Encapsulation mechanism for packet processing
Systems and methods are disclosed for processing data packets. Such a system may generate a header for a session and repeatedly use that header to generate packets for the session. Packets may be processed by a host processor and an associated security processor. When the security processor generates packets for the session it may prepend a header from the host processor onto packets, rather than independently generate the header.
1. A method of generating secure packets for a plurality of flows comprising:
for each flow, generating a flow header;
storing the plurality of flow headers in a memory;
receiving a plurality of data packets associated with a flow in the plurality of flows;
retrieving the flow header associated with the flow from the memory; and
for each data packet, combining the retrieved flow header with the data packet to generate a secure packet in the flow.
2. The method of claim 1 further comprising:
sending the plurality of generated flow headers to a security processor.
3. The method of claim 2 wherein the step of sending comprises:
sending a flow header and an associated flow identifier to the security processor.
4. The method of claim 3 further comprising the step of identifying, in the security processor, the flow associated with the received flow header.
5. The method of claim 1 wherein the generating step further comprises for each flow, generating a security association for the flow.
6. The method of claim 1 wherein the generating step comprises for each flow, generating the flow header for the flow when the flow is established.
7. The method of claim 1 further comprising:
encapsulating the retrieved flow header and data packet in the secure packet.
8. The method of claim 7 further comprising:
sending the secure packet including the encapsulated flow header and data packet over a packet network.
9. The method of claim 1 further comprising the step of processing the plurality of data packets, the processing step consisting of one of the group of authenticating, encrypting and decrypting.
10. The method of claim 1 further comprising the step of, following the combining step, adding data to at least one field in the retrieved flow header of the secure packet.
11. The method of claim 1 wherein the retrieving step comprises retrieving the flow header associated with the flow according to address information received with the data packets.
12. The method of claim 1 , further comprising:
performing security processing on the combined flow header and data packet.
13. The method of claim 12 , further comprising:
modifying a field in the flow header as a result of the security processing.
14. The method of claim 1 , further comprising:
performing IPsec processing on the combined flow header and data packet.
15. The method of claim 14 , further comprising:
appending an encapsulating security payload header to the processed combination of the flow header and data packet.
16. The method of claim 15 , further comprising:
appending an outer header to the processed combination of the flow header and data packet.
17. The method of claim 1 , further comprising:
after the generating step, generating a configuration packet including a generated flow header.
18. A method, in a secure processor, for generating secure packets for a plurality of flows comprising:
for each flow, receiving a flow header for the flow;
storing the plurality of flow headers in a memory;
receiving a plurality of data packets associated with a flow in the plurality of flows;
retrieving the flow header associated with the flow from the memory; and
for each data packet, combining the retrieved flow header with the data packet to generate a secure packet in the flow.
19. The method of claim 18 further comprising the step of processing the plurality of data packets, the processing step consisting of one of the group of authenticating, encrypting and decrypting.
20. The method of claim 18 further comprising the step of, following the combining step, adding data to at least one field in the retrieved flow header of the secure packet.
21. The method of claim 18 , further comprising:
performing security processing on the combined flow header and data packet.
22. The method of claim 21 , further comprising:
modifying a field in the flow header as a result of the security processing.
23. The method of claim 18 , further comprising:
performing IPsec processing on the combined flow header and data packet.
24. The method of claim 23 , further comprising:
appending an encapsulating security payload header to the processed combination of the flow header and data packet.
25. The method of claim 24 , further comprising:
appending an outer header to the processed combination of the flow header and data packet.
26. A packet processing system comprising:
a processor for generating a plurality of flow headers associated with a plurality of flows, wherein each flow has an associated flow header, and for communicating a plurality of data packets associated with a flow to a security processor; and
a memory for storing the plurality of flow headers;
wherein the security processor is configured to receive the data packets, retrieve the flow header associated with a flow from the memory, and combine, for each data packet, the flow header and the data packet to generate a secure packet in the flow.
27. The packet processing system of claim 26 wherein the processor includes a media access controller for transferring the plurality of flow headers and the data packets from the processor to the security processor.
28. The packet processing system of claim 26 , wherein the security processor comprises:
a policy lookup unit for retrieving security association data for data packets in a flow; and
a merge data unit for merging retrieved security association data for a flow with a data packet in the flow.
29. The packet processing system of claim 26 , wherein the security processor comprises:
an IPsec processor.