Method and apparatus for increasing the output of a cryptographic system

摘要

The rate at which packets are provided to a cryptographic engine of a cryptographic system is adjusted using a feedback mechanism to increase the output of the cryptographic system. Data is classified and queued on a per class/flow basis and stored in input queues prior to being processed. A class based queue scheduler is implemented to select data from the input queues to be transmitted to the cryptographic engine. The cryptographic engine operates in processing cycles. At each cycle, an amount of data is transferred from the input queues to a cryptographic engine input queue. A cryptographic accelerator in the cryptographic engine processes the data on the cryptographic engine input queue during the cycle. The output rate of the cryptographic accelerator is measured during the cycle and this value is used as feedback to determine how much data should be passed to the cryptographic engine for a subsequent cycle.

主权项

1. A method of operating a network element to cryptographically process packets for communication over a communication network, the network element comprising at least one network interface and a cryptographic processor having a cryptographic processor input queue, the method comprising, over a plurality of processing cycles of the cryptographic processor:
operating the cryptographic processor over a current processing cycle to cryptographically process a plurality of packets stored in the cryptographic processor input queue while measuring an output bandwidth of the cryptographic processor during the current processing cycle; providing the cryptographically processed packets to the at least one network interface; transmitting the cryptographically processed packets onto the communication network at the at least one network interface; and moving a plurality of packets into the cryptographic processor input queue for processing by the cryptographic processor during a next processing cycle, the plurality of packets comprising an amount of data determined based, at least in part, on the measured output bandwidth of the cryptographic processor during the current processing cycle.