Cut-Through Switch Authentication Latency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Communications networks face challenges in ensuring data security and reliability due to hardware and software errors, as well as malicious attacks, which can lead to data exposure and network unavailability, and existing technologies struggle to effectively authenticate packets in real-time while maintaining low latency.
Innovation Solution
A method and switch implementation that performs authentication checks on packets using cut-through routing, delaying forwarding until all checks are complete to ensure invalid packets are discarded, and utilizing authentication mechanisms such as partition key validation and service level verification in InfiniBand networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication checks are performed on all packets before forwarding, then network security is improved, but forwarding latency increases
Solution Approach 1:
The patent performs preliminary authentication checks on packet headers before complete packet reception, using cut-through routing to forward validated packets immediately while continuing authentication of remaining packets. This preliminary action secures the forwarding decision without waiting for complete packet reception, thus improving security without excessive latency.
Solution Approach 2:
The patent segments the authentication process into header authentication (performed immediately) and body authentication (performed concurrently during forwarding). This segmentation allows the critical security check to be completed and acted upon without waiting for the entire packet, resolving the contradiction between security and latency.
2Measurement precision
If complete packet reception is waited for before forwarding, then authentication accuracy is improved, but network throughput decreases
Solution Approach 1:
The system performs preliminary authentication on the packet header portion before the complete packet is received, making a forwarding decision based on the header validation. This preliminary action maintains authentication accuracy for the critical routing portion while avoiding the throughput penalty of waiting for complete packet reception.
Solution Approach 2:
The patent maintains continuous packet forwarding by not interrupting the data flow to wait for complete packet reception. Authentication checks run concurrently with forwarding operations, ensuring that the useful action of data transmission continues without interruption while security validation proceeds in parallel.
3Speed
If cut-through routing is implemented, then forwarding speed is improved, but risk of forwarding invalid packets increases
Solution Approach 1:
The patent performs preliminary authentication validation on packet headers before initiating cut-through routing forwarding. This preliminary check ensures that only packets passing basic authentication criteria are forwarded through the high-speed cut-through path, maintaining forwarding speed while reducing the risk of forwarding invalid packets.
Solution Approach 2:
The patent introduces an intermediary authentication check mechanism that sits between packet reception and cut-through forwarding. This intermediary layer validates critical packet information before enabling the high-speed forwarding path, acting as a gatekeeper that preserves speed while ensuring basic packet validity.
Data Source
AI summary
One embodiment of the invention provides a method of operating a switch with cut-through routing in a communications network. The method includes receiving a packet at a first port of the switch and determining a second port of the switch from which the received packet is to be forwarded out over the network. At least one authentication check is performed on the received packet. In general, the switch starts to forward the received packet from the second port prior to complete reception of the packet at the first port. However, this onward transmission is delayed until the authentication check has completed. This ensure that none of the received packet is forwarded from the second port if any authentication check fails.