Advanced Micro Devices Corporation

Globalfoundries Inc.

Somnath Viswanath

Peter Ka-Fai Chow

Marufa Kaniz

Gopal S Krishna

Robert Alan Williams

Jeffrey Roy Dwork

Mohammad Y Maniar

Bahadir Erimli

Shr-Jie Tzeng

Mrudula Kanuri

Chandan Egbert

Xiaohua Zhuang

Thomas J Runaldue

Yatin Acharya

Chin-Wei Kate Liang

Charles Akum Njinda

Kevin Pond, Legal Representative

The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The network interface offloads IPsec processing from the host processor. According to the invention, the security system includes two processors for encrypting and authenticating the outgoing data. Outgoing data packets are sent alternately to one or the other processor, whereby transmission processing can be accelerated relative to receive processing.

Two parallel engines for high speed transmit IPSEC processing

Network interface systems are disclosed comprising a bus interface system, a media access control system, a memory system, a security system for selectively encrypting outgoing data and decrypting incoming data, a checksum system for generating and verifying checksum values, and a segmentation system for selectively segmenting outgoing data, where the network interface system may be fabricated as a single integrated circuit chip. Methods are also provided for interfacing a host system with a network, in which checksum information is obtained from the host system, which is used to generate checksum values for outgoing data while the data is being stored in a network interface memory system.

Network interface systems and methods for offloading segmentation and/or checksumming with security processing

A system includes a plurality of network devices and an external memory. Each network device includes an address table. The external memory includes a group of address tables corresponding to the address tables of the network devices. The system monitors the address table associated with each of the network devices, detects whether one of the address tables has been updated, and updates the corresponding address table in the external memory in response to detecting an update to one of the address tables.

System and method for implementing an IRC across multiple network devices

The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, a memory system, and a security system. The security system is coupled to the memory system and is adapted to selectively perform security processing on incoming and outgoing data. For at least one of receive or transmit processing, the security system comprises one or more encryption pipelines and at least two sets of one or more authentication pipelines. The encryption pipelines are adapted to perform one or more encryption or decryption algorithms. The authentication pipelines are adapted to perform one or more authentication algorithms. The security system is configured to selectively process frames through the encryption pipelines and then through the two sets of authentication pipelines. The system toggles whereby successive frames alternate between the two sets of authentication pipelines.

Method to maximize hardware utilization in flow-thru IPsec processing

Two parallel engines for high speed transmit IPsec processing

A security association architecture system of the present invention facilitates network data transfer by providing an internal portion of a security association database that can be quickly accessed to obtain security associations as well as an external component that stores the complete security association database. As a result, at least some security associations for incoming received frames and outgoing transmitted frames can be obtained from the internal portion located on a network interface device without accessing system memory, a host computer, and the like in order to obtain the security associations to perform security processing.

Security association table lookup architecture and method of operation

The invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The security system is operative to selectively authenticate incoming and outgoing data. The security system includes a pipeline that masks mutable fields from incoming data prior to authentication.

Receive IPSEC in-line processing of mutable fields for AH algorithm

A network switch includes network switch ports, each including a port filter configured for detecting user-selected attributes from a received layer 2 type data frame. Each port filter, upon detecting a user-selected attribute in a received layer 2 type data frame, sends a signal to a switching module indicating the determined presence of the user-selected attribute, enabling the switching module to generate a switching decision based on the corresponding user-selected attribute and based on a corresponding user-defined switching policy. The switching policy may specify a priority class, or a guaranteed quality of service (e.g., a guaranteed bandwidth), ensuring that the received layer 2 type data frame receives the appropriate switching support. The user-selected attributes for the port filter and the user-defined switching policy for the switching module are programmed by a host processor. Hence, the integrated network switch is able to perform advanced switching operations for layer 2 type data packets to ensure quality of service requirements, independent of priority information specified in the layer 2 type data packets, based on the user-selected attributes in the layer 2 type data packets and the user-defined switching policies established for the switching module.

Arrangement in a network switch for prioritizing data frames based on user-defined frame attributes

One aspect of the invention relates to a network interface system for interfacing a host system with a network. The network interface system includes a bus interface system, a media access control system, and a security system. The security system selectively perform security processing on data incoming from the network based on security associations stored in a memory external to the network interface system, typically a host system memory. The security association for any given frame, when available, is fetched from the external memory after the frame begins to arrive in the network interface system based in part on information contained in the frame. Preferably, the fetch begins before the frame is fully received and the security association is queued whereby security processing can begin without having to wait for the security association to be fetched.

Network interface with security association data prefetch for high speed offloaded security processing

Network interface systems are disclosed comprising a bus interface system, a media access control system, a memory system, a security system for selectively encrypting outgoing data and decrypting incoming data, where the network interface system may be fabricated as a single integrated circuit chip. Systems and methods are disclosed wherein out-of-order writing is used to improve throughput for the security system on the receive end.

Method and apparatus for out of order writing of status fields for receive IPsec processing

An address lookup table in a multiport switch is implemented as a plurality of address sub-tables. Entries in the address sub-tables are stored at row addresses based on a hash of the information in the entry. Hash collisions are stored in a common heap as a linked list of chained values. Entries in the address sub-tables at any particular address are alternated between the address sub-tables. A search of the address sub-table for the particular entry is performed simultaneously on the plurality of address sub-tables. In this manner, the total memory size of the address table can be increased relative to a single address sub-table while decreasing the length of the longest chain length and the length of the average chain length.

Alternately accessed parallel lookup tables for locating information in a packet switched network

A multiport switching device includes a configuration table that stores associations between addresses of subnets directly connected to the switching device and the port number of the multiport switching device that leads to the subnet. A host processor connected to the multiport switching device updates and maintains the configuration table. A remote processor communicates with the switching device through the host processor. To facilitate the communication of the remote processor with the multiport switch, the host processor executes a TCP/IP stack and the multiport switch is assigned a unique IP address.

Remote configuration of a subnet configuration table in a network device

A multiport switching device includes an Internal Rules Checker (IRC) that determines forwarding addresses for packets received at the device. The determined forwarding addresses may include a new MAC destination address that is to substituted for the MAC destination address of the received packet. In one implementation, the new MAC destination address is transmitted from the IRC to the dequeuing logic by transmitting pairs of adjacent words through the switch output queues. In other implementations, the new MAC destination address is transmitted from the IRC to the dequeuing logic by transmitting an index field to the output queuing logic or by having the IRC write the new MAC destination address directly to memory.

Address modification within a switching device in a packet-switched network

An address lookup table in a multiport switch is implemented as a plurality of address sub-tables. Entries in the address sub-tables are stored at row addresses based on a hash of the information in the entry. Entries in the address sub-tables are stored in one of the address sub-tables, as determined by pre-selected information relating to the entry. For example, the least significant bit of a source or destination MAC address may be used to select between two address sub-tables. In this manner, the total memory size of the address table can be increased relative to a single address sub-table while decreasing the length of the longest chain and the length of the average chain.

Parallel lookup tables for locating information in a packet switched network

A network switch, configured for performing layer 2 and layer 3 switching in an Ethernet (IEEE 802.3) network without blocking of incoming data packets, includes a network switch port having a filter (i.e., a packet classifier module) configured for evaluating an incoming data packet on an instantaneous basis, immediately upon receipt at the network switch port. The filter performs simultaneous comparisons between the incoming data stream of the data packet and multiple templates configured for identifying respective data protocols. Each template is composed of a plurality of min terms, wherein each min term specifies a prescribed comparison operation within a selected data byte of the incoming data packet. The templates may be programmed by a user and stored in an internal min term memory. Moreover, the multiple simultaneous comparisons enable the network switch to perform layer 3 switching for 100 Mbps and gigabit networks without blocking in the network switch.

Growing community of inventors

San Jose, CA, United States of America

Somnath Viswanath