Abstract: A hash processing system and method for reducing the number of clock cycles required to implement the SHA1 and MD5 hash algorithms by using a common hash memory having multiple storage areas each coupled to one of two or more hash channels. The system further provides implicit padding on-the-fly as data is read from the common hash memory. The system shares register and other circuit resources for MD5 and SHA1 hash circuits that are implemented in each hash channel, and uses pipelined, two-channel SHA1 and pipelined, single-channel MD5 hash architectures to reduce the effective time required to implement the SHA1 and MD5 algorithms.

Abstract: Compression of inner headers of IPSec tunnel packets is achieved by storing an inner IP header and an inner protocol header in a context sub-table associated with the security association database entry at a destination tunnel device. IPSec tunnel packets having compressed inner headers may be identified by the LSBs of the SPI number in the IPSec header. The SPI number may also identify whether the IPSec tunnel packet is a TCP packet. A portion of padding in the encapsulated portion may identify a particular context sub-table used for decompressing the inner headers. The context sub-table may be updated as portions of the inner headers change.

Abstract: A hash processing system and method for reducing the number of clock cycles required to implement the SHA1 and MD5 hash algorithms by using a common hash memory having multiple storage areas each coupled to one of two or more hash channels. The system further provides implicit padding on-the-fly as data is read from the common hash memory. The system shares register and other circuit resources for MD5 and SHA1 hash circuits that are implemented in each hash channel, and uses pipelined, two-channel SHA1 and pipelined, single-channel MD5 hash architectures to reduce the effective time required to implement the SHA1 and MD5 algorithms.

Abstract: A packet processing system is embodied on an ASIC is optimized for processing IPSec security protocol packets in a hardware configuration. Embedded RISC processors operate with hardware support modules providing for IPSec packet processing at OC24 data rates and greater. IPSec packets are received through a streaming interface and buffered in an external memory. When the entire packet is in external memory, portions are buffered in a local memory for crypto-processing. As portions of the packets complete processing, the portions are buffered to an output portion of the external memory associated with the channel. When an entire packet competes processing, portions are buffered to a local memory for streaming. The hardware accordingly reduces the involvement of the RISC processors and significantly increases channel throughput providing for high-speed IPSec packet processing.

Abstract: A full-adder post processor performs modulo arithmetic. The full-adder post processor is a hardware implementation able to calculate A mod N, (A+B) mod N and (A?B) mod N. The processor includes a full adder able to add the operands A and B while modulo reduction is accomplished in the processor by successively subtracting the largest possible multiple of the modulus N obtainable by bit shifting prior to subtraction.

Abstract: A flexible input/output (I/O) interface allows a processing core to communicate high-speed data with a several different types of interfaces including a Direct Memory Access (DMA) interface and a streaming interface. The I/O interface includes a streaming interface for transferring streamed data from the streaming data bus to the core-processing engine, a DMA interface for transferring DMA data from the DMA data bus to the core-processing engine, and an arbiter for coordinating data transfer with the core-processing engine between the streaming interface and DMA interface. The arbiter may operate in a split-bus-mode wherein the arbiter performs the address phase for more than one channel prior to entering into the data phase. The flexible I/O interface may include a common address bus and data bus between the processing engine and the interfaces. Alternatively, a switching fabric may couple separate address and data buss of the interfaces with the processing engine.

Abstract: An encryption processing system implements an encryption algorithm using a memory system comprising a multiple-port memory by performing at least one set of parallel read and write operations to the memory. The algorithm is, for example, the conventional ARCFOUR (or RC4) algorithm, and the key and state array used in the ARCFOUR algorithm are stored in the multiple port memory. During execution of the ARCFOUR algorithm, a read from one port of the multiple port memory of a state array value is done while another port is used to write a new value to the state array. The use of such parallel read and write operations uses a comparator system that determines whether to use certain previously-read values from the state array or to read a new value from the state array when selecting the pseudorandom K byte to calculate the output data byte.

Abstract: A multi-function modulo processor architecture is capable of performing multiple modulo mathematic operations. The modulo processor includes a pipeline processing portion that iteratively computes a running partial modulo product using the operands of a modulo mathematic argument to obtain one or more final partial modulo products. The final partial modulo product is post-processed to obtain the final result.

Abstract: A circuit includes a single circuit portion for implementing the Advanced Encryption Standard (AES) block cipher algorithm in a system having a plurality of channels. The circuit portion includes a circuit for individually generating, on the fly, the round keys used during each round of the AES block cipher algorithm. The circuit portion also includes shared logic circuits that implement the transformations used to encrypt and decrypt data blocks according to the AES block cipher. The single circuit portion encrypts or decrypts data blocks from each of the plurality of system channels in turn, in round-robin fashion. The circuit portion also includes a circuit for determining S-box values for the AES block cipher algorithm. The circuit additionally implements an efficient method for generating round keys on the fly for the AES block cipher decryption process.

Abstract: An electronic device such as an integrated circuit includes a power distribution system having a plurality of symmetrical power distribution structures, for example as triplet power line structures, distributed in parallel and spaced evenly across the surface of the electronic device. A plurality of circuit blocks are coupled to receive power through the power distribution structures. Each of the power distribution structures comprises a first power line for providing a first power supply voltage, and a second power line and a third power line for providing a second supply voltage. The second power line and the third power line are disposed symmetrically on opposite sides of the first power line.

Abstract: A system and method for generating an indeterminate random digital data string based on a sampling source, which varies in frequency and phase, sampling an entropy source that also varies in frequency and phase, and additionally based on the principles of permutation and substitution. The system includes a random number generation circuit and a data substitution circuit coupled to receive random data output from the random number generation circuit. A data permutation circuit is coupled to receive substituted random data output from the data substitution circuit. A data compression circuit is coupled to receive permuted and substituted random data output from the permutation circuit and output at least a portion of the indeterminate random data string. A plurality of variable frequency clocks, each operating at different clock frequencies, are selectively coupled to various of the circuits within the system.

Abstract: A circuit and method for generating a variable frequency clock signal that uses a first, lower frequency oscillator, to modulate and vary the frequency of a second, higher frequency oscillator to generate a variable frequency clock signal. The circuit includes a first oscillator, a control circuit, and a second oscillator. The first oscillator generates a first signal having a substantially fixed-frequency magnitude. The control circuit is coupled to receive the first signal from the first oscillator and outputs control signals based on the received first signal. The second oscillator is coupled to receive the control signals from the control circuit and generates the variable frequency magnitude clock signal in response to the received control signal.

Abstract: An IPSec packet processing system includes an IPSec manager to interface with an IPSec engine, to manage memory and to handle exceptions associated with IPSec packet processing. The IPSec manager may be a software module operating as part of a software stack on a host processor while the IPSec engine may perform IPSec packet processing. The IPSec manager may also initiate the negotiation of new keys, send ICMP messages for PMTU violations and log entries for exceptions.