Configuring connectivity association key and connectivity association name in a media access control security capable device

Patent metadata

Field	Value
Publication number	US-10686595-B2
Application number	US-201715816400-A
Country	US
Kind code	B2
Filing date	Nov 17, 2017
Priority date	Nov 17, 2017
Publication date	Jun 16, 2020
Grant date	Jun 16, 2020

Abstract

Examples disclosed herein relate to configuring a connectivity association key and a connectivity association name in a MACsec capable device. In an example, a first MACsec device may receive a MAC address and a device identifier of a second MACsec capable device. First MACsec capable device may authenticate the second MACsec capable device based on the device identifier. First MACsec capable device may generate a CAK, a CKN, and a nonce. The CAK, the CKN, and the nonce may be encrypted using a public key of the second MACsec capable device to generate an encrypted packet. The encrypted packet may be sent to the second MACsec capable device. The first MACsec capable device may receive a decrypted nonce from the second MACsec capable device. In response to a determination that the decrypted nonce matches with the nonce, CAK and CKN may be configured on first MACsec capable device.

First claim

The invention claimed is:

1. A method comprising:
receiving, by a first Media Access Control Security (MACsec) device, a MAC address and a device identifier of a second MACsec capable device from the second MACsec capable device;
authenticating, by the first MACsec capable device, the second MACsec capable device based on the device identifier of the second MACsec capable device;
generating, by the first MACsec capable device, a Connectivity Association Key (CAK), a Connectivity Association Name (CKN), and a nonce;
encrypting, by the first MACsec capable device, the CAK, the CKN, and the nonce using a public key of the second MACsec capable device to generate an encrypted packet;
sending, by the first MACsec capable device, the encrypted packet to the second MACsec capable device, wherein the encrypted packet is useable by the second MACsec capable device to configure the CAK and the CKN on the second MACsec capable device by decrypting the encrypted packet using a private key corresponding to the public key of the second MACsec capable device;
receiving, by the first MACsec capable device, a decrypted nonce from the second MACsec capable device, wherein the decrypted nonce is generated by decrypting the encrypted packet using the private key corresponding to the public key of the second MACsec capable device;
comparing, by the first MACsec capable device, the decrypted nonce from the second MACsec capable device with the nonce on the first MACsec capable device; and
in response to a determination that the decrypted nonce matches with the nonce, configuring, by the first MACsec capable device, the CAK and the CKN on the first MACsec capable device.

2. The method of claim 1 , further comprising:
establishing, by the first MACsec capable device, a MACsec session with the second MACsec capable device.

3. The method of claim 1 , further comprising:
providing, by the first MACsec capable device, a MAC address and a device identifier of the first MACsec capable device to the second MACsec capable device, wherein the MAC address and the device identifier of the first MACsec capable device is usable by the second MACsec capable device to authenticate the first MACsec capable device.

4. The method of claim 1 , wherein encrypting comprises:
extracting, by the first MACsec capable device, the public key from the device identifier of the second MACsec capable device.

5. The method of claim 1 , wherein generating comprises:
comparing, by the first MACsec capable device, the MAC address of the first MACsec capable device with the MAC address of the second MACsec capable device; and
in response to a determination that the MAC address of the first MACsec capable device is lower than the MAC address of the second MACsec capable device, generating, by the first MACsec capable device, the CAK, the CKN, and the nonce.

6. The method of claim 1 , wherein the device identifier of the first MACsec capable device is a digital certificate of the first MACsec capable device and wherein the device identifier of the second MACsec capable device is a digital certificate of the second MACsec capable device.

7. A Media Access Control Security (MACsec) device comprising:
a processing resource; and
a non-transitory machine readable medium comprising instructions, the instructions executable by a processor to:
receive a MAC address and a device identifier of a second MACsec capable device from the second MACsec capable device;
authenticate the second MACsec capable device based on the device identifier of the second MACsec capable device;
generate a Connectivity Association Key (CAK), a Connectivity Association Name (CKN), and a nonce;
encrypt the CAK, the CKN, and the nonce using a public key of the second MACsec capable device to generate an encrypted packet;
send the encrypted packet to the second MACsec capable device, wherein the encrypted packet is useable by the second MACsec capable device to configure the CAK and the CKN on the second MACsec capable device by decrypting the encrypted packet using a private key corresponding to the public key of the second MACsec capable device;
receive a decrypted nonce from the second MACsec capable device, wherein the decrypted nonce is generated by decrypting the encrypted packet using the private key corresponding to the public key of the second MACsec capable device;
compare the decrypted nonce from the second MACsec capable device with the nonce on the MACsec capable device;
configure the CAK and the CKN on the MACsec capable device, in response to a determination that the decrypted nonce matches with the nonce; and
establish a MACsec session with the second MACsec capable device.

8. The device of claim 7 , wherein the public key is present in the device identifier of the second MACsec capable device.

9. The device of claim 7 , wherein the installation engine is to establish the MACsec session by initiating MACsec key agreement protocol with the second MACsec capable device.

10. The device of claim 7 , wherein the decrypted nonce is received in plain text.

11. The device of claim 7 , wherein the device identifier of the second MACsec capable device is an IDevID certificate.

12. The device of claim 7 , wherein the second MACsec capable device includes one of a network switch and a network router.

13. A non-transitory machine-readable storage medium comprising instructions, the instructions executable by a processor to:
receive, by a first Media Access Control Security (MACsec) device, a MAC address and a device identifier of a second MACsec capable device from the second MACsec capable device;
authenticate, by the first MACsec capable device, the second MACsec capable device based on the device identifier of the second MACsec capable device;
provide, by the first MACsec capable device, a MAC address and a device identifier of the first MACsec capable device to the second MACsec capable device, wherein the MAC address and the device identifier of the first MACsec capable device is usable by the second MACsec capable device to authenticate the first MACsec capable device;
generate, by the first MACsec capable device, a Connectivity Association Key (CAK), a Connectivity Association Name (CKN), and a nonce;
encrypt, by the first MACsec capable device, the CAK, the CKN, and the nonce using a public key of the second MACsec capable device to generate an encrypted packet;
send, by the first MACsec capable device, the encrypted packet to the second MACsec capable device, wherein the encrypted packet is useable by the second MACsec capable device to configure the CAK and the CKN on the second MACsec capable device by decrypting the encrypted packet using a private key corresponding to the public key of the second MACsec capable device;
receive, by the first MACsec capable device, a decrypted nonce from the second MACsec capable device, wherein the decrypted nonce is generated by decrypting the encrypted packet using the private key corresponding to the public key of the second MACsec capable device;
compare, by the first MACsec capable device, the decrypted nonce from the second MACsec capable device with the nonce on the first MACsec capable device; and
in response to a determination that the decrypted nonce matches with the nonce, configure, by the first MACsec capable device, the CAK and the CKN on the first MACsec capable device.

14. The storage medium of claim 13 , wherein the first MACsec capable device and the second MACsec capable device are point-to-point devices.

15. The storage medium of claim 13 , wherein the instructions to generate comprise instructions to:

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Chimakurthy Sudhir Kumar
• Gali Chaitanya Kumar
• Sridhara Dileep Bangalore

Classifications

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L63/162

  at the data link layer · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0869

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title