MACsec Fast Heartbeat Protocol for Peer Liveness Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current MACsec protocols experience delays in network convergence and communication failures due to prolonged delays in detecting peer disconnection, leading to packet loss and traffic blackholing, especially in large-scale networks, where standard peer liveness messages result in unnecessary resource usage and decreased responsiveness.
Innovation Solution
Implementing a fast heartbeat protocol between packet processing engines at a lower stack level, allowing for faster liveness message exchange (every 0.5 seconds) and suspending MKA packet data transmission and timeout timers when the MKA protocol is in a pause state, thereby conserving computing and network resources and enhancing scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard peer liveness messages are used for monitoring MACsec session, then network coverage is maintained, but detection delay increases and responsiveness decreases
Solution Approach 1:
The patent segments the liveness detection function into two layers: a fast heartbeat mechanism at the packet processing engine level for rapid detection, and the standard MKA protocol at the daemon level for comprehensive session management. This segmentation allows simultaneous achievement of fast detection and reliable monitoring.
Solution Approach 2:
The fast heartbeat message acts as an intermediary mechanism between packet processing engines, providing rapid liveness detection without requiring full MKA protocol engagement. This intermediary layer resolves the contradiction by offering quick feedback while the standard protocol maintains overall session reliability.
2Speed
If fast heartbeat messages are exchanged continuously, then peer liveness detection speed increases, but computing and network resources are consumed
Solution Approach 1:
The fast heartbeat mechanism uses periodic message exchange at optimized intervals (e.g., every 0.5 seconds) rather than continuous transmission. This periodic action maintains fast detection capability while significantly reducing computing and network resource consumption compared to continuous monitoring.
Solution Approach 2:
The system dynamically adjusts the operational state of the fast heartbeat mechanism based on session state. The MKA protocol can pause non-critical packet data transmission while maintaining fast heartbeat monitoring, allowing resource usage to adapt to current network conditions and priorities.
3Reliability
If MKA protocol remains active continuously, then session management is maintained, but resource consumption increases and scalability decreases
Solution Approach 1:
The patent segments session management functions between the fast heartbeat mechanism (handling liveness detection) and the MKA protocol (handling key management and session state). This segmentation allows the MKA protocol to be paused during stable periods, reducing resource consumption while maintaining essential session management capabilities through the fast heartbeat layer.
Solution Approach 2:
The patent extracts the liveness detection function from the MKA protocol into a separate fast heartbeat mechanism. This extraction allows the MKA protocol to suspend non-essential operations during stable sessions, reducing resource consumption while the extracted fast heartbeat mechanism continues to provide reliable session monitoring.
4Reliability
If timeout timers are suspended during pause state, then false disconnection detection is prevented, but actual disconnection detection may be delayed
Solution Approach 1:
The fast heartbeat message serves as an intermediary monitoring mechanism that remains active even when MKA timeout timers are suspended. This intermediary layer provides continuous disconnection detection without triggering false positives, resolving the contradiction by offering a more sensitive detection mechanism that doesn't rely on the slower MKA protocol timing.
Data Source
AI summary
A network device may establish a media access control security (MACsec) key agreement (MKA) session with another network device via a MACsec communication link; establish a fast heartbeat session via the MACsec communication link, between a first packet processing engine of the network device and a second packet processing engine of the other network device, where the fast heartbeat session is to permit the first packet processing engine and the second packet processing engine to exchange fast heartbeat messages via the fast heartbeat session and the MACsec communication link; place an MKA protocol of the MKA session in a pause state until the first packet processing engine detects a rekey event; determine that a key for the MKA session is to be regenerated based on detection of the rekey event; and perform an action based on the rekey event for the MKA session.