Apparatus and method for allocating resources within a security processing architecture using multiple queuing mechanisms
View Patent ↗An apparatus is described comprising: a plurality of security processing resources for processing two or more different types of data traffic within a cryptographic processor; a first scheduler to provide a first type of data traffic to a first predefined subset of the security processing resources using a first scheduling technique; and a second scheduler to provide a second type of data traffic to a second predefined subset of the security processing resources using a second scheduling technique.
1. An apparatus comprising:
a plurality of security processing resources within a cryptographic processor for processing two or more different types of data traffic;
a first scheduler to handle only a first type of data traffic and to provide the first type of data traffic to a first predefined subset of the security processing resources using a first scheduling technique; and
a second scheduler to handle only a second type of data traffic and to provide the second type of data traffic to a second predefined subset of the security processing resources using a second scheduling technique;
a first request queue for storing security processing requests to be processed by the first predefined subset of the security processing resources comprising execution cores, wherein the first scheduler reads the security processing requests from the first request queue and forwards the security processing requests to individual execution cores of the first predefined subset in a round robin manner, as the execution cores become available; and
a second request queue for storing security processing requests to be processed by the second predefined subset of the security processing resources comprising execution cores, wherein the second scheduler reads the security processing requests from the second request queue and forwards the security processing requests to one of a plurality of execution core queues in a round robin manner, as the execution cores associated with each of the execution core queues become available; wherein the first scheduler and the first request queue are implemented within the cryptographic processor and wherein the second scheduler and the second request queue are implemented within a memory external to the cryptographic processor.
2. The apparatus as in claim 1 wherein the plurality of security processing resources comprise a plurality of execution cores, each of the execution cores within the first subset capable of performing security processing operations on the first type of data traffic and each of the execution cores within the second subset capable of performing security processing operations on the second type of data traffic.
3. The apparatus as in claim 2 wherein the first type of data traffic comprises IP security (“IPSEC”) data traffic and wherein the second type of data traffic comprises secure sockets layer (“SSL”) data traffic.
4. The apparatus as in claim 1 wherein each individual execution core within the second subset is assigned its own execution core queue from which to receive security processing requests.
5. The apparatus as in claim 1 further comprising:
a monitor module to monitor load on the first predefined subset of the security processing resources resulting from the first type of data traffic and the second predefined subset of the security processing resources resulting from the second type of data traffic.
6. The apparatus as in claim 5 further comprising:
a resource allocation module to reallocate security processing resources from the first subset to the second subset in response to the monitor module detecting that the load on the second subset is above a specified threshold value.
7. The apparatus as in claim 6 wherein the resource allocation module reallocates security processing resources from the first subset to the second subset only if the load on the first subset is below a specified threshold value.
8. The apparatus as in claim 6 wherein the plurality of security processing resources comprise a plurality of execution cores, each of the execution cores within the first subset capable of performing security processing operations on the first type of data traffic and each of the execution cores within the second subset capable of performing security processing operations on the second type of data traffic,
wherein the allocation module loads new microcode on the execution cores reallocated from the first subset to the second subset, the microcode causing the execution cores within the second set to implement the second scheduling technique and/or the security processing operations on the second type of data.
9. The apparatus as in claim 2 wherein the first type of data traffic is associated with a first service level and the second type of data traffic is associated with a second service level.
10. The apparatus as in claim 1 further comprising a third scheduler to provide a third type of data traffic to a third predefined subset of the security processing resources using the second scheduling technique.
11. The apparatus as in claim 10 further comprising:
a monitor module to monitor load on the first predefined subset of the security processing resources resulting from the first type of data traffic, the second predefined subset of the security processing resources resulting from the second type of data traffic, and the third predefined subset of the security processing resources resulting from the third type of data traffic.
12. The apparatus as in claim 11 further comprising:
a resource allocation module to reallocate security processing resources from the second subset to the third subset in response to the monitor module detecting that the load on the third subset is above a specified threshold value.
13. The apparatus as in claim 12 wherein the resource allocation module reallocates security processing resources from the second subset to the third subset only if the load on the second subset is below a specified threshold value.
14. An apparatus comprising:
a plurality of security processing resources within a cryptographic processor for processing two or more different types of data traffic;
hardware-based scheduling logic embedded within the cryptographic processor to handle only a first type of data traffic and to schedule security operations for the first type of data traffic to a first subset of the plurality of security processing resources; and
software-based scheduling logic executed within a memory external to the cryptographic processor to handle only a second type of data traffic and to schedule security operations for the second type of data traffic to a second subset of the plurality of security processing resources;
wherein the hardware-based scheduling logic comprises: a first request queue for storing security processing requests for the first type of data traffic, and a first scheduler to read the security processing requests from the first request queue and forward the security processing requests to individual execution cores within the first subset in a round robin manner, as the execution cores become available;
wherein the software-based scheduling logic comprises: a software request processor (“SRP”) to forward security processing requests for the second type of data traffic to one of a plurality of execution core queues in a round robin manner, as execution cores of the second subset associated with each of the execution core queues become available.
15. The apparatus as in claim 14 wherein the plurality of security processing resources comprise a plurality of execution cores, each of the execution cores within the first subset capable of performing security processing operations on the first type of data traffic and each of the execution cores within the second subset capable of performing security processing operations on the second type of data traffic.
16. The apparatus as in claim 15 wherein the first type of data traffic comprises IP security (“IPSEC”) data traffic and wherein the second type of data traffic comprises secure sockets layer (“SSL”) data traffic.
17. The apparatus as in claim 15 wherein each individual execution core within the second subset is assigned its own execution core queue from which to receive security processing requests.
18. The apparatus as in claim 14 further comprising:
a monitor module to monitor load on the first subset of the security processing resources resulting from the first type of data traffic and the second subset of the security processing resources resulting from the second type of data traffic.
19. The apparatus as in claim 18 further comprising:
a resource allocation module to reallocate security processing resources from the first subset to the second subset in response to the monitor module detecting that the load on the second subset is above a specified threshold value.
20. The apparatus as in claim 19 wherein the resource allocation module reallocates security processing resources from the first subset to the second subset only if the load on the first subset is below a specified threshold value.
21. The apparatus as in claim 19 wherein the plurality of security processing resources comprise a plurality of execution cores, each of the execution cores within the first subset capable of performing security processing operations on the first type of data traffic and each of the execution cores within the second subset capable of performing security processing operations on the second type of data traffic,
wherein the allocation module loads new microcode on the execution cores reallocated from the first subset to the second subset, the microcode causing the execution cores within the second set to implement the second scheduling technique and/or the security processing operations on the second type of data.
22. The apparatus as in claim 14 wherein the first type of data traffic is associated with a first service level and the second type of data traffic is associated with a second service level.
23. An apparatus comprising:
a plurality of security processing resources within a cryptographic processor for processing two or more different types of data traffic;
first scheduling means for handling only a first type of data traffic and providing the first type of data traffic to a first subset of the security processing resources; and
second scheduling means for handling one or more additional types of data traffic and providing said one or more additional types of data traffic to a second predefined subset of the security processing resources using a second scheduling technique.
24. The apparatus as in claim 23 wherein the plurality of security processing resources comprise a plurality of execution cores, each of the execution cores within the first subset capable of performing security processing operations on the first type of data traffic and each of the execution cores within the second subset capable of performing security processing operations on the one or more additional types of data traffic.
25. The apparatus as in claim 23 further comprising:
monitoring means to monitor load on the first predefined subset of the security processing resources resulting from the first type of data traffic and the second predefined subset of the security processing resources resulting from one or more additional types of data traffic.
26. The apparatus as in claim 25 further comprising:
resource allocation means to reallocate security processing resources from the first subset to the second subset in response to the monitor module detecting that the load on the second subset is above a specified threshold value.
27. The apparatus as in claim 26 wherein the resource allocation module reallocates security processing resources from the first subset to the second subset only if the load on the first subset is below a specified threshold value.