At Rambus, we create cutting-edge semiconductor and IP products, spanning memory and interfaces to security, smart sensors and lighting.
1.6T/3.2T Multi-Channel MACsec Engine with TDM Interface (MACsec-IP-364)
MACsec solution for data center, service providers, 5G and AI
The MACsec-IP-364 is a MACsec/IPsec engine developed specifically for high-speed, multi-rate and multi-port Ethernet devices. Its architecture provides an optimal multi-protocol solution for aggregate throughput for 1.6T and 3.2T. The MACsec-IP-364 is ideal for deployment in data center, enterprise and carrier network applications, as well as network-attached high-performance computing.
Remarkable progress in optical connectivity in combination with the ramp of 3/2nm silicon technology has enabled 1.6T pluggable optical modules for short-reach (<10km) to long-haul (>500km) applications. A new generation of Rambus industry-proven MACsec/IPsec Silicon IP can secure Terabit-plus Ethernet traffic while maintaining power budgets and addressing the latency and throughput requirements of advanced end applications.
Contact
Product Brief
Security CertificationsComplete and fully compliant MACsec Packet Engine with classifier and transformation engines for rates of 1.6T and 3.2T, up to 64 channels, ready for FlexE
All IEEE MACsec standards supported (including IEEE802.1AE-2018). Optional inclusion of IPsec ESP transport and tunnel modes
Supplied with the Driver Development Kit to accelerate time to market. Rambus offers MACsec Toolkit for IEEE 802.1X key management
How the MACsec-IP-364 Works
The MACsec-IP-364 engine provides complete MACsec SecY frame processing for multiple channels (ports). It supports multiple SecY (virtual ports) to realize protection for each individual virtual network running over the same physical port. Its pooled classification and transformation resources allow optimal implementation of multi-port designs. A segmented, fat-pipe design allows aggregating multiple ports to use the same MACsec SecY as well as protecting a single port.
The MACsec-IP-363 is a virtual port matching classifier that works with the MACsec-IP-364 to form an autonomous MACsec processing data path. Alternatively, the MACsec-IP-364 can be used in combination with an external classifier or stand alone, depending on the use case.
The MACsec-IP-364 (+ 363) engine offers flexibility on integration in the customer’s Ethernet subsystem. Integration depends on the following major factors: data path design (channelized or port-based), bus width, number of packets per clock, location of the IEEE 1588 timestamping and preferred method for handling packet expansion (per-packet or port-based). Customers have the flexibility to implement buffering and flow control according to their system requirements.
The engine provides the minimum latency and deterministic latency and can be used in combination with IEEE1588 timestamp update logic.
For applications that require numerous SA and TCAM matching rules, the engine can be supplied with a TCAM controller that supports configurable TCAM profiles. The default TCAM implementation is logic-based.
MACsec Fundamentals
For end-to-end security of data, it must be secured both when at rest (stored on a connected device) and when in motion (communicated between connected devices). For data at rest, a hardware root of trust anchored in silicon provides that foundation upon which all device security is built. Similarly, MACsec security anchored in hardware at the foundational communication layer (Layer 2) provides that basis of trust for data in motion over Ethernet-based networks.
Solution Offerings
Packet Interface
- Channelized interface (TDM)
- Segmented data bus from 1024-bit to 2048-bit (multiple options)
- Low and deterministic latency
- Up to 64 channels (ports)
- Flexible bandwidth allocation
- FlexE ready
Classification and Resource Scaling
- Pooled SecY/SC and SA
- TCAM (internal or external)
- Statistics
- Scaling up to 8K SA and TCAM rules
Control Interface
- 32-bit register interface
- Interrupts (global and per-channel)
MACsec Support
- IEEE 802.1AE-2018
- MACsec with up to 4x VLAN-in-clear
Extra Protocols
- IPsec ESP transport/tunnel modes
NIST CAVP Compliance for FIPS 140-3 Validation
- Support for basic AES and AEC-GCM transformations
Packages
- Silicon IP
- Driver Development Kit
Complete Documentation
- Hardware integration manual
- Hardware and programming manuals
- IP-XACT Register description
- SRAM memory list
- Driver usage and porting manuals
Tools and Scripts
- Setup and Simulation scripts
- Synthesis scripts
Integration Support
- UVM verification test bench
- Comprehensive set of test vectors
Secure Networking Basics: MACsec, IPsec, and SSL/TLS/DTLS
The MACsec, IPsec and SSL/TLS/DTLS protocols are the primary means of securing data in motion (communicated between connected devices). These protocols can be anchored in hardware or implemented in software as part of an end-to-end security architecture. This white paper provides fundamental information on each of these protocols including their interrelationships and use cases.
