Systems and methods for implementing host-based security in a computer network
View Patent ↗An architecture for implementing host-based security such that data security may be applied whenever the confidential data leaves a host computer or a networked device. The improved method and architecture may be implemented in a single integrated circuit for speed, power consumption, and space-utilization reasons. Within the integrated circuit, a combination of hardware-implemented, network processor-implemented, and software-implemented functions may be provided. The innovative host-based security architecture may offer line-rate IPSec acceleration, TCP acceleration, or both.
1. A method for providing end-to-end security for communication between a first networked device and a second networked device, comprising:
providing a first integrated circuit at said first networked device, said first integrated circuit including logic for substantially performing both TCP offloading and IPSec offloading on behalf of said first networked device;
providing a second integrated circuit at said second networked device, said second integrated circuit including logic for substantially performing both TCP offloading and IPSec offloading on behalf of said second networked device; and
routing said communication between said first networked device and said second networked device through said first integrated circuit and said second integrated circuit, thereby allowing said first integrated circuit and said second integrated circuit to perform substantial portions of both said TCP offloading and said IPSec offloading on behalf of said first networked device and said second networked device respectively,
wherein said communication pertains to a long-lived connection between said first networked device and said second networked device, said long-lived connection represents a connection that stays open between said first networked device and said second networked device even if no data transfer occurs and wherein said IPSec offloading comprises IPSec security association, said first integrated circuit performs said IPSec security association on behalf of said first networked device, and wherein said IPSec security association is bounded such that only one encryption/decryption ahgorithm would be required for packets associated with said communication between said first networked device and said second networked device.
2. The method of claim 1 wherein said communication pertains to block storage, wherein one or more data storage blocks in a network data storage device are accessed.
3. The method of claim 1 wherein said IPSec security association is bounded such that only one authentication algorithm would be required for packets associated with said communication between said first networked device and said second networked device.
4. The method of claim 1 wherein said IPSec security association is bounded such that only one encapsulation algorithm would be required for packets associated with said communication between said first networked device and said second networked device.
5. The method of claim 1 wherein said integrated circuit comprises at least one embedded processor, at least one network protocol processor, and hardware logic circuits.
6. The method of claim 5 wherein said network protocol processor is configured to perform a least one of IP Security encapsulation, IP Security decapsulation, and security association lookup on behalf of said first networked device.
7. The method of claim 1 wherein said first integrated circuit performs iSCSI command packaging.
8. The method of claim 1 wherein said first integrated circuit performs TCP encapsulation on behalf of said first network device.
9. The method of claim 1 wherein said first integrated circuit is configured to be capable of handling IKE (Internet Key Management) functions in both a first mode or a second mode, said first mode and said second mode being alternatives, said first mode involving handling said IKE functions within said first integrated circuit, said second mode involving delegating said IKE functions to a host processor of said first networked device, said host processor being external to said first integrated circuit.
10. Integrated circuit for providing end-to-end security for communication from a first networked device to a second networked device, said integrated circuit providing TCP offloading and an IPSec offloading on behalf of said first networked device, comprising:
a hardware logic portion for performing one of first TCP acceleration tasks and first security tasks;
a network protocol processor operatively coupled to said hardware logic portion to allow said communication to traverse along an in-line path through said hardware logic portion and said network protocol processor, said network protocol processor performing second TCP acceleration tasks and second security tasks; and
an embedded processor operatively coupled to said network protocol processor to allow said communication to traverse along an in-line path through said hardware logic portion, said network protocol processor, and said embedded processor, said embedded processor being configured to perform Internet Key Exchange (IKE) functions,
wherein said communication pertains to a long-lived connection between said first networked device and said second networked device, said long-lived connection represents a connection that stays open between said first networked device and said second networked device even if no data transfer occurs and wherein said IPSec offloading comprises IPSec security association, said first integrated circuit performs said IPSec security association on behalf of said first networked device, and said IPSec security association is bounded such that only one encryption/decryption ahzorithm would be required for packets associated with said communication between said first networked device and said second networked device.
11. The integrated circuit of claim 10 wherein said communication pertains to block storage, wherein one or more data storage blocks in a network data storage device are accessed.
12. The integrated circuit of claim 10 wherein said second security tasks include at least one of IP Security encapsulation, IP Security decapsulation, and security association lookup on behalf of said first networked device.
13. The integrated circuit of claim 10 wherein said TCP offloading includes packaging of iSCSI commands and data.
14. The integrated circuit of claim 10 wherein IKE (Internet Key Management) functions are configured to be handled in a first mode or a second mode by said integrated circuit, said first mode and said second mode being alternatives, said first mode involving handling said IKE functions within said integrated circuit, said second mode involving delegating said IKE functions to a host processor of said first networked device, said host processor being external to said integrated circuit.