Method and circuit to accelerate secure socket layer (SSL) process
View Patent ↗Methods and apparatus' for performing SSL processing on an IP packet being transmitted onto a network and being received from a network are described. The methods and apparatus' further described performing SSL processing inline which results in a reduced number of transfers over the system bus, reduced utilization of system memory, and a reduced utilization of the system CPU. An IP packet that requires SSL processing enters an acceleration device. SSL processing is performed at the acceleration device without first sending the IP packet to system memory for processing.
1. A computing system, comprising:
a central processing unit;
a host memory coupled to said central processing unit, said host memory storing instructions executed by said central processing unit and data operated upon by way of said central processing unit executing said instructions;
a network interface receiving inbound IP packets and sending outbound IP packets;
an offload processing subsystem, said offload processing subsystem communicatively coupled to said central processing unit and said network interface, said offload processing subsystem comprising:
a) TCP/IP logic circuitry processing TCP/IP tasks on said inbound and outbound IP packets without using said central processing unit and said host memory;
b) SSL decryption logic circuitry processing SSL tasks on said inbound IP packets without using said central processing unit and said host memory;
c) SSL encryption logic circuitry processing SSL tasks on said outbound IP packets without using said central processing unit and said host memory;
d) a storage resource comprising one or more memory chips coupled to both said SSL decryption logic circuitry and said SSL encryption logic circuitry, said storage resource storing SSL processing information;
e) an offload memory coupled to said TCP/IP logic circuitry, said offload memory storing said inbound and outbound TCP/IP packets, said network interface coupled to said offload memory;
f) a first direct memory access (DMA) controller retrieving said inbound IP packets from said offload memory, said first DMA controller coupled to said SSL decryption logic circuitry;
g) a second direct memory access (DMA) controller retrieving said outbound IP packets from said host memory, said second DMA controller coupled to said SSL encryption logic circuitry.
2. The computing system as in claim 1 wherein said inbound network interface comprises an Ethernet interface.
3. The computing system as in claim 1 comprising a first buffer downstream from an output of said first DMA controller and upstream from an input of said SSL decryption logic circuitry, and, a second buffer downstream from an output of said second DMA controller and upstream from an input of said SSL encryption logic circuitry.