MACsec for encrypting tunnel data packets

A MACsec capable device comprising:

• communication circuitry configured to receive a data packet from a host device for tunneling to a controller in a network;
• encapsulation circuitry configured to encapsulate the data packet with a layer-2 encapsulation header to generate an encapsulated data packet, wherein the layer-2 encapsulation header comprises a destination MAC address of the controller;
• encryption circuitry configured to:
• identify an encryption key corresponding to the controller based on the destination MAC address;
• encrypt the encapsulated data packet with the encryption key to generate an encrypted data packet based on a MACsec protocol;
• tunneling circuitry configured to encapsulate the encrypted data packet with a tunnel header;
• and
• wherein the communication circuitry is further configured to send the encrypted data packet to the controller via a tunnel corresponding to the tunnel header.

A non-transitory machine-readable storage medium comprising instructions, the instructions executable by a processor to execute a method, the method comprising:

• receiving, by a Media Access Control (MAC) Security (MACsec) capable device, a data packet from a host device for tunneling to a controller node amongst a plurality of controller nodes in a network;
• encapsulating, by the MACsec capable device, the data packet with a layer-2 encapsulation header to generate an encapsulated data packet, wherein the layer-2 encapsulation header comprises a destination MAC address reserved for the controller node;
• identifying, by the MACsec capable device, an encryption key corresponding to the controller node based on the destination MAC address;
• encrypting, by the MACsec capable device, the encapsulated data packet with the encryption key to generate an encrypted data packet based on a MACsec protocol;
• encapsulating, by the MACsec capable device, the encrypted data packet with a tunnel header;
• and
• sending, by the MACsec capable device, the encrypted data packet to the controller node via a tunnel corresponding to the tunnel header.