Network Device Inactive Encryption Key Detection and Removal

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current techniques for achieving hitless key rollover in MACsec networks consume excessive computing and networking resources due to the need to store previous encryption keys, leading to resource depletion and potential traffic loss.

Innovation Solution

Implement a method where a network device installs a new receive encryption key, starts a timer for deleting the old key, and determines whether the new key has successfully decrypted packets before deleting the old key, thereby optimizing resource usage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If previous encryption keys are stored in the network device to enable hitless key rollover, then key rollover reliability is improved, but computing and networking resources are depleted

Engineering Contradiction:

Improvekey rollover reliabilityVSAvoidcomputing resources

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system performs preliminary actions by installing the new receive key before deleting the old key, and by pre-establishing the timer mechanism to track key usage. This ensures continuous operation during the transition without requiring both old and new keys to coexist indefinitely, thus reducing resource consumption while maintaining reliability.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces dynamic key management where the retention of old keys is not fixed but determined by timer expiration and packet count changes. The system dynamically adjusts key retention based on actual usage patterns, allowing automatic cleanup of inactive keys to conserve resources while maintaining reliability during active transitions.

Inventive Principle:

Principle #15Dynamics

2Reliability

If previous encryption keys are stored in the network device to enable hitless key rollover, then key rollover reliability is improved, but networking resources are depleted

Engineering Contradiction:

Improvekey rollover reliabilityVSAvoidnetworking resources

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements automatic discarding of old keys after the timer expires and packet counts indicate inactivity. The system recovers resources by freeing up networking resources associated with inactive keys, allowing the same resources to be reused for new key pairs, thus reducing overall resource depletion.

Inventive Principle:

Principle #34Discarding and recovering

3Quantity of substance

If a timer is started to delete the old key after confirming new key activity, then resource conservation is improved, but key deletion timing complexity increases

Engineering Contradiction:

Improveresource conservationVSAvoidkey deletion timing complexity

Core Design Contradiction:

Quantity of substanceVSDevice complexity

Solution Approach 1:

The system uses feedback mechanisms where packet counts for the old key are continuously monitored and compared against thresholds. This feedback loop automatically triggers timer expiration and key deletion when inactivity is confirmed, simplifying the complexity through automated decision-making based on real-time usage data rather than complex manual timing logic.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The key deletion process is made self-service through automated timer management and packet count monitoring. The system automatically determines when to delete old keys based on predefined conditions (timer expiration + packet count changes), eliminating the need for complex external control logic and reducing operational complexity.

Inventive Principle:

Principle #25Self-service

4Measurement precision

If packet counts are monitored to determine key activity status, then accurate key deletion timing is improved, but processing overhead increases

Engineering Contradiction:

Improvekey activity detection accuracyVSAvoidprocessing overhead

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The system applies partial action by monitoring only the packet count changes of the old key rather than continuously analyzing all network traffic. This selective monitoring provides sufficient accuracy to determine key activity status without the excessive processing overhead of comprehensive traffic analysis, achieving the right balance between precision and efficiency.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent maintains continuity of useful action by continuously tracking packet counts for the old key throughout the timer period. This continuous monitoring ensures accurate detection of key activity status without requiring repeated discrete measurements, smoothing out processing requirements over time and reducing peak processing overhead.

Inventive Principle:

Principle #20Continuity of useful action

Data Source

PatentUS12323519B1Detecting and removing inactive encryption keys during encryption key rollover events

Publication Date: 2025.06.03 JUNIPER NETWORKS INC

AI summary

A network device may install a new receive encryption key, and may start a timer associated with deleting an old receive encryption key. The network device may provide, to another network device, a message identifying the new receive encryption key, and may determine whether packet counts, successfully decrypted with the old receive encryption key, have changed. The first network device may determine whether the timer has expired, and may determine whether the new receive encryption key has successfully decrypted a packet. The first network device may delete the old receive encryption key from the first network device based on the new receive encryption key successfully decrypting a packet.