Media access control (MAC) security with association number flexibility
Embodiments allow a network device whose hardware limits an Association Number (AN) to only {0, 1}, to be part of Media Access Control security (MACsec). Upon detecting a network device as being AN-limited, that device's priority value is assigned a maximum value, thereby ensuring election of the AN-limited device as the key server. The {0, 1} AN of the key server is used to generate a Secure Association Key (SAK) used for MACsec. Upon subsequent rekeying, the AN-limited key server automatically cycles to a next AN (either 0 or 1) to generate a new SAK, where that next AN is also recognized by other network devices. In this manner, the AN-limited network device can participate in the MACsec without encountering ANs (e.g., {2, 3}) that it does not recognize.
1. A method performed by a peer device in a Media Access Control Security (MACsec) group, the method comprising:
detecting that the peer device only supports a two-valued association number (AN) with which to identify secure association keys (SAKs), the two-valued AN being either a first value or a second value;
in response to detecting that the peer device only supports the two-valued AN, setting a key server priority of the peer device to a highest priority;
participating in a key server election with other peer devices in the MACsec group; and
while acting as a key server of the MACsec group:
generating a sequence of SAKs, wherein each generated SAK is identified by the two-valued AN, wherein a newly generated SAK in the sequence of SAKs is identified by the two-valued AN being set to the second value when a SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to the first value, and wherein the newly generated SAK is identified by the two-valued AN being set to the first value when the SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to the second value; and
distributing each generated SAK and the two-valued AN that identifies the generated SAK to the other peer devices in the MACsec group.
2. The method of claim 1 , wherein each SAK in the sequence of SAKs is generated and distributed in response to occurrence of a rekey event.
3. The method of claim 1 , wherein the peer device, acting as the key server:
generates a first SAK;
distributes both the first SAK and the two-valued AN being set to the first value to the other peer devices in the MACsec group;
generates a second SAK at a time subsequent to distributing the first SAK;
distributes both the second SAK and the two-valued AN being set to the second value, to the other peer devices in the MACsec group;
generates a third SAK at a time subsequent to distributing the second SAK; and
distributes both the third SAK and the two-valued AN being set to the first value, to the other peer devices in the MACsec group.
4. The method of claim 3 , wherein the second SAK is generated in response to occurrence of a first rekey event, wherein the third SAK is generated in response to occurrence of a second rekey event.
5. The method of claim 1 , wherein the first value is ‘0’ and the second value is ‘1’.
6. The method of claim 1 , wherein the peer device is elected as the key server based upon the key server priority.
7. The method of claim 6 , wherein election of the peer device as the key server is further based upon a Secure Channel Identifier (SCI).
8. A network device comprising:
one or more hardware processors; and
a computer-readable storage medium comprising instructions for controlling the one or more hardware processors to:
detect that the network device only supports a two-valued association number (AN) of ‘0’ or ‘1’ with which to identify secure association keys (SAKs);
in response to detecting that the network device only supports the two-valued AN, set a key server priority of the network device to a highest priority;
cause the network device to participate in a key server election with other peer devices in a Media Access Control Security (MACsec) group; and
while acting as a key server of the MACsec group:
generate a sequence of SAKs, wherein each generated SAK is identified by the two-valued AN, wherein a newly generated SAK in the sequence of SAKs is identified by the two-valued AN being set to ‘1’ when a SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to ‘0’, and wherein the newly generated SAK is identified by the two-valued AN being set to ‘0’ when the SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to ‘1’; and
distribute each generated SAK and the two-valued AN that identifies the generated SAK to the other peer devices in the MACsec group.
9. The network device of claim 8 , wherein each SAK in the sequence of SAKs is generated and distributed in response to occurrence of a rekey event.
10. The network device of claim 8 , wherein the peer device, acting as the key server:
generates a first SAK;
distributes both the first SAK and the two-valued AN being set to the first value to the other peer devices in the MACsec group;
generates a second SAK at a time subsequent to distributing the first SAK;
distributes both the second SAK and the two-valued AN being set to the second value, to the other peer devices in the MACsec group;
generates a third SAK at a time subsequent to distributing the second SAK; and
distributes both the third SAK and the two-valued AN being set to the first value, to the other peer devices in the MACsec group.
11. The network device of claim 10 , wherein the second SAK is generated in response to occurrence of a first rekey event, wherein the third SAK is generated in response to occurrence of a second rekey event.
12. The network device of claim 8 , wherein the peer device is elected as the key server based upon the key server priority.
13. A non-transitory machine-readable medium storing a program executable by at least one processing unit of a network device, the program comprising sets of instructions for:
detecting that the network device only supports a two-valued association number (AN) with which to identify secure association keys (SAKs), the two-valued AN being only a first value or a second value;
in response to detecting that the network device only supports the two-valued AN, setting a key server priority of the network device to a highest priority;
participating in a key server election with other peer devices in a Media Access Control Security (MACsec) group; and
while acting as a key server of the MACsec group:
generating a sequence of SAKs, wherein each generated SAK is identified by the two-valued AN, wherein a newly generated SAK in the sequence of SAKs is identified by the two-valued AN being set to the second value when a SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to the first value, and wherein the newly generated SAK is identified by the two-valued AN being set to the first value when the SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to the second value; and
distributing each generated SAK and the two-valued AN that identifies the generated SAK to the other peer devices in the MACsec group,
wherein each SAK in the sequence of SAKs is generated and distributed in response to occurrence of a rekey event.
14. The non-transitory machine-readable medium of claim 13 , wherein the first value is ‘0’ and the second value is ‘1’.
15. The non-transitory machine-readable medium of claim 1 , wherein the peer device, acting as the key server:
generates a first SAK;
distributes both the first SAK and the two-valued AN being set to the first value to the other peer devices in the MACsec group;
generates a second SAK at a time subsequent to distributing the first SAK;
distributes both the second SAK and the two-valued AN being set to the second value, to the other peer devices in the MACsec group;
generates a third SAK at a time subsequent to distributing the second SAK; and
distributes both the third SAK and the two-valued AN being set to the first value, to the other peer devices in the MACsec group.
16. The non-transitory machine-readable medium of claim 15 , wherein the second SAK is generated in response to occurrence of a first rekey event, wherein the third SAK is generated in response to occurrence of a second rekey event.
17. The non-transitory machine-readable medium of claim 13 , wherein the peer device is elected as the key server based upon the key server priority.