System for cryptographic key sharing among networked key servers

A method comprising:

• at a key server connected to one or more networks:
• storing cryptographic keys and an associated authentication and cryptographic policy on behalf of the key server;
• providing the keys and the associated authentication and cryptographic policy to a device group including multiple devices connected with the key server over a local area network, to enable the device group to encrypt messages with the keys, wherein the device group is configured to:
• authenticate and integrity check messages with the keys;
• and
• authenticate and integrity check messages received from other device groups with other keys;
• and
• acting as a proxy for other key servers, wherein acting as a proxy includes:
• determining the other key servers from which the other keys are to be requested based on a service discovery protocol;
• requesting the other keys to decrypt encrypted messages from the other key servers over a wide area network, the encrypted messages encrypted with the other keys and received from other device groups respectively connected with the other key servers over respective local area networks;
• receiving the other keys together with respective associated authentication and cryptographic policies from the other key servers over the wide area network;
• and
• providing the other keys and the associated authentication and cryptographic policies to the device group over the local area network to decrypt the encrypted messages.

A non-transitory computer readable storage medium encoded with instructions that, when executed by a processor of a key server, cause the key server to:

• store cryptographic keys and an associated authentication and cryptographic policy on behalf of the key server;
• provide the keys and the associated authentication and cryptographic policy to a device group including multiple devices connected with the key server over a local area network, to enable the device group to encrypt messages with the keys, wherein the device group is configured to:
• authenticate and integrity check messages with the keys;
• and
• authenticate and integrity check messages received from other device groups with other keys;
• and
• act as a proxy for other key servers, wherein acting as a proxy includes:
• determining the other key servers from which the other keys are to be requested based on a service discovery protocol;
• requesting the other keys to decrypt encrypted messages from the other key servers over a wide area network, the encrypted messages encrypted with the other keys and received from other device groups respectively connected with the other key servers over respective local area networks;
• receiving the other keys together with respective associated authentication and cryptographic policies from the other key servers over the wide area network;
• and
• providing the other keys and the associated authentication and cryptographic policies to the device group over the local area network to decrypt the encrypted messages.

A method comprising:

• at a key server connected to one or more networks:
• storing cryptographic keys on behalf of the key server;
• providing the keys and an associated authentication and cryptographic policy to a device group including multiple devices connected with the key server over a local area network, to enable the device group to encrypt messages with the keys, wherein the device group is configured to:
• authenticate and integrity check messages with the keys;
• and
• authenticate and integrity check messages received from other device groups with other keys;
• transmitting the keys and the associated authentication and cryptographic policy over the wide area network to a central key server for storage therein along with other keys and respective associated authentication and cryptographic policies transmitted from other key servers to the central key server;
• and
• acting as a proxy for the other key servers, wherein acting as a proxy includes:
• requesting the other keys to decrypt encrypted messages from the central key server over a wide area network, the encrypted messages encrypted with the other keys and received from other device groups respectively connected with the other key servers over respective local area networks;
• receiving the other keys and the associated authentication and cryptographic policies for the other key servers from the central key server over the wide area network;
• and
• providing the other keys and the associated authentication and cryptographic policies over the local area network to the device group to decrypt the encrypted messages.