# US 8,752,131 B2 · Facilitating protection of a maintenance entity group > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,131 B2 - Document ID: US8752131B2 - Status: Granted - Kind: B2 - Application number: 12/112,044 - Filed: 2008-04-30 - Published: 2009-11-05 - Granted: 2014-06-10 - Earliest claimed: 2008-04-30 - Assignees: Fujitsu Limited - Applicants: Donald C. O'Connor - Inventors: Donald C. O'Connor - Web page: https://patentgrep.com/patent/US8752131B2 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract According to one embodiment, maintenance points of a maintenance entity group are identified. The maintenance points comprise end points and intermediate points. A secure connectivity association set is established for the maintenance points. The following is performed for each frame of a number of frames: determining security data of the secure connectivity association set; placing the security data into a frame; and communicating the frame to a maintenance point. The maintenance point is configured to determine whether a frame is acceptable from the security data of the frame. ## Claims ### Claim 1 A method comprising: identifying a plurality of maintenance points of a maintenance entity group, the plurality of maintenance points comprising a plurality of end points and one or more intermediate points; establishing a Media Access Control Security (MACSec) connectivity association set for the plurality of maintenance points of the maintenance entity group, wherein establishing the MACSec connectivity association set comprises establishing a secure channel between each end point and associated end points and intermediate points and establishing a secure channel between each intermediate point and associated end points; and performing the following for each frame of a plurality of frames: determining security data of the MACSec connectivity association set, the security data facilitating determination of whether the each frame is acceptable; placing the security data into the each frame; encoding one or more parameters in a security tag of the each frame, the one or more parameters selected from a group consisting of: a maintenance entity level encoded in a secure association number field of the security tag, a maintenance entity group identifier encoded in a secure channel identifier field of the security tag, and a maintenance end point identifier encoded in the secure channel identifier field of the security tag; and communicating the frame to a maintenance point, the maintenance point configured to determine whether the each frame is acceptable from the security data. ### Claim 2 (depends on 1) The method of claim 1: the determining the security data of the MACSec connectivity association set further comprising: calculating an integrity check variable; and the placing the security data into the each frame further comprising: placing the integrity check variable into the frame. ### Claim 3 (depends on 1) The method of claim 1, the determining the security data of the MACSec connectivity association set further comprising: calculating an integrity check variable according to content of the frame, a key, and a cipher suite algorithm. ### Claim 4 (depends on 1) The method of claim 1, the each maintenance point configured to determine whether the frame is acceptable by: calculating an integrity check variable according to content of the frame, a key, and a cipher suite algorithm; and comparing the calculated integrity check variable with a received integrity check variable received in the frame. ### Claim 5 (depends on 1) The method of claim 1: the determining the security data of the MACSec connectivity association set further comprising: determining a packet number for the frame; and the placing the security data into the each frame further comprising: placing the packet number into the frame. ### Claim 6 (depends on 1) The method of claim 1, the each maintenance point configured to determine whether the frame is acceptable by: checking a packet number of the frame to determine if the frame is in the correct sequence. ### Claim 7 (depends on 1) The method of claim 1, further comprising: encrypting data of the frame according to a key and a cipher suite algorithm. ### Claim 8 (depends on 1) The method of claim 1, the each maintenance point further configured to: decrypt data of the frame according to a key and a cipher suite algorithm. ### Claim 9 (depends on 1) The method of claim 1, the each maintenance point configured to respond to the frame, the frame determined to be unacceptable, by performing one or more responses selected from a group consisting of a plurality of responses: ignore the packet; discard the packet; maintain a count of one or more packet security failures; maintain a log of one or more packet security failures; and generate an alarm. ### Claim 10 (depends on 1) The method of claim 1, further comprising: using a secure association number to distinguish between the frame and a secure data frame, the frame comprising a secure Operations, Administration, and Maintenance frame. ### Claim 11 One or more non-transitory computer-readable tangible media encoding software configured to, when executed: identify a plurality of maintenance points of a maintenance entity group, the plurality of maintenance points comprising a plurality of end points and one or more intermediate points; establish a Media Access Control Security (MACSec) connectivity association set for the plurality of maintenance points of the maintenance entity group, wherein establishing the MACSec connectivity association set comprises establishing a secure channel between each end point and associated end points and intermediate points and establishing a secure channel between each intermediate point and associated end points; and perform the following for each frame of a plurality of frames: determine security data of the MACSec connectivity association set, the security data facilitating determination of whether the each frame is acceptable; place the security data into the each frame; encode one or more parameters in a security tag of the each frame, the one or more parameters selected from a group consisting of: a maintenance entity level encoded in a secure association number field of the security tag, a maintenance entity group identifier encoded in a secure channel identifier field of the security tag, and a maintenance end point identifier encoded in the secure channel identifier field of the security tag; and communicate the frame to a maintenance point, the maintenance point configured to determine whether the each frame is acceptable from the security data. ### Claim 12 (depends on 11) The non-transitory computer-readable tangible media of claim 11, the software further configured to: determine the security data of the MACSec connectivity association set by: calculating an integrity check variable; and place the security data into the each frame by: placing the integrity check variable into the frame. ### Claim 13 (depends on 11) The non-transitory computer-readable tangible media of claim 11, the software further configured to determine the security data of the MACSec connectivity association set by: calculating an integrity check variable according to content of the frame, a key, and a cipher suite algorithm. ### Claim 14 (depends on 11) The non-transitory computer-readable tangible media of claim 11, the each maintenance point configured to determine whether the frame is acceptable by: calculating an integrity check variable according to content of the frame, a key, and a cipher suite algorithm; and comparing the calculated integrity check variable with a received integrity check variable received in the frame. ### Claim 15 (depends on 11) The non-transitory computer-readable tangible media of claim 11, the software further configured to: determine the security data of the MACSec connectivity association set by: determining a packet number for the frame; and place the security data into the each frame by: placing the packet number into the frame. ### Claim 16 (depends on 11) The non-transitory computer-readable tangible media of claim 11, the each maintenance point configured to determine whether the frame is acceptable by: checking a packet number of the frame to determine if the frame is in the correct sequence. ### Claim 17 (depends on 11) The non-transitory computer-readable tangible media of claim 11, the software further configured to: encrypt data of the frame according to a key and a cipher suite algorithm. ### Claim 18 (depends on 11) The non-transitory computer-readable tangible media of claim 11, the each maintenance point further configured to: decrypt data of the frame according to a key and a cipher suite algorithm. ### Claim 19 (depends on 11) The non-transitory computer-readable tangible media of claim 11, the each maintenance point configured to respond to the frame, the frame determined to be unacceptable, by performing one or more responses selected from a group consisting of a plurality of responses: ignore the packet; discard the packet; maintain a count of one or more packet security failures; maintain a log of one or more packet security failures; and generate an alarm. ### Claim 20 (depends on 11) The non-transitory computer-readable tangible media of claim 11, the software further configured to: use a secure association number to distinguish between the frame and a secure data frame, the frame comprising a secure Operations, Administration, and Maintenance frame.