The MAC security entity (SecY) module for managing IEEE
802.1AE.  An SecY is the entity that operates the MAC Security
protocol within the system.

Each SecY transmits frames conveying secure MAC Service
requests on a single Secure Channel (SC), and receives frames
conveying secure service indications on separate SCs (one for
each of the other SecYs participating in the Secure
Connectivity Association (CA)).  A CA is a security
relationship, established and maintained by key agreement
protocols that comprise a fully connected subset of the
service access points in stations attached to a single MACsec
supported LAN.  An SC is a security relationship used to
provide security guarantees for frames transmitted from one
member of a CA to the others.  It is a unidirectional point to
multipoint communication, and can be long lived, persisting
through Secure Association Key (SAK) changes.  Each SC is
supported by a sequence of Secure Associations (SAs) thus
allowing the periodic use of fresh keys without terminating
the relationship.  Each SA is supported by a single secret
key, or a set of keys where the cryptographic operations used
to protect one frame require more than one key.

Two different interfaces 'Controlled Port' and
'Uncontrolled Port', are associated with a SecY, and that for
each instance of a SecY, two ifTable rows (one for each
interface) run on top of an ifTable row representing the
'Common Port' interface, such as a row with ifType =
'ethernetCsmacd(6)'.

For example :

-----------------------------------------------------------
|                            |                            |
|   Controlled Port          |   Uncontrolled Port        |
|      Interface             |      Interface             |
|    (ifEntry = j)           |     (ifEntry = k)          |
| (ifType =                  | (ifType =                  |
|  macSecControlledIF(231))  |  macSecUncontrolledIF(232))|
|                            |                            |
|---------------------------------------------------------|
|                                                         |
|                    Physical Interface                   |
|                      (ifEntry = i)                      |
|                (ifType = ethernetCsmacd(6))             |
|_________________________________________________________|
i, j, k are ifIndex to indicate an interface row in the ifTable.

                Figure : MACsec Interface Stack

The 'Controlled Port' is the service point to provide one
instance of the secure MAC service in a SecY.  The
'Uncontrolled Port' is the service point to provide one instance
of the insecure MAC service in a SecY.