Multi-hop WAN MACsec over IP

1. An egress frame processing method performed at a network device, comprising:

receiving an egress frame including an outer Ethernet frame, an Internet Protocol (IP) header defining an IP tunnel between the network device and a peer network device over a public wide area network, a layer 3 (L3) encapsulation identifying a layer 2 (L2)-over-L3 tunnel protocol, and an inner Ethernet frame with a payload and that is demarcated by the L3 encapsulation; and

parsing the outer Ethernet frame, the IP header, the L3 encapsulation, and the inner Ethernet frame;

determining a media access control security (MACsec) policy that defines how to protect the inner Ethernet frame based on results of the parsing;

protecting the inner Ethernet frame according to the MACsec policy, while leaving unprotected the outer Ethernet frame, the IP header, and the L3 encapsulation, to produce a partly protected output egress frame; and

transmitting the partly protected output egress frame to the peer network device over the IP tunnel of the public wide area network.

2. The method of claim 1 , wherein the parsing includes parsing the IP header based on an Ethertype field of the outer Ethernet frame to extract a destination IP address of the IP tunnel, and the method further comprises:

determining a MACsec entity based on the destination IP address of the IP tunnel; and

determining a security association and a MACsec secure channel based on at least the MACsec entity,

wherein the determining the MACsec policy includes determining the MACsec policy based on the MACsec entity, the security association, and the secure channel.

3. The method of claim 2 , wherein:

the determining the MACsec entity further includes determining the MACsec entity additionally based on a physical port of the network device at which the egress frame was received, priority bits also extracted from the IP header, and a sub-port associated with the Ethernet packet that is mapped to the MACsec entity; and

the determining the security association and the secure channel includes determining the security association and the secure channel based on the sub-port.

4. The method of claim 1 , wherein:

the MACsec policy identifies which ones of an Ethernet header, an Ethernet type field, and the payload of the inner Ethernet frame each available from the parsing results, are to be MACsec protected; and

the protecting includes:

protecting the identified ones of the Ethernet header, the Ethernet type field, and the payload of the inner Ethernet frame; and

inserting a MACsec security tag and an integrity check value into the inner Ethernet frame.

5. The method of claim 4 , wherein the protecting further includes authenticating, encrypting, or both authenticating and encrypting one or more of the identified ones of the Ethernet header, the Ethernet type field, and the payload of the inner Ethernet frame.

6. The method of claim 1 , wherein the MACsec policy further indicates whether the inner Ethernet frame is to be protected or is not to be protected, the method further comprising:

determining whether the MACsec policy indicates that the inner Ethernet frame is to be protected or is not to be protected;

if it is determined that the MACsec policy indicates that the inner Ethernet frame is to be protected, performing the protecting and the transmitting the partly protected output egress frame; and

if it is determined that the MACsec policy indicates that the inner Ethernet frame is not to be protected, not performing the protecting.

7. The method of claim 1 , wherein:

the payload of the inner Ethernet frame of the egress frame includes an IP packet having a source IP address and a destination IP address corresponding to a source device from which the IP packet originated and a destination device, respectively; and

the MACsec protecting the inner Ethernet frame includes MACsec protecting the IP packet therein.

8. The method of claim 1 , wherein the egress frame processing method is performed at a single network device.

9. An apparatus, comprising:

one or more network ports;

a switch fabric connected with the one or more network ports; and

a processor connected to, or comprising part of, the switch fabric, and configured to:

receive, via one of the network ports, an egress frame including an outer Ethernet frame, an Internet Protocol (IP) header defining an IP tunnel between the network device and a peer network device over a public wide area network, a layer 3 (L3) encapsulation identifying a layer 2 (L2)-over-L3 tunnel protocol, and an inner Ethernet frame with a payload and that is demarcated by the L3 encapsulation;

parse the outer Ethernet frame, the IP header, the L3 encapsulation, and the inner Ethernet frame;

determine a media access control security (MACsec) policy that defines how to protect the inner Ethernet frame based on results of the parsing;

protect the inner Ethernet frame according to the MACsec policy, while leaving unprotected the outer Ethernet frame, the IP header, and the L3 encapsulation, to produce a partly protected output egress frame; and

transmit the partly protected output egress frame to the peer network device over the IP tunnel of the public wide area network.

10. The apparatus of claim 9 , wherein the processor is configured to parse by parsing the IP header based on an Ethertype field of the outer Ethernet frame to extract a destination IP address of the IP tunnel, and the processor is further configured to:

determine a MACsec entity based on the destination IP address of the IP tunnel; and

determine a security association and a MACsec secure channel based on at least the MACsec entity,

wherein the processor is configured to determine the MACsec policy based on the MACsec entity, the security association, and the secure channel.

11. The apparatus of claim 10 , wherein:

the processor is configured to determine the MACsec entity by determining the MACsec entity additionally based on a physical port of the network device at which the egress frame was received, priority bits also extracted from the IP header, and a sub-port associated with the Ethernet packet that is mapped to the MACsec entity; and

the processor is configured to determine the security association and the secure channel by determining the security association and the secure channel based on the sub-port.

12. The apparatus of claim 9 , wherein:

the MACsec policy identifies which ones of an Ethernet header, an Ethernet type field, and the payload of the inner Ethernet frame each available from the parsing results, are to be MACsec protected; and

the processor is configured to protect by:

protecting the identified ones of the Ethernet header, the Ethernet type field, and the payload of the inner Ethernet frame; and

inserting a MACsec security tag and an integrity check value into the inner Ethernet frame.

13. The apparatus of claim 12 , wherein the processor is further configured to protect by authenticating, encrypting, or both authenticating and encrypting one or more of the identified ones of the Ethernet header, the Ethernet type field, and the payload of the inner Ethernet frame.

14. The apparatus of claim 9 , wherein the MACsec policy further indicates whether the inner Ethernet frame is to be protected or is not to be protected, and the processor is further configured to:

determine whether the MACsec policy indicates that the inner Ethernet frame is to be protected or is not to be protected;

if it is determined that the MACsec policy indicates that the inner Ethernet frame is to be protected, perform the protecting and the transmitting the partly protected output egress frame; and

if it is determined that the MACsec policy indicates that the inner Ethernet frame is not to be protected, not performing the protecting.

15. An ingress frame processing method performed at a network device, comprising:

receiving an ingress frame transmitted by a peer network device to the network device over a public wide area network via an Internet Protocol (IP) tunnel, the ingress frame including an unprotected outer Ethernet frame, an unprotected IP header defining the IP tunnel, an unprotected layer 3 (L3) encapsulation identifying a layer 2 (L2)-over-L3 tunnel protocol, and a MACsec protected inner Ethernet frame carrying a payload destined for a destination device;

parsing the unprotected outer Ethernet frame, the unprotected IP header, the unprotected L3 encapsulation, and the MACsec protected inner Ethernet frame:

determining a media access control security (MACsec) policy that defines the MACsec protection on the MACsec protected inner Ethernet frame based on results of the parsing;

removing the MACsec protection from the MACsec protected inner Ethernet frame according to the MACsec policy, to produce an inner Ethernet frame; and

transmitting the inner Ethernet frame to the destination device.

16. The method of claim 15 , wherein the parsing includes parsing the IP header based on an Ethertype field in the outer Ethernet frame to extract one or more IP addresses of the IP tunnel, the method further comprising:

determining a MACsec entity based on the IP addresses; and

determining a security association and a MACsec secure channel based on at least the MACsec entity,

wherein the determining the MACsec policy includes determining the MACsec policy based on the MACsec entity, the security association, and the secure channel.

17. The method of claim 16 , wherein:

the determining the MACsec entity includes determining the MACsec entity based on a destination IP address of the IP addresses, a physical port of the network device at which the ingress frame was received, and priority bits also extracted from the IP header, a sub-port associated with the ingress frame that is mapped to the MACsec entity; and

the determining the security association and the secure channel includes determining the security association and the secure channel based on the sub-port.

18. The method of claim 15 , wherein:

the MACsec policy defines the MACsec protection on an Ethernet header, an Ethernet type field, and the payload of the inner Ethernet frame; and

the removing the MACsec protection includes removing the MACsec protection from the Ethernet header, the Ethernet type field, and the payload of the inner Ethernet frame according to the MACsec policy, to produce the inner Ethernet frame.

19. The method of claim 18 , wherein the removing MACsec protection further includes authenticating, decrypting, or both authenticating and decrypting one or more of the Ethernet header, the Ethernet type field, and the payload of the MACsec protected inner Ethernet frame according to the MACsec policy.

20. The method of claim 15 , wherein:

the payload of the inner Ethernet frame includes an IP packet having a source IP address and a destination IP address corresponding to a source device and the destination device, respectively; and

the removing the MACsec protection includes removing MACsec protection from the IP packet.

21. The method of claim 15 , wherein:

the removing the MACsec protection further includes removing a MACsec security tag and an integrity check value from the MACsec protected inner Ethernet frame, to produce the inner Ethernet frame.

22. The method of claim 15 , wherein:

the removing the MACsec protection further includes not removing a MACsec security tag and not removing an integrity check value from the MACsec protected inner Ethernet frame, to produce the inner Ethernet frame.

23. The method of claim 15 , wherein the ingress frame processing method is performed at a single network device.