30 wherein the value in the type field in the MAC header is hexadecimal ‘0800’.
Claim 35
Dependent Claim
50 words
The computer readable medium containing instructions for enhancing the performance of a network device in a communications network of claim wherein the value in the protocol field of the IP header is hexadecimal is ‘50’ or ‘51’ represents an IP Security (IPSec) data frame in tunnel mode or transport mode.
Claim 36
Dependent Claim
28 words
The computer readable medium containing instructions for enhancing the performance of a network device in a communications network of claim 27 wherein the data frames are Token-Ring frames.
Claim 37
Dependent Claim
41 words
The computer readable medium containing instructions for enhancing the performance of a network device in a communications network of claim 28 wherein the preprocessing of the security extension for the incoming data frames includes decapsulation and decryption of the data frames.
Claim 38
Dependent Claim
41 words
The computer readable medium containing instructions for enhancing the performance of a network device in a communications network of claim 29 wherein the postprocessing of the security extension for the outbound data frames includes encryption and encapsulation of the data frames.
Claim 39
Dependent Claim
32 words
The computer readable medium containing instructions for enhancing the performance of a network device in a communications network of claim 27 , by providing security association management by the hardware assist component.
Claim 40
Dependent Claim
43 words
The computer readable medium containing instructions for enhancing the performance of a network device in a communications network of claim 27 , by performing a key exchange with another network device associated with an establishment of a security tunnel between the network devices.
References Cited (Backward Citations)
US5655140A
Cited
US5691985A
Cited
US5796944A
Cited
US5758070A
Cited
US5706489A
Cited
US5898784A
Cited
US5889863A
Cited
US6449723B1
Cited
US5878229A
Cited
US20030014627A1
Cited
US6505192B1
Cited
US6327625B1
Cited
US6539483B1
Cited
US20010047487A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2007-03-16 | 2007-09-15 | 2008-03-16 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2011-03-16 | 2011-09-15 | 2012-03-16 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2015-03-16 | 2015-09-15 | 2016-03-16 | $7700.00 | Window Closed / Lapsed |