Cryptographic processing in a communication network, using a single cryptographic engine

Claim 3

A method as defined in claim 1, wherein the step of storing inbound and outbound packets in temporary buffer storage includes: storing inbound packets if the client interface is unavailable; and storing outbound packets if the communication network is unavailable.

Claim 4

A method as defined in claim 2, and further comprising the steps of: receiving a loopback packet from the client interface; immediately parsing and cryptographically processing the loopback packet, if necessary; and storing the loopback packet if the client interface is unavailable.

Claim 7

A method as defined in claim 4, and further comprising the steps of: receiving a loopback packet from the client interface; immediately parsing and cryptographically processing the loopback packet, if parsing determines that such processing is necessary; and storing the loopback packet if the client interface in unavailable.

Claim 8

A method as defined in claim 4, and further comprising, prior to transmitting a packet onto the client interface, the steps of: parsing a portion of the packet before the client interface becomes available; storing the parsed portion of the packet in a first-in-first-out buffer, to be ready to transmit; retrieving data from the first-in-first-out buffer when the client interface becomes available; and beginning transmission of the retrieved data onto the client interface while additional data of the same packet is stored and retrieved in the first-in-first-out buffer.

Claim 9

Apparatus for cryptographic processing of data packets outbound from a half-duplex client interface to a communication network, and inbound from the communication network to the client interface, using only a single cryptographic engine, the apparatus comprising: means for parsing each outbound data packet to determine whether cryptographic processing is necessary and the type of processing to be performed; means for parsing each inbound data packet to determined whether processing is necessary and the type of processing to be performed; a single cryptographic engine, for cryptographically processing, if necessary, outbound data packets as they are received from the client interface and, if necessary, inbound data packets as they are transmitted onto the client interface; and buffer storage means for storing, as needed, inbound and outbound data packets before forwarding; whereby only a single cryptographic engine is needed because the client interface cannot handle an outbound packet and an inbound packet at the same time.

Claim 10

Apparatus for cryptographic processing of data packets outbound from a half-duplex client interface to a communication network, and inbound from the communication network to the client interface, using only a single cryptographic engine, the apparatus comprising: means for parsing each outbound data packet to determine whether cryptographic processing is necessary and the type of processing to be performed; means for parsing each inbound data packet to determined whether processing is necessary and the type of processing to be performed; a single cryptographic engine, for cryptographically processing, if necessary, outbound data packets as they are received from the client interface and, if necessary, inbound data packets as they are transmitted onto the client interface; and buffer storage means for storing, as needed, inbound and outbound data packets before forwarding; whereby only a single cryptographic engine is needed because the client interface cannot handle an outbound packet and an inbound packet at the same time.

Claim 11

Apparatus as defined in claim 7, wherein the buffer storage means includes: means for storing inbound packets if the client interface is unavailable; and means for storing outbound packets if the communication network is unavailable.

Claim 12

Apparatus as defined in claim 8, and further comprising; means for storing a loopback data packet received from the client interface and cryptographically processed as needed in the cryptographic engine, until the client interface is available.

Claim 13

Apparatus for cryptographic processing of data packets outbound from a half-duplex client interface to a communication network, and inbound from the communication network to the client interface, using only a single cryptographic engine, the apparatus comprising: means for receiving inbound data packets from a communication network; means for determining whether the client interface is available; means for storing each inbound data packet if the client interface is unavailable; means operable when the client interface becomes available, for retrieving a stored data packet; means for parsing each inbound packet to determine whether it should be cryptographically processed; a cryptographic engine, operable to cryptographically process the inbound data packet if necessary as determined by the means for parsing each inbound packet; means for transmitting the inbound data packet onto the client interface; means for receiving outbound data packets from the client interface; means for parsing each outbound data packet as it is received from the client interface, and for forwarding each packet for processing in the cryptographic engine, if necessary; means for determining whether the communication network is available; means for storing each outbound data packet if the communicating network is unavailable; means operable when the communication network becomes available, for retrieving a stored data packet and transmitting it onto the communication network; whereby a single cryptographic engine is sufficient to perform cryptographic processing of the data, because cryptographic processing of outbound packets is performed as the packets are received from the client interface, and processing of inbound packets is performed as the packets are transmitted to the client interface, but half-duplex operation of the client interface precludes the possibility of both these functions occurring at the same time.

Claim 14

Apparatus for cryptographic processing of data packets outbound from a half-duplex client interface to a communication network, and inbound from the communication network to the client interface, using only a single cryptographic engine, the apparatus comprising: means for receiving inbound data packets from a communication network; means for determining whether the client interface is available; means for storing each inbound data packet if the client interface is unavailable; means operable when the client interface becomes available, for retrieving a stored data packet; means for parsing each inbound packet to determine whether it should be cryptographically processed; a cryptographic engine, operable to cryptographically process the inbound data packet if necessary as determined by the means for parsing each inbound packet; means for transmitting the inbound data packet onto the client interface; means for receiving outbound data packets from the client interface; means for parsing each outbound data packet as it is received from the client interface, and for forwarding each packet for processing in the cryptographic engine, if necessary; means for determining whether the communication network is available; means for storing each outbound data packet if the communicating network is unavailable; means operable when the communication network becomes available, for retrieving a stored data packet and transmitting it onto the communication network; whereby a single cryptographic engine is sufficient to perform cryptographic processing of the data, because cryptographic processing of outbound packets is performed as the packets are received from the client interface, and processing of inbound packets is performed as the packets are transmitted to the client interface, but half-duplex operation of the client interface precludes the possibility of both these functions occurring at the same time.

Claim 15

Apparatus as defined in claim 10, and further comprising: means for storing a loopback data packet; and wherein the means for receiving and parsing outbound packets also serve to receive and parse loopback packets as received from the client interface, and the cryptographic engine also serves to cryptographically process loopback packets, as necessary.

Claim 16

Apparatus as defined in claim 11, and further comprising: a high-speed data bus providing bidirectional access to the means for storing data packets.

Claim 17

Apparatus as defined in claim 10, and further comprising: a first-in-first-out buffer, for storing a portion of an inbound data packet prior to its transmission onto the client interface; means for initiating parsing of a portion of the packet before the client interface becomes available, wherein the parsed portion of the packet is stored in the first-in-first-out buffer, to be ready to transmit; and means for retrieving data from the first-in-first-out buffer when the client interface becomes available, and beginning transmission of the retrieved data onto the client interface while additional data of the same packet is stored and retrieved in the first-in-first-out buffer.