Cut-through Packet Stream Encryption Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems-on-chip (SoC) face inefficiencies due to dedicated encryption/decryption engines per port, leading to poor resource utilization and excessive buffering requirements when handling multiple Ethernet ports, as they cannot operate simultaneously and require large input and output buffers to prevent buffer overflow.
Innovation Solution
Implementing a single high-speed encryption engine that operates at a 128-byte block interleaving level, allowing it to process packets from multiple ports concurrently and reduce buffering needs by processing 128 bytes from each port before switching to the next, thereby minimizing latency and buffer requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If dedicated encryption/decryption engines are allocated to each port, then encryption/decryption speed is improved, but resource utilization deteriorates and die size increases
Solution Approach 1:
The patent merges multiple dedicated encryption/decryption engines into a single shared engine that serves multiple Ethernet ports. The engine is configured to operate at different speeds (10 Gbps or 1 Gbps) and can be dynamically assigned to different ports, eliminating the need for separate hardware engines at each port while maintaining encryption/decryption capabilities.
Solution Approach 2:
The single encryption/decryption engine is designed to be universal, supporting both 10 Gbps and 1 Gbps operation modes and serving multiple Ethernet ports. The engine can be dynamically reconfigured to handle different data rates and port assignments, making it a multi-functional resource that improves overall system efficiency.
2Productivity
If a shared encryption engine is used between multiple ports, then resource utilization is improved, but buffering requirements increase to handle arbitration latencies
Solution Approach 1:
The system dynamically configures the encryption/decryption engine to match the operational mode of the assigned port. When a 1 Gbps port is active, the engine operates at 1 Gbps; when a 10 Gbps port is active, it operates at 10 Gbps. This dynamic adaptation eliminates the need for excessive buffering that would be required if the engine operated at a fixed high speed, as data flows through the engine at matching rates.
Solution Approach 2:
The encryption/decryption engine's operational parameters (speed mode) are changed based on the assigned port's requirements. The engine can switch between 10 Gbps and 1 Gbps modes, allowing it to process data at the same rate it needs to be transmitted, thereby minimizing buffer requirements while maintaining high resource utilization.
3Productivity
If arbitration switching is implemented between ports, then resource sharing is improved, but latency increases due to packet buffering and switching overhead
Solution Approach 1:
The system uses dynamic port assignment where the encryption/decryption engine is actively assigned to a specific port based on real-time needs. Rather than time-sharing through arbitration, the engine is dedicated to one port at a time, eliminating arbitration latency. The assignment is dynamic, allowing the engine to be reassigned to different ports as needed, but during its assignment period, it operates without interruption.
4Speed
If high-speed encryption engine operates faster than port data rate, then encryption speed is improved, but output buffering requirements increase to prevent overflow
Solution Approach 1:
The encryption/decryption engine's operating speed is dynamically matched to the assigned port's data rate. When assigned to a 1 Gbps port, the engine operates at 1 Gbps rather than its maximum 10 Gbps capability. This dynamic speed matching ensures that the engine outputs data at the same rate the port can transmit it, eliminating the need for output buffering to prevent overflow while maintaining efficient resource utilization.
Data Source
AI summary
A system and method are provided for the cut-through encryption of packets transmitted via a plurality of input/output (IO) ports. A system-on-chip is provided with a first plurality of input first-in first out (FIFO) memories, an encryption processor, and a first plurality of output FIFOs, each associated with a corresponding input FIFO. Also provided is a first plurality of IO ports, each associated with a corresponding output FIFO. At a tail of each input FIFO, packets from the SoC are accepted at a corresponding input data rate. Packet blocks are supplied to the encryption processor, from a head of each input FIFO, in a cut-through manner. The encryption processor supplies encrypted packet blocks to a tail of corresponding output FIFOs. The encrypted packet blocks are transmitted from each output FIFO, via a corresponding IO port at a port speed rate effectively equal to the corresponding input data rate.