Security for communication protocols
Various example embodiments for supporting security for communications may be configured to support security for communications of communication protocols at various communication layers. For example, various example embodiments for supporting security for communications may be configured to support security for communications of communication protocols operating above Layer 2 using a Layer 2 network security protocol. For example, various example embodiments for supporting security for communications may be configured to support security for communications of communication protocols operating at Layer 2.5 (e.g., Multiprotocol Label Switching (MPLS) protocols or other Layer 2.5 protocols) using a Layer 2 network security protocol. For example, various example embodiments for supporting security for communications may be configured to support security for communications of communication protocols operating at Layer 3 (e.g., Internet Protocol (IP), such as IP version 4 (IPv4) or IP version 6 (IPv6), or other Layer 3 protocols) using a Layer 2 network security protocol.
1 . An apparatus, comprising:
at least one processor; and
at least one memory including instructions which, when executed by the at least one processor, cause the apparatus to at least:
receive a Multiprotocol Label Switching (MPLS) packet to be secured based on a security protocol and to be transported based on a Layer 2 header, wherein the MPLS packet includes a payload and an MPLS header;
determine an encryption offset and an authentication offset for the MPLS packet, wherein the encryption offset is configured to leave the Layer 2 header, the MPLS header, and a header of the security protocol unencrypted, wherein the authentication offset is configured to leave the Layer 2 header and the MPLS header unauthenticated;
provide a packet including the payload, the MPLS header, the header of the security protocol, and the Layer 2 header, wherein the header of the security protocol is arranged between the payload and the MPLS header, wherein the Layer 2 header encapsulates the payload, the header of the security protocol, and the MPLS header, wherein the payload is encrypted based on the encryption offset, wherein authentication is run over the payload and the header of the security protocol based on the authentication offset; and
forward the packet from a first router toward a second router.
2 . The apparatus of claim 1 , wherein the instructions, when executed by the at least one processor, cause the apparatus to at least:
receive the payload; and
associate the MPLS header with the payload to form the MPLS packet.
3 . The apparatus of claim 1 , wherein the payload comprises an Internet Protocol packet.
4 . The apparatus of claim 1 , wherein the MPLS header includes one or more MPLS labels.
5 . The apparatus of claim 1 , wherein a determination to secure the MPLS packet using the security protocol is based on the MPLS header.
6 . The apparatus of claim 1 , wherein the security protocol supports features of an IEEE 802.1AE protocol.
7 . An apparatus, comprising:
at least one processor; and
at least one memory including instructions which, when executed by the at least one processor, cause the apparatus at least to:
provide a packet including a payload, a Multiprotocol Label Switching (MPLS) header, a header of a security protocol, and a Layer 2 header, wherein the header of the security protocol is arranged between the payload and the MPLS header, wherein the Layer 2 header encapsulates the payload, the header of the security protocol, and the MPLS header;
determine an encryption offset configured to leave the Layer 2 header, the MPLS header, and the header of the security protocol unencrypted;
encrypt, based on the encryption offset, the payload;
determine an authentication offset configured to leave the Layer 2 header and the MPLS header unauthenticated;
run, based on the authentication offset, authentication over the payload and the header of the security protocol; and
forward the packet from a first router toward a second router.
8 . The apparatus of claim 7 , wherein the payload is an Internet Protocol packet.
9 . The apparatus of claim 7 , wherein the MPLS header includes one or more MPLS labels.
10 . The apparatus of claim 7 , wherein the MPLS header is associated with the payload as an MPLS packet prior to the header of the security protocol being arranged between the payload and the MPLS header.
11 . The apparatus of claim 7 , wherein the security protocol supports features of an IEEE 802.1AE protocol.
12 . The apparatus of claim 7 , wherein the encryption of the payload is based on the security protocol and an encryption algorithm.
13 . The apparatus of claim 7 , wherein the running of the authentication over the payload and the header of the security protocol is based on the security protocol and an authentication algorithm.
14 . The apparatus of claim 7 , the encryption offset and the authentication offset are determined based on at least a portion of the MPLS header.
15 . The apparatus of claim 7 , wherein the Layer 2 header is an Ethernet header.