US 11,539,513 B1Granted

Pausing a media access control security (MACsec) key agreement (MKA) protocol of an MKA session using a fast heartbeat session

AssigneeJuniper Networks, Inc.

InventorsBaba Syed Mazaz Hussain, Sachin Mutalik Desai

Life of this patent

Estimating the term…

Loading patent…

Abstract

A network device may establish a media access control security (MACsec) key agreement (MKA) session with another network device via a MACsec communication link; establish a fast heartbeat session via the MACsec communication link, between a first packet processing engine of the network device and a second packet processing engine of the other network device, where the fast heartbeat session is to permit the first packet processing engine and the second packet processing engine to exchange fast heartbeat messages via the fast heartbeat session and the MACsec communication link; place an MKA protocol of the MKA session in a pause state until the first packet processing engine detects a rekey event; determine that a key for the MKA session is to be regenerated based on detection of the rekey event; and perform an action based on the rekey event for the MKA session.

Claims20

Dependent claims

A network device, comprising:

one or more memories;
and
one or more processors, communicatively coupled to the one or more memories, to:
establish a media access control security (MACsec) key agreement (MKA) session with another network device via a MACsec communication link,
where the MKA session exchanges MKA packet data between a MKA daemon of the network device and a MKA daemon of the other network device;
establish a fast heartbeat session via the MACsec communication link, between a first packet processing engine of the network device and a second packet processing engine of the other network device,
where the fast heartbeat session is to permit the first packet processing engine and the second packet processing engine to exchange fast heartbeat messages via the fast heartbeat session and the MACsec communication link, and
where the fast heartbeat session exchanges fast heartbeat protocol messages between MKA devices at a faster rate than standard peer liveness messages of MKA sessions;
place a MKA protocol of the MKA session in a pause state when the fast heartbeat session is established,
where the MKA protocol of the MKA sessions is placed in the pause state until the first packet processing engine detects a rekey event,
where the first packet processing engine, when the MKA protocol is in the pause state, is to:
cause the MKA daemon of the network device to suspend transmission of MKA packet data for the MKA session, and
cause the MKA daemon to suspend a timeout timer associated with the MKA session;
determine that a key for the MKA session is to be regenerated based on detection of the rekey event;
and
perform an action based on the rekey event for the MKA session,
the action including placing the MKA protocol in an active state.

14 more elements

A non-transitory computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by one or more processors of a network device, cause the one or more processors to:
establish a media access control security (MACsec) key agreement (MKA) session with another network device via a MACsec communication link,
where the MKA session exchanges MKA packet data between a MKA daemon of the network device and a MKA daemon of the other network device;
establish a fast heartbeat session via the MACsec communication link, between a first packet processing engine of the network device and a second packet processing engine of the other network device,
where the fast heartbeat session is to permit the first packet processing engine and the second packet processing engine to exchange fast heartbeat messages via the fast heartbeat session and the MACsec communication link, and
where the fast heartbeat session exchanges fast heartbeat protocol messages between MKA devices at a faster rate than standard peer liveness messages of MKA sessions;
place a MKA protocol of the MKA session in a pause state when the fast heartbeat session is established,
where the first packet processing engine, when the MKA protocol is in the pause state, is to:
cause the MKA daemon of the network device to suspend transmission of MKA packet data for the MKA session, and
cause the MKA daemon to suspend a timeout timer associated with the MKA session;
detect a rekey event associated with the MKA session;
determine that a key for the MKA session is to be regenerated based on detecting the rekey event;
and
perform an action based on the rekey event for the MKA session,
the action including placing the MKA protocol in an active state.

12 more elements

A method, comprising:

establishing, by a network device, a media access control security (MACsec) key agreement (MKA) session with another network device via a MACsec communication link,
where the MKA session exchanges MKA packet data between a MKA daemon of the network device and a MKA daemon of the other network device;
establishing, by the network device, a fast heartbeat session via the MACsec communication link,
where the fast heartbeat session is to permit the network device and the other network device to exchange fast heartbeat messages via the fast heartbeat session and the MACsec communication link,
where the fast heartbeat session exchanges fast heartbeat protocol messages between MKA devices at a faster rate than standard peer liveness messages of MKA sessions;
and
placing, by the network device, a MKA protocol of the MKA session in a pause state when the fast heartbeat session is established,
where the MKA protocol of the MKA sessions is placed in the pause state until a rekey event is detected;
suspending, by the network device and after the MKA protocol is placed in the pause state, transmission of MKA packet data for the MKA session;
suspending, by the network device, a timeout timer associated with the MKA session;
and
performing, by the network device, an action based on the rekey event being detected,
the action including placing the MKA protocol in an active state.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/891,089Filed 7 Feb 2018 · us provisional application
Priority: 19 Dec 2017
Granted: 27 Dec 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 9/0838
Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for…:…
H04L 9/0891
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: revocation or update of secret…
H04L 9/40
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: network security protocols
H04L 43/10
Arrangements for monitoring or testing data switching networks: active monitoring, e.g. heartbeat, ping or trace-route