Method and apparatus for secure network enclaves

A network apparatus comprising:

• authentication hardware logic to initiate authentication by the network apparatus with a central network authority;
• packet processing hardware logic to receive from the central network authority a first derivation key;
• and
• security protocol hardware logic to:
• establish a client-server security association between a client and a server different than said central network authority using a first communication including (i) a client identifier that is provided by the central network authority and (ii) an encrypted portion and/or an authorization signature,
• generate a client authorization key as a pseudo-random function of (i) the client identifier and (ii) the first derivation key provided to the network apparatus by the central network authority, wherein the client authorization key is separately generated by the central network authority,
• perform a cryptographic operation using the client authorization key, wherein the cryptographic operation comprises to decrypt the encrypted portion using the client authorization key or to validate the first communication using the authorization signature and the client authorization key, and
• securely receive a second derivation key from the server, wherein the server encrypts the second derivation key using the first derivation key to securely transmit the second derivation key to the network apparatus;
• wherein the server produces a new session key and a new session identifier for the client and encrypts the new session key and the new session identifier using the client authorization key, wherein the new session key and the new session identifier are produced using the second derivation key generated by the server.

One or more non-transitory, computer-readable storage media comprising a plurality of instructions that in response to being executed cause a client to:

• initiate authentication with a central network authority;
• receive, from the central network authority, a client authorization key generated by the central network authority and a client identifier;
• initiate a client-server security association using a first communication to a server different than the central network authority, the first communication including (i) the client identifier and (ii) an encrypted portion and/or an authorization signature;
• and
• receive a second communication from the server in response to the server confirming the client-server security association from the first communication;
• wherein the client authorization key is separately generated by the server as a pseudo-random function of (i) the client identifier and (ii) a first derivation key provided to the server by the central network authority, to decrypt the encrypted portion or to validate the first communication using the authorization signature;
• and
• wherein the second communication is to include a new session key and a new session identifier for the client, wherein the new session key and the new session identifier are produced by the server using a second derivation key generated by the server and encrypted using the client authorization key by the server, and wherein the server is to encrypt the second derivation key using the first derivation key to securely transmit the second derivation key to a network appliance.

One or more non-transitory, computer-readable storage media comprising a plurality of instructions that in response to being executed cause a server to:

• initiate authentication with a central network authority, wherein the server is different from the central network authority;
• receive from the central network authority a first derivation key;
• receive, from a client, a first communication including (i) a client identifier that is provided by the central network authority and (ii) an encrypted portion and/or an authorization signature;
• generate a client authorization key as a pseudo-random function of (i) the client identifier and (ii) the first derivation key;
• perform a cryptographic operation using the client authorization key, wherein the cryptographic operation comprises decrypting the encrypted portion using the client authorization key or validating the first communication using the authorization signature and the client authorization key;
• and
• establish a client-server security association with the client using the first communication;
• produce a new session key and a new session identifier for the client and encrypt the new session key and the new session identifier using the client authorization key, wherein the new session key and the new session identifier are produced using a second derivation key generated by the server;
• and
• encrypt the second derivation key using the first derivation key to securely transmit the second derivation key to a network appliance.