Layer 2 Packet Security for Low-Latency MPLS and IP Forwarding

Solution Overview

Problem

Existing communication protocols face inefficiencies in providing security, particularly in Layer 2.5 and Layer 3 protocols like MPLS and IP, due to high resource consumption and latency issues with current encryption methods such as IPSec and MACSec, which are not suitable for low-latency applications.

Innovation Solution

Implementing IEEE 802.1AE protocol for encryption and authentication, leaving specific portions of the packet unencrypted and unauthenticated to allow devices to operate on the Layer 2.5 and Layer 3 headers, reducing resource usage and latency by encrypting only the necessary parts of the packet.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If full packet encryption is applied using IPSec or MACSec, then security is improved, but resource consumption and latency increase significantly

Engineering Contradiction:

ImprovesecurityVSAvoidCPU resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The packet is divided into two portions: a first portion containing data to be secured, and a second portion containing headers that remain unencrypted. The encryption protocol selectively encrypts only the first portion while leaving the second portion in clear text, thereby reducing computational overhead while maintaining security for the sensitive data payload.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different security treatments are applied to different portions of the packet. The first portion receives full encryption and authentication protection, while the second portion (headers requiring device operation) remains unencrypted. This localized security approach optimizes the balance between security and performance by applying cryptographic operations only where necessary.

Inventive Principle:

Principle #3Local quality

2Reliability

If full packet encryption is applied using IPSec or MACSec, then security is improved, but communication latency increases

Engineering Contradiction:

ImprovesecurityVSAvoidcommunication latency

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The packet is divided into two portions: a first portion containing data to be secured, and a second portion containing headers that remain unencrypted. The encryption protocol selectively encrypts only the first portion while leaving the second portion in clear text, thereby reducing computational overhead while maintaining security for the sensitive data payload.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different security treatments are applied to different portions of the packet. The first portion receives full encryption and authentication protection, while the second portion (headers requiring device operation) remains unencrypted. This localized security approach optimizes the balance between security and performance by applying cryptographic operations only where necessary.

Inventive Principle:

Principle #3Local quality

3Reliability

If headers are encrypted for security, then confidentiality is improved, but device ability to operate on headers is lost

Engineering Contradiction:

ImproveconfidentialityVSAvoiddevice operation on headers

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The packet is divided into two portions: a first portion containing data to be secured, and a second portion containing headers that remain unencrypted. The encryption protocol selectively encrypts only the first portion while leaving the second portion in clear text, thereby reducing computational overhead while maintaining security for the sensitive data payload.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different security treatments are applied to different portions of the packet. The first portion receives full encryption and authentication protection, while the second portion (headers requiring device operation) remains unencrypted. This localized security approach optimizes the balance between security and performance by applying cryptographic operations only where necessary.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS12537765B2Security for communication protocols

Publication Date: 2026.01.27 NOKIA SOLUTIONS & NETWORKS OY

AI summary

Various example embodiments for supporting security for communications may be configured to support security for communications of communication protocols at various communication layers. For example, various example embodiments for supporting security for communications may be configured to support security for communications of communication protocols operating above Layer 2 using a Layer 2 network security protocol. For example, various example embodiments for supporting security for communications may be configured to support security for communications of communication protocols operating at Layer 2.5 (e.g., Multiprotocol Label Switching (MPLS) protocols or other Layer 2.5 protocols) using a Layer 2 network security protocol. For example, various example embodiments for supporting security for communications may be configured to support security for communications of communication protocols operating at Layer 3 (e.g., Internet Protocol (IP), such as IP version 4 (IPv4) or IP version 6 (IPv6), or other Layer 3 protocols) using a Layer 2 network security protocol.