Multi-hop WAN MACsec Over IP Encapsulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing MACsec technologies are limited in providing secure communication over Wide Area Networks (WANs) as they encrypt all data except for MAC addresses, restricting the ability to offer multiple Ethernet services on a single port and requiring additional encryption methods like IPsec, which adds overhead and costs.
Innovation Solution
Implementing multi-hop WAN MACsec over IP, which encapsulates MACsec frames with transport layer protocols like IP, EoMPLS, or GRE, allowing secure transmission over public networks without the need for additional encryption, enabling multiple site connections and reducing administrative overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MACsec encrypts all data except MAC addresses, then security is improved, but the ability to offer multiple Ethernet services on a single port deteriorates
Solution Approach 1:
The patent segments the Ethernet frame into multiple parts with different encryption treatments. Specifically, it encrypts the payload while leaving the MAC header (including source and destination MAC addresses) unencrypted. This segmentation allows the encrypted payload to provide security while the unencrypted header enables service identification and routing, thus resolving the contradiction between security and service versatility.
2Reliability
If IPsec is used to encrypt IP packets, then security over WAN is improved, but device complexity and overhead increase
Solution Approach 1:
The patent merges MACsec encryption with Ethernet frame structure to provide security at the data link layer, eliminating the need for separate IPsec implementation. By integrating encryption directly into the Ethernet frame format and processing it at the MAC layer, the solution reduces device complexity and overhead compared to using IPsec, while still providing robust security over WAN connections.
3Reliability
If IPsec-based encryption devices are used, then security is improved, but processing speed deteriorates
Solution Approach 1:
The patent replaces the complex IPsec encryption mechanism with MACsec, which is designed for hardware acceleration and line-rate processing. MACsec operates at the data link layer with a simpler encryption architecture that can be implemented in hardware, substituting the more complex IPsec mechanical system and thereby improving processing speed while maintaining security.
Data Source
AI summary
An egress frame processing method, an Ethernet frame is received. Information defining an Internet Protocol (IP) tunnel between the network device and a peer network device over a public wide area network is determined. A media access control security (MACsec) policy that defines how to protect the Ethernet frame is determined based on the information defining the IP tunnel. The Ethernet frame is protected according to the MACsec policy. The following fields are appended to the protected Ethernet frame: (i) an unprotected layer 3 (L3) encapsulation identifying a layer 2 (L2)-over-L3 tunnel protocol; (ii) an unprotected IP header corresponding to the IP tunnel; and (iii) an unprotected outer Ethernet header, to produce a partly protected egress frame. The partly protected egress frame is transmitted to the peer network device over the IP tunnel of the public wide area network.