 authentication, firewall services, and SO on) running on the main CPU of the router/switch. Given the performance penalty that such a piece of equipment would pay in a commen- surate loss of switching capacity, they soon realized that hardware acceleration engines were required. Alliances were formed between some security companies and some network gear vendors to ini- tiate designs. In some cases, the network equipment manufacturers set up new specialized engineer- ing teams to design their own in-house-developed add-on acceleration boards or application-specific integrated circuits (ASICs) in order to handle the heavy-duty mathematical processing required for encryption and authentication, which was to be the mandate of the security co-processors. These are chips and/or sometimes whole subsystems that can handle predominantly cryptographic functionality quickly, something that ordinary CPUs were never designed to handle efficiently. With the arrival of the IPsec specifications and publications from the IETF, vendors started implementing IPsec first in software and then in hardware. The faster the network equipment became, the more pro- grammers had to consider how to generate cryptographic keys and digital signatures as well as how to encapsulate traffic into new types of packets that provided at least the sense, if not the impression, of a secure tunnel. Security co-processors are another relative in the family tree of network processors. We will dis- cuss these in detail later in the book in Chapter 17. TRAFFIC ENGINEERING (TE) Another direct result of the introduction and acceptance of MPLS is the set of capabilities that it offers for TE. TE is geared toward decreasing the cost of network operations for carriers and service providers by enabling them to more efficiently allocate and manage the use of bandwidth resources. This prevents undesirable situations where some parts of the network are congested while other parts remain underutilized. Special intelligence and adequate processing speed are required t