Policy-based application of peer-to-peer security protocols for network flows of source applications

Abstract

Examples of the present disclosure relate to policy-based application of a peer-to-peer security protocol to network flows from a source application. Some examples relate to applying a peer-to-peer security protocol to a network flow from a source application. In an example, in an example implementation, a network device may receive a network flow from a network client on a network. A network device may analyze network packets of a network flow. Based on the analysis, the network device may identify a source application of the network flow. The network device may then refer to a lookup table in an integrated circuit (IC) on the network device, the lookup table including a peer-to-peer security protocol (PSP) related policy for the source application. Based on the PSP policy in the lookup table, the network device may avoid applying PSP-based encryption to the network flow from the source application.

Description

Background Art

[0001] An enterprise's network acts as a highway for all data traffic, facilitating the movement, storage, and access to data. Given the importance of data in today's world, the security of an enterprise's network has become critical. Enterprises are increasingly focusing on protecting their networks from the inside. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Figure 1 is a block diagram of a computing environment for applying a peer-to-peer security protocol to a network flow from a source application according to some examples;

[0003] Figure 2 shows a lookup table according to some examples;

[0004] Figure 3 shows network grouping according to some examples;

[0005] Figure 4 is a block diagram of a network device according to some examples;

[0006] Figure 5 is a flowchart of a method according to some examples; and

[0007] Figure 6 is a block diagram of a storage medium storing machine-readable instructions according to some examples. DETAILED DESCRIPTION

[0008] Enterprise network security protects a company's data and resources from malicious activity. Threats, such as malware, computer worms, computer viruses, and other network attacks, can take many forms. Enterprise security solutions can protect a company's data from these threats by detecting and blocking them before they cause damage.

[0009] Enterprise network security is a set of security measures taken by enterprises to prevent and resolve real-time attacks on enterprise data. Enterprise network security aims to protect company applications, data and infrastructure from online threats. One such enterprise network security measure is the Point-to-Point Security Protocol (PSP). As used herein, "Point-to-Point Security Protocol (PSP)" refers to a network security protocol that operates at the media access control layer and provides point-to-point security on Ethernet links. An example of a point-to-point security protocol is the Media Access Control Security (MACsec) protocol.

[0010] MACsec is a network security protocol that provides point-to-point security on Ethernet links. MACsec is defined by IEEE standard 802.1AE. MACsec specifies how to protect all or part of a local area network (LAN) at the link layer. MACsec performs encryption functions in the physical layer (PHY) of the Ethernet port and supplies encryption at the same rate as the Ethernet port, regardless of packet size. MACsec can protect participating entities (e.g., network devices) using the MACsec Key Agreement (MKA) protocol.

[0011] MACsec on enterprise networks is deployed to protect traffic between directly connected network devices that carry traffic over the Internet. When MACsec is enabled on a point-to-point Ethernet link, the link is protected after matching security keys are exchanged and verified between the interfaces at each end of the link. Keys can be manually configured or dynamically generated. MACsec provides MAC layer encryption by using an out-of-band method for encryption keys. The MACsec Key Agreement (MKA) protocol manages encryption keys. Network administrators can configure a pre-shared key (PSK) on both network devices. Once MKA is secured on the link, the security association keys (SAKs) that protect the data plane traffic are programmed in hardware to establish the MACsec channel. Subsequently, all traffic on the link except MKA frames is protected by MACsec.

[0012] However, there are technical challenges in using MACsec on a network. MACsec adds a 32-byte header to each Ethernet frame protected by MACsec. This in turn reduces link capacity. "Link capacity" refers to the maximum amount of traffic or signal that can pass through a specific infrastructure channel. When MACsec is used, link capacity can drop to 70% for 64-byte frames and 90% for 256-byte frames. MACsec also requires that packets undergo encryption operations on the sending end and decryption operations on the receiving end, which increases latency. In the case of time-sensitive application traffic (such as audio and video), it may produce a jitter experience. Network latency refers to the amount of time it takes for a packet to get from one place to another.

[0013] The increase in applications using networks (e.g., the Internet) has caused a large amount of data to enter enterprise networks. Not all data entering enterprise networks is required to be protected via MACsec. For example, entertainment application traffic destined for the Internet (such as Netflix and YouTube) may not contain sensitive data associated with the enterprise.

[0014] In one example, filtering available today to bypass MACsec for specific frames is based on the source and destination MAC addresses and the Ethernet type (a two-octet field) in the Ethernet frame. There is no mechanism for network administrators to selectively pick which applications on a link should (or should not) be protected by MACsec.

[0015] It is desirable to have a mechanism for selectively protecting end-user traffic at the edge based on the application associated with the user flow to reduce the number of frames to be protected by MACsec on the link. The proposed solution utilizes deep packet inspection (DPI) to identify network applications associated with flows in an enterprise network. A DPI engine is used to inspect the first few packets of a flow. Once the source application of the flow is identified, the application identification is combined with user-defined application-specific policies on a chip (e.g., an application-specific integrated circuit (ASIC)) to determine whether the network flow from the source application should be encrypted on a downlink port of a network device (e.g., a network switch).

[0016] In an example implementation, a network device may receive a network flow from a network client on a network. The network device may analyze network packets of the network flow. Based on the analysis, the network device may identify a source application of the network flow. The network device may then refer to a lookup table in an integrated circuit (IC) on the network device that includes a Point-to-Point Security Protocol (PSP)-related policy for the source application. Based on the PSP policy in the lookup table, the network device may avoid applying PSP-based encryption to the network flow from the source application.

[0017] The proposed solution increases link capacity while still using point-to-point security protocols (e.g., MACsec) to protect critical application traffic. This in turn reduces the need for higher bandwidth on the uplink port to absorb the overhead introduced by the point-to-point security protocol. The proposed solution also reduces latency for certain applications, such as audio and video applications (e.g., YouTube, Netflix, and Facebook), which do not require protection by point-to-point security protocols.

[0018] Now referring to the accompanying drawings, Figure 1 1 is a block diagram of a computing environment 100 including a network client 102, a network device 104, and a network server 106. Figure 1 In the example of FIG. 1 , for simplicity, one network client 102, one network device 104, and one network server 106 are depicted. In some examples, computing environment 100 may include a different number of network clients, network devices, and network servers.

[0019] As used herein, "network client" refers to computer hardware or software (machine executable instructions) that requests access to a service provided by another device on a network. Examples of network clients 102 may include workstations, desktop computers, notebook computers, thin clients, Voice over Internet Protocol (VoIP) phones, security cameras, or any other processing devices. Network client 102 may include processor(s). Processor(s) may also include core(s). "Core" refers to a processing unit built into a processor (or socket) that is capable of independently executing or processing computing tasks.

[0020] The network client 102 may host one application (machine executable instructions) or multiple applications. As used herein, an "application" refers to a computer program designed to perform specific tasks other than tasks related to the operation of the computer itself. Examples of applications may include word processors (e.g., MS Word), media player applications (e.g., VLC player), video sharing applications (e.g., YouTube), content streaming applications (e.g., Netflix), and social media applications (e.g., Facebook).

[0021] The application can perform various tasks, such as data creation, data modification, data storage, data transfer, etc. In an example, an application on the network client 102 can generate a network flow. As used herein, a "network flow" refers to a sequence of packets that share a set of header field values ​​that pass through a network. For example, a network flow can include each packet in a packet with the same source and destination IP addresses, or each packet in a packet with the same virtual local area network (VLAN) identifier (VLAN ID). The VLAN ID is used for VLAN identification, and is, for example, a 12-bit field that specifies the VLAN to which an Ethernet frame belongs. In an example, when an application generates a network flow, the application can be referred to as a "source application."

[0022] As used herein, a "network device" refers to an electronic device used for communication and interaction between devices on a computer network. Figure 1 In an example, the network device 104 may include a network switch, a network router, a gateway device, or any other network device. In an example, the network device 104 may include a processor (or multiple processors) and a storage medium. The processor may include a central processing unit (CPU), a microprocessor, a programmable gate array, a microcontroller, or any other processing logic that interprets and executes machine-readable instructions stored in a storage medium.

[0023] As used herein, "network server" refers to computer hardware or software (machine-executable instructions) that provides functionality to other programs or devices (e.g., network client 102). Network server 106 can provide various functions, such as sharing data or resources between multiple clients or performing calculations for a client (e.g., network client 102). Examples of network server 106 can include database servers, file servers, mail servers, print servers, web servers, game servers, video sharing servers, content streaming servers, and social media servers.

[0024] The network clients 102, network devices 104, and network servers 106 may be communicatively coupled via a network. The network may be a local area network (LAN), a wide area network (WAN), a storage area network (SAN), a campus network (CAN), the Internet, or any other type of network. In some examples, the network clients 102, network devices 104, and network servers 106 may be part of separate networks (such as separate LANs or WANs). In some examples, the network clients 102, network devices 104, and network servers 106 may be located in different geographic locations.

[0025] In some examples, network client 102, network device 104, and network server 106 may be devices that are physically connected, for example, via LAN cables, via Ethernet. Ethernet is a wired computer network technology used to connect multiple devices (such as network client 102) to form a local area network, using protocols to control the transfer of information and to avoid simultaneous transmissions by two or more devices.

[0026] In an example, the network device 104 can apply a point-to-point security protocol (PSP). As used herein, "point-to-point security protocol (PSP)" refers to a network security protocol that operates at the media access control (MAC) sublayer and provides point-to-point security on an Ethernet link. The media access control sublayer is a sublayer of the data link layer of the open system interconnection (OSI) reference model for data transmission. The MAC sublayer controls the hardware responsible for interacting with wired, optical or wireless transmission media. The MAC sublayer and the logical link control (LLC) sublayer together form the data link layer. An example of a point-to-point security protocol is the media access control security (MACsec) protocol.

[0027] MACsec is a network security protocol that provides point-to-point security on Ethernet links. MACsec is defined by IEEE standard 802.1AE. MACsec uses the Advanced Encryption Standard (AES) to provide authentication, confidentiality, and integrity for data transmitted on point-to-point links in an enterprise network. MACsec provides authentication by ensuring that only known nodes are allowed to communicate on the LAN. MACsec provides confidentiality through encryption of the data so that only endpoints with the correct encryption key can see the contents.

[0028] MACsec key negotiation is an associated protocol that provides multiple authentications between hosts (e.g., network client 102 and network device 104) in a network (e.g., network server 106). MACsec adds a security tag and integrity check value to each Ethernet frame, which provides integrity to all frames and confidentiality to user data. Integrity is provided through an encryption mechanism ("MACsec encryption"), ensuring that the data has not been tampered with or corrupted while in motion.

[0029] As mentioned above, MACsec operates at the data link layer. MACsec encapsulates IP packets using, for example, a 16-byte MACsec SecTag header and a 16-byte integrity check value (ICV) trailer, and uses a special EtherType (0x88E5). In the MAC layer, a preamble and a cyclic redundancy check (CRC) are added to the Ethernet frame before transmission.

[0030] In an example, the network device 104 may include one or more lookup tables 108. As used herein, a "lookup table" refers to a list of values ​​stored in a memory of a hardware component (e.g., an integrated circuit (IC)) 110 that can be accessed using software (machine executable instructions). In an example, a hardware component can "look up" what the output(s) are for a given input(s). An "integrated circuit (IC)" is a set of electronic circuits on a piece of semiconductor material, typically silicon. Multiple tiny transistors and other electronic components can be integrated together on an IC. Figure 2 A lookup table according to an example is shown.

[0031] In an example, an application on the network client 102 can generate a network flow. For example, when an application wants to communicate with another device on the network (e.g., the network server 106) to send and / or receive data, a network flow can be generated. For example, when an email application wants to send a message to the network server 106, the email application can generate a network flow. In another example, when a video sharing application wants to share a video with the network server 106, the video sharing application (e.g., YouTube) can generate a network flow. In another example, when a social media application wants to post a message to the network server 106, the social media application can generate a network flow.

[0032] A network flow can include one or more network packets. Depending on the protocol used for transmission, a network packet can also be called a datagram, segment, block, or frame. A network packet is the basic unit of communication on a network. For example, a network packet can be divided into three parts: a header, a payload, and a trailer. The size and structure of a network packet depends on the underlying network structure or the protocol used.

[0033] In an example, a network client may include an application ID in a network packet of a network flow from an application. As used herein, an "application ID" refers to a unique value assigned to an application that is used to identify the application. An application ID may be, for example, a string of letters, numbers, special characters (e.g., @ and #), or alphanumeric characters. For example, application ID "1455" may be used to represent a YouTube application. In another example, application ID "ab46" may be used to specify a Facebook application. In a similar manner, each application may be assigned a unique ID. In an example, an application ID may be included in the payload of a network packet. Figure 3 A network packet including an application ID according to an example is shown.

[0034] Once the application on the network client generates the network flow, the network client can send the network flow via the network to the network device 104. The network device 104 can receive the network flow from the network client and continue to analyze the network packets present therein. In an example, the network device 104 can analyze the network packet(s) by performing deep packet inspection (DPI) on the network packet(s).

[0035] As used herein, "deep packet inspection (DPI)" refers to a type of data processing that examines in detail data sent over a computer network. DPI is a method of inspecting the contents of a network packet. DPI includes analysis of packet headers and protocol fields. DPI looks at a series of data and metadata associated with individual packets, and the network device 104 can use different ways to obtain packets for deep packet inspection. One example technology is port mirroring, which can be used by the network device 104 to send a copy of a network packet seen on one port to a network monitoring connection on another port. Another example technology involves physically inserting a network splitter (a dedicated hardware device) that copies the data stream and sends it to an analyzer tool for inspection. These are some examples of performing DPI to extract application IDs from network packets. They will not cause bandwidth overhead because DPI can be performed even with one packet. The bandwidth loss that the current implementation attempts to solve is caused by MACsec encryption of all packets regardless of the type of application, which causes a 32-byte MACsec header to be added to each frame, as described above.

[0036] In an example, by performing DPI, the network device 104 can extract the application ID from the network packet. Once the network device 104 extracts the application ID from the network packet, the network device 104 can reference a lookup table 108 in an integrated circuit (IC) 110 of the network device 104. An "integrated circuit (IC)" is a set of electronic circuits on a piece of semiconductor material (usually silicon) (or a "chip" of semiconductor material). In an example, the lookup table in the IC includes a mapping between the application ID of the application and the PSP-related policy 112 for the application. Figure 2 A mapping in a lookup table according to an example is shown.

[0037] The network device 104 can refer to the lookup table in the IC to identify the point-to-point security protocol (PSP) related policies for the application ID based on the application ID. In other words, the network device 104 can identify the PSP related policies for the source application of the network packet based on the application ID because the application ID represents the source application.

[0038] As previously mentioned, "Point-to-Point Security Protocol (PSP)" refers to a network security protocol that operates at the media access control layer and provides point-to-point security on Ethernet links. An example of a point-to-point security protocol is the MACsec protocol. PSP-related policies for applications are defined in a lookup table to enable network device 104 to determine policy-related actions for network flows received by network device 104 for the application.

[0039] Once the network device 104 references the lookup table and identifies the PSP-related policy for the application ID, the network device 104 can take action based on the PSP-related policy. In an example, the action can include applying the PSP to the network flow of the application received by the network device 104. In an example, applying the PSP to the network flow of the application can include applying MACsec (including MACsec encryption) to the network flow of the application. As used herein, MACsec encryption refers to the encryption performed in the physical layer (PHY) of the Ethernet port.

[0040] MACsec is defined by the IEEE 802.1AE standard. MACsec uses a combination of data integrity checking and encryption (or "MACsec encryption") to protect the data being sent. MACsec authenticates Ethernet endpoints (e.g., network device 104 and network server 106) before sending MACsec frames over the network. Authenticated MACsec peers on the same network belong to a connectivity association (CA). This means that these MACsec peers are connected and allowed to communicate with each other. CA member devices use a long-lived connectivity association key (CAK) to identify themselves. MACsec frames are transmitted over a secure channel (SC), which is supported by a security association (SA). "SecY" is an entity that operates the MACsec protocol on a network port. A SecY instance is associated with a specific virtual port. For each peer device connected to an Ethernet port, each SecY and virtual port has an outgoing-SA and a receiving-SA. Each SA uses a separate security association key (SAK) to encrypt and authenticate frames.

[0041] The long-lived CAK is used to generate a short-lived SAK for protecting data transmitted between peers. The SAK is updated periodically based on the number of packets sent. MACsec uses the Advanced Encryption Standard (AES) with a Galois / Counter Mode (GCM) encryption algorithm for authenticated encryption ("MACsec encryption"). A sending device (e.g., network device 104) can encrypt data and send the data in ciphertext on a LAN link. The receiving device decrypts the received encrypted data and then performs other processing. In an example, the MACsec standard encrypts the fields after the SecTAG, which obscures fields such as the Multi-Protocol Label Switching (MPLS) label in the original Ethernet frame. When the Ethernet frame traverses the underlying transport network, intermediate network devices that may require those labels cannot see them.

[0042] In the example, the receiving device is configured to accept both MACsec protected packets and non-MACsec packets. When a packet enters the receive (Rx) channel of the interface on the receiving device, the packet is inspected to check whether the packet contains a SecTAG. If the packet contains a SecTAG, the packet is passed to a "controlled port" where it is MACsec decrypted before passing through the rest of the forwarding pipeline. If the packet does not contain a SecTAG, the packet is passed to an "uncontrolled port" where the hardware is configured not to drop the packet and pass it through to the rest of the forwarding pipeline. In other words, the transmit (Tx) and receive (Rx) channels are not forced to only transmit and receive MACsec protected frames. They are configured to accept non-MACsec frames and process them like any other packets.

[0043] MACsec also provides integrity through the Integrity Check Value (ICV). The ICV is a cryptographic digest function that depends on the data and the SAK. The ICV is used to authenticate the Ethernet frame before the CRC field. This ensures that any tampering with the frame will be detected.

[0044] In an example implementation, a port supporting MACsec on a sender device (e.g., network device 104) can be used to perform MACsec encryption services, and another such port can be used for MACsec decryption services. The port can be configured to an internal loopback mode. Any packet that will be MACsec encrypted due to a PSP-related policy can be redirected to a port configured for MACsec encryption services. The original destination port for the packet is recorded in the packet metadata, which is retained in the sender device by recycling. Once the packet is recycled back to the hardware after MACsec encryption, a first three-state content addressable memory (TCAM) rule can be installed to redirect any packet arriving at the port (providing MACsec encryption) to the original destination port available in the packet metadata. On a similar line, when a packet with a SecTAG arrives at an uplink port, a second TCAM rule can redirect such a packet to a port providing MACsec decryption services. The packet returns to the hardware after decryption, and the original source port of the packet stored in the packet metadata is restored and further used to make a forwarding decision for the packet.

[0045] In another example, the action may include abstaining from applying the PSP to a network flow of an application received by the network device 104. As used herein, the term "abstaining" refers to an action of intentionally avoiding applying PSP-based encryption to a network flow of a source application. In an example, abstaining includes avoiding applying MACsec (including MACsec encryption) to a network flow of an application.

[0046] Figure 2 A lookup table 200 according to an example is shown. As previously described, a lookup table can be used to provide an output for each input. The lookup table 200 can include, for example, (multiple) output values ​​on each row. The (multiple) values ​​can be in the form of bytes, words, and integers, for example. In an example, the lookup table can include multiple elements on a single row (e.g., inputs and outputs corresponding to the inputs). A device (e.g., network device 104) can simply "look up" what the (multiple) output values ​​should be for any given input.

[0047] Once the lookup table is created, a read command may be used to read data from it. In an example, the read command may use the name of the table, the location of the item to be retrieved, and a variable to store the retrieved number.

[0048] In an example, lookup table 200 can be used to represent the point-to-point security protocol (PSP) related policies for applications. In an example, separate PSP related policies can be represented depending on the application. For example, PSP related policies can be represented depending on whether the network flow from the application is "encrypted" or "unencrypted". An enterprise can choose whether the network flow from the application will be "encrypted" or "unencrypted". An enterprise can choose to select, for example, video sharing applications (e.g., YouTube), content streaming applications (e.g., Netflix) and social media applications (e.g., Facebook) as applications whose network flows will not be encrypted. On the other hand, network flows from applications such as email applications (e.g., MS Outlook), GitHub and messaging applications (e.g., MS Teams) can be selected for encryption.

[0049] In an example, the "values" (eg, bytes, words, and integers) in the lookup table 200 may be used to represent PSP-related policies for an application. Figure 2 In the example of , the lookup table shows two columns. The first column 202 includes an application ID for an application (e.g., Facebook, YouTube, and GitHub), and the second column 204 includes a value assigned to the application ID for the application. The value in the second column represents a Point-to-Point Security Protocol (PSP) related policy for the application (represented via the application ID).

[0050] In an example, the value can be defined using a binary numbering system. The binary numbering system represents the number with only two digits: 0 (zero) and 1 (one). In an example, in a given row of the lookup table, if the value (in the second column) corresponding to the application ID (in the first column) is "0", it can indicate that the PSP (e.g., MACsec) will be applied to network packets of the network flow from the application corresponding to the application ID. In another example, if the value (present in the second column) corresponding to the application ID (present in the first column) is "1", it can indicate that the PSP (e.g., MACsec) will not be applied to network packets of the network flow from the application corresponding to the application ID. In another example, two digits: 0 (zero) and 1 (one) can be used to represent these values, and vice versa.

[0051] An advantage of using a lookup table is that it is memory efficient for reading compared to the equivalent set of command statements that might be required to be given to read the data.

[0052] Figure 3 An unencrypted network packet 300A and an encrypted network packet 300B according to some examples are shown accordingly. The structure of the unencrypted network packet 300A may include three parts: a header 302 , a payload 304 , and a trailer 306 .

[0053] The header 302 contains instructions about the data carried by the network packet. These instructions may include the length of the network packet, synchronization information (bits that help the packet match the network), the packet number, protocol information 312 (defining the type of packet being sent out), the destination address 312 (where the packet is going), and the source address 308 (where the packet is coming from).

[0054] The payload 304 is the actual data that the network packet is delivering to the destination address. In this example, the payload appears immediately after the header. The network protocol may specify the maximum length allowed for the packet payload. In an example, the payload may include the application ID 316 of the application that generated the network packet. The application ID is a unique value assigned to an application that is used to identify the application.

[0055] The trailer 306 (also called a footer) contains bits that tell the receiving device that it has reached the end of the packet. The trailer may also include an error checking mechanism, such as a cyclic redundancy check (CRC) 314, which is an error detection code commonly used in digital networks and storage devices to detect accidental changes to digital data.

[0056] In addition to the portion of the unencrypted network packet (e.g., 300A), the structure of the encrypted network packet 300B protected by MACsec may also include the following: Figure 3MACsec header 342 is shown. MACsec adds a 32-byte header 342 to each Ethernet frame protected by MACsec. In encrypted network packet 300B, payload 304 including application ID 316 of the application that generated the network packet is encrypted.

[0057] Figure 4 A block diagram of a network device 400 according to some examples is shown. The network device may be similar to Figure 1 104, where like reference numerals correspond to the same or similar but possibly not identical components. Figure 4 With Figure 1 Components or reference numerals having the same or similar functions as described herein will not be combined. Figure 4 The components or reference numerals may be considered similar.

[0058] Network device 400 may include a processor 420 (or multiple processors) and storage media 422. Processor 420 may include one or more central processing units (CPUs), microprocessors, programmable gate arrays, microcontrollers, or any other processing logic that interprets and executes machine-readable instructions stored in storage media 422.

[0059] The storage medium 422 may store information and machine-readable instructions executable on the processor 420 to perform various tasks. The storage medium 422 may be synchronous DRAM (SDRAM), double data rate (DDR), Rambus DRAM (RDRAM), Rambus RAM, etc., or a storage memory medium such as a floppy disk, hard disk, CD-ROM, DVD, pen drive, etc.

[0060] In an example, processor 420 executes receiving instructions 430 to receive a network stream from a network client on a network. In an example, an application on a network client (e.g., a workstation, a desktop computer, and a notebook computer) can generate a network stream. The network stream includes (multiple) network packets, and the network packet includes an application ID that uniquely identifies the application. In an example, processor 420 can execute receiving instructions 430 to establish a network connection with the network client via Ethernet. Processor 420 can then obtain the network stream from the network client via Ethernet.

[0061] Processor 420 executes analysis instructions 432 to analyze network packets of a network flow. As previously described, a network packet in a network flow may include an application ID of a source application that generates the flow. The application ID may be present in, for example, a payload portion of a network packet. When the analysis instructions are executed, they may include performing a deep packet inspection of (multiple) network packets in a network flow.

[0062] Processor 420 executes identification instructions 434 to identify the application ID of the source application that generated the network packet. Deep packet inspection may look at the payload of the network packet(s) to identify the application ID of the source application.

[0063] Processor 420 performs lookup instruction 436 with reference to the lookup table in the IC of network equipment, and this lookup table includes the PSP relevant strategy for source application.Once the application ID of source application is identified, lookup instruction 436 just can be executed to identify the PSP relevant strategy mapped to application ID.In one example, the lookup table in the ASIC of network equipment includes the mapping between application ID and PSP relevant strategy, and this PSP relevant strategy will be applied to the network flow of the application corresponding to this application ID.Lookup instruction 436 identifies such mapping for given application ID from the ASIC of network equipment.

[0064] Based on the PSP-related policies in the lookup table, the processor 420 executes the action instruction 438 to avoid applying PSP-based encryption to the network flow of the source application. In an example, if the PSP-related policies mapped to the application ID in the lookup table indicate that PSP-based encryption will not be applied to the network flow of the source application, the action instruction avoids the network device from applying PSP-based encryption to the network flow of the source application.

[0065] Figure 5 5 is a flow chart of a method 500 according to some examples. The method 500 may be performed by a network device. For example, the method 500 may be performed at least in part in Figure 1 The network device 104 or Figure 4 is executed on the network device 400.

[0066] At block 502, method 500 includes receiving, by a network device, a network flow from a network client on a network. In an example, receiving includes establishing a network connection with the network client via Ethernet and obtaining network traffic from the network client via the Ethernet network.

[0067] At block 504, method 500 includes analyzing, by a network device, network packets of a network flow. In an example, analyzing includes performing deep packet inspection of network packets from the network flow and identifying an application ID associated with a source application from the network packets.

[0068] Based on the analysis, at block 506, method 500 includes identifying, by the network device, a source application of the network flow. In one example, identifying includes identifying an application corresponding to the application ID based on the application ID present in the network packet.

[0069] At block 508, method 500 includes referencing, by the network device, a lookup table in an IC of the network device, the lookup table including a PSP-related policy for a source application. In an example, the lookup table or data structure in the IC may include a mapping between an application ID of the application and a MACsec-related policy for the source application. The MACsec-related policy for the application is defined in the lookup table so that the network device can determine an action related to the MACsec-related policy for a network flow received by the network device for the application. In an example, the action may include applying a MACsec protocol (as defined by the IEEE 802.1AE standard) to the network flow of the application.

[0070] Based on the PSP-related policies in the lookup table, at block 510, method 500 includes abandoning, by the network device, applying PSP-based encryption to the network flow of the source application. In an example, the action may include abandoning applying a MACsec protocol (as defined by the IEEE 802.1AE standard) to the network flow of the application. In an example, applying the MACsec protocol to the network flow of the application may include applying encryption (e.g., MACsec encryption) to the network flow of the application. In an example, abandoning includes avoiding applying MACsec encryption on a downlink port of the network device.

[0071] Figure 6 is a block diagram of a non-transitory machine-readable or computer-readable storage medium 600 storing machine-readable instructions that, when executed, cause a network device to perform various tasks. The network device may include Figure 1 The network device 104 or Figure 3 The network device 400.

[0072] The machine-readable instructions include instructions 602 for receiving a second network flow from a network client on a network. The machine-readable instructions include instructions 604 for analyzing network packets of the second network flow. Based on the analysis, the machine-readable instructions include instructions 606 for identifying a second source application of the second network flow. The machine-readable instructions include instructions 608 for referencing a lookup table in an IC of the network device, the lookup table including a PSP-related policy for the second source application. Based on the PSP-related policy for the second source application, the machine-readable instructions include instructions 610 for applying PSP-based encryption to the second network flow of the second source application.

[0073] For simplicity of explanation, Figure 5 The example methods are shown as being performed serially, however, it should be understood and appreciated that this example and other examples are not limited to the order shown. Figure 1 , Figure 4 and Figure 6 The example system and Figure 5The method can be implemented in the form of a computer program product, which includes computer executable instructions, such as program codes, which can be combined with an appropriate operating system (for example, Microsoft etc.) to run on any suitable computing device. Examples within the scope of the present solution may also include a program product that includes a non-transitory computer-readable medium for carrying or having computer-executable instructions or data structures stored thereon. Such a computer-readable medium may be any available medium that can be accessed by a general-purpose or special-purpose computer. For example, such a computer-readable medium may include RAM, ROM, EPROM, EEPROM, CD-ROM, disk storage or other storage devices, or any other medium that can be used to carry or store the desired program code in the form of computer-executable instructions and that can be accessed by a general-purpose or special-purpose computer. The computer-readable instructions may also be accessed from the memory and executed by the processor.

[0074] It should be understood that the above examples of the present solution are for illustration only. Although the solution has been described in conjunction with its specific examples, multiple modifications may be possible without departing substantially from the teachings and advantages of the subject matter described herein. Other replacements, modifications and changes may be made without departing from the spirit of the present solution. All features disclosed in this specification (including any attached claims, abstracts and drawings) and / or all steps of any method or process so disclosed may be combined in any combination, unless at least some of these features and / or steps are mutually exclusive combinations.

[0075] Although particular combinations of features are recited in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of the various implementations. In fact, many of these features may be combined in ways not specifically recited in the claims and / or disclosed in the specification. Although each dependent claim listed below may be directly dependent on a claim, the disclosure of the various implementations includes the combination of each dependent claim with every other claim in the claim set.

[0076] As used herein, a phrase referring to "at least one of" a list of items refers to any combination of those items, including single members. As an example, "at least one of: a, b, or c" is intended to cover a, b, c, ab, ac, bc, and abc, as well as any combination of multiples of the same item.

[0077] As used herein, the articles "a" and "an" are intended to include one or more items and may be used interchangeably with "one or more." Additionally, as used herein, the article "the" is intended to include one or more items in conjunction with the article "the" and may be used interchangeably with "one or more." Additionally, as used herein, the terms "has," "have," "having," and the like are intended to be open-ended terms. As used herein, the term "includes" is intended to mean "including, but not limited to," and the term "including" is intended to mean "including, but not limited to." Additionally, unless expressly stated otherwise, the phrase "based on" is intended to mean "based at least in part on." Additionally, as used herein, the term "or" is intended to be included when used in series and may be used interchangeably with "and / or," unless expressly stated otherwise (e.g., if used in combination with "either" or "only one").

Claims

1. A method comprising: receiving, by a network device, a network stream from a network client on the network; Analyzing, by the network device, network packets of the network flow; identifying, by the network device, a source application of the network flow based on the analysis; The network device refers to a Point-to-Point Security Protocol (PSP) related policy for the source application; as well as Based on the PSP-related policy, the network device abandons applying PSP-based encryption to the network flow of the source application.

2. The method of claim 1, wherein abandoning comprises: Accessing a lookup table in an integrated circuit IC of the network device, the lookup table comprising the PSP-related policy for the source application; determining the PSP-related policy for the source application in the lookup table; as well as In response to determining that the PSP-related policy for the source application is to not apply the PSP-based encryption to the network flow of the source application, avoiding applying the PSP-based encryption to the network flow of the source application.

3. The method of claim 1 , wherein receiving comprises: Establishing a network connection with the network client via Ethernet; as well as The network stream is obtained from the network client via the Ethernet.

4. The method of claim 1, wherein analyzing comprises: performing deep packet inspection of the network packets from the network flow; as well as An application ID associated with the source application is identified from the network packet.

5. The method according to claim 1, further comprising: determining the PSP-related policy for the source application in the lookup table; In response to determining that the PSP-related policy for the source application is to apply the PSP-based encryption to the network flow of the source application, applying the PSP-based encryption to the network flow of the source application.

6. The method of claim 1, wherein abandoning comprises refraining from applying the PSP-based encryption on a downlink port of the network device.

7. A network device comprising: processor; as well as A non-transitory storage medium storing instructions, which when executed by the processor cause the network device to: receiving a network stream from a network client on the network; Analyzing network packets of the network flow; identifying a source application of the network flow based on the analyzing; Refer to the Point-to-Point Security Protocol (PSP) related policy for the source application; as well as Based on the PSP-related policy, applying PSP-based encryption to the network flow of the source application is abandoned.

8. The network device according to claim 7, wherein the PSP-related policies include policies related to a Media Access Control Security (MACsec) protocol.

9. The network device of claim 7, wherein the PSP-based encryption comprises MACsec protocol encryption.

10. The network device of claim 7, wherein the network client and the network device are physically connected devices.

11. The network device of claim 7, wherein the network client and the network device are parts of separate networks.

12. The network device of claim 7, wherein the PSP-related policies exist in a lookup table of the IC.

13. The network device of claim 7, wherein the instructions are executable by the processor to further: receiving a second network stream from the network client on the network; analyzing network packets of the second network flow; identifying a second source application of the second network flow based on the analyzing; referring to the PSP-related policy for the second source application; as well as Based on the PSP-related policy for the second source application, PSP-based encryption is applied to the second network flow of the second source application.

14. The network device of claim 7, wherein to avoid applying PSP-based encryption to the network flow of the source application, the instructions when executed are to: accessing a lookup table in an IC of the network device, the lookup table comprising the PSP-related policy for the source application; determining the PSP-related policy for the source application in the lookup table; as well as In response to determining that the PSP-related policy for the source application is to not apply the PSP-based encryption to the network flow of the source application, avoiding applying the PSP-based encryption to the network flow of the source application.

15. A non-transitory machine-readable storage medium comprising instructions that, when executed, cause a network device to: receiving a network stream from a network client on the network; Analyzing network packets of the network flow; identifying a source application of the network flow based on the analyzing; Refer to the Point-to-Point Security Protocol (PSP) related policy for the source application; as well as Based on the PSP-related policy, applying PSP-based encryption to the network flow of the source application is abandoned.

16. The storage medium of claim 15, wherein the network comprises Ethernet.

17. The storage medium of claim 15, wherein the source application is one of: a video sharing application, a content streaming application, and a social media application.

18. The storage medium of claim 15, wherein to avoid applying PSP-based encryption to the network flow of the source application, the instructions, when executed, cause the network device to: accessing a lookup table in an IC of the network device, the lookup table comprising the PSP-related policy for the source application; determining the PSP-related policy for the source application in the lookup table; as well as In response to determining that the PSP-related policy for the source application is to not apply the PSP-based encryption to the network flow of the source application, avoiding applying the PSP-based encryption to the network flow of the source application.

19. The storage medium of claim 15, wherein for analysis, the instructions, when executed, cause the network device to: performing deep packet inspection of the network packets from the network flow; and An application ID associated with the source application is identified from the network packet.

20. The storage medium of claim 15, wherein to receive, the instructions, when executed, cause the network device to: Establishing a network connection with the network client via Ethernet; and The network stream is obtained from the network client via the Ethernet.

Images