TSN Network Interface MACsec Handling for Preempted Packet Fragments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network interfaces face challenges in handling fragmented MACsec protected preemptable packets interspersed with express packets, as MACsec processing on the line side results in fragments that violate standard frame size limits, leading to rejection by downstream processing units.
Innovation Solution
Implementing MACsec functionality on the network link side with a single dual-channel MACsec unit that processes both preemptable and express traffic, adjusting FCS information to conform to MAC layer expectations, and using compensation padding or fragment length indicators to maintain compliant frame sizes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MACsec protection is applied to preemptable packets that are fragmented due to TSN express traffic preemption, then network security is improved, but the fragmented packets violate standard frame size limits and are rejected by downstream processing units
Solution Approach 1:
The patent segments the MACsec processing function into two parts: FCS calculation is performed on the line side before fragmentation, while FCS verification is performed on the system side after reassembly. This segmentation allows MACsec protection to be applied to fragmented packets without violating frame size limits, as the security processing is distributed across different locations in the network interface.
Solution Approach 2:
The patent introduces an intermediary mechanism where the FCS information is calculated and attached to fragmented packets on the line side, serving as a mediator that allows downstream processing units to accept and handle the fragmented MACsec-protected packets without rejection, while maintaining frame size compliance through the compensation padding mechanism.
2Device complexity
If a single dual-channel MACsec unit is used to process both preemptable and express traffic on the line side, then device complexity is reduced, but processing both traffic types with different fragmentations becomes difficult
Solution Approach 1:
The patent implements a universal MACsec processing unit with dual channels that can handle both preemptable and express traffic through the same hardware structure. The unit processes MACsec for both traffic types using identical FCS calculation and verification mechanisms, eliminating the need for separate processing units while maintaining the ability to handle different traffic characteristics through the compensation padding and fragment length indicator mechanisms.
3Adaptability or versatility
If FCS information is adjusted to conform to MAC layer expectations after MACsec processing, then compatibility with downstream systems is improved, but additional processing steps increase device complexity
Solution Approach 1:
The patent performs FCS calculation on the line side before packet fragmentation occurs, as a preliminary action that prepares the FCS information in advance. This preliminary FCS calculation eliminates the need for complex post-processing adjustments, as the FCS is already computed correctly for the original unfragmented packet, and the same FCS value is used for verification after reassembly on the system side.
Data Source
AI summary
In a general aspect, a network interface capable of processing network traffic conforming to a Time Sensitive Network (TSN) standard and a Media Access Control layer security (MACsec) standard, comprises, within an ingress path, a Physical Coding Sublayer (PCS) connected to receive a traffic stream from a network link; a Media Access Control (MAC) unit configured to split the traffic stream into a preemptable packet stream and an express packet stream; and a MACsec unit connected between the PCS and the MAC unit, configured to operate on individual fragments of a preempted MACsec protected packet in the traffic stream to produce a traffic stream with unprotected fragments for the MAC unit.