Back to results
US 8,266,286 B2Granted
Dynamic key management server discovery
AssigneeCisco Technology, Inc.
InventorsKavitha Kamarthy, Brian E. Weis
Life of this patent
Estimating the term…
Abstract
Various systems and method are disclosed for automatically disseminating key server contact information in a network. For example, one method (e.g., performed by a discovery server) involves generating a discovery message that includes at least one list of one or more key servers and then sending that discovery message to one or more members of a key management protocol group. Each list of key servers can include contact information for one or more key servers and indicate the priority of each key server relative to other key servers within the list.
Claims19
A method comprising:
- generating, performed by a discovery server, a message, wherein the discovery server is configured to distribute information identifying one or more key servers, wherein the discovery server is not one of the one or more key servers, wherein the one or more key servers are configured to distribute cryptographic policy or encryption keys, wherein the message comprises the information identifying the one or more key servers, wherein the message indicates a priority of each of the one or more key servers, and wherein a destination address of the message is a multicast address identifying a multicast group;
- and
- sending, performed by the discovery server, the message, via a network, to the multicast group without first receiving a request from one of a plurality of key management protocol group members, wherein the multicast group comprises the plurality of key management protocol group members.
A method comprising:
- receiving a message, via a network, from a discovery server, wherein the discovery server is configured to distribute information identifying one or more key servers, wherein the discovery server is not one of the one or more key servers, wherein the one or more key servers are configured to distribute cryptographic policy or encryption keys, wherein the message comprises the information identifying the one or more key servers, wherein the message indicates a priority of each of the one or more key servers, wherein a destination address of the message is a multicast address identifying a multicast group comprising a plurality of key management protocol group members, and wherein the discovery server sends the discovery message to the multicast group without first receiving a request from one of the key management protocol group members;
- and
- using the information in the message to select one of the one or more key servers;
- and
- attempting to register with the selected one of the one or more key servers.
2 more elements
A network device comprising:
- a key management protocol module of a discovery server, wherein the key management protocol module is configured to generate a discovery message, wherein the discovery server is configured to distribute information identifying one or more key servers, wherein the discovery server is not one of the one or more key servers, wherein the one or more key servers are configured to distribute cryptographic policy or encryption keys, wherein the discovery message comprises the information identifying the one or more key servers, wherein the discovery message indicates a priority of each of the one or more key servers, and wherein a destination address of the message is a multicast address identifying a multicast group;
- and
- a hardware interface configured to couple to a network, wherein the key management protocol module is configured to send, via the interface, the discovery message to the multicast group without first receiving a request from one of a plurality of key management protocol group members, wherein the multicast group comprises the plurality of key management protocol group members.
A network device comprising:
- a hardware interface configured to receive a message from a discovery server, wherein the discovery server is configured to distribute information identifying one or more key servers, wherein the discovery server is not one of the one or more key servers, wherein the one or more key servers are configured to distribute cryptographic policy or encryption keys, wherein the message comprises the information identifying the one or more key servers, wherein the message indicates a priority of each of the one or more key servers, wherein a destination address of the message is a multicast address identifying a multicast group comprising a plurality of key management protocol group members, and wherein the discovery server sends the discovery message to the multicast group without first receiving a request from one of the key management protocol group members;
- and
- a key management protocol module, wherein the key management protocol module is configured to extract the information in the message, use the extracted information to select one of the more key servers, and attempt to register with the selected one of the one or more key servers.
A system comprising:
- means for generating a message in a discovery server, wherein the discovery server is configured to distribute information identifying one or more key servers, wherein the discovery server is not one of the one or more key servers, wherein the one or more key servers are configured to distribute cryptographic policy or encryption keys, wherein the message comprises the information identifying the one or more key servers, wherein the message indicates a priority of each of the one or more key servers, and wherein a destination address of the message is a multicast address identifying a multicast group;
- and
- means for sending the message from the discovery server, via a network, to the multicast group without first receiving a request from one of a plurality of key management protocol group members, wherein the multicast group comprises the plurality of key management protocol group members.
A system comprising:
- means for receiving a message from a discovery server, wherein the discovery server is configured to distribute information identifying one or more key servers, wherein the discovery server is not one of the one or more key servers, wherein the one or more key servers are configured to distribute cryptographic policy or encryption keys, wherein the message comprises the information identifying the one or more key servers, wherein the message indicates a priority of each of the one or more key servers, wherein a destination address of the message is a multicast address identifying a multicast group comprising a plurality of key management protocol group members, and wherein the discovery server sends the discovery message to the multicast group without first receiving a request from one of the key management protocol group members;
- means for using the information in the message to select one of the more key servers;
- and
- means for attempting to register with the selected one of the one or more key servers.
1 more element
Dependencies are inferred from the claim text.