Overview
Ethernet is a ubiquitous, efficient and cost-effective transport mechanism for unified communication of voice, data and video over a shared medium, but it was not designed with secure networks in mind and is not inherently secure. MACSEC can be applied to any Ethernet network and as well as its use in commercial networks is eminently well suited to overlay an additional layer of security to military and governmental communications systems. MACSEC also provides an exciting opportunity to add standards based security to Ethernet connected embedded systems.
The concept of the MACsec scheme is that nodes on a network form a set of trusted entities. Each node can receive both encrypted or plaintext messages, and the system policy can dictate how each is handled. Unlike protocols such as IPsec which are end-to-end and session based, the MACSEC decrypts and verifies each packet at every node. Packets that require routing to other trusted nodes in the system are then encrypted and forwarded.
The MACSEC core is a high performance pipelined implementation of IEEE standard 802.1ae. The core is built on Algotronix' AES-GCM-40G encryption IP core. The MACSEC core supports multiple 'virtual' MACSec SecYs on a single hardware encryptor which allows for a Multi-Access LAN as specified in section 11-8 of the standard. Each SecY has a single secure channel for transmit so unless multiple SecYs are supported an end point would use the same key to send packets to all the end-points it wished to communicate with. For example, if it wished to communicate with endpoints A and B then B would have access to the key used to encrypt messages for A. Multiple SecYs provide more control of security - for example a separate SecY could be used for node A and node B after and node B would no longer be provided with the key to decrypt messages intended for node A.
The Algotronix MACSEC core is supplied with a VHDL testbench which generates a sequence of test packets and compares the responses of the IP core to the output generated by a behavioral model of MACSEC. It is supplied as VHDL source code and can be configured using a number of VHDL generic parameters to select only those features which are required in order to conserve area. The MACSEC core provides both transmit and receive channels. The core is an easy to use fully synchronous design with a single clock and separate flow control on the transmit and receive channels. The core has been designed for efficiency in modern FPGAs and makes full use of FPGA specific features such as dual port memory blocks.
Learn more about MACsec IP core
Algotronix and Adaptive Micro-Ware announced today that they have reached an agreement to co-operate on combining their encryption and video IP cores to provide unique solutions for secure video transmission.
The availability of low-cost IP cores that implement AES-128 or AES-256 opens up the possibility that all drives can have high-grade encryption as standard.
Algotronix Ltd., Edinburgh, UK announces the availability of an XTS-AES core to meet the NIST SP800-38E recommendation published in January 2010 and the IEEE 1619-2007 standard.
Algotronix has announced the availability of a reference design that provides Advanced Encryption Standard (AES) over USB. The company provides an interface to Altera's NIOS II soft processor that works with their G3 core to provide AES encryption and decryption of files passed over a USB 2 interface.
Algotronix Ltd., Edinburgh, UK was presented with two prestigious awards this week, recognising its contribution to the industry.
This article describes a new way of tagging designs to help to counter the rapidly growing trade in stolen IP and cloned designs. The topic is a difficult one for the industry to discuss; recently, however, more and more voices have been raised on the issue.
