Method and apparatus for implementing MACsec using multiple DP switching chips

Abstract

The present invention provides a method and device for implementing MACsec by a multi-DP switching chip, wherein the multi-DP switching chip uses a flow-based MACsec function, and the flow enables a linkagg function, the multi-DP switching chip comprises a MAC module, an IPE module, a BSR module and an EPE module, the MAC module comprises at least two DP submodules, each DP submodule is divided into two directions, an input direction and an output direction, and each DP submodule is not aware of each other, the method comprises: selecting one of the DP submodules as a message encryption processing DP; and when a message is received from the DP submodule in the input direction, judging whether the message is a message exported on the message encryption processing DP, if so, the message is directly sent out after being encrypted; if not, the message is first sent to the message encryption processing DP through a loop channel for encryption, and then the encrypted message is looped back to the IPE module, and the corresponding processing flow of the IPE module and the EPE is skipped, and finally it is sent out from the corresponding export according to the real export information of the message.

Description

Technical Field

[0001] The present invention relates to the field of user data security networks, and in particular to a method and device for implementing MACsec with a multi-DP switching chip. Background Art

[0002] IEEE802.1AE introduces Macsec technology, which can provide users with secure MAC layer data sending and receiving services, including user data encryption, data frame integrity check and data authenticity verification, and replay protection.

[0003] Traditional MACsec implementation is based on a single DP (data path) switching chip, and is based on ports (ports) or channels (channels), and its implementation is implemented in MAC. The entire process includes the media access control receiving module (MACRX), the inbound processing module (IPE), the memory management module (BSR), the outbound processing module (EPE), and the media access control sending module (MACTX). On the one hand, as everyone has emphasized security in recent years, the granularity of data encryption and decryption has become increasingly fine, and port-based encryption and decryption has become increasingly unable to meet current needs, and more encryption and decryption is based on flows. On the other hand, with the rapid development of the network, the switching chip is required to have more ports and greater bandwidth, so multi-DP switching chips came into being. Each DP maintains a MAC module, and each MAC module contains multiple channels. DPs are not aware of each other.

[0004] In actual network deployment, linkagg technology is usually used to increase link bandwidth and improve link reliability. On the switch chip, the same flow will go out from different ports.

[0005] The difference between a multi-DP switching chip and a single-DP switching chip is that there are multiple MAC modules, which share the IPE EPEBSR process. There are multiple channels in each MAC, and MACsec is implemented in each MAC. The table entries in each MAC module are independent and do not communicate with each other. When using flow-based MACsec, and the flow has linkagg enabled, when the egress is distributed on multiple DPs, there will be a problem that PN cannot be synchronized during encryption. For example, the first message of the flow is encrypted from port0 of DP0. At this time, the PN value filled in the sectag of the message is PN+1, and the table entry maintained on DP0 is PN+1. The second message of the flow is encrypted from port1 of DP1. At this time, the PN value filled in the sectag of the message is also PN+1, and the table entry maintained on DP1 is PN+1. In this way, the messages filled in the sectag of two consecutive messages are PN+1. If the other end receives such messages continuously, the messages will be discarded due to PN problems. Of course, other table entries will also have similar problems.

[0006] This problem can be solved by moving the MACsec module between IPE and EPE. In this case, there will be no incompatibility between MACsec entries. However, the module changes are too large, and the MACsec module is far away from the MAC, becoming a centralized MACsec. The processing bandwidth will be limited and not easy to expand later. There needs to be a way to solve this problem without changing the architecture. Summary of the invention

[0007] In order to solve the above technical problems, the present invention discloses a method and device for implementing MACsec with multiple DP switching chips, which can unify the MACsec entries of different DPs and enable the messages to be correctly encrypted and decrypted when using flow-based MACsec and linkagg applications exist.

[0008] To achieve the above-mentioned purpose, the technical solution of the present invention provides a method for implementing MACsec with a multi-DP switching chip, wherein the multi-DP switching chip uses a flow-based MACsec function, and the flow enables the linkagg function, the multi-DP switching chip includes a MAC module, an IPE module, a BSR module and an EPE module, the MAC module includes at least two DP sub-modules, each DP sub-module is divided into two directions, input and output, and each DP sub-module is unaware of each other, wherein the method includes: selecting one of the DP sub-modules as a message encryption processing DP; and when a message is received from the DP sub-module in the input direction, determining whether the message is a message exported on the message encryption processing DP, if so, the message is directly sent out after encryption processing; if not, the message is first sent to the message encryption processing DP through a loop channel for encryption processing, and then the encrypted message is looped back to the IPE module, and the corresponding processing flow of the IPE module and the EPE is skipped, and finally sent out from the corresponding export according to the real export information of the message.

[0009] In a further technical solution, the LAG Engine of the IPE module performs hash calculation to obtain the egress information of the message.

[0010] In a further technical solution, when encrypting a message, the cvlan tag of the message is taken to perform hashlookup, the SCID is obtained, and the SCID is used as the index value to index the corresponding Table, and then the corresponding encryption information is obtained for encryption processing.

[0011] In a further technical solution, when encrypting a message, a corresponding PN value is filled in the sectag of the message, and the PN value maintained in the Table is updated.

[0012] In a further technical solution, the MAC module includes n DP sub-modules, where n is an integer greater than or equal to 2. Each DP sub-module includes m channels, where m is an integer greater than or equal to 2. The channels displayed to the outside by all DP sub-modules are 0-(m-1). When IPE arrives, the channels are restored to continuous 0-(m*n-1) based on the DP ID and the channel ID.

[0013] The technical solution of the present invention also provides a device for implementing MACsec with a multi-DP switching chip, wherein the multi-DP switching chip uses a flow-based MACsec function, and the flow enables a linkagg function, the multi-DP switching chip includes a MAC module, an IPE module, a BSR module and an EPE module, the MAC module includes at least two DP sub-modules, each DP sub-module is divided into two directions, input and output, and each DP sub-module is unaware of each other, and the device includes: a DP selection module, used to select one of the DP sub-modules as a message encryption processing DP; and a message loop judgment module, used to determine whether the message is a message exported on the message encryption processing DP when a message is received from the DP sub-module in the input direction, if so, the message is directly sent out after encryption processing; if not, the message is first sent to the message encryption processing DP through a loop channel for encryption processing, and then the encrypted message is looped back to the IPE module, and the corresponding processing flow of the IPE module and the EPE is skipped, and finally sent out from the corresponding export according to the real export information of the message.

[0014] In a further technical solution, the egress information of the message is obtained by performing hash calculation through the LAG Engine of the IPE module.

[0015] In a further technical solution, when encrypting a message, the cvlan tag of the message is taken to perform hashlookup, the SCID is obtained, and the SCID is used as the index value to index the corresponding Table, and then the corresponding encryption information is obtained for encryption processing.

[0016] In a further technical solution, when encrypting a message, a corresponding PN value is filled in the sectag of the message, and the PN value maintained in the Table is updated.

[0017] In a further technical solution, the MAC module includes n DP sub-modules, where n is an integer greater than or equal to 2. Each DP sub-module includes m channels, where m is an integer greater than or equal to 2. The channels displayed to the outside by all DP sub-modules are 0-(m-1). When IPE arrives, the channels are restored to continuous 0-(m*n-1) based on the DP ID and the channel ID. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is the overall architecture TOPO schematic diagram;

[0019] Figure 2 It is a processing flow chart of the message of the present invention that does not require a loop;

[0020] Figure 3 It is a processing flow chart of the message requiring a loop according to the present invention. DETAILED DESCRIPTION

[0021] The technical solution of the present invention is further described below in conjunction with specific embodiments, but the present invention is not limited to these embodiments.

[0022] The present invention needs to consider two modes: port-based MACsec and flow-based MACsec. These two modes will not coexist from an application perspective. When the port-based MACsec mode is selected, each DP maintains its own MACsec table entry, which is no different from the forwarding principle of an ordinary MACsec chip. If the flow-based MACsec mode is selected, the messages are placed on the same DP when encrypted. For messages whose exits are on the selected DP, the messages are directly encrypted and sent out. For messages whose actual exits are on other DPs, the chip sends a loop channel to the encryption DP to encrypt the message. The loop channel is a loopback channel or loopback port. The message can return to the input direction through this channel. After encryption, the message carries the real exit information and loops back to the IPE, bypassing the IPE EPE operation (for example, skipping message parsing, layer 2 and 3 search and forwarding, etc.), and finally finding the real exit according to the real exit information carried.

[0023] In an embodiment of the present invention, a method for implementing MACsec with a multi-DP switching chip is provided, wherein the multi-DP switching chip uses a flow-based MACsec function, and the flow enables a linkagg function, the multi-DP switching chip includes a MAC module, an IPE module, a BSR module and an EPE module, the MAC module includes at least two DP sub-modules, each DP sub-module is divided into two directions, input and output, and each DP sub-module is unaware of each other, wherein the method includes: selecting one of the DP sub-modules as a message encryption processing DP; and when a message is received from the DP sub-module in the input direction, determining whether the message is a message exported on the message encryption processing DP, if so, the message is directly sent out after encryption processing; if not, the message is first sent to the message encryption processing DP through a loop channel for encryption processing, and then the encrypted message is looped back to the IPE module, and the corresponding processing flow of the IPE module and the EPE is skipped, and finally sent out from the corresponding export according to the real export information of the message.

[0024] In a further technical solution, the LAG Engine of the IPE module performs hash calculation to obtain the egress information of the message.

[0025] In a further technical solution, when encrypting a message, the cvlan tag of the message is taken to perform hashlookup, the SCID is obtained, and the SCID is used as the index value to index the corresponding Table, and then the corresponding encryption information is obtained for encryption processing.

[0026] In a further technical solution, when encrypting a message, a corresponding PN value is filled in the sectag of the message, and the PN value maintained in the Table is updated.

[0027] In a further technical solution, the MAC module includes n DP sub-modules, where n is an integer greater than or equal to 2. Each DP sub-module includes m channels, where m is an integer greater than or equal to 2. The channels displayed to the outside by all DP sub-modules are 0-(m-1). When IPE arrives, the channels are restored to continuous 0-(m*n-1) based on the DP ID and the channel ID.

[0028] In another embodiment of the present invention, a device for implementing MACsec with a multi-DP switching chip is also provided, wherein the multi-DP switching chip uses a flow-based MACsec function, and the flow enables a linkagg function, the multi-DP switching chip includes a MAC module, an IPE module, a BSR module and an EPE module, the MAC module includes at least two DP sub-modules, each DP sub-module is divided into two directions, input and output, and each DP sub-module is unaware of each other, and the device includes: a DP selection module, used to select one of the DP sub-modules as a message encryption processing DP; and a message loop judgment module, used to determine whether the message is a message exported on the message encryption processing DP when a message is received from the DP sub-module in the input direction, if so, the message is directly sent out after encryption processing; if not, the message is first sent to the message encryption processing DP through a loop channel for encryption processing, and then the encrypted message is looped back to the IPE module, and the corresponding processing flow of the IPE module and EPE is skipped, and finally sent out from the corresponding export according to the real export information of the message.

[0029] In a further technical solution, the egress information of the message is obtained by performing hash calculation through the LAG Engine of the IPE module.

[0030] In a further technical solution, when encrypting a message, the cvlan tag of the message is taken to perform hashlookup, the SCID is obtained, and the SCID is used as the index value to index the corresponding Table, and then the corresponding encryption information is obtained for encryption processing.

[0031] In a further technical solution, when encrypting a message, a corresponding PN value is filled in the sectag of the message, and the PN value maintained in the Table is updated.

[0032] In a further technical solution, the MAC module includes n DP sub-modules, where n is an integer greater than or equal to 2. Each DP sub-module includes m channels, where m is an integer greater than or equal to 2. The channels displayed to the outside by all DP sub-modules are 0-(m-1). When IPE arrives, the channels are restored to continuous 0-(m*n-1) based on the DP ID and the channel ID. Specific embodiment:

[0034] See also Figure 1 , which shows the overall architecture TOPO diagram, including MAC module, IPE module, BSR module, and EPE module. The MAC module is divided into two sub-modules, DP0 and DP1. Each DP is divided into two directions, TX and RX. There are multiple channels in each DP and a built-in MACsec engine. The IPE module is responsible for processing the message in the incoming direction. The BSR is responsible for memory management. The EPE module is responsible for processing the message in the outgoing direction. Each DP is unaware of each other, and their number is designed according to specific needs. It is assumed here that DP0 and DP1 are used, and each DP has a total of ten channels (the specific number can also be designed according to specific needs). Externally, the channels of DP0 and DP1 are 0-9. When IPE arrives, the channels are restored to continuous 0-19 based on the DP ID and the channel ID, and the same applies to the outgoing direction. Each MACsec module maintains its own table entry.

[0035] See also Figure 2, which shows the chip processing flow of a message in a specific flow. Specifically, the message comes in from channel 1 of DP0, arrives at IPE and enters LAG Engine for linkagg, and obtains channel 2 of DP1 as the outlet (Linkagg finds the hash value by matching the flow characteristics, and obtains the outlet according to the hash value. Here, the outlet is configured by the user, and different hash values ​​will match the corresponding outlet). Therefore, the message passes through BSR EPE to reach DP1, and first undergoes MACsec encryption processing in DP1. Here, MACsec is based on the flow. Here, for example, the cvlan tag (user-side VLAN, encapsulated in the message) of the message is taken for hash lookup, and the SCID (Secure Channel Identifier) ​​is obtained. The SCID is used as the index value to index the corresponding Table, and then the corresponding encryption information is obtained for encryption processing. At this time, the PN value filled in the message sectag is PN+1, and the PN value maintained in the corresponding Table is also updated to PN+1. After encryption, it goes out from channel 2.

[0036] See also Figure 3 , which shows the chip processing flow of another message in a specific flow. The message also comes in from channel 1 of DP0, reaches IPE and enters LAG Engine for linkagg, and gets the exit as channel 3 of DP0. At this time, in order to put all MACsec processing in one DP (that is, DP1), it leaves DP1 loop channel, and the message reaches DP1 through loopchannel for encryption processing. The cvlan tag of the message is also taken (attached Figure 2 The same as the message cvlan tag in the example is used for hash lookup, and the SCID is also obtained. The SCID is used as the index value to index the corresponding Table, and then the corresponding encryption information is obtained for encryption processing. At this time, the PN value filled in the message sectag is PN+2, and the pn value maintained in the corresponding Table is also updated to PN+2. After the message is encrypted, the message carries the real exit information of the message, that is, channel 3 of DP0 loops back to IPE, and bypasses (skips) the processing flow of IPE EPE, and finally exits from channel 3 of DP0 according to the real exit information of the message. In this way, the above-mentioned problems mentioned in the background technology will not exist when encrypting the same flow.

[0037] The present invention effectively solves the problem of PN discontinuity during message encryption when a flow-based MACsec function is used on a multi-DP switching chip and the flow enables a linkagg function, thereby greatly improving security performance.

[0038] The above is only a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several modifications and improvements without departing from the inventive concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A method for implementing MACsec using a multi-DP switching chip, characterized in that: The multi-DP switching chip uses a flow-based MACsec function, and the flow enables the linkagg function. The multi-DP switching chip includes a MAC module, an inbound processing module IPE module, a memory management module BSR module, and an outbound processing module EPE module. The MAC module includes at least two DP submodules, each DP submodule is divided into two directions, inbound and outbound, and each DP submodule is not aware of each other. The method includes: Select one of the DP submodules as the message encryption processing DP; and When a message is received from the DP submodule in the inbound direction, the LAG Engine of the IPE module performs hash calculation to obtain the message's export information to determine whether the message is an export message on the message encryption processing DP. If so, the message is directly sent out after encryption; if not, the message is first sent to the message encryption processing DP through the loop channel for encryption, and then the encrypted message is looped back to the IPE module, skipping the corresponding processing flows of the IPE module and the EPE module, and finally sent out from the corresponding export according to the calculated message export information.

2. The method according to claim 1, characterized in that When encrypting a message, the cvlan tag of the message is used for hash lookup to obtain the secure channel identifier SCID, and then the SCID is used as the index value to index the corresponding Table, thereby obtaining the corresponding encryption information for encryption processing.

3. The method according to claim 2, characterized in that When encrypting a message, fill the corresponding PN value in the sectag of the message and update the PN value maintained in the Table.

4. The method according to claim 1, characterized in that The MAC module includes n DP sub-modules, where n is an integer greater than or equal to 2. Each DP sub-module includes m channels, where m is an integer greater than or equal to 2. The channels displayed by all DP sub-modules to the outside are 0-(m-1). When it reaches the IPE module, the channels are restored to continuous 0-(m*n-1) based on the DP ID and the channel ID.

5. A device for implementing MACsec using a multi-DP switching chip, characterized in that: The multi-DP switching chip uses a flow-based MACsec function, and the flow enables the linkagg function. The multi-DP switching chip includes a MAC module, an inbound processing module IPE module, a memory management module BSR module, and an outbound processing module EPE module. The MAC module includes at least two DP submodules, each DP submodule is divided into two directions, inbound and outbound, and each DP submodule is not aware of each other. The device includes: A DP selection module, used to select one of the DP submodules as a message encryption processing DP; and The message loop judgment module is used to obtain the message export information through the LAGEngine of the IPE module by performing hash calculation when receiving a message from the DP submodule in the inbound direction, so as to determine whether the message is a message exported on the message encryption processing DP. If so, the message is directly sent out after encryption; if not, the message is first sent to the message encryption processing DP through the loopchannel for encryption, and then the encrypted message is looped back to the IPE module, and the corresponding processing flow of the IPE module and the EPE module is skipped, and finally it is sent out from the corresponding export according to the calculated message export information.

6. The device according to claim 5, characterized in that When encrypting a message, the cvlan tag of the message is used for hash lookup to obtain the secure channel identifier SCID, and then the SCID is used as the index value to index the corresponding Table, thereby obtaining the corresponding encryption information for encryption processing.

7. The device according to claim 6, characterized in that When encrypting a message, fill the corresponding PN value in the sectag of the message and update the PN value maintained in the Table.

8. The device according to claim 5, characterized in that The MAC module includes n DP sub-modules, where n is an integer greater than or equal to 2. Each DP sub-module includes m channels, where m is an integer greater than or equal to 2. The channels displayed by all DP sub-modules to the outside are 0-(m-1). When it reaches the IPE module, the channels are restored to continuous 0-(m*n-1) based on the DP ID and the channel ID.

Images