Ethernet Frame Classifier for Low-Load Secure Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Ethernet security protocols for in-vehicle communications face challenges in secure communication implementation as Ethernet speeds increase, leading to high CPU load and complex hardware requirements, particularly with protocols like IPsec and TLS/DTLS, and large lookup tables are impractical due to area cost or reduced lookup speed.
Innovation Solution
A frame classifier in an Ethernet switch identifies frame characteristics to compute a key index, determines security parameters using a collision entry table, and employs a second key index for resolving collisions, reducing CPU load and memory usage by minimizing the size of lookup tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If large lookup tables are used to store security parameters for Ethernet frames, then security parameter determination accuracy is improved, but hardware area cost increases and lookup speed decreases
Solution Approach 1:
The patent segments the security parameter storage into two parts: a compact collision entry table stored in hardware (TCAM) that maps key indices to security parameter sets, and a flow identifier table stored in software (CPU memory) that maps flow identifiers to key indices. This segmentation allows the hardware to maintain a small, fast lookup table while the software handles the comprehensive security parameter storage, resolving the contradiction between accuracy and hardware area cost.
Solution Approach 2:
The patent introduces a key index as an intermediary between the flow identifier and the security parameters. Instead of directly mapping flow identifiers to security parameters (which would require a large lookup table), the system first computes a key index from frame characteristics, then uses this key index to retrieve the appropriate security parameter set. This intermediary approach significantly reduces the size of hardware lookup tables while maintaining accurate security parameter determination.
2Measurement precision
If large lookup tables are used to store security parameters for Ethernet frames, then security parameter determination accuracy is improved, but lookup speed decreases
Solution Approach 1:
The patent segments the security parameter storage into two parts: a compact collision entry table stored in hardware (TCAM) that maps key indices to security parameter sets, and a flow identifier table stored in software (CPU memory) that maps flow identifiers to key indices. This segmentation allows the hardware to maintain a small, fast lookup table while the software handles the comprehensive security parameter storage, resolving the contradiction between accuracy and hardware area cost.
Solution Approach 2:
The patent introduces a key index as an intermediary between the flow identifier and the security parameters. Instead of directly mapping flow identifiers to security parameters (which would require a large lookup table), the system first computes a key index from frame characteristics, then uses this key index to retrieve the appropriate security parameter set. This intermediary approach significantly reduces the size of hardware lookup tables while maintaining accurate security parameter determination.
3Productivity
If traditional Ethernet security protocols are implemented on CPU, then security processing capability is improved, but CPU load increases
Solution Approach 1:
The patent extracts the security parameter determination function from the CPU and implements it in hardware using a frame classifier that computes key indices and retrieves security parameters from lookup tables. This extraction offloads the computationally intensive security processing from the CPU, maintaining high security processing capability while significantly reducing CPU load and energy consumption.
Solution Approach 2:
The patent introduces a key index as an intermediary between the flow identifier and the security parameters. Instead of directly mapping flow identifiers to security parameters (which would require a large lookup table), the system first computes a key index from frame characteristics, then uses this key index to retrieve the appropriate security parameter set. This intermediary approach significantly reduces the size of hardware lookup tables while maintaining accurate security parameter determination.
Data Source
AI summary
In some implementations, a device may identify a set of characteristics of a frame. The device may compute a first key index associated with the frame based on the set of characteristics and using a first key index function. The device may determine whether the first key index is associated with any collision entries from a set of collision entries. The device may determine a set of security parameters associated with the frame using a particular key index. The particular key index is either the first key index when the first key index is not associated with any collision entries from the set of collision entries, or is a second key index when the first key index is associated with a collision entry from the set of collision entries.