Facilitating Protection Of A Maintenance Entity Group

• US 20090276830A1
• Filed: 04/30/2008
• Published: 11/05/2009
• Est. Priority Date: 04/30/2008
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Network Communications Incorporated (Fujitsu Limited)
• Inventors: O'Connor, Donald C.
• Granted Patent: US 8,752,131 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

According to one embodiment, maintenance points of a maintenance entity group are identified. The maintenance points comprise end points and intermediate points. A secure connectivity association set is established for the maintenance points. The following is performed for each frame of a number of frames: determining security data of the secure connectivity association set; placing the security data into a frame; and communicating the frame to a maintenance point. The maintenance point is configured to determine whether a frame is acceptable from the security data of the frame.

Claims

1. A method comprising:

identifying a plurality of maintenance points of a maintenance entity group, the plurality of maintenance points comprising a plurality of end points and one or more intermediate points;

establishing a secure connectivity association set for the plurality of maintenance points of the maintenance entity group; and

performing the following for each frame of a plurality of frames;

determining security data of the secure connectivity association set, the security data facilitating determination of whether the each frame is acceptable;

placing the security data into the each frame; and

communicating the frame to a maintenance point, the maintenance point configured to determine whether the each frame is acceptable from the security data.

2. The method of claim 1:

the determining the security data of the secure connectivity association set further comprising;

calculating an integrity check variable; and

the placing the security data into the each frame further comprising;

placing the integrity check variable into the frame.

3. The method of claim 1, the determining the security data of the secure connectivity association set further comprising:

calculating an integrity check variable according to content of the frame, a key, and a cipher suite algorithm.

4. The method of claim 1, the each maintenance point configured to determine whether the frame is acceptable by:

calculating an integrity check variable according to content of the frame, a key, and a cipher suite algorithm; and

comparing the calculated integrity check variable with a received integrity check variable received in the frame.

5. The method of claim 1:

the determining the security data of the secure connectivity association set further comprising;

determining a packet number for the frame; and

the placing the security data into the each frame further comprising;

placing the packet number into the frame.

6. The method of claim 1, the each maintenance point configured to determine whether the frame is acceptable by:

checking a packet number of the frame to determine if the frame is in the correct sequence.

7. The method of claim 1, further comprising:

encrypting data of the frame according to a key and a cipher suite algorithm.

8. The method of claim 1, the each maintenance point further configured to:

decrypt data of the frame according to a key and a cipher suite algorithm.

9. The method of claim 1, the each maintenance point configured to respond to the frame, the frame determined to be unacceptable, by performing one or more responses selected from a group consisting of a plurality of responses:

ignore the packet;

discard the packet;

maintain a count of one or more packet security failures;

maintain a log of one or more packet security failures; and

generate an alarm.

10. The method of claim 1, further comprising:

encoding one or more parameters in a security tag of the frame, a parameter selected from a group consisting of the following plurality of parameters;

a maintenance entity level encoded in a secure association number field of the security tag;

a maintenance entity group identifier encoded in a secure channel identifier field of the security tag; and

a maintenance end point identifier encoded in the secure channel identifier field of the security tag.

11. The method of claim 1, further comprising:

using a secure association number to distinguish between the frame and a secure data frame, the frame comprising a secure Operations, Administration, and Maintenance frame.

12. One or more computer-readable tangible media encoding software configured to, when executed:

identify a plurality of maintenance points of a maintenance entity group, the plurality of maintenance points comprising a plurality of end points and one or more intermediate points;

establish a secure connectivity association set for the plurality of maintenance points of the maintenance entity group; and

perform the following for each frame of a plurality of frames;

determine security data of the secure connectivity association set, the security data facilitating determination of whether the each frame is acceptable;

place the security data into the each frame; and

communicate the frame to a maintenance point, the maintenance point configured to determine whether the each frame is acceptable from the security data.

13. The computer-readable tangible media of claim 12, the software further configured to:

determine the security data of the secure connectivity association set by;

calculating an integrity check variable; and

place the security data into the each frame by;

placing the integrity check variable into the frame.

14. The computer-readable tangible media of claim 12, the software further configured to determine the security data of the secure connectivity association set by:

calculating an integrity check variable according to content of the frame, a key, and a cipher suite algorithm.

15. The computer-readable tangible media of claim 12, the each maintenance point configured to determine whether the frame is acceptable by:

calculating an integrity check variable according to content of the frame, a key, and a cipher suite algorithm; and

comparing the calculated integrity check variable with a received integrity check variable received in the frame.

16. The computer-readable tangible media of claim 12, the software further configured to:

determine the security data of the secure connectivity association set by;

determining a packet number for the frame; and

place the security data into the each frame by;

placing the packet number into the frame.

17. The computer-readable tangible media of claim 12, the each maintenance point configured to determine whether the frame is acceptable by:

checking a packet number of the frame to determine if the frame is in the correct sequence.

18. The computer-readable tangible media of claim 12, the software further configured to:

encrypt data of the frame according to a key and a cipher suite algorithm.

19. The computer-readable tangible media of claim 12, the each maintenance point further configured to:

decrypt data of the frame according to a key and a cipher suite algorithm.

20. The computer-readable tangible media of claim 12, the each maintenance point configured to respond to the frame, the frame determined to be unacceptable, by performing one or more responses selected from a group consisting of a plurality of responses:

ignore the packet;

discard the packet;

maintain a count of one or more packet security failures;

maintain a log of one or more packet security failures; and

generate an alarm.

21. The computer-readable tangible media of claim 12, the software further configured to:

encode one or more parameters in a security tag of the frame, a parameter selected from a group consisting of the following plurality of parameters;

a maintenance entity level encoded in a secure association number field of the security tag;

a maintenance entity group identifier encoded in a secure channel identifier field of the security tag; and

a maintenance end point identifier encoded in the secure channel identifier field of the security tag.

22. The computer-readable tangible media of claim 12, the software further configured to:

use a secure association number to distinguish between the frame and a secure data frame, the frame comprising a secure Operations, Administration, and Maintenance frame.

23. A system comprising:

means for identifying a plurality of maintenance points of a maintenance entity group, the plurality of maintenance points comprising a plurality of end points and one or more intermediate points;

means for establishing a secure connectivity association set for the plurality of maintenance points of the maintenance entity group; and

means for performing the following for each frame of a plurality of frames;

determining security data of the secure connectivity association set, the security data facilitating determination of whether the each frame is acceptable;

placing the security data into the each frame; and

communicating the frame to a maintenance point, the maintenance point configured to determine whether the each frame is acceptable from the security data.