Method and system for key generation, distribution and management

A method for key distribution by a controller, the method comprising:

• maintaining a secure control channel with each node N(i) of a network;
• receiving, from the each node N(i) of the network, security parameters for the node N(i) generated by the node N(i) and transmitted via the secure control channel;
• storing the security parameters received for the each node N(i);
• receiving, from a node N(j) of the network, a request for the security parameters associated with a particular node N(i), wherein the request is received via the secure control channel;
• responsive to receiving the request, sending the security parameters associated with the particular node N(i) to the node N(j) via the secure control channel;
• and
• instructing the each node N(i) of the network to selectively invalidate an old encryption key when the old encryption key is no longer in use by all current peers of the node N(i) and all the current peers have transitioned to a new encryption key, wherein the security parameters for the node N(i) include at least one of the old encryption key and the new encryption key, and the old encryption key and the new encryption key are unique for the node N(i) with respect to every other device in the network.

A controller, comprising:

• a processor;
• and
• a memory coupled to the processor, the memory storing instructions which when executed perform a method for key distribution, comprising:
• maintaining a secure control channel with each node N(i) of a network;
• receiving, from the each node N(i) of the network, security parameters for the node N(i) generated by the node N(i) and transmitted via the secure control channel;
• storing the security parameters received for the each node N(i);
• receiving from a node N(j) of the network, a request for the security parameters associated with a particular node N(i), wherein the request is received via the secure control channel;
• responsive to the request, sending the security parameters associated with the particular node N(i) to the node N(j) via the secure control channel;
• and
• instructing the each node N(i) of the network to selectively invalidate an old encryption key when the old encryption key is no longer in use by all current peers of the node N(i) and all the current peers have transitioned to a new encryption key, wherein the security parameters for the node N(i) include at least one of the old encryption key and the new encryption key, and the old encryption key and the new encryption key are unique for the node N(i) with respect to every other device in the network.

A method for network security comprising a plurality of nodes N(i), the method comprising:

• generating, at each node N(i) of the network, security parameters for the node N(i), the security parameters comprising at least one encryption key;
• sending, by the node N(i), the security parameters to a controller via a secure control channel maintained with the controller;
• establishing, by the node N(i), communications with a node N(j) comprising:
• requesting security parameters associated with the node N(j) from the controller via the secure control channel;
• receiving the security parameters including an encryption key generated by the node N(j);
• and
• establishing a peer-to-peer session with the node N(j);
• and
• selectively invalidating, by the node N(i), an old encryption key when the old encryption key is no longer in use by all current peers of the node N(i) and all the current peers have transitioned to a new encryption key, wherein the security parameters for the node N(i) include at least one of the old encryption key and the new encryption key, and the old encryption key and the new encryption key are unique for the node N(i) with respect to every other device in the network.

A router for routing communications within a network, the router comprising:

• a processor;
• and
• a memory coupled to the processor, the memory storing instructions which when executed cause the router to perform a method, comprising:
• generating security parameters for the router, the security parameters comprising at least one encryption key;
• sending the security parameters to a controller via a secure control channel maintained with the controller, wherein the controller is an entity in the network distinct from the router;
• establishing communications with a router N(j) comprising:
• requesting security parameters associated with the router N(j) from the controller via the secure control channel;
• receiving the security parameters including an encryption key generated by the router N(j);
• and
• establishing a peer-to-peer session with the router N(j);
• and
• selectively invalidating, by the node N(i), an old encryption key when the old encryption key is no longer in use by all current peers of the node N(i) and all the current peers have transitioned to a new encryption key, wherein the security parameters for the node N(i) include at least one of the old encryption key and the new encryption key, and the old encryption key and the new encryption key are unique for the node N(i) with respect to every other device in the network.