Method and system for combined security protocol and packet filter offload and onload

1. A network interface card (NIC), comprising:

a security association database (SADB) comprising a plurality of security associations (SAs) configured to decrypt received packets and encrypt sent packets;

a cryptographic offload engine operatively connected to the SADB, configured to:

receive an encrypted packet from the network, wherein the encrypted packet comprises a first source address and a destination address,

decrypt the encrypted packet using one of the plurality of SAs to obtain a decrypted packet, and

send the decrypted packet to a policy engine;

a security policy database (SPD), operatively connected to the policy engine, comprising a plurality of security policies (SPs) configured to define access to packet destinations on a host and a plurality of firewall policies configured to determine access to the host, wherein the host is operatively connected to the NIC; and

a policy engine configured to:

receive the encrypted packet from the cryptographic offload engine,

determine a packet destination on the host using the destination address and one of the plurality of SPs from the SPD,

determine admittance of the decrypted packet to the host using one of the plurality of firewall policies,

modify the first source address to a second source address using the firewall policies to obtain a modified decrypted packet, and

send the modified decrypted packet to the destination address in the host.

2. The NIC of claim 1 , further comprising:

a transport protocol offload engine configured to apply transport protocol processing to the modified decrypted packet.

3. The NIC of claim 2 , wherein the transport protocol offload engine applies transmission control protocol (TCP) processing to the modified decrypted packet.

4. The NIC of claim 1 , wherein the SADB comprises a plurality of SADB partitions and wherein each of the SADB partitions comprises at least one of the plurality of SAs.

5. The NIC of claim 1 , wherein the SPD comprises a plurality of SPD partitions and wherein each of the SPD partitions comprises at least one of the plurality of SPs.

6. The NIC of claim 1 , wherein the SPD is associated with a filter utility on the host.

7. The NIC of claim 1 , wherein the SPD is associated with a destination policy database on the host.

8. A method for processing a packet, comprising:

receiving the packet in a network interface card (NIC), wherein the packet comprises a first source address and a destination address;

obtaining a security association (SA) from a security association database (SADB) on the NIC;

decrypting, by a cryptographic offload engine, the packet using the SA to obtain a decrypted packet;

obtaining a security policy (SP) from a security policy database (SPD) on the NIC;

determining a packet destination of the decrypted packet based on the SP;

obtaining a firewall policy from a filter database on the NIC;

determining admittance of the decrypted packet to a host using the firewall policy,

modifying the first source address to a second source address using the firewall policy to obtain a modified decrypted packet, and

sending the modified decrypted packet to the destination address on the host, wherein the modified decrypted packet is processed by the host.

9. The method of claim 8 , further comprising:

processing the modified decrypted packet using a transport protocol offload engine on the NIC prior to sending the modified decrypted packet to the host.

10. The method of claim 8 , wherein the SADB is associated with an internet key exchange (IKE) daemon on the host.

11. The method of claim 8 , wherein the SADB is associated with the cryptographic offload engine on the NIC.

12. The method of claim 8 , wherein the SPD is associated with a policy engine on the NIC.

13. The method of claim 8 , wherein the filter database is associated with a filter utility on the host.

14. The method of claim 8 , wherein the filter database is associated with a filter engine on the NIC.

15. A non-transitory computer readable storage medium comprising computer readable code that, when executed by a processor, is configured to perform a method, the method comprising:

receiving a packet in a network interface card (NIC), wherein the packet comprises a first source address and a destination address;

obtaining a security association (SA) from a security association database (SADB) on the NIC;

decrypting, by a cryptographic offload engine, the packet using the SA to obtain a decrypted packet;

obtaining a security policy (SP) from a security policy database (SPD) on the NIC;

determining a packet destination of the decrypted packet based on the SP;

obtaining a firewall policy from a filter database on the NIC;

determining admittance of the decrypted packet to a host using the firewall policy,

modifying the first source address to a second source address using the firewall policy to obtain a modified decrypted packet, and

sending the modified decrypted packet to the destination address on the host, wherein the modified decrypted packet is processed by the host.

16. The non-transitory computer readable storage medium of claim 15 , further comprising:

processing the modified decrypted packet using a transport protocol offload engine on the NIC prior to sending the modified decrypted packet to the host.

17. The non-transitory computer readable storage medium of claim 15 , wherein the SADB is associated with an internet key exchange (IKE) daemon on the host.

18. The non-transitory computer readable storage medium of claim 15 , wherein the SADB is associated with a cryptographic offload engine on the NIC.

19. The non-transitory computer readable storage medium of claim 15 , wherein the SPD is associated with a policy engine on the NIC.

20. The non-transitory computer readable storage medium of claim 15 , wherein the filter database is associated with a filter utility on the host.

21. The non-transitory computer readable storage medium of claim 15 , wherein the filter database is associated with a filter engine on the NIC.