Data path security processing

1. A security processing method comprising:

receiving, by a security processor, an internal outbound packet from an Ethernet controller over a network, wherein the internal outbound packet includes a flow identifier for the internal outbound packet and security processor address data;

processing at least a portion of the received internal outbound packet if the security processor address data matches address information assigned to the security processor, wherein the processing includes:

using the flow identifier as a direct address handle to retrieve a security association for the received internal outbound packet,

performing a cryptographic operation on a portion of the received internal outbound packet using at least a portion of the retrieved security association, and

assembling an outbound network packet including a header and the cryptographically processed portion of the received internal outbound packet; and

transmitting, from the security processor, the outbound network to an external network.

2. The method of claim 1 wherein performing the cryptographic operation comprises performing one or more IPsec operations.

3. The method of claim 2 wherein the IPsec operations comprise adding or removing protocol elements.

4. The method of claim 1 wherein the security processor resides on a network interface card (NIC).

5. The method of claim 1 , further comprising:

entering a low power state upon receipt of a low-power configuration signal, wherein entering the low power state includes:

disabling an IPSec data path and a public key data path.

6. The method of claim 5 , further comprising:

receiving a second configuration signal indicating a release from low power state; and

enabling the IPSec data path and the public key data path.

7. The method of claim 1 , further comprising:

prior to receiving the internal outbound packet in a flow,

receiving security association information for the flow, the security association information including a security association handle and security association data.

8. The method of claim 7 , further comprising:

storing the security association information in a local memory associated with the security processor.

9. The method of claim 1 , wherein the security processor resides on a motherboard of a computer system.

10. A security processor comprising:

at least one media access controller (MAC); and

at least one processor configured to:

receive an internal outbound packet from an Ethernet controller via the at least one MAC, wherein the internal outbound packet includes a flow identifier for the internal outbound packet and security processor address data,

process at least a portion of the received internal outbound packet if the security processor address data matches address information assigned to the security processor, including:

using the flow identifier as a direct address handle to retrieve a security association for the received internal outbound packet,

performing a cryptographic operation on a portion of the received internal outbound packet using at least a portion of the retrieved security association, and

assembling an outbound network packet including a header and the cryptographically processed portion of the received internal outbound packet; and

transmitting the outbound network packet from the security processor to an external network.

11. The security processor of claim 10 wherein the at least one processor comprises at least one IPsec processor.

12. The security processor of claim 11 wherein the IPsec processor is configured to add IPsec protocol elements to or to remove IPsec protocol elements from the internal outbound packet or the outbound network packet.

13. The security processor of claim 10 further comprising at least one data memory for storing security association information for use by the at least one processor, wherein the security association information includes a handle and security association data.

14. The security processor of claim 10 wherein the security processor resides on a network interface card (NIC).

15. The security processor of claim 10 , wherein the at least one processor is further configured to enter a low power state upon receipt of a low-power configuration signal and disable an IPSec data path and a public key data path.

16. The security processor of claim 15 , wherein the at least one processor is further configured to:

receive a second configuration signal indicating a release from low power state; and

enable the IPSec data path and the public key data path.

17. The security processor of claim 10 , wherein the at least one processor is further configured to receive security association information for the flow, the security association information including a security association handle and security association data.

18. The security processor of claim 17 , wherein the at least one processor is further configured to store the security association information in a local memory associated with the security processor.

19. The security processor of claim 10 , wherein the security processor resides on a motherboard of a computer system.

20. The security processor of claim 10 , wherein the security processor is in-line with a data path of a packet network.

21. An in-line security processor comprising:

a plurality of media access controllers (MACs); and

at least one processor configured to receive an internal outbound packet from an Ethernet controller via at least one of the plurality of MACs, wherein the internal outbound packet includes a flow identifier for the internal outbound packet and security processor address data,

process at least a portion of the received internal outbound packet if the security processor address data matches address information assigned to the security processor, including:

using the flow identifier as a direct address handle to retrieve a security association for the received internal outbound packet,

performing a cryptographic operation on a portion of the received internal outbound packet using at least a portion of the retrieved security association, and

assembling an outbound network packet including a header and the cryptographically processed portion of the received internal outbound packet; and

transmitting the outbound network packet from the in-line security processor to an external network.

22. The in-line security processor of claim 21 wherein the at least one processor comprises at least one IPsec processor.

23. The in-line security processor of claim 22 wherein the IPsec processor is configured to add IPsec protocol elements to or to remove IPsec protocol elements from the internal outbound packet or the outbound network packet.

24. The in-line security processor of claim 21 further comprising at least one data memory for storing security association information for use by the at least one processor.

25. A security processing system comprising:

at least one media access controller (MAC);

at least one security processor configured to:

receive an internal outbound packet from an Ethernet controller via at least one MAC, wherein the internal outbound packet includes a flow identifier for the internal outbound packet and security processor address data,

process at least a portion of the received internal outbound packet if the security processor address data matches address information assigned to the at least one security processor, including:

using the flow identifier as a direct address handle to retrieve a security association for the received internal outbound packet,

performing a cryptographic operation on a portion of the received internal outbound packet using at least a portion of the retrieved security association, and

assembling an outbound network packet including a header and the cryptographically processed portion of the received internal outbound packet; and

at least one switch between the at least one media access controller and the at least one security processor; and

transmitting the outbound network packet from the at least one security processor to an external network.

26. The security processing system of claim 25 wherein the at least one media access controller comprises at least one Gigabit MAC.

27. The security processing system of claim 25 wherein the at least one security processor is further configured to allocate memory space associated with the security association used by the at least one security processor.

28. The security processing system of claim 25 wherein the at least one switch associates VLAN tags with the at least one media access controller.

29. A chassis-based switch comprising:

at least one backplane;

at least one processing blade connected to the at least one backplane, the at least one processing blade comprising at least one media access controller; and

at least one switching blade connected to the at least one backplane, the at least one switching blade comprising:

at least one security processor configured to:

receive an internal outbound packet from an Ethernet controller, wherein the internal outbound packet includes a flow identifier for the internal outbound packet and security processor address data,

process at least a portion of the received internal outbound packet if the security processor address data matches address information assigned to the at least one security processor, including:

using the flow identifier as a direct address handle to retrieve a security association for the received internal outbound packet,

performing a cryptographic operation on a portion of the received internal outbound packet using at least a portion of the retrieved security association, and

assembling an outbound network packet including a header and the cryptographically processed portion of the received internal outbound packet; and

at least one packet switch between the at least one media access controller and the at least one security processor; and

transmitting the outbound network packet from the at least one security processor to an external network.

30. A security processing system comprising:

at least one Ethernet controller configured to:

receive a TCP/IP packet in a data flow and store context information associated with the TCP/IP packet;

identify flow identification information for the data flow including a flow identifier; and

generate an internal outbound packet including a security identifier header having the flow identifier, security processor address data, and at least a portion of the TCP/IP packet; and

at least one security processor configured to:

receive the internal outbound packet from the at least one Ethernet controller, wherein the internal outbound packet includes a flow identifier for the packet and security processor address data,

process at least a portion of the received internal outbound packet if the security processor address data matches address information assigned to the security processor, including:

using the flow identifier as a direct address handle to retrieve a security association for the received internal outbound packet,

performing a cryptographic operation on a portion of the received packet using at least a portion of the retrieved security association, and

assembling an outbound network packet including a header and the cryptographically processed portion of the received internal outbound packet; and

transmitting the outbound network packet from the at least one security processor to an external network.

31. The security processing system of claim 30 wherein the at least one security processor is further configured to modify at least one checksum in the security identifier header.

32. The security processing system of claim 30 wherein the at least one Ethernet controller modifies at least one maximum transmitted unit size in accordance with modifications the at least one security processor makes to at least a portion of the outbound network packets.

33. The security processing system of claim 30 wherein the at least one Ethernet controller reduces at least one TCP/IP payload size in accordance with at least one security header and trailer size added to at least a portion of the outbound network packets.

34. The security processing system of claim 30 wherein the at least one Ethernet controller securely communicates with the at least one security processor to configure the at least one security processor or retrieve status information from the at least one security processor.