Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L12/00—Data switching networks
  • H04L12/54—Store-and-forward switching systems 
  • H04L12/56—Packet switching systems
  • H04L12/5691—Access to open networks; Ingress point selection, e.g. ISP selection
  • H04L12/5692—Selection among different networks

Definitions

• This invention relates to an electronic system architecture and particularly to an electronic system architecture for a distributed domestic electronic system having a connection to a larger network such as a distributed domestic computer system connected to the Internet.
• Such services can be provided through and such devices connected to any network, subject of course to the network performance being sufficient to meet the minimum requirements of a service or device.
• Network services can be provided through a satellite link such as DVB or DBS.
• DVB satellite link
• most domestic users will be employing telecoms or cable television terrestrial links and this will also be the normal choice for most organisations. It is expected that the Internet will be the most common network choice.
• a single home could have one or more digital televisions able to display video on demand images retrieved through a wide area network such as the Internet or a Cable Television company or an ADSL (Asymmetric Digital Subscriber Line) connection from the local telephone company or any other network with sufficient data capacity.
• a wide area network such as the Internet or a Cable Television company or an ADSL (Asymmetric Digital Subscriber Line) connection from the local telephone company or any other network with sufficient data capacity.
• Such a home may also have one or more personal computers able to connect to the Internet and also possibly one or more dedicated games consoles able to download games software from the Internet or another network and optionally connect through the Internet to allow multi-player games and one or more smoke or burglar alarms and/or remote surveillance cameras.
• One method of doing this is to connect all of the devices requiring Internet access to one another and to a server to form a Local Area Network (LAN).
• the server can then act as a gateway to the Internet for all of the devices and control and arbitrate Internet access.
• any communication between two parties on a bus is accessible by other parties who are not intended recipients of the information. Consequently, the only method available to secure data is encryption. Even then it is not possible to prevent devices not intended to receive data from accessing the data, albeit possibly in encrypted form.
• the present invention is intended to provide electronic system architectures, components, devices and networks overcoming these problems, at least in part.
• the invention provides an electronic system architecture comprising a plurality of client devices connected in a hierarchical structure where the client devices form nodes in the structure interconnected by communications links in which one client device at the top of the hierarchical structure provides a gateway to a server, each other client device is connected to a single client device through a single communications link in an upstream direction and each client device is connected to a number, which may be zero, of client devices through the same number of communications links in a downstream direction, in which downstream client devices have lower bandwidth requirements than any client devices upstream of them and the sum of the bandwidths of the communications links from each client device in a downstream direction is less than the bandwidth of the communications links in the upstream direction and any client device able to make a hardware access request to a client device further in the downstream direction supports exception handling of the request.
• this invention provides a switch suitable for use in an electronic system to connect a local element to first and second bi-directional communication links, the switch comprising first and second receiving means able to receive messages along the first and second communication links respectively, first and second transmitting means able to send messages along the first and second cornmunication links respectively and transfer means to send and receive data from the local element, in which the messages include data identifying their intended destination, the switch further comprising a message destination identification means able to identify received messages having the local element as their intended destination and the switch being arranged to pass messages so identified to the local element and to re-transmit messages not so identified received at the first receiving means from the second transmitting means and to re-transmit those received at the second receiving means from the first transmitting means without passing them to the local element.
• this invention provides a device having at least two communications sections suitable for connection to similar devices along different bi-directional communications links, the device having a first communications section arranged to respond to reception of a clock transition along a first communications link by transmitting a clock transition having the same polarity back along said first communications link and a second communications section arranged to respond to reception of a clock transition along a second communications link by transmitting a clock transition having the opposite polarity back along said second communications link.
• this invention provides an electronic communication network comprising at least two devices connected by at least one bi-directional communications link in which an oscillating loop is formed by a first device receiving a clock transition along the communications link and sending a clock transition having the same polarity back along the communications link and a second device receiving a clock transition along the communications link and sending a clock transition having the opposite polarity back along the communications link, and the two devices use the clock transitions travelling around the loop to provide a clock signal to control data transfer along the commumcations link.
• this invention provides an electronic communication system comprising at least three devices connected by at least two bi-directional communication links in which signals between two devices along each communications link are independently encrypted.
• Figure 1 shows a network structure according to a first aspect of the invention
• Figure 2 shows details of the devices making up the network of Figure 1 ;
• FIG. 3 shows details of a switch used in the devices of Figure 2;
• Figure 4 A shows a receiver section used in the switch of Figure 3;
• Figure 4B shows a transmitter section used in the switch of Figure 3;
• FIGS 5 A and 5B are explanatory timing diagrams showing message propagation in the network according to Figure 1;
• Figure 6 shows an encryption system suitable for use in the network
• Figure 7 shows an improved encryption system for use in the network
• Figure 8 shows another improved encryption system for use in the network
• Figures 9A to 9C show message formats and codes suitable for use on the network
• Figure 10 is an explanatory diagram showing how clock pulse circuits are automatically generated between the devices of the network
• Figure 11 shows examples of clock data and frame signals on the network
• Figure 12 shows a device architecture according to the invention
• Figure 13 shows an alternative device architecture according to the invention
• Figure 14 is an explanatory diagram showing security features of the device architectures
• Figure 15 shows a processor arrangement for use in the devices.
• FIG 16 shows an alternative message format for use in the network or devices.
• An electronic network according to a first aspect of the invention is shown in Figure 1.
• This network can be made up of any communications, computer or other electronic devices and products. Although this example it is described in terms of a domestic, i.e. single household, connection to the Internet which is expected to be the most common and most commercially significant use of the invention, it will be understood that the inventive architecture is equally applicable to commercial use or connection to any other digital communications network.
• a server 1 is connected to the electronic system or architecture comprising a plurality of client devices 2 arranged in a hierarchical structure though a number of local network connections to form a local area network.
• the server 1 may be a single server or a network of separate servers forming a host network such as the Internet.
• the client devices 2 are arranged in a hierarchical tree structure connected by branches formed by the communication links of the local area network.
• branches lower down the structure have lower bandwidth than the branches above them, that is the branches through which they are connected to the server 1.
• the sum of this downstream branch bandwidths must be less than the bandwidth of the upstream branch. Security of data is secured from the bottom of the system upwards, as will be explained below.
• the client devices 2 forming the end nodes of the system are client devices 2 having on-board processing capability and offer user access to server facilities.
• the client devices 2 forming the nodes in the structure which are not end points control the provision of services to the lower client devices 2. They will have on-board processing capability and may also themselves be client devices 2 offering user access to server facilities in their own right in addition to controlling the provision of services to the lower level client devices 2.
• the reduction in bandwidth for branches further away from the server 1 is necessary in order to prevent the bandwidth requirements for the system increasing geometrically as it increases in size and to ensure that a lower level client device 2 cannot swamp a higher level client device 2 by demanding more bandwidth, that is a higher data transfer rate, that the higher level client device 2 can support.
• One reason for employing a multiprocessor system comprising a plurality of different client devices is to distribute the computing and functional burden so as to place the requisite computing capability where it is most needed and to provide the appropriate electronics for a given function in the most economic and effective location to provide said function in a reliable and maintainable fashion.
• Another reason for employing a multi processor system comprising a plurality of separate client devices 2 is to allow data to be kept secure. This data security may be necessary to ensure authorised control, financially reliable e-commerce or simply privacy. For example, an application processor capable of running Internet software applications may be susceptible to external attack. Thus, keeping control of an electronic commerce smart cart in a separate unit will enhance the security of the e-commerce functions and improve the predictable quality of service that can be obtained when using the smart card.
• the inventive electronic system architecture supports hierarchical data structures. Access to a specific client device 2 is controlled by that client device 2 alone. Higher level data users, that is the server 1 and client devices 2 situated between a particular client device 2 and the server 1 must request the lower level client devices 2 for their data and be able to authenticate these requests. Of course, client devices 2 which do not have a requirement to safeguard data, may freely pass requests and responses through themselves or respond to requests for any unprotected data they hold without requiring any authentication.
• Access requests from higher level chent devices 2 to lower level client devices 2 may be made by hardware or software. If a higher level client device 2 is able to make a hardware access request of a lower level client device 2 this hardware access request may be permitted to pass through any intermediate client devices 2 unmodified. If the hardware access request is blocked, the intermediate level client device 2 will attempt to make the access of behalf of the higher level client device 2 if permitted. In order to allow the system to be transparent so that hardware and software access requests appear the same to the originating client device 2, the intermediate client device 2 will need to be provided with exception handling facilities, that is the facility to cause a software protocol to be employed to carry out an access request in place of an aborted hardware access request.
• exception handling facilities that is the facility to cause a software protocol to be employed to carry out an access request in place of an aborted hardware access request.
• any client device 2 which does not support exception processing must either be an end point in the hierarchical system or be a client device 2 which never makes or passes hardware access requests to lower level client devices 2.
• the set top box will itself be a client device 2 connected to the Internet in the form of an Internet server 1 through one or , more other client devices 2 and is controlled by an infrared remote control equipped with an integral smart card interface.
• an infrared remote control equipped with an integral smart card interface.
• the remote control can instruct the set box to allow pay-per-view, video on demand or similar restricted access digital video signals to be displayed on the television.
• the set top box cannot make a hardware access to the smart card and must rely on a software protocol over the infrared link.
• the processor in the set top box does not need to support exception processing even though the remote control is a lower level device than the set top box in the network.
• Each client device 2 forming a node in the electronic network is an active information processing device able to manipulate data passing through it. Or, more precisely each client device 2 can manipulate the data it receives and can selectively re-send this data. A minimum amount of processing would be nil, that is what comes into a node goes out. Alternatively, very little of the original information received by a client device 2 forming the node may be passed on. At one extreme, a particular client device 2 may even send on none of the data received, instead it may respond to the received data by sending on a different message containing different data which is however related to or derived from the received data.
• the highest upstream client device 2 nearest to the server 1 will provide a gateway to the server and will control and arbitrate server access for the entire network.
• This gateway client device 2 will normally have to support different communications protocols on the network and for communications with the server, although the protocols could be the same.
• the passing of data through the client devices 2 forming nodes in the network allows hierarchical security to be implemented by client devices 2 at nodes higher up the network controlling provision of services to lower components while client devices forming nodes lower down the network control end user authentication.
• the higher nodes facilitate server side security while the lower nodes facilitate client side security.
• the individual communications links between pairs of nodes can be physically separate and client devices 2 forming the nodes can selectively pass on received ; data to the next node or block it, data security on the network can be greatly improved because data is made available only to client devices 2 requiring the data and those client devices 2 forming part of the data path along which the data travels.
• the security feature of data only being physically accessible at particular points in the network can be used to provide an additional level of security over and above that provided by encryption alone.
• the data carried out between different pairs of client devices 2 and different nodes can be made not just logically but also physically distinct, failure of a single communications link or client device 2 will not necessarily disable the entire system.
• a generic client device 2 is shown in Figure 2. It will be understood that this illustration is intended only as an explanatory diagram to explain the functions of a generic client device 2 and is not intended to imply any particular component arrangement or physical structure.
• a series of client devices 2 are shown arranged in an network having a top node M and bottom node 0 and the chent device 2 forming intermediate node N+l is shown in detail.
• the network structure of a linear string of nodes is a simple example which has been selected for clarity and it will be understood that other network structures are possible.
• the client device 2 comprises three main components, a local switch 3, a local processing section 4 and a local data input and output section 5.
• data is passed up and down between the client devices 2 situated at the chain of nodes forming the network.
• information is sent or received up or down the chain through the local switch 3 of the client device 2.
• the switch 3 operates under the control of the client device 2 only.
• Data being passed through the network is directed to a specific destination and this destination may be defined logically or physically. All client devices 2 making up all nodes are able to receive data and those client devices 2 which are not end points of the network are able to pass data on.
• the client device 2 at any node may imtiate an information transaction by sending data to another client device 2 at another node. However, it is possible that some client devices may not do this in practice because their function only requires them to receive data and not initiate information transactions.
• the switch 3 in each client device 2 can be as complex as required by the specific application. However, the minimum functionality of the switch 3 is that it must remove all received messages destined for its local client device 2 from the mcoming data stream and pass on in the same direction along the network chain received messages destined for client devices 2 other than the local one.
• the switch 3 forwards messages destined for other client devices 2 along the chain and extracts the received message destined for the local client device 2 from the stream of messages passing along the network. These messages destined for the local chent devices 2 are passed to the local processing section 4.
• the local processing section 4 processes the received data as required.
• the local processing section 4 passes data or instructions to a local input/output section 5 which can be a data display device or some equipment under the control of or reporting to the local processing section 4 or an interface to some external equipment under the control of or reporting to the client device 2.
• the local input/output section 5 can send data as necessary to the local processing section 4.
• the local processing section 4 processes this data and as determined by data received from the switch 3 and local input/output section 5 and any other factors such as current time the local processing section 4 prepares messages to other client devices 2 and sends them to the switch 3 to be sent out through the network.
• a client device comprising only a switch 3 and local processing section 4 or only a switch 3 and local processing section 5 would be possible although in practice there are very few circumstances under which a client device able to receive, process and send data only upon the network and having no local input and output function would be useful.
• a client device able to input locally generated data directly onto the network or output data from the network directly it will normally be the case in practice that at least some minimal amount of local processing within the client device 2 will be necessary.
• section 5 is described as the local data input and output section 5 in practice this might in some applications be data output only or data input only.
• the switch 3 is normally able to support a full duplex operation.
• a switch 3 is shown in detail in Figure 3.
• the switch 3 comprises two separate switch blocks 6a and 6b, the switch block 6a handling downstream traffic, that is the switch block 6a receives messages from the next node upstream and transmits messages to the next node downstream while the switch block 6b handles upstream traffic, that is the switch block 6b receives data from the next node downstream and sends data to the next node upstream.
• the switch blocks 6 are interconnected by a link 7 to provide a data path for acknowledgements of received messages and each switch block 6 is connected to send out received data from the local processor 4 along lines 8.
• Each switch block 6 contains a receiver (input) section 9 and a transmitter (output) section 10 which operate under the control of a synchronising finite state machine forming part of the switch block 6.
• Figures 4a and 4b Suitable examples of receiver and transmitter structures are shown in Figures 4a and 4b, in which Figure 4a shows the receiver structure while Figure 4b shows the transmitter structure.
• the receiver section 9 receives messages only from the transmitter section 10 of a i switch block 6 of a client device 2 forming an adjacent node, although the actual data carried by the message may have originated anywhere in the network.
• Each message includes a message type and routing information section identifying the originating chent device 2 and destination client device 2, the type of message and the amount of data carried and usually a data payload section made up of the data carried by the message.
• a message type and routing information section identifying the originating chent device 2 and destination client device 2
• the type of message and the amount of data carried usually a data payload section made up of the data carried by the message.
• some types of messages particularly acknowledgements of receipt of earlier messages, may just be identified as such by the message type and routing information section and carry no payload data.
• Each message is received along the input data path by a synchroniser element 11 and then passed to a message type and routing element 12 which examines the message type data carried by the message to see what type of message it is. If the message is an acknowledgement that a message has been received, this information is passed to a finite state machine 17 which notifies the other switch block 6 of the local switch 3 that the notification has been received over the link 7, so that the other switch block 6 knows that its opposed input section is ready to receive the next message. The input section 9 then awaits the next message.
• the message type and routing element 12 extracts the route identification information carried by the message, that is the local circuit number of the client device 2 for which the message is intended, and passes it to a route comparator 13.
• the route comparator 13 compares the destination circuit number extracted from the message with the local circuit number held in a local circuit number store 14. If the route comparator 13 identifies the circuit numbers as being identical message type and routing element 12 passes the relevant parts of the message type and routing information to the host IF element 16 and the message payload element 15 passes the data content of the message to the host IF element 16.
• the host IF element 16 sends this data to the other parts of the client machine 2. That is, this data is sent to the local processing section 4 and/or the local input and output section 5.
• the message is passed to the transmitter section 10.
• the state machine 17 of the receiver section ⁇ 9 instructs the other switch block 6 of the local switch 3 to send an acknowledgement of receipt response on its behalf back to the client device 2 at the adjacent node from which the message was received.
• This acknowledgement informs the sending client device 2 that the receiver section 9 is ready to receive the next message.
• the transmitter section 10 can receive messages for transmission both from the receiver section 9 forming part of the same switch block 6 or from other parts of the local client device 2 and can be instructed to send acknowledgement of receipt messages by the receiver section 9 of the other switch block 6 of the local switch 3. Since the transmitter section 10 can only send one message at a time the state machine must arbitrate between the three message sources and some means of temporarily storing or buffering messages for sending must be provided.
• a buffer would be required in any event between the receiver section 9 and transmitter section 10.
• the necessary buffers may be locally incorporated into the receiver section 9, transmitter section 10 or elsewhere as convenient.
• the transmit host IF section 17 which receives data from other parts of the local client device 2 incorporates a transmit buffer and another buffer is located within the switch block 6 between the receiver section 9 and transmitter section 10, but this is not shown in the figures.
• the data to be carried is passed from the buffer or the host IF 17 to a payload store 18.
• the data is then passed to a message type and routing generator 19 which generates the appropriate message type and routing information part of the message based on data provided by the host IF 17 or simply checks and repeats the message type and routing information already incorporated into the received message.
• the message originates from the local client machine 2 the local circuit number identifying the originating client device 2 is provided to the message type and routing generator 19 by a local circuit number store 20.
• the message type and routing generator 19 In response to an instruction from the receiver section 9 of the other switch block 6 of the local switch 3 to send an acknowledgement of receipt message, the message type and routing generator 19 generates a message type and routing information part of the message identifying it as an acknowledgement. There is no data payload to be carried by such a message.
• the assembled message is sent along the communications link to that client machine 2 through a transmit synchroniser 21.
• receiver section 9 and transmitter section 10 are both shown as being controlled by a synchronising finite state machine. There may be a separate controlling finite state machine for the transmitter section 9 and receiver section 10 or there may be a single synchronising finite state machine controlling the entire switch block 6. Similarly, separate local circuit number memories 14 and 20 are shown for the receiver section 9 and transmitter section 10. Clearly, these could be replaced by a single common local circuit number memory.
• the transmitter section 10 can transmit messages both from the receiver section 9 of the same switch block 6 or from other parts of the local client device 2 or acknowledgements as instructed by the receiver section 9 of the other switch block 6 of the local switch 3, but can only send one message at a time so that the finite state machine must arbitrate between the three message sources. In order to avoid degrading the perceived bandwidth and latency of the network, acknowledgements will take priority followed by messages passed to the transmitter section 10 from the receiver section 9 of the same switch block 6.
• each local client device 2 has a single local circuit number associated with it. It would of course be possible for a local client device 2 to be assigned multiple local circuit numbers.
• bus systems operate on the assumption that signals placed on the bus are propagated to all points on the bus instantaneously although there is in reality a very small difference from point to point across the bus because of the time taken for the electrical signals to physically propagate along the bus. Accordingly, buses can generally be regarded as synchronous systems because signals are available everywhere simultaneously on the bus.
• the electronic network according to the invention is an asynchronous system in which messages will be received at different points in the system at different times, the time delay being multiples of the time taken to transmit the message from one client device 2 to the next client device 2 at the adjacent node.
• FIG. 5 the timing sequence of a message travelling from node N+1 to node N is illustrated.
• a message is sent from node N+1 to node N.
• an acknowledgement is returned from node N to node N+1. This confirms that the message has been safely received and that the client device 2 and node N is now free to receive another message.
• FIG. 5b A more complex example is shown in Figure 5b in which a message is to be sent from node M at the top of the network to node 0 at the bottom of the network.
• the message is sent from node M to node N+1.
• acknowledgement No acknowledgement that the message has been successfully received at node 0 is passed to node M. Only successful receipt at the next node is acknowledged at each step of the message journey.
• the acknowledgement is a simple last message received acknowledge which does not contain any data identifying the original message or its content or any original message route data. The acknowledgement is always an acknowledgement of receipt of the last message sent in the opposite direction, so there is no need to include this data in the acknowledgement message.
• the switch block architecture described above is a minimal implementation having only a single buffer between the transmit and receive sections. Once a received message has been passed from the receiver section 9 to the transmitter section 10 the receiver section 9 can begin receiving a second message, so that the switch block 6 as a whole is effectively double buffered.
• This minimalist switch block architecture is that where a series of messages are to be passed through the node, the rate at which incoming messages can be received is limited to the rate at which outgoing messages can be transmitted because a received message cannot be transferred to the buffer to allow the next message to be received until the message previously transferred to the buffer has been transmitted.
• This problem can be overcome by use of a more complex architecture by increasing the size of the buffer to allow multiple messages to be held, allowing the switch block 6 to act as a speed matching element.
• Such an enlarged buffer able to hold multiple messages must be a first in first out (FIFO) type memory to keep message order passing through a node constant, but there is no limit to how many messages the FIFO buffer can hold, that is the FIFO buffer can be arbitrarily deep as required to allow smooth data flow and is only limited by cost.
• FIFO first in first out
• the network architecture described above provides a basic level of security for data within the system because messages sent to a client device 2 at a particular node are extracted from the signal flow along the network by the local switch 3 and so are not available or accessible to chent devices 2 at nodes further along the network. Further, messages sent through a client device 2 at a particular node to a client device at another node are passed through the local switch 3 of the intermediate client device 2 only and are not supplied to the local processing section 4 of the intermediate client device 2.
• each of the receivers 9 and transmitters 10 making up the switch blocks 6 of a local switch 3 is provided with a programmable exclusive OR element 33 which applies a logical exclusive OR function to each message after reception by the receiver section 9 or before transmission by the transmitter section 10.
• the exclusive OR function applied by the programmable exclusive OR elements 33 in each local switch 3 takes the form of an exclusive OR mask controlled by the local processing section 4.
• the exclusive OR mask encodes the entire transmitted message so that as well as the actual data carried by the message the message header and routing information such as the recipient virtual circuit identification, data type and data size are all encoded.
• the exclusive OR mask applied by the exclusive OR elements 33 may be modified periodically by sending messages to all of the client devices 2 in the system instructing them to change the exclusive OR mask.
• the messages encrypted by the exclusive OR mask are identical in size to the original messages before encryption and accordingly this encryption method does not impose any band width penalty on system performance.
• An improved level of security can be provided by the incorporation of an auxiliary security processor within each local switch 3.
• a local switch section 3 comprising two switch blocks 6a and 6b operating on the downstream and upstream data paths though the switch 3 respectively.
• the local switch 3 also includes an auxiliary security processor 34.
• the auxiliary security processor 34 sets the exclusive OR masks applied by the exclusive OR elements 33 instead of the exclusive OR masks being set by the local processing section 4 as in the system without the auxiliary security processor 34 described above.
• the auxiliary security processors 34 in the opposed local switches 3 in client devices 2 in adjacent nodes communicate with one another exchanging public encryption keys.
• the auxiliary security processors 34 then use these public keys to encrypt and issue exclusive OR masks to each other which are applied to the messages sent between them.
• This communication and exchange of public keys is carried out by inj ecting additional messages into the message stream along the communications link between the two nodes. This will require additional received message routing and processing and transmit message arbitration by the receiver sections 9 and transmitter sections 10 since the system will now be carrying messages to and from the auxiliary security processor 34 at each local switch 3 as well as messages to and from the local processing sections 4 and messages to be passed on along the network to other nodes and acknowledgements.
• each auxiliary security processor 34 will re-establish communication with the auxiliary security processors 34 in adjacent nodes and in a synchronised manner they will change the exclusive OR masks.
• each auxiliary security processor 34 will re-establish communication with the auxiliary security processors 34 in adjacent nodes and in a synchronised manner they will change the exclusive OR masks.
• the exclusive OR masks are changed at the same time at both ends of each communications link between nodes, there is no requirement that all of the exclusive OR masks in the network be changed simultaneously.
• the intervals at which the exclusive OR masks are changed being time based they could also be changed independently based on the number of messages exchanged along each commumcations link or based on some combination of these two criteria.
• auxiliary security processor 34 Another advantage is that the actual mask generation and encryption by the auxiliary security processor 34 does not have to be carried out in real time. That is, the mask generation and encryption can be carried out by the auxiliary security processor 34 out of band while the rest of the local switch 3 is sending and receiving messages using the already set exclusive OR masks. As a result, the time taken to carry out the mask generation and encryption process is not critical so that the auxiliary security processor 34 can be simple, small and cheap microprocessors, enabling them to be incorporated into the local switch elements 3 with only a marginal effect on costs.
• the auxiliary security processor 34 could be embedded in macro cells within the local switch elements 3.
• auxihary security processors 34 are shown as a single unit connected to both of the switch blocks 6a and 6b of a local switch 3. It would of course be possible to employ separate auxiliary security processors within each security block 6a and 6b but the two auxiliary security processors will have to be in contact with one another to properly control the encryption process.
• This arrangement ensures that any attempt to compromise the system and extract data would have access to only a part of the data carried on the network for a relatively short period of time.
• auxiliary security processors 34 When the network is first switched on, or after a network wide system reset, the auxiliary security processors 34 will exchange public keys and set the exclusive OR encryption masks before allowing any other messages to be sent.
• a method of further enhancing the security provided by the auxiliary security processors 34 is to inco ⁇ orate smart card user authentication into the local switches 3.
• An example is shown in Figure 8 where a smart card connector socket 35 connected to the auxiliary security processor 34 is incorporated into the local switch 3.
• Insertion of the smart card into the socket 35 acts as user authentication and enables the auxiliary security processor 34 to begin operation. Further, the smart card 35 provides a seed or seeds for the exclusive OR encryption masks used.
• the local switch 3 When a smart card is not present in the smart card socket 35 the local switch 3 is unable to function because the auxiliary security processor 34 will not set the exclusive OR masks and enable operation of the switch blocks 6a and 6b.
• the auxiliary security processor 34 will not set the exclusive OR masks and enable operation of the switch blocks 6a and 6b.
• auxiliary security processor 34 Even if a physically compatible smart card is connected to the smart card socket 35, if this smart card is not a correct smart card, for example if it is valid only until a given date, which has passed, it will not be able to provide an exclusive OR mask seed to the auxiliary security processor 34 which is compatible with the network requirements. As a result, the auxiliary security processor 34 will be unable to set effective exclusive OR encryption masks matching those used at switches 3 at adjacent nodes and the local switch 3 will again be unable to function.
• auxiliary security processor 34 provides some security. Whether the improved encryption based security options as described above are used or not will, like most security decisions, be a trade off between the importance placed on security and costs.
• user authenticating smart cards are to be employed they can be used for one, some or all local switches 3 in the network depending upon the degree of security required. In some very high security applications it may be appropriate to employ smart cards for user authentication at all local switches 3 while in less security critical applications it may be sufficient to employ smart card user authentication only at the gateway client device 2 connecting to the Internet or the gateway client device 2 containing and generating the most security critical data. It will be understood that the above described security features are a function of the network hardware and software itself and are entirely independent of and transparent to applications employing and operating over the network. Any application based security features such as data encryption by the applications are entirely independent of the security features described above.
• exclusive OR masks are advantageous because is imposes little extra delay on message transmission and reception, does not increase message size and can be simply , and cheaply implemented.
• alternative encryption masks or arrangements could be used.
• the message format has a message type and routing section comprising a 2 bit message type code, 2 bit data size code, and 6 bit destination and source identifiers.
• the message format may also have a data section comprising a 32 or 128 bit data payload.
• This arrangement simplifies the logic employed in the finite state machines of the switch blocks 6 as the bit counter and early termination can be processed during the following field.
• level 1 messages are non-secure messages between processing elements at the nodes. Each node may only send data request messages or responses to earlier requests in this format and may only receive requests for data or return information in response to an earlier request. Message passing of this type is normally used to report interrupt requests and carry network protocols.
• Level 2 messages are pre-encoded messages between application processors to set up inter-node encryption masks and are essentially special purpose level 1 messages.
• Level 3 and 4 messages are used for communication between the auxiliary security processors 34 at different nodes.
• Acknowledgement messages contain no data payload and are specifically identified as such by the message type code.
• the data size codes are shown in Figure 9c and these indicate whether the message includes zero data, one word (32 bits) of data or four words (128 bits) of data as a payload. Normally, only acknowledgements will have a zero data content.
• the communications link between adjacent nodes carries data, clock and frame signals.
• the data signal is of course the actual data making up the messages carried on the network as explained above.
• the clock signal is required to ensure that the opposed transmitter and receiver sections 9 and 10 in the switches 3 at each end of each communications link in the system are sending and receiving data at the same rate in order to allow reliable transmission of data.
• networks operate with a common clock signal throughout the network with any differences being due to propagation delays only and indeed such a common clock arrangement is mandatory in a data bus type system.
• the opposed transmitter and receiver pairs 9 and 10 in the switches 3 of adjacent nodes are connected so as to form an asynchronous logic loop which generates a clock signal used to synchronise the transmitters and receivers and the data link between them.
• This logic loop is shown diagrammatically in Figure 10.
• a clock status transition is generated in the transmitting section 9 of the upstream local switch 3a at the upstream node and sent along the communication path to the receiving section 10 of the local switch 3b at the downstream node.
• the clock transition is then inverted by an inverter 36 to provide an opposite polarity clock transition and re-sent by the transmitting section 10 of the downstream local switch 3b back to the receiving section 9 of the upstream local switch 3 a where it is passed back to the transmitting section 9 and re-sent.
• the inverter gives a 180° phase shift and the rest of the phase shift at the loop resonating frequency is provided by the various delays to the signal going around the loop.
• the switches 3 are arranged so that when their upstream or downstream sections are not connected to another switch 3 through a communications link, an unconnected downstream transmitting port is held at a clock logic level of one while an unconnected upstream receiving section is held at a clock logic level of zero.
• the use of a single inversion in the loop is not essential, the essential criterion is having an odd number of inversions.
• the precise location of the or each inversion is unimportant, the inverter 36 can be in either switch 3.
• loops are driven by an initial clock pulse from the upstream switch 3.
• the reduced delay in the loop will automatically cause the clock signals for the communications links the switch is using to be increased.
• changes in the delay times across the data links for example due to replacement of one cable with another of different length, will be automatically compensated for by a change in the clock rate, as will changes in the operating speeds of the switches 3 due to temperature changes.
• clock rate for each communications link in the network may be different and in practice it probably will be at least slightly different. Further, although the internal clock rates used by the switches 3 and the clock rates used to transfer data through the connecting data links are related because any increase in the switch clock rate will allow an increased data transfer clock rate to be supported along its data links, they are not the same.
• bit-synchronous timing is preferred to allow the data rate between adjacent nodes to be as high as possible without losing bandwidth due to preambles for synchronisation. This is also simple to implement.
• Messages may be partially pipelined if desired. If mid-message pipelining is to be used, the local switches 3 along the pipelined data route must cooperate so that they are all using the same clock rate along all of the communication links. This common clock speed will have to be the lowest along the data route. Accordingly, setting a common clock rate should be carried out by the local processing sections 4 of the client devices 2 requiring message pipelining instructing the necessary switches 3 to do this only when pipelined messages are to be sent, the locally set clock rates as described above being otherwise used.
• one node will be the furthest upstream and one will be furthest downstream.
• the furthest upstream node is deemed to be the network master for position resolution purposes and allocation of logical or virtual circuit numbers. Being at the uppermost node, on startup or reset it will not have an incoming clock signal on its output (upstream) facing receiver.
• On start up or system reset all switches 3 send clock signals downstream and the presence or otherwise of a received clock signal from upstream is used to determine whether or not a node is a master. After clock signals have been received or not for a preset period, the fact that a switch 3 is at a master node or not will be indicated in a status register and then reset status will be de-asserted.
• switches 3 After reset all switches 3 are configured with an assigned address of zero.
• the assigned circuit is then determined from the master node outwards by the switch 3 at the master node being logical circuit zero and sending a message downstream to node 1 giving the logical circuit number 1.
• the switch 3 at node 1 captures that message and assigns itself the received circuit number, using the result as its own node address.
• the switch 3 at node 1 increments the received circuit number and sends it downstream to node 2. This process continues, assigning the virtual circuit numbers node by node. If necessary, a given node may be allocated more than one circuit number.
• node numbers are permanently initially assigned in order to allow for the possibility that switches could be added or removed or moved from place to place in an network over time requiring reassignment of numbers. Further, resetting followed by assignment of new identifying numbers may be useful or necessary in order to allow a partial network separated from a larger network by a component failure to continue functioning independently.
• the equipment of all nodes must be able to support asynchronous byte wide and synchronous byte wide transfers but all other features are optional. On system startup or reset local processing must establish what facilities are available at each node in the network.
• a local processor able to send and receive 128 bit messages must check not only that the recipient node of a message is able to send and receive 128 bit messages but also that all intermediate nodes are able to do this if 128 bit messages are to be sent. Otherwise, the message will have to be broken down into a number of smaller messages which can be handled by the intermediate nodes.
• downstream switch block 6a the only additional requirement is hardware or logical switching to allow the appropriate one of the transmission sections to be selected based upon the message destination address.
• the upstream switch block 6b will require additional buffering and message arbitration in order to allow for the possibility of multiple messages being received simultaneously on the different downstream timing receiving sections and arbitrating which received message should be transmitted next.
• each communications link is not strictly essential, a single transmitting section could be used together with switching downstream of the transmitting section to select the destination node.
• the use of separate transmitting sections for each communication link is preferred because this allows the automatic clock rate setting technique and enhanced security techniques outlined above to be used fully.
• the network architecture described can also be used as an architecture within the individual client devices 2 to provide the local processing section 4.
• a typical multiprocessor and local processing section 4 is shown in Figure 12.
• the processing section 4 is formed by a plurality of processors 40, six processors 40a to 40f in the example, linked together into a chain by a series of in/out buses or data transfer links 41a to 41e, each of which links a pair of processors 40.
• connections 41 a to 41 e can be buses, such buses will only link two consecutive processors 40 in the chain and not all of the processors 40 as in a conventional bus-based multi-processor device.
• the processing section 4 operates similarly to the linear network described above with the processor 40a being regarding as the highest upstream processor and controlling external access to and from the processing section 4.
• the processors need not be exclusively arithmetic, they could be audio or video processors having their own separate inputs and outputs.
• FIG 14. A simple illustration of this principle is shown in Figure 14.
• the device in Figure 14 is extremely simple having only three nodes, the first network node 30 being connected to a second smart card node 31 which is connected in turn to a third applications processor node 32.
• the network node 30 is formed by a processor forming a connection to the local switch 3.
• the smart card node 31 incorporates a smart card connector. Data sent to and from the smart card from the network cannot be intercepted by the applications processor at the applications processor node 32 because the data sent to and from the smart card, which may incorporate e-commerce or biometric data, are simply not physically passed to it.
• This level of basic security is only reliable for embedded applications in a client device 2 which only receives software upgrades by a protected service, in this example by smart card. Otherwise, the software within the smart card node 31 could be remotely altered so that the messages containing the sensitive data were copied to the processor at the applications processor node 32.
• this level of security is vulnerable to anyone with physical access to the device because a logic state analyser could be used to record transactions along a data path and then allow an unauthorised node to be inserted.
• a logic state analyser could be used to record transactions along a data path and then allow an unauthorised node to be inserted.
• such an attack is dependent on having physical access to the device and this may not be possible, for example where the device is an automatic teller machine (ATM) or inside medical equipment.
• ATM automatic teller machine
• FIG. 13 An alternative structure is shown diagrammatically in Figure 13 where a device 4 having five processors 40a to 40e has had an additional communication link 41 f connected between the most upstream processor 40a and the most downstream processor 40f so that the processors are linked in a ring.
• This structure will support dual control rotating loop communication links. In this illustration the possible separate video input and output buses are not shown for clarity.
• the first is increased redundancy and improved system integrity. If the ring is broken at any point by failure of a commumcations link 41 or a processor 40 communication between the remaining parts of the device can still be effected by routing messages around the loop in the direction avoiding the break.
• any processor 40 can test the integrity of the loop by attempting to send messages to itself in both directions around the loop and if one or both of these messages is blocked sending messages to the other processors 40 in turn until the failure point can be determined.
• contra rotating loops have been used in the past in FDDI (fibre distributed data interface) based systems they have never before been used in device level architectures.
• FDDI field-dielectric distributed data interface
• the use of a dual contra rotating loop imparts a level of system robustness not achievable with traditional parallel bus based architectures.
• any source processor 40 can transmit data in both directions to the same destination processor 40.
• any particular processor can be allowed to provide twice the bandwidth into the system that it can do using a linear arrangement with the hardware being otherwise identical.
• FIG. 15 A suitable processor structure for use within the device structures shown in Figures 12 and 13 is shown in Figure 15.
• each processor 40 includes a switch element 43 as well as the actual application processor 44. Accordingly, a virtual circuit will pass through the switch 43 to a particular port on the processor 44.
• Software controlled security is implemented by programming the switch 43 to route the selected virtual circuits, that is selected destination addresses, into the local processor 44. It is then a matter of implementations specific security rules as to the conditions under which the accepted data is reinserted into the switch for passing to the next processor 40 in the sequence. It is prefened to use ATM to carry data within the device.
• the reinserted data be given the same virtual circuit header as the incoming data to avoid the need for the recipient device to be reprogrammed to a different virtual circuit to the incoming one. This renders the switch transparent from a device internal transparency perspective.
• the security provided in the network by messages not being available throughout the system will also be provided in a single device. This is more significant within a device than in a network because the physical security of the internal parts of a single device are usually much greater than the physical security of the network.
• the described processor structure allows use of a very simple switch 43 on each processor since only those virtual circuits destined to be retained at that device node for use by the applications processor 44 need to be registered in the switch 43. Messages for all other virtual circuit destinations will be simply passed through unmodified.
• Such encryption schemes are analogous to the network level encryption schemes described above and so will not be described in detail here.
• Such encryption can employ exclusive OR masks set under control of the applications processor 44 or set autonomously by an auxiliary security processor incorporated within the processor 40 and controlling the exclusive OR masks employed by the switch or switches 43 of the processor 40 in a similar manner to the auxihary security processor described with regard to network security.
• auxiliary security processors forming part of the individual processors 40 within a device can also be controlled and provided with mask seeds by a smart card.
• the clock rate employed between separate processors of a single device and the message size to be employed can be set in a similar manner to the techniques described above for use in the network.
• both the network architecture and the non-loop device architecture it is possible to connect additional devices or processors further downstream without effecting the operation of the upstream parts of the network or device. This allows hot plugging of both new devices into a network and new processors into a device without interrupting the operation of the rest of the network or device. This is not normally possible in consumer devices or products and is generally not possible with data bus based architectures.
• the connectors for devices into the network or processors within a device should be arranged to link up power and ground first and then allow the newly-added element to begin receiving the clock signal from the device it has been connected downstream of.
• the newly-added element can then integrate itself into the network or device. This process is simplest where the network or device is a purely linear arrangement because the newly-added element can then simply be assigned an address or logical circuit number by simply incrementing the number or numbers held by the upstream device.
• Such a hot plug insertion of the new processor cannot easily be carried out in a device configured as a loop unless messages are normally only sent around the loop in one direction so that the additional link 40F is normally not in use, in which case its link could be broken and re-made to include an additional processor without disturbing the operation of the rest of the device.
• the most upstream or gateway element will be sending and receiving messages upstream out of the device or network while the most downstream elements will not be connected to any further downstream location. Accordingly, these elements at the extremes of the device or network do not require the capability to send or receive messages both upstream and downstream. However, in practice it will normally be preferred to retain a full upstream and downstream message sending and receiving capability in all elements to allow improved economies of scale in component production and to allow maximum flexibility in rearranging elements within a network or device even though this involves the elements at the extremes of the network or device having redundant components and capabilities.
• ATM asynchronous transfer mode
• the data links between nodes in the network can be provided by mains carrier modem, category 5 twin twisted pairs, 75 ⁇ coaxial cable, wireless or consumer infrared. This is a list of suitable examples and is not intended to be exhaustive.
• the message has a fixed size with a payload of 32 bits only. Accordingly, there is no requirement for a data size code.
• the 6 bit source identifier is replaced by a 8 bit virtual circuit number used to identify the source.
• message formats given are purely examples. As other alternatives, it would be possible to include message type and size in a single code if a variable message size was required rather than having separate message type and message size codes.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Small-Scale Networks (AREA)
• Radiation-Therapy Devices (AREA)
• Selective Calling Equipment (AREA)
• Manipulator (AREA)
• Computer And Data Communications (AREA)
• Tests Of Electronic Circuits (AREA)
• Superconductors And Manufacturing Methods Therefor (AREA)
• Analysing Materials By The Use Of Radiation (AREA)

Priority Applications (8)

Applications Claiming Priority (2)

Publications (2)

Family

ID=22229014

Family Applications (1)

Country Status (11)

Cited By (1)

Families Citing this family (1)

• 1999
  • 1999-07-02 AU AU46345/99A patent/AU4634599A/en not_active Abandoned
  • 1999-07-02 WO PCT/GB1999/002125 patent/WO2000002345A2/en not_active Ceased
  • 1999-07-02 AT AT99929556T patent/ATE356503T1/de not_active IP Right Cessation
  • 1999-07-02 EP EP99929556A patent/EP1142259B1/en not_active Expired - Lifetime
  • 1999-07-02 JP JP2000558633A patent/JP2002520906A/ja not_active Ceased
  • 1999-07-02 DE DE69935452T patent/DE69935452T2/de not_active Expired - Lifetime
  • 1999-07-02 CN CN99809277A patent/CN1312997A/zh active Pending
  • 1999-07-02 ES ES99929556T patent/ES2284259T3/es not_active Expired - Lifetime
  • 1999-07-02 HK HK02100693.8A patent/HK1039006A1/zh unknown
  • 1999-07-02 CA CA002336328A patent/CA2336328A1/en not_active Abandoned
• 2000
  • 2000-12-22 NO NO20006622A patent/NO20006622L/no unknown

Non-Patent Citations (3)

Also Published As

Similar Documents

Legal Events