CXL Receiver Latency Reduction via Batch MAC Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing Compute Express Link (CXL) protocol's flit-level authentication mechanism introduces extra latency, which is undesirable for sensitive traffic like memory loads, and requires large no-skid buffers to prevent unauthenticated messages from being sent downstream, leading to increased latency and area requirements.
Innovation Solution
Implementing a per-message authentication technique that maintains MAC epochs, allowing the receiver to reduce latency by authenticating messages as a group rather than individually, eliminating the need for a no-skid buffer and reducing the number of times the header is decoded.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If flit-level authentication mechanism is used in containment mode, then security and integrity are improved, but message transfer latency increases
Solution Approach 1:
The patent merges multiple flits into a single MAC epoch for batch authentication. Instead of authenticating each flit individually, the receiver collects a group of flits (forming a MAC epoch) and authenticates them together using a single MAC value, thereby reducing the frequency of authentication operations and lowering overall latency while maintaining integrity protection.
Solution Approach 2:
The patent performs preliminary decryption of flits before authentication. By decrypting flits ahead of time and storing them in a buffer, the system prepares data in advance so that when authentication completes, the decrypted flits are already ready for downstream processing, eliminating wait time and reducing overall message transfer latency.
2Reliability
If flit-level authentication mechanism is used in containment mode, then security is improved, but area requirements increase
Solution Approach 1:
The patent merges multiple flits into a single MAC epoch for batch authentication. This reduces the number of authentication operations needed, allowing the no-skid buffer to be smaller since it only needs to hold flits for one epoch rather than maintaining larger buffers for individual flit authentication.
Solution Approach 2:
The patent changes the authentication granularity from per-flit to per-epoch (per-message or per-group). This parameter change fundamentally alters the buffer size requirements, as the buffer only needs to accommodate flits within a single epoch rather than larger structures required for strict per-flit authentication in containment mode.
3Loss of time
If per-message authentication is implemented, then latency is reduced, but authentication granularity changes
Solution Approach 1:
The patent segments the authentication process into distinct phases: flit collection phase (where flits are gathered into a MAC epoch), authentication phase (where the epoch is validated), and release phase (where authenticated flits are forwarded). This segmentation allows the system to maintain containment mode integrity while achieving lower latency through batch processing.
Solution Approach 2:
The patent introduces dynamic buffering where the no-skid buffer temporarily holds decrypted flits during the authentication process. The buffer size and holding duration are dynamically adjusted based on the epoch structure and authentication timing, allowing flexible optimization between latency and resource usage.
Data Source
AI summary
In one embodiment, an apparatus includes: a control circuit to receive a message authentication code (MAC) for an epoch comprising a plurality of flits; a calculation circuit to calculate a computed MAC for the epoch; a cryptographic circuit to receive the epoch via a link and decrypt the plurality of flits, prior to authentication of the epoch; and at least one memory to store messages of the decrypted plurality of flits, prior to the authentication of the epoch. Other embodiments are described and claimed.