Broadcom Corporation

Freegate Corporation

Tut Systems, Inc.

Avago Technologies General IP (singapore) Pte. Ltd.

Joseph John Tardo

Mark Leonard Buer

Jean-Marc Frailong

Charles A Price

Zheng Qi

Jianjun Luo

Ronald Squires

Don Matthews

Stanislas Wolski

Nate Hill

Uri Elzur

Patrick Y Law

Derrick Chu Lin

Scott Sterling McDaniel

Kan Frankie Fan

Christopher Owen

Suresh Krishna

Jean A Gastinel

Shiv Haris

Donald P Matthews

Phillip Smith

Harold Lee Mendoza

Duc Hua

Mark James Herbert

Scott S Mcdaniel

A method, system and apparatus for an OpenFlow hybrid architecture network device. In one embodiment, a hybrid approach is enabled by a network device that brackets an OpenFlow forwarding plane with conventional forwarding planes. Interfaces between the OpenFlow forwarding plane is provided via logical ports that pass packets along with associated metadata.

Method, system and apparatus for an OpenFlow hybrid architecture network device

A system and method for efficient matching regular expression patterns across multiple packets. A deep packet inspection system can be embodied in a switch ASIC using a flow tracker and a signature matching engine. The flow tracker can be positioned in an ingress portion of the switch ASIC at a location where packets in a bi-direction flow can be observed and recorded. The flow tracker generates a signature match request that is forwarded to a signature matching engine in an auxiliary pipeline. The signature matching engine is enabled to perform cross-packet signature matching using signature matching state machines and reports the signature matching results to the flow tracker using a response packet that is sent to the ingress pipeline.

System and method for efficient matching of regular expression patterns across multiple packets

A system and method for integrating line-rate application recognition in a switch ASIC. Switching platforms can be built using this feature with a conventional control plane processor rather than a more expensive specialized processor. A deep packet inspection system can be embodied in a switch ASIC using a flow tracker and a signature matching engine. The flow tracker can be positioned in an ingress portion of the switch ASIC at a location where packets in a bi-direction flow can be observed and recorded. The flow tracker generates a signature match request that is forwarded to a signature matching engine in an auxiliary pipeline. The signature matching engine analyzes packets using signature matching state machine and reports the signature matching results to the flow tracker using a response packet that is sent to the ingress pipeline.

System and method for integrating line-rate application recognition in a switch ASIC

Methods and apparatus are provided for performing authentication and decryption operations. A record including multiple encrypted blocks is received. An encrypted block in the record is extracted and decrypted first in order to obtain context information for performing authentication operations. Each remaining block is then decrypted and authenticated by using the available context information. Authentication operations can be performed without having to wait for the decryption of all of the blocks in the record.

Methods and apparatus for performing authentication and decryption

Methods and systems are disclosed for providing secured data transmission and for managing cryptographic keys. One embodiment of the invention provides secure key management when separate devices are used for generating and utilizing the keys. One embodiment of the invention provides secure storage of keys stored in an unsecured database. One embodiment of the invention provides key security in conjunction with high speed decryption and encryption, without degrading the performance of the data network.

Key management system and method

Methods and associated systems provide secured data transmission over a data network. A security device provides security processing in the data path of a packet network. The device may include at least one network interface to send packets to and receive packets from a data network and at least one cryptographic engine for performing encryption, decryption and/or authentication operations. The device may be configured as an in-line security processor that processes packets that pass through the device as the packets are routed to/from the data network.

Data path security processing

Provided is an architecture for a cryptography accelerator chip that allows significant performance improvements over previous prior art designs. In various embodiments, the architecture enables parallel processing of packets through a plurality of cryptography engines and includes a classification engine configured to efficiently process encryption/decryption of data packets. Cryptography acceleration chips in accordance may be incorporated on network line cards or service modules and used in applications as diverse as connecting a single computer to a WAN, to large corporate networks, to networks servicing wide geographic areas (e.g., cities). The present invention provides improved performance over the prior art designs, with much reduced local memory requirements, in some cases requiring no additional external memory. In some embodiments, the present invention enables sustained full duplex Gigabit rate security processing of IPSec protocol data packets.

Classification engine in a cryptography acceleration chip

Methods and apparatus are provided for performing authentication and decryption operations in a cryptography accelerator system. Input data passed to a cryptography accelerator from a host such a CPU includes information for a cryptography accelerator to determine where to write the processed data. In one example, processed data is formatted as packet payloads in a network buffer. Checksum information is precalculated and an offset for a header is maintained.

Data transfer efficiency in a cryptography accelerator system

Distributed processing in a cryptography acceleration chip

Methods and apparatus are provided for an entity such as a CPU to efficiently call a cryptography accelerator to perform cryptographic operations. A function call causes the cryptography accelerator to execute multiple cryptographic operations in a manner tailored for specific processing steps, such as steps during a handshake phase of a secured session. The techniques provide efficient use of hardware processing resources, data interfaces, and memory interfaces.

Methods and apparatus for accelerating secure session processing

Methods and apparatus are provided for a cryptography accelerator to efficiently perform authentication and encryption operations. A data sequence is received at a cryptography accelerator. An encrypted authentication code and an encrypted data sequence is provided efficiently upon performing single pass authentication and encryption operations on the data sequence.

Methods and apparatus for performing encryption and authentication

Growing community of inventors

Palo Alto, CA, United States of America

Joseph John Tardo