Frame Classifier Key Indexing for High-Speed Ethernet Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Ethernet security protocols for in-vehicle communications face challenges in secure communication implementation as Ethernet speeds increase, leading to high CPU load and complex hardware requirements, particularly with protocols like IPsec and TLS/DTLS, and traditional lookup tables for security key indices are either expensive or impractical in terms of area cost and speed.
Innovation Solution
A frame classifier in an Ethernet switch identifies frame characteristics to compute a key index, determines security parameters using a collision entry table, and employs a second key index for resolving collisions, reducing CPU load and memory usage by minimizing the size of lookup tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional lookup tables are used for security key indices, then security communication can be implemented, but the area cost and hardware complexity increase significantly
Solution Approach 1:
The patent segments the security key index lookup process into two stages: first using a collision entry table to determine potential key indices, then using a second lookup table only for collision resolution. This segmentation reduces the size of the primary lookup table needed for most lookups while maintaining security functionality.
Solution Approach 2:
The patent introduces a collision entry table as an intermediary structure between the frame characteristics and the security key indices. This intermediary table maps frame characteristics to potential key indices, reducing the direct lookup table size required while maintaining secure communication capabilities.
2Reliability
If traditional lookup tables are used for security key indices, then security communication can be implemented, but the hardware requirements and CPU load increase
Solution Approach 1:
The patent divides the security key index determination into multiple steps using different table structures. The collision entry table handles the majority of lookups efficiently, while a smaller second lookup table handles collision cases, reducing overall hardware complexity compared to a single large lookup table.
Solution Approach 2:
The patent uses a collision entry table that may contain more entries than the minimum required, allowing for collision resolution without needing a proportionally large lookup table. This partial action approach reduces hardware requirements while maintaining security communication reliability.
3Speed
If Ethernet speeds increase, then communication performance improves, but CPU load and processing complexity increase
Solution Approach 1:
The patent replaces CPU-intensive security key index lookup operations with hardware-based table lookups. The collision entry table and second lookup table are implemented in hardware memory structures that can be accessed parallel to data transmission, reducing CPU load while maintaining high Ethernet speeds.
Solution Approach 2:
The patent performs security key index determination in advance of actual data processing by using the collision entry table to pre-identify key indices based on frame characteristics. This preliminary action reduces the processing burden on the CPU during high-speed data transmission.
Data Source
AI summary
In some implementations, a device may identify a set of characteristics of a frame. The device may compute a first key index associated with the frame based on the set of characteristics and using a first key index function. The device may determine whether the first key index is associated with any collision entries from a set of collision entries. The device may determine a set of security parameters associated with the frame using a particular key index. The particular key index is either the first key index when the first key index is not associated with any collision entries from the set of collision entries, or is a second key index when the first key index is associated with a collision entry from the set of collision entries.