MACSec Channel for Autonomic Control Plane Packet Transmission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing self-organizing networks face challenges in setting up an autonomic control plane (ACP) with Internet Protocol Security (IPSec) channels using IPv4, as IPv4 link-local addresses are not routable, hindering secure tunnel establishment and compatibility with existing IPv4 networks.
Innovation Solution
The implementation of a packet transmission method using Media Access Control Security (MACSec) channels, where identification information is carried in the frame header of MACSec frames to distinguish ACP packets, eliminating the need for routable interface addresses and link-local addresses, and providing a security mechanism without using Layer 3 tunnels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If IPv4 link-local address is used to set up IPSec channel, then compatibility with existing IPv4 network is improved, but secure tunnel establishment fails because IPv4 link-local address is not routable
Solution Approach 1:
The patent introduces a layer 2 tunnel as an intermediary mechanism to enable routable communication for ACP packets. Instead of relying on unroutable IPv4 link-local addresses, the tunnel encapsulates ACP packets and transports them through routable network paths, thereby resolving the contradiction between using IPv4 link-local addresses for compatibility and establishing secure tunnels for reliability
Solution Approach 2:
The patent transitions from layer 3 (network layer) address-based routing to layer 2 (data link layer) tunnel-based routing. By moving the routing function to layer 2 through tunnel endpoints, the system enables ACP packet delivery without relying on routable IPv4 addresses, thus resolving the contradiction between IPv4 link-local address compatibility and secure tunnel establishment
2Reliability
If IPv6 link-local address is used for ACP setup, then secure tunnel can be established, but compatibility with existing IPv4 network deteriorates
Solution Approach 1:
The layer 2 tunnel acts as an intermediary that allows ACP packets to be transported over IPv4 networks without requiring IPv6 infrastructure. The tunnel encapsulation mechanism enables secure tunnel establishment while maintaining compatibility with existing IPv4 networks by translating the routing requirements to layer 2
3Device complexity
If MACSec channel is used instead of IPSec, then configuration complexity is reduced and routable addresses are not required, but security mechanism changes from layer 3 to layer 2
Solution Approach 1:
The patent extracts the security function from the layer 3 IPSec protocol and implements it at layer 2 using MACSec. This extraction simplifies configuration by eliminating the need for complex IPSec key management and routing setup, while the MACSec protocol provides equivalent security functionality at the data link layer
Solution Approach 2:
The MACSec channel provides automatic key management and security association establishment between tunnel endpoints, eliminating the need for manual configuration of security parameters. This self-service capability reduces configuration complexity while maintaining security
Data Source
AI summary
A method includes: setting up, by a first network device, a MACSec channel to a second network device according to the MACSec protocol; and sending, by the first network device, an ACP packet to the second network device by using the MACSec channel, where the ACP packet is carried in a MACSec frame, and a frame header of the MACSec frame carries identification information used to identify the ACP packet. By means of the packet transmission method, MACSec channel is set up between adjacent nodes in a self-organizing network according to the MACSec protocol, and an ACP packet is transmitted between the adjacent nodes by using the MACSec channel and processed.