Switch Key Negotiation for Data Link Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing wired local area networks lack effective security measures for data secrecy, leading to potential safety hazards as attackers can capture all data packets, and existing security enhancements like IEEE 802.1AE increase calculation load and delay network transmission.
Innovation Solution
A method and system for establishing a security connection between switch equipment by calculating a shared switch key, reducing the need for decryption and re-encryption of data packets, and improving network efficiency by using a switch key negotiation process that includes switch key activation, request, and response packets to verify and establish a consistent switch key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IEEE 802.1AE security enhancement is applied to protect Ethernet data, then data link layer security is improved, but calculation load on switch equipment increases and network transmission delay increases
Solution Approach 1:
The patent segments the security mechanism into two parts: pre-established shared keys between adjacent switches, and end-to-end encryption keys derived from these shared keys. This allows security to be maintained while reducing per-packet processing complexity, as switches use pre-computed keys rather than performing full encryption/decryption operations on each packet.
Solution Approach 2:
The patent implements preliminary key establishment between adjacent switches before actual data transmission. The switch key negotiation and establishment process occurs in advance, allowing switches to have pre-computed encryption keys ready, thereby avoiding real-time calculation overhead during packet forwarding and reducing transmission delay.
2Reliability
If IEEE 802.1AE hop-by-hop encryption is used, then data confidentiality is improved, but network transmission efficiency deteriorates due to increased processing overhead
Solution Approach 1:
The patent divides the encryption key management into hierarchical levels: local shared keys between adjacent switches, and derived end-to-end keys for multi-hop transmissions. This segmentation allows intermediate switches to forward packets using pre-computed keys without performing full decryption and re-encryption, thereby maintaining confidentiality while improving transmission efficiency.
Solution Approach 2:
The patent changes the encryption parameter approach by using derived keys instead of requiring full IEEE 802.1AE encryption processing at each hop. The switch key negotiation protocol establishes parameters that enable efficient encryption/decryption operations, reducing processing overhead while maintaining security.
3Reliability
If switch key negotiation protocol is implemented, then security connection establishment between switches is improved, but communication protocol complexity increases
Solution Approach 1:
The switch key negotiation protocol performs all necessary key establishment, verification, and synchronization operations in advance during a dedicated negotiation phase. This preliminary action ensures that when actual data transmission occurs, switches can use the pre-established keys without complex real-time negotiation, thereby reducing protocol complexity during operation while maintaining security.
Solution Approach 2:
The negotiation protocol incorporates feedback mechanisms where switches exchange verification information (such as MIC values) to confirm key establishment success. This feedback ensures security reliability by verifying that both switches have correctly derived the same keys, while the structured feedback process keeps the protocol manageable through clear confirmation steps.
Data Source
Figure 1~2
Figure 3
AI summary
A method and a system for establishing a security connection between switch equipments are disclosed in the present invention. The system includes the first switch equipment and the second switch equipment; the first switch equipment sends the switch key negotiation activation packet and the switch key negotiation response packet to the second switch equipment; the second switch equipment sends the switch key negotiation request packet to the first switch equipment. The embodiments of the present invention provide a security policy for data security transmission between switch equipments by establishing shared switch key between each two switch equipments, thus guaranteeing the confidentiality of the data transmission process between switch equipments in the data link layer. The calculation burden of switch equipment and the delay of the data packets transmitted from the transmission end to the reception end can be reduced and the efficiency of network transmission can be improved.