Encryption Groups

Encryption Groups (EGs) can be assigned to a service to enable encryption for that service. An EG contains the CA, which contains the PSK used for the MKA to secure the SAK. As with tunnel encryption, the MKA is established for each pair of PEs in a service. The MKA distributes the SAK to each pair of PEs. Each PE pair within a service (such as VPRN) is encrypted with a different SAK, providing additional security. If a pair of PE SAKs is compromised, other PE pairs in the same service remain uncompromised.

An EG can be assigned to a single service or to multiple services. If assigned to multiple services, the services use the same MKA between peers and the same datapath key (SAK) to encrypt their packets between the peers. This provides scaling benefits for ANYsec, as multiple services are encrypted using the same SAK. The peer IP address must be configured under the EG. The IP address should match the BGP neighbor IP address or TLDP far-end IP address.

EGs function as follows:

• The provider can choose to encrypt a service or multiple services using a single MACsec CA and PSK (and its SAK), or assign each service a unique CA, PSK, and SAK. As with tunnel encryption, this creates an EG concept.
• An EG can be used for a set of services to be encrypted using a single CA and its corresponding PSK (CKN, CAK).
  • Services using the same EG use the same local encryption SID, which uniquely identifies the source of encrypting.
  • Each EG must be configured with a set of peers (PEs) that the service is encrypting traffic toward and receiving encrypted traffic from. For service encryption, these peers must match the peers discovered by dynamic protocols, such as BGP and TLDP, for each service. If a service discovers a peer through overlay signaling (BGP or TLDP), and this peer is not configured under the EG for that service, traffic is dropped.
  • Each EG must be configured with its encryption SID (ES) to uniquely identify it as an encrypting source of the service. The peer's ES is discovered automatically through the MKA SCI field.

Depending on security needs, services can be configured with a single EG or with multiple EGs. When the appropriate EGs are configured with their corresponding peers, the EG is assigned to a service under autobind or within the context of its spoke SDP. The following applies:

• When an EG is assigned to an autobind, all LSPs used by that autobind inherit the EG configuration, including the CA, ES, and local address.
• For PW switching, each spoke SDP has its own EG. As a result, the encryption terminates on the first spoke and switches to the second spoke, where it is encrypted again.