look-up, the DPU forwards the SA information along with the packet to the crypto algorithm
processors. The DPU then updates the SA sequence number and counters. The encoded
packet is then egressed out the Ethernet GMAC interface connected to the network-side
physical device (PHY) port. Any errors in this process are captured to the eSC processor for
statistics logging. Non-IPsec packets are checked against the SPD policy database and
either discarded or forwarded to the network PHY port, depending on policy.
As noted above, reassembled packets received on the outbound host interface are
processed as inbound and returned to the host-side interface.
Table 4-1. Description of the Primary Functional Units
Block
Description
eSC (embedded
Session Controller)
The eSC controller performs the “control path” functions including IKE,
SPD configuration, random number generation, optional packet
reassembly handling, and exception handling.
DPU
The DPU performs “fast data path” functions including packet policy
look-up, SAD look-up, IPsec header processing, and SA maintenance.
Crypto Processors
The crypto algorithm processors consist of a pipelined encryption,
padding, and authentication engines, along with hardware for
computing packet checksums. The crypto algorithm processors are
configured by the DPU prior to the start of each packet or task.
Post Crypto Processor
(PCP)
The Post-Crypto Processor handles packet header/trailer formatting and
other “fast-path” functions after the packet has run through the Crypto
Processor cores.
Public-Key Processor
The public-key processor provides hardware acceleration of public-key
arithmetic computations. It supports modulus sizes of up to 8,192 bits.
Random Number
Generator (RNG)
The 4450 contains a hardware true-random number generator. It is
internally used to generate IKE keys.
Embedded SA Memory
The on-chip memory is used for the storage of up to 200 security
associations. The number of SA's supported on-chip may vary
depending on the software release and the supported features. Please
refer to the Product Release Notes, RN-0118, for additional
information.
Embedded TCAM
Memory
This on-chip Content Addressable Memory (CAM) is used for
implementing efficient security policy and security association look-ups.
Up to 256 policy entries are supported (generally 128 in each
direction).
GMAC Cores
The 4450 supports four independent 1Gbps full-duplex Ethernet ports,
two on the “network” side and two on the “host” side. The physical
interfaces can either be RGMII/RTBI/SGMII/SERDES. The host side
interfaces also optionally support GMII or TBI. Each GMAC port is
internally connected to an inbound/outbound buffer. On the host side
commands and unprocessed outbound packets are transferred from the
host to the 4450, and inbound processed packets are transmitted to
the host. On the network side outbound processed packets are
transferred to the PHY device, and inbound unprocessed packets are
received from the PHY device.
DDR2 SDRAM
The DDR2 SDRAM is required to store eSC program code/Data when
running IKE on-chip or if it is necessary to support more than 200 SAs
in a configuration.
4450 – Data Sheet, DS-0131-06
Page25
Hifn Confidential
EXAR [ EXAR CORPORATION ]
