Information technology — Telecommunications and information networks — Part 1AE: Media access control (MAC) security networks — Part 1AE: Media access control (MAC) security
The scope of this standard is to specify provision of connectionless user data confidentiality, frame data
integrity, and data origin authenticity by media access independent protocols and entities that operate
transparently to MAC Clients.
NOTE—The MAC Clients are as specified in IEEE Std 802, IEEE Std 802.2™, IEEE Std 802.1D™, IEEE Std 802.1Q™,
and IEEE Std 802.1X™.2
To this end it
a) Specifies the requirements to be satisfied by equipment claiming conformance to this standard.
b) Specifies the requirements for MAC Security in terms of provision of the MAC Service and the
preservation of the semantics and parameters of service requests and indications.
c) Describes the threats, both intentional and accidental, to correct provision of the service.
d) Specifies security services that prevent, or restrict, the effect of attacks that exploit these threats.
e) Examines the potential impact of both the threats and the use of MAC Security on the Quality of
Service (QoS), specifying constraints on the design and operation of MAC Security entities and
protocols.
f) Models support of the secure MAC Service in terms of the operation of media access control method
independent MAC Security Entities (SecYs) within the MAC Sublayer.
g) Specifies the format of the MACsec Protocol Data Unit (MPDUs) used to provide secure service.
h) Identifies the functions to be performed by each SecY, and provides an architectural model of its
internal operation in terms of Processes and Entities that provide those functions.
i) Specifies the interface/exchanges between a SecY and its associated and collocated MAC Security
Key Agreement Entity (KaY, IEEE P802.1af [B2]) that provides and updates cryptographic keys.
j) Specifies performance requirements and recommends default values and applicable ranges for the
operational parameters of a SecY.
k) Specifies how SecYs are incorporated within the architectural structure within end stations and
bridges.
l) Establishes the requirements for management of MAC Security, identifying the managed objects
and defining the management operations for SecYs.
m) Specifies the Management Information Base (MIB) module for managing the operation of MAC
Security in TCP/IP networks.
n) Specifies requirements, criteria and choices of Cipher Suites for use with this standard.
This standard does not
o) Specify how the relationships between MACsec protocol peers are discovered and authenticated, as
supported by key management or key distribution protocols, but makes use of IEEE P802.1af Key
Agreement for MAC security to achieve these functions.