Chaining port scheme for network security

• US 20080141023A1
• Filed: 12/08/2006
• Published: 06/12/2008
• Est. Priority Date: 12/08/2006
• Status: Active Grant

• Current Assignee: Avago Technologies General IP PTE Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Qi, Zheng
• Granted Patent: US 8,112,622 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14

Abstract

A networking method, microchip, and device are described in which a first security engine may be associated with a chaining port and configured to perform an inner processing for an inner layer of encryption for a frame of data, while a second security engine may be associated with an external port and configured to perform an outer processing for an outer layer of encryption for the frame of data. Control logic may be configured to instruct the first security engine to execute both a transmit operation and a receive operation of the frame of data in association with the inner processing.

Claims

1. A network chip comprising:

a first security engine associated with a chaining port and configured to perform an inner processing for an inner layer of encryption for a frame of data;

a second security engine associated with an external port and configured to perform an outer processing for an outer layer of encryption for the frame of data; and

control logic configured to instruct the first security engine to execute both a transmit operation and a receive operation of the frame of data in association with the inner processing.

2. The networking chip of claim 1 wherein the inner layer includes a MACSec layer.

3. The networking chip of claim 1 wherein the first security engine is configured to perform the inner processing for the inner layer of encryption including encrypting the inner layer of encryption.

4. The networking chip of claim 1 wherein the first security engine is configured to perform the inner processing for the inner layer of encryption including decrypting the inner layer of encryption.

5. The networking chip of claim 1 wherein the first security engine is configured to perform the inner processing for the inner layer of encryption including applying an inner cryptographic key associated with an inner security tag of the frame.

6. The networking chip of claim 1 wherein the chaining port is configured to execute an external loopback function on the frame of data in association with the first security engine executing both the transmit and the receive operation on the frame of data.

7. The networking chip of claim 1 wherein:

the transmit operation includes encrypting the inner layer of encryption in response to receiving the frame of data from a switch logic of the network chip.

8. The networking chip of claim 1 wherein:

the receive operation includes decrypting the inner layer of encryption in response to receiving the frame of data from the second security engine.

9. The networking chip of claim 1 wherein the second security engine is configured to perform the outer processing including decrypting the outer layer of encryption after receiving the frame of data from the external port, and thereafter to send the frame of data to the first security engine.

10. The networking chip of claim 1 wherein the control logic is configured to route the frame between the first security engine and the second security engine.

11. The networking chip of claim 1 wherein:

the first security engine is configured to perform the inner processing including adding or removing an inner security tag to/from the frame of data; and

the second security engine is configured to perform the outer processing including adding or removing an outer security tag to/from the frame of data.

12. The networking chip of claim 1 wherein the first security engine is configured to perform the inner processing for the inner layer of encryption including adding an security tag for the inner layer of encryption and adding a non-decryption tag in association with the security tag and designating that the first security engine should not remove the security tag during the receive operation.

13. A method comprising:

providing a first security engine associated with a chaining port and configured to perform an inner processing for an inner layer of encryption for a frame of data;

providing a second security engine associated with an external port and configured to perform an outer processing for an outer layer of encryption for the frame of data; and

providing control logic configured to instruct the first security engine to execute both a transmit operation and a receive operation of the frame of data in association with the inner processing.

14. The method of claim 13 wherein providing the first security engine comprises providing the first security engine being configured to add a non-decryption tag to the frame of data in association with an addition of an inner security tag during the inner processing, the first security engine being configured not to remove the inner security tag during the receive operation, based on the non-decryption tag.

15. The method of claim 13 wherein providing the control logic comprises providing communication between the first security engine and the second security engine.

16. The method of claim 13 wherein providing the control logic comprises configuring the second security engine to route the frame of data, when received from the external port, to the first security engine, after removal of an outer security tag therefrom.

17. A network device comprising:

a chaining port associated with a first security engine that is configured to transmit and receive a frame of data and to process an inner layer of encryption of the frame in association with at least one of the transmit and the receive; and

an external port associated with a second security engine that is configured to receive the frame of data and process an outer layer of encryption of the frame.

18. The network switch of claim 17 wherein the first security engine and the second security engine are in communication with one another.

19. The network switch of claim 17 wherein the network switch is associated with a management interface configured to configure a first port and a second port of the network switch between a first configuration in which the first port and the second port operate as standard ports, and a second configuration in which the first port and the second port operate as the chaining port and the external port, respectively.

20. The network switch of claim 17 wherein the outer layer includes an outer MACSec layer, and the inner layer includes an inner MACSec layer, and wherein the network switch is configured to send the frame over an Ethernet network.