Network interface with security association data prefetch for high speed offloaded security processing

1. A network interface system for interfacing a host system with a network to provide outgoing data from the host system to the network and to provide incoming data from the network to the host system, the network interface system comprising:

a bus interface system adapted to couple with a host bus in the host system and transfer data between the network interface system and the host system;

a media access control system adapted to couple with the network and to transfer data between the network interface system and the network;

a memory system coupled with the media access control system and the bus interface system, the memory system being adapted to store data frames received by the media access control system from the network and frames received by the bus interface system from the host; and

a security system coupled to the memory system and adapted to selectively decrypt individual data frames according to security associations stored in a memory external to the network interface system;

wherein the security associations correspond with the data frames and each security association is obtained by the network interface system from the external memory after beginning to receive but before fully receiving the corresponding data frame.

2. The network interface system of claim 1 , wherein the network interface system is adapted to fetch the security associations from the external memory before the corresponding data frames are completely stored in a first memory.

3. The network interface system of claim 1 , wherein the external memory is part of the host system.

4. The network interface system of claim 3 , wherein the network interface system is adapted to fetch the security associations from the external memory without interrupting the host processor.

5. The network interface system of claim 4 , wherein for individual frames, the network interface system determines a location in the external memory of a security association for that frame by consulting a table stored in a memory that is part of the network interface system.

6. The network interface system of claim 1 , further comprising:

a queue adapted to store a plurality of pointers to security associations in the external memory;

wherein the network interface system fetches the security associations from the external memory according to pointers in the queue.

7. The network interface system of claim 1 , wherein the network interface system fetches the security associations through the bus interface system.

8. The network interface system of claim 1 , further comprising:

a queue adapted to store a plurality of security associations;

wherein the network interface system fetches the security associations from the external memory and stores them in the queue; and

the security system reads the security associations from the queue.

9. The network interface system of claim 1 , wherein the bus interface system, the media access control system, the security system, and the memory system are included within a single integrated circuit.

10. The network interface system of claim 9 , wherein the security system comprises an IPsec system adapted to selectively provide authentication, encryption, and decryption functions for incoming and outgoing data.

11. The network interface system of claim 10 , wherein the security system is adapted to apply out one or more of the DES-CBC, the 3DES-CBC, and the AES-CBC encryption algorithms.

12. A network interface system for interfacing a host system with a network to provide outgoing data from the host system to the network and to provide incoming data from the network to the host system, the network interface system comprising:

a bus interface system adapted to couple with a host bus in the host system and transfer data between the network interface system and the host system;

a media access control system adapted to couple with the network and to transfer data between the network interface system and the network;

a memory system coupled with the media access control system and the bus interface system, the memory system being adapted to store data frames received by the media access control system from the network and frames received by the bus interface system from the host;

a security system coupled to the memory system and adapted to selectively decrypt individual data frames according to security associations stored in a random access memory; and

a queue coupled to the security system and adapted to store a plurality of security associations;

wherein the network interface system fetches the security associations from the random access memory and stores them in the queue;

wherein the security system reads the security associations from the queue in a predetermined order; and

wherein for each of the data frames, after beginning to receive the data frame, the network interface system fetches a corresponding security association, where one is available, from the random access memory and places it in the queue in a manner whereby the security association can arrive in the queue before the data frame is completely stored in the memory system.

13. The network interface of claim 12 , wherein the queue is a FIFO memory.

14. The network interface system of claim 12 , wherein the random access memory is part of the host system.

15. The network interface system of claim 14 , wherein the network interface system is adapted to fetch the security associations from the random access memory without interrupting the host processor.

16. The network interface system of claim 14 , wherein for individual frames, the network interface system determines a location in an external memory of corresponding security associations by consulting a table stored in a memory that is part of the network interface system.

17. The network interface system of claim 12 , further comprising:

a second queue adapted to store a plurality of pointers to security associations in the random access memory;

wherein the network interface system fetches the security associations from the random access memory according to pointers in the second queue.

18. The network interface system of claim 12 , wherein the network interface system fetches the security associations through the bus interface system.

19. The network interface system of claim 12 , wherein the bus interface system, the media access control system, the security system, the memory system, and the queue are included within a single integrated circuit.