Method capable of flexibly configuring macsec encryption offset

Abstract

The invention provides a method capable of flexibly configuring macsec encryption offset, which comprises the following steps that: before encryption negotiation, configuration of self-defined encryption offset is carried out on all equipment ends needing MACsec encryption, in a key negotiation process, an encryption negotiation server configures and selects a corresponding Confidentiality Offset encryption offset parameter numerical value according to an encryption offset mode, and the encryption offset parameter numerical value is configured according to an encryption offset mode; if a configurable MACsec encryption offset mode is started, a Confidentiality Offset encryption offset parameter is set to be 2'b11, otherwise, the Confidentiality Offset encryption offset parameter is set to be other corresponding numerical values, and after negotiation is completed, the encryption offset parameter is transmitted to all equipment ends encrypted by MACsec through key negotiation data. According to the method capable of flexibly configuring the macsec encryption offset, an implementation mode capable of flexibly configuring the encryption offset is expanded on the basis of an original key negotiation mode, the implementation mode is simple and flexible, and resources are saved.

Description

Technical Field

[0001] The invention relates to the field of macsec encryption, and in particular to a method for flexibly configuring a macsec encryption offset. Background Art

[0002] MACsec is a data security communication method for local area networks based on the IEEE802 protocol specification. MACsec uses Layer 2 encryption technology to achieve secure sending and receiving of MAC layer data. It mainly includes the following functions: user data encryption, data frame integrity check, data source authenticity check and replay protection. MACsec is not a replacement for the existing end-to-end Layer 3 security technology, but their complementary technology. This technology is suitable for occasions with high requirements for data confidentiality, such as when two switches in a local area network pass through optical transmission equipment. MACsec encryption technology can ensure the secure transmission of data on the intermediate transmission device. The MACsec data encryption message frame structure is shown in the attached figure. Figure 1 shown.

[0003] DA: destination address of MAC message (6 bytes); SA: Source address of MAC message (6 bytes); VLAN: virtual LAN information (4 bytes); ETH_TYPE: MAC message type or length (2 bytes); User Data: MAC message data (46~1500 bytes); FCS: MAC message CRC check data (4 bytes); SEC TAG: MAC message encryption identification information (8 or 16 bytes); NO SEC DATA: MAC message encryption offset field (0, 30 or 50 bytes); SEC DATA: MAC message encryption field; ICV: MAC message integrity verification data (8~16 bytes); New FCS: CRC checksum data recalculated after MAC message encryption (4 bytes); The MAC message encryption offset field, that is, the length of the data not encrypted in the data encryption protection field, is determined by the Confidentiality Offset parameter of 2 bits provided by key negotiation. This is to accommodate certain applications that need to identify Layer 3 messages. The specific correspondence between the encryption offset parameter and the encryption offset is as follows: 2'b00: the encryption offset byte is 0; 2'b01: the encryption offset byte is 30; 2'b10: The encryption offset byte is 50; 2'b11: reserved field; The disadvantage of the prior art is that the MACsec encryption offset can only be one of the three values ​​of 0, 30 or 50, the encryption offset is single, and the encryption offset cannot be flexibly and accurately adjusted to meet the encryption scenario requirements of different types of messages.

[0004] Therefore, it is necessary to provide a method for flexibly configuring the macsec encryption offset to solve the above technical problems. Summary of the invention

[0005] The present invention provides a method for flexibly configuring a MACsec encryption offset, which solves the problem that the MACsec encryption offset can only be one of the three values ​​of 0, 30 or 50, the encryption offset is single, and the encryption offset cannot be flexibly and accurately adjusted to meet the encryption scenario requirements of different types of messages.

[0006] In order to solve the above technical problems, the present invention provides a method for flexibly configuring the macsec encryption offset, comprising the following steps: S1. Before encryption negotiation, configure a custom encryption offset on all devices that require MACsec encryption. S2. During the key negotiation process, the encryption negotiation server selects the corresponding Confidentiality Offset encryption offset parameter value according to the encryption offset mode configuration. If the configurable MACsec encryption offset mode is enabled, the Confidentiality Offset encryption offset parameter is set to 2'b11, otherwise it is set to other corresponding values. After the negotiation is completed, the encryption offset parameter is transmitted to all MACsec encrypted devices through the key negotiation data. S3. The MACsec encryption device parses the corresponding encryption offset according to the ConfidentialityOffset encryption offset parameter extracted from the received key negotiation data; S4. The MACsec encryption device encrypts the MAC message to be encrypted according to the encryption offset.

[0007] Preferably, the encryption negotiation in S1 includes key generation, key exchange, key verification and key usage.

[0008] Preferably, the key generation includes random number generation, cryptographic algorithms and key derivation functions.

[0009] Preferably, the random number generation utilizes a high-quality random number generator to generate a random key, which may be based on a hardware random number source or a well-validated software random number algorithm.

[0010] Preferably, the cryptographic algorithm can generate a key through an internal mechanism of a specific encryption algorithm, such as generating a key pair based on an elliptic curve algorithm.

[0011] Preferably, the key derivation function can process some input information through KDF to obtain a new key.

[0012] Preferably, the key verification includes digital signature verification, message authentication code verification, key exchange verification and hash value comparison.

[0013] Preferably, the digital signature verification can be performed by the sender using his own private key to digitally sign the key, and the receiver uses the sender's public key to verify the signature to confirm that the key is indeed from the sender.

[0014] Preferably, the message authentication code verification can be performed by calculating the MAC value of the key and the relevant data, and performing a comparison verification at the receiving party.

[0015] Preferably, the hash value comparison can be performed by performing a hash calculation on the key, and the receiver compares whether the received hash value is consistent with the expected hash value.

[0016] Compared with the related art, the method for flexibly configuring the macsec encryption offset provided by the present invention has the following beneficial effects: The present invention provides a method for flexibly configuring a macsec encryption offset. Under the original key negotiation mode, an implementation mode for flexibly configuring the encryption offset is extended. The implementation mode is simple, flexible, and resource-saving. The adjustment of the encryption offset is more flexible and accurate. The encryption offset can be set to any value between 0 and 1500 bytes, covering a wider range. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A structural schematic diagram of a first embodiment of a method for flexibly configuring macsec encryption offset provided by the present invention; Figure 2 A schematic diagram of the processing flow; Figure 3 A structural schematic diagram of a second embodiment of a method for flexibly configuring macsec encryption offset provided by the present invention. DETAILED DESCRIPTION

[0018] The present invention will be further described below in conjunction with the accompanying drawings and implementation modes.

[0019] First embodiment:

[0020] Please refer to Figure 1 and Figure 2 ,in, Figure 1 A structural schematic diagram of a first embodiment of a method for flexibly configuring macsec encryption offset provided by the present invention; Figure 2 A method for flexibly configuring macsec encryption offset includes the following steps: S1. Before encryption negotiation, configure a custom encryption offset on all devices that require MACsec encryption. S2. During the key negotiation process, the encryption negotiation server selects the corresponding Confidentiality Offset encryption offset parameter value according to the encryption offset mode configuration. If the configurable MACsec encryption offset mode is enabled, the Confidentiality Offset encryption offset parameter is set to 2'b11, otherwise it is set to other corresponding values. After the negotiation is completed, the encryption offset parameter is transmitted to all MACsec encrypted devices through the key negotiation data. S3. The MACsec encryption device parses the corresponding encryption offset according to the ConfidentialityOffset encryption offset parameter extracted from the received key negotiation data; S4. The MACsec encryption device encrypts the MAC message to be encrypted according to the encryption offset.

[0021] A method for flexibly configuring the MACsec encryption offset is adopted. Based on the original technology, this method adds a mode in which the encryption offset can be configured according to the register through the reserved field of the key negotiation Confidentiality Offset. This method can flexibly and accurately adjust the encryption offset to meet the encryption scenario requirements of different types of messages. The specific technical solution is as follows: First, add a set of encryption offset register configurations on all devices that need MACsec encryption. The encryption offset range is 0 to 1500 bytes. Before encryption negotiation, the desired encryption offset configuration needs to be completed. Then, during the key negotiation process, if the configurable MACsec encryption offset mode is enabled, the Confidentiality Offset encryption offset parameter is set to 2'b11, otherwise it is set to other corresponding values; Finally, the MACsec encryption device determines the corresponding encryption offset based on the Confidentiality Offset encryption offset parameter extracted from the received key negotiation data, and encrypts the MAC message to be encrypted based on the encryption offset.

[0022] The current MACsec encryption offset can only be one of the three values ​​of 0, 30 or 50. The encryption offset is single and cannot be accurately and flexibly adjusted to meet the encryption scenario requirements of different types of messages. The present invention is a method for flexibly configuring the MACsec encryption offset. The present invention uses the reserved field of the Confidentiality Offset parameter of the key negotiation to add a mode in which the encryption offset can be configured according to a register. In this mode, the encryption offset can be flexibly adjusted through a set of register configurations.

[0023] Compared with the related art, the method for flexibly configuring the macsec encryption offset provided by the present invention has the following beneficial effects: The present invention provides a method for flexibly configuring a macsec encryption offset. Under the original key negotiation mode, an implementation mode for flexibly configuring the encryption offset is extended. The implementation mode is simple, flexible, and resource-saving. The adjustment of the encryption offset is more flexible and accurate. The encryption offset can be set to any value between 0 and 1500 bytes, covering a wider range.

[0024] Second embodiment:

[0025] Please refer to Figure 3 Based on the method for flexibly configuring the macsec encryption offset provided by the first embodiment of the present application, the second embodiment of the present application proposes another method for flexibly configuring the macsec encryption offset. The second embodiment is only a preferred method of the first embodiment, and the implementation of the second embodiment will not affect the independent implementation of the first embodiment.

[0026] Specifically, the second embodiment of the present application provides a method for flexibly configuring the macsec encryption offset, which is different in that it is a method for flexibly configuring the macsec encryption offset, and the encryption negotiation in S1 includes key generation, key exchange, key verification and key usage.

[0027] The key generation includes random number generation, cryptographic algorithms and key derivation functions.

[0028] The random number generation utilizes a high-quality random number generator to generate a random key, which may be based on a hardware random number source or a well-validated software random number algorithm.

[0029] The cryptographic algorithm may generate a key through an internal mechanism of a specific encryption algorithm, such as generating a key pair based on an elliptic curve algorithm.

[0030] The key derivation function can process some input information through KDF to obtain a new key.

[0031] The key verification includes digital signature verification, message authentication code verification, key exchange verification and hash value comparison.

[0032] The digital signature verification can be performed by the sender using his own private key to digitally sign the key, and the receiver uses the sender's public key to verify the signature to confirm that the key is indeed from the sender.

[0033] The message authentication code verification can be performed by calculating the MAC value of the key and the related data, and performing a comparison verification at the receiving end.

[0034] The hash value comparison can be performed by performing a hash calculation on the key, and the receiver compares whether the received hash value is consistent with the expected hash value.

[0035] Random number generation: Use a high-quality random number generator to generate random keys. This can be based on a hardware random number source or a well-validated software random number algorithm.

[0036] Based on cryptographic algorithms: for example, keys are generated through the internal mechanism of a specific encryption algorithm, such as generating key pairs based on elliptic curve algorithms.

[0037] Key derivation function (KDF): Some input information (such as master key, password, salt, etc.) is processed through KDF to obtain a new key.

[0038] Key generation: Each party in communication generates a key. This key can be a symmetric key or a private key in an asymmetric key pair.

[0039] Key exchange: The communicating parties exchange keys with each other in a secure way. The key exchange can be done by directly transmitting the key or by using a key negotiation protocol to generate a shared key.

[0040] Key verification: After receiving the other party's key, the two communicating parties need to verify the key to ensure the authenticity and validity of the key. Key verification can be done by using digital certificates, hash functions, etc.

[0041] Compared with the related art, the method for flexibly configuring the macsec encryption offset provided by the present invention has the following beneficial effects: The present invention provides a method for flexibly configuring the macsec encryption offset. In key negotiation, through the operations of key generation, key exchange, key verification and key use, both communicating parties can generate a key respectively, and the two communicating parties exchange each other's keys in a certain secure manner. After receiving the other party's key, the two communicating parties need to verify the key to ensure the authenticity and validity of the key. Once the key verification is passed, the two communicating parties can use the negotiated key to encrypt and decrypt the communication content.

[0042] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for flexibly configuring macsec encryption offset, characterized in that: The following steps are involved: S1. Before encryption negotiation, configure a custom encryption offset on all devices that require MACsec encryption. S2. During the key negotiation process, the encryption negotiation server selects the corresponding Confidentiality Offset encryption offset parameter value according to the encryption offset mode configuration. If the configurable MACsec encryption offset mode is enabled, the Confidentiality Offset encryption offset parameter is set to 2'b11, otherwise it is set to other corresponding values. After the negotiation is completed, the encryption offset parameter is transmitted to all MACsec encrypted devices through the key negotiation data. S3. The MACsec encryption device parses the corresponding encryption offset according to the ConfidentialityOffset encryption offset parameter extracted from the received key negotiation data; S4. The MACsec encryption device encrypts the MAC message to be encrypted according to the encryption offset.

2. The method for flexibly configuring macsec encryption offset according to claim 1, characterized in that: The encryption negotiation in S1 includes key generation, key exchange, key verification and key usage.

3. The method for flexibly configuring macsec encryption offset according to claim 2, characterized in that: The key generation includes random number generation, cryptographic algorithms and key derivation functions.

4. The method for flexibly configuring macsec encryption offset according to claim 2, characterized in that: The random number generation utilizes a high-quality random number generator to generate a random key, which may be based on a hardware random number source or a well-validated software random number algorithm.

5. The method for flexibly configuring macsec encryption offset according to claim 2, characterized in that: The cryptographic algorithm may generate a key through an internal mechanism of a specific encryption algorithm, such as generating a key pair based on an elliptic curve algorithm.

6. The method for flexibly configuring macsec encryption offset according to claim 2, characterized in that: The key derivation function can process some input information through KDF to obtain a new key.

7. The method for flexibly configuring macsec encryption offset according to claim 2, characterized in that: The key verification includes digital signature verification, message authentication code verification, key exchange verification and hash value comparison.

8. The method for flexibly configuring macsec encryption offset according to claim 7, characterized in that: The digital signature verification can be performed by the sender using his own private key to digitally sign the key, and the receiver uses the sender's public key to verify the signature to confirm that the key is indeed from the sender.

9. The method for flexibly configuring macsec encryption offset according to claim 7, characterized in that: The message authentication code verification can be performed by calculating the MAC value of the key and the related data, and performing a comparison verification at the receiving end.

10. The method for flexibly configuring macsec encryption offset according to claim 7, characterized in that: The hash value comparison can be performed by performing a hash calculation on the key, and the receiver compares whether the received hash value is consistent with the expected hash value.

Images