Devices, systems, and methods for integrating encryption service channels with a data path
A system comprises a transmitter including first circuitry that generates a first frame of a first type for establishing a quantum-secure link with an endpoint according to a security protocol, a data source that generates a second frame of a second type for communicating data to the endpoint, an output that couples to the endpoint via a first communication channel, and second circuitry. The second circuitry selects either the first frame or the second frame, adds information to the selected frame that identifies the selected frame as being of the first type or the second type to form an output frame, and outputs the output frame to the output.
1. A system, comprising:
a transmitter including:
first circuitry that generates a first frame of a first type for establishing a quantum-secure link with an endpoint according to a security protocol;
a data source that generates a second frame of a second type for communicating data to the endpoint;
an output that couples to the endpoint via a first communication channel; and
second circuitry that:
selects either the first frame or the second frame;
adds information to the selected frame that identifies the selected frame as being of the first type or the second type to form an output frame; and
outputs the output frame to the output.
2. The system of claim 1 , wherein the second circuitry selects either the first frame or the second frame based on a first priority associated with the first frame and a second priority associated with the second frame.
3. The system of claim 1 , wherein the second circuitry identifies boundaries of the selected frame.
4. The system of claim 1 , wherein the second circuitry comprises a multiplexer and circuitry for performing one or more datalink layer functions.
5. The system of claim 1 , wherein the output comprises a gearbox that sends the output frame to the first communication channel, and wherein the first frame comprises service traffic for establishing the quantum-secure link.
6. The system of claim 1 , wherein the transmitter further comprises:
third circuitry that generates a third frame of a third type for the quantum-secure link according to the security protocol, wherein the second circuitry selects either the first frame, the second frame, or the third frame for output by the output.
7. The system of claim 6 , wherein the first circuitry is configured to perform one or more key exchange operations with the endpoint over a second communication channel different from the first communication channel.
8. The system of claim 7 , wherein the third circuitry is coupled to the first circuitry and is configured to perform one or more key management operations for the one or more key exchange operations.
9. The system of claim 8 , wherein the third circuitry comprises a memory including a first data structure that identifies available keys and associated key identifiers.
10. The system of claim 9 , wherein the memory includes a second data structure that identifies installed keys and associated entity identifiers that identify entities using the installed keys.
11. The system of claim 1 , wherein the information comprises a control flit prepended to the selected frame, and wherein the second frame comprises data encrypted with the security protocol.
12. The system of claim 11 , wherein the control flit identifies a number of flits in the selected frame.
13. The system of claim 1 , further comprising:
a receiver for the endpoint and including:
an input that receives a signal comprising the selected frame over the first communication channel; and
third circuitry that extracts the selected frame from the signal based on the information added to the selected frame.
14. The system of claim 13 , wherein the third circuitry:
directs the selected frame extracted from the signal to a respective destination.
15. The system of claim 13 , wherein the information identifies a number of flits in the selected frame.
16. A method, comprising:
generating a first frame of a first type for establishing a quantum-secure link with an endpoint according to a security protocol;
generating a second frame of a second type for communicating data to the endpoint;
selecting either the first frame or the second frame based on priorities of the first frame and the second frame;
adding a control flit to the selected frame that identifies the selected frame as being of the first type or the second type to form an output frame; and
sending the output frame over a first communication channel to the endpoint.
17. The method of claim 16 , wherein first circuitry selects the selected frame and adds the control flit, and wherein second circuitry sends the output frame over the first communication channel to the endpoint.
18. The method of claim 16 , wherein the control flit identifies boundaries of the selected frame, wherein the first frame comprises service traffic for establishing the quantum-secure link, and wherein the second frame comprises data encrypted with the security protocol.
19. The method of claim 16 , further comprising:
performing one or more key exchange operations with the endpoint according to the security protocol over a second communication channel different from the first communication channel.
20. A transmitter for communicating data to an endpoint via a communication channel, the transmitter comprising:
first circuitry that generates a first frame of a first type for establishing a quantum-secure link with the endpoint according to a security protocol;
a data source that generates a second frame of a second type for communicating data to the endpoint;
an output that couples to the communication channel; and
second circuitry that:
selects either the first frame or the second frame;
adds, to the selected frame, information that identifies the selected frame as being of the first type or the second type to form an output frame; and
transmits the output frame to the output.