News and New Products

Security for any wireless application

By Nicholas Cravotta -- EDN, 9/25/2003

The Nitrox Wireless family of wireless-LAN security processors from Cavium Networks has 10 members spanning the wireless landscape, from low-end security for network-access devices requiring 50 Mbps or less capacity, to network aggregation devices processing 4 Gbps (Picture). The devices support a variety of protocols, including WPA (Wireless-Fidelity Protected Access), the interim standard replacing WEP (Wireless Encryption Protocol) until 802.11i sees approval; IPSec; MPPE (Microsoft point-to-point encryption); and TKIP (Temporal Key Integ-rity Protocol).

For IPSec and IKE (Internet Key Exchange), the Nitrox device will likely be a look-aside coprocessor, offloading all IPSec handling from a host processor. For incoming packets, the host processor must identify only the IPSec packet, then pass it to the Nitrox device with a single macro instruction. The engine provides the unencrypted IP packet with a security association, so the host can identify the session to which the packet belongs. For outgoing packets, the host provides a security-association and IP packet to the engine and receives an IP-Sec packet ready for transmission. The engine also accelerates session setup and asymmetric key generation and maintains all relevant information behind each security association.

The Nitrox Wireless family also supports the current 802.11i standard. Firmware changes will support minor changes to the spec once it achieves approval. For 802.11i, the host control will send CCMP (AES in counter mode with cyber-block-chaining message-authentication-code protocol) packets and receive secure packets ready for transmission. Interconnect options for the family are PCI, PCI-X, and HyperTransport.

Currently sampling, with production slated for the fourth quarter, Nitrox Wireless family devices cost $15 (10,000) to $500 (1000).

Cavium Networks, 1-408-844-8420, ext 205, www.cavium.com.