.webp){kind=small}
Technology Solution
End-to-End Security
Line-rate crypto including MACsec and IPsec, plus post-quantum support on Agilex® FPGAs, from access to core, with security you can update in the field.
Security at Every Hop and Every Layer
Encrypted traffic is now the norm, ports are moving to 400G and 800G, and the first post-quantum cryptography (PQC) standards are final. Wireline equipment shipping today has to secure every link at line rate and still take on new algorithms years after it leaves the factory.
Agilex® FPGAs put security where the traffic is. MACsec, IPsec, and TLS run in the data path at line rate, with Altera® MACsec IP and 200G hard AES-GCM engines on select Agilex 7 devices and production intellectual property (IP) for Agilex device scaling MACsec to 800G and IPsec to 400G. PQC-enabled secure boot on Agilex 3 and Agilex 5 devices anchors trust in silicon. A new cipher is a bitstream update, not a board respin.
The Challenges, and Why FPGA
The Challenge
Encryption Has to Keep Pace with 400G
Ports are moving from 100G to 400G and 800G. Software crypto and CPU-bound inspection cannot hold line rate or latency at those speeds.
Why FPGA
Crypto in the Data Path
MACsec and IPsec run in programmable logic next to the MAC, encrypting every frame at wire speed with fixed latency and no CPU in the loop.
The Challenge
Post-Quantum Migration Is Underway
NIST finalized the first PQC standards in 2024. Equipment built to last a decade must adopt new key exchange and signatures in the field.
Why FPGA
Crypto Agility by Design
New algorithm, new bitstream, same board. NIST calls FPGAs the exception to fixed-function crypto because they reconfigure after deployment.
The Challenge
Trust Has to Start at Boot and Last a Decade
Rules such as the EU Cyber Resilience Act (CRA) expect secure updates across a product's life, and trust must exist before any code runs.
Why FPGA
Hardware Root of Trust
The Secure Device Manager verifies firmware and bitstream before the fabric runs. PQC-enabled secure boot ships on Agilex 3 and Agilex 5 devices.
The Challenge
Shared Hardware, Isolated Tenants
Agilex and Stratix® 10 FPGAs partition tenants in silicon rather than software, with hardware-enabled identity management and authenticated bitstreams and partial bitstreams. Cloud providers can build integrity and confidentiality into their platforms and swap workloads at runtime without compromising their neighbors.
Why FPGA
Hardware Isolation
Partition tenants in silicon with authenticated bitstreams and partial bitstreams, so workloads can change at runtime while staying isolated.
Why Altera
Hard Crypto Where It Pays Off
Select Agilex 7 devices F- and I-Series add 200G hard AES-GCM engines; Altera MACsec IP ships in the Quartus® Prime Pro Edition software.
Post-Quantum Ready, Shipping Today
PQC-enabled secure boot on Agilex 3 and Agilex 5 devices, with a Quartus Prime Pro Edition software v26.1.1 flow, anchors trust for a decade.
One Portfolio, Access to Core
Agilex 3 devices for 10GbE control, Agilex 5 devices for 25G access and edge, Agilex 7 devices for 400G transport: one tool flow, reusable RTL.
An Open Security IP Ecosystem
Partner IP for Agilex devices covers MACsec to 800G, IPsec to 400G, TLS and PQC key exchange, all in the Altera partner catalog.
Get Started
More Wireline Applications
NFVi
FPGAs bring hardware acceleration to Network Functions Virtualization Infrastructure.
Gateway
FPGAs implement flexible, reconfigurable hardware acceleration for network gateways.
Routing/Switching Overlay
FPGAs power high-speed routing and switching with integrated crypto and memory.
OTN, B100G OTN, and FlexO
FPGA-based Virtual ASSPs for OTN, Beyond-100G, and FlexO transport up to 800G.
Flex Ethernet (FlexE) and MTN
FPGAs implement FlexE and MTN to turn Ethernet into a flexible multichannel link.
Private Line Emulation (PLE)
FPGAs enable bit-level transparent OTN transport over IP and Ethernet networks.
EPON-GPON / 10G / 25-50G PON
FPGAs implement scalable OLT MAC solutions from GPON to 50G Asymmetric PON.
Common Questions
OTN provides optical transport framing and associated management, FlexE groups and allocates Ethernet client capacity, and PLE carries transparent client bit streams over packet networks. Choose according to the service and transport architecture rather than bandwidth alone.
Use PLE when transparent client transport over a suitable packet network fits the service requirements. Verify clock recovery, packet-delay variation, buffering and loss behavior; RFC 9801 specifies PLE but a deployment still needs deployment validation.
Size the buffer from the bounded packet-delay variation, recovery strategy and allowable added delay for the service. Test representative network load and loss conditions because a larger buffer can improve tolerance while increasing latency.
Define the reconfigurable boundary and preserve required static traffic paths, clocks and state behavior. Validate interruption, recovery and isolation for the selected protocol; partial reconfiguration does not automatically make every interface change hitless.
Correlate link training and alignment, FEC counters, clock quality and channel margin with traffic errors. Check optics, board path and configuration against the selected device/IP guidance before changing higher-level transport mapping.
Use programmability when supported PON MAC, transceiver and coexistence configurations fit the planned access portfolio. Validate burst-mode reception, FEC, scheduling and legacy coexistence for each deployed combination rather than assuming one image covers all standards.