US 12,192,330 B2Granted

Media access control (MAC) security with association number flexibility

AssigneeArista Networks, Inc.

InventorsKaustav Majumdar, Manish Singhvi

Life of this patent

Estimating the term…

Loading patent…

Abstract

Embodiments allow a network device whose hardware limits an Association Number (AN) to only {0, 1}, to be part of Media Access Control security (MACsec). Upon detecting a network device as being AN-limited, that device's priority value is assigned a maximum value, thereby ensuring election of the AN-limited device as the key server. The {0, 1} AN of the key server is used to generate a Secure Association Key (SAK) used for MACsec. Upon subsequent rekeying, the AN-limited key server automatically cycles to a next AN (either 0 or 1) to generate a new SAK, where that next AN is also recognized by other network devices. In this manner, the AN-limited network device can participate in the MACsec without encountering ANs (e.g., {2, 3}) that it does not recognize.

Claims17

Dependent claims

A method performed by a peer device in a Media Access Control Security (MACsec) group, the method comprising:

detecting that the peer device only supports a two-valued association number (AN) with which to identify secure association keys (SAKs), the two-valued AN being either a first value or a second value;
in response to detecting that the peer device only supports the two-valued AN, setting a key server priority of the peer device to a highest priority;
participating in a key server election with other peer devices in the MACsec group;
and
while acting as a key server of the MACsec group:
generating a sequence of SAKs, wherein each generated SAK is identified by the two-valued AN, wherein a newly generated SAK in the sequence of SAKs is identified by the two-valued AN being set to the second value when a SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to the first value, and wherein the newly generated SAK is identified by the two-valued AN being set to the first value when the SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to the second value;
and
distributing each generated SAK and the two-valued AN that identifies the generated SAK to the other peer devices in the MACsec group.

5 more elements

A network device comprising:

one or more hardware processors;
and
a computer-readable storage medium comprising instructions for controlling the one or more hardware processors to:
detect that the network device only supports a two-valued association number (AN) of ‘0’ or ‘1’ with which to identify secure association keys (SAKs);
in response to detecting that the network device only supports the two-valued AN, set a key server priority of the network device to a highest priority;
cause the network device to participate in a key server election with other peer devices in a Media Access Control Security (MACsec) group;
and
while acting as a key server of the MACsec group:
generate a sequence of SAKs, wherein each generated SAK is identified by the two-valued AN, wherein a newly generated SAK in the sequence of SAKs is identified by the two-valued AN being set to ‘1’ when a SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to ‘0’, and wherein the newly generated SAK is identified by the two-valued AN being set to ‘0’ when the SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to ‘1’;
and
distribute each generated SAK and the two-valued AN that identifies the generated SAK to the other peer devices in the MACsec group.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/706,076Filed 28 Mar 2022
Published: US 2023/0308262 A128 Sep 2023
Granted: 7 Jan 2025
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 9/0825
Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely…: using…
H04L 9/0861
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: generation of secret information…
H04L 9/088
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: usage controlling of secret information,…
H04L 9/0891
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: revocation or update of secret…

Family

US 2023/0308262 A1Pre-grant publication · published 28 Sep 2023
US 12,192,330 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key