PBB MACsec Key Exchange Frame Rewriting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Provider Backbone Bridges (PBBs) often block or consume MACsec key exchange frames due to default behaviors when encountering well-known MAC-addresses and Ether-types, leading to unsuccessful key establishment between MACsec endpoints over public Ethernet networks.
Innovation Solution
Implementing a mechanism for PBB devices to rewrite the MAC-address and Ether-Type fields of MACsec key exchange frames to 'standard-but-unknown' values, allowing these frames to be transparently forwarded through the network, thereby avoiding default blocking behaviors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If PBB devices use default blocking behaviors for well-known MAC-addresses and Ether-types, then network security is improved, but MACsec key exchange frames are blocked leading to failed key establishment
Solution Approach 1:
The patent changes the MAC-address and Ether-Type parameters of MACsec key exchange frames from well-known values to standard-but-unknown values. This parameter transformation allows the frames to bypass PBB blocking mechanisms that target specific well-known addresses and types, while still maintaining proper frame structure and deliverability to the intended destination.
Solution Approach 2:
The patent introduces an intermediary rewriting mechanism at PBB devices that modifies the MAC-address and Ether-Type fields of passing frames. This intermediary function allows MACsec key exchange frames to be transparently forwarded through the PBB network by converting them to a form that doesn't trigger blocking rules, while the original destination information is preserved for final delivery.
2Reliability
If PBB devices forward all frames transparently, then MACsec key exchange succeeds, but network security control is reduced
Solution Approach 1:
The patent applies different handling rules to different types of frames at PBB devices. MACsec key exchange frames are identified and subjected to specific rewriting operations, while other frames continue to be processed according to standard PBB forwarding rules. This localized quality change ensures security control is maintained for specific protocols while enabling key exchange functionality.
3Adaptability or versatility
If MACsec frames use well-known MAC-addresses and Ether-types, then protocol compatibility is improved, but PBB devices block or consume the frames
Solution Approach 1:
The patent performs preliminary rewriting of the MAC-address and Ether-Type fields before frames are blocked by PBB devices. By proactively transforming these fields to standard-but-unknown values, the frames are prepared in advance to avoid blocking, ensuring they can traverse the PBB network and reach their destination successfully.
Data Source
AI summary
The present disclosure is directed to systems and methods for transparent Provider Backbone Bridge forwarding of MACsec key exchanges over public Ethernet provider backbones. The method includes the steps of receiving, at a first PBB device, an Ethernet frame from a first edge router for transmission to a second edge router via a MACsec connection, the Ethernet frame comprising a plurality of fields; performing a lookup of one or more fields of the plurality of fields to determine a match with one or more pre-defined values; determining that the one or more fields of the Ethernet frame match the one or more pre-defined values; rewriting the one or more fields of the Ethernet frame to one or more open values operable to allow the Ethernet frame to be transmitted to a next hop device; and transmitting the Ethernet frame to the next hop device.