Adapter Device Rerouting MACsec Traffic on Link Failure

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network systems face challenges in securely rerouting network traffic when an encrypted communication link, particularly those using the MACsec protocol, goes offline due to configuration issues or attacks.

Innovation Solution

The implementation of an adapter device that communicates with a router device using a different protocol than MACsec, establishing an encrypted connection with a remote adapter device using MACsec, and propagating messages to reroute traffic when the encrypted link becomes offline.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a router device uses MACsec protocol for encrypted communication, then security is improved, but device complexity increases and compatibility decreases

Engineering Contradiction:

ImprovesecurityVSAvoiddevice complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system divides the security functionality into separate adapter devices that can be selectively deployed. The router device itself remains simple while adapter devices handle MACsec encryption/decryption, allowing security to be added without increasing router complexity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Adapter devices act as intermediaries between the router and remote devices. These adapters handle the complex MACsec protocol operations, shielding the router from complexity while maintaining secure communication through the adapter layer.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Speed

If the adapter device propagates offline status to the router device, then traffic rerouting speed is improved, but information loss increases

Engineering Contradiction:

Improvetraffic rerouting speedVSAvoidinformation loss

Core Design Contradiction:

SpeedVSLoss of information

Solution Approach 1:

The adapter device performs preliminary detection of connection status and proactively notifies the router before traffic is affected. This allows the router to pre-compute alternative routes, reducing rerouting delay when failures occur.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The adapter device continuously monitors the encrypted connection status and provides feedback to the router device. This feedback mechanism enables the router to dynamically adjust routing decisions based on real-time connection health information.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS12244642B1Rerouting network traffic based on detecting offline connection

Publication Date: 2025.03.04 JUNIPER NETWORKS INC

AI summary

In some examples, a system includes a router device and a first adapter device in communication with the router device. The first adapter device includes processing circuitry configured to: communicate with the router device, wherein the router device is incapable of communicating in accordance with the MACsec protocol. The processing circuitry is further configured to establish an encrypted connection in accordance with the MACsec protocol between the first adapter device and a remote device, determine that the encrypted connection is offline, and output a message to the router device that the encrypted connection is offline. The router device is configured to communicate with the remote device via a second adapter device configured to communicate in accordance with the MACsec protocol and bypass the first adapter device.