Data path security processing
View Patent ↗Methods and associated systems provide secured data transmission over a data network. A security device provides security processing in the data path of a packet network. The device may include at least one network interface to send packets to and receive packets from a data network and at least one cryptographic engine for performing encryption, decryption and/or authentication operations. The device may be configured as an in-line security processor that processes packets that pass through the device as the packets are routed to/from the data network.
1. A security processing method comprising:
receiving, at a host-side interface of a security processor, an in-band packet from a device, wherein the in-band packet includes an internal security header encapsulating an original packet;
cryptographically processing, at the security processor, at least a portion of the received original packet in the in-band packet using data from the internal security header;
generating, at the secure processor, an outbound packet including the cryptographically processed portion of the original packet; and
transmitting, via a line-side interface of the security processor, the outbound packet to a data communications network.
2. The security processing method of claim 1 , wherein the outbound packet includes an outbound security header and an outbound security trailer.
3. The security processing method of claim 2 , wherein the outbound security header is an IPsec header and the outbound security trailer is an IPsec trailer.
4. The security processing method of claim 3 , wherein a size of a data payload of the original packet is modified by the first device to account for a size of the IPsec header and a size of the IPsec trailer in the outbound packet.
5. The security processing method of claim 2 , wherein the in-band packet includes a placeholder for the outbound security header and a placeholder for the outbound security trailer.
6. The security processing method of claim 1 , wherein the internal security header includes an index to a security association.
7. The security processing method of claim 6 , wherein the index is a flow identifier.
8. The security processing method of claim 6 , wherein processing, at the security processor, further comprises:
retrieving the security association using the index; and
cryptographically processing the at least a portion of the received outbound packet using the security association.
9. The security processing method of claim 1 , further comprising:
receiving, at the host-side interface of the security processor, a second in-band packet from a second device, wherein the second packet includes a second internal security header encapsulating a second original packet;
processing, at the security processor, at least a portion of the received second original packet in the second in-band packet using data from the second internal security header;
generating, at the security processor, a second outbound packet including the cryptographically processed portion of the second outbound packet; and
transmitting, via the line-side interface of the security processor, the second outbound packet to the data communications network.
10. The security processing method of claim 1 , wherein the original packet is a TCP/IP packet.
11. The security processing method of claim 1 , further comprising:
receiving, at the line-side interface of the security processor, a inbound packet from the data communications network, wherein the inbound packet includes a security header;
stripping the security header;
processing, at the security processor, at least a portion of the received packet according to data in the security header;
assembling a second in-band packet, wherein the second in-band packet includes a header and a data payload; and
transmitting the in-band packet via the host-side interface of the security processor to the first device.
12. The security processing method of claim 11 , further comprising:
determining whether the received inbound packet is part of a flow assigned to the security processor; and
processing at least a portion of the received packet according to data in the security header if the received inbound packet is part of a flow assigned to the security processor.
13. The security processing method of claim 1 , wherein the security processor and the device are in a trusted network.
14. A security processor comprising:
a first controller configured to receive at a host-side interface of the security processor an in-band packet from a device, wherein the in-band packet includes an internal security header encapsulating an original packet;
a cryptographic processor configured to cryptographically process at least a portion of the received original packet in the in-band packet using data from the internal security header; and
a second controller configured to generate an outbound packet including the cryptographically processed portion of the original packet and transmit via a line-side interface of the security processor, the outbound packet to a data communications network.
15. The security processor of claim 14 , wherein the internal security header includes an index to a security association.
16. The security processor of claim 15 , wherein the index is a flow identifier.
17. The security processor of claim 15 , further comprising:
a header processor configured to retrieve security association information using the index.
18. The security processor of claim 17 , wherein the header processor is further configured to determine whether the header includes an address of the security processor and to retrieve security association information associated with the in-band packet if the address of the security processor is included in the in-band packet.
19. The security processor of claim 14 , wherein the original packet is a TCP/IP packet.