Rollover of encryption keys in a packet-compatible network

A computing system comprising a first peering computer (1st peer) and a second peering computer (2nd peer) configured to communicate via a data path, wherein each peer is configured to use input keying material to generate a pairs of peer encryption keys (PEKs), a PEK pair generated by the 1st peer comprises a transmission PEK Tx1 and a reception PEK Rx1 and a PEK pair generated by the 2nd peer comprises a transmission PEK Tx2 and a reception PEK Rx2, wherein each peer receives a respective input keying material and generates a respective PEK pair independently from another peer;

• wherein in order to verify that both peers are in possession of equivalent PEK pairs generated by the 1st peer and the 2nd peer:
• the 1st peer is configured to generate a first handshake (HS) message encrypted by the transmission PEK Tx1 and to send the first HS message to the 2nd peer via the data path, thereby initiating a handshake (HS) process;
• the 2nd peer is configured to decrypt the first HS message using the reception PEK Rx2, upon successful decryption to generate a second HS message encrypted by the transmission PEK Tx2, and to send the second HS message to the 1st peer via the data path;
• and
• the 1st peer is further configured to decrypt the second HS message using the reception PEK Rx1, wherein a successful decryption of the second HS message confirms the successful completion of the HS process;
• and
• wherein the 1st peer and the 2nd peer are further configured to generate the PEK pairs prior and independently of the HS process and to use said PEK pairs to become, upon successful completion of the HS process, in possession of equivalent pairs of session encryption keys (SEKs).

A non-transitory computer readable medium comprising instructions that, when executed by a computing system comprising a first peering computer (1st peer) and a second peering computer (2nd peer) configured to communicate via a data path, cause the computing system to perform a method of establishing encryption keys for communicating between the 1st peer and the 2nd peer, the method comprising:

• a. by each peer, using input keying material to generate a pairs of peer encryption keys (PEKs), a PEK pair generated by the 1st peer comprises a transmission PEK Tx1 and a reception PEK Rx1 and a PEK pair generated by the 2nd peer comprises a transmission PEK Tx2 and a reception PEK Rx2, wherein each peer receives a respective input keying material and generates a respective PEK pair independently from another peer;
• b. running a handshake (HS) process to verify that both peers are in possession of equivalent verifying equivalence of the PEK pairs generated prior and independently of the HS process, the HS process comprising:
• i. by the 1st peer, generating a first handshake (HS) message encrypted by the transmission PEK Tx1 and sending the first HS message to the 2nd peer via the data path, thereby initiating the handshake process;
• ii. by the 2nd peer, decrypting the first HS message using the reception PEK Rx2, upon successful decryption generating a second HS message encrypted by the transmission PEK Tx2, and sending the second HS message to the 1st peer, wherein the 2nd peer sends the second HS message via the data path;
• iii. by the 1st peer, decrypting the second HS message using the reception PEK Rx1, wherein a successful decryption of the second HS message confirms the successful completion of the HS process;
• and
• c. upon successful completion of the HS process, using by the 1st peer and the 2nd peer said PEK pairs to become in possession of equivalent pairs of session encryption keys (SEKs).