Method for processing multiple security policies applied to a data packet structure
A method and system for processing packets allows consolidation of security processing. Security processing is performed in accordance with multiple security policies. This processing is done in a single front end processing block. Different security processes can be performed in parallel. Processing overhead is reduced by eliminating the need to redundantly check packet characteristics to assess the different security requirements imposed by security policies. Further, the present invention also substantially reduces the CPU cycles required to transport data back and forth from memory to a cryptographic coprocessor.
1. A method of processing a packet having a plurality of layers wherein a first layer is structured in accordance with a first protocol and a second layer is structured in accordance with a second protocol, comprising:
processing the first layer of the packet in accordance with the first protocol and a first security policy; and
processing the second layer of the packet in accordance with the second protocol and a second security policy at least partially in parallel with processing of the first layer of the packet when processing of the first layer of the packet uncovers sufficient information to support security processing of the second layer of the packet.
2. A method of processing a data packet having a plurality of layers according to a plurality of security policies, comprising the steps of:
(a) receiving the data packet;
(b) identifying a first security policy associated with a first layer of the data packet;
(c) processing the first layer of the data packet according to the first security policy;
(d) identifying a second security policy associated with a second layer of the data packet when information necessary for the identification of the second security policy becomes available during the processing of the first layer of the data packet; and
(e) processing the second layer of the data packet according to the second security policy, wherein processing the first layer of the data packet according to the first security policy occurs at least partially concurrently with the step of processing the second layer of the data packet according to the second security policy.
3. The method of claim 2 , wherein said step (c) comprises decryption of data in the packet.
4. The method of claim 3 , wherein said decryption is performed according to the data encryption standard (DES).
5. The method of claim 3 , wherein said decryption is performed according to the triple data encryption standard (3DES).
6. The method of claim 3 , wherein said decryption is performed according to the ARC4 algorithm.
7. The method of claim 3 , wherein said decryption is performed in application layer processing.
8. The method of claim 2 , wherein said step (e) comprises decryption of data in the packet.
9. The method of claim 8 , wherein said decryption is performed according to the DES.
10. The method of claim 8 , wherein said decryption is performed according to the 3DES.
11. The method of claim 8 , wherein said decryption is performed according to the ARC4 standard.
12. The method of claim 2 , wherein said step (e) comprises authentication of the data packet.
13. The method of claim 12 , wherein said authentication comprises application of the Multilinear Modular Hashing (MMH) algorithm.
14. The method of claim 12 , wherein said authentication comprises application of the Hash-based Message Authentication Code (HMAC) Secure Hash Algorithm (SHA)-1.
15. The method of claim 12 , wherein said authentication is performed in application layer processing.
16. The method of claim 2 , wherein said step (e) comprises re-encryption of decrypted data from the packet.
17. The method of claim 16 , wherein said re-encryption comprises encryption performed according to the Advanced Encryption Standard (AES).
18. A system for processing a data packet having a plurality of layers according to a plurality of security policies, wherein the data packet comprises a first and second layer, the first layer associated with a first security policy and the second layer associated with a second security, and wherein processes that effect respective security policies for the first and second layers of the data packet can execute in parallel, the system comprising:
a first security processing module configured to process the first layer of the data packet according to the first security policy; and
a second security processing module processing the second layer of the data packet according to the second security policy; and
wherein the first and second security processing modules process the first and second layers of the data packet at least partially in parallel.
19. The system of claim 18 , wherein the first security processing module comprises a module for performing decryption according to the DES.
20. The system of claim 18 , wherein the first security processing module comprises a module for performing decryption according to the 3DES.
21. The system of claim 18 , wherein the first security processing module comprises a module for performing Digital Video Broadcast (DVB) descrambling.
22. The system of claim 18 , wherein the first security processing module comprises a module for performing HMAC authentication.
23. The system as set forth in claim 18 , further comprising a packet identification (PID) parser that identifies the packet.
24. The system as set forth in claim 18 , further comprising at least one feedback loop or feeding output of at least one of said security processing modules to at least one other security processing module.