Pausing MKA Sessions for Faster Network Service Resumption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The frequent destruction and reestablishment of Media Access Control Security (MACsec) key agreement (MKA) sessions between network devices due to temporary unavailability, such as rebooting or going offline, leads to wastage of computing and network resources, causing delays in communication and network service resumption.
Innovation Solution
A network device places its MKA state in a paused state when the other device becomes unavailable, allowing the session to be resumed without termination, thereby conserving resources and reducing delays upon the other device's return to availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MKA sessions are destroyed and reestablished upon device unavailability, then security protocols are followed, but computing and network resources are wasted and service resumption is delayed
Solution Approach 1:
The system performs preliminary actions by pausing the MKA state machine and preserving session context before device unavailability occurs. When the device returns, the preserved context allows rapid session resumption without full reestablishment, preventing resource wastage while maintaining security
Solution Approach 2:
The MKA state machine transitions from a static destroy/recreate approach to a dynamic pause/resume capability. The state machine can be suspended and later reactivated with preserved context, adapting the session management behavior based on device availability status
2Reliability
If MKA sessions are destroyed and reestablished upon device unavailability, then security is maintained, but network service resumption time increases
Solution Approach 1:
Session context including security parameters and state information is preserved in advance during the pause state. When the device returns, this pre-preserved context enables immediate session resumption without time-consuming reestablishment procedures
Solution Approach 2:
The MKA session maintains continuity through the pause state rather than being terminated. The session context persists across device unavailability, allowing the useful action of secure communication to resume quickly without interruption to the security framework
3Loss of energy
If MKA sessions are paused and resumed, then resource wastage is reduced, but session state management complexity increases
Solution Approach 1:
The pause/resume functionality is extracted as a distinct operational mode of the existing MKA state machine rather than requiring a separate system. The state machine transitions to a paused state where processing is suspended but context is preserved, adding minimal complexity while achieving resource conservation
4Productivity
If MKA sessions are paused upon device unavailability, then quick resumption is enabled, but session termination security risks may arise
Solution Approach 1:
The system implements feedback mechanisms where the paused MKA state machine monitors for device availability and session validity. Security parameters are verified upon resume attempts, and the state machine only reactivates when security conditions are met, preventing unauthorized session continuation
Data Source
AI summary
A network device may communicate with another network device via a media access control security (MACsec) key agreement (MKA) communication link, wherein an MKA session has been established between the network device and the other network device. The network device may determine that the other network device is unavailable. The network device may cause, based on determining that the other network device is unavailable, an MKA state of the network device to be placed in a paused state. The network device may receive, after causing the MKA state of the network device to be placed in the paused state, a packet from the other network device via the MKA communication link. The network device may determine, based on the packet, that the MKA session has not ended. The network device may continue, based on the MKA session having not ended, the MKA session by reactivating the MKA state.