MACsec Security Tag Layout for Multi-PHY Tunnel Decryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing MACsec protocols face challenges in multi-PHY deployments due to extended packet numbering (XPN) recovery and tunnel scale issues, leading to decryption failures and increased memory footprint in secure tunnel deployments.
Innovation Solution
The solution involves updating MACsec header interpretation by dividing the 8-byte Secure Channel Identifier (SCI) into 4-byte higher-32 PN, 2-byte engine-identifier, and 2-byte short SCI, allowing SecY engines to derive the initialization vector directly from the received packet, and sharing a single security association across multiple receiving channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If extended packet numbering (XPN) is used for MACsec encryption, then packet number space is extended to 64 bits, but decryption failures occur due to inability to recover packet number across multiple PHYs
Solution Approach 1:
The 64-bit packet number is segmented into two parts: the lower 32 bits are stored in the MACsec header, while the upper 32 bits are recovered through a separate mechanism involving the SCI field and packet number synchronization across multiple PHYs. This segmentation allows the system to maintain large packet number space while enabling reliable decryption through distributed recovery.
Solution Approach 2:
The SCI field acts as an intermediary to enable packet number recovery. By incorporating SCI information into the packet number recovery mechanism, the system can reconstruct the full 64-bit packet number across multiple PHYs without requiring direct access to the complete packet number in each PHY, thus enabling reliable decryption.
2Productivity
If multiple PHYs are deployed for secure tunnel, then throughput and scalability are improved, but memory footprint increases due to multiple security associations
Solution Approach 1:
Multiple security associations across different PHYs are merged into a single shared security association. This is achieved by using a common SCI field and packet number synchronization mechanism that allows all PHYs to decrypt packets using the same security context, thereby reducing memory footprint while maintaining high throughput through multi-PHY parallel processing.
Solution Approach 2:
The security association is designed to be universal across multiple PHYs. The same security association can be used by all PHYs in the system, making the system scalable. This multi-functionality allows a single security association to serve multiple purposes across different physical interfaces, reducing the overall memory requirement.
3Adaptability or versatility
If standard MACsec header format is used, then compatibility is maintained, but tunnel scale is limited due to inability to share security associations
Solution Approach 1:
The MACsec header is extended by adding a 2-byte SCI field, transforming it from a fixed-format header to a more flexible structure. This dimensional change allows the header to carry additional identification information that enables security association sharing across multiple PHYs, thereby increasing tunnel scale while maintaining backward compatibility through optional field inclusion.
Data Source
AI summary
In an embodiment, a method includes receiving a data packet and generating an optimized security tag based on a standard security tag by replacing an 8-byte optional secure channel identifier (SCI) of the standard security tag with 32 most significant bits of a 4 packet number, a 2-byte MAC Security Entities (SecY) engine identifier, and a 2-byte short SCI. The method further includes encrypting the data packet and transmitting the encrypted data packet comprising the optimized security tag to an electronic device.