# US 12,192,330 B2 · Media access control (MAC) security with association number flexibility > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,330 B2 - Document ID: US12192330B2 - Status: Granted - Kind: B2 - Application number: 17/706,076 - Filed: 2022-03-28 - Published: 2023-09-28 - Granted: 2025-01-07 - Earliest claimed: 2022-03-28 - Assignees: Arista Networks, Inc. - Applicants: Arista Networks, Inc. - Inventors: Kaustav Majumdar; Manish Singhvi - Web page: https://patentgrep.com/patent/US12192330B2 ## CPC - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments allow a network device whose hardware limits an Association Number (AN) to only {0, 1}, to be part of Media Access Control security (MACsec). Upon detecting a network device as being AN-limited, that device's priority value is assigned a maximum value, thereby ensuring election of the AN-limited device as the key server. The {0, 1} AN of the key server is used to generate a Secure Association Key (SAK) used for MACsec. Upon subsequent rekeying, the AN-limited key server automatically cycles to a next AN (either 0 or 1) to generate a new SAK, where that next AN is also recognized by other network devices. In this manner, the AN-limited network device can participate in the MACsec without encountering ANs (e.g., {2, 3}) that it does not recognize. ## Claims ### Claim 1 A method performed by a peer device in a Media Access Control Security (MACsec) group, the method comprising: detecting that the peer device only supports a two-valued association number (AN) with which to identify secure association keys (SAKs), the two-valued AN being either a first value or a second value; in response to detecting that the peer device only supports the two-valued AN, setting a key server priority of the peer device to a highest priority; participating in a key server election with other peer devices in the MACsec group; and while acting as a key server of the MACsec group: generating a sequence of SAKs, wherein each generated SAK is identified by the two-valued AN, wherein a newly generated SAK in the sequence of SAKs is identified by the two-valued AN being set to the second value when a SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to the first value, and wherein the newly generated SAK is identified by the two-valued AN being set to the first value when the SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to the second value; and distributing each generated SAK and the two-valued AN that identifies the generated SAK to the other peer devices in the MACsec group. ### Claim 2 (depends on 1) The method of claim 1, wherein each SAK in the sequence of SAKs is generated and distributed in response to occurrence of a rekey event. ### Claim 3 (depends on 1) The method of claim 1, wherein the peer device, acting as the key server: generates a first SAK; distributes both the first SAK and the two-valued AN being set to the first value to the other peer devices in the MACsec group; generates a second SAK at a time subsequent to distributing the first SAK; distributes both the second SAK and the two-valued AN being set to the second value, to the other peer devices in the MACsec group; generates a third SAK at a time subsequent to distributing the second SAK; and distributes both the third SAK and the two-valued AN being set to the first value, to the other peer devices in the MACsec group. ### Claim 4 (depends on 3) The method of claim 3, wherein the second SAK is generated in response to occurrence of a first rekey event, wherein the third SAK is generated in response to occurrence of a second rekey event. ### Claim 5 (depends on 1) The method of claim 1, wherein the first value is ‘0’ and the second value is ‘1’. ### Claim 6 (depends on 1) The method of claim 1, wherein the peer device is elected as the key server based upon the key server priority. ### Claim 7 (depends on 6) The method of claim 6, wherein election of the peer device as the key server is further based upon a Secure Channel Identifier (SCI). ### Claim 8 A network device comprising: one or more hardware processors; and a computer-readable storage medium comprising instructions for controlling the one or more hardware processors to: detect that the network device only supports a two-valued association number (AN) of ‘0’ or ‘1’ with which to identify secure association keys (SAKs); in response to detecting that the network device only supports the two-valued AN, set a key server priority of the network device to a highest priority; cause the network device to participate in a key server election with other peer devices in a Media Access Control Security (MACsec) group; and while acting as a key server of the MACsec group: generate a sequence of SAKs, wherein each generated SAK is identified by the two-valued AN, wherein a newly generated SAK in the sequence of SAKs is identified by the two-valued AN being set to ‘1’ when a SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to ‘0’, and wherein the newly generated SAK is identified by the two-valued AN being set to ‘0’ when the SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to ‘1’; and distribute each generated SAK and the two-valued AN that identifies the generated SAK to the other peer devices in the MACsec group. ### Claim 9 (depends on 8) The network device of claim 8, wherein each SAK in the sequence of SAKs is generated and distributed in response to occurrence of a rekey event. ### Claim 10 (depends on 8) The network device of claim 8, wherein the peer device, acting as the key server: generates a first SAK; distributes both the first SAK and the two-valued AN being set to the first value to the other peer devices in the MACsec group; generates a second SAK at a time subsequent to distributing the first SAK; distributes both the second SAK and the two-valued AN being set to the second value, to the other peer devices in the MACsec group; generates a third SAK at a time subsequent to distributing the second SAK; and distributes both the third SAK and the two-valued AN being set to the first value, to the other peer devices in the MACsec group. ### Claim 11 (depends on 10) The network device of claim 10, wherein the second SAK is generated in response to occurrence of a first rekey event, wherein the third SAK is generated in response to occurrence of a second rekey event. ### Claim 12 (depends on 8) The network device of claim 8, wherein the peer device is elected as the key server based upon the key server priority. ### Claim 13 A non-transitory machine-readable medium storing a program executable by at least one processing unit of a network device, the program comprising sets of instructions for: detecting that the network device only supports a two-valued association number (AN) with which to identify secure association keys (SAKs), the two-valued AN being only a first value or a second value; in response to detecting that the network device only supports the two-valued AN, setting a key server priority of the network device to a highest priority; participating in a key server election with other peer devices in a Media Access Control Security (MACsec) group; and while acting as a key server of the MACsec group: generating a sequence of SAKs, wherein each generated SAK is identified by the two-valued AN, wherein a newly generated SAK in the sequence of SAKs is identified by the two-valued AN being set to the second value when a SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to the first value, and wherein the newly generated SAK is identified by the two-valued AN being set to the first value when the SAK generated immediately prior to the newly generated SAK is identified by the two-valued AN being set to the second value; and distributing each generated SAK and the two-valued AN that identifies the generated SAK to the other peer devices in the MACsec group, wherein each SAK in the sequence of SAKs is generated and distributed in response to occurrence of a rekey event. ### Claim 14 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the first value is ‘0’ and the second value is ‘1’. ### Claim 15 (depends on 1) The non-transitory machine-readable medium of claim 1, wherein the peer device, acting as the key server: generates a first SAK; distributes both the first SAK and the two-valued AN being set to the first value to the other peer devices in the MACsec group; generates a second SAK at a time subsequent to distributing the first SAK; distributes both the second SAK and the two-valued AN being set to the second value, to the other peer devices in the MACsec group; generates a third SAK at a time subsequent to distributing the second SAK; and distributes both the third SAK and the two-valued AN being set to the first value, to the other peer devices in the MACsec group. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the second SAK is generated in response to occurrence of a first rekey event, wherein the third SAK is generated in response to occurrence of a second rekey event. ### Claim 17 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the peer device is elected as the key server based upon the key server priority.