Abstract: A router chip is proposed which comprises a central processing unit, a plurality of network interface circuitry, and a firewall circuitry coupled between the plurality of network interface circuits and the central processing unit to selectively block network traffic.

Abstract: The present invention provides a method and apparatus for network address translation (NAT) based on pure hardware architecture. The method includes that when receiving a packet, the first MAC circuit will translate the address of the packet directly and store the address-translated packet into the storage, and that the first MAC circuit informs the second MAC circuit to access the address-translated packets from the storage so as to output. Because address translation requires lots of operating resource, the present invention using the first and the second MAC circuits instead of the CPU to obtain the aforesaid functions only needs a simple, low-speed and low-power CPU to setup the parameters of the first and the second MAC circuits or process few special packets, thus getting the biggest bandwidth under the restriction, the zero wastage of the smallest packet, followed the stipulation of IEEE802.3 in the environment of 100 MHz Ethernet.

Abstract: A router chip is proposed which comprises a central processing unit, a plurality of network interface circuitry, and a firewall circuitry coupled between the plurality of network interface circuits and the central processing unit to selectively block network traffic.

Abstract: Current applications used in security system for encryption/decryption/authentication require intense CPU computation for an SAD search. Therefore, a part of the SAD is planted into an ASIC in order to lessen the load of the CPU. The invention provides a high-performance lookup method that is “LIFM” adapted to the ASIC. Initially, the ASIC makes a perfect match by comparing the SAD_index field of all items allocated in the ASIC with an incoming packet to fetch the required SAD_key. If there is no match, the software and hardware are started by issuing an interrupt from the ASIC until the CPU finds a perfectly matched item. Then, the software level updates the perfectly matched item in the ASIC.

Abstract: The present invention provides a method and apparatus for network address translation (NAT) based on pure hardware architecture. The method includes that when receiving a packet, the first MAC circuit will translate the address of the packet directly and store the address-translated packet into the storage, and that the first MAC circuit informs the second MAC circuit to access the address-translated packets from the storage so as to output. Because address translation requires lots of operating resource, the present invention using the first and the second MAC circuits instead of the CPU to obtain the aforesaid functions only needs a simple, low-speed and low-power CPU to setup the parameters of the first and the second MAC circuits or process few special packets, thus getting the biggest bandwidth under the restriction, the zero wastage of the smallest packet, followed the stipulation of IEEE802.3 in the environment of 100 MHz Ethernet.

Abstract: The transmitter of the present invention calculates a first integrity check value of the MSDU and fragments it into several MPDUs before transmitting it to the receiver in sequence. The receiver firstly calculate a second integrity check value from these MPDUs in sequence by a computing unit, and verifies the integrity of the received MSDU by checking if the first integrity check value is equal to the second integrity check value. If the first integrity check value is equal to the second integrity check value, a CPU shall reassemble these MPDU into the MSDU.

Abstract: The present invention discloses a method of controlling bandwidth for a bridge device applied to packets transmitting between the bridge device and a companion chip. The method first calculates the traffic of packets received by the bridge device and adjusts the frequency of a clock signal that is generated by the bridge device. The clock signal is then outputted to the companion chip, and the companion chip adjusts the output bandwidth according to the clock signal. The bridge device will adjust the frequency of the clock signal when the storage ratio of the receiving queue is beyond a predetermined region and the predetermined region can be the region of the storage ratio between 20 and 80 percent. Additionally, the method of the present invention can be applied to the operation of transmitting packet from the bridge device to the companion chip.

Abstract: The invention provides a device by using a pipelined architecture for enhancing the efficiency and speed of encryption/authentication. To handle all modes defined in RFC2401, 3 DES-HMAC sub-engines are built in the IPSEC engine. Each DES-HMAC sub-engine includes one DES engine and one HMAC engine. By utilizing the pipelined architecture for the combinations of multiple modes, it does not take any waiting time in the encryption and authentication processing. A data block is immediately sent to the next DES_HMAC sub-engine for the next encryption and authentication process right after the previous DES_HMAC sub-engine has outputted the data block.

Abstract: Current applications used in security system for encryption/decryption/authentication require intense CPU computation for an SAD search. Therefore, a part of the SAD is planted into an ASIC in order to lessen the load of the CPU.