Hitless MACsec Key Rollover via Data Plane Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current MACsec key rollover methods can result in traffic loss due to processing delays, as network devices may not finish installing new security keys before receiving encrypted traffic, leading to decryption failures and resource consumption for retransmitting packets.
Innovation Solution
Implementing a system where network devices send messages only after the installation of new security keys is complete, using data plane feedback to notify control planes, ensuring that key agreement control messages are sent only after keys are fully installed on protocol hardware, thereby facilitating hitless security key rollover without packet loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If network devices send key agreement control messages before new security keys are fully installed on protocol hardware, then key rollover process is faster, but traffic loss occurs due to decryption failures
Solution Approach 1:
The patent implements a feedback mechanism where the control plane receives notifications from the data plane about key installation status. The control plane waits for confirmation that the new receiving key is successfully installed in the data plane before sending the key agreement control message. This feedback loop ensures timing synchronization and prevents premature message transmission that would cause decryption failures.
Solution Approach 2:
The patent performs preliminary key installation in the data plane before initiating the key agreement message exchange. By pre-installing the new receiving key and confirming its successful installation, the system ensures that decryption capability is ready before encrypted traffic arrives, preventing traffic loss during the transition.
2Reliability
If network devices wait for key installation completion before sending control messages, then traffic loss is eliminated, but processing time increases
Solution Approach 1:
The notification mechanism from data plane to control plane provides real-time feedback on key installation status, enabling the system to proceed immediately upon completion rather than waiting for predetermined time intervals or attempting retries. This minimizes unnecessary delays while ensuring reliability.
3Device complexity
If network devices use traditional key rollover methods, then implementation is simpler, but resource consumption increases due to packet retransmission
Solution Approach 1:
By implementing feedback-based timing control, the system eliminates decryption failures and subsequent packet retransmissions. Although the key management process becomes slightly more complex with notification handling, this prevents the much higher resource consumption associated with retransmitting lost packets, achieving net resource savings.
Data Source
AI summary
A first network device may install a receiving key for decrypting traffic on protocol hardware associated with a data plane of the first network device. The first network device may receive, from the data plane, a first notification indicating that the receiving key is installed on the protocol hardware and may provide, to a second network device, a first message identifying the receiving key. The first network device may receive, from the second network device, an acknowledgment message indicating that the receiving key is installed on the second network device and may install a transmission key for encrypting traffic on the protocol hardware. The first network device may receive, from the data plane, a second notification indicating that the transmission key is installed on the protocol hardware and may provide, to the second network device, a second message identifying the transmission key.