# US 9,882,714 B1 · Method and apparatus for enhanced distribution of security keys

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,882,714 B1
- Document ID: US9882714B1
- Status: Granted
- Kind: B1
- Application number: 14/203,542
- Filed: 2014-03-10
- Granted: 2018-01-30
- Earliest claimed: 2013-03-15
- Assignees: Certes Networks, Inc.
- Applicants: Certes Networks, Inc.
- Inventors: Todd L. Cignetti; Miles S. Krivoshia; Ganesh Murugesan; Timothy J. Megela
- Web page: https://patentgrep.com/patent/US9882714B1

## CPC

- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/065: {for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833)}
- H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In many secure communication systems, group keys are updated on a regular basis in order to maintain high security level. Decryption and encryption keys are typically updated simultaneously in policy enforcement points (PEPs). Such approach makes the respective communication system prone to dropping of network traffic. According to at least one embodiment, re-keying is performed by installing, at a first phase, a new decryption key at the PEPs without removing an old decryption key previously installed in the PEPs. At a second phase, a new encryption corresponding to the new decryption key is installed and an old encryption key corresponding to the old decryption is removed. At a third stage, the old decryption key and any other old decryption keys are removed from the PEPs.

## Claims

### Claim 1

A method of updating security keys in a group of policy enforcement points (PEPs), the method comprising:
providing a new decryption key to each PEP, and causing each PEP to support decryption using the new decryption key while still supporting decryption using an old decryption key previously installed in each PEP;
waiting until receipt of a first acknowledgement from each and every PEP in the group of PEPs, the first acknowledgement indicating that each PEP has installed and is supporting the new decryption key, and upon receipt of all the first acknowledgements, providing a new encryption key, corresponding to the new decryption key, to each PEP of the PEP group, and causing each PEP to support encryption using the new encryption key and halt support of encryption using a previously-installed old encryption key that corresponds to the old decryption key; and
waiting until receipt of a second acknowledgement from each and every PEP in the group of PEPs, the second acknowledgement indicating that each PEP has installed and is supporting the new encryption key, and has halted support of encryption using the old encryption key, and upon receipt of all the second acknowledgements, causing each PEP to (i) halt support of the old decryption key and (ii) remove any decryption keys older than the new decryption key and (iii) remove any encryption keys older than the new encryption key.

### Claim 2 (depends on 1)

A method according to claim 1, wherein the group of PEPs are caused to support decryption using the new decryption key while still supporting decryption using the old decryption key for a period of time; and
said causing includes:
sending the new decryption key to the group of PEPs; or
sending instruction to install the new decryption key to the group of PEPs.

### Claim 3 (depends on 1)

A method according to claim 1, further including receiving an acknowledgement from each PEP of the group of PEPs indicating that the new decryption key is installed therein.

### Claim 4 (depends on 1)

A method according to claim 1, further including receiving an acknowledgement from each PEP of the group of PEPs indicating that the new encryption key is installed therein.

### Claim 5 (depends on 1)

A method according to claim 1, wherein causing each PEP to support encryption using the new encryption key and halt support of encryption using a previously-installed old encryption key that corresponds to the old decryption key includes:
sending the new encryption key to each PEP of the group of PEPs; or
sending instruction to install the new encryption key to each PEP of the group of PEPs.

### Claim 6

An apparatus for updating security keys in a group of policy enforcement points (PEPs) comprising:
a key server; and
at least one processor operatively coupled to the key server and configured to:
provide a new decryption key to each PEP, and cause each PEP to support decryption using the new decryption key while still supporting decryption using an old decryption key previously installed in each PEP;
wait until receipt of a first acknowledgement from each and every PEP in the group of PEPs, the first acknowledgement indicating that each PEP has installed and is supporting the new decryption key, and upon receipt of all the first acknowledgements, provide a new encryption key, corresponding to the new decryption key, to each PEP of the PEP group, and cause each PEP to support encryption using the new encryption key and halt support of encryption using a previously-installed old encryption key that corresponds to the old decryption key; and
wait until receipt of a second acknowledgement from each and every PEP in the group of PEPs, the second acknowledgement indicating that each PEP has installed and is supporting the new encryption key, and has halted support of encryption using the old encryption key, and upon receipt of all the first acknowledgements, cause each PEP to (i) halt support of the old decryption key and (ii) remove any decryption keys older than the new decryption key and (iii) remove any encryption keys older than the new encryption key.

### Claim 7 (depends on 6)

An apparatus as claimed in claim 6 wherein the at least one processor supports decryption at the group of PEPs by using the new decryption key while still supporting decryption using the old decryption key for a period of time; and
the key server is configured to:
send the new decryption key to the group of PEPs; or
send instruction to install the new decryption key to the group of PEPs.

### Claim 8 (depends on 6)

An apparatus as claimed in claim 6 wherein the key server receives an acknowledgement from each PEP of the group of PEPs indicating that the new decryption key is installed therein.

### Claim 9 (depends on 6)

An apparatus as claimed in claim 6 wherein the key server receives an acknowledgement from each PEP of the group of PEPs indicating that the new encryption key is installed therein.

### Claim 10 (depends on 6)

An apparatus as claimed in claim 6 wherein the at least one processor causes each PEP of the group of PEPs to update the old encryption key with the new encryption key in response to the key server:
sending the new encryption key to the group of PEPs; or
sending instruction to install the new encryption key to the group of PEPs.

### Claim 11

A computer program product updating security keys in a plurality of policy enforcement points (PEPs), comprising:
a non-transitory computer-readable medium storing computer software instructions, and
the computer software instructions when executed by a processor cause a computer system to:
providing a new decryption key to each PEP, and causing each PEP to support decryption using the new decryption key while still supporting decryption using an old decryption key previously installed in each PEP;
waiting until receipt of a first acknowledgement from each and every PEP in the group of PEPs, the first acknowledgement indicating that each PEP has installed and is supporting the new decryption key, and upon receipt of all the first acknowledgements, providing a new encryption key, corresponding to the new decryption key, to each PEP of the PEP group, and causing each PEP to support encryption using the new encryption key and halt support of encryption using a previously-installed old encryption key that corresponds to the old decryption key; and
waiting until receipt of a second acknowledgement from each and every PEP in the group of PEPs, the second acknowledgement indicating that each PEP has installed and is supporting the new encryption key, and has halted support of encryption using the old encryption key, and upon receipt of all the second acknowledgements, causing each PEP to (i) halt support of the old decryption key and (ii) remove any decryption keys older than the new decryption key and (iii) remove any encryption keys older than the new encryption key.