ll Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SECURITY COPROCESSORS NETWORK PROCESSORS Bus Mode Kernel 2183 Mode Protection Logic Interface PCUDMA Mode 32-bit Main Bus Controller PCI or Cardbus Interface ADSPM-218x DSP Core Encrypt Block (DES, 3DES) CGX Kernel 32x 24 Dual Context Register Program RAM 16K 24 4 Kbyte Data RAM Protected 16K 16 Blocks 44-byte Kernel (MD5, SHA-1) Mailbox EMI Bus 16/24 EMI bus 26-bits address Laser Serial Interrupt Random Controller Public Key Variable EEPROM Number Accelerator Store Interface Generator Timer Int_Host FIGURE 17.10 The internal structure of the Analog Devices/SafeNet-2141L security coprocessor chip (Source: Analog Devices) Systems Considerations when Engaging a Security Coprocessor Regardless of their speed of processing, security processing can be conceived either in a look-aside or flow-through architecture. The principles are shown in Figures 17.11 and 17.12, respectively, where the corresponding cases of a typical NPU-based high-speed line card is depicted. Some interesting systems-related issues are associated with both of these architectures. In the look-aside architecture, incoming traffic(1) that needs decryption or decapsulation is for- warded by the NPU to the security coprocessor. After local processing, it is sent back(2) to the NPU for further classification and forwarding. Outgoing traffic(3) that needs encryption, hashing, or encap- sulation is forwarded by the NPU to the security coprocessor. After processing, it is sent back to the NPU for subsequent scheduling(4) and transmission over the line interface. As soon as the host CPU (or the NPU in the case of a network-processing piece of equipment) receives a packet, it will deter- mine whether it requires security-related processing. If it does, it will forward the packets through the host bus (usually PCI, but in some security coprocessors, it can also be PCIX, which just doubles the performance of the bus, or HyperTransport, which unfortunately is not