Techniques for encryption key rollover synchronization in a network

One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor of a first network element in a network comprising a plurality of network elements, cause the processor to:

• generate a new set of public-key encryption keys for the first network element;
• based on the new set of public-key encryption keys, generate a set of new security associations between the first network element and each other network element of the plurality of network elements in the network;
• provide a new public key from the new set of public-key encryption keys for the first network element to a network controller in communication with the plurality of network elements;
• use security associations associated with a previous set of public-key encryption keys to protect traffic for encrypted communication between the first network element and each other network element in the network;
• and
• upon obtaining, from a second network element of the plurality of network elements, traffic protected by a security association from the set of new security associations, use security associations from the set of new security associations for subsequent encrypted communication between the first network element and the second network element,
• wherein the first network element and the second network element exchange peer-to-peer encrypted communication directly without passing through the controller, and only the network controller distributes public key cryptographic material on behalf of the first network element to the second network element.

An apparatus comprising:

• at least one network port for communicating in a network;
• a memory;
• a processor coupled to the memory and to the at least one network port, wherein the processor is configured to:
• generate a new set of public-key encryption keys for the apparatus;
• based on the new set of public-key encryption keys, generate a set of new security associations between the apparatus and each network element of a plurality of network elements in the network;
• provide a new public key from the new set of public-key encryption keys for the apparatus to a network controller in communication with the plurality of network elements;
• use security associations associated with a previous set of public-key encryption keys to protect traffic for encrypted communication between the apparatus and each network element of the plurality of network elements;
• and
• upon obtaining, from a first network element of the plurality of network elements, traffic protected by a security association from the set of new security associations, use security associations from the set of new security associations for subsequent encrypted communication between the apparatus and the first network element,
• wherein the first network element and the second network element exchange peer-to-peer encrypted communication directly without passing through the controller, and only the network controller distributes public key cryptographic material on behalf of the first network element to the second network element.