MACsec Pre-Shared Key Auto-Refresh for Quantum-Resistant Sessions

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Quantum attacks on TLS-based public-key cryptography compromise the security of MACsec traffic by potentially exposing the MKA CAK and other keys, putting the integrity of MACsec sessions at risk.

Innovation Solution

Implement post-quantum pre-shared key (PPK) identifiers to derive control association keys (CAK) and secure association keys (SAK) within MACsec sessions, using a quantum key distribution (QKD) service to generate and distribute PPKs independently to communicating entities, ensuring quantum-resistant security without exposing the actual PPK over the wire.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If TLS-based public-key cryptography is used for key agreement, then mutual authentication and key derivation are achieved, but quantum attacks may compromise the security of MACsec traffic

Engineering Contradiction:

Improvesecurity of MACsec trafficVSAvoidquantum attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent changes the cryptographic parameter from classical public-key cryptography to post-quantum cryptography algorithms. Specifically, it transitions from TLS-based EAP-TLS authentication to PPK-based authentication using post-quantum algorithms, thereby maintaining security reliability while resisting quantum attack threats

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent substitutes the mechanical/crypto system of TLS public-key cryptography with a post-quantum cryptographic system. By replacing the EAP-TLS authentication mechanism with PPK-based authentication using post-quantum algorithms, the system achieves quantum-resistant security while maintaining the same functional purpose of mutual authentication and key derivation

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If pre-shared keys are manually configured for MACsec sessions, then security associations are established, but administrative workload increases and manual intervention is required

Engineering Contradiction:

ImproveMACsec session securityVSAvoidadministrative workload

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent implements self-service by enabling MACsec sessions to automatically establish security associations through PPK-based authentication. The system autonomously performs key derivation and session establishment without requiring manual configuration or administrative intervention, thereby reducing operational workload while maintaining security

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent applies preliminary action by pre-distributing post-quantum pre-shared keys to authorized entities before MACsec session establishment. This preliminary key distribution enables automatic authentication and session setup, eliminating the need for manual key configuration while ensuring secure session establishment

Inventive Principle:

Principle #10Preliminary action

3Ease of operation

If actual pre-shared keys are transmitted over the network, then key distribution is achieved, but security is compromised during transmission

Engineering Contradiction:

Improvekey distributionVSAvoidkey exposure risk

Core Design Contradiction:

Ease of operationVSObject-generated harmful factors

Solution Approach 1:

The patent extracts the actual pre-shared key material from the transmission process by using post-quantum pre-shared key identifiers instead of transmitting the keys themselves. Only the identifiers are exchanged over the network, while the actual key material remains securely stored locally at each entity, eliminating key exposure risk during transmission

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces post-quantum pre-shared key identifiers as an intermediary between key distribution and key usage. These identifiers serve as safe proxies that can be transmitted over the network without exposing the actual key material, enabling secure key distribution while maintaining key confidentiality

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20260081767A1Post-quantum secure media access control security (macsec) pre-shared key auto-refresh

Publication Date: 2026.03.19 CISCO TECHNOLOGY INC

AI summary

Techniques for utilizing post-quantum pre-shared key (PPK) identifiers (PPK_ID) to determine control association key(s) (CAK(s)) and/or secure association key(s) (SAK(s)) utilized in MACsec sessions are described herein. A key server (KS) and a non-key server (NKS) may advertise capabilities indicating an ability to utilize PPKs as CAKs and/or SAKs in MACsec sessions. The KS may leverage a quantum key distribution (QKD) service to determine a PPK_ID and a PPK, which may be utilized as a CAK for a MACsec session with the NKS. The PPK_ID may be transmitted to the NKS, where the NKS may retrieve the PPK from the QKD, and a new group connectivity association may be established using the PPK as the CAK. In some examples, the KS may be configured to refresh the PPK as the CAK for instantiating subsequent MACsec sessions. Additionally, the KS may be configured to distribute a SAK in a similar manner.