Hardware MACsec Key Exchange in Resource-Constrained Ethernet Bridges
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Ethernet bridges with limited resources face challenges in implementing the MACsec Key Agreement (EAPOL-MKA) protocol due to the need for state machine implementation and significant silicon and memory usage, which is not feasible in resource-constrained environments.
Innovation Solution
A hardware-based protocol for secured key distribution is implemented using existing MACsec hardware blocks in Ethernet bridges, where session encryption keys are generated independently by the host and bridge, and a secure association key (SAK) is distributed and installed using a simplified transaction, leveraging AES-GCM and AES-CMAC for encryption and minimal memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the EAPOL-MKA protocol is implemented using state machine software in memory, then secure key distribution is achieved, but silicon space and memory consumption increase significantly
Solution Approach 1:
The patent replaces the software-based state machine implementation with a hardware-based finite state machine (FSM) implemented in logic circuits. This substitution moves the security protocol from software execution in memory to dedicated hardware logic, eliminating the need for large memory allocations and complex software stacks while maintaining the same security functionality. The hardware FSM directly implements the protocol states and transitions through circuit logic rather than software interpretation.
Solution Approach 2:
The patent extracts and implements only the essential key distribution functionality of EAPOL-MKA in hardware, rather than implementing the complete software protocol stack. By taking out the core state machine logic and implementing it directly in hardware circuits, the solution achieves secure key distribution with minimal silicon and memory resources, excluding unnecessary software overhead and memory management structures.
2Quantity of substance
If a hardware-based protocol is implemented without CPUs or flash memory, then resource consumption is minimized, but implementation complexity increases
Solution Approach 1:
The patent implements a universal hardware architecture that can handle multiple MACsec operations including key distribution, key installation, and security association management through a single finite state machine. This multi-functional hardware design consolidates what would otherwise require separate processing units and memory systems, achieving resource minimization without proportionally increasing complexity. The same hardware blocks perform multiple protocol functions.
Solution Approach 2:
The patent segments the key distribution protocol into distinct hardware state machines and logic blocks, each handling specific protocol functions. Rather than implementing a monolithic complex processor, the solution divides the protocol handling into manageable hardware modules (e.g., separate states for key generation, exchange, and installation), making the overall system more implementable in resource-constrained hardware while maintaining functionality.
3Reliability
If session encryption keys are generated independently by host and bridge, then key distribution security is improved, but key matching and synchronization become more difficult
Solution Approach 1:
The patent implements a feedback mechanism where the hardware finite state machine monitors and tracks the key generation and distribution process. When independent keys are generated by the host and bridge, the hardware protocol automatically manages the key exchange, verification, and synchronization through predefined state transitions. The feedback loop ensures that both parties arrive at the same security association keys through coordinated hardware operations rather than complex software negotiation.
Solution Approach 2:
The patent performs preliminary key generation and validation actions in hardware before actual data transmission begins. The finite state machine pre-establishes the security associations and verifies key matching during the hardware handshake process, so that when data transmission starts, synchronization is already confirmed. This preliminary hardware-based key establishment simplifies ongoing synchronization compared to continuous software verification.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A new approach is proposed to support secured key distribution between a host and a resource-constrained Ethernet bridge using MACSec, wherein the resource-constrained Ethernet bridge is a hardware having a plurality of hardware blocks but no processor or non-volatile storage. Under the proposed approach, a protocol for secured key distribution is fully implemented using existing hardware blocks of the resource-constrained Ethernet bridge. First, session encryption keys (SEKs) are generated independently by both the host and the Ethernet bridge. If the SEKs match, the host is configured to generate and distribute a Secure Association Key (SAK) to the Ethernet bridge to be installed on it. After the SAK is installed on the Ethernet bridge, a secured communication channel is established between the host and the Ethernet bridge. The secured communication channel can be utilized for secured communication of sensitive data collected by the Ethernet bridge from a plurality of electronic devices.