# US 12,015,642 B2 · Methods, systems, and computer readable media for testing a network system under test communicating over a secure channel > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,642 B2 - Document ID: US12015642B2 - Status: Granted - Kind: B2 - Application number: 17/175,329 - Filed: 2021-02-12 - Published: 2022-08-18 - Granted: 2024-06-18 - Earliest claimed: 2021-02-12 - Assignees: Keysight Technologies, Inc. - Applicants: Keysight Technologies, Inc. - Inventors: Debojyoti Roy; Pradosh Tapan Datta; Robert Brian Luking; Aymen Chebab - Web page: https://patentgrep.com/patent/US12015642B2 ## CPC - H04L 63/162: {at the data link layer} - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 43/50: Testing arrangements - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/123: {received data contents, e.g. message integrity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and computer readable media for testing a system under test (SUT). A method includes sending a first test packet to the SUT over a communication link. The first test packet is associated with a layer 2 secure channel that is bound to an emulated network device. The method includes receiving a second test packet from the SUT over the communication link. The second test packet includes an unencrypted portion and an encrypted portion. The method includes forming a test identifier that uniquely identifies the layer 2 secure channel and the emulated network device using a subset of bits from a secure channel identifier in the unencrypted portion of the second test packet. The method includes decrypting the encrypted portion of the second test packet by finding a security key using the test identifier. ## Claims ### Claim 1 A method for testing a system under test (SUT), the system comprising: sending a first test packet to the SUT over a communication link, wherein the first test packet is associated with a layer 2 secure channel that is bound to an emulated network device; receiving a second test packet from the SUT over the communication link, wherein the second test packet includes an unencrypted portion and an encrypted portion; forming a test identifier that uniquely identifies the layer 2 secure channel and the emulated network device using a subset of bits from the unencrypted portion of the second test packet, wherein forming the test identifier comprises forming a portion of the test identifier as a device identifier from the unencrypted portion of the second test packet such that the device identifier uniquely identifies the emulated network device from a plurality of other emulated network devices, and wherein forming the portion of the test identifier as the device identifier comprises using both a destination media access control (MAC) address and virtual local area network (VLAN) identifier; and decrypting the encrypted portion of the second test packet by finding a security key using the test identifier, wherein decrypting the encrypted portion of the second test packet by finding a security key using the test identifier comprises using the test identifier, including the device identifier that uniquely identifies the emulated network device, as an index to a key table. ### Claim 2 (depends on 1) The method of claim 1, comprising storing one or more test metrics for the emulated network device in a data structure using the test identifier. ### Claim 3 (depends on 1) The method of claim 1, wherein the layer 2 secure channel is a medium access control security (MACsec) secure channel. ### Claim 4 (depends on 1) The method of claim 1, wherein forming the portion of the test identifier as a device identifier comprises using a multi-protocol label lab& switching identifier (MPLS ID). ### Claim 5 (depends on 1) The method of claim 1, wherein forming the test identifier comprises concatenating the device identifier and N bits from the unencrypted portion of the second test packet. ### Claim 6 (depends on 1) The method of claim 1, comprising receiving a plurality of incoming test packets, forming test identifiers for the incoming packets, and decrypting the incoming packets at line rate. ### Claim 7 (depends on 1) The method of claim 1, wherein using the test identifier as the index to the key table comprises accessing the key table at a key server. ### Claim 8 (depends on 1) The method of claim 1, wherein forming the test identifier using a subset of bits comprises using M bits of the unencrypted portion of the second packet. ### Claim 9 (depends on 1) The method of claim 1, comprising preconfiguring, before initiating a test case, a programmable logic device for forming the test identifier using M bits as a device identifier and N bits as a secure channel identifier. ### Claim 10 A system for testing a system under test (SUT), the system comprising: one or more processors and memory storing instructions for the one or more processors; and one or more networking circuits configured, by the one or more processors, for performing operations comprising: sending a first test packet to the SUT over a communication link, wherein the first test packet is associated with a layer 2 secure channel that is bound to an emulated network device; receiving a second test packet from the SUT over the communication link, wherein the second test packet includes an unencrypted portion and an encrypted portion; forming a test identifier that uniquely identifies the layer 2 secure channel and the emulated network device using a subset of bits from the unencrypted portion of the second test packet, wherein forming the test identifier comprises forming a portion of the test identifier as a device identifier from the unencrypted portion of the second test packet such that the device identifier uniquely identifies the emulated network device from a plurality of other emulated network devices, and wherein forming the portion of the test identifier as the device identifier comprises using both a destination media access control (MAC) address and virtual local area network (ULAN) identifier; and decrypting the encrypted portion of the second test packet by finding a security key using the test identifier, wherein decrypting the encrypted portion of the second test packet by finding a security key using the test identifier comprises using the test identifier, including the device identifier that uniquely identifies the emulated network device, as an index to a key table. ### Claim 11 (depends on 10) The system of claim 10, the operations comprising storing one or more test metrics for the emulated network device in a data structure using the test identifier. ### Claim 12 (depends on 10) The system of claim 10, wherein the layer 2 secure channel is a medium access control security (MACsec) secure channel. ### Claim 13 (depends on 10) The system of claim 10, wherein forming the portion of the test identifier as a device identifier comprises using a multi-protocol label switching identifier (MPLS ID). ### Claim 14 (depends on 10) The system of claim 10, wherein forming the test identifier comprises concatenating the device identifier and N bits from the unencrypted portion of the second test packet as a secure channel identifier. ### Claim 15 (depends on 10) The system of claim 10, the operations comprising receiving a plurality of incoming test packets, forming test identifiers for the incoming packets, and decrypting the incoming packets at line rate. ### Claim 16 (depends on 10) The system of claim 10, wherein decrypting the encrypted portion of the second test packet by finding a security key using the test identifier comprises using the test identifier as an index to a key table at a key server. ### Claim 17 (depends on 10) The system of claim 10, wherein forming the test identifier using a subset of bits comprises using M bits of the unencrypted portion of the second packet. ### Claim 18 (depends on 10) The system of claim 10, wherein the one or more network circuits comprise at least one programmable logic device, the operations comprising preconfiguring, before initiating a test case, the programmable logic device for forming the test identifier using M bits as a device identifier and N bits as a secure channel identifier.