Systolic Array Pipeline for High-Throughput Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional routers face performance degradation due to computationally intensive processes in determining destination ports, especially with high network traffic and encrypted packets, leading to bottlenecks in forwarding engines.
Innovation Solution
A security engine with a systolic array pipeline architecture is implemented in network processing devices to perform high-throughput encryption and decryption functions, breaking down processes into sub-steps and executing them in parallel across specialized processors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption and decryption engines are used in routers, then security is provided, but processing speed decreases significantly causing bottlenecks in network traffic
Solution Approach 1:
The encryption/decryption process is divided into multiple independent stages (e.g., key expansion, substitution, permutation, mixing) that can be executed in parallel. Each stage processes a portion of the data independently, allowing simultaneous execution across multiple processing elements within the forwarding engine, thereby maintaining security while dramatically improving throughput.
Solution Approach 2:
The patent transitions from sequential single-processor encryption/decryption to a multi-dimensional parallel processing architecture. Multiple processing elements operate simultaneously on different data blocks or different stages of the same data block, adding spatial parallelism to the traditionally temporal process. This dimensional expansion enables line-rate processing of encrypted packets without compromising security.
2Ease of operation
If the router determines destination ports for high-speed network traffic, then packet forwarding is achieved, but the computationally intensive process causes performance degradation at line rates
Solution Approach 1:
The router performs preliminary actions by pre-computing and caching routing information in content-addressable memory (CAM) tables before packets arrive. When encrypted packets are received, the forwarding engine can quickly match destination addresses against pre-computed routing entries without performing intensive real-time computations, enabling fast destination port determination even at line rates.
Solution Approach 2:
The patent replaces conventional microprocessor-based routing lookup with specialized hardware implementations including content-addressable memory (CAM) and parallel comparison logic. This substitution of general-purpose computing with dedicated hardware accelerators eliminates the computational bottleneck, allowing the router to handle high-speed encrypted traffic efficiently while maintaining accurate destination port determination.
Data Source
AI summary
A method and network device to process network data is described. The method may comprise receiving the network data and security operation data at a security engine. The security operation data may be associated with a security operation (e.g., encryption, decryption, hashing, or the like) to be performed on the network data. The network data and the security operation data is communicated to a systolic array including a plurality of serially interconnected processing elements each defining a processing stage. Data in each processing stage may be processed in parallel to obtain processed network data. The processed data may be stored in a memory for use by a network processing module and may identify a destination of a packet in the network. In an example embodiment, decryption or encryption may be divided up into a plurality of sub-operations wherein each sub-operation is performed by a processing stage.