589846 A7 _____ B7 _ 五、發明說明(丨) j:發明之領域 (請先閱讀背面之注意事項再填寫本頁) 本發明係有關於資料通訊的領域,且尤指實現保密協 定之網際網路協定(IP)通訊,及尤指處理IPSec保密協定封 包以達到IP網路的高速保密。 發明背景 現代通訊中保密協定廣泛地被使用,以提供在不同實 體層、邏輯層或虛擬媒體間的保密。保密協定目的之一係 關於資訊隱藏。一種此類保密協定係於”要求附註”(RFC) 2401、2402及2406中所說明的標準iPSec網路協定保密 。該IPSec協定可能以隧道模式或傳輸模式來實現。在典 型的隧道模式中,單方編排的位址被使用來安排透過網路 的兩個節點之間的”隧道”。隧道使網路能夠經由另一個網 路連結來傳送資料,壓縮由第二個網路所運送的封包協定 。例如,網際網路上中繼站之間的連結係獨立管理的,且 對於終點站往往是透明的。 例如,IPSec保密協定通訊可以建立在一個機構的分 離位置之間,以幫助保護該位置之間的資料通訊。IPSec 保密的利用使得一群人能夠建立保密的虛擬私人網路 (VPN) 〇 處理實現例如IPSec的保密協定封包的一個難題,係 高速封包通訊之處理要求是難以達到的。基本上,往外送 出的封包必須根據IPSec的要求來壓縮,且往內送回.的 IPSec封包必須是未壓縮的。例如在典型軟體處理系統中 所實現的IPSec封包處理,例如對於許多網路所滿意的 ____3_ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 --_____ B7____ 五、發明說明(> ) OC24程度的通訊而言,係無法容易達到的。在即將來臨 的未來,例如在例如寬頻通訊網路中,係期望達到OC192 資料傳輸速率之IPSec通訊。 因此所需要的係一種系統和方法,其能夠提供改善 IPSec封包處理。同樣需要的一種系統及方法,其能夠提 供至少OC24資料傳輸速率的IPSec封包處理。同樣需要 的係IPSec封包處理的一種系統及方法,其可達到較高的 資料傳輸速率。同樣需要的係一種特殊應用積體電路 (ASIC),其能夠執行IPSec封包的高速處理。 發明槪要 根據較佳實施例,一種特殊應用積體電路(ASIC),被 提供以處理IPSec保密協定封包。根據較佳實施例之一, 該ASIC包括透過一個串流介面,和網路處理器通訊的第 一個串流介面,例如SONET封包-第三實體層介面來接收 串流封包。該ASIC也包括用以儲存和封包控制資訊一起 之串流封包部份的一個輸入緩衝器、用以執行封包上的 IPSec編密操作之編密核心引擎、用以儲存串流封包已處 理部份的一個輸出緩衝器、和用以從輸出緩衝器接收串流 封包之已處理部份的第二串流介面,且透過該串流介面提 供網路處理器已處理之IPSec封包。 根據較佳實施例,一個通道從複數個用以處理串流封 包的通道中來選取。該輸入緩衝器具有和每一個通道相連 結的部份。根據此實施例,該ASIC包括複數個RISC處理 核心。每一個處理核心和通道之一相連結,且透過所相連 4 ___ - 本紙張尺度適用中國國家標準(CNS)A4規格(210 x 297公爱) _____________,#i — (請先閱讀背面之注意事項再填寫本頁) · i線· 589846 A7 ____B7_ 五、發明說明()) 結的通道控制IPSec保密協定封包的處理。 根據較佳實施例,傳送直接記憶存取(DMA)介面接收 已串流的保密資料封包,及選擇用以處理已分流之保密資 料封包的通道,且傳送已串流的保密資料封包至一外部記 憶體。在已串流的保密資料封包所有部份已經傳送至外部 記憶體之後,一輸入DMA引擎從外部記憶體取回已串流 保密資料封包的部份。一輸入先進先出(FIFO)佇列從輸入 DMA引擎,以預定大小的方塊接收已串流的保密資料封包 部分。這些部分係以分配至所選擇的通道之部份輸入FIFO 中來保留。一個關聯隨機存取記憶體(RAM)接收和所選擇 的通道相關之保密關聯資料庫(SAD)入口。該SAD入口由 輸入DMA引擎從外部記憶體取回。當封包可被處理時, 一輸入編密DMA引擎提供保密資料封包之方塊至一處理 引擎來處理。如所能夠看到的,和存取外部記憶體相關的 任何潛在因素顯著地降低。 根據該實施例,系統的輸出部份包括:一輸出編密 FIFO,其從處理引擎接收保密封包之已處理的方塊;一輸 出DMA引擎,其傳送保密封包之已處理方塊至外部輸出 記憶體;及一接收(Rx)DMA介面,其在已處理保密資料封 包之所有部份已經傳送至外部記憶體(158)之後,從外部輸 出記憶體取回保密封包之已處理方塊。該接收(Rx)DMA介 面傳送保密資料封包之已處理方塊至串流介面來串流。 接收(Rx)DMA介面最好包括複數個暫存器,用以儲存 每個複數個已處理保密資料封包的長度資訊。接收 — ___5_ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) ---------------- (請先閱讀背面之注意事項再填寫本頁) · -線· 589846 A7 __B7 _ 五、發明說明(斗) (請先閱讀背面之注意事項再填寫本頁) (Rx)DMA介面相對應於相關的已處理之保密資料封包長度 資訊的儲存來執行取回操作。該關連RAM最好包括儲存 關於所選擇通道之程式狀態資訊的部份。傳送(Tx)DMA介 面最好基於外部記憶體中通道可獲得的緩衝器空間數量, 來選取最不忙碌的通道。當保密封包係一個往外送出的 IPSec保密封包時,在部份封包被緩衝至輸入FIFO之中時 ,一外部標題及IPSec標題被加入至該往外送出的IPSec 保密封包。當保密封包係一個往內送入的IPSec保密封包 時,在部份封包被緩衝至輸入FIFO之前,一外部標題及 IPSec標題從該往外送出的IPSec保密封包中被移除。 圖式簡單說明 本發明係特別由申請專利範圍所界定。然而,本發明 更完整的瞭解可以參閱相關圖式時,參考詳細的說明及申 請專利範圍來獲得,其中相同的元件參考符號係對應於在 整個圖式相類似的項目,且 圖一係說明合適於實現本發明較佳實施例之系統架構 的簡化功能方塊圖; 圖二係說明根據本發明較佳實施例之封包處理系統的 高階簡化功能方塊圖; 圖三係說明根據本發明較佳實施例之封包處理系統的 細部功能方塊圖; 圖四係說明處理根據本發明較佳實施例之封包的簡化 流程圖; 圖五係說明根據本發明較佳實施例之往外送出IPSec — ____6_ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 ______B7 _ 五、發明說明(S ) 資料封包的簡化圖; 圖六係說明根據本發明較佳實施例之往內送入IPSec 資料封包的簡化圖; 圖七係說明用於根據本發明較佳實施例之往外送出 IPSec資料封包的保密關聯資料庫入口之簡化實例; 圖八係說明處理根據本發明較佳實施例之往外送出封 包的程序之簡化流程圖; 圖九係說明處理根據本發明較佳實施例之往內送入封 包的程序之簡化流程圖; 圖十係說明用於根據本發明較佳實施例之往內送入 IPSec資料封包的保密關聯資料庫入口之簡化實例。 這此處所列舉的實例係說明本發明較佳實施例之一種 形式,而此實例並非在於限制之意。 孟件符號說明 50 :往外送出的IP資料封包 51 : IP標題 52 :上層協定(ULP)欄位 5 3 :使用者資料欄上層協定欄 54 :保密關聯資料庫(SAD)標籤 55 : IPSEC 標題 56 :微外部標題589846 A7 _____ B7 _ V. Description of the invention (丨) j: Field of invention (please read the notes on the back before filling out this page) The present invention relates to the field of data communication, especially the Internet that implements confidentiality agreements Protocol (IP) communications, and especially the processing of IPSec confidentiality agreement packets to achieve high-speed privacy in IP networks. BACKGROUND OF THE INVENTION Confidentiality agreements are widely used in modern communications to provide confidentiality between different physical, logical, or virtual media. One of the purposes of the confidentiality agreement is with regard to information hiding. One such non-disclosure agreement is the confidentiality of the standard iPSec network protocols described in "Required Notes" (RFC) 2401, 2402, and 2406. The IPSec protocol may be implemented in a tunnel mode or a transmission mode. In a typical tunnel mode, unilaterally-arranged addresses are used to arrange a "tunnel" between two nodes passing through the network. Tunneling enables the network to transmit data over another network link, compressing the packet protocols carried by the second network. For example, the links between relay stations on the Internet are independently managed and are often transparent to the end stations. For example, IPSec confidential agreement communications can be established between separate locations in an organization to help protect data communications between the locations. The use of IPSec confidentiality enables a group of people to establish a confidential virtual private network (VPN). One of the difficulties in handling confidentiality agreement packets such as IPSec, which is difficult to meet the processing requirements of high-speed packet communication. Basically, outbound packets must be compressed according to the requirements of IPSec, and inbound IPSec packets must be uncompressed. For example, the IPSec packet processing implemented in a typical software processing system, such as ____3_ which is satisfactory for many networks. This paper size applies the Chinese National Standard (CNS) A4 specification (210 X 297 mm) 589846 A7 --_____ B7____ 5 2. Description of the invention (>) For OC24 level communication, it is not easy to achieve. In the coming future, for example, in broadband communication networks, for example, IPSec communication is expected to achieve the OC192 data transmission rate. What is needed is a system and method that can provide improved IPSec packet processing. There is also a need for a system and method that can provide IPSec packet processing at least OC24 data transmission rate. Also needed is a system and method for IPSec packet processing, which can achieve higher data transmission rates. Also needed is a special application integrated circuit (ASIC) capable of performing high-speed processing of IPSec packets. Summary of the Invention According to a preferred embodiment, a special application integrated circuit (ASIC) is provided to process IPSec confidentiality agreement packets. According to one of the preferred embodiments, the ASIC includes a first stream interface that communicates with the network processor through a stream interface, such as a SONET packet-third physical layer interface to receive the stream packet. The ASIC also includes an input buffer to store the streaming packet portion along with the packet control information, an encryption core engine to perform IPSec encryption operations on the packet, and a processed portion of the streaming packet. An output buffer, and a second stream interface for receiving a processed portion of the stream packet from the output buffer, and providing the IPSec packet processed by the network processor through the stream interface. According to a preferred embodiment, a channel is selected from a plurality of channels for processing streaming packets. The input buffer has a portion connected to each channel. According to this embodiment, the ASIC includes a plurality of RISC processing cores. Each processing core is connected to one of the channels and is connected through 4 ___-This paper size applies Chinese National Standard (CNS) A4 (210 x 297 public love) _____________, #i — (Please read the precautions on the back first (Fill in this page again) · i-line · 589846 A7 ____B7_ V. Description of the invention ()) The closed channel controls the processing of IPSec confidential agreement packets. According to a preferred embodiment, the transmitting direct memory access (DMA) interface receives the streamed confidential data packets, selects a channel for processing the streamed confidential data packets, and transmits the streamed confidential data packets to an external Memory. After all the parts of the streamed confidential data packet have been transferred to the external memory, an input DMA engine retrieves the parts of the streamed confidential data packet from the external memory. A first-in-first-out (FIFO) queue receives a stream of confidential data packets in a predetermined size block from the input DMA engine. These sections are reserved as part of the input FIFO allocated to the selected channel. An associative random access memory (RAM) receives a secret association database (SAD) entry associated with the selected channel. The SAD entry is retrieved from the external memory by the input DMA engine. When a packet can be processed, an input encryption DMA engine provides a block of confidential data packets to a processing engine for processing. As can be seen, any potential factors associated with accessing external memory are significantly reduced. According to this embodiment, the output part of the system includes: an output coded FIFO that receives the processed blocks of the sealed packet from the processing engine; an output DMA engine that sends the processed blocks of the sealed packet to the external output memory; And a receive (Rx) DMA interface, which retrieves the processed block of the sealed packet from the external output memory after all parts of the processed confidential data packet have been transferred to the external memory (158). The receive (Rx) DMA interface sends the processed blocks of the confidential data packet to the streaming interface for streaming. The receive (Rx) DMA interface preferably includes a plurality of registers for storing the length information of each of the processed confidential data packets. Receiving — ___5_ This paper size applies to China National Standard (CNS) A4 (210 X 297 mm) ---------------- (Please read the precautions on the back before filling this page ) · -Line · 589846 A7 __B7 _ V. Description of the invention (bucket) (Please read the precautions on the back before filling this page) (Rx) The DMA interface corresponds to the storage of the processed confidential data packet length information. Perform a retrieval operation. The associated RAM preferably includes a section that stores program status information about the selected channel. The transmit (Tx) DMA interface preferably selects the least busy channel based on the amount of buffer space available to the channel in external memory. When the sealed packet is an outbound IPSec sealed packet, when a part of the packet is buffered in the input FIFO, an external header and the IPSec header are added to the outbound IPSec sealed packet. When the sealed packet is an incoming IPSec sealed packet, an external header and the IPSec header are removed from the outgoing IPSec sealed packet before a part of the packet is buffered to the input FIFO. BRIEF DESCRIPTION OF THE DRAWINGS The invention is specifically defined by the scope of patent application. However, a more complete understanding of the present invention can be obtained by referring to the related drawings, referring to the detailed description and the scope of patent applications, where the same component reference symbols correspond to similar items throughout the drawings, and the drawings are suitable for illustration. A simplified functional block diagram of a system architecture for implementing a preferred embodiment of the present invention; FIG. 2 is a high-level simplified functional block diagram illustrating a packet processing system according to a preferred embodiment of the present invention; FIG. A detailed functional block diagram of a packet processing system; Figure 4 is a simplified flowchart illustrating processing of a packet according to a preferred embodiment of the present invention; Figure 5 is a diagram illustrating outgoing IPSec according to a preferred embodiment of the present invention — ____6_ This paper size applies China National Standard (CNS) A4 specification (210 X 297 mm) 589846 A7 ______B7 _ V. Simplified diagram of the description of the (S) data packet; Figure 6 illustrates the inbound IPSec data according to the preferred embodiment of the present invention A simplified diagram of a packet; FIG. 7 illustrates the security of an outbound IPSec data packet according to a preferred embodiment of the present invention A simplified example of the database entry; Figure 8 is a simplified flowchart illustrating the procedure for processing outgoing packets according to a preferred embodiment of the present invention; Figure 9 is a flowchart illustrating processing for inward packets according to a preferred embodiment of the present invention Simplified flowchart of the procedure; FIG. 10 illustrates a simplified example of a security association database entry for inwardly sending an IPSec data packet according to a preferred embodiment of the present invention. The example listed here illustrates one form of the preferred embodiment of the present invention, and this example is not intended to be limiting. Description of Symbols 50: IP data packets sent out 51: IP header 52: Upper Layer Protocol (ULP) field 5 3: User data column Upper layer field 54: Confidentiality Association Database (SAD) tag 55: IPSEC header 56 : Micro external title
57 : MAC 58 :暗的資料 59 :控制資訊 _________7__ 本紙張尺度適用中國國家標準(CNS)A4規格(21〇 X 297公釐) (請先閱讀背面之注意事項再填寫本頁)57: MAC 58: Dark information 59: Control information _________7__ This paper size is applicable to China National Standard (CNS) A4 (21〇 X 297 mm) (Please read the precautions on the back before filling this page)
589846 A7 _B7_ 五、發明說明(&) 61 :外部標題欄位589846 A7 _B7_ V. & Explanation of invention 61: External title field
62 : ULP (請先閱讀背面之注意事項再填寫本頁) 63 :使用者資料 65 ·· IPSEC標題欄位 66 :往外送出之IP標題欄位62: ULP (Please read the precautions on the back before filling out this page) 63: User Information 65 ·· IPSEC Title Field 66: IP Title Field Outward
67 : MAC 68 :暗的資料欄位 69 :控制資訊 100 :架構 110 :主控制匯流排 120 :主處理器 130 :連接至網路處理器 140 :處理系統 141 :介面 142 :預編密封包處理子系統 144 :編密封包處理子系統 146 :後編密封包處理系統 148 :控制器子系統. 150 :串流介面 152 :串流介面 154 :串流介面 156 :輸入外部隨機存取記憶體 158 :輸出外部隨機存取記憶體 306 :輸入DMA引擎 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 _B7_ 五、發明說明(1 ) 308 :輸入先進先出丨宁列 310 :輸入編密直接記憶存取引擎 (請先閱讀背面之注意事項再填寫本頁) 312 :輸入串流介面 314 :傳送(Tx)直接記憶體存取介面 320 :輸出編密先進先出丨宁列 322 :輸出直接記憶存取引擎 324 :接收(Rx)直接記憶存取介面 326 :串流介面 340 :編密核心引擎 342 :輸出隨機存取記憶體 352 :處理核心 354 :核心隨機存取記憶體 350 :匯流排控制器 360 :主介面 370 :硬體加速器 400 :封包處理程序 402 :預編密封包處理操作 404 :編密封包處理操作 406 :後編密封包處理操作 700 :表 701 :保密關聯循序號碼 702 :保密關聯現態位元組計數器 703 :關鍵字 705 :跳躍旗標 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 _____B7___ 五、發明說明(<?) 708 : SPI 號碼 710 : IV旗標欄位 711 :旗標 712 :指標 713 :隧道來源端位址 714 :目的端位址 715 :欄位 800 :程序 1000 : SAD 入口 1002 :保密策略序號欄位 1004 : IV大小欄位 1006 :旗標欄位 1008 :硬體位元組期限欄位 1010 :硬體時間期限 1012 :關鍵字資訊指標欄位 1014 : RFU 欄位 1016 :現態位元組期限欄位 1018 : SA循序號碼欄位 圖式詳細說明 本發明特別係提供用以改善IPSec封包處理的一種系 統及方法。根據較佳實施例,特殊應用積體電路(ASIC)透 過一種新型的硬體架構、硬體加速引擎及RISC處理器核 心的使用,提供了 IPSec封包處理的硬體加速。IPSec處理 均被提供於往內送入及往外送出的封包。本發明之IPSec _ίο _ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) (請先閱讀背面之注意事項再填寫本頁)67: MAC 68: Dark data field 69: Control information 100: Architecture 110: Main control bus 120: Main processor 130: Connected to network processor 140: Processing system 141: Interface 142: Pre-programmed sealed packet processing Subsystem 144: sealed packet processing subsystem 146: post-sealed packet processing system 148: controller subsystem 150: streaming interface 152: streaming interface 154: streaming interface 156: input external random access memory 158: Output external random access memory 306: Input DMA engine This paper size is applicable to Chinese National Standard (CNS) A4 specification (210 X 297 mm) 589846 A7 _B7_ V. Description of the invention (1) 308: Input FIFO 丨 Ning Lie 310: input encryption direct memory access engine (please read the precautions on the back before filling out this page) 312: input streaming interface 314: transmission (Tx) direct memory access interface 320: output encryption first in first out 丨Ning Lie 322: Output Direct Memory Access Engine 324: Receive (Rx) Direct Memory Access Interface 326: Streaming Interface 340: Encrypted Core Engine 342: Output Random Access Memory 352: Processing Core 354: Core Random Access Memory 350: Streaming controller 360: main interface 370: hardware accelerator 400: packet processing program 402: pre-programmed sealed packet processing operation 404: coded sealed packet processing operation 406: post-coded sealed packet processing operation 700: table 701: confidential association sequential number 702 : Secret-associated current byte counter 703: Keyword 705: Jumping flag specimen paper size applicable to Chinese National Standard (CNS) A4 (210 X 297 mm) 589846 A7 _____B7___ V. Description of the invention (<?) 708: SPI number 710: IV flag field 711: flag 712: index 713: tunnel source end address 714: destination end address 715: field 800: procedure 1000: SAD entry 1002: privacy policy serial number field 1004: IV Size field 1006: Flag field 1008: Hardware byte period field 1010: Hardware time period 1012: Keyword information indicator field 1014: RFU field 1016: Current byte period field 1018: SA Sequential Number Field Schematic Detailed Description The present invention particularly provides a system and method for improving IPSec packet processing. According to a preferred embodiment, a special application integrated circuit (ASIC) provides hardware acceleration of IPSec packet processing through the use of a new type of hardware architecture, a hardware acceleration engine, and a RISC processor core. IPSec processing is provided for both inbound and outbound packets. The IPSec of this invention _ίο _ This paper size is applicable to China National Standard (CNS) A4 specification (210 X 297 mm) (Please read the precautions on the back before filling this page)
589846 A7 ___Β7___ 五、發明說明(丫) (請先閱讀背面之注意事項再填寫本頁) 封包處理系統及方法,提供OC24全雙工及更大之資料封 包的編密、解密、發訊及檢查。本發明之IPSec封包處理 系統及方法,也提供例如使用資料編密標準(DES)、三重 DES或進階編密標準(AES)演算法的編密及解密操作。本 發明之IPSec封包處理系統及方法,也提供例如HMAC-MD5及HMAC-SHA1的訊息驗證演算法。 根據較佳實施例,本發明之IPSec封包處理系統及方 法可以被使用以”隧道”模式”傳輸”模式來實現IPSec,和實 現壓縮保密協定(ESP)及驗證標題(AH)協定。一般而言,當 IPSec之AH封包的壓縮欄位被驗證時,IPSec之ESP封包 的壓縮欄位被編密且可以被驗證。 實現本發明各種實施例之要素以架構階層下的某些情 形來說明。許多要素可以使用眾所周知的結構來建構。這 裡所說明的功能性及處理係以能夠實現該架構之功能性及 處理的一般技術的方式來說明的。 圖一係說明合適用以實現本發明較佳實施例之系統架 構的簡化功能方塊圖。架構100包括主處理器120,其係 由也連接至處理系統140之主控制匯流排110,連接至網 路處理器130。儘管其他匯流排形式也合適,主控制匯流 排110最好係PCI匯流排。處理系統140最好係用以執行 IPSec處理最佳的處理系統。處理系統140由串流介面150 的方式連接至網路處理器130。儘管UTOPIA、LX SPI-4 及其他介面形式係合適的,介面150最好係SONET封包/ 第三實體層(POS/PHY3)之形式的串流介面。IP資料封包係 ____η____ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 __ B7_ 五、發明說明(P ) 經由網路處理器130接收和傳送至外部網路。網路處理器 130提供具有可能需要IPSec處理之往外送出及往內送入 的資料封包。換言之,用於IPSec保密而格式化之往內送 入的封包係由網路處理器130所接收,且透過串流介面 150依路線發送至IPSEC處理系統140。IPSEC處理系統 140在所接收到往內送入的封包上執行IPSEC處理,且回 送所處理的封包至網路處理器130。用於IPSEC保密而格 式化之往外送出的封包係由網路處理器130所提供,在 IPSEC處理系統14〇中處理,且透過串流介面150回送至 網路處理器130。 串流介面150包括串流封包透過其由處理系統140來 接收的第一串流介面152(例如,傳送(Tx)介面)、及串流封 包透過其提供給處理系統140的第二串流介面154(例如, 接收(Rx)介面)。主處理器120係透過匯流排110和網路處 理器130及IPSEC處理系統140通訊的處理系統。匯流排 110包括至IPSec處理系統140的介面141。除此之外,主 控制匯流排110提供用於封包處理較少時間急迫性較慢路 徑功能的通訊路徑。這些功能可以包括例如保密關聯資料 庫(SAD)維護、封包移除及關於處理系統140中所執行的 IPSec處理之其他管理功能。 介面150最好係操作在大約133MHz的時脈速率之串 流隨動形式介面,以全雙工操作支援至少2.5Gbps的位元 速率處理量。PCI介面141最好係32位元66MHz的PCI 介面,其用於包括SAD入口的維護操作、封包移除、最大 _ _12_ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) (請先閱讀背面之注意事項再填寫本頁) 訂· · 線- 589846 A7 ___B7___ 五、發明說明(Η ) 傳輸單元違背及外部記憶體管理等標題操作。 (請先閱讀背面之注意事項再填寫本頁) 圖二係說明根據本發明較佳實施例之封包處理系統的 高階簡化功能方塊圖。處理系統140包括控制器子系統 148、預編密封包處理子系統142、編密封包處理子系統 144及後編密封包處理系統146。當分流介面154由系統 140提供所處理的封包時,串流介面152提供要在系統140 中處理的封包。控制器子系統148透過內部匯流排和子系 統142、144及146通訊。根據本發明之較佳實施例,預編 密封包處理系統142透過串流介面152從網路處理器130 接收封包,且執行準備用於由編密封包處理系統144所處 理之封包所需要的封包預處理。 -•線- 一般而言用於往外送出的IPSec封包,預編密封包處 理系統142在相應於區域記憶體之通道SAD入口的讀取之 後,讀取保密關聯資料庫(SAD)標籤。一位元組計數器和 循序號碼被用來更新入口。它執行封包存在時間檢核且爲 往外送出之IPSec封包建立一外部IP標題。根據本發明之 較佳實施例,處理系統140產生往外送出的IPSEC保密協 定封包,且在封包上執行編密操作之前,建立外部IPSEC 標題。用於處理往外送出之IPSec封包的程序如以下之圖 八中詳細來說明。 對於往內送入之IPSec封包,也就是包括IPSec標題( 除了別的以外)之IPSec封包,IPSEC處理系統140解析封 包之標題以定位IPSEC標題,執行封包上之存在時間檢核 ,在某些情形中歸零外部IP標題中變化的欄位,且在送出 __ 13_____ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 ___B7_ 五、發明說明(A) (請先閱讀背面之注意事項再填寫本頁) 封包至編密處理子系統144之前,加入編密控制資訊。用 以處理往內送入之IPSec封包之程序如以下之圖九中詳細 來說明。 編密封包處理子系統144在往外送出或往內送入的 IPSec封包上之IPSec封包上執行編密操作。例如對於往 外送出之封包,編密操作及/或發訊操作可以被執行。對於 往內送入之封包,解密操作及/或驗證形式操作可以被執行 〇 後編密封包處理子系統操作146,根據本發明之較佳 實施例,在編密封包處理子系統144已經處理封包之後, 執行IPSEC處理。例如對於往外送出的封包,在外部ip 標題之可變欄位(AH封包)中的數値被替換,且訊息驗證碼 可以在封包透過串流介面154送至網路處理器130之前被 加入。例如對於往內送入的封包,一 SAD入口被讀入區域 記憶體,該訊息驗證碼(MAC)被檢查,且保密檢核被執行 以檢查對於特定隧道而言,該內部IP來源位址係正確的。 另外對於往內送入的封包,在將封包透過串流介面154送 至網路處理器130之前,也會執行避免重複的檢核。使用 以執行封包處理的韌體最好存在於控制器子系統148中。 用以處理往內送入及往外送出的IPSec封包的程序係分別 於以下之圖八和圖九中來詳細說明。 圖三係說明根據本發明較佳實施例之封包處理系統的 細部功能方塊圖。輸入串流介面312提供從網路處理器 130之串流封包的接收。傳送(Tx)直接記憶存取(DMA)介面 ____14 _ 本紙張尺度適用中國國家標準(CNS)A4規格(210 x 297公釐) 589846 A7 ___B7___ 五、發明說明(〇 ) 314傳送串流封包至外部緩衝器中,如輸入外部rAM 156 所顯示。根據本發明之較佳實施例,Tx DMA介面314選 擇幾個通道之一,用以處理輸入資料封包。最不忙碌之通 道最好依據外部記憶體(156)中可獲得的緩衝器空間之數量 來選擇。輸入DMA 314係從輸入串流介面312透過幾個由 處理核心352所存取之控制暫存器,提供至輸入外部ram 156之資料封包傳送的DMA引擎。 輸入RAM裁決器304要求從包括主處理器12〇、處理 核心352、輸入DMA等多個來源存取至外部ram 156, 且允許至最高優先權要求者的存取。輸入控制器RAM 302 提供記憶體匯流排協定,以讀取和寫入輸入RAM 156。 在操作時,Tx DMA介面314接收串流保密資料封包 、選擇用以處理串流保密資料封包的通道及傳送串流保密 資料封包至外部記憶體156。當所有的串流保密封包已經 傳送至外部記憶體時,輸入DMA引擎306從外部記憶體 取回部分的串流保密資料封包。換言之,在輸入DMA引 擎之前,儲存於外部記憶體的引擎封包將被取回。輸入先 進先出佇列308從輸入DMA引擎306,以預定位元組大小 的方塊來接收部分的串流保密資料封包。封包方塊被留在 分配至所選擇的通道之部份輸入先進先出佇列308中。資 料方塊的預定大小最好係64位元組,然而其他大小也合適 。關聯隨機存取記憶體308接收關於所選擇的通道之保密 關聯資料庫SAD入口。該SAD入口由輸入DMA引擎306 從外部記憶體來取回。關聯隨機存取記憶體308也儲存其 ____15_____ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) (請先閲讀背面之注意事項再填寫本頁) . -線· 589846 A7 _____Β7_ 五、發明說明(αγ) (請先閱讀背面之注意事項再填寫本頁) 中通道之狀態資訊。輸入編密直接記憶存取引擎310提供 保密資料封包方塊至處理引擎來處理。關聯隨機存取記憶 體308,儘管顯示爲FIFO 308的一部份,其邏輯上係可分 開的’且可以當作分開的功能性元件來實現。當封包方塊 由輸入編密直接記憶存取引擎310所取回時,輸入直接記 憶存取引擎306保持先進先出佇列308排滿。 輸入直接記憶存取引擎306爲每一個通道,透過由處 理核心352之一所存取的控制暫存器,從隨機存取記憶體 156提供資料傳輸。根據本發明之較佳實施例,預編密封 包處理系統142包含複數個輸入先進先出/關聯隨機存取記 憶體308,最好每一個通道都有。輸入引擎310從輸入先 進先出/關聯隨機存取記憶體308傳送資料至編密核心引擎 340之相關緩衝器。特定的通道之資料傳輸透過它由處理 核心所存取的控制暫存器來執行。 複數個獨立的通道最好同時用以處理獨立的封包。根 據較佳實施例,八個獨立的通道處理四十個封包,其中每 個通道同時處理五個64位元的封包。應該要注意的,圖三 中所說明之架構的主要優點是它係可刻度化的,使得可以 容易地來架構以實現許多通道。在本發明之實施例中,半 個通道被配置來往內送入封包處理,同時另一半的通道則 被配置來往外送出封包處理,儘管任一種通道配置同樣係 可以合適的。 輸入外部隨機存取記憶體156及輸出外部隨機存取記 憶體158最好係64位元的DDR-SDRAM元件,其以 ___16______ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 _B7___ —__ 五、發明說明(A) 133MHz或更高的時脈週期來執行,用以緩衝封包及儲存 和封包有關的保密關聯性。 (請先閱讀背面之注意事項再填寫本頁) 每一個處理核心352最好係至少操作在20〇mHz之32 位元的RISC處理器核心。當封包通過處理系統時,在處 理核心上執行的韌體協調各種硬體組件的操作,包括以下 所說明之IPSec封包處理操作。 編密核心引擎340提供IPSEC資料封包上所執行之編 密、解密、散列、驗證及其他功能。根據本發明之較佳實 施例,多平行處理線(例如通道)被使用以接收相當高的通 訊量。編密核心引擎340透過提供各通道緩衝足夠的輸出 入先進先出佇列之串流介面,來連接至輸入編密直接記憶 存取引擎31及輸出編密先進先出佇列320。根據本發明較 佳貫施例’後編幣封包處理系統146包含複數個輸出編密 先進先出佇列320,最好每一個通道都有。 後編密封包處理系統146之操作係如以下所說明。輸 出編密先進先出佇列320從處理引擎接收所處理之保密封 包方塊,輸出直接記憶存取引擎322傳送所處理之保密封 包方塊至外部記憶體158,Rx直接記憶存取介面324在所 有的已處理保密資料封包已經傳送至外部輸出記憶體158 之後,從外部輸出記憶體158取回已處理的保密封包方塊 。Rx直接記憶存取介面324傳送已處理的保密資料封包至 串流介面來串流。Rx直接記憶存取介面324最好包括每個 複數個儲存複數個已處理保密資料封包之長度資訊的暫存 器。該Rx直接記憶存取介面324從外部記憶體158,相應 一__17___ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 ___B7 ______ 五、發明說明(J) (請先閱讀背面之注意事項再填寫本頁) 於相關的已處理保密資料封包之長度資訊得儲存’執行已 處理封包之取回操作。 輸出隨機存取記憶體342提供記億體匯流排協定’以 讀取及寫入至輸出外部隨機存取記憶體158 °隨機存取記 憶體158提供每一個通道輸出資料的儲存及緩衝。隨機存 取記憶體158也提供存取資料結構,其包括關鍵字及由編 密核心引擎340所使用來編密處理操作的其他資料。輸出 編密先進先出佇列320包含從編密核心引擎取回已處理資 料之記憶體組件。輸出直接記憶存取引擎322提供從輸出 先進先出佇列320至外部隨機存取記憶體158之資料傳輸 。每一個通道最好透過由處理核心所存取之分開的控制暫 存器來處理。輸出隨機存取記憶體328提供編密核心引擎 340及Rx直接記憶存取介面324之間輸出隨機存取記憶體 頻寬的共享。 線-589846 A7 ___ Β7 ___ V. Description of the Invention (Yah) (Please read the precautions on the back before filling this page) The packet processing system and method, which provide encryption, decryption, sending and inspection of OC24 full duplex and larger data packets . The IPSec packet processing system and method of the present invention also provide encryption and decryption operations using, for example, Data Encryption Standard (DES), Triple DES, or Advanced Encryption Standard (AES) algorithms. The IPSec packet processing system and method of the present invention also provide message authentication algorithms such as HMAC-MD5 and HMAC-SHA1. According to a preferred embodiment, the IPSec packet processing system and method of the present invention can be used to implement IPSec in a "tunnel" mode and a "transport" mode, and to implement a compression privacy agreement (ESP) and an authentication header (AH) agreement. Generally speaking, when the compression field of the IPSec AH packet is verified, the compression field of the IPSec ESP packet is encrypted and can be verified. The elements that implement the various embodiments of the present invention are illustrated in certain scenarios at the architectural level. Many elements can be constructed using well-known structures. The functionality and processing described herein are described in a way that enables the general functionality of the architecture's functionality and processing. Figure 1 is a simplified functional block diagram illustrating a system architecture suitable for implementing a preferred embodiment of the present invention. The architecture 100 includes a main processor 120 connected to a network processor 130 by a main control bus 110 also connected to the processing system 140. Although other bus forms are also suitable, the main control bus 110 is preferably a PCI bus. The processing system 140 is preferably a processing system optimal for performing IPSec processing. The processing system 140 is connected to the network processor 130 by a streaming interface 150. Although UTOPIA, LX SPI-4, and other interface formats are suitable, interface 150 is preferably a streaming interface in the form of a SONET packet / third physical layer (POS / PHY3). The IP data packet is ____ η ____ This paper size is applicable to the Chinese National Standard (CNS) A4 specification (210 X 297 mm) 589846 A7 __ B7_ V. Description of the invention (P) Received and transmitted to the external network via the network processor 130. The network processor 130 provides data packets with outbound and inbound data that may require IPSec processing. In other words, the inbound incoming packets formatted for IPSec security are received by the network processor 130 and routed to the IPSEC processing system 140 via the streaming interface 150. The IPSEC processing system 140 performs IPSEC processing on the received incoming packet, and returns the processed packet to the network processor 130. Outbound packets formatted for IPSEC confidentiality and formatting are provided by the network processor 130, processed in the IPSEC processing system 14o, and sent back to the network processor 130 through the streaming interface 150. The streaming interface 150 includes a first streaming interface 152 (eg, a transmission (Tx) interface) through which a streaming packet is received by the processing system 140 and a second streaming interface through which the streaming packet is provided to the processing system 140 154 (eg, receive (Rx) interface). The main processor 120 is a processing system that communicates with the network processor 130 and the IPSEC processing system 140 through the bus 110. The bus 110 includes an interface 141 to the IPSec processing system 140. In addition, the main control bus 110 provides a communication path for packet processing with less time and urgency and a slower path function. These functions may include, for example, confidential association database (SAD) maintenance, packet removal, and other management functions related to IPSec processing performed in the processing system 140. The interface 150 is preferably a stream follower interface operating at a clock rate of about 133 MHz, and supports a bit rate throughput of at least 2.5 Gbps with full-duplex operation. The PCI interface 141 is preferably a 32-bit 66MHz PCI interface, which is used for maintenance operations including SAD entry, packet removal, and maximum _ _12_ This paper size applies to the Chinese National Standard (CNS) A4 specification (210 X 297 mm) (Please read the precautions on the back before filling out this page) Order · · Line-589846 A7 ___B7___ V. Description of the Invention (Η) The operation of the transmission unit violates the title operation of external memory management. (Please read the precautions on the back before filling out this page.) Figure 2 is a high-level simplified functional block diagram illustrating a packet processing system according to a preferred embodiment of the present invention. The processing system 140 includes a controller subsystem 148, a pre-programmed sealed packet processing subsystem 142, an edited sealed packet processing subsystem 144, and a post-programmed sealed packet processing system 146. When the shunt interface 154 provides processed packets from the system 140, the streaming interface 152 provides packets to be processed in the system 140. Controller subsystem 148 communicates with subsystems 142, 144, and 146 via internal buses. According to a preferred embodiment of the present invention, the pre-encapsulated packet processing system 142 receives packets from the network processor 130 through the streaming interface 152, and executes the packets required to prepare the packets for processing by the encapsulation packet processing system 144. Pre-processing. -• line- Generally used for outgoing IPSec packets, the pre-programmed sealed packet processing system 142 reads the SAD tag after reading the SAD entry corresponding to the channel of the area memory. A one-byte counter and sequential number are used to update the entry. It performs a packet existence time check and establishes an external IP header for outgoing IPSec packets. According to a preferred embodiment of the present invention, the processing system 140 generates an IPSEC confidentiality agreement packet sent out, and establishes an external IPSEC header before performing the encryption operation on the packet. The procedure for processing outgoing IPSec packets is described in detail in Figure 8 below. For incoming IPSec packets, that is, IPSec packets that include IPSec headers (among other things), the IPSEC processing system 140 parses the headers of the packets to locate the IPSEC headers, and performs a time-of-life check on the packets. In some cases, Changed fields in the title of "Zero to Zero" external IP, and submitting __ 13_____ This paper size applies the Chinese National Standard (CNS) A4 specification (210 X 297 mm) 589846 A7 ___B7_ V. Description of the invention (A) (please first (Please read the note on the back and fill in this page) Before adding the packet to the encryption processing subsystem 144, add the encryption control information. The procedure for processing incoming IPSec packets is described in detail in Figure 9 below. The encrypted packet processing subsystem 144 performs an encryption operation on the IPSec packet on the IPSec packet sent out or in. For example, for packets sent out, encryption operations and / or signaling operations can be performed. For incoming packets, a decryption operation and / or a verification operation may be performed. Post-encapsulation packet processing subsystem operation 146. According to a preferred embodiment of the present invention, after the encapsulation packet processing subsystem 144 has processed the packet, , Perform IPSEC processing. For example, for outgoing packets, the number in the variable field (AH packet) of the external IP header is replaced, and the message verification code can be added before the packet is sent to the network processor 130 through the streaming interface 154. For example, for incoming packets, a SAD entry is read into the area memory, the message authentication code (MAC) is checked, and a privacy check is performed to check that for a particular tunnel, the internal IP source address is correct. In addition, for incoming packets, before the packets are sent to the network processor 130 through the streaming interface 154, a repetitive check is also performed. Firmware used to perform packet processing is preferably present in the controller subsystem 148. The procedures for processing inbound and outbound IPSec packets are described in detail in Figures 8 and 9 below. FIG. 3 is a detailed functional block diagram illustrating a packet processing system according to a preferred embodiment of the present invention. The input streaming interface 312 provides for receiving streaming packets from the network processor 130. Transmission (Tx) direct memory access (DMA) interface ____14 _ This paper size is applicable to the Chinese National Standard (CNS) A4 specification (210 x 297 mm) 589846 A7 ___B7___ 5. Description of the invention (〇) 314 Transmission stream packets to In external buffers, as shown by input external rAM 156. According to a preferred embodiment of the present invention, the Tx DMA interface 314 selects one of several channels for processing input data packets. The least busy channel is preferably selected based on the amount of buffer space available in the external memory (156). The input DMA 314 is a DMA engine that provides data packets from the input stream interface 312 to the input external ram 156 through several control registers accessed by the processing core 352. The input RAM arbiter 304 requires access to the external ram 156 from multiple sources including the main processor 120, the processing core 352, the input DMA, and allows access to the highest priority claimant. The input controller RAM 302 provides a memory bus protocol to read and write the input RAM 156. In operation, the Tx DMA interface 314 receives the stream confidential data packet, selects a channel for processing the stream confidential data packet, and transmits the stream confidential data packet to the external memory 156. When all the stream-preserving packets have been transferred to the external memory, the input DMA engine 306 retrieves a portion of the stream confidential data packets from the external memory. In other words, the engine packets stored in external memory will be retrieved before the DMA engine is input. The input first-in, first-out queue 308 receives a portion of the stream confidential data packet from the input DMA engine 306 in a predetermined byte size block. The packet block is left in the input first-in-first-out queue 308 assigned to the selected channel. The predetermined size of the data block is preferably 64 bytes, but other sizes are also suitable. Associative random access memory 308 receives the secret association database SAD entry for the selected channel. The SAD entry is retrieved from the external memory by the input DMA engine 306. Associated Random Access Memory 308 also stores its ____15_____ This paper size applies to Chinese National Standard (CNS) A4 (210 X 297 mm) (Please read the precautions on the back before filling this page). -Line · 589846 A7 _____ Β7_ V. Status information of the channel in the description of the invention (αγ) (Please read the precautions on the back before filling this page). The input encryption direct memory access engine 310 provides the confidential data packet block to the processing engine for processing. Associative random access memory 308, although shown as part of FIFO 308, is logically separable 'and can be implemented as a separate functional element. When the packet block is retrieved by the input encryption direct memory access engine 310, the input direct memory access engine 306 keeps the FIFO queue 308 full. The input direct memory access engine 306 provides data transmission from the random access memory 156 for each channel through a control register accessed by one of the processing cores 352. According to a preferred embodiment of the present invention, the pre-programmed sealed packet processing system 142 includes a plurality of input FIFO / associated random access memories 308, preferably each channel. The input engine 310 transmits data from the input first in, first out / associated random access memory 308 to the associated buffer of the encryption core engine 340. The data transmission of a specific channel is performed through the control register which is accessed by the processing core. Multiple independent channels are best used to process independent packets at the same time. According to the preferred embodiment, eight independent channels process forty packets, of which each channel processes five 64-bit packets simultaneously. It should be noted that the main advantage of the architecture illustrated in Figure 3 is that it is scalable, making it easy to architect to implement many channels. In the embodiment of the present invention, half of the channels are configured to send inward packets for processing, while the other half of the channels are configured to send out packets for processing, although any channel configuration may be appropriate. The input external random access memory 156 and the output external random access memory 158 are preferably 64-bit DDR-SDRAM components. The size of the paper is ___16______ and the Chinese National Standard (CNS) A4 specification (210 X 297 mm) (Centi) 589846 A7 _B7___ —__ 5. Description of the Invention (A) 133MHz or higher clock cycle is implemented to buffer the packets and store the confidentiality related to the packets. (Please read the precautions on the back before filling out this page) Each processing core 352 is preferably a 32-bit RISC processor core operating at least 20mHz. When a packet passes through the processing system, the firmware executed on the processing core coordinates the operations of various hardware components, including the IPSec packet processing operations described below. The encryption core engine 340 provides encryption, decryption, hashing, verification, and other functions performed on the IPSEC data packet. According to a preferred embodiment of the present invention, multiple parallel processing lines (e.g., channels) are used to receive a relatively high amount of communication. The encryption core engine 340 is connected to the input encryption direct memory access engine 31 and the output encryption first-in-first-out queue 320 by providing a streaming interface for each channel to buffer sufficient output I / O queues. According to the preferred embodiment of the present invention, the post-coded packet processing system 146 includes a plurality of output coded first-in-first-out queues 320, preferably for each channel. The post-sealed packet processing system 146 operates as described below. The output encryption first-in-first-out queue 320 receives the processed sealed packet block from the processing engine, and the output direct memory access engine 322 sends the processed sealed packet block to the external memory 158. The Rx direct memory access interface 324 After the processed confidential data packet has been transferred to the external output memory 158, the processed security packet block is retrieved from the external output memory 158. The Rx direct memory access interface 324 sends the processed confidential data packets to the streaming interface for streaming. The Rx direct memory access interface 324 preferably includes a plurality of registers each for storing length information of a plurality of processed confidential data packets. The Rx direct memory access interface 324 is from external memory 158, corresponding to a __17___ This paper size applies to China National Standard (CNS) A4 specifications (210 X 297 mm) 589846 A7 ___B7 ______ 5. Description of the invention (J) (Please (Please read the notes on the back before filling in this page.) The length information of the related processed confidential data packets can be stored. 'Perform the operation of retrieved processed packets. The output random access memory 342 provides a memory bank protocol ′ to read and write to the output external random access memory 158 ° random access memory 158 provides storage and buffering of the output data of each channel. The random access memory 158 also provides access to the data structure, which includes keywords and other data used by the encryption core engine 340 to perform encryption processing operations. Output The coded first-in-first-out queue 320 contains a memory component that retrieves processed data from the coded core engine. The output direct memory access engine 322 provides data transmission from the output first-in-first-out queue 320 to the external random access memory 158. Each channel is best handled by a separate control register accessed by the processing core. The output random access memory 328 provides the sharing of the output random access memory bandwidth between the encryption core engine 340 and the Rx direct memory access interface 324. line-
Rx直接記憶存取介面324係依直接記憶存取引擎,其 提供從輸出隨機記憶存取記憶體158至輸出串流介面156 的資料傳輸,每一個串流通道透過由處理核心所存取之控 制暫存器。當處理已經由封包處理系統140來完成時,串 流介面326提供網路處理器以接收串流資料。匯流排協定 提供關於串流資料之通道號碼的確認。 控制器子系統148包括複數個處理核心352,其提供 硬體控制及憶體資料處理。根據本發明較佳實施例,控 制器子系統148也包括複數個碼隨機存取記憶體354,每 一個均和特定的處理器核心有關。每一個碼隨機存取記憶 ______18__ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公爱) --- 589846 A7 ___B7 _ 五、發明說明(1 ) 體354提供由處理器核心352之微碼執行。根據較佳實施 例,每一個處理器核心352具有用以存取指令、硬體控制 暫存器及記憶體資料的指示匯流排控制器350。硬體加速 器370提供硬體加速,例如檢核加總操作、防止重複操作 等。硬體加速370提供硬體加速,其改善微碼中典型可達 到之效能。主介面360提供由外部主處理器120讀取/寫入 存取至結構暫存器及區域隨機存取記憶體。 圖四係說明處理根據本發明較佳實施例之封包的簡化 流程圖。封包處理程序400包括執行步驟402的預編密封 包處理操作、執行步驟406的後編密封包處理操作、及執 行步驟404的編密封包處理操作。根據本發明較佳實施例 ,程序400係由封包處理系統140(圖一)所執行。工作402 最好係由預編密封包處理子系統142(圖二)所執行,步驟 404最好係由編密封包處理子系統144(圖二)所執行,且步 驟406最好係由後編密封包處理子系統146(圖二)所執行。 在步驟402中,封包從網路處理器來接收。不同的操 作依據封包是否係往外送出或往內送入的封包來執行。對 於往外送出的封包而言,封包處理程序400根據IPSEC保 密協定實現來壓縮封包。對於往內送入的封包而言,該壓 縮被移除。圖八詳細說明往外送出的封包處理,而圖九則 詳細說明往內送入的封包處理。 圖五係說明根據本發明較佳實施例之往外送出IPSec 資料封包的簡化圖。最初,往外送出的IP資料封包50典 型上包括一個IP標題51、一上層協定(ULP)欄52及使用 _ 19___ 本紙張尺度適用中國國家標準CCNS)A4規格(210 X 297公釐) '' (請先閱讀背面之注意事項再填寫本頁) 訂·- ;線· 589846 A7 ___B7_ 五、發明說明(β ) 者資料欄53。上層協定欄52指示例如UDP或TCP/IP上 層協定。根據本發明較佳實施例,保密關聯資料庫(SAD) 標籤54在如項目50A所顯示的處理之前預先附加IP資料 封包。預編密封包處理期間,壓縮標題55及56被加入至 封包,其被稱之爲外部標題56及IPSEC標題55。往外送 出IP標題56統稱爲隧道標題。在處理步驟404(圖四)中, 使用者資料53、IP標題及ULP 52可以被編密及/或驗證, 如項目50C中暗的資料58所顯示之例子。控制資訊59預 先附加如系統使用之項目50c所顯示完整的IPSEC封包。 一標記欄位(未顯示)也可以被包括在控制資訊欄位59及外 部標題欄位56之間。如MAC 57所顯示的一驗證碼也被包 括成完整之IPSec封包的一部分。用來處理往外送出之 IPSec封包之程序如以下圖八中詳細來說明。 圖六係說明根據本發明較佳實施例之往內送入IPSec 資料封包的簡化圖。往內送入之IPSEC封包包括往外送出 之IP標題欄位66、IPSEC標題欄位65及暗的資料欄位68 。外部IP標題66統稱爲隧道標題。如MAC 67所顯示的 一驗證碼也被包括成完整之IPSec封包的一部分。控制資 訊69在編密處理之前預先附加封包。一標記欄位(未顯示) 也可以被包括在60A中外部標題欄位66之前,及在60C 中外部標題欄位61之前。在編密處理往內送入的IPSEC 資料封包之後,暗的資料導致淸除提供IP標題61、ULP 62、及使用者資料63的文字資料。如封包60C所顯示。 如這裡所使用的,暗的資料稱之爲已編密且已驗證的資料 一 _20 __ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) (請先閱讀背面之注意事項再填寫本頁) 一aj. --線_ 589846 A7 ___B7___ 五、發明說明(j ) ,或僅係已驗證的資料。用以處理往內送入之IPSec封包 的程序如以下圖九中詳細來說明。 圖七係說明用於根據本發明較佳實施例之往外送出 IPSec資料封包的保密關聯資料庫入口之簡化實例。儘管 表700係說明特定資料元素之指定位置,應該可瞭解到表 700之特定資料結構不是本發明所必要的條件。換言之, 表700之元素可以許多不同的方式來分佈及儲存。根據本 發明較佳實施例,客戶所建立的保密策略係期望能通訊的 。該保密策略建立在來源及目的位址、ULP、可允許的通 訊埠等所能夠接受的項目。該資訊最好以保密策略資料庫 (SPD)來儲存,其係期望和用以往內送入封包之保密關聯資 料庫(SAD)入口(圖十)及用以往外送出封包之保密關聯資料 庫(SAD)入口(圖七)有關。 表700包括保密關聯循序號碼701及保密關聯現態位 元組計數器702。關鍵字703係用以檢查的8位元欄位, 由網路處理器所指定之SAD入口係有效的SAD入口。跳 躍旗標705係設定確認是否從SAD入口複製或從封包的內 部標題複製跳躍欄位。旗標711包括一防止重複旗標,其 確認當循序號碼溢位時,SAD入口是否結束、一協定旗標 ,其確認IPSEC協定是否係ESP或AH協定、一網路協定 版本旗標,其確認隧道IP位址是否係IPv4或IPv6位址、 及一散列旗標,其指出散列操作是否在ESP封包上被執行 。例如,在ESP封包的情況下,一 MAC欄位將被加在封 包的末端。旗標711也包括一編密旗標,其指出ESP封包 __ 21___ P氏張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) (請先閱讀背面之注意事項再填寫本頁) >aj· •.線- 589846 A7 ___B7_ 五、發明說明(/ ) (請先閱讀背面之注意事項再填寫本頁) 是否將執行編密。其他旗標也可以包括在旗標欄位711中 。IV旗標欄位710最好係兩個位元的欄位,其指出IV大 小及當編密旗標被設定時,其爲有效的。 往外送出之SAD入口表700也包括SPI號碼708、保 密關聯關鍵字結構的指標712、隧道來源端位址713、隧道 目的端位址714及欄位715。透過以下程序800(圖八)的了 解,如表700中所顯示之元素的使用將變得很明顯。 -線- 圖八係說明處理根據本發明較佳實施例之往外送出封 包的程序之簡化流程圖。程序800最好由處理系統140結 合網路處理器130(圖一)來執行,儘管其他硬體及韌體系統 也可以係合適的。一般而言,經由從網路處理器130往外 送出的IP保密封包先經過處理系統140來做IPSec處理。 儘管程序800係根據本發明較佳實施例來說明實現IPSec 隧道協定的往外送出封包,應該能夠瞭解對於實現其他隧 道技術而言,本發明可以係同樣合用的。 在步驟802中,保密策略查閱被執行,且保密關聯資 料庫(SAD)入口位址(例如標籤)被預先附加往外送出封包。 另外,幾個標記可以被預先附加封包。最好,程序800之 步驟802及804由網路處理器130來執行,經過832(如以 下)的步驟804由處理系統140來執行。 在步驟804中,網路處理器130將往外送出IP保密封 包送至輸入串流介面,且在步驟806中,一通道被選擇用 來處理該封包。最好,最不忙碌的通道被選擇。所選擇的 通道被使用來處理整個封包,且封包送回網路處理器。整 ---22__ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 __;_B7_____ 五、發明說明(糾) (請先閱讀背面之注意事項再填寫本頁) 個封包首先被緩衝儲存在外部記憶體中(例如,圖三的記憶 體156),其係其中一部份配置給每一個通道。最好,所配 置的記憶體足夠維持至少每個通道兩個封包。根據本發明 之較佳實施例,封包大小係由特定通道之封包最大傳輸單 元(PMTU)大小來決定。根據較佳實施例,當所有通道太忙 碌於處理封包時,輸入串流介面可以調節網路處理器的流 量。 在步驟814中,SAD入口由比較以有效的SAD位址 預先附加資料封包SAD入口位址來檢核。倘若該SAD入 口係無效的,封包會被丟棄(步驟810),且該錯誤會被紀錄 (步驟812)。 在步驟816中,SAD入口上一硬體的期限檢查最好伴 隨著軟體的期限檢查來執行。硬體過期係指出編密操作所 使用的關鍵字已經超過,而軟體過期係指出新的關鍵字應 該馬上再重新核定。對於軟體過期而言,一訊息被送至網 路處理器以再重新核定關鍵字。在硬體過期的情形,封包 被丟棄(步驟810),且一錯誤被記錄(步驟812)。步驟816 也執行硬體期限位元組計數。當硬體期限位元組計數超過 時,封包被丢棄(步驟810),且一錯誤被記錄(步驟812)。 當軟體位元組計數已經超過時,一紀錄入口可以被建立。 步驟816也包括計算往外送出封包的位元組總數,其係用 以遞增SAD入口現態位元組計數。位元組總數最好包括以 下之步驟818及820所建構的壓縮標題需要之額外的位元 組。在ESP封包的情形,現態位元組計數最好由該ESP標 ___23____ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 _ B7__ 五、發明說明(〆) 題的額外長度來增加。在步驟816更新SAD入口之後’信 號控制器取回SAD入口上的”維持”。 在步驟818中,外部IP標題(例如圖五之外部標題56) ,稱之爲隧道標題,係使用從SAD入口的資訊來建構的。 根據本發明較佳實施例,外部IP標題(例如隧道標題)包括 IP版本的識別、隧道來源端及隧道目的端位址、一 IPSec 協定型態、標題長度及收費長度。對於IPv4封包而言,一 加總檢核値被計算,且寫入至外部標題。對於AH封包而 言,外部標題包括變化欄位,其被移除及儲存在關聯記憶 體308(圖一)中。 在步驟820中,一 IPSec標題(例如圖五之外部標題 55),係使用從SAD入口的資訊來建構的。該IPSec標題 最好包括至少一個保密策略定序(SPI)號碼及一個SA循序 號碼。步驟820也包括在往外送出之資料封包上的預先附 加IPSec標題及外部IP標題。另外,在步驟802中預先附 加內部IP標題之標籤,和狀態欄位一起附加至外部IP標 題。狀態欄位,例如可以係用來指示一個操作成功之32位 元欄位,且在處理中稍後當錯誤發生時被更新。 在步驟822中,初步封包最大傳輸單元(PMTU)檢查被 執行,以決定封包的長度是否爲了隧道而超過PMTU値, 包括了外部IP標題及IPSec標題。倘若PMTU値超過,該 封包最好被丟棄。最好當PMTU値超過時,封包的發出者 會被通知,例如以訊息的方式改變隧道之PMTU的長度。 在步驟822之後,控制資訊預先附加封包(例如圖五之 ____24_ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) (請先閱讀背面之注意事項再填寫本頁) 訂· 線_ 589846 A7 ______JB7_ 五、發明說明(/η) 控制資訊)。該控制資訊包括封包總長度、用以執行編密及 /或驗證操作(例如,編密及/或散列功能)之位元組偏移量、 流向及保密關聯(SA)關鍵字結構的指標。保密關聯關鍵字 結構包括隨著確認編密演算法及驗證演算法的資訊,用來 編密及/或驗證的關鍵字。編密演算法,例如可以包括但不 侷限於DES、3DES及AES。驗證演算法,例如可以包括 但不侷限於MD-5及SHA-1。 在步驟824中,封包在封包處理子系統中來處理,例 如編密封包處理子系統144(圖二)。編密核心引擎340(圖 三)通知輸入編密直接記憶存取引擎340(圖一),它準備好 處理複數個通道上的封包。輸入編密直接記憶存取引擎 340(圖一)提供編密核心引擎340(圖三)封包方塊,其係緩 衝於輸入先進先出佇列308中,且輸入直接記憶存取引擎 306操作以保持先進先出佇列308排滿。最好,封包在步 驟806中所選擇的複數個往外送出之通道之一來處理,且 封包以位元組方塊(64位元組方塊)來移入編密封包處理子 系統144。預先附加的控制資訊係由編密封包處理子系統 144用來處理封包。在ESP封包的情形中,編密操作典型 地被執行,且驗證操作可以被執行。在AH封包的情形中 ,僅有一個驗證操作典型地被執行。當編密封包處理子系 統144完成處理每一個封包方塊時,該已處理方塊被送至 輸出緩衝器。例如,輸出編密先進先出佇列320緩衝每一 個已處理方塊,且輸出直接記憶存取引擎傳送每一個已處 理方塊至外部隨機存取記憶體158。最好,輸出編密先進 _25____ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) (請先閱讀背面之注意事項再填寫本頁) 訂: ;線_ 589846 A7 __ B7 五、發明說明(4) 先出佇列320通知編密核心引擎34〇,它已經準備好要接 收已處理封包。且,輸出編密先進先出佇列320從關聯隨 機存取記憶體取回狀態資訊(包括AH封包之可變欄位), 且儲存至區域暫存器中。 在步驟826中,封包之外部IP標題被更新。在AH封 包的情形中,在步驟818中被移除之可變欄位重新被儲存 。封包總長度也從內部IP封包取回。已處理之封包方塊繼 續被緩衝且複製到配置給該通道的外部緩衝器中。最好, 如外部隨機存取記憶體158(圖三)的一外部記憶體被使用當 做外部緩衝器。編密封包處理子系統提供一狀態欄位,其 被附加至完整的封包末端,其指出在處理中錯誤何時已經 被偵測到。 在步驟828中,已處理封包的狀態欄位被檢查,且當 狀態欄位指出錯誤時,該封包被丟棄(步驟810)。當錯誤被 指出時,一錯誤記錄最好也被建立(步驟812)。當一錯誤被 指出時,步驟830被執行。在步驟830中,步驟802中附 加在第一標籤之後的狀態欄位被更新。標籤及資訊被送至 網路處理器,指出例如封包已經成功地完整被處理。當沒 有錯誤指出時,對於ESP封包而言,一訊息驗證碼 (HMAC)被附加至已處理封包,對於AH封包而言,HMAC 被插入至標題中。 當整個已處理封包係完整的且傳送至RAM 158時,然 後已處理封包方塊可以由Rx DMA控制器324來傳送至串 流介面326。在步驟832中,封包被串流至網路處理器, 26 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) (請先閱讀背面之注意事項再填寫本頁} - · 589846 A7 __B7___ 五、發明說明(A ) (請先閱讀背面之注意事項再填寫本頁) 例如使用串流介面326(圖一)以預定大小的方塊,提供部分 的已處理封包至串流介面326。步驟832完成時,封包根 據如IPSec保密協定之保密協定來壓縮。 圖九係說明處理根據本發明較佳實施例之往內送入封 包的程序之簡化流程圖。程序900最好係由處理系統140( 圖一)配合網路處理器130(圖一)來執行,儘管其他的硬體 及韌體系統也可以是合適的。一般而言,透過網路由網路 處理器130(圖一)所接收,且根據例如IPSec保密協定之特 定協定來壓縮的IP保密封包,其路徑係經由處理系統140 。儘管程序900係根據較佳實施例,用以往內送入封包實 現IPSec保密協定來說明,應該可瞭解本發明同樣適用於 實現其他的保密協定及技術。 在步驟902中,IPSec保密協定封包被確認。最好, 倘若目的位址係有關於網路處理器(例如圖一之網路處理器 130)之目的位址時,該網路處理器分析該封包標題以決定 該封包是否係一 IPSec保密封包。該封包標題也確認封包 是否係一 AH或ESP IPSec保密封包。當該封包被確認爲 IPSec保密封包時,步驟904被執行。 在步驟904中,標籤被附加至封包,於封包處理中來 使用。在步驟906中,封包被串流至輸入串流介面,且Rx DMA控制器緩衝每一封包方塊至外部記憶體。在步驟908 中,一通道被選擇用以處理封包。根據本發明較佳實施例 ,一旦通道被選擇用以處理封包,所選擇的通道用以接收 及處理每一個封包方塊。部分的外部記憶體配置給每一個 _27__ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 ___B7____ 五、發明說明(4) 通道,且每一部分最好係能夠維持在至少兩個64位元組的 封包。 (請先閱讀背面之注意事項再填寫本頁) 在整個封包被緩衝於外部記憶體中之後,封包方塊被 傳送至區域記憶體。例如輸入直接記憶存取引擎306(圖一) 將該64位元組封包方塊傳送進入輸入FIFO 308中。在工 作910中,步驟904所附加至封包的標籤被移除及儲存, 且外部IP標題(例如圖六之外部IP標題66),稱之爲隧道 標題,從往內送入之IPSec封包被移除。在工作912中, IPSec標題被分析以決定,例如,IP版本號碼(例如IPv4或 IPv6)、IPSec協定形式、標題及運載長度、及來源及/或目 的位址。具有無效或遺失標題資訊之IPSec封包最好被丟 棄(步驟917),且在步驟919中另外記錄。 步驟912也包括分析IPSec標題以決定保密策略序號 (SPI)値,其被使用來查閱相應的SAD入口。根據較佳實 施例,SPI値包括指向相應於通道保密策略資料庫之SAD 入口的指標。最好,部分的SPI値係實際的SAD入口位址 。該SPI値也包括重複使用一個SAD位址而遞增的每一個 新SAD位址之號碼部分。因此,對應重複使用或重複傳送 之SAD位址的舊封包可以被偵測。 在步驟914中,至少一部分的SAD表入口(圖十)被讀 取至區域緩衝器中。部分SAD表入口最好被讀取至部分的 區域緩衝器,其係配置給所選擇的通道,用以處理往內送 入IPSec封包。輸入直接記憶存取引擎306最好從外部記 憶體取回SAD入口,且移入部分的關聯隨機存取記憶體 ____28____ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 _ B7 _ 五、發明說明(ή ) 308,其係配置給所選擇的通道。 (請先閱讀背面之注意事項再填寫本頁) 在步驟916中,封包之外部標題及SAD入口被有效化 。隧道來源位址範圍或從SAD入口的屏罩最好和外部標題 之隧道來源位址相比較。SAD入口係藉由確認SAD入口 中的SPI號碼係正確的來檢查之(例如和封包之IPSec標題 中的SPI號碼相同)。期限檢查也依據SAD入口中硬體期 限値來執行,以決定SAD入口是否已經超過。當SAD入 口被決定已經超過時,封包最好將被丟棄(步驟917)且一錯 誤記錄被建立。 步驟916也包括在AH封包的情況下儲存外部標題總 長度,淸除外部標題中的可變欄位。該可變欄位包括在外 部標題中,其在封包傳送過程中可以改變,且因此不能夠 被使用來驗證。 在步驟918中,控制資訊被附加至第一封包方塊的開 端。該控制資訊最好係三個雙字組且包含用於散列及解密 起始點、流向(例如指出往內送入或往外送出)及相應於 SAD入口之SA關鍵字結構指標的封包長度、位元組偏移 量。 在步驟920中,封包被處理。根據本發明之較佳實施 例,步驟920係由編密封包處理子系統144(圖二)來執行, 經過918的步驟908係由預編密封包處理子系統142(圖二) 來執行,且經過938的步驟9〗2係由後編密處理子系統 146(圖二)來執行。 於處理期間,輸入編密直接記憶存取引擎310傳送封 ______29_____ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 ____B7_ 五、發明說明(J) (請先閱讀背面之注意事項再填寫本頁) 包方塊,以緩衝於編密核心引擎340中等待處理。步驟 920的一部分,外部標題及IPSec標題和任何結尾(例如 ESP結尾)及附加段一起被移除。例如,ESP封包可以指定 額外的附加段,其係附加於已編密的IP封包。在這種情形 下,例如內部IP標題之收費長度和所期望的長度相比較以 偵測附加段。對於ESP封包的情形,該附加段在解密之前 被移除。 步驟920最好由執行方塊上的編密操作,以位元組方 塊(64位元組方塊)來處理IP封包。視封包是否被確認爲 AH封包或ESP封包而定,該編密操作可以包括一驗證操 作或解密及/或驗證操作。用於編密操作之關鍵字及演算法 由SAD入口來確認。步驟920寫入已處理的封包方塊至輸 出編密先進先出佇列320,且輸出直接記憶存取引擎322 傳送已處理方塊至外部隨機存取記憶體158。步驟920的 完成導致一 IP保密封包實質以封包60C(圖六)的形式,緩 衝至外部隨機存取記憶體158。ESP封包被編密(例如內部 標題及資料欄位被編密),且驗證最好被外加至已編密部份 。AH封包具有外加至外部標題及壓縮部份的驗證。因爲 在封包傳送期間,外部標題部份被改變,該欄位可能已經 改變,稱之爲可變化欄位,在AH封包上於驗證之前歸零 被執行。 在步驟922中,標籤被儲存至封包的開端且狀態字被 插入,最好在第一標籤之後。當封包完成處理,該狀態字 由編密處理子系統來使用,以指出處理錯誤是否已經發生 ___30______ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) 589846 A7 ___ B7_ 五、發明說明(1 ) Ο 在步驟924中,IP標題中的TTL/跳躍計數値被更新, 且在遞減TTL之後,標題總和檢查被計算。該總和計算最 好由硬體累積器來執行。 在整個封包處理之後,步驟926被執行。在步驟926 中,狀態字被檢查,以決定步驟920中錯誤是否被偵測到 。該狀態字也可以指出HMAC比較錯誤何時被偵測到。倘 若一錯誤已經被偵測,步驟930被執行,且封包最好被丟 棄(步驟917),而一錯誤記錄入口最好被建立(步驟919)。 在步驟930中,步驟922中和狀態字一起附加至封包的第 一標籤被更新,且被送至網路處理器。 在步驟932中,執行保密策略檢查。來源位址最好在 內部IP標題中來確認,其現在不再被壓縮,和相應的SAD 入口中來源位址範圍相比較。當封包不符合保密策略檢查 時,封包最好被丟棄(步驟917),一錯誤記錄被建立(步驟 919),且最好被送至網路處理器。 在步驟934中,一防止重複檢核被執行以檢查重複的 封包不會被接收。當封包不符合保密策略檢查時,封包最 好被丟棄(步驟917),一錯誤記錄被建立(步驟919),且最 好被送至網路處理器。 在步驟936中,SAD入口中現態位元組計數欄位和防 止重複欄位一起被更新。在步驟938中,已處理封包方塊 從外部記憶體被傳送至配置給所選擇之通道的緩衝器(例如 Rx DMA控制器324),且輸出串流介面被通知,封包已經 _ 31_________ 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) <請先閱讀背面之注意事項再填寫本頁) 訂-· 線- 589846 A7 ______B7______ 五、發明說明(V。) 準備好被串流至網路處理器。當整個已處理封包被完成且 傳送至外部隨機存取記憶體158時,然後已處理方塊最好 由Rx DMA控制器324來傳送至串流介面326。在步驟 938,封包被串流至網路處理器,例如使用串流介面326( 圖三)。Rx DMA控制器324(圖一)以預先決定的大小,提 供部分已處理封包至串流介面326。 當程序900完成時,輸入IP保密封包不再根據保密協 定來壓縮。圖三之硬體結構中所實現的程序800及900最 好係以組合語言碼來實現。應該注意的是,本發明的一項 主要優點係其處理核心不會影響在程序800及900的許多 步驟之效能。 圖十係說明用於根據本發明較佳實施例之往內送入 IPSec資料封包的保密關聯資料庫(SAD)入口之簡化實例。 往內送入之SAD入口 1000根據程序900(圖九),被使用來 處理往內送入的IPSec保密協定封包。儘管圖十係僅說明 一個SAD入口,應該瞭解到對於由系統所實現的每一個保 密策略,其保密關聯資料庫係包含往內送入SAD入口。 SAD入口 1000包括保密策略序號欄位1〇〇2,用以儲存 SPI號碼及IV大小攔位1004及一個旗標欄位1006。該旗 標欄位包括幾個旗標,例如防止重複旗標指出防止重複服 務何時被致能、協定旗標指出ESP或AH協定是否被選擇 、散列旗標用於ESP協定以指出驗證是否包括在封包、編 密旗標用於ESP封包以指出編密何時在封包上被執行、範 圍旗標指出來源範圍何時係一個範圍或子網路屏罩、版本 32 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) -- (請先閱讀背面之注意事項再填寫本頁) 一SJ. 589846 A7 ___B7_ 五、發明說明(呶) 旗標指出來源位址是否爲IPv4或IPv6、及預編密錯誤旗標 用以指出編密處理中所偵測到的錯誤。 SAD入口 1000也包括硬體位元組期限欄位1〇〇8、硬 體時間期限1010、關鍵字資訊指標欄位1012、RFU欄位 1014、現態位元組期限欄位1016及SA循序號碼欄位1018 〇 SAD入口 1000也包括防止重複屏罩1020、來源範圍/ 屏罩欄位1022、RFU欄位1024及IPv4位址和IPv6位址 欄位1026。 因此已經說明了一種改良式封包處理系統及處理封包 之方法。IPSec保密封包實質以至少是OC4資料速率所提 供之硬體來處理。本發明的封包處理系統可調整大小,使 得許多通道可以同時來處理。 特定實施例的前述說明將完全揭示本發明的一般特性 ,以致藉由應用目前的知識,可很容易地修改及/或調整該 等特定實施例,而用於各種應用,且不脫離一般性的觀念 ,所以在所揭示之實施例之均等物含意和範圍內,這此些 調整及修改應該可理解。 應該瞭解這裡所使用的用辭及術語,係用以說明的目 的,而不侷限於此。因此,本發明包含符合申請專利範圍 的精神及範圍內的所有變化、修改、均等物及改變形式。 _;_33 本紙張尺度適用中國國家標準(CNS)A4規格(210 X 297公釐) (請先閱讀背面之注意事項再填寫本頁) ;# i線·The Rx direct memory access interface 324 is based on the direct memory access engine, which provides data transmission from the output random access memory 158 to the output stream interface 156. Each stream channel is controlled by the access by the processing core. Register. When processing has been completed by the packet processing system 140, the streaming interface 326 provides a network processor to receive streaming data. Bus Protocol Provides confirmation of the channel number of the streaming data. The controller subsystem 148 includes a plurality of processing cores 352, which provide hardware control and memory data processing. According to a preferred embodiment of the present invention, the controller subsystem 148 also includes a plurality of code random access memories 354, each of which is associated with a particular processor core. Random access memory for each code ______18__ This paper size applies to China National Standard (CNS) A4 specification (210 X 297 public love) --- 589846 A7 ___B7 _ V. Description of the invention (1) Body 354 provided by processor core 352 Microcode execution. According to a preferred embodiment, each processor core 352 has an instruction bus controller 350 for accessing instructions, hardware control registers, and memory data. The hardware accelerator 370 provides hardware acceleration, such as checking and summing operations, preventing repeated operations, and the like. Hardware acceleration 370 provides hardware acceleration, which improves performance typically achievable in microcode. The main interface 360 provides read / write access to the structure register and the area random access memory by the external main processor 120. FIG. 4 is a simplified flowchart illustrating processing of a packet according to a preferred embodiment of the present invention. The packet processing program 400 includes a pre-edited sealed packet processing operation that performs step 402, a post-edited sealed packet processing operation that performs step 406, and a compiled-seal packet processing operation that performs step 404. According to a preferred embodiment of the present invention, the program 400 is executed by the packet processing system 140 (FIG. 1). Job 402 is preferably performed by pre-programmed sealed packet processing subsystem 142 (Figure 2), step 404 is preferably performed by edited sealed packet processing subsystem 144 (Figure 2), and step 406 is preferably performed by post-programmed sealing The packet processing subsystem 146 (Figure 2) is executed. In step 402, the packet is received from the network processor. Different operations are performed based on whether the packet is an outbound or inbound packet. For outgoing packets, the packet processing program 400 compresses the packets according to the implementation of the IPSEC encryption protocol. For incoming packets, the compression is removed. Figure 8 details the processing of outgoing packets, and Figure 9 details the processing of incoming packets. FIG. 5 is a simplified diagram illustrating outgoing IPSec data packets according to a preferred embodiment of the present invention. Initially, an IP data packet 50 sent out typically includes an IP header 51, an upper-layer agreement (ULP) column 52, and use_ 19___ This paper size applies the Chinese National Standard CCNS) A4 specification (210 X 297 mm) '' ( Please read the notes on the back before filling this page.) Order ·-; line · 589846 A7 ___B7_ V. Inventor's Note (β) Information Box 53. The upper layer protocol column 52 indicates, for example, a UDP or TCP / IP upper layer protocol. According to a preferred embodiment of the present invention, the security association database (SAD) tag 54 is pre-attached with an IP data packet before processing as shown in item 50A. During pre-sealed packet processing, compressed headers 55 and 56 are added to the packet, which are referred to as external headers 56 and IPSEC headers 55. The outgoing IP header 56 is collectively called the tunnel header. In processing step 404 (Figure 4), the user information 53, the IP title and the ULP 52 may be encrypted and / or verified, as shown in the dark information 58 in item 50C. The control information 59 is pre-attached with a complete IPSEC packet as shown in item 50c used by the system. A marker field (not shown) may also be included between the control information field 59 and the external title field 56. A verification code as shown in MAC 57 is also included as part of the complete IPSec packet. The procedure for processing outgoing IPSec packets is described in detail in Figure 8 below. FIG. 6 is a simplified diagram illustrating an inbound IPSec data packet according to a preferred embodiment of the present invention. The inbound IPSEC packet includes an IP header field 66, an IPSEC header field 65, and a dark data field 68 that are sent out. The external IP header 66 is collectively called a tunnel header. A verification code as shown in MAC 67 is also included as part of the complete IPSec packet. The control information 69 attaches a packet before the encryption processing. A marker field (not shown) may also be included before the external title field 66 in 60A and before the external title field 61 in 60C. After encrypting and processing the IPSEC data packets sent in, the dark data resulted in the erasure of the textual information of the IP header 61, ULP 62, and user data 63. As shown in packet 60C. As used here, the dark data is called compiled and verified data. _20 __ This paper size applies to China National Standard (CNS) A4 (210 X 297 mm). (Please read the note on the back first Please fill in this page again for matters) aj. --Line_ 589846 A7 ___B7___ 5. Description of invention (j), or only verified information. The procedure for processing incoming IPSec packets is described in detail in Figure 9 below. FIG. 7 illustrates a simplified example of a security association database entry for sending out IPSec data packets according to a preferred embodiment of the present invention. Although table 700 illustrates the specified locations of specific data elements, it should be understood that the specific data structure of table 700 is not a requirement of the present invention. In other words, the elements of table 700 can be distributed and stored in many different ways. According to the preferred embodiment of the present invention, the privacy policy established by the customer is expected to be able to communicate. This confidentiality policy is based on acceptable items such as source and destination addresses, ULPs, and allowable communication ports. The information is best stored in the privacy policy database (SPD), which is the secret related database (SAD) entry (Figure 10) that is expected and used to send packets into the past, and the confidential related database (packed in the past) SAD) entrance (Figure 7). The table 700 includes a security association sequential number 701 and a security association status byte counter 702. The keyword 703 is an 8-bit field for checking. The SAD entry specified by the network processor is a valid SAD entry. The jump flag 705 is set to confirm whether to copy the jump field from the SAD entry or the internal header of the packet. The flag 711 includes a repetition prevention flag, which confirms whether the SAD entry ends when a sequential number overflows, an agreement flag, which confirms whether the IPSEC protocol is an ESP or AH agreement, a network protocol version flag, which confirms Whether the tunnel IP address is an IPv4 or IPv6 address, and a hash flag indicating whether the hash operation is performed on the ESP packet. For example, in the case of an ESP packet, a MAC field will be added at the end of the packet. The flag 711 also includes a secret flag, which states that the ESP packet __ 21___ P-scale is applicable to the Chinese National Standard (CNS) A4 specification (210 X 297 mm) (Please read the precautions on the back before filling this page ) > aj · • .line-589846 A7 ___B7_ V. Description of the invention (/) (Please read the notes on the back before filling this page) Will it be compiled? Other flags may also be included in the flag field 711. The IV flag field 710 is preferably a two-bit field, which indicates the IV size and is valid when the secret flag is set. The SAD entry table 700 sent out also includes the SPI number 708, the index 712 of the key structure of the security association key, the tunnel source end address 713, the tunnel destination end address 714, and the field 715. Through the understanding of the following procedure 800 (Figure 8), the use of elements as shown in Table 700 will become apparent. -Line- FIG. 8 is a simplified flowchart illustrating a procedure for processing an outbound packet according to a preferred embodiment of the present invention. The program 800 is preferably executed by the processing system 140 in conjunction with the network processor 130 (Figure 1), although other hardware and firmware systems may be suitable. Generally speaking, the IP-encapsulated packet sent out from the network processor 130 first passes through the processing system 140 for IPSec processing. Although the program 800 is used to describe the implementation of the IPSec tunneling protocol to send outbound packets according to the preferred embodiment of the present invention, it should be understood that the present invention can be equally applicable to the realization of other tunneling technologies. In step 802, a security policy lookup is performed, and a security association database (SAD) entry address (e.g., a tag) is pre-attached to send out a packet. In addition, several tags can be pre-packed. Preferably, steps 802 and 804 of the program 800 are executed by the network processor 130, and step 804 after 832 (as described below) is executed by the processing system 140. In step 804, the network processor 130 sends the outbound IP-secured packet to the input stream interface, and in step 806, a channel is selected to process the packet. The best and least busy channel is chosen. The selected channel is used to process the entire packet and the packet is sent back to the network processor. --22__ This paper size applies Chinese National Standard (CNS) A4 specification (210 X 297 mm) 589846 A7 __; _B7_____ V. Description of the invention (correction) (Please read the precautions on the back before filling this page) The packet is first buffered and stored in external memory (for example, memory 156 in FIG. 3), and a part of the packet is allocated to each channel. Preferably, the memory is configured to hold at least two packets per channel. According to a preferred embodiment of the present invention, the packet size is determined by the maximum transmission unit (PMTU) size of the packet for a particular channel. According to a preferred embodiment, when all channels are too busy processing packets, the input streaming interface can regulate the network processor's traffic. In step 814, the SAD entry is checked by comparing the SAD entry address with a valid SAD address in advance and appending the data packet in advance. If the SAD entry is invalid, the packet is discarded (step 810), and the error is recorded (step 812). In step 816, a hardware deadline check on the SAD portal is preferably performed in conjunction with a software deadline check. Hardware expiration indicates that the keywords used for the encryption operation have been exceeded, while software expiration indicates that new keywords should be re-approved immediately. For software expiration, a message is sent to the network processor to re-verify the keywords. In the case of hardware expiration, the packet is discarded (step 810) and an error is recorded (step 812). Step 816 also performs hardware term byte counting. When the hardware deadline byte count exceeds, the packet is discarded (step 810) and an error is recorded (step 812). When the software byte count has been exceeded, a log entry can be created. Step 816 also includes calculating the total number of bytes sent out of the packet, which is used to increment the current byte count of the SAD entry. The total number of bytes preferably includes the additional bytes required for the compressed header constructed in steps 818 and 820 below. In the case of ESP packets, the current byte count is best marked by the ESP ___23____ This paper size applies the Chinese National Standard (CNS) A4 specification (210 X 297 mm) 589846 A7 _ B7__ V. Description of the invention (〆) Additional length of questions to increase. After updating the SAD entry in step 816, the 'signal controller retrieves "maintenance" on the SAD entry. In step 818, the external IP header (such as the external header 56 in FIG. 5), which is called a tunnel header, is constructed using the information from the SAD entry. According to a preferred embodiment of the present invention, the external IP header (such as the tunnel header) includes the identification of the IP version, the address of the tunnel source end and the tunnel destination end, an IPSec protocol type, the length of the header, and the length of the charge. For IPv4 packets, the one-to-one checksum is calculated and written to the external header. For AH packets, the external header includes a change field, which is removed and stored in associative memory 308 (Figure 1). In step 820, an IPSec header (such as the external header 55 in FIG. 5) is constructed using information from the SAD entry. The IPSec header preferably includes at least a privacy policy sequence (SPI) number and an SA sequence number. Step 820 also includes pre-adding an IPSec header and an external IP header on the outgoing data packet. In addition, in step 802, a tag of an internal IP header is attached in advance, and an external IP title is attached together with a status field. The status field, for example, can be a 32-bit field used to indicate the success of an operation, and is updated later when an error occurs during processing. In step 822, a preliminary packet maximum transmission unit (PMTU) check is performed to determine whether the length of the packet exceeds the PMTU for the tunnel, including the external IP header and the IPSec header. If PMTU 値 is exceeded, the packet is best discarded. It is better that when the PMTU is exceeded, the sender of the packet will be notified, such as changing the PMTU length of the tunnel in a message. After step 822, the control information is pre-packed (for example, ____24_ in Figure 5) This paper size applies the Chinese National Standard (CNS) A4 specification (210 X 297 mm) (Please read the precautions on the back before filling this page) Order · Line _ 589846 A7 ______JB7_ V. Description of the invention (/ η) Control information). The control information includes the total packet length, byte offsets used to perform encryption and / or verification operations (e.g., encryption and / or hashing functions), flow direction, and indicators of confidentiality association (SA) keyword structure . The confidential association keyword structure includes keywords used for encryption and / or verification with confirmation of the encryption algorithm and verification algorithm information. The encryption algorithm can include, but is not limited to, DES, 3DES, and AES. The verification algorithm may include, but is not limited to, MD-5 and SHA-1. In step 824, the packet is processed in the packet processing subsystem, such as the sealed packet processing subsystem 144 (Figure 2). The encryption core engine 340 (Figure 3) notifies the input encryption direct memory access engine 340 (Figure 1) that it is ready to process packets on multiple channels. The input encryption direct memory access engine 340 (Figure 1) provides a packet encryption core engine 340 (Figure 3) packet block, which is buffered in the input FIFO queue 308, and the input direct memory access engine 306 operates to maintain The first-in-first-out queue 308 was full. Preferably, the packet is processed in one of the plurality of outgoing channels selected in step 806, and the packet is moved into a byte-sealed packet processing subsystem 144 in byte blocks (64-bit blocks). The pre-attached control information is used by the coding packet processing subsystem 144 to process packets. In the case of ESP packets, encryption operations are typically performed, and verification operations can be performed. In the case of AH packets, only one verification operation is typically performed. When the encoded packet processing subsystem 144 finishes processing each packet block, the processed block is sent to the output buffer. For example, the output encryption first-in-first-out queue 320 buffers each processed block, and the output direct memory access engine sends each processed block to the external random access memory 158. Best, advanced output coding _25____ This paper size is applicable to China National Standard (CNS) A4 (210 X 297 mm) (Please read the precautions on the back before filling this page) Order:; line _ 589846 A7 __ B7 V. Description of the invention (4) The queue 320 is first notified to the encryption core engine 34, and it is ready to receive the processed packet. In addition, the output encryption first-in-first-out queue 320 retrieves status information (including the variable field of the AH packet) from the associated random access memory and stores it in the area register. In step 826, the external IP header of the packet is updated. In the case of the AH packet, the variable field removed in step 818 is stored again. The total packet length is also retrieved from the internal IP packet. The processed packet blocks continue to be buffered and copied to the external buffer allocated to the channel. Preferably, an external memory such as external random access memory 158 (Figure 3) is used as an external buffer. The coded packet processing subsystem provides a status field, which is appended to the end of the complete packet and indicates when an error has been detected during processing. In step 828, the status field of the processed packet is checked, and when the status field indicates an error, the packet is discarded (step 810). When errors are pointed out, an error record is also preferably created (step 812). When an error is indicated, step 830 is performed. In step 830, the status field added after the first tag in step 802 is updated. The tags and information are sent to the network processor, indicating that, for example, the packet has been successfully processed completely. When no error is indicated, for ESP packets, a message authentication code (HMAC) is appended to the processed packet, and for AH packets, the HMAC is inserted into the header. When the entire processed packet is complete and transferred to the RAM 158, the processed packet block may then be transferred by the Rx DMA controller 324 to the streaming interface 326. In step 832, the packet is streamed to the network processor. 26 This paper size applies the Chinese National Standard (CNS) A4 specification (210 X 297 mm) (Please read the precautions on the back before filling out this page}-· 589846 A7 __B7___ 5. Description of the Invention (A) (Please read the notes on the back before filling out this page) For example, use the streaming interface 326 (Figure 1) to provide a portion of the processed packets to the streaming interface 326 When step 832 is completed, the packet is compressed according to a confidentiality agreement such as the IPSec confidentiality agreement. Figure 9 is a simplified flowchart illustrating a procedure for processing an incoming packet according to a preferred embodiment of the present invention. The procedure 900 is preferably processed. System 140 (Figure 1) is implemented in conjunction with network processor 130 (Figure 1), although other hardware and firmware systems may be suitable. Generally speaking, network processor 130 (Figure 1) is routed through the network The IP security sealed packet received and compressed according to a specific protocol such as the IPSec confidentiality agreement is routed through the processing system 140. Although the procedure 900 is based on the preferred embodiment, the IPSec security is implemented by sending packets in the past. Agreement to explain, it should be understood that the present invention is equally applicable to the implementation of other confidentiality agreements and technologies. In step 902, the IPSec confidentiality agreement packet is confirmed. Preferably, if the destination address is related to the network processor (for example, Figure 1) When the destination address of the network processor 130), the network processor analyzes the packet header to determine whether the packet is an IPSec sealed packet. The packet header also confirms whether the packet is an AH or ESP IPSec sealed packet. When When the packet is confirmed as an IPSec sealed packet, step 904 is performed. In step 904, a label is attached to the packet and used in the packet processing. In step 906, the packet is streamed to the input stream interface, and Rx The DMA controller buffers each packet block to external memory. In step 908, a channel is selected for processing packets. According to a preferred embodiment of the present invention, once a channel is selected for processing packets, the selected channel is used for Receive and process each packet block. Part of the external memory is allocated to each _27__ This paper size applies to China National Standard (CNS) A4 specifications (2 10 X 297 mm) 589846 A7 ___B7____ 5. Description of the invention (4) The channel, and each part should be able to maintain at least two 64-byte packets. (Please read the precautions on the back before filling this page) After the entire packet is buffered in external memory, the packet block is transferred to regional memory. For example, the input direct memory access engine 306 (Figure 1) transfers the 64-byte packet block into the input FIFO 308. At work In 910, the label attached to the packet in step 904 is removed and stored, and the external IP header (for example, the external IP header 66 in FIG. 6) is called a tunnel header, and the IPSec packet sent inward is removed. In job 912, the IPSec header is analyzed to determine, for example, the IP version number (e.g., IPv4 or IPv6), the IPSec protocol form, the header and carrying length, and the source and / or destination address. The IPSec packets with invalid or missing header information are preferably discarded (step 917) and recorded separately in step 919. Step 912 also includes analyzing the IPSec header to determine the privacy policy sequence number (SPI), which is used to look up the corresponding SAD entry. According to a preferred embodiment, the SPI (R) includes pointers to SAD entries corresponding to the channel privacy policy database. Preferably, part of the SPI is the actual SAD entry address. The SPI frame also includes the number portion of each new SAD address that is incremented by reusing an SAD address. Therefore, old packets corresponding to the reused or repeatedly transmitted SAD address can be detected. In step 914, at least a part of the SAD table entry (Figure 10) is read into the area buffer. Part of the SAD table entry is preferably read into part of the area buffer, which is allocated to the selected channel for processing incoming IPSec packets. The input direct memory access engine 306 is best to retrieve the SAD entry from the external memory and move the part of the associated random access memory ____28____ This paper size applies to the Chinese National Standard (CNS) A4 specification (210 X 297 mm) 589846 A7 _ B7 _ V. Invention description (price) 308, which is allocated to the selected channel. (Please read the notes on the back before filling this page) In step 916, the external header and SAD entry of the packet are validated. The tunnel source address range or the mask from the SAD entrance is best compared with the tunnel source address of the external title. The SAD entry is checked by confirming that the SPI number in the SAD entry is correct (for example, the same as the SPI number in the IPSec header of the packet). The deadline check is also performed based on the hardware deadline in the SAD entry to determine whether the SAD entry has been exceeded. When the SAD entry is determined to have been exceeded, the packet is preferably discarded (step 917) and an error record is created. Step 916 also includes storing the total length of the external header in the case of the AH packet, and eliminating the variable fields in the external header. This variable field is included in the external header, which can be changed during packet transmission and therefore cannot be used for verification. In step 918, control information is appended to the beginning of the first packet block. The control information is preferably three double words and contains the starting point for hashing and decryption, the flow direction (for example, indicating inward or outward), and the length of the packet corresponding to the SA keyword structure index of the SAD entry, Byte offset. In step 920, the packet is processed. According to a preferred embodiment of the present invention, step 920 is performed by the compiled sealed packet processing subsystem 144 (Figure 2), and step 908 after 918 is performed by the pre-programmed sealed packet processing subsystem 142 (Figure 2), and Step 9 through step 938 2 is executed by the post-encryption processing subsystem 146 (Figure 2). During processing, the input encryption direct memory access engine 310 transmits the envelope ______29_____ This paper size applies the Chinese National Standard (CNS) A4 specification (210 X 297 mm) 589846 A7 ____B7_ V. Description of the invention (J) (Please read first Note on the back, please fill in this page again) to wrap the box to buffer in the encryption core engine 340 and wait for processing. As part of step 920, the external header and the IPSec header are removed along with any endings (such as ESP endings) and additional segments. For example, an ESP packet may specify an additional additional segment, which is appended to the encrypted IP packet. In this case, for example, the charge length of the internal IP header is compared with the expected length to detect additional segments. In the case of ESP packets, this additional segment is removed before decryption. Step 920 preferably performs an encryption operation on the block to process the IP packet in a byte block (64-byte block). Depending on whether the packet is confirmed as an AH packet or an ESP packet, the encryption operation may include a verification operation or a decryption and / or verification operation. The keywords and algorithms used for the encryption operation are confirmed by the SAD entry. Step 920 writes the processed packet block to the output encryption first-in-first-out queue 320, and outputs the direct memory access engine 322 to transmit the processed block to the external random access memory 158. The completion of step 920 causes an IP-secured sealed packet to be buffered to the external random access memory 158 in the form of a packet 60C (Figure 6). ESP packets are encrypted (for example, internal headers and data fields are encrypted), and authentication is preferably added to the encrypted part. AH packets have authentication added to the external header and compression. Because the external header part is changed during the packet transmission, this field may have been changed. It is called a changeable field, and it is executed before the AH packet is reset to zero. In step 922, the tag is stored to the beginning of the packet and the status word is inserted, preferably after the first tag. When the packet is processed, the status word is used by the encryption processing subsystem to indicate whether a processing error has occurred. ___30______ This paper size applies the Chinese National Standard (CNS) A4 specification (210 X 297 mm) 589846 A7 ___ B7_ 5 2. Description of the invention (1) In step 924, the TTL / jump count 値 in the IP header is updated, and after the TTL is decremented, the header sum check is calculated. This sum calculation is best performed by a hardware accumulator. After the entire packet processing, step 926 is performed. In step 926, the status word is checked to determine whether the error was detected in step 920. This status word can also indicate when an HMAC comparison error is detected. If an error has been detected, step 930 is performed and the packet is preferably discarded (step 917), and an error record entry is preferably established (step 919). In step 930, the first label attached to the packet with the status word in step 922 is updated and sent to the network processor. In step 932, a privacy policy check is performed. The source address is best identified in the internal IP header, it is no longer compressed and compared to the range of source addresses in the corresponding SAD entry. When the packet does not comply with the privacy policy check, the packet is preferably discarded (step 917), an error record is created (step 919), and it is preferably sent to the network processor. In step 934, a duplicate check is performed to check that duplicate packets will not be received. When the packet does not comply with the privacy policy check, the packet is preferably discarded (step 917), an error record is created (step 919), and preferably sent to the network processor. In step 936, the current byte count field in the SAD entry is updated together with the prevent duplicate field. In step 938, the processed packet block is transferred from the external memory to the buffer allocated to the selected channel (such as the Rx DMA controller 324), and the output stream interface is notified that the packet has been _ 31_________ This paper standard applies China National Standard (CNS) A4 Specification (210 X 297 mm) < Please read the notes on the back before filling this page) Order-· Line-589846 A7 ______B7______ V. Description of Invention (V.) Ready to be streamed To the network processor. When the entire processed packet is completed and transmitted to the external random access memory 158, the processed block is then preferably transmitted to the streaming interface 326 by the Rx DMA controller 324. At step 938, the packet is streamed to a network processor, such as using a streaming interface 326 (Figure 3). The Rx DMA controller 324 (Figure 1) provides a portion of the processed packets to the streaming interface 326 in a predetermined size. When the procedure 900 is completed, the input IP security package is no longer compressed according to the confidentiality agreement. The programs 800 and 900 implemented in the hardware structure of FIG. 3 are preferably implemented by combining language codes. It should be noted that a major advantage of the present invention is that its processing core does not affect the performance of many of the steps in procedures 800 and 900. FIG. 10 illustrates a simplified example of a security association database (SAD) entry for inwardly entering an IPSec data packet according to a preferred embodiment of the present invention. The incoming SAD entry 1000 is used to process incoming IPSec confidential agreement packets according to the procedure 900 (Figure 9). Although Figure 10 only illustrates one SAD entry, it should be understood that for each security policy implemented by the system, its confidential association database contains the SAD entry that is sent inward. The SAD entry 1000 includes a privacy policy serial number field 1002, which is used to store the SPI number and IV size block 1004 and a flag field 1006. The flag field includes several flags, such as the duplicate prevention flag indicating when duplicate prevention is enabled, the agreement flag indicating whether the ESP or AH agreement is selected, and the hash flag used in the ESP agreement to indicate whether verification includes The packet and encryption flags are used in ESP packets to indicate when encryption is performed on the packets, and the range flag indicates when the source range is a range or subnet mask. Version 32 ) A4 specification (210 X 297 mm)-(Please read the notes on the back before filling this page) One SJ. 589846 A7 ___B7_ V. Description of the invention (呶) The flag indicates whether the source address is IPv4 or IPv6, And pre-encryption error flags are used to indicate errors detected during the encryption process. The SAD entry 1000 also includes a hardware byte term field 1008, a hardware time term 1010, a keyword information indicator field 1012, an RFU field 1014, a current byte term field 1016, and an SA sequential number field Bit 1018. The SAD entry 1000 also includes a duplicate prevention mask 1020, a source range / mask field 1022, an RFU field 1024, and an IPv4 address and IPv6 address field 1026. Therefore, an improved packet processing system and method for processing packets have been described. The IPSec security packet is essentially processed in hardware provided by at least the OC4 data rate. The packet processing system of the present invention can be resized so that many channels can be processed simultaneously. The foregoing description of specific embodiments will fully reveal the general characteristics of the present invention, so that by applying current knowledge, these specific embodiments can be easily modified and / or adjusted for various applications without departing from the general These adjustments and modifications should be understandable within the meaning and scope of the equivalents of the disclosed embodiments. It should be understood that the terminology and terminology used herein are for the purpose of illustration and are not limited thereto. Therefore, the present invention includes all changes, modifications, equivalents, and altered forms within the spirit and scope of the scope of the patent application. _; _ 33 This paper size applies to China National Standard (CNS) A4 (210 X 297 mm) (Please read the precautions on the back before filling this page); # i 线 ·