Cryptographic processing in a communication network, using a single

Abstract

A device and related method for cryptographically processing data packets being forwarded in both directions between a communication network and a client interface, using only a single cryptographic engine, but without any degradation in latency or throughput performance, as compared with a device using two cryptographic engines Outbound data packets received from the client interface are immediately parsed to determine if cryptographic processing is required, and an appropriate portion of each packet may be cryptographically processed as the packet is received and stored in an outbound buffer memory, until forwarded onto the communication network. Inbound data packets received from the communication network are not immediately parsed but are stored in an inbound buffer memory until the client interface is available. Parsing and any needed cryptographic processing of an inbound packet is not performed until the client interface becomes available and the packet is retrieved from the inbound buffer memory for forwarding. Since the client buffer cannot receive an inbound packet at the same time that it is sending an outbound packet, the single cryptographic engine serves to process traffic in both directions.