# US 8,543,826 B1 · MACSec implementation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,826 B1 - Document ID: US8543826B1 - Status: Granted - Kind: B1 - Application number: 13/590,979 - Filed: 2012-08-21 - Granted: 2013-09-24 - Earliest claimed: 2006-04-07 - Assignees: Marvell International Ltd. - Applicants: Guy T. Hutchison; Awais B. Nemat - Inventors: Guy T. Hutchison; Awais B. Nemat - Web page: https://patentgrep.com/patent/US8543826B1 ## CPC - H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up} - H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 2209/125: Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations - H04L 2463/041: using an encryption or decryption engine integrated in transmitted data - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A media access control (MAC) security apparatus for a local area network interface includes multiple independently controlled power domains, each of which enters and exits a reduced power state independent of others of the power domains. An encryption/decryption engine, located within a first of the power domains, generates encrypted data in response to received packets and cryptographic primitives. An authentication engine, located within a second of the power domains, performs authentication operations in response to the encrypted data. The encryption/decryption engine comprises an advanced encryption standard engine that forms the cryptographic primitives and is located within a third of the power domains. The third power domain enters the reduced power state for part of a period during which (i) the first power domain does not enter the reduced power state and (ii) the encryption/decryption engine is generating the encrypted data. ## Claims ### Claim 1 A media access control (MAC) security apparatus for a local area network interface, the MAC security apparatus comprising: a plurality of independently controlled power domains, wherein each of the plurality of independently controlled power domains is configured to enter and exit a reduced power consumption state independent of others of the plurality of independently controlled power domains; an encryption/decryption engine configured to receive packets and generate encrypted data in response to the received packets and cryptographic primitives, wherein the encryption/decryption engine is located within a first power domain of the plurality of independently controlled power domains; and an authentication engine configured to perform authentication operations of the local area network interface in response to the encrypted data, wherein the authentication engine is located within a second power domain of the plurality of independently controlled power domains, the encryption/decryption engine comprises an advanced encryption standard (AES) engine configured to form the cryptographic primitives, the AES engine is located within a third power domain of the plurality of independently controlled power domains, and the third power domain is configured to enter the reduced power consumption state for part of a period during which (i) the first power domain does not enter the reduced power consumption state and (ii) the encryption/decryption engine is generating the encrypted data. ### Claim 2 (depends on 1) The MAC security apparatus of claim 1, wherein during the reduced power consumption state of the third power domain, a clock signal in the third power domain is idle. ### Claim 3 (depends on 1) The MAC security apparatus of claim 1, further comprising clock gating logic configured to: receive a clock signal; in response to the received clock signal, output a gated clock signal to the third power domain; and in order to cause the third power domain to enter the reduced power consumption state, stop oscillation of the gated clock signal. ### Claim 4 (depends on 1) The MAC security apparatus of claim 1, further comprising a controlling entity configured to cause the third power domain to enter the reduced power consumption state. ### Claim 5 (depends on 1) The MAC security apparatus of claim 1, further comprising a parser configured to provide the packets to the encryption/decryption engine, wherein the parser is located within a fourth power domain of the plurality of independently controlled power domains. ### Claim 6 (depends on 5) The MAC security apparatus of claim 5, further comprising a look-up table coupled to the parser, wherein the look-up table provides values to the parser, and wherein the look-up table is located within a fifth power domain of the plurality of independently controlled power domains. ### Claim 7 (depends on 1) The MAC security apparatus of claim 1, wherein the authentication engine and the encryption/decryption engine are configured to operate together to generate an authenticated encryption output in response to the received packets. ### Claim 8 (depends on 7) The MAC security apparatus of claim 7, wherein the authentication engine is configured to perform authentication using a Galois Field Multiplier (GFM), and wherein the authentication engine and the encryption/decryption engine are configured to implement Galois Counter Mode (GCM). ### Claim 9 (depends on 1) The MAC security apparatus of claim 1, further comprising idle logic configured to generate an idle indication in response to a completion of processing, wherein the third power domain is configured to enter the reduced power consumption state in response to the idle indication. ### Claim 10 (depends on 1) The MAC security apparatus of claim 1, wherein the encryption/decryption engine is configured to generate a notification indicating data availability, and wherein the third power domain is configured to exit the reduced power consumption state in response to the notification. ### Claim 11 A method of operating a media access control (MAC) security apparatus in a local area network interface, the method comprising: independently controlling a plurality of power domains to enter and exit a reduced power consumption state independent of others of the plurality of power domains; receiving packets; generating encrypted data in response to the received packets and cryptographic primitives, wherein the generating encrypted data is performed by a first power domain of the plurality of power domains; authenticating the local area network interface in response to the encrypted data, wherein the authenticating the local area network interface is performed by a second power domain of the plurality of power domains; using an advanced encryption standard (AES) engine to form the cryptographic primitives, wherein the forming the cryptographic primitives is performed by a third power domain of the plurality of power domains; and controlling the third power domain to enter the reduced power consumption state for part of a period during which (i) the first power domain does not enter the reduced power consumption state and (ii) the generating encrypted data is being performed. ### Claim 12 (depends on 11) The method of claim 11, further comprising stopping a clock signal in the third power domain to cause the third power domain to enter and remain in the reduced power consumption state. ### Claim 13 (depends on 11) The method of claim 11, further comprising: receiving a clock signal; in response to the received clock signal, outputting a gated clock signal to the third power domain; and stopping oscillation of the gated clock signal in order to cause the third power domain to enter the reduced power consumption state. ### Claim 14 (depends on 11) The method of claim 11, further comprising processing the packets using a parser of the MAC security apparatus, wherein the processing the packets is performed by a fourth power domain of the plurality of power domains. ### Claim 15 (depends on 14) The method of claim 14, further comprising: accessing values from a look-up table of the MAC security apparatus; and using the values in the parser, wherein the accessing values is performed by a fifth power domain of the plurality of power domains. ### Claim 16 (depends on 11) The method of claim 11, further comprising performing the authenticating the local area network interface by using a Galois Field Multiplier (GFM). ### Claim 17 (depends on 16) The method of claim 16, further comprising implementing a Galois Counter Mode (GCM) using the GFM. ### Claim 18 (depends on 17) The method of claim 17, further comprising generating an idle indication in response to a completion of forming the cryptographic primitives; and causing the third power domain to enter the reduced power consumption state in response to the idle indication. ### Claim 19 (depends on 11) The method of claim 11, further comprising: generating a notification indicating data availability; and causing the third power domain to exit the reduced power consumption state in response to the notification. ### Claim 20 (depends on 11) The method of claim 11, further comprising comparing a hash value of one of the received packets to a calculated value.