10Base-T1S Ethernet And The Use Of MACsec For Link Security

Reducing the number of interfaces used and unifying control protocols for the low-cost edge applications space.

popularity

10Base-T1S (henceforth in this blog referred to as T1S) is a relatively new standard for a 10Mbit/s single-pair Ethernet over an unshielded, single-twisted pair that was introduced with the IEEE 802.3cg-2019 specification. It brings Ethernet technology into the low-cost, edge applications space, enabling connection of “edge nodes” (remote sensors, actuators, light controls, etc.) to a “head node” (host MCU, switch or gateway) through the use of a multi-drop bus up to 25 meters in length. The T1S bus can support up to 8 nodes with half-duplex operation mode, making it an alternative to CAN/CAN-FD.

Fig. 1: 10BASE-T1S PHY Multi-Drop Link Representation. (Source: Wikimedia Commons)

T1S is an important part of the new generation of automotive and industrial architectures that aim to go “All Ethernet” or as close as possible to it. The move to T1S allows a reduction in the number of interfaces used at the edge (e.g. LIN, CAN/CAN-FD), avoids costly gateways, and unifies the control protocols. On the practical side, T1S will be added to new devices (chips and subsystems), while mature and cost-efficient CAN-based devices remain in the architecture for a time.

While IEEE defines the 802.3 standard for T1S, the Open Alliance (www.opensig.org) promotes the use of T1S by specifying the usage scenarios, types of silicon solutions, common management approach, testing and interoperability. Open Alliance is also working on other initiatives like defining profiles for MACsec network security and remote control protocol (RCP).

10Base-T1S adoption

The T1S port definition is based on a “standard Ethernet MAC” combined with two layers:

  • Physical Layer Collision Avoidance (PLCA) layer, a new type of Physical Coding Sublayer (PCS). This is referred to as the “Digital PHY.”
  • A physical media attachment (PMA/PMD) layer, implementing access to T1S media through analog/mixed-signal circuitry.

The industry adoption of T1S is ongoing with the following approaches:

  • Using a T1S PHY with MII: It adds T1S to the existing system without the need to change the host device (e.g. MCU).
  • Using a MAC-PHY: A purpose-built PHY with an SPI host interface. This approach is defined and promoted by Open Alliance, where a host uses its SPI interface to send/receive Ethernet packets, and the MAC-PHY maps them to the T1S port. This method is suitable for low-cost and low-bandwidth applications.
  • Integrating T1S into an SOC (MCU or Zonal controller): A method defined and promoted by the Open Alliance, where the PMD transceiver is the only external component connected to the SOC with a 3-pin interface (OA3p interface).

Fig. 2: 10BASE-T1S PHY Implementations. (Source: Open Alliance)

Host SOC products with native support of T1S will be based on the OA3p specification, where the digital part of T1S is integrated into the SOC. Such an approach provides the most cost-effective solution to the market.

Edge node and RCP

A couple of major concerns in adoption of T1S are the cost-efficiency and standardization of the “edge node,” a remote module that is accessed and controlled via T1S to perform its function like control of a light, motor, heater, or reading sensor data, etc. In a sense, such devices can be seen as a “reversed MAC-PHY,” receiving commands via T1S and converting them to low-level signals like SPI, I2C, PWM, GPIO.

Open Alliance TC18 is working on defining the RCP (Remote Control Protocol), a lightweight Ethernet-based communication protocol to simplify transition towards zonal architecture and All-Ethernet architectures for in-vehicle networks. While this work is in progress, some vendors may adopt their own alternatives for the Ethernet-based control protocol for time-to-market reasons.

Network security for 10Base-T1S

The T1S physical wires are located at remote locations, like peripheral zones, and are easily accessible for potential physical intervention, where the attacker may not only read the data, but also inject its own. Therefore, protecting T1S traffic is vitally important, and IEEE802.1AE MACsec has been chosen as an industry-wide network security protocol.

The initial use of MACsec would be for access control, to prevent unauthorized peers from participating in communication, along with detecting and rejecting unknown or suspicious traffic. MACsec provides that capability by data integrity protection, packet delay check, and dropping non-protected packets. The advanced use-cases would include data confidentiality and multiple secure domains (for example, separating broadcast and multicast traffic).

Automotive MACsec specifications

MACsec originates from the enterprise and high-speed data world and has features and modes that bring inherent cost to the implementation. Due to the low-cost and low-speed nature of T1S applications, MACsec will be used in a feature-reduced manner, which is called a “profile.” In addition, its use in the automotive environment drives special constraints for system behavior that influence control plane implementations.

The automotive MACsec environment and solutions are discussed and promoted by the Open Alliance TC17 group, which recently released two specifications:

  • Automotive MKA specification, which specifies the changes in the MKA control state machines necessary to improve real-time reaction when managing MACsec secure connection in the automotive-critical environment.
  • Automotive MACsec specification, which specifies the minimum required features from the IEEE802.1AE standard for the switched automotive Ethernet (point-to-point, including T1S). The MACsec profile for a T1S in shared medium mode would be added in future revisions of the document.

Adding MACsec for T1S ports

For T1S applications, efficiency and feature completeness of the MACsec implementation is one of the key factors for silicon vendors.

For the host node, it is important for MACsec to be feature rich and have enough scale to support future profiles. Likely, most of the IEEE MACsec features would be required.

At the edge node, with the greatest size constraints, a tailored approach to building the MACsec data plane is required, focusing on automotive MACsec profiles, while keeping latency impact as low as possible.

Conclusions

10Base-T1S is an important technology, introduced by the promoters of the All-Ethernet approach to unify the software architecture and control principles across the target platform, whether it is automotive, industrial or aerospace.

In the past 4-5 years, adoption of T1S has rapidly grown with many silicon vendors supplying PHYs, MAC-PHYs, and PMDs. At the same time, the Open Alliance members are actively working to find ways to bring down costs, specifically tailoring the features to the target application’s needs.

Security for T1S is an imperative and the optimized profiles of MACsec along with tailored implementations will be used to meet the cost targets and provide automotive-grade behavior.

Related links



Leave a Reply


(Note: This name will be displayed publicly)