WAN transport of frames with MAC security
View Patent ↗A physical layer device provides security processing on communication frames that may include tags or headers that are for use in a wide area network. As frames pass through the physical layer device, the frames are classified for a type of security processing. Depending on the classification a cipher is applied to the frames for integrity checking of data in the frames. Some frames are also encrypted. The security processing may exclude some of the tags or headers. The frames may also be filtered and buffered.
1. A transmission device for a communications network, the transmission device comprising:
circuitry to buffer and schedule further processing of a frame for transmission;
circuitry configured to determine a class of security processing to perform on the frame for transmission based on a source address, a destination address, a virtual local area network (VLAN) tag, and an Ethernet type (Etype), the class of security processing being determined from among a set of classes including standard media access control security (MACsec), single tag bypass MACsec, dual tag bypass MACsec, and Ethernet over multiprotocol label switching (EoMPLS) header bypass MACsec, and to signal the circuitry to buffer and schedule if security processing is to be performed on the frame based on the determined class of security processing;
circuitry configured to apply security processing to the portion of the frame to generate a secured frame, the applied security processing excluding application of security processing of one VLAN tag of the frame for the single tag bypass MACsec class of security processing and the applied security processing excluding application of security processing of at least two VLAN tags of the frame for the dual tag bypass MACsec class of security processing, the security processing including adding an integrity check value (ICV) to the frame, the ICV covering portions of the frame excluding the one VLAN tag for the single tag bypass MACsec class of security processing and excluding the at least two VLAN tags for the dual tag bypass MACsec class of security processing; and
circuitry configured to process the secured frame to calculate a frame check sequence (FCS) value for the secured frame and to generate an output signal for transmission to a communication network.
2. The transmission device of claim 1 , wherein applying the security processing includes applying a cipher to the frame, excluding the one VLAN tag for the single tag bypass MACsec class of security processing and excluding the at least two VLAN tags for the dual tag bypass MACsec class of security processing.
3. The transmission device of claim 1 , wherein the security processing includes encrypting portions of the frame.
4. The transmission device of claim 1 , wherein the class of security processing is determined based on a source address associated with the frame.
5. The transmission device of claim 1 , wherein the at least two VLAN tags consist of two VLAN tags.
6. The transmission device of claim 1 , wherein the ICV provides protection for at least a destination address of the frame, a source address of the frame, a security tag for the frame, and a payload of the frame.
7. The transmission device of claim 6 , wherein the one VLAN tag for the single tag bypass MACsec class of security processing has a position in the frame at a location between the source address and the security tag.
8. A method for performing security processing on communications frames including tags for use in a wide area network, the method comprising:
determining whether a frame is to receive selective security processing based on a source address, a destination address, a virtual local area networking (VLAN) tag, and an Ethernet type (Etype) associated with the frame;
if the frame is to receive selective security processing, determining a class of security processing, the class of security processing being determined from among a set of classes including standard media access control security (MACsec), MACsec plus single tag bypass, MACsec plus dual tag bypass, and MACsec plus Ethernet over multiprotocol label switching (EoMPLS) header bypass;
signaling a frame scheduler whether the frame is to receive selective security processing;
performing security processing on portions of the frame other than one VLAN tag of the frame for the MACsec plus single tag bypass class of security processing and performing security processing on portions of the frame other than at least two VLAN tags of the frame for the MACsec plus dual tag bypass class of security processing, the security processing including adding an integrity check value (ICV) to the frame, the ICV covering portions of the frame excluding the one VLAN tag for the single tag bypass MACsec class of security processing and excluding the at least two VLAN tags for the dual tag bypass MACsec class of security processing;
calculating a frame check sequence (FCS) for the security processed frame; and
transmitting the security processed frame, including the FCS.
9. The method of claim 8 , wherein the security processing comprises Media Access Control Security (MACSec) processing.
10. The method of claim 8 , wherein the at least two VLAN tags consist of two VLAN tags.
11. The method of claim 8 , wherein the security processing comprises applying a cipher to portions of the frame.
12. The method of claim 8 , wherein the one VLAN tag precedes a security tag in the frame.