Extending cryptographic-key lifespan in network encryption protocols

An apparatus comprising:

• an injection module operable to:
• maintain packet sequence numbers for a sender device that sends packets to different network devices in a group of network devices;
• receive, from the sender device, a first packet and a second packet, the first packet being destined for a first device from the group of network devices, and the second packet being destined for a second device from the group of network devices and to be sent from the apparatus after the first packet, wherein the first device is different from the second device;
• update the first packet using a first packet sequence number from the packet sequence numbers;
• generate a second packet sequence number using the first packet sequence number, the second packet sequence number being different from the first packet sequence number;
• and
• update the second packet using the second packet sequence number;
• and
• an encryption module operable to:
• determine a first initialization vector based on the first packet sequence number and a second initialization vector based on the second packet sequence number;
• form a first encrypted packet by applying an encryption algorithm to the first packet, using the first initialization vector and an encryption key as inputs to the encryption algorithm;
• and
• form a second encrypted packet by applying the encryption algorithm to the second packet, using the second initialization vector and the encryption key as inputs to the encryption algorithm.

A computer implemented method, comprising:

• maintaining, by a network device, packet sequence numbers for a sender device that sends packets to different network devices in a group of network devices;
• receiving, by the network device and from the sender device, a first packet and a second packet, the first packet being destined for a first device from the group of network devices, and the second packet being destined for a second device from the group of network devices and to be sent from the network device after the first packet, wherein the first device is different from the second device;
• updating the first packet using a first packet sequence number from the packet sequence numbers;
• generating a second packet sequence number using the first packet sequence number, the second packet sequence number being different from the first packet sequence number;
• updating the second packet using the second packet sequence number;
• and
• determining a first initialization vector, for encrypting the first packet, based on the first packet sequence number and a second initialization vector, for encrypting the second packet, based on the second packet sequence number.