Autonomous Key Update Mechanism with Blacklisting of Compromised Nodes for Mesh Networks

A network node which is configured to receive a network key update, comprising:

• a memory configured to store a secret information associated with the network node;
• a processor configured to:
• receive an encrypted message including an update data structure and a new network key from a network key manager;
• generate a decryption key based upon the secret information and a current index;
• decrypt the encrypted message with the decryption key;
• determine a neighbor node of the network node;
• remove the volatile private key for the neighbor node from the update data structure;
• encrypt the resulting update data structure and the new network key with the private key for the neighbor node to produce an encrypted neighbor message;
• and
• send the encrypted neighbor message to the neighbor node.

A method of managing keys in nodes in a network by a network key manager, the method comprising:

• determining which nodes are blacklisted;
• generating an update data structure of volatile private keys for each node that is not blacklisted, wherein the volatile private key is based upon secret information associated with the node and an index, wherein the volatile private key is used for the indexth key update;
• determining a neighbor node of the network key manager;
• removing the volatile private key for the neighbor node from the update data structure;
• encrypting the resulting update data structure and a new network key with the private key for the neighbor node to produce an encrypted message;
• and
• sending the encrypted message to the neighbor node.

A method of updating a network key in a network node, comprising:

• receiving an encrypted message including an update data structure and a new network key from a network key manager;
• generating a decryption key based upon a secret information associated with the network node and a current index;
• decrypting the encrypted message with the decryption key;
• determining a neighbor node of the network node;
• removing the volatile private key for the neighbor node from the update data structure;
• encrypting the resulting update data structure and the new network key with the private key for the neighbor node to produce an encrypted neighbor message;
• and
• sending the encrypted neighbor message to the neighbor node.