Itt Manufacturing Enterprises, Inc.

Intel Corporation

Exelis Inc.

Corrent Corporation

Chad W Mercer

Lee Noehring

Steve J Brown

David Allan Schollmeyer

David K Cassetti

Aniruddha P Joshi

Satish N Anand

Larry H Gass

Michael Privett

Jenny M Wohletz

An apparatus and method for updating security association database entries in a system having multiple security channels by selectively granting access to the entries by a plurality of the multiple security channels that may need to update the same entry using a first-come, first-served scheme. The apparatus includes a controller circuit that functions to carry out the method which, for each of the multiple security channels, includes determining whether another of the security channels has a higher priority to access a particular security association database entry. If no other channel has a higher priority, then the channel requesting access to the entry retrieves it from its address location, modifies it, and writes the modified entry back to its address location. The controller prevents other channels from simultaneously, or substantially simultaneously, retrieving and modifying the same entry.

Apparatus and method for resolving security association database update coherency in high-speed systems having multiple security channels

A system and method for controlling a flow of data from a network interface controller (NIC) to a host processor coupled to the NIC. Data such as IP packets are received by the NIC and may be transmitted to the host processor for further processing such as firewall processing. The NIC is in communication with the host processor using, for example, a software driver running on the host processor. The NIC may monitor the processing load on the host processor as it handles packet data received from the NIC. As the processing load increases, the NIC may begin to throttle the quantity of packets being sent to the host processor in order to avoid overloading the host processor. The throttling may be governed by a heuristic throttling function.

System and method for controlling a flow of data a network interface controller to a host processor

A portion of a firmware program may be automatically upgraded during power on of a processor-based system. A firmware upgrade file signed by a private key is authenticated using a public key accessible to the firmware program. The authentication and upgrade is performed automatically. Interrupted upgrades are anticipated and resolved by the firmware program. The public key is duplicated and is itself upgradable, in case the private key changes. The firmware program may be locked to prevent both viewing and unauthorized upgrades of the public keys or other parts of the firmware program.

Firmware security key upgrade algorithm

A method for establishing a secure communication channel for information flow between two or more computers communicating via an interconnected computer network, and a system for implementing the method, in response to receiving a security association data structure from one of the computers. The received security association data structure is stored in a memory region having a specific memory address value, and the specific memory address value is assigned as the security parameter index value associated with the received inbound security association data structure. Additionally, a method of processing information received over a previously established secure communication channel, and a system for implementing the method, in response to receiving a data packet that includes an encrypted data portion, and a header portion that includes a security parameter index value. A memory region is located using the security parameter index value as an address pointer. The encrypted data portion of the received data packet is then processed based on a security association data structure stored in the located memory region.

Method for establishing a security association between two or more computers communicating via an interconnected computer network

A processor-based system may be operated in an effectively 'always on' condition. The system may transition from a lower power consumption state to a higher power consumption state in response to the first operation of a power button. In response to a second operation of the power button, the system transitions from the higher power consumption state to the lower power consumption state. However, unless the system is unplugged, the system remains in a power consuming state even when the power button is repeatedly operated.

Power management for processor-based appliances

A packet processing system is embodied on an ASIC is optimized for processing IPSec security protocol packets in a hardware configuration. Embedded RISC processors operate with hardware support modules providing for IPSec packet processing at OC24 data rates and greater. IPSec packets are received through a streaming interface and buffered in an external memory. When the entire packet is in external memory, portions are buffered in a local memory for crypto-processing. As portions of the packets complete processing, the portions are buffered to an output portion of the external memory associated with the channel. When an entire packet competes processing, portions are buffered to a local memory for streaming. The hardware accordingly reduces the involvement of the RISC processors and significantly increases channel throughput providing for high-speed IPSec packet processing.

Growing community of inventors

Chandler, AZ, United States of America

Chad W Mercer