Patent ID: 9571283
Date: 2017-02-14
CPC Classifications: H04L,H04W

Claim:
1. A method executed at a single network device, comprising: receiving, at the single network device, unsecured data sent from a source device towards a destination device; generating, at the single network device, packet handling information comprising at least one of a virtual local area network (VLAN) tag or a Multiprotocol Label Switching (MPLS) label from a portion of the unsecured data received from the source device, and wherein the packet handling information includes routing priority information determined based on the unsecured data; generating, at the single network device, encrypted payload data from the unsecured data using techniques according to the Media Access Control Security (MACSEC) standard of IEEE 802.1 AE; generating, at the single network device, a MACSEC security tag; generating, at the single network device, a packet that transports the encrypted payload data towards the destination device; inserting, at the single network device, the encrypted payload data in an encrypted and authenticated portion of the packet that transports the encrypted payload data towards the destination device; inserting, at the single network device, the packet handling information into an unencrypted and unauthenticated portion of the packet; determining, based on one or more of a source address, a destination address, an encapsulation type, and the at least one of the VLAN tag or the MPLS label, a variable byte offset from a start of the packet for insertion of the MACSEC security tag; at the single network device, using the variable byte offset from the start of the packet to determine a selected location for insertion of the MACSEC security tag in the packet, wherein the selected location is after the at least one of the VLAN tag or the MPLS label; inserting the MACSEC security tag at the selected location of the packet; and sending, at the single network device, the packet on a network.