Rethinking the link security approach to manage large scale Ethernet network

Abstract

The expansion of Ethernet in service provider domain requires modification of its service models and management issues. Works are underway inside research community, but their main focuses on Quality of Service, failure recovery, scalability, reliable connectivity, resource utilization and traffic monitoring put security in isolation. As developed initially for a shared link communication, Ethernet lacks security feature. Standardized Media Access Control security (MACsec) provides segment-based security. Its link-constrained feature is constructed mainly for scalability, key-agreement simplicity and traffic analysis, but unsupported multi-segment confidentiality and integrity make the MACsec vulnerable and disqualify it for large Ethernet deployment where switches reside outside of secure premises. In this paper we pinpoint vulnerabilities remained in existing mechanism, and further classify security requirements for unicast and multicast frames. Moreover, we present arguments to support our classification and propose new security approaches using existing Ethernet-based protocols. Finally, we evaluate the performance of our secure data transmission.