MACsec Security Tag Layout for Multi-PHY Secure Tunnel Scaling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing MACsec protocols face challenges in multi-PHY deployments due to extended packet numbering (XPN) recovery and tunnel scale issues, leading to decryption failures and increased memory footprint in secure tunnel deployments.
Innovation Solution
The solution involves modifying the MACsec header by replacing the 8-byte optional secure channel identifier (SCI) with 32 most significant bits of the packet number, a 2-byte MAC Security Entities (SecY) engine identifier, and a 2-byte short SCI, allowing for secure tunnel deployments without increasing the MACsec header size and enabling correct initialization vector derivation directly from the received packet, while sharing a single security association across multiple receiving channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If the 8-byte optional SCI is replaced with 32 most significant bits of packet number, 2-byte SecY engine identifier, and 2-byte short SCI, then the MACsec header size is maintained without increase, but the complexity of packet number recovery and synchronization increases
Solution Approach 1:
The 8-byte SCI field is segmented into multiple components: 32 most significant bits of packet number, 2-byte SecY engine identifier, and 2-byte short SCI. This segmentation allows the header to maintain the same size while distributing the information needed for packet number recovery across multiple fields, reducing the complexity of any single field.
Solution Approach 2:
The patent transitions from a single 8-byte SCI field to a multi-component structure that utilizes different dimensional aspects of data representation. By incorporating the 32 most significant bits of packet number into the security tag, the system adds a dimensional aspect to packet identification that enables correct IV derivation without increasing header size.
2Quantity of substance
If packet number synchronization is eliminated, then memory footprint is reduced, but the reliability of decryption may be compromised
Solution Approach 1:
The receiving device derives the initialization vector directly from the received packet's security tag containing the 32 most significant bits of packet number. This self-service approach eliminates the need for external packet number synchronization mechanisms, reducing memory requirements while maintaining decryption reliability through self-contained IV derivation.
Solution Approach 2:
The system changes the parameter used for IV derivation from synchronized packet numbers requiring memory resources to the 32 most significant bits of packet number embedded in the security tag. This parameter change enables correct IV derivation without packet number synchronization, reducing memory footprint while preserving decryption reliability.
3Adaptability or versatility
If multiple ports host independent SecY engines, then tunnel scale is improved, but the complexity of managing security associations increases
Solution Approach 1:
Multiple ports with independent SecY engines can share a common security association by utilizing the 32 most significant bits of packet number and 2-byte short SCI from the security tag. This universal approach allows different ports to function independently while managing security associations more efficiently, improving tunnel scale without proportionally increasing management complexity.
Solution Approach 2:
The patent enables multiple receiving ports to share security associations by copying the relevant identification information (32 most significant bits of packet number, 2-byte short SCI) from the security tag. This copying mechanism allows independent SecY engines to operate with a shared security association framework, reducing the need for duplicate associations across multiple ports.
Data Source
AI summary
In an embodiment, a method includes receiving a data packet and generating an optimized security tag based on a standard security tag by replacing an 8-byte optional secure channel identifier (SCI) of the standard security tag with 32 most significant bits of a 4 packet number, a 2-byte MAC Security Entities (SecY) engine identifier, and a 2-byte short SCI. The method further includes encrypting the data packet and transmitting the encrypted data packet comprising the optimized security tag to an electronic device.