Virtual Secure Link over Software-Defined Bridged Networks

Ethernet can transfer massive data stream flows as well as real-time flows supported by Time-Sensitive Network (TSN). The MAC layer security, MACsec, is defined at IEEE Std 802.1AE and IEEE Std 802.1X. However, a security association established by MACsec protects the communication among devices within single LAN at bridged networks. Therefore, a packet traversing several LANs must be decrypted and re-encrypted at each bridge. We propose a new virtual secure link over the Software-Defined Bridged Networks (SDBN). In SDBN, end-devices interact with the central MACsec module, running over the SoftwareDefined Network (SDN) controller, using the standard MACsec procedure. The central MACsec module recognizes a group of devices at the bridged networks regardless of their attached LANs. These devices are treated as they are attached to the same virtual link. The proposed scheme supports end-to-end unicast/multicast secure communication without any modification of the current MACsec standards as well as eliminating the security operation required at bridges in bridged networks.