arious applications that are running at higher layers must be made systematically available to the security coprocessor, SO that it can make the correct decisions about what to do on incoming or out- going packets without disturbing the network processor or other CPUs in a complete system. In terms of the security ratings of a system, several levels of certification of how secure a device is deemed to be are available. The Federal Information Protection Standard (FIPS)-140 standard describes the requirements a device must satisfy to be rated at a specific level of security needed (in this case) by the U.S. federal government. As an example of the implications, we will mention the danger of having the security coprocessor access an external block of SDRAM to obtain the neces- sary keys and other session-related information. If the system is not designed to be tamper-proof, essentially anyone can open the chassis and gain physical access to the memory pins, thereby read- ing the sensitive information simultaneously with the security coprocessor in order to subsequently attack a system or a link. If the system is designed according to the FIPS-140 standard and the security coprocessor is housed in the same tamper-proof cryptographic module with the session-state memory in such a way that when it detects intrusion and a specific trigger is created, then a specific pin can be activated (when available) on some security coprocessor chips, and that event will zeroize all internal registers and storage SO no sensitive internal material can be obtained by an intruder. Of course, the box design (if it has been designed according to the same standard guidelines) will also leave physical traces and undeniable proof of the physical tampering. Yet another approach that systems designers can take is for the security coprocessor to write and retrieve encrypted session-related data to and from the session memory only when it obtains access to the session-state memory directly (bypassing the network processor or host CPU). This wa