Implementation method of macsec rate and port mixed verification model

Abstract

The application provides a method for implementing a macsec rate and port mixed verification model. A verification platform obtains a corresponding rate of a port through configuration, configures different rates and different encryption key lengths of a macsec encryption algorithm for different ports, and can verify macsec algorithms of multiple rates and ports, thereby saving simulation time and improving simulation efficiency and accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the chip verification technical field, and in particular to a macsec rate and port mixed verification model implementation method. BACKGROUND

[0002] With the continuous development and change of Ethernet interface rate, under the background of higher and higher network security requirements, macsec (macsec is a main protocol used to protect the security of local area network) data encryption, data integrity check and data correctness check are applied in Ethernet transmission. Macsec defines the data security communication method of IEEE802 local area network, to cope with the increasing complexity of macsec circuit caused by the change of demand of different rates and multiple ports of Ethernet interface, different ports have different rates, which brings challenges to macsec verification.

[0003] At present, the verification of macsec is all based on VIP (commercial verification platform) and chip docking test. Macsec chip contains multiple rates and multiple ports, and the rate of each port is different. VIP cannot meet the verification needs of the existing macsec chip with multiple rates and multiple port mixed verification, which brings inconvenience to the verification work.

[0004] In view of the above shortcomings, the present application solves the above problems:

[0005] 1. Integrated with multiple rates and configurable;

[0006] 2. Support multiple port encryption and decryption verification.

[0007] In order to solve the deficiency of the prior art, the present application provides a macsec rate and port mixed verification model implementation method. The verification platform obtains the corresponding rate of the port through configuration, configures different rates and different encryption key lengths of macsec encryption algorithm for different ports, can realize the verification of macsec algorithm with multiple rates and ports, save simulation time, improve simulation efficiency and accuracy. SUMMARY

[0008] In order to solve the deficiency of the prior art, the present application provides a macsec rate and port mixed verification model implementation method. The verification platform obtains the corresponding rate of the port through configuration, configures different rates and different encryption key lengths of macsec encryption algorithm for different ports, can realize the verification of macsec algorithm with multiple rates and ports, save simulation time, improve simulation efficiency and accuracy.

[0009] To achieve the above purpose, the present application adopts the following technical scheme.

[0010] In the embodiment of the present application, an implementation method of a macsec rate and port mixed verification model is provided, which comprises the following steps:

[0011] The S1 verification platform obtains the number of ports of the current macsec chip and the data rate of each port through configuration;

[0012] The S2 verification platform obtains the key information, IV vector and PN value of the macsec chip;

[0013] The S3 verification platform performs encryption / decryption operation on the data to be encrypted / decrypted by the macsec chip and stores according to the ports;

[0014] The S4 verification platform samples the encryption / decryption data of the macsec chip according to the corresponding rate of the ports and stores according to the ports;

[0015] The S5 verification platform automatically compares the encryption / decryption data of the macsec chip and the encryption / decryption data of the verification platform byte by byte according to the ports.

[0016] Further, the verification platform needs to store the encrypted / decrypted data of different ports according to the port grouping after the encryption / decryption of the data of different ports, and samples the encrypted / decrypted data of the macsec chip according to the rate of each port and stores according to the port grouping.

[0017] Further, the verification platform automatically compares the encryption / decryption data obtained by performing encryption / decryption operation on the data to be encrypted / decrypted by the macsec chip with the sampled encryption / decryption data of the macsec chip byte by byte according to the ports, and outputs a success mark if the comparison is successful, outputs a failure mark if the comparison fails, and reports the error.

[0018] Further, the verification platform obtains the rate corresponding to each port of the macsec by using the configuration method, selects a sampling clock according to the different rates of the ports, and sends the Ethernet data of the corresponding port to the macsec.

[0019] Further, the number of ports of the verification platform changes according to the port configuration of the macsec chip and is consistent with the capability of the macsec chip, and one example can cover each port of the macsec chip.

[0020] The present application has the advantages that, in view of the problems existing in the existing chip verification system, the present application provides an implementation method of a macsec rate and port mixed verification model, the verification platform obtains the rate corresponding to the ports through configuration, configures different rates and different encryption key lengths of the macsec encryption algorithm for different ports, can realize the verification of the macsec algorithm with multiple rates and ports, saves the simulation time, and improves the simulation efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0022] Figure 1 Schematic diagram of the process for implementing the present invention;

[0023] Figure 2 This is the verification platform encryption process of the first embodiment of the present invention;

[0024] Figure 3 This is the decryption process of the verification platform in the first embodiment of the present invention. DETAILED DESCRIPTION

[0025] To make the purpose, technical solutions and advantages of the embodiments of the present invention more clearly understood, the embodiments of the present invention are further described in detail below with reference to the accompanying drawings. The following examples are only used to more clearly illustrate the system method and technical solutions of the present invention, and are not intended to limit the scope of protection of this application.

[0026] According to the implementation mode of the present invention, the present invention proposes a method for implementing a verification model of a mixed macsec rate and port. The verification platform obtains the rate corresponding to the port through configuration, configures different rates and different macsec encryption algorithm encryption key lengths for different ports, and can verify macsec algorithms with multiple rates and ports, saving simulation time and improving simulation efficiency and accuracy.

[0027] The principles and spirit of the present invention are explained in detail below with reference to several representative embodiments of the present invention.

[0028] Figure 1 The following is a flowchart of a method for implementing a mixed MACSEC rate and port authentication model. Figure 1 As shown, the method includes the following steps:

[0029] The S1 verification platform obtains the number of ports and the data rate of each port of the current macsec chip through configuration;

[0030] The S2 verification platform obtains the secret key information, IV vector, and PN value of the macsec chip;

[0031] The S3 verification platform encrypts / decrypts the data to be encrypted / decrypted by the macsec chip and stores it by port;

[0032] S4 The verification platform samples the macsec chip encryption / decryption data according to the corresponding rate of the port and stores according to the port;

[0033] S5 The verification platform automatically compares the verification platform encryption / decryption data and the macsec chip encryption / decryption data byte by byte according to the port.

[0034] In specific implementation, the verification platform encrypts / decrypts the serially input data of different ports and stores the encrypted / decrypted data of different ports according to the port grouping. The verification platform samples the macsec chip encrypted / decrypted data according to the rate of each port and stores the sampled data according to the port grouping.

[0035] In specific implementation, the verification platform automatically compares the encrypted / decrypted data obtained by encrypting / decrypting the data to be encrypted / decrypted by the macsec chip with the macsec chip encrypted / decrypted data sampled by the verification platform byte by byte according to the port. If the comparison is successful, a success flag is output, if the comparison fails, a failure flag is output, and an error is reported.

[0036] In specific implementation, the verification platform obtains the rate corresponding to each port of the macsec by using a configuration method, selects a sampling clock according to the different rates of the ports, and sends the Ethernet data of the corresponding port to the macsec.

[0037] In specific implementation, the number of ports of the verification platform changes according to the port configuration of the macsec chip and is consistent with the capability of the macsec chip. One example can cover each port of the macsec chip.

[0038] It should be noted that although the operations of the method of the present application are described in a specific order in the above embodiments and drawings, this does not require or imply that the operations must be performed in this specific order or that all of the shown operations must be performed to achieve the desired result. Additionally or alternatively, certain steps can be omitted, multiple steps can be combined into one step, and / or one step can be divided into multiple steps.

[0039] In order to more clearly explain the implementation method of the above-described macsec rate and port mixed verification model, a specific embodiment will be described below, however, it should be noted that this embodiment is only used to better illustrate the present application and does not constitute an improper limitation on the present application.

[0040] Embodiment one:

[0041] An implementation method of a macsec rate and port mixed verification model is as follows:

[0042] In this embodiment, the encryption and decryption of the verification model adopts the macsec algorithm for data encryption and integrity verification. The processing flow is referred to the standard NIST Special Publication 800-38D.

[0043] The verification platform obtains the rate corresponding to each port of the macsec by using the configuration method. The verification platform selects a sampling clock according to the rate, sends the Ethernet data of the corresponding port to the macsec, and obtains the data (such as key information, IV vector (96-bit arbitrary binary number), and PN (packet number) value) and performs the same encryption operation as the macsec chip.

[0044] For encryption of different port data input in series, the encrypted data of different ports is stored in groups according to the ports, that is, the encrypted data is stored in the port storage queue of the platform according to the ports. After the encryption operation of each port of the macsec chip is completed, the verification platform samples the encrypted export data of the macsec chip according to the rate of each port and stores it according to the port. After the platform obtains the data of one port of the macsec chip, the platform automatically compares the macsec encrypted data stored in the platform port with the platform.

[0045] The verification platform samples the encrypted data of the macsec chip on the receiving side, obtains the configuration information (key information, IV vector, and PN value), and performs decryption. The decrypted data is stored according to the port. After the macsec chip receives the decrypted data, the verification platform samples the macsec chip decryption data according to the port and stores the macsec chip data according to the port. The platform decryption data and the macsec chip decryption data are compared byte by byte. If they are inconsistent, the platform reports an error.

[0046] The specific implementation process is as follows:

[0047] 1. The implementation realizes that the platform can send data of different ports and rates, sample the encryption and decryption data of each port of the macsec chip, and compare them byte by byte. The encryption process of the verification platform is shown in the attached Figure 2 The CFG module is used for configuring the rate. The excitation generator refers to a module for sending data packets to the chip and can send random packet lengths. The encryption model is a module for realizing the encryption function of the chip using a software language and is used for verifying the encryption function of the chip.

[0048] The specific encryption process is as follows:

[0049] 1) Obtain the number of ports and the data rate of each port of the current macsec chip by configuring the platform;

[0050] 2) Obtain the key information, IV vector, and PN value of the macsec chip by the verification platform;

[0051] 3) The verification platform encrypts the data to be encrypted by the macsec chip and stores them according to the ports;

[0052] 4) The verification platform samples the encrypted data of the macsec chip according to the rate of each port and stores them according to the ports;

[0053] 5) The verification platform automatically compares the encrypted data obtained by encrypting the data to be encrypted by the macsec chip with the encrypted data of the macsec chip sampled by the verification platform byte by byte according to the ports, and outputs a success mark if the comparison is successful, and outputs a failure mark if the comparison fails.

[0054] 2. The decryption process of the verification platform of the application is shown in the following table: Figure 3 , wherein the CFG module configures the rate, the excitation generator refers to a module for sending data packets to the chip, and can send random packet lengths. The decryption model refers to a software language implementation of the chip decryption function, and is used to verify the chip decryption function.

[0055] The specific decryption process is as follows:

[0056] 1) Obtain the number of ports and the data rate of each port of the current macsec chip through the configuration platform;

[0057] 2) Obtain the secret key information, IV vector and PN value of the macsec chip;

[0058] 3) The verification platform decrypts the data to be decrypted by the macsec chip and stores them according to the ports;

[0059] 4) The verification platform samples the decrypted data of the macsec chip according to the rate of each port and stores them according to the ports;

[0060] 5) The verification platform automatically compares the data obtained by decrypting the data to be decrypted by the macsec chip with the decrypted data of the macsec chip sampled by the verification platform byte by byte according to the ports, and outputs a success mark if the comparison is successful, and outputs a failure mark if the comparison fails.

[0061] In specific implementation, the verification platform can send data at different rates to the macsec chip through configuration, and can also complete automatic comparison. The number of ports of the verification platform can be changed according to the port configuration of the macsec chip, and is consistent with the capability of the macsec chip, and has the characteristics of flexible programmability.

[0062] The verification platform supports multiple rates at the same time, meets the verification requirements of the macsec chip multiple rates, and can improve the reusability of the verification platform and save the time of the verification personnel for rebuilding the verification platform by using the verification platform. One verification case can cover each port of the macsec chip and the corresponding rate on each port, and the number of verification cases is reduced.

[0063] The present application has the beneficial effects that, aiming at the problems existing in the existing chip verification system, a kind of implementation method of macsec rate and port mixed verification model is provided, the verification platform can obtain the rate corresponding to the port by configuration, different rate and different encryption key length of macsec encryption algorithm are configured for different ports, the macsec algorithm with multiple rate and port can be verified, the simulation time is saved, and the simulation efficiency and accuracy are improved.

[0064] The applicant of the present application has made a detailed description and explanation of the implementation examples of the present application in combination with the drawings of the specification. The above implementation examples are only preferred embodiments of the present application, and the detailed description is only to help the reader better understand the spirit of the present application, and is not a limitation on the protection scope of the present application. On the contrary, any improvement or modification based on the spirit of the present application should fall within the protection scope of the present application.

Claims

1. A method for implementing a MACSEC rate and port hybrid verification model, characterized in that: The method comprises the following steps: The S1 verification platform obtains the number of ports and the data rate of each port of the current macsec chip through configuration; The S2 verification platform obtains the secret key information, IV vector, and PN value of the macsec chip; The S3 verification platform encrypts / decrypts the data to be encrypted / decrypted by the macsec chip and stores it by port; The S4 verification platform samples the MACSEC chip encryption / decryption data according to the corresponding port rate and stores it according to the port; The S5 verification platform automatically compares the encrypted / decrypted data of the verification platform and the encrypted / decrypted data of the MACSEC chip byte by byte according to the port; The verification platform encrypts / decrypts serial input data from different ports, and needs to encrypt / decrypt the data from different ports and then store them in groups according to ports; The verification platform samples the data encrypted / decrypted by the MACSEC chip based on the rate of each port and stores it in groups according to the port. The verification platform automatically compares the encrypted / decrypted data obtained after the verification platform performs encryption / decryption operations on the data to be encrypted / decrypted by the MACSEC chip with the encrypted / decrypted data sampled by the verification platform byte by byte according to the port, and outputs a success mark if the comparison is successful, and outputs a failure mark if the comparison fails, and reports an error; The verification platform obtains the rate corresponding to each port of macsec using an acquisition configuration method, selects a sampling clock according to the different rates of the ports, and sends Ethernet data of the corresponding port to macsec; The number of ports on the verification platform changes according to the port configuration of the macsec chip and is consistent with the capabilities of the macsec chip. One sample can cover every port of the macsec chip.

Images