US 11,599,649 B2Granted

Method and apparatus for managing transmission of secure data packets

AssigneeRockwell Automation Technologies, Inc.

InventorKenneth William Batcher

Life of this patent

Estimating the term…

Loading patent…

Abstract

A logic circuit for generation of data signatures and/or encryption of data packets to be transferred from an industrial controller snoops data as it is written to an output buffer within the industrial controller. The logic circuit generates a secure signature and/or coordinates encryption of the data packet being transferred between the shared memory location and the output buffer. If encryption of the data is required, an encryption module may both encrypt the data and generate a secure signature. If encryption is not required, the logic circuit generates the secure signature. In either case, the logic circuit controls ownership of the memory address in which the secure signature is to be written to coordinate with the MAC transferring the secure signature to the output buffer, providing a uniform interface between the SPP module and the MAC.

Claims20

Dependent claims

A method for managing transmission of secure data packets, comprising the steps of:

writing a data packet for transmission to a shared memory location defined on a shared memory within a network device;
transferring the data packet from the shared memory location to an output buffer for a network interface in the network device, wherein:
the network interface includes at least one port configured to be connected to a network external from the network device,
the output buffer for the network interface is associated with the at least one port,
the data packet is transferred via a communication bus connected between the shared memory and the output buffer within the network device, wherein a Media Access Controller (MAC) executing on the network device initiates the transfer of the data packet from the shared memory location to the output buffer;
reading the data packet from the communication bus with an inline logic circuit located within the network device, wherein:
the inline logic circuit is operatively connected to the communication bus between the shared memory and the output buffer, and
the inline logic circuit performs a read only function from the communication bus between the shared memory location and the output buffer to read the data packet as the data packet is transferred from the shared memory location to the output buffer without interfering with the transmission of the data packet;
generating a secure signature of the data packet with the inline logic circuit as the data packet is transferred by the MAC from the shared memory location to the output buffer;
appending the secure signature to the data packet with the inline logic circuit;
and
queuing the data packet for transmission from the output buffer of the network interface with the MAC after the secure signature has been appended to the data packet.

9 more elements

A communication circuit for managing transmission of secure data packets within a network device, the communication circuit comprising:

a shared memory;
a software packet processing module configured to write a data packet for transmission to a shared memory location defined in the shared memory;
a network interface, including:
at least one port configured to be connected to a network external from the network device,
an output buffer associated with the at least one port, and
a Media Access Controller (MAC) configured to transfer the data packet from the shared memory to the output buffer via a communication bus connected between the shared memory and the output buffer and to queue the data packet for transmission from the output buffer;
and
an inline logic circuit operatively connected to the communication bus between the shared memory and the output buffer, wherein the inline logic circuit is configured to:
execute a read only function to read the data packet from the communication bus as the data packet is transferred from the shared memory location to the output buffer by the MAC, wherein the read only function does not interfere with the transmission of the data packet,
generate a secure signature of the data packet as the data packet is being transferred by the MAC from the shared memory location to the output buffer, and
append the secure signature to the data packet, wherein the data packet is queued for transmission from the output buffer by the MAC after the secure signature has been appended to the data packet.

8 more elements

A method for managing transmission of secure data packets within a network device comprising the steps of:

writing a data packet for transmission to a shared memory with a software packet processing module, wherein a header for the data packet defines a secure operation to perform on the data packet prior to transmission;
writing a descriptor to a descriptor ring in the shared memory with the software packet processing module;
periodically monitoring the descriptor ring with a Media Access Controller (MAC) executing in the network device to detect when the data packet is available for transmission;
transferring the data packet from the shared memory to an output buffer in the network interface via a communication bus, wherein the data packet is transferred by the MAC when the data packet is available;
reading the data packet from the communication bus with an inline logic circuit operatively connected to the communication bus between the shared memory and the output buffer, wherein the inline logic circuit reads the data packet from the communication bus as the data packet is transferred from the shared memory to the output buffer by the MAC without interfering with the transmission of the data packet;
setting a done bit with the inline logic circuit when the data packet has been transferred to the output buffer and the data packet is ready for transmission;
and
queueing the data packet for transmission from the network interface with the MAC after the inline logic circuit has set the done bit.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/914,683Filed 29 Jun 2020
Published: US 2021/0406387 A130 Dec 2021
Granted: 7 Mar 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

G06F 21/606
Protecting data: by securing the transmission between two devices or processes
G06F 13/1668
For access to memory bus: details of memory controller
G06F 21/602
Protecting data: providing cryptographic facilities or services
G06F 21/71
Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer: to…