Automatic key rolling for link encryption

A computing device comprising:

• a key generator to generate data encryption keys for encrypting and decrypting data packets for communication between a first endpoint and a second endpoint via a communication link;
• a key rolling event detector to detect a key rolling event, the key rolling event comprising communication of a threshold number of the encrypted data packets between the first endpoint and the second endpoint;
• and
• an encryption engine to roll from a current data encryption key generated by the key generator to a next data encryption key generated by the key generator, without communicating the next data encryption key between the first endpoint and the second endpoint, responsive to detection of the key rolling event by the key rolling event detector.

A method comprising:

• receiving, at a first endpoint and a second endpoint of a communication link, a first key derivation key;
• generating, at the first endpoint and the second endpoint, a first data encryption key and a second key derivation key by applying a key derivation function to the first key derivation key;
• and
• generating, at the first endpoint and the second endpoint, a second data encryption key and a third key derivation key by applying the key derivation function to the second key derivation key, wherein the first endpoint and the second endpoint are configured to roll from the first data encryption key to the second data encryption key, without communicating the second data encryption key between the first endpoint and the second endpoint, responsive to detecting a key rolling event that is known by both the first endpoint and the second endpoint, the key rolling event comprising receiving, at the first endpoint and from the second endpoint, a threshold number of data packets encrypted using the first data encryption key.