Network state Processor memory Security Coprocessor Line interface PHY/MAC Outgoing Incoming traffic traffic FIGURE 17.11 A security coprocessor sitting next to an NPU in a look-aside architecture Switch Fabric Host CPU Interface subsystem Network Processor SDRAM PCI bus session state memory Security Coprocessor Line interface Outgoing PHY/MAC Incoming traffic traffic FIGURE 17.12 A security coprocessor sitting next to a network processor in a flow- through architecture The security processor will need access to the data associated with the secure session such as the keys, policies, and parameters. This usually requires a storage capacity per session of up to a few hun- dreds of bytes. In many cases where the number of sessions is limited, if the security coprocessor chip contains on-chip memory this information can be stored on-chip where it is both convenient and relatively safe. However, when several sessions (tens of thousands, if not hundreds of thousands of Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SECURITY COPROCESSORS 392 NETWORK PROCESSORS sessions) need to be maintained, some sort of massive external memory will be required to preserve the session states. In these cases, synchronous dynamic random access memory (SDRAM) is usually used. The obvious bandwidth issue associated with the frequent duplex use of the PCI/host bus to send traffic back and forth between the network processor and the security coprocessor indicates that the look-aside solution can only be sustained for relatively low-end systems where line speed is OC-3 or OC-12 and not more than 1 Gbps. The flow through is extremely scalable to line speeds to the extent that the security coprocessor has been designed to sustain the wire-speed processing. The system- related downside of the flow-through approach is that some comprehensive information about the state of v