Preserving security association in MACsec protected network through VLAN mapping
According to one general aspect, a method of using a network device may include receiving, via an ingress port, a data packet that includes a payload portion, a source network address and a destination network address. In various embodiments, the method may also include determining if the data packet includes a security tag that includes a role based authentication tag. In some embodiments, the method may include, if the data packet includes a security tag that includes a role based authentication tag, transmitting, via an egress port, at least the payload portion and the role based authentication tag towards, in a topological sense, the destination network address.
1. A method comprising:
receiving, via an ingress port of a network device, a data packet that includes a payload portion and a destination network address;
determining if the data packet, as received, includes a security tag, in a first protocol format, that includes a role based authentication tag; and
if the data packet, as received, includes a security tag that includes a role based authentication tag;
determining whether or not a next network device, in a network path towards the destination network address, is configured to support a data packet that includes a security tag in the first protocol format,
if so, generating, in the first protocol format, a first protocol-formatted security tag that includes the role based authentication tag and associating the first protocol-formatted security tag with the payload portion of the data packet
if not, generating, in a second protocol format, a second protocol-formatted security tag that includes the role based authentication tag and associating the second protocol-formatted security tag with the payload portion of the data packet, and
transmitting, via an egress port of the network device and without a determination of privileges associated with the role base authentication tag, at least the payload portion and the role based authentication tag towards, in a topological sense, the destination network address.
2. The method of claim 1 , further comprising, if the data packet does not include a security tag that includes a role based authentication tag:
assigning a predetermined default role value to the data packet;
generating a role based authentication tag that includes the predetermined default role value;
associating the role based authentication tag with the payload portion of the data packet; and
transmitting, via the egress port, at least the payload portion and the role based authentication tag towards, in a topological sense, the destination network address.
3. The method of claim 1 ,
wherein generating the first protocol-formatted security tag includes generating a security tag that is substantially compliant with the MACsec protocol.
4. The method of claim 1 , wherein generating the second protocol-formatted security tag includes:
generating a virtual local area network (VLAN) tag that includes the role based authentication tag.
5. The method of claim 1 , further comprising, if the data packet includes a security tag that includes a role based authentication tag:
disassociating the security tag from the payload portion; and
associating either the first protocol-formatted security tag or the second protocol-formatted security tag with the payload portion.
6. The method of claim 1 , further comprising, if the data packet includes a security tag that includes a role based authentication tag: determining a network route based at least in part upon the role based authentication tag.
7. The method of claim 4 , wherein
generating a virtual local area network (VLAN) tag that includes the role based authentication tag includes placing the role based authentication tag within a VLAN identifier (ID) portion of the VLAN tag.
8. The method of claim 1 , wherein determining if the data packet includes a security tag comprises: determining if the data packet includes a security tag that is substantially compatible with the I.E.E.E. 802.1 AE standard.
9. The method of claim 1 , wherein determining if the data packet includes a security tag that includes a role based authentication tag comprises: determining if the role based authentication tag is included as a portion of a Secure Channel Identifier.
10. An apparatus comprising:
an ingress port configured to:
receive a data packet that includes a payload portion and a destination network address;
a processor configured to:
determine if the data packet includes a security tag, in a first protocol format, that includes a role based authentication tag, and
determining whether or not a next network device, in a network path towards the destination network address, is configured to support a data packet that includes a security tag in the first protocol format,
if so, generating, in the first protocol format, a first protocol-formatted security tag that includes the role based authentication tag and associating the first protocol-formatted security tag with the payload portion of the data packet
if not, generating, in a second protocol format, a second protocol-formatted security tag that includes the role based authentication tag and associating the second protocol-formatted security tag with the payload portion of the data packet; and
an egress port configured to:
if the data packet includes a security tag that includes a role based authentication tag, transmit, without a determination of privileges associated with the role base authentication tag, at least the payload portion and the role based authentication tag towards, in a topological sense, the destination network address.
11. The apparatus of claim 10 , wherein the processor is configured to, if the data packet does not include a security tag that includes a role based authentication tag:
assign a predetermined default role value to the data packet,
generate a role based authentication tag that includes the predetermined default role value, and associate the role based authentication tag with the payload portion of the data packet; and
wherein the egress port is configured to: transmit at least the payload portion and the role based authentication tag towards, in a topological sense, the destination network address.
12. The apparatus of claim 10 , wherein the apparatus is configured to
generate the first protocol-formatted security tag such that the first protocol-formatted security tag is substantially compliant with the MACsec protocol.
13. The apparatus of claim 10 , wherein the apparatus is configured to
generate the second protocol-formatted security tag such that the second protocol-formatted security tag includes a virtual local area network (VLAN) tag that includes the role based authentication tag.
14. The apparatus of claim 10 , wherein the apparatus is configured to, if the data packet includes a security tag that includes a role based authentication tag: generate a virtual local area network (VLAN) tag that includes the role based authentication tag; disassociate the security tag from the payload portion; and associate the VLAN tag with the payload portion.
15. The apparatus of claim 10 , wherein the processor is configured to: determine a network route based at least in part upon the role based authentication tag.
16. The apparatus of claim 13 , wherein the apparatus is configured to, when generating a virtual local area network (VLAN) tag that includes the role based authentication tag, place the role based authentication tag within a VLAN identifier (ID) portion of the VLAN tag.
17. The apparatus of claim 10 , wherein the processor is configured to: determine if the data packet includes a security tag that is substantially compatible with the I.E.E.E. 802.1 AE standard.
18. The apparatus of claim 10 , wherein the processor is configured to: determine if the role based authentication tag is included as a portion of a Secure Channel Identifier.
19. A computer program product for communicating information, the computer program product being tangibly and non-transitorily embodied on a computer-readable medium and including executable code that, when executed, is configured to cause a network apparatus to:
receive, via an ingress port of the network device, a data packet that includes a payload portion, a source network address and a destination network address;
determine if the data packet includes a security tag, in a first protocol format, that includes a role based authentication tag; and
if the data packet includes a security tag that includes a role based authentication tag:
determine whether or not a next network device, in a network path towards the destination network address, is configured to support a data packet that includes a security tag in the first protocol format,
if so, generate, in the first protocol format, a first protocol-formatted security tag that includes the role based authentication tag and associating the first protocol-formatted security tag with the payload portion of the data packet
if not, generate, in a second protocol format, a second protocol-formatted security tag that includes the role based authentication tag and associating the second protocol-formatted security tag with the payload portion of the data packet, and
transmit, without a determination of privileges associated with the role base authentication tag, at least the payload portion and the role based authentication tag towards, in a topological sense, the destination network address.
20. A computer program product of claim 19 , wherein executable code that, when executed, is configured to cause a network apparatus to:
generate the first protocol-formatted security tag such that the first protocol-formatted security tag is substantially compliant with the MACsec protocol, and
generate the second protocol-formatted security tag such that the second protocol-formatted security tag includes a virtual local area network (VLAN) tag that includes the role based authentication tag.