Programmable Cryptographic Engine for Multi-Standard Packet Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cryptographic systems face challenges in efficiently supporting multiple security standards and high processing speeds, leading to performance and chip area issues, as they require custom logic for each mode and struggle to keep up with evolving security standards.
Innovation Solution
The implementation of programmable control-plane and data-plane engines, along with a security context cache module, allows for concurrent processing of multiple security standards like IPSEC, SRTP, and WiMax using the same engines, enabling adaptive firmware-controlled security header processing and hardware-driven data staging, which separates control and data planes to avoid blocking effects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If custom logic is implemented for each cryptographic mode, then security functionality is achieved, but chip area increases and device complexity increases
Solution Approach 1:
The patent implements a universal cryptographic engine that can execute multiple cryptographic modes (AES, DES, 3DES, RC4, MD5, SHA-1, etc.) through a single reconfigurable architecture. The engine uses a unified state machine and lookup table structure that can be programmed via control signals to perform different cryptographic operations, eliminating the need for separate custom logic circuits for each mode and significantly reducing chip area while maintaining full security functionality.
Solution Approach 2:
The cryptographic engine employs dynamic reconfiguration capabilities where the same hardware structure can change its operational mode on-the-fly based on input signals. The state machine transitions between different operational states (encryption, decryption, authentication) and the lookup tables are dynamically accessed based on the current cryptographic mode, allowing a single static hardware design to perform multiple functions that would traditionally require separate custom logic.
2Adaptability or versatility
If multiple security standards are supported, then adaptability improves, but processing speed decreases due to complexity
Solution Approach 1:
The patent divides the cryptographic processing into distinct functional segments: a control plane for mode selection and configuration, a data plane for actual cryptographic operations, and separate lookup table structures for different algorithms. This segmentation allows the data plane to operate at full speed once configured, while the control plane handles the complexity of supporting multiple standards. The segmented architecture enables parallel processing of different security standards without mutual interference, maintaining high processing speeds across all supported protocols.
Solution Approach 2:
The system performs preliminary configuration of the cryptographic engine through firmware or control signals before actual data processing begins. The mode selection, parameter setup, and lookup table selection are all predetermined and configured in advance, allowing the main processing pipeline to operate at maximum speed without real-time decision-making delays. This preliminary action separates the complexity of supporting multiple standards from the time-critical data processing path.
3Device complexity
If control plane and data plane are combined, then device complexity is reduced, but blocking effects occur and productivity decreases
Solution Approach 1:
The patent explicitly separates the system into a control plane (handling mode selection, configuration, and command generation) and a data plane (handling actual cryptographic data processing). This segmentation allows the control plane to prepare commands and the data plane to execute them in parallel without blocking each other. The control plane can configure the engine for the next operation while the data plane processes current data, maximizing throughput and eliminating the blocking effects that would occur in a combined architecture.
Data Source
AI summary
An electronic circuit (200) includes one or more programmable control-plane engines (410, 460) operable to process packet header information and form at least one command, one or more programmable data-plane engines (310, 320, 370) selectively operable for at least one of a plurality of cryptographic processes selectable in response to the at least one command, and a programmable host processor (100) coupled to such a data-plane engine (310) and such a control-plane engine (410). Other processors, circuits, devices and systems and processes for their operation and manufacture are disclosed.