Reconfigurable key search engine

• US 20060034461A1
• Filed: 03/16/2005
• Published: 02/16/2006
• Est. Priority Date: 08/12/2004
• Status: Abandoned Application

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Park, Tae Gon
• Application Number:
  US11/081,000
• Publication Number:
  US 20060034461A1
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

A Reconfigurable Key Search Engine is disclosed along with a mobile unit incorporating same and related methods. The RKSE is adapted to efficiently search a memory system storing a plurality of security keys potentially related to multiple networks. One embodiment uses a hierarchical memory system including at least one associative memory.

Claims

1. A mobile unit, comprising:

a Key Search Engine (KSE) to receive search criteria from a network, to provide a security key, and comprising a memory system to store a plurality of security keys;

wherein the memory system comprises;

an associative memory to provide an index output in response to index data derived from the search criteria, and a memory to output the security key in response to the index output.

2. The mobile unit of claim 1, wherein the KSE comprises a KSE control block to receive the search criteria, and to derive the index data.

3. The mobile unit of claim 2, wherein the search criteria comprises at least one of data packet information related to a data packet received in the mobile unit, and auxiliary information related to an element in the network.

4. The mobile unit of claim 3, wherein the auxiliary information comprises control option information related to a user-defined option selection.

5. The mobile unit of claim 2, wherein the KSE control block further comprises:

an Input/Output block to receive the search criteria and output the security key;

an associative memory interface to connect the KSE control block with the associative memory; and

,

a memory interface to connect the KSE control block with the memory.

6. The mobile unit of claim 2, wherein the KSE control block further comprises:

an index selector to derive the index data in response to the search criteria.

7. The mobile unit of claim 6, wherein the index selector comprises:

a register block and a mapper.

8. The mobile unit of claim 7, wherein the register block comprises a reconfigurable register adapted to output index data of varying size or character in response a mapper output.

9. The mobile unit of claim 8, wherein the mapper comprises a mapping table or a finite state machine.

10. The mobile unit of claim 1, wherein the plurality of security keys comprises a default key, and the memory system further comprises a default memory storing the default key.

11. The mobile unit of claim 10, wherein security key comprises multiple components, and the memory comprises multiple memories, each storing one or more of the multiple components.

12. The mobile unit of claim 11, wherein the multiple components comprise at least one of, an encryption/decryption key, a cipher, and an Initialization Vector (IV).

13. The mobile unit of claim 1, wherein security key comprises multiple components, and the memory comprises multiple memories, each storing one or more of the multiple components.

14. The mobile unit of claim 13, wherein the multiple components comprise at least one of;

a Security Association Identifier (SAID), a Traffic Encryption Key (TEK), a Security Association (SA) and an Initialization Vector (IV).

15. The mobile unit of claim 13, wherein the associative memory comprises multiple Content Addressable Memories (CAMs).

16. The mobile unit of claim 11, wherein the associative memory comprises multiple Content Addressable Memories (CAMs).

17. The mobile unit of claim 1, wherein the associative memory comprises multiple Content Addressable Memories (CAMs).

18. The mobile unit of claim 1, wherein the KSE comprises:

an index operation block to receive index criteria derived from the search criteria and the index output, and to generate a memory address.

19. The mobile unit of claim 18, wherein the index operation block comprises a circuit performing concatenation, a circuit performing a hashing operation, or a circuit performing a logical operation.

20. The mobile unit of claim 5, wherein the KSE control block further comprises:

an index selector comprising a register block and a mapper, the index selector to derive the index data from the data packet information and the auxiliary information by operation of the register block and the mapper.

21. The mobile unit of claim 20, wherein the register block comprises a register storing control option information.

22. The mobile unit of claim 21, wherein the index selector further comprises an index operation block to receive index criteria selected from the search criteria and the index output, and to output a memory address applied to the memory.

23. A Key Search Engine (KSE), comprising:

a KSE control block to receive search criteria from a network, to derive index data from the search criteria, and to provide a security key; and

,

a memory system to store a plurality of security keys,

wherein the memory system comprises an associative memory to provide an index output in response to the index data, and a memory to output the security key in response to the index output.

24. The KSE of claim 23, wherein the search criteria comprises at least one of data packet information related to a data packet received in the KSE, and auxiliary information related to an element in the network.

25. The KSE of claim 24, wherein the auxiliary information comprises control option information related to a user-defined option selection.

26. The KSE of claim 25, wherein the KSE control block further comprises:

an Input/Output block to receive the search criteria and output the security key;

an associative memory interface to connect the KSE control block with the associative memory; and

,

a memory interface to connect the KSE control block with the memory.

27. The KSE of claim 26, wherein the KSE control block further comprises:

an index selector to derive the index data in response to the search criteria.

28. The KSE of claim 27, wherein the index selector comprises:

a register block and a mapper.

29. The KSE of claim 28, wherein the register block comprises a reconfigurable register adapted to output index data of varying size or character in response a mapper output.

30. The KSE of claim 29, wherein the mapper performs a mapping operation in response to one of the search criteria, an associative memory data entry, and a memory data entry.

31. The KSE of claim 30, wherein the mapper comprises a mapping table or a finite state machine.

32. The KSE of claim 23, wherein the plurality of security keys comprises a default key, and the memory system comprises a default memory storing the default key.

33. The KSE of claim 32, wherein the security key comprises multiple components, and the memory comprises multiple memories, each storing one or more of the multiple components.

34. The KSE of claim 33, wherein the multiple components comprise at least one of, an encryption/decryption key, a cipher, and an Initialization Vector (IV).

35. The KSE of claim 23, wherein the security key comprises multiple components, and the memory comprises multiple memories, each storing one or more of the multiple components.

36. The KSE of claim 35, wherein the multiple components comprise at least one of;

a Security Association Identifier (SAID), a Traffic Encryption Key (TEK), a Security Association (SA) and an Initialization Vector (IV).

37. The KSE of claim 23 further comprising:

an index operation block to receive index criteria derived from the search criteria and the index output, and to generate a memory address.

38. The KSE of claim 37, wherein the index operation block comprises a circuit performing concatenation, a circuit performing a hashing operation, or a circuit performing a logical operation.

39. A mobile unit adapted to connect within a first network communicating data in accordance with a first protocol and a second network communicating data in accordance with a second protocol, the mobile unit comprising:

a Reconfigurable Key Search Engine (RKSE), comprising;

a memory system storing a plurality of security keys related the first and second networks; and

,

a control block outputting a security key selected from the plurality of security keys in response to search criteria comprising data packet information received by the mobile unit.

40. The mobile unit of claim 39, wherein the first network is a Wireless Local Area Network (WLAN), and the second network is a Wireless Metropolitan Area Network (WMAN) or an Ad-hoc network.

41. The mobile unit of claim 40, wherein the memory system comprises:

an associative memory receiving index data derived from the search criteria and outputting an index output; and

,

a memory receiving a memory address derived from the index output and outputting the security key in response to the memory address.

42. The mobile unit of claim 41, wherein the index output indicates a HIT condition if the index data identifies an associative memory entry, or a MISS condition if the index data fails to identify an associative memory entry.

43. The mobile unit of claim 42, wherein the memory system further comprises:

a default memory receiving the memory address when a MISS condition is indicated; and

,

wherein the memory receives the memory address when a HIT condition is indicated.

44. The mobile unit of claim 43, wherein the default memory is a hierarchical memory comprising multiple default memories, each storing related components of the security key;

and,

wherein the multiple default memories are responsive to the received memory address.

45. The mobile unit of claim 43, wherein the memory is a hierarchical memory comprising multiple memories, each storing related components of the security key;

and,

wherein the multiple memories are responsive to the received memory address.

46. The mobile unit of claim 44, wherein the memory is a hierarchical memory comprising multiple memories, each storing related components of the security key;

and,

wherein the multiple memories are responsive to the received memory address.

47. The mobile unit of claim 41, wherein the RKSE further comprises:

an index operation block receiving the index output and index criteria; and

,

wherein the memory address is derived by performing a logical operation on the index output and the index criteria.

48. The mobile unit of claim 47, wherein the logical operation is a concatenation or a hash.

49. The mobile unit of claim 47, wherein the index criteria is derived from the search criteria.

50. The mobile unit of claim 49, wherein the search criteria comprises auxiliary information related to the mobile unit.

51. The mobile unit of claim 50, wherein the auxiliary information comprises control option information related to user-defined option selections.

52. The mobile unit of claim 50, wherein the index criteria is defined at least in part in relation to the control option information.

53. The mobile unit of claim 40, wherein the control block further comprises:

an Input/Output block to receive the search criteria and output the security key;

an associative memory interface to connect the control block with the associative memory; and

,

a memory interface to connect the control block with the memory.

54. The mobile unit of claim 53, wherein the memory system comprises:

a first Content Addressable Memory (CAM) receiving first index data from the control block and outputting a first index output;

a first memory receiving a first memory address derived from the first index output and outputting a first security key component output;

a second CAM receiving second index data derived from the first security key component output and outputting a second index output; and

,

a second memory receiving the second index data and outputting a second security key component output.

55. The mobile unit of claim 54, wherein the first security key component output is a Security Association Identifier (SAID), and the second security key component output comprises a Traffic Encryption Key (TEK) and a corresponding Initialization Vector (IV).

56. The mobile unit of claim 40, further comprising:

first circuitry adapted to communicate with a WLAN and second circuitry adapted to communicate with a WMAN or an Ad-hoc network, wherein the first and second circuitry commonly access the RKSE to obtain a respective security key.

57. The mobile unit of claim 41, wherein the first network is a WLAN, and the second network is a WMAN or an Ad-hoc network,

wherein the plurality of security keys comprises a plurality of WLAN-related security keys, and a plurality of WMAN-related security keys or a plurality of AD-hoc network-related security keys;

wherein the mobile unit comprises a radio frequency receiver receiving a data packet; and

,

wherein the RKSE outputs a WLAN-related security key selected from the plurality of WLAN-related security keys where the received data packet originates from the WLAN,

outputs a WMAN-related security key selected from the plurality of WMAN-related security keys where the received data packet originates from the WMAN, or

outputs an Ad-hoc network-related security key selected from the plurality of Ad-hoc network-related security keys where the received data packet originates from the Ad-hoc network.

58. The mobile unit of claim 57, wherein the memory system further comprises a default memory storing selected at least one WLAN security key comprising a default key.

59-103. -103. (canceled)