MKA Key Distribution Over IP/UDP for Low-Latency MPLS Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication networks face challenges in providing efficient encryption and authentication for Multiprotocol Label Switching (MPLS) and Internet Protocol (IP) protocols, as current methods like IPSec and MACSec consume significant CPU resources and introduce high latency, making them unsuitable for low-latency applications.
Innovation Solution
Implementing IEEE 802.1AE standard for encryption and authentication, leaving MPLS and IP headers unencrypted and unauthenticated to allow network devices to operate on these headers dynamically, while using AES-GCM for secure packet transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IPSec or MACSec is used for encryption and authentication of MPLS and IP protocols, then security is improved, but CPU resource consumption increases and latency is introduced
Solution Approach 1:
The patent segments the packet into different parts: the MPLS/IP headers remain unencrypted and unauthenticated while only the payload is encrypted and authenticated. This segmentation allows network devices to process headers without intensive cryptographic operations, reducing CPU usage and latency, while still providing security for the payload data.
Solution Approach 2:
Different parts of the packet receive different treatments: headers are left in clear text for efficient routing and processing, while the payload receives full encryption and authentication. This local differentiation optimizes both performance (for headers) and security (for payload), resolving the contradiction between security and latency.
2Reliability
If full packet encryption is applied to ensure security, then security is improved, but processing speed decreases due to CPU resource consumption
Solution Approach 1:
The encryption and authentication operations are applied only to the payload portion of the packet, not the entire packet including headers. This segmentation reduces the amount of data requiring cryptographic processing, thereby improving processing speed while maintaining security for the actual data content.
Solution Approach 2:
Instead of applying encryption to the entire packet (excessive action), the patent applies encryption only to the necessary payload portion (partial action). This partial application of encryption maintains security where needed while avoiding the performance penalty of encrypting unnecessary header data.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Technique for distributing encryption keys for Layer 2.5/3 transport using MKA (MACsec (Media Access Control Security) Key Agreement). A transmitting (TX) node generates an MKA packet having a Layer 2 header, an IP header, a UDP header, an IEEE 802.1x header, and an MKA payload containing the encryption key for encrypting a packet flow transmitted from the TX node to a receiving (RX) node. The IEEE 802.1x header includes a Security Channel Identification (SCI) that uniquely identifies the packet flow and the encrypting TX node. The TX node transmits the MKA packet to the RX node via a Layer 3 transport. The RX node receives the MKA packet and obtains the encryption key from the MKA packet. The TX node uses the encryption key to encrypt Layer 2.5/3 transport to the RX node, which uses the encryption key to decrypt the encrypted Layer 2.5/3 transport received from the TX node.