800G Multi-Channel MACsec Engine with TDM Interface

The MACsec-IP-164 is a MACsec/IPsec engine developed specifically for high-speed, multi-rate and multi-port Ethernet devices. Its architecture provides an optimal multi-protocol solution solution for aggregate throughput ranging from 100G to 800G and beyond. The MACsec-IP-164 is ideal for deployment in data center, enterprise and carrier network applications, as well as network-attached high-performance computing.

Cloud computing and data center throughput requirements have driven Ethernet and OTN standards to 100G, 400G and now to 800G. These standards deploy multiple SerDes lanes with various rates, which require support for flexible bandwidth allocation for a varying number of channels (ports), depending on the target silicon.

How the MACsec-IP-164 works

The MACsec-IP-164 engine provides complete MACsec SecY frame processing for multiple channels (port). It supports multiple SecY (virtual ports) to realize protection for each individual virtual network running over the same physical port. Its pooled classification and transformation resources allow optimal implementation of multi-port designs. The fat-pipe design allows aggregating multiple port to use the same MACsec SecY.

The MACsec-IP-164 engine provides a cost-effective option for line-rate IPsec ESP packet processing for transport and tunnel modes with AES-GCM cipher. A port can work in either MACsec or IPsec mode. In IPsec mode, at egress, it receives classification results from the system side. At ingress, it can match the decrypting SA. Like in MACsec, it supports pooled SA and classification resources. Implementation supports IPsec topologies with sharing the same group key.

The MACsec-IP-164 engine is delivered together with a widely adopted Driver Development Kit (DDK-164). To build a system-level solution, Rambus offers the MACsec Toolkit product that implements a complete IEEE 802.1X specification and has multiple features that facilitate development and testing of the MACsec compliant processing.

The MACsec-164 engine has been used by leading silicon and system vendors over multiple generations thanks to the engine’s software compatibility and proven history of API scalability.

The MACsec-IP-163 is a virtual port matching classifier that works with the MACsec- IP-164 to form an autonomous MACsec processing data path. Alternatively, the MACsec-IP-164 can be used in combination with an external classifier or stand alone, depending on the use case.

• Packet Interface
  • 800G in 7nm technology
  • 400G/600G in 16nm technology
  • 100G/200G in reduced area configurations
  • Cut-through TDM interface
  • Up to 64 channels (ports)
  • Flexible bandwidth allocation
  • FlexE ready
• SA and Classification Scaling
  • Pooled SA (from few to many K entries)
  • TCAM internal/external
• Control Interface
  • AMBA APB3
  • Interrupts (global and per-channel)
• Default Protocol Support
  • Full IEEE 802.1AE-2018 compliance
    • IEEE 802.1AE
    • IEEE 802.1AEbn
    • IEEE 802.1AEbw
    • IEEE 802.1AEcg
  • MACsec with VLAN-in-clear
• Optional Features
  • Cisco MACsec extensions
  • IPsec ESP with AEC-GCM
• Other customer classifications
  • NIST CAVP Compliance for FIPS 140-3 Validation
  • Support for basic AES and AEC-GCM transformations

• Silicon proven MACsec solution with classifier and in-line interface for Multi-channel Ethernet.
• Supports all IEEE MACsec and additional customer specific or proprietary requirements on top of MACsec, related to VLAN parcing, and more.
• Supported by Driver Development Kit, QuickSec MACsec toolkit.

• Data center, Data center backbone networks, Network appliances providing Enterprise Network Security at Layer-2 using MACsec,
• End-station security solutions for laptops, PCs, printers and network servers.
• Fronthaul and Backhaul, OTN and PON.
• Base stations
• Home gateways

• Documentation
• Hardware Reference and Programmer Manual
• Integration Manual
• Verification Specification
• Programmer and Operations Manual
• Synthesizable Verilog RTL source code
• Self-checking RTL test bench, including test vectors and expected result vectors
• Simulation scripts
• Configurations:
• EIP-164d-e-c4-512:
• 512 SAs,
• 256 vPorts,
• 4 channels, Egress
• 2330k gates
• 213.3 bits/clk
• up to 550 MHz
• EIP-164d-i-c4-512:
• 512 SAs,
• 256 vPorts,
• 4 channels, Ingress
• 2650k gates
• 213.3 bits/clk
• up to 550 MHz
• EIP-164d-e-c4-256:
• 512 SAs,
• 128 vPorts,
• 4 channels, Egress
• 2170k gates
• 213.3 bits/clk
• up to 550 MHz
• EIP-164d-i-c4-256:
• 512 SAs,
• 128 vPorts,
• 4 channels, Ingress
• 2380k gates
• 213.3 bits/clk
• up to 550 MHz