Anti-replay protection for network packet communications
Methods and systems are disclosed for anti-replay protection for network packet communications. A scorecard is stored that includes packet sequence numbers for received packets associated with a network packet flow. For each received packet, an anti-replay unit accesses the scorecard for an initial check to determine if the current packet represents a late packet and/or a replay packet. After further processing, the anti-replay unit accesses the scorecard for a final check to determine if the current packet represents a replay packet. For one embodiment, the initial check uses a first window of packet sequence numbers, and the final check uses a second window of packet sequence numbers that is larger than the first window. For further embodiments, multiple processing units operate in parallel to process received packets and to share the anti-replay unit, and each processing unit requests initial and final checks for received packets it processes.
1. A system for packet replay protection, comprising:
a memory configured to store a scorecard, the scorecard representing packet sequence numbers for received packets associated with a network packet flow; and
one or more programmable circuits including one or more processors or configurable logic devices programmed to provide an anti-replay unit to receive the received packets and for each received packet to:
access the scorecard for an initial check, wherein the initial check is performed prior to packet processing and during the initial check the programmable circuits are configured to
determine if a current packet represents a late packet, and
determine if the current packet represents a replay packet based upon a packet sequence number for the current packet; and
access the scorecard for a final check, wherein the final check is performed subsequent to the initial check and subsequent to packet processing and during the final check the programmable circuits are configured to
determine if the current packet represents a replay packet based upon the packet sequence number for the current packet, and
update the scorecard, wherein updating the scorecard is only performed during the final check;
wherein the initial check is based upon a first window of packet sequence numbers within the scorecard;
wherein the final check is based upon a second window of packet sequence numbers within the scorecard; and
wherein the second window is larger than and includes the first window.
2. The system of claim 1 , wherein the first window and the second window both comprise bits representing packet sequence numbers relative to a newest packet sequence number.
3. The system of claim 1 , wherein for the initial check, the current packet is identified as a late packet if the packet sequence number for the current packet is outside a range of packet sequence numbers represented within the first window, and wherein the current packet is identified as a replay packet if the packet sequence number for the current packet matches a packet sequence number represented within the first window.
4. The system of claim 1 , wherein for the final check, the current packet is identified as a replay packet if the packet sequence number for the current packet matches a packet sequence number represented within the second window, and wherein a determination is also made whether the packet sequence number for the current packet is outside a range of packet sequence numbers represented within the second window.
5. The system of claim 1 , further comprising a second set of one or more programmable circuits including one or more processors or configurable logic devices programmed to provide a second set of a plurality of processing units configured to process the received packets in parallel and to share the anti-replay unit, each processing unit being further configured to request the initial check and the final check from the anti-replay unit for each received packet it processes.
6. The system of claim 5 , wherein the second set of processing units are further configured to process the received packets in an order that they were received and to wait until a received packet clears its initial check before proceeding with an initial check for a next received packet.
7. The system of claim 5 , wherein the anti-replay unit is configured to update the scorecard after each received packet clears its final check.
8. The system of claim 5 , wherein the second set of processing units are configured to identify the packet sequence number for the current packet and to request the initial check based upon the packet sequence number prior to completing other security processing for the current packet.
9. The system of claim 8 , wherein the second set of processing units are configured to request the final check after completing the other security processing for the current packet.
10. A method for packet replay protection, comprising:
receiving packets associated with a network packet flow;
storing a scorecard, the scorecard representing packet sequence numbers for the received packets; and
for each received packet, performing an anti-replay check by:
accessing the scorecard for an initial check, wherein the initial check is performed prior to packet processing, the initial check determines if a current packet represents a late packet and also determines if the current packet represents a replay packet based upon a packet sequence number for the current packet; and
accessing the scorecard for a final check, wherein the final check is performed subsequent to the initial check and subsequent to packet processing, the final check determines if the current packet represents a replay packet based upon the packet sequence number for a current packet, and updates the scorecard, wherein updating the scorecard is only performed during the final check;
wherein the initial check is based upon a first window of packet sequence numbers within the scorecard;
wherein the final check is based upon a second window of packet sequence numbers within the scorecard; and
wherein the second window is larger than and includes the first window.
11. The method of claim 10 , wherein the first window and the second window both comprise bits representing packet sequence numbers relative to a newest packet sequence number.
12. The method of claim 10 , further comprising, for the initial check, identifying the current packet as a late packet if the packet sequence number for the current packet is outside a range of packet sequence numbers represented within the first window, and identifying the current packet as a replay packet if the packet sequence number for the current packet matches a packet sequence number represented within the first window.
13. The method of claim 10 , further comprising, for the final check, identifying the current packet as a replay packet if the packet sequence number for the current packet matches a packet sequence number represented within the second window, and also determining whether the packet sequence number for the current packet is outside a range of packet sequence numbers represented within the second window.
14. The method of claim 10 , further comprising operating one or more programmable circuits including one or more processors or configurable logic devices to provide a plurality of processing units, and using the plurality of processing units to process the received packets in parallel, each processing unit requesting the initial check and the final check for the anti-replay check for each received packet it processes.
15. The method of claim 14 , further comprising, with the plurality of processing units, processing the received packets in an order that they were received and waiting until a received packet clears its initial check before proceeding with an initial check for a next received packet.
16. The method of claim 14 , further comprising updating the scorecard after each received packet clears its final check.
17. The method of claim 14 , further comprising, with the plurality of processing units, identifying the packet sequence number for the current packet and requesting the initial check based upon the packet sequence number prior to completing other security processing for the current packet.
18. The method of claim 17 , further comprising, with the plurality of processing units, requesting the final check after completing the other security processing for the current packet.