Use of marker packets for synchronization of encryption/decryption keys in a data communication network

For use at a source node in a system including one or more source nodes for encrypting data using an encryption key, an interposed data communication network through which data packets including encrypted data are transmitted, each of said data packets including a header and a data payload portion, and one or more destination nodes for decrypting received data using a decryption key, a method of maintaining synchronization between encryption keys used at the source node in encrypting data and decryption keys used at a destination node to decrypt data, said method comprising the steps of:

• sending at least one new decryption key to the destination node at which the key is to be used;
• generating a marker cell having a predetermined format, which when recognized by a destination node, will cause a new decryption key to be activated at the destination node;
• transmitting the marker cell to the destination node;
• initiating use of a new encryption key to encrypt data, said new encryption key corresponding to the decryption key to be activated at the destination node upon receipt of the transmitted marker cell.

For use at a destination node in a system including one or more source nodes for encrypting data using an encryption key, an interposed data communication network through which data packets including encrypted data are transmitted, each of said data packets including a header and a data payload portion, and one or more destination nodes for decrypting received data using a decryption key, a method of maintaining synchronization between encryption keys used at the source node in encrypting data and decryption keys used at the destination node to decrypt data, said method comprising the steps of:

• receiving at least one new decryption key from a source node;
• storing each received new decryption key;
• monitoring received data packets to determine whether any of such packets have a predetermined format;
• upon detection of a received data packet having the predetermined format, retrieving a new decryption key from storage;
• and
• using the new decryption key to decrypt data in subsequently received data packets.

For use in a system including one or more source nodes for encrypting data using an encryption key, an interposed data communication network through which data packets including encrypted data are transmitted, each of said data packets including a header portion and a data payload portion, and one or more destination nodes for decrypting received data packets using a decryption key, a key-synchronizing system for maintaining synchronization between the encryption key used at a source node to encrypt data and the decryption key used at the destination node to decrypt data, said key-synchronizing system comprising:

• at a source node from which the encrypted packet is to be sent, means for sending at least one new decryption key to the destination node which is to receive the packet;
• at the destination node, means for storing each new decryption key that is received;
• at the source node, means for generating a cell having a predetermined format;
• at the destination node, means for monitoring each received data packet to determine whether the packet has the predetermined format;
• and
• at the destination node, means responsive to the identification of a received data packet having the predetermined format for retrieving a new decryption key from storage and for initiating use of that key to decrypt each subsequently received data packet.

A key-synchronizing source node for use in a system including one or more source nodes for encrypting data using an encryption key, an interposed data communication network through which data packets including the encrypted data are transmitted, each of said data packets including a header portion and a data payload portion, and one or more destination nodes for decrypting received data packets using a decryption key, said key-synchronizing source node comprising:

• means for sending at least one new decryption key to a destination node to which data packets are to be sent;
• means for generating a marker cell having a predetermined format, said marker cell being an indicator that a new decryption key is to be activated at a destination node to which the marker cell is sent;
• and
• means for sending the marker cell to at least one destination node.

A key-synchronizing destination node for use in a system including one or more source nodes for encrypting data using an encryption key, an interposed data communication network through which each data packets including the encrypted data are transmitted, each of said data packets including a header portion and a data payload portion, and one or more destination nodes for decrypting received data packets using a decryption key, said key-synchronizing destination node comprising:

• means for receiving and storing one or more new decryption keys from a source node from which encrypted packets are being transmitted;
• means for monitoring received data packets for any packet having a predetermined format;
• and
• means for activating a new decryption key upon detection of a received packet having the predetermined format.