Key management

ANYsec uses MKA to distribute datapath keys (SAKs). For ANYsec, the MKA is established for each EG and each peer in the EG.

The MKA is uniquely identified through the source IP address, destination IP address, and SCI. The SCI is made up of the ES and endpoint ID.

The following figure shows an example of the MKA for an encrypted service.

Figure 1. MKA for encrypted service

In MKA for encrypted service, if the VPRN on PE1 has two peers (PE3 and PE2) for EG1, two MKA sessions are created: one from PE1 to PE2 and another from PE1 to PE3, both for the same VPRN. The source IP address of the MKA is the local address in the security termination policy. The destination IP address is the peer IP address in EG1, which has two peers (PE2 and PE3). Each pair of local addresses, peer addresses, and SCIs create an MKA session.

As a result, each EG and PE within that EG is assigned a unique SAK for encryption, as shown in the following figure.

Figure 2. SAK for encrypted service

If two VPRNs between two PEs use the same EG and security termination policy, only a single MKA session is created. This is because the source IP address of the MKA is the security termination policy local address, which is common to both VPRNs; the destination IP address is the peer IP address in the EG, which is also common. In addition, the ES is common for both VPRNs. In this case, because one MKA session serves both VPRNs, the same SAK is signaled for both. In this example, each VPRN must be configured with a unique EG to have its own MKA and SAK.