Granted Patent B2

US 7,337,314 · App. 10/411,945 · Granted Feb 26, 2008

Abstract

Claims (27)

1. A method comprising:

allocating a first plurality of security processing resources within a cryptographic processor to a first type of data traffic associated with a first type of security protocol and a first service level defined by a first level of guaranteed processing bandwidth;

allocating a second plurality of security processing resources within the cryptographic processor to a second type of data traffic associated with a second type of security protocol and a second service level defined by a second level of guaranteed processing bandwidth, wherein the second level of guaranteed processing bandwidth is different from the first level of guaranteed processing bandwidth, the first and second plurality of security processing resources comprise a plurality of cryptographic execution cores logically separated into first and second groups, respectively, and the first type of data traffic is data traffic requiring processing according to the first type of security protocol and wherein the second type of data traffic is data traffic requiring processing according to the second type of security protocol;

monitoring load on the first plurality of security processing resources and the second plurality of security processing resources as the first and second types of data traffic are processed; and

reallocating some of the first plurality of security processing resources from processing the first type of data traffic to processing the second type of data traffic if detected load on the second plurality of resources is above a specified threshold value, wherein said reallocating some of the first plurality of resources to the second plurality of resources comprises reallocating execution cores from the first group to the second group.

2. The method as in claim 1 wherein the first and second plurality of security processing resources comprises a plurality of queues logically separated into first and second groups, respectively.

3. The method as in claim 2 wherein reallocating some of the first plurality of resources to the second plurality of resources comprises:

reallocating queues from the first group to the second group.

4. The method as in claim 1 wherein monitoring load on the first plurality of security processing resources and the second plurality of security processing resources comprises:

measuring a relative amount of input or output memory space consumed by the first and second types of data traffic.

5. The method as in claim 1 wherein the first type of security protocol is the secure sockets layer (“SSL”) protocol and the second type of security protocol is the IP security (“IPSEC”) protocol.

6. A security processing apparatus comprising:

a cryptographic processor having a first plurality of security processing resources initially allocated to process a first type of data traffic associated with a first service level and according to a first type of security protocol and a second plurality of security processing resources initially allocated to process a second type of data traffic associated with a second service level and according to a second type of security protocol, wherein the first and second service levels are defined by different levels of guaranteed processing bandwidth, wherein the first and second plurality of security processing resources comprise a plurality of cryptographic execution cores logically separated into first and second groups, respectively;

a monitor module to monitor load on the first plurality of security processing resources and the second plurality of security processing resources as the first and second types of data traffic are processed; and

a resource allocation module to reallocate some of the first plurality of security processing resources from the first type of data traffic to the second type of data traffic if detected load on the second plurality of security processing resources is above a specified threshold value, wherein the resource allocation module reallocates execution cores from the first group to the second group in response to the detected load.

7. The security processing apparatus as in claim 6 wherein the first and second plurality of security processing resources comprises a plurality of queues logically separated into first and second groups, respectively.

8. The security processing apparatus as in claim 7 wherein the resource allocation module comprises a queue allocation module to reallocate queues from the first group to the second group in response to the detected load.

9. The security processing apparatus as in claim 6 wherein the monitor module detects load on the first plurality of security processing resources and the second plurality of security processing resources by measuring a relative amount of input or output memory space consumed by the first and second types of data traffic.

10. The security processing apparatus as in claim 6 wherein the first type of security protocol is the secure sockets layer (“SSL”) protocol and the second type of security protocol is the IP security (“IPSEC”) protocol.

11. A machine-readable medium having code stored thereon which defines an integrated circuit (IC), said IC comprising:

a cryptographic processor having a first plurality of security processing resources initially allocated to process a first type of data traffic associated with a first service level and a second plurality of security processing resources initially allocated to process a second type of data traffic associated with a second service level, wherein the first and second service levels are defined by different levels of guaranteed processing bandwidth, wherein the first and second plurality of security processing resources comprises a plurality of cryptographic execution cores logically separated into first and second groups, respectively, and wherein the first type of data traffic is data traffic requiring processing according to a first type of security protocol and wherein the second type of data traffic is data traffic requiring processing according to a second type of security protocol;

a monitor module to monitor load on the first plurality of security processing resources and the second plurality of security processing resources as the first and second types of data traffic are processed; and

a resource allocation module to reallocate some of the first plurality of security processing resources from the first type of data traffic to the second type of data traffic if detected load on the second plurality of security processing resources is above a specified threshold value, wherein the resource allocation module reallocates execution cores from the first group to the second group in response to the detected load.

12. The machine-readable medium as in claim 11 wherein the first and second plurality of security processing resources comprises a plurality of queues logically separated into first and second groups, respectively.

13. The machine-readable medium as in claim 12 wherein the resource allocation module comprises a queue allocation module to reallocate queues from the first group to the second group in response to the detected load.

14. The machine-readable medium as in claim 11 wherein the monitor module detects load on the first plurality of security processing resources and the second plurality of security processing resources by measuring a relative amount of input or output memory space consumed by the first and second types of data traffic.

15. The machine-readable medium as in claim 11 wherein the first type of security protocol is the secure sockets layer (“SSL”) protocol and the second type of security protocol is the IP security (“IPSEC”) protocol.

Assignments (8)