前言:信息技术部门的标准制定与国际标准制定相协调。通过CSA信息技术技术委员会（TCIT），加拿大人担任加拿大标准委员会（SCC）ISO/IEC信息技术联合技术委员会（ISO/IEC JTC1）的SCC镜像委员会（SMC），该委员会是加拿大的ISO成员机构，也是IEC加拿大国家委员会的发起人。此外，作为国际电信联盟（ITU）的成员，加拿大还参加了国际电报和电话协商委员会（ITU）- T） 。为简洁起见，本标准通篇称为“CSA ISO/IEC/IEEE 8802-1AE”。本标准取代CSA ISO/IEC/IEEE 8802-1AE:20（采用ISO/IEC/IEEE 8802-1AE:2013）。出版时，ISO/IEC/IEEE 8802-1AE:2020仅可从ISO和IEC获得英文版本。CSA集团将在ISO和IEC发布法文版。本标准已由技术委员会正式批准，无需修改，并根据加拿大标准委员会对加拿大国家标准的要求制定。CSA集团已将其作为加拿大国家标准发布。 范围:本标准的范围是通过对MAC客户端透明的媒体访问独立协议和实体规定无连接用户数据保密性、帧数据完整性和数据源真实性。注:MAC客户端符合IEEE标准802®、IEEE标准802.1Q的规定™, 和IEEE标准802.1X。为此，ita）规定了声称符合本标准的设备应满足的要求。b） 在提供MAC服务以及保留服务请求和指示的语义和参数方面，规定了对MACsec的要求。 c） 描述了为纠正服务提供而受到的威胁，包括故意威胁和意外威胁。d） 指定用于防止或限制利用这些威胁的攻击效果的安全服务。e） 研究威胁和MACsec的使用对服务质量（QoS）的潜在影响，具体说明对MAC安全实体和协议的设计和操作的限制。f） 模型支持在MAC子层中独立于媒体访问控制方法的MAC安全实体（SECY）的操作方面的安全MAC服务。g） 指定用于提供安全服务的MACsec协议数据单元（MPDU）的格式。 h） 确定每个部门要执行的功能，并提供其内部运作的架构模型，包括提供这些功能的流程和实体。i） 指定每个SecY使用关联的并置端口访问实体（PAE，IEEE Std 802.1X）来发现和验证MACsec协议对等方，以及使用该PAE的密钥协议实体（KaY）来同意和更新加密密钥。j） 指定性能要求，并建议SecY操作参数的默认值和适用范围。k） 指定如何将SecYs合并到端站、桥接器和两个端站的体系结构中- 端口以太网数据加密设备（EDE）。l） 确定MAC安全管理的要求，确定受管对象，并定义SecYs的管理操作。m） 指定用于管理TCP/IP网络中MAC安全操作的管理信息库（MIB）模块。n） 指定用于本标准的密码套件的要求、标准和选择。

Preface:Standards development within the Information Technology sector is harmonized with international standards development. Through the CSA Technical Committee on Information Technology (TCIT), Canadians serve as the SCC Mirror Committee (SMC) on ISO/IEC Joint Technical Committee 1 on Information Technology (ISO/IEC JTC1) for the Standards Council of Canada (SCC), the ISO member body for Canada and sponsor of the Canadian National Committee of the IEC. Also, as a member of the International Telecommunication Union (ITU), Canada participates in the International Telegraph and Telephone Consultative Committee (ITU-T).For brevity, this Standard will be referred to as "CSA ISO/IEC/IEEE 8802-1AE" throughout.This Standard supersedes CSA ISO/IEC/IEEE 8802-1AE:20 (adopted ISO/IEC/IEEE 8802-1AE:2013). At the time of publication, ISO/IEC/IEEE 8802-1AE:2020 is available from ISO and IEC in English only. CSA Group will publish the French version when it becomes available from ISO and IEC.This Standard has been formally approved, without modification, by the Technical Committee and has been developed in compliance with Standards Council of Canada requirements for National Standards of Canada. It has been published as a National Standard of Canada by CSA Group.Scope:The scope of this standard is to specify provision of connectionless user data confidentiality, frame data integrity, and data origin authenticity by media access independent protocols and entities that operate transparently to MAC Clients.NOTE—The MAC Clients are as specified in IEEE Std 802®, IEEE Std 802.1Q™, and IEEE Std 802.1X.To this end, ita) Specifies the requirements to be satisfied by equipment claiming conformance to this standard.b) Specifies the requirements for MACsec in terms of provision of the MAC Service and the preservation of the semantics and parameters of service requests and indications.c) Describes the threats, both intentional and accidental, to correct provision of the service.d) Specifies security services that prevent, or restrict, the effect of attacks that exploit these threats.e) Examines the potential impact of both the threats and the use of MACsec on the Quality of Service (QoS), specifying constraints on the design and operation of MAC Security entities and protocols.f) Models support of the secure MAC Service in terms of the operation of media access control method independent MAC Security Entities (SecYs) within the MAC Sublayer.g) Specifies the format of the MACsec Protocol Data Unit (MPDUs) used to provide secure service.h) Identifies the functions to be performed by each SecY, and provides an architectural model of its internal operation in terms of Processes and Entities that provide those functions.i) Specifies each SecY's use of an associated and collocated Port Access Entity (PAE, IEEE Std 802.1X) to discover and authenticate MACsec protocol peers and its use of that PAE's Key Agreement Entity (KaY) to agree and update cryptographic keys.j) Specifies performance requirements and recommends default values and applicable ranges for the operational parameters of a SecY.k) Specifies how SecYs are incorporated within the architecture of end stations, bridges, and two-port Ethernet Data Encryption devices (EDEs).l) Establishes the requirements for management of MAC Security, identifying the managed objects and defining the management operations for SecYs.m) Specifies the Management Information Base (MIB) module for managing the operation of MAC Security in TCP/IP networks.n) Specifies requirements, criteria, and choices of Cipher Suites for use with this standard.