# US 9,002,016 B2 · Rekey scheme on high speed links > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,002,016 B2 - Document ID: US9002016B2 - Status: Granted - Kind: B2 - Application number: 14/229,986 - Filed: 2014-03-30 - Published: 2014-07-31 - Granted: 2015-04-07 - Earliest claimed: 2010-04-08 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Chandan Mishra - Web page: https://patentgrep.com/patent/US9002016B2 ## CPC - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, apparatus and methods for a rekey process are disclosed. In certain rekey embodiments, when a key-generation protocol exchange is executed, instead of generating a single new security relationship, such as a Security Association or SA, a multiple set (e.g., 10) of new security relationships (e.g., SAs) are generated. An authorized device can then individually use these security relationships (e.g., SAs) as needed to securely communicate with each other. For example, a set of SAs can be efficiently programmed into an 802.1ae protocol ASIC for handling transmitted and received data packets. In the description herein, embodiments of the invention are described with respect to SA's, and this “SA” term is generally defined as any type of security relation that can be formed to allow a particular node to securely transmit packets or frames to another receiving node. ## Claims ### Claim 1 A method of establishing a secure link from a first node, the method comprising: obtaining at the first node key generation information that includes one or more current security associations; transmitting a first set of secure packets that each include one of the one or more current security associations, wherein the first set of secure packets includes a corresponding first set of related packet identifiers; and transmitting a next set of secure packets that each include one of the one or more current security associations, wherein the next set of secure packets includes a corresponding next set of related packet identifiers, wherein transmitting the next set of secure packets is accomplished without the first node reiterating a portion of the key generation exchange or transmitting the next one of the plurality of security associations. ### Claim 2 (depends on 1) The method of claim 1, wherein at least some of the one or more current security associations differ from one another. ### Claim 3 (depends on 1) The method of claim 1, further comprising performing a portion of a key generation exchange from a first node, the key generation exchange enabling the secure transmission of packet from the first node to a second node. ### Claim 4 (depends on 3) The method of claim 3, wherein the first set of secure packets are transmitted sequentially after the key generation exchange. ### Claim 5 (depends on 4) The method of claim 4, wherein the corresponding set of packet identifiers comprises different incremented packet numbers, wherein the different incremented packet numbers are contained in a packet field that is sized to hold values in a range from a minimum value up to a maximum value. ### Claim 6 (depends on 1) The method of claim 1, wherein the next set of secure packets are transmitted sequentially in response to transmitting a last packet of the first set of secure packets, wherein the last packet has a packet number that is a predefined value. ### Claim 7 (depends on 6) The method of claim 6, wherein the corresponding next set of packet identifiers comprises different incremented packet numbers. ### Claim 8 (depends on 1) The method of claim 1, further comprising repeating the operation of sending a next set of secure packets after each time a last packet having a packet number that is the predefined amount from the maximum value is sent, until all of the current security associations have been used. ### Claim 9 (depends on 8) The method of claim 8, further comprising: after all of the current security associations have been used, the first node performing a portions of a subsequent key generation exchange; and obtaining one or more next security associations. ### Claim 10 (depends on 1) The method of claim 1, wherein the key generation exchange and the first and second set of secure packets utilize 802.1ae protocol. ### Claim 11 (depends on 1) The method of claim 1, wherein each secure packet includes encrypted information that is encrypted using one or more keys from the key generation information. ### Claim 12 A first node comprising: a processor; non-transitory memory storing thereon instructions, that when executed by the processor, cause the first node to: obtain at the first node key generation information that includes one or more current security associations; transmit a first set of secure packets that each include one of the one or more current security associations, wherein the first set of secure packets includes a corresponding first set of related packet identifiers; and transmit a next set of secure packets that each include one of the one or more current security associations, wherein the next set of secure packets includes a corresponding next set of related packet identifiers, wherein transmitting the next set of secure packets is accomplished without the first node reiterating a portion of the key generation exchange or transmitting the next one of the plurality of security associations. ### Claim 13 (depends on 12) The first node of claim 12, wherein at least some of the one or more current security associations differ from one another. ### Claim 14 (depends on 12) The first node of claim 12, wherein the memory further comprises instructions that when executed by the processor cause the first node to perform a portion of a key generation exchange from a first node, the key generation exchange enabling the secure transmission of packet from the first node to a second node. ### Claim 15 (depends on 14) The first node of claim 14, wherein the memory further comprises instructions that when executed by the processor cause the first node to transmit the first set of secure packets sequentially after the key generation exchange. ### Claim 16 (depends on 15) The first node of claim 15, wherein the corresponding set of packet identifiers comprises different incremented packet numbers, wherein the different incremented packet numbers are contained in a packet field that is sized to hold values in a range from a minimum value up to a maximum value. ### Claim 17 (depends on 12) The first node of claim 12, wherein the memory further comprises instructions that when executed by the processor cause the first node to transmit the next set of secure packets sequentially in response to transmitting a last packet of the first set of secure packets, wherein the last packet has a packet number that is a predefined value. ### Claim 18 (depends on 17) The first node of claim 17, wherein the corresponding next set of packet identifiers comprises different incremented packet numbers. ### Claim 19 (depends on 18) The first node of claim 18, wherein the memory further comprises instructions that when executed by the processor cause the first node repeat the operation of sending a next set of secure packets after each time a last packet having a packet number that is the predefined amount from the maximum value is sent, until all of the current security associations have been used. ### Claim 20 (depends on 19) The first node of claim 19, wherein the memory further comprises instructions that when executed by the processor cause the first node to: perform a portion of a subsequent key generation exchange in response to determining that current security associations have been used or will be used within a subsequent time duration; and obtain one or more next security associations.