Patent Application
20060153183
The invention relates to the field of Ethernet switches. In particular, the invention relates to an Ethernet switch for routing packets to and from a broadband connection.
In an Ethernet network, packets coming in and out of a broadband gateway or bridge need to be properly routed.
One way to achieve this is simply to use an Ethernet switch to direct packets to and from the Ethernet ports. Incoming packets are directed to the correct destination port by the switch according to their Layer 2 (Data Link Layer or Medium Access Control (MAC) Layer) address. This arrangement has the advantage that the processing is simple and takes few cycles, as the switch just directs the packets automatically without processor involvement. However, security may be low as the switch may allow unauthorized packets to be passed from one Ethernet port to the other or elsewhere. The packet content itself is only checked by the higher layer protocol.
An alternative method involves the use of a separate Ethernet controller for each Ethernet port. In that arrangement, incoming packets must be processed by a central processor in order to be directed correctly. Although this arrangement is more secure as the processor has the flexibility to inspect the entire packet, it requires more processing power and time.
In one aspect, the invention provides a modified Ethernet switch which mitigates or substantially overcomes the problems of prior art arrangements described above.
According to a first aspect of the invention, there is provided an Ethernet switch for directing data packets to and from a plurality of Ethernet ports, the switch maintaining an address lookup table and comprising a control block for switching the switch between a first mode and a second mode, wherein the switch is arranged to forward each data packet outgoing to one of the ports to the correct port as determined by the address lookup table and in the first mode, to forward each data packet incoming from one of the ports to the correct destination as determined by the address lookup table, and in the second mode, to forward each data packet incoming from one of the ports to a processor.
In the first mode, the switch simply forwards incoming data packets to the right destination by performing a lookup in the address lookup table. The address lookup table is preferably implemented in hardware. Therefore the data packets can be dealt with quickly. Outgoing packets are also forwarded by address lookup.
In the second mode, the switch automatically forwards all incoming data packets to a processor. Outgoing packets are still forwarded by address lookup. This is more secure but is also reasonably fast because the switch is performing the lookup, not the processor.
The processor may be arranged to forward the data packet to its correct destination as determined by the content of the data packet.
In the second mode, the switch may be arranged to forward each data packet incoming from one of the ports to the processor via a memory.
The control block allows the Ethernet switch to be switched between the first and second modes. The control block may be operable by a user. It may be appropriate to operate in the first mode when there is no need to process higher layer protocols for security reasons. It may be appropriate to operate in the second mode when higher security is required.
Preferably the address lookup table is a Layer 2 address lookup table. In that case, in the first mode, the switch is arranged to direct each data packet to its correct destination based on the Layer 2 address of the data packet. Thus, the switch simply forwards the data packets to their next destination based on the Layer 2 address. In the second mode, the switch is arranged to direct each outgoing data packet to its correct destination based on the Layer 2 address of the data packet, which means that the data packets can be handled quickly. (Alternatively, the address lookup table may be a Layer 3 lookup table or a lookup table for Layer 2 protocols or, in fact, any other suitable lookup arrangement.)
The Layer 2 address may be termed the Data Link Layer address or the MAC (Medium Access Control) address. The Layer 2 address is simply an indicator of the next destination for the data packet. It does not provide any indication regarding the ultimate destination for the data packet.
In the second mode, the address look up table is enabled. This address table is always needed in order to send the packets to the correct physical address. If the address table is maintained by software, then the processor needs lots of effort to maintain it and use it. Because the proposed switch maintains the lookup table and, in both modes, performs the lookup for outgoing data packets from the processor to determine the appropriate port, the lookup does not need to be performed by a processor. Thus, there is less work for the processor and, even in the second mode, the data packets can be processed quickly.
According to the first aspect of the invention, there is also provided an Ethernet device comprising an Ethernet switch as described above and a processor.
According to a second aspect of the invention, there is also provided an Ethernet switch for directing data packets to and from a plurality of Ethernet ports, the switch maintaining an address lookup table and comprising a control block for switching the switch between a first mode and a second mode, wherein, in the first mode, the switch is arranged to forward data packets to the correct destination as determined by the address lookup table, and in the second mode, the switch is arranged to forward data packets to a processor, the processor being arranged to forward the data packets to the correct destination as determined by the content of the data packet.
In the second aspect, in the first mode, the switch operates like a conventional Ethernet switch. In the second mode, the switch operates like a conventional Ethernet controller. Thus, the first mode may be selected for fast processing but lower security and the second mode may be selected for higher security but slower processing. In the second aspect of the invention, in the second mode, use of the lookup table may be in hardware so as to reduce the work load of the processor.
An exemplary embodiment of the invention will now be described with reference to the accompanying Figure, which is a schematic diagram of the modified Ethernet switch according to an embodiment of the invention.
The Figure shows a schematic diagram of the modified Ethernet switch according to an embodiment of the invention. The left hand side of the diagram shows operation of a conventional Ethernet switch 101 and its operation will be briefly summarized.
The incoming packet arrives at 103. A particular incoming packet may be one of several types: a unicast packet 105a (a packet sent from a single sender to a single recipient), a multicast packet 105b (a packet sent from a single sender to a select group of recipients) or a broadcast packet 105c (a packet sent from a single sender to the entire network of recipients). As can be seen by the control logic in buffer 107, a multicast packet takes priority over a unicast packet. Similarly, as can be seen by the control logic in buffer 109, a broadcast packet takes priority over either a multicast or unicast packet. The buffers 107 and 109 will forward the packets according to their priority.
The packet and the packet's Layer 2 (Data Link Layer or MAC Layer) address are input to buffer 111. The packets are stored in buffer 111 and forwarded according to their priority, as determined by the Layer 2 address.
The packet and its Layer 2 address, together with any VLAN (Virtual Local Area Network) information, are forwarded at 113. The VLAN information is additional information inherent in the packet data that is used to further classify packets. The partially processed packet is then filtered in two steps. Firstly, at block 115, the part of the packet relating to the source port is removed. Secondly, at block 117, the switch checks the port bridge status, i.e., if the port is enabled to forward data, and the link status, i.e., if the link up is on the destination port.
As already mentioned, the above described left hand portion 101 of the illustrated arrangement works in the same way as a conventional Ethernet switch. The switch just forwards each incoming packet based on its Layer 2 address. The Ethernet switch does not look at the packet content itself, this waits until higher protocol.
The modification to the switch according to this embodiment of the invention takes place at control block 119, as described below.
If the logic in block 119 is at 0 (i.e., the block is switched off), the control block 119 makes no difference to the switch's operation. So, the switch just operates in the conventional way. That is, the switch just forwards each incoming packet based on its Layer 2 address. As already set out, this process is fast (as the switch just forwards the packets based on Layer 2 address) but it is not very secure (as the packet content itself is not checked).
If, on the other hand, the logic in block 119 is at 1 (i.e., the logic block is switched on), all the incoming packets are automatically directed to the central processor via an external memory to be processed, rather than just being automatically forwarded. The software then processes the whole header information. The central processor looks at the packet content itself and is accordingly directed to the right connection.
Thus, the modified switch has two modes of operation. Firstly, when the logic at block 119 is set to zero, the modified Ethernet switch operates in the conventional way. Incoming packets are forwarded based on their MAC Address. However, the arrangement is not very secure, so operation in this mode is sometimes known as de-militarized operation.
Alternatively, when the logic at block 119 is set to one, the modified Ethernet switch operates under militarized operation. Incoming packets are automatically forwarded to the processor via an external memory. The processing is quite a slow operation compared with the automated hardware lookup of the first mode. However, it is more secure.
Because the switch itself maintains the lookup table for outgoing packets in both modes, the code size and the complexity of the software can be reduced. There is also flexibility to allow the lookup table to be totally disabled thereby making the arrangement operate like an Ethernet controller. That is, in the second mode, there is the ability to use or not use the address lookup table to assist the processor to direct the data packets to the correct destination, in addition to packet filtering done by the processor.
