Transparent IPSec processing inline between a framer and a network component
View Patent ↗A method and apparatus for transparent processing of IPsec network traffic by a security processor in line between a framer and a network processor. Security processor parses packet header and tail information to determine if encryption or decryption is required. After encryption or decryption is completed packet header and tail information is modified to reflect the changes in the packet such as length of the packet. The modified packet is then passed on to the network processor or framer.
1. An apparatus comprising:
a security processor to be inline between a framer and a network processor, the security processor to intercept data traffic between the framer and network processor and to process an IPsec protocol layer in the data traffic transparent to the framer or network processor without terminating any other protocol layer in the data traffic and to identify IPsec frames within the data traffic to process.
2. The apparatus of claim 1 , wherein the security processor decrypts an IPsec protocol layer.
3. The apparatus of claim 1 , wherein the security processor creates an encrypted IPSEC protocol layer.
4. An apparatus comprising:
a first circuit to determine a protocol type of a packet;
at least one execution unit coupled to the first circuit, the at least one execution unit to decrypt an encrypted protocol layer of the packet;
a second circuit to correct protocol layer data after decryption to reflect changes to the packet caused by the decryption; and
a third circuit coupled to second circuit to communicate with a framer.
5. The apparatus of claim 4 , further comprising:
a fourth circuit coupled to the first circuit to determine whether a packet contains an encrypted protocol layer.
6. The apparatus of claim 4 , wherein the first circuit parses the packet to determine at least one level two protocol type.
7. The apparatus of claim 4 , wherein the first circuit parses the packet to determine at least one level three protocol type.
8. The apparatus of claim 4 , wherein the third circuit receives the packet from the framer.
9. The apparatus of claim 4 , wherein the third circuit transmits the packet from the framer.
10. The apparatus of claim 4 , further comprising:
a fourth circuit coupled to the second circuit to communicate with a network processor.
11. The apparatus of claim 4 , wherein the second circuit alters length data in a protocol layer.
12. The apparatus of claim 4 , further comprising:
a fifth circuit coupled to the at least one execution unit to retrieve a security association context from a memory device.
13. A method comprising:
receiving a packet;
parsing the packet to determine the level two protocol information in the packet;
processing an IPsec protocol layer of the packet;
altering the packet to correct header information to reflect the processing of the IPsec protocol; and
sending the packet to a framer device.
14. The method of claim 13 , wherein the processing of the IPsec protocol layer includes decrypting the IPsec protocol layer.
15. The method of claim 13 , wherein the processing of the IPsec protocol layer includes encrypting the IPsec protocol layer.
16. An apparatus comprising:
means for receiving a packet;
means for parsing the packet to determine the level two protocol information in the packet;
means for processing an IPsec protocol layer of the packet;
means for correcting protocol layer information after processing the IPsec protocol layer to reflect changes based on the processing; and
means for sending a packet to a framer device.
17. The method of claim 16 , further comprising:
means for retrieving a security association context from a memory device.
18. The method of claim 16 , wherein the means for correcting protocol layer information include creating level two protocol information for the packet from parsed information and information modified after processing of the IPsec protocol layer.
19. A system comprising:
a framer device;
a network processor; and
a security processor couple between the framer device and the network processor, the security processor to process an IPsec protocol layer transparent to the network device and framer without terminating any other protocol layer and to adjust header data to reflect IPsec processing.
20. The system of claim 19 , further comprising:
a memory device to store security association context data, the memory device coupled to the security processor.
21. The system of claim 19 , wherein the security processor decrypts the IPsec protocol layer.
22. A machine-readable medium that provides instructions, which when executed by a machine cause the machine to perform operations comprising:
processing a packet received from a framer device by a security processor coupled to the framer to determine a type of protocol layers including identifying an IPsec protocol layer in the packet;
processing the packet to decrypt the IPsec protocol layer;
modifying the packet to generate a modified packet including a decrypted IP protocol layer and protocol layer information based on the decrypted IP protocol layer and
sending the modified packet from the security processor to a network processor.
23. The machine-readable medium of claim 22 , wherein the modifying the packet includes generating level two protocol layer information with a length including the size of the decrypted IP protocol layer.
24. The machine-readable medium of claim 22 , further comprising:
generating a CRC field for a modified packet including a decrypted IP protocol layer.