InsSec Packet Generation for VxLAN Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current MACsec implementations do not effectively secure and ensure data integrity for VxLAN, iVxLAN, and VxLAN-GPE packets across network tunnels, as they do not provide comprehensive encryption and integrity checking that covers all necessary packet components, particularly excluding the MAC address in the integrity checksum.
Innovation Solution
The proposed solution generates InsSec packets by inserting a MACSec header after the UDP/TCP header, updating port numbers, encrypting VxLAN packets using MACSec, and inserting an integrity check value that covers the MACSec header and encrypted payload but not the MAC header, ensuring secure transmission and integrity across network environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MACsec is applied to VxLAN packets using standard encryption, then data confidentiality is improved, but data integrity cannot be ensured because the integrity checksum excludes the MAC address
Solution Approach 1:
The patent segments the VxLAN packet into distinct components (outer MAC header, UDP/TCP header, VxLAN header, payload) and applies MACsec encryption and integrity checking to specific segments. The integrity checksum is calculated over the encrypted payload and MACsec header but deliberately excludes the outer MAC header, creating a segmented protection scheme that ensures integrity while maintaining MAC address visibility for networking purposes.
Solution Approach 2:
The patent applies different security treatments to different parts of the packet. The outer MAC header remains unencrypted and excluded from integrity checking to preserve addressing information, while the inner payload and MACsec header are encrypted and included in integrity checking to ensure confidentiality and integrity. This local differentiation resolves the contradiction between ensuring integrity and maintaining packet functionality.
2Reliability
If integrity checking includes the MAC address, then complete packet integrity is improved, but MAC address visibility for routing and switching is lost
Solution Approach 1:
The integrity checking scope is segmented to include only the encrypted portions of the packet (MACsec header and payload) while excluding the outer MAC header. This segmentation allows the MAC address to remain visible and modifiable for routing and switching operations while ensuring integrity of the protected data portions.
Solution Approach 2:
Different integrity protection rules are applied to different packet regions. The outer MAC header is excluded from integrity checking to maintain routing functionality, while the inner encrypted payload and MACsec header are included to ensure their integrity. This local quality approach resolves the contradiction between complete integrity and operational ease.
3Reliability
If VxLAN packets are encrypted end-to-end, then security across network tunnels is improved, but intermediate nodes cannot perform necessary packet inspection and forwarding
Solution Approach 1:
The MACsec header and encryption are applied in advance at the VxLAN tunnel endpoint before packets enter the encrypted tunnel. This preliminary action allows intermediate nodes to forward packets based on outer headers without needing to decrypt or inspect the encrypted payload, maintaining both security and intermediate node functionality.
Solution Approach 2:
The MACsec header acts as an intermediary layer between the outer VxLAN header and the inner payload. It provides structured encryption with defined fields that allow intermediate nodes to perform necessary forwarding operations while the encrypted payload remains protected. The MACsec structure mediates between security requirements and network routing requirements.
Data Source
AI summary
Techniques are provided herein to achieve data security and integrity using the cryptographic machinery of IEEE MACSec for TCP or UDP packets, for example, VxLAN, iVxLAN, and VxLAN-GPE packet. In particular, the disclosed techniques generate InsSec packets from received VxLAN based packets, in which the generated InsSec packets include an integrity checksum that that does not cover the MAC address of the packet.