Packet-parallel high performance cryptography systems and methods

1. A cryptographic system, comprising:

a plurality of cryptographic sub-units, each of the sub-units being configured to perform a cryptographic operation on data blocks associated with a plurality of packets to form transformed blocks;

a scheduler configured to:

receive the packets,

associate a sequence number with each of the packets, the sequence number being a timestamp indicative of a worst-case completion time for packet reassembly, and

assign the packets to the sub-units; and

a reassembler configured to:

receive the transformed blocks from the sub-units,

reassemble the packets from the transformed blocks,

order the packets based on the associated sequence numbers, and

output the ordered packets, the outputting including to:

determine whether a particular packet of the ordered packets is marked as complete and the value of the timestamp associated with the particular packet is less than or equal to the current time; and

output the particular packet once the determination is satisfied;

wherein at least one of the plurality of cryptographic sub-units, the scheduler, and the reassembler is at least partially implemented using a hardware device.

2. The system of claim 1 , wherein the cryptographic operation includes one of an encryption operation and a decryption operation.

3. The system of claim 1 , wherein the reassembler is configured to:

receive one of the transformed blocks for one of the packets from the sub-unit,

determine whether the transformed block is a first data block in the packet, and

store the transformed block in an output queue based on the sequence number when the transformed block is the first data block in the packet.

4. The system of claim 3 , wherein the reassembler is further configured to:

determine whether the transformed block is also a last data block in the packet when the transformed block is the first data block in the packet, and

mark the packet as complete when the transformed block is the last data block in the packet.

5. The system of claim 3 , wherein the reassembler is further configured to:

determine whether the transformed block is a last data block in the packet when the transformed block is not the first data block in the packet, and

attach the transformed block to an end of the packet when the transformed block is not the last data block in the packet.

6. The system of claim 3 , wherein the reassembler is further configured to:

determine whether the transformed block is a last data block in the packet when the transformed block is not the first data block in the packet,

attach the transformed block to an end of the packet when the transformed block is the last data block in the packet, and

mark the packet as complete.

7. The system of claim 1 , wherein the scheduler is further configured to associate the timestamp with a first data block of the packet.

8. A cryptographic system, comprising:

means for receiving a plurality of packets, each of the packets including one or more data blocks;

means for associating a sequence number with each of the packets, each sequence number being a timestamp indicative of a worst-case completion time for packet reassembly;

means for assigning each of the packets to one of a plurality of cryptographic sub-units;

means for performing a cryptographic operation on the data blocks by the sub-units to form transformed blocks;

means for reassembling the packets from the transformed blocks;

means for ordering the packets based on the associated sequence numbers; and

means for outputting the packets according to the ordering, including:

means for determining whether a particular packet of the ordered packets is marked as complete and the value of the timestamp associated with the particular packet is less than or equal to the current time; and

means for outputting the particular packet once the determination is satisfied.

9. A cryptographic method, comprising:

receiving a plurality of packets, each of the packets including one or more data blocks;

associating a sequence number, as an associated sequence number, with each of the packets, each sequence number being a timestamp indicative of a worst-case completion time for packet reassembly;

assigning each of the packets to one of a plurality of cryptographic sub-units;

performing a cryptographic operation on the data blocks by the sub-units to form transformed blocks;

reassembling and ordering the packets from the transformed blocks and the associated sequence numbers;

outputting the packets according to the ordering, including:

determining whether a particular packet of the plurality of packets is marked as complete and the value of the timestamp associated with the particular packet is less than or equal to the current time; and

outputting the particular packet once the determination is satisfied.

10. The method of claim 9 , wherein the performing a cryptographic operation includes:

performing one of an encryption operation and a decryption operation.

11. The method of claim 9 , wherein the outputting the packets includes:

outputting the packets in a single packet stream.

12. The method of claim 9 , wherein the reassembling and ordering the packets includes:

receiving one of the transformed blocks for one of the packets,

determining whether the transformed block is a first data block in the packet, and

storing the transformed block in an output queue based on the sequence number when the transformed block is the first data block in the packet.

13. The method of claim 12 , wherein the reassembling and ordering the packets further includes:

determining whether the transformed block is also a last data block in the packet when the transformed block is the first data block in the packet, and

marking the packet as complete when the transformed block is the last data block in the packet.

14. The method of claim 12 , wherein the reassembling and ordering the packets further includes:

determining whether the transformed block is a last data block in the packet when the transformed block is not the first data block in the packet, and

attaching the transformed block to an end of the packet when the transformed block is not the last data block in the packet.

15. The method of claim 12 , wherein the reassembling and ordering the packets further includes:

determining whether the transformed block is a last data block in the packet when the transformed block is not the first data block in the packet,

attaching the transformed block to an end of the packet when the transformed block is the last data block in the packet, and

marking the packet as complete.

16. The method of claim 9 , further comprising associating the timestamp with a first data block of the packet.