Ethernet Frame Security Encapsulation with Fragmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current communication networks lack effective security measures at the Data Link Layer (layer 2) of the OSI Reference Model, making data vulnerable to interception and modification, as existing security protocols like IPsec primarily operate at the network layer (layer 3) and do not provide comprehensive end-to-end security for Ethernet packets.
Innovation Solution
The technique involves encrypting Ethernet payload data and adding a security encapsulation header with a fragmentation field to support secure data transfer at the Data Link Layer, including features like VLAN tags, MPLS labels, and peer-to-peer encryption, ensuring data origin authentication, integrity, and confidentiality without modifying higher layers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security protocols like IPsec are used at network layer (layer 3), then data authentication and encryption are provided, but they do not provide security at data link layer (layer 2) and do not ensure complete end-to-end security for Ethernet packets
Solution Approach 1:
The patent applies another dimension by introducing security encapsulation at the data link layer (layer 2), complementing the existing network layer (layer 3) security protocols. This creates a multi-layer security architecture where Ethernet frames are encrypted and authenticated at layer 2, while IPsec provides security at layer 3, achieving comprehensive end-to-end security across multiple OSI model dimensions.
2Reliability
If encryption is applied to Ethernet payload, then data confidentiality is improved, but the payload size increases and may exceed maximum Ethernet frame size limits
Solution Approach 1:
The patent applies segmentation by dividing the encrypted Ethernet payload into multiple fragments when the encrypted size exceeds the maximum frame size. The encapsulation header includes a fragmentation field that tracks fragment numbers and offsets, allowing the receiver to reassemble the original payload from the fragmented pieces, thus resolving the size conflict while maintaining encryption.
3Ease of manufacture
If standard Ethernet frames are used without modification, then compatibility with existing network infrastructure is maintained, but security functions such as authentication and integrity protection are not provided at layer 2
Solution Approach 1:
The patent applies the nested doll principle by encapsulating standard Ethernet frames within a new security-oriented frame structure. The original Ethernet frame (header and payload) is nested inside the encapsulated frame, with the encapsulation header containing security parameters. This allows standard Ethernet compatibility while adding layer 2 security functions through the outer encapsulation layer.
4Reliability
If hop-by-hop security is used as in IEEE 802.1AE MACsec, then local area network security is improved, but complete end-to-end security is not achieved
Solution Approach 1:
The patent applies universality by designing a security encapsulation mechanism that can operate at the data link layer universally across different network segments and transmission media. The encapsulated frames can traverse multiple network layers and hops while maintaining security, unlike IEEE 802.1AE which is limited to hop-by-hop protection. The security scope is extended to cover the entire end-to-end communication path.
Data Source
AI summary
A technique for encapsulating data packets at a Data Link Layer to provide security functions. The technique first encrypts a payload to provide an encrypted payload. The encrypted payload is inserted in an output encapsulated frame. Also added to the output encapsulated frame is an encapsulation header that includes security information, such as a security packet index (SPI) value used to identify a security association (SA). Because the output encapsulated frame may now be longer than maximum allowed Ethernet Path Maximum Transmission Unit (PMTU), the encapsulation header also preferably includes a fragmentation field. The fragmentation field supports the ability to fragment the encrypted datagrams into smaller pieces.