IPsec processing of packets in SoCs

US11722525B2 · kind B2 · utility

Assignee

• Cisco Technology, Inc. · US

Inventors

• Shuxian Lou · San Jose, US
• Jie Chu · Los Altos, US
• Jonathan Rosen · Chapel Hill, US
• Douglas Michael Toney · Raleigh, US
• Harikrishnan Pillai · Thrissur, IN
• Feng Cao · Shanghai, CN

Key dates

• Filing date: Apr 14, 2021
• Grant date: Aug 8, 2023
• Expiry date: Aug 17, 2041

Classification

• Technology area (CPC G): Physics
• CPC primary: G06F16/2455
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

Techniques and mechanisms for IPsec processing of IPsec packets for routing platforms where IPsec is just one or more features in the middle of data path features on the packet processing path and hence, the typical, simple inline IPsec scheme does not work well for such platforms. The techniques include using a hardware look-up table for packet classification and inbound security association (SA) lookup in one pass with IP 5-tuple plus SPI as a lookup key at hardware table. The techniques provide an entry match action format and mechanism for deriving inbound SA dram addresses that may be used by a hardware (HW)/firmware (FW) crypto/IPsec engine to process inbound packet traffic. A software SA look-up table is also provided to overcome hardware look-up table resource limitations and support more IPsec session scaling than the physical hardware look-up table can handle. Additional techniques are described.