MACsec is moving to the module in scale-across networks.

Media Access Control security (MACsec) is a foundational technology for protecting data in motion. It encrypts and authenticates Ethernet traffic to guard against eavesdropping, denial-of-service attacks, intrusion and other security threats while also strengthening overall data integrity. Embodied in silicon, MACsec further establishes a robust root of trust for managing encryption keys and securing the boot process.

What’s changing is where the silicon for delivering MACsec gets located.

To date, the MACsec circuitry for long-distance scale-across networks has typically been embedded in the switch ASIC, where space and silicon real estate are at an absolute premium. Embedding MACsec into the tight confines of the ASIC raises the cost of integrating the technology. It also makes infrastructure less flexible: some upgrades require taking the system offline, reducing overall capacity.

Alternatively, MACsec devices can be placed on the printed circuit board near the ASIC—think of this as near-packaged MACsec—but this too comes with extra costs and additional complexity. A retimer would likely have to accompany the MACsec device on the board and upgrades can, again, involve taking the system offline.

Integrating MACsec into the coherent DSPs inside ZR/ZR+ modules that make up data center interconnect (DCI) fabrics, by contrast, reduces cost, time and risk. MACsec can be added to the coherent DSPs without changing the external physical footprint of ZR/ZR+ modules or adding components to the module. Just as important, installing, upgrading and managing modules is far easier than replacing switch ASICs or dedicated security devices on a circuit board: ZR/ZR+ modules are specifically designed to be replaced at will.

Marvell has already announced several industry firsts to enable MACsec to scale across networks:

• Electra, a 2nm MACsec-enabled 1.6T coherent DSP for interconnects up to 1,000km at 1.6 Tbps. Electra-based modules will also be capable of providing 800 Gbps connectivity at distances up to 2,000km, or twice as far as today’s 800G coherent modules at the same data rate.
• Libra, an 800G coherent DSP with integrated MACsec for long-distance interconnects ranging from 10km-1000 km at 800 Gbps and up to 2,400km at 400 Gbps.
• Aquila M, a 1.6T coherent-lite DSP for campus and metro connections (2km-20km).

Marvell is collaborating with partners to ensure switches, routers and ZR/ZR+ DCI modules from other developers incorporating Marvell® coherent DSPs are compatible with module-based MACsec.