Cryptographic micro-segmentation using IKEv2

A method of establishing one or more secure data channels between network devices, comprising:

• generating and exchanging, by a first network device, a base key pair with a second network device;
• for each of a plurality of policies, receiving, by the first network device, a nonce corresponding to the each of the plurality of policies to from a central management system;
• for the each of the plurality of policies, generating, by the first network device, a session key that is a function of the base key pair and the nonce corresponding to the each of the plurality of policies;
• by the first network device, (i) determining that a first data packet matches a rule associated with a first policy of the plurality of policies, (ii) encrypting the data with a first session key that corresponds to the first policy of the plurality of policies to produce a first encrypted data packet, and (iii) conveying the first encrypted data packet to the second network device.

A network device in a secure communication system, comprising:

• a processor;
• and
• a memory with computer code instructions stored thereon, the memory operatively coupled to the processor such that, when executed by the processor, the computer code instructions cause the network device to:
• generate a base key pair and exchange the base key pair with a second network device;
• for each of a plurality of policies, receive a nonce corresponding to the each of the plurality of policies from a central management system;
• generate, for the each of the plurality of policies, a session key that is a function of the base key pair and the nonce corresponding to the each of the plurality of policies;
• determine that a first data packet matches a rule associated with a first policy of the plurality of policies;
• encrypt the data with a first session key that corresponds to the first policy to produce a first encrypted data packet;
• and
• convey the first encrypted data packet to the second network device.