San Mateo, Calif. - Broadcom Corp.'s introduction of the BCM5812 cryptography processor earlier this month represented more than an extension of the company's product line. It signaled a dramatic shift in Broadcom's design methodology, a revised approach to intellectual-property (IP) reuse and an attempt to integrate a collection of acquisitions by a growing company into a single machine for producing networking and communications silicon.
The driving force behind the change was market reality, said Joseph Wallace, product line manager for security products at Broadcom (Irvine, Calif.). "Frankly, the market size today is very disappointing," Wallace said. "Analysts had predicted a $100 million market for security processors based on the number of routers, gateways and firewalls that would be handling VPN [virtual private network] traffic. But the attach rate has been nowhere near what they assumed-it probably isn't above 20 percent."
The BCM5812 accelerates the execution of AES encryption algorithms in firewalls, small switches and routers to improve VPN throughput.
"The next problem is performance," Wallace continued. "A lot of vendors expected that all the interest would be in increasing the bandwidth of the devices so they could operate at wire speed on very fast lines. That didn't happen either. I'd estimate that wire speeds of 1 Gbit/second and above represent about 1 percent of the opportunity."
In today's market, opportunities come up quickly, and one by one, Wallace said. A particular router or firewall box goes into design at a particular price/performance point. If Broadcom is to sell security processors into that design, it must respond in a matter of months with a chip that meets the cost, speed and interface requirements of that opportunity.
That means that Broadcom's engineering team must turn around a chip design for practically zero cost in nearly zero time. And that, in turn, has focused many of Broadcom's architects on two fundamental ideas: array architectures and reusable IP.
The BCM5812's predecessor, the 5823, is a case in point, Wallace said. "We saw an opportunity for a particular configuration," he said. "We were able to create a design by instantiating blocks, mostly from previous designs in the family, and go from definition to tapeout in about four months."
This has had a twofold impact on architecture, Wallace said. First, the design team created a common I/O architecture so that various types of interfaces-such as PCI-can be dropped into the design with little additional work. But the concept goes deeper than that.
The encryption accelerator itself is not a monolithic processor. Instead, Broadcom uses a relatively small processing core with a limited amount of buffer memory around it. This core is instantiated as often-or as little-as necessary to achieve the specified throughput. But the real secret sauce, as Wallace put it, is the custom task-control logic that makes it possible for several processors to cooperate on a single "security association"-that is, a single collection of packets that share the same keys.
In most architectures, a single processor core must be mapped to a single security association. That means that no matter how many cores the chip has, it can only assign one to each security association. So, for instance, when there's only one security association going through the chip, it will still run at the speed of a single core. The Broadcom architects have overcome that problem. Hence, their architecture can scale smoothly in die size and performance from a single core to a large array, independent of the richness of the packet stream.
Reusability has also been a key issue for the core design. To stay on schedule, designers must follow strict design-for-reuse guidelines. Even more important, the verification suite must be almost entirely reusable.
This is a relatively new issue at Broadcom, which has grown through the acquisition of small companies. Startups don't typically devote much energy to design-for-reuse: If they don't put all their energy into their first chip, they probably won't be around to reuse any of the chip's cores. But BlueSteel Networks Inc., a startup that Broadcom acquired in 2000 and the source of the security-processor design team, found itself in the position of having to develop a reuse strategy.
That will be an issue not just within the design team, but also across the corporation in the near future, according to Wallace. The next logical step for security processors, which are relatively small pieces of silicon, is to be integrated onto larger system-on-chip designs to form single-chip firewalls or routers with on-chip VPN acceleration. Doing so will require cooperation among several Broadcom groups, including the security-processor folks, the switching-chip designers and the physical-layer IC designers. The IP-reuse strategy must become a formal part of the company's design culture, Wallace said.