} v & Ç l > E } v µ o ] v P >>...

15
Ethernet -Traffic Flow Security Don Fedyk LabN Consulting LLC. 5/22/2019 1

Transcript of } v & Ç l > E } v µ o ] v P >>...

Page 1: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

Ethernet -Traffic Flow Security

Don Fedyk LabN Consulting LLC.

5/22/2019 1

Page 2: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

Rational

• Privacy is increasingly important with network growth and dependency on data networks increases.

• Implement methods to improve Privacy for IEEE 802.1 MACsec and for Ethernet Data Encryption devices.

• Forming or joining a project to standardize a service format to address Privacy and enable fixed frames as well as variable frames.

5/22/2019 2

Page 3: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

What we want to do:

• Improve Privacy in MACsec by Moving Identifiable Information into the Secure Encrypted part of the frame.

• Anonymize the frame behavior by:• Create a tunnel MAC SA/DA for a set of flows. • Hide MAC SA/DA using 802.1 AE MACsec secure data• Tunnel frames constructed with a uniform size• Bandwidth efficiency

• Aggregate frames in a single tunnel frame• Fragment user frames within a tunnel frame

• Send frames at regular intervals even if there is no data

• Build on MACsec EDEs

Increasingcomplexity

Varying Efficiency

5/22/2019 3

Page 4: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

Existing MACsec Frame (IEEE 802.1AE)

DA SA SecTag Secure Data ICV

User Data

VLAN TAG User Data

Priority

TAG

Priority copied from Inner Tag to Outer Tag

Identifiable information

Priority

5/22/2019 4

Page 5: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

VLAN TAG User Data 2DA SA

Functional ETT MACsec Frame

ETT DA ETT SA SecTag Secure Data ICV

MTDU (User Data)

VLAN TAG User Data 1

Priority

VLANTag

Moved Fields

DA SAETT EtherTypeEthernet Tunnel

Ethernet Transport Tunnel Destination/Source address

New Ethernet Transport Tunnel Fields

Red Network DA/SA

MTDU-TAG

5/22/2019 5

Page 6: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

EtherTypeS-TAG

EtherTypeC-TAG

SADA

EtherType

Length

Summary of Ethernet Headers

5/22/2019 6

EtherTypeSADA

User Data EtherType

SADA

User Data

C-TAGEtherType

EtherType

SADA

S-TAGEtherType

EtherType

User Data

C-TAG

EtherType

B-SAB-DA

S-TAG

EtherType

EtherType

User Data

C-TAG

B-TAG

I-TAGEtherType

SADA

SADA

EtherTypeSec-TAG

EtherType

EtherTypeC/S-TAG

SA/B-SADA/B-DA

EtherTypeS/B-TAG

EtherTypeSec-TAG

EtherTypeC-TAG

User Data

EtherTypeS-TAG

EtherTypeC-TAG

SADA

EtherType

EtherType EtherTypeMTDU-TAG

Length

One OrMoreData PDUs

802.1 802.1Q 802.1ad 802.1ah 802.1AE E-TFS (proposal)

User DataUser Data

MACsecEncrypted

Page 7: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

Ethernet Transport Tunnels on Ethernet Data Encryption devices

Red Network

Red Network

Red Network

Black Network

EDE

EDE

EDE

Unidirectional Ethernet Transport Tunnels (ETTs)

5/22/2019 7

Page 8: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

data

EDE-CC Today

5/22/2019

B1

B2

SecTag DA SAC-Tag

DA SAC-Tagdata

SecTag DA SAC-Tag

B3

B1,B2

B1,B3

Red - Side

BridgedNetwork

EDE-CC

EDE-CC

EDE-CC

Customer Edge Port

Provider Edge Port

Customer Network Port

Provider Network Port

Black - SideBlack - Side Red - Side

Etype

C-Tag Etype

data

Page 9: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

data or MTDU

data or MTDU

EDE-CC with E-TFS

5/22/2019

B1

B2

DA SA SecTag DA SA

DA SAC-Tagdata

SecTag DA SAC-Tag

B3

B1,B2

B1,B3

Red - Side

BridgedNetwork

EDE-CC

EDE-CC

EDE-CC

Customer Edge Port

Provider Edge Port

Customer Network Port

Provider Network Port

Black - SideBlack - Side Red - Side

Etype

DA SAC-Tag Etype

C-Tag

Page 10: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

High Level Requirements

• The solution must not limit EDE/802.1AE functionality, notably mapping of VLANs and priorities and possible support for multiple SecYs.

• Red-side host and control addresses must not be exposed on the black-side/insecure port

• The solution must not significantly impact network bandwidth availability or unbounded impact on network latency

• The solution should allow for different implementation/deployment choices related to a specific deployment fixed frame size or transmission data rate.

• Solution should minimize required configuration, e.g., minimize the receiver configuration.

5/22/2019 10

Page 11: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

Existing MAC Security Tag SecTag

MACsec EtherType TCI SCIAN SL PN

2 octets

1 octets

1 octets

4 octets

8 Octets (optional)

1 0 0 0 1 0 0 0 1 1 1 0 0 1 0 1

V=0 ES SC SCB SH E AN0 0 SL

Secure Data

5/22/2019 11

Page 12: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

MAC Security Tag with MTDU (Only data MTU changes)

Sec EtherType TCI SCIAN SL PN

2 octets

1 octets

1 octets

4 octets

8 Octets (optional)

V=0 ES SC SCB SH E AN0 0 SL

MDTU

MAC Tunnel Data Unit is the generic new format for secure data

New/Modified Field

1 0 0 0 1 0 0 0 1 1 1 0 0 1 0 1

5/22/2019 12

Page 13: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

New MAC Tunnel Data Units (MTDU)

ETT EtherType Offset Data Block Optional more Data Blocks

Length MSDU (TAGs and Original User Data)DA SA

Original MAC Frame

MACsec Secure Data Unit

New/Modified Field

5/22/2019 13

Page 14: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

References

[1] IEEE Std 802.1AE-2018, IEEE Standard for Local and Metropolitan Area Networks: Media Access Control (MAC) Security. [2] Mick Seaman, Privacy considerations in bridged networks, White Paper http://www.ieee802.org/1/files/public/docs2018/e-seaman-privacy-in-bridged-networks-1018-v01.pdfChris Hopps, “IP Traffic Flow Security”, draft-chopps-ipsecme-iptfs-00, Feb 2019.

5/22/2019 14

Page 15: } v & Ç l > E } v µ o ] v P >> Xgrouper.ieee.org/groups/802/1/files/public/docs2019/new-fedyk-traffi… · Z d Ç ^ rd ' Z d Ç rd ' ^ Z d Ç > v P Z. Z v d v } d µ v v o } v Z

GlossaryDA - Destination Address

E - E-bit encryption set bit

EDE - Ethernet Data Encryption device

EDE-CC - Ethernet Data Encryption device with red-side recognition of C-TAGs and black-side addition and removal of C-TAGs

EDE-CS - Ethernet Data Encryption device with red-side recognition of C-TAGs and black-side addition and removal of S-TAGs

EDE-M - VLAN-unaware Ethernet Data Encryption device operating as a Customer Bridge

EDE-SS - Ethernet Data Encryption device with red-side recognition of S-TAGs and black-side addition and removal of S-TAGs

EISS - Enhanced Internal Sublayer Service

ES - End Station Bit

E-TFS – Ethernet Traffic Flow Security

ETT – Ethernet Transport Tunnels

FCS - frame check sequence

ICV - integrity check value

IPsec - Internet Protocol Security

MAC - Media Access Control

MACsec - Media Access Control Security

MTDU – MAC Tunnel Data Unit

MTDU-TAG – MAC Tunnel Data Unit – New Tag for discussion

MSDU – MACsec Service Data Unit

MSTP - Multiple Spanning Tree Protocol

PCP - Priority Code Point (IEEE Std 802.1Q)

PN - Packet Number

SA - Secure Association or Source Address, as applicable

SAI - Secure Association Identifier

SC – Secure Channel

SCB - Single Copy BroadcastSCISecure Channel Identifier

SecTAG - MAC Security TAGSecYMAC Security Entity

SL - Short Length

5/22/2019 15


W> ^ WZ/Ed W ] v , ] } Ç Y µ ] } v v ] W Z } } z z z z z z ... · ,/W W ] À Ç W } o ] Ç / l v } Á o P Z u Ç u ] o Z ] } Ç u Ç } } v o ] v Z } µ P Z D o o Ç [ } u µ Ç

W> ^ WZ/Ed W ] v , ] } Ç Y µ ] } v v ] W Z } } z z z z z z ... · ,/W W ] À Ç W } o ] Ç / l v } Á o P Z u Ç u ] o Z ] } Ç u Ç } } v o ] v Z } µ P Z D o o Ç [ } u µ Ç

Á ( ] o ] Ç Z }€¦ · î ì î ì D ' Z t Á ( ] o ] Ç Z } ð ì õ> Ç v v l ] v Ç Z o ] D ^ o ] l t P

Á ( ] o ] Ç Z }€¦ · î ì î ì D ' Z t Á ( ] o ] Ç Z } ð ì õ> Ç v v l ] v Ç Z o ] D ^ o ] l t P

Æ o } W W r, o Z / v ( } u } v r W Z Ç ] o d Z Ç ~Wd ... · W r, o Z / v ( } u } v r W Z Ç ] o d Z Ç ~Wd ^ Z } } o Æ o } D } À } v ( } u ] ] v l ...

Æ o } W W r, o Z / v ( } u } v r W Z Ç ] o d Z Ç ~Wd ... · W r, o Z / v ( } u } v r W Z Ç ] o d Z Ç ~Wd ^ Z } } o Æ o } D } À } v ( } u ] ] v l ...

P } Ç Z v l t ] v v · 2020. 7. 20. · Z v } u } µ } µ o ] Ç } ( z } P ] v ^ Ç Z o o X d Z } v Á Z o ] v ò P } ] W r z } µ Z D o U

P } Ç Z v l t ] v v · 2020. 7. 20. · Z v } u } µ } µ o ] Ç } ( z } P ] v ^ Ç Z o o X d Z } v Á Z o ] v ò P } ] W r z } µ Z D o U

, } Á u v Ç u o } Ç } t Z v P } ( Z } u o } Ç v t ] Z } µ ] ] } v …...Z ] o Z o v ò õ ñ 9 õ ñ 9 ñ Á l u Ç Á ] v Z Z v P ] À v } Á í } P v ] Ì ] } v v } v r } (

, } Á u v Ç u o } Ç } t Z v P } ( Z } u o } Ç v t ] Z } µ ] ] } v …...Z ] o Z o v ò õ ñ 9 õ ñ 9 ñ Á l u Ç Á ] v Z Z v P ] À v } Á í } P v ] Ì ] } v v } v r } (

] v µ P Z Z ] o v [ , } ] o Z ] Ç d µ [ Z } v } µ v z ... · Z ] o v v Ç } µ v P } o [ o ] À o ] v µ Ç ] o o v X

] v µ P Z Z ] o v [ , } ] o Z ] Ç d µ [ Z } v } µ v z ... · Z ] o v v Ç } µ v P } o [ o ] À o ] v µ Ç ] o o v X

, À Ç } µ ~ } Z Ç ] Ç } µ ~ } Æ ] v , Z Z v P } Z , Z v ......, o Z } Ç } µ ( ] o o ] v P Z ] µ À Ç ] v } µ , o Z } Ç } µ ( ] o o ] v P Z ] µ À Ç ] v } µ

, À Ç } µ ~ } Z Ç ] Ç } µ ~ } Æ ] v , Z Z v P } Z , Z v ......, o Z } Ç } µ ( ] o o ] v P Z ] µ À Ç ] v } µ , o Z } Ç } µ ( ] o o ] v P Z ] µ À Ç ] v } µ

u o } Ç [ Z } > } P · d Z u o } Ç u Ç U µ v ^ ] } v î ï } ( Z E ] } v o D ] v ] u µ u t P U î ì ì ì U µ ( } u Z u o } Ç Á ] v u v } ( Z u o } Ç [ À P Z } µ o Ç

u o } Ç [ Z } > } P · d Z u o } Ç u Ç U µ v ^ ] } v î ï } ( Z E ] } v o D ] v ] u µ u t P U î ì ì ì U µ ( } u Z u o } Ç Á ] v u v } ( Z u o } Ç [ À P Z } µ o Ç

Ç v ^ v µ Z } ] Ç } ( / v ] ^ µ } Ç µ Z } ] Ç µ v D ] v ] Ç } ( , o Z & u ] o ... · 2020. 7. 31. · W P î } ( ï ï } v } ( } P } u v ] } v &^^ / t Z r ì í l î ì î

Ç v ^ v µ Z } ] Ç } ( / v ] ^ µ } Ç µ Z } ] Ç µ v D ] v ] Ç } ( , o Z & u ] o ... · 2020. 7. 31. · W P î } ( ï ï } v } ( } P } u v ] } v &^^ / t Z r ì í l î ì î

Brochure€¦ · /(Ç}µ vv} Z µ i Ç}µÁ] Z } µ Ç]v Z] o] U o } }v µ XdZ ] v Æ oo v Zv Z Á Á]oo o } vP }µ (} Ç}µ]v Ç}µ Z} v. o } ( µ ÇX u] W }P uu t Z}À Á v Ç ]+

Brochure€¦ · /(Ç}µ vv} Z µ i Ç}µÁ] Z } µ Ç]v Z] o] U o } }v µ XdZ ] v Æ oo v Zv Z Á Á]oo o } vP }µ (} Ç}µ]v Ç}µ Z} v. o } ( µ ÇX u] W }P uu t Z}À Á v Ç ]+

o E v } o Ì u v v D Z ] v · 2021. 3. 5. · d Z , o u Z } o Ì & v P Ç } ( ^ Ç u Ç u Z o ] ( ] u µ v v o Ç À Ç ] v P Z Á Z ] Z ] À ] ] Z À ] } µ U }

o E v } o Ì u v v D Z ] v · 2021. 3. 5. · d Z , o u Z } o Ì & v P Ç } ( ^ Ç u Ç u Z o ] ( ] u µ v v o Ç À Ç ] v P Z Á Z ] Z ] À ] ] Z À ] } µ U }

Z Z ] µ º ] l È ! v u Ç v Z Æ Z ¸ Z ¥ v d ] v Z ¸ ¢ ] Ç ... · D o À D ,Wd ! v ,W> } ¢ ] o À ' Z ] Z ·^ddD ^s, ¸ À ! vE P Ç ] v Z> À ^s E P Ç Z ]W Z ~ v P

Z Z ] µ º ] l È ! v u Ç v Z Æ Z ¸ Z ¥ v d ] v Z ¸ ¢ ] Ç ... · D o À D ,Wd ! v ,W> } ¢ ] o À ' Z ] Z ·^ddD ^s, ¸ À ! vE P Ç ] v Z> À ^s E P Ç Z ]W Z ~ v P

d } o Ç W ] u Ç ^ Z } } o t l ó z ï t v Ç v Á · , } Á u µ Z u } v Ç } Z Ç Z À o } P Z M v v o o µ Ç ( } ¬ ò v ñ ì X ^ Z o } µ Ç l Ç ] v P X

d } o Ç W ] u Ç ^ Z } } o t l ó z ï t v Ç v Á · , } Á u µ Z u } v Ç } Z Ç Z À o } P Z M v v o o µ Ç ( } ¬ ò v ñ ì X ^ Z o } µ Ç l Ç ] v P X

t Z P Ç Á Z ( } P } o ( } v & ] Ç U } o Ç } v } ( Z Ç } o ...

t Z P Ç Á Z ( } P } o ( } v & ] Ç U } o Ç } v } ( Z Ç } o ...

u ] ] } v W } o ] Ç ( } v Ç } d Z : } Z v t v ^ Z } } o ...€¦ · í } ( ò n W P u ] ] } v W } o ] Ç ( } v Ç } d Z : } Z v t v ^ Z } } o ( } Z ... This form should be completed

u ] ] } v W } o ] Ç ( } v Ç } d Z : } Z v t v ^ Z } } o ...€¦ · í } ( ò n W P u ] ] } v W } o ] Ç ( } v Ç } d Z : } Z v t v ^ Z } } o ( } Z ... This form should be completed

Yost - Whole Foods...d Z ] } µ u v ] } ] Ç v } v ( ] v ] o X E } } ( Z ] } µ u v u Ç ] o } ] v v Ç u v v } Z ] Ç Á ] Z } µ Z ] } Á ] v } v v } ( t Z } o & } } D l X

Yost - Whole Foods...d Z ] } µ u v ] } ] Ç v } v ( ] v ] o X E } } ( Z ] } µ u v u Ç ] o } ] v v Ç u v v } Z ] Ç Á ] Z } µ Z ] } Á ] v } v v } ( t Z } o & } } D l X

*ROGPDQ ,V * : } µ v Ç } ( Z ^ } µ o X...i } ] v ( } Á ] Z ^ v X t Z Ç } , o o } Á o o Z ] o u ] ( } µ v } ( o o µ M v Ç U Á l v } Á Z Z o o Ç v µ o Ç } o } À µ X

*ROGPDQ ,V * : } µ v Ç } ( Z ^ } µ o X...i } ] v ( } Á ] Z ^ v X t Z Ç } , o o } Á o o Z ] o u ] ( } µ v } ( o o µ M v Ç U Á l v } Á Z Z o o Ç v µ o Ç } o } À µ X

Learn Angular 2 · d Z Á Ç } o v v Ç v Á Z v } o } P Ç ] Ç ] v P } i X ^ } ] v Z ] Ç ]

Learn Angular 2 · d Z Á Ç } o v v Ç v Á Z v } o } P Ç ] Ç ] v P } i X ^ } ] v Z ] Ç ]

zE u ^ ] } µ v Ç ^ ] d Ç d v } v } µ v Ç , ^€¦ · o l & } Æ o u v Ç o Ç } µ v Ç rZ ] l ( Z } } o v & ] À ] Á } Ç v ' ] o o µ ^ } } µ v Ç rZ ] l ( Z } } o v

zE u ^ ] } µ v Ç ^ ] d Ç d v } v } µ v Ç , ^€¦ · o l & } Æ o u v Ç o Ç } µ v Ç rZ ] l ( Z } } o v & ] À ] Á } Ç v ' ] o o µ ^ } } µ v Ç rZ ] l ( Z } } o v

} Tc Ð T V e ¥ þ T V e ¥ r > I y q s Ò r > s Ò k z º ¥ { - s Q ^ Ç ç * Ò ¥ { - s k z ^ Ç ç - o 8 7 þ T V e ¥ Ç £ k z º Ç £ k z q V V ¥ T V e ¥ Ç £ q V V ¥

} Tc Ð T V e ¥ þ T V e ¥ r > I y q s Ò r > s Ò k z º ¥ { - s Q ^ Ç ç * Ò ¥ { - s k z ^ Ç ç - o 8 7 þ T V e ¥ Ç £ k z º Ç £ k z q V V ¥ T V e ¥ Ç £ q V V ¥