Secure in-line network packet transmittal
A network processor provides for in-line encryption and decryption of received and transmitted packets. For packet transmittal, a processor core generates packet data for encryption and forwards an encryption instruction to a cryptographic unit. The cryptographic unit generates an encrypted packet, and enqueues a send descriptor to a network interface controller, which, in turn, constructs and transmits an outgoing packet. For received encrypted packets, the network interface controller communicates with the cryptographic unit to decrypt the packet prior to enqueuing work to the processor core, thereby providing the processor core with a decrypted packet.
1. A circuit, comprising:
a packet processor, implemented in a hardware processor, configured to request a work queue entry, generate a packet from data indicated by the work queue entry, and selectively generate an encryption instruction for the packet;
an encryption engine configured, in response to the encryption instruction, to 1) encrypt the packet to generate an encrypted packet independent of operation by the packet processor, and 2) forward the encrypted packet and a send descriptor; and
a network interface controller configured to construct an outgoing packet from the encrypted packet based on the send descriptor received from the encryption engine;
wherein the packet processor is further configured to forward a pointer to the send descriptor to the encryption engine; and
wherein the encryption engine is further configured to locate the send descriptor based on the pointer and forward the send descriptor to the network interface controller.
2. The circuit of claim 1 , wherein the packet processor is further configured to 1) generate a non-secure packet, the non-secure packet not requiring encryption, and 2) forward a send descriptor corresponding to the non-secure packet to the network interface controller.
3. The circuit of claim 1 , wherein the encryption engine is further configured to 1) encrypt a successive packet to generate a successive encrypted packet, and 2) forward the successive encrypted packet to the packet processor.
4. The circuit of claim 3 , wherein the packet processor is further configured to forward the successive encrypted packet and a corresponding send descriptor to the network interface controller.
5. The circuit of claim 1 , wherein the encryption engine is further configured to forward an error message to the packet processor in response to detecting an error during generation of the encrypted packet.
6. The circuit of claim 5 , wherein the encryption engine is further configured to generate a queue entry indicating a request to process the error.
7. The circuit of claim 1 , wherein the encryption engine is further configured to selectively forward the send descriptor to the network interface controller based on the status of a network interface controller queue.
8. The circuit of claim 7 , wherein the network interface controller is further configured to selectively forward a backpressure command to at least one of the packet processor and the encryption engine based on the status of the network interface controller queue.
9. The circuit of claim 1 , wherein the packet processor is further configured to selectively forward the encryption instruction to the encryption engine based on the status of an encryption engine queue.