Maximizing Ethernet Security by Switch-Based Single Secure Domain

Media Access Control Security (MACsec) is a new segment based link layer security, which is standardized on 2006. It leaves data in clear inside switches and facilitates packet inspection at those connection points. The support for traffic analysis is crucial for Enterprises or Service Providers in secure premises, but when the networking devices are placed in populated areas (e.g., hospitals, airports), this facility can break security of total infrastructure. Also inside attackers can take advantage of this unsecured zone. In this paper, we identify the security requirements that need to be followed for better Ethernet security, and propose MACsec-enable switch-based single secure domain to address the above critical problem. Our design requires no additional cryptographic algorithms and adds the new feature only in switches. The evaluation of our proposal highlights the increased security and maximized performance. Finally, we guide further research in this area.