Patent ID: 8386772
Filing Date: 2013-02-26
Classification: H04L

Abstract:
1. A method for realizing medium access control security (MACsec) in a network system, wherein the network system is formed by a plurality of terminals, and bridges of a plurality of networks; multiple MACsec levels are preset on the terminals or the bridges in one kind of the plurality of networks according to MACsec application ranges, and each of the multiple MACsec levels spans across multiple kinds of the plurality of networks; a single secure connectivity association key (CAK) is preset to part or all of the terminals or the bridges in a single MACsec level of the multiple MACsec levels; each of the terminals or bridges comprises a key selection protocol (KSP) instance, the KSP instance owns the CAK preset to the terminal or bridge, and multiple KSP instances which have a same CAK belong to a same secure connectivity association (CA); said method comprising: receiving, by a terminal or bridge, a key selection protocol data unit (KSPDU) from another terminal or bridge, wherein the KSPDU carries an identifier of the CAK (CM) of a sending KSP instance of the other terminal or bridge and information about a first MACsec level that the sending KSP instance belongs to; determining, by the terminal or bridge, whether a receiving KSP instance in the first MACsec level indicated by the information of the first MACsec level carried in the KSPDU exists in the terminal or bridge: if the receiving KSP instance in the first MACsec level does not exist in the terminal or bridge: forwarding, by the terminal or bridge, the KSPDU to a next terminal or bridge; or if the receiving KSP instance in the first MACsec level exists in the terminal or bridge: determining, by the receiving KSP instance, whether the receiving KSP instance and the sending KSP instance belong to a same CA based on the CKI carried in the KSPDU; and if the receiving KSP instance and the sending KSP instance belong to the same CA: generating, by the receiving KSP instance, a secure association key (SAK) based on the KSPDU.