Secure path determination between devices

A non-transitory machine-readable medium storing instructions executable by a network controller to cause the network controller to:

• determine a secure path between a source device and a destination device, via a plurality of network devices, based on a security capability of each of the plurality of network devices, and wherein:
• the plurality of network devices are part of at least one network including a plurality of other network devices not included in the secure path,
• a plurality of the network devices is selected for the secure path based on having a media access security (MACsec) capability,
• at least one of the network devices is selected from the network devices having the MACsec capability for the secure path based on having a MACsec pass-through capability, and
• the MACsec pass-through capability comprises to parse a frame received from the MACsec capability to determine whether the frame is to be passed through the plurality of the network devices based on a predetermined Ethertype of the frame;
• and
• enable forwarding of data between the source device and the destination device, via the plurality of network devices, based on the determined secure path.

A network controller, comprising:

• a memory access controller to manage a memory storing topology information of a network, the topology information including a plurality of devices in the network and device information, each of the plurality of devices having associated therewith device information;
• a secure path module to:
• determine a secure path between a source device and a destination device, via at least two of the plurality of network devices, based on a security capability of the at least two of network devices, and wherein,
• the network includes a plurality of other network devices not included in the secure path,
• a plurality of the network devices is selected for the secure path based on having a media access security (MACsec) capability,
• a plurality of the network devices is selected from the network devices having the MACsec capability for the secure path based on having a MACsec pass-through capability, and
• the MACsec pass-through capability comprises to parse a frame received from the MACsec capability to determine whether the frame is to be passed through the plurality of the network devices based on a predetermined Ethertype of the frame;
• and
• to enable forwarding of data between the source device and the destination device, via the at least two of network devices, based on the secure path determined by a determination module;
• and
• a processor to execute the determination module and a forwarding module, wherein the network controller is outside of the secure path.