Techniques for distributing a new communication key within a virtual private network

• US 20070209071A1
• Filed: 03/06/2006
• Published: 09/06/2007
• Est. Priority Date: 03/06/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Weis, Brian, Rowles, Sheela, Sastry, Shashi
• Granted Patent: US 8,347,376 B2
• Time in Patent Office: Days
• US Class Current: 726/15
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819

Abstract

Techniques for distributing a new communication key within a group virtual private network (VPN) are provided. A key distribution service determines that a new communication key for a VPN is to be distributed to members of the VPN. The new communication key is sent individually in a unique and separate message to each of the members. The key distribution service also maintains records to determine which of the members have and have not successfully received the new communication key.

Claims

1. A method, comprising:

determining to distribute a new communication encryption key to members of a virtual private network;

individually sending a unicast message to each member with the new encryption key; and

tracking select members who have acknowledged receipt of the new encryption key.

2. The method of claim 1, wherein determining further includes deciding to distribute the new encryption key in response to at least one of:

evaluation of a policy, instruction from an authorized one of the members, and occurrence of a configured event or condition.

3. The method of claim 1, wherein individually sending further includes regulating a rate at which each unicast message is sent to control a response rate for which acknowledgements are received from the members.

4. The method of claim 1, wherein individually sending further includes encrypting each unicast message with a different key and optionally signing the unicast message before sending to each of the members.

5. The method of claim 1, wherein tracking further includes recording a sequence number associated with each acknowledgement received to identify the new encryption key, and wherein identities for the members are acquired with each acknowledgement.

6. The method of claim 1 further comprising, resending the new encryption key to select members who have not responded with an acknowledgement pursuant to a policy.

7. The method of claim 5 further comprising, deciding pursuant to the policy that a specific and repeatedly non-responsive one of the members is to be removed from the members and from participation within the virtual private network.

8. A method, comprising:

directly sending a unique message to each member of a virtual private network (VPN), wherein a new encryption key is included in the unique message for use in communications among the members within the VPN; and

maintaining records to identify which of the members have successfully received the unique message and which of the members have not successfully received the unique message.

9. The method of claim 8, wherein directly sending further includes controlling the rate at which the unique message is sent out.

10. The method of claim 8, wherein directly sending further includes unicasting each unique message over a network to each of the members.

11. The method of claim 8, wherein directly sending further includes encrypting each unique message before sending to each of the members.

12. The method of claim 8, wherein directly sending further includes associating a sequence number with each unique message that permits each sequence number to be associated with the new encryption key.

13. The method of claim 12, wherein maintaining further includes selectively receiving acknowledgments from a number of the members, wherein the acknowledgments include the identities of responding members permitting the responding members to be identified and to be noted within the records as having properly received the unique message with the new encryption key.

14. A system, comprising:

a virtual private network (VPN); and

key distribution service, wherein the VPN includes a group of members and is to use encryption for communications between the members of the group, and wherein the encryption is defined by a key, and wherein the key distribution service is to distribute a changed key for the VPN to the group by messages individually sent to each of the members of the group.

15. The system of claim 14, wherein the key distribution service is to unicast the changed key within the messages to each of the members of the group.

16. The system of claim 14, wherein the key distribution service is to maintain records indicating which of the members have been sent the changed key and which of the members have and have not acknowledged the changed key.

17. The system of claim 14, wherein the key distribution service is to evaluate policy to determine a rate for individually sending the messages to the members of the group.

18. The system of claim 14, wherein the key distribution service is to evaluate policy to determine when and if subsequent messages with the changed key are to be resent to a number of the members that appear to be unresponsive.

19. The system of claim 14, wherein the key distribution service is to encrypt and optionally sign the messages before sending to the members of the group.

20. A system, comprising:

a means for sending a new encryption key to members of a virtual private network (VPN); and

a means for maintaining records to indicate which of the members have successfully received the new encryption key, and wherein the means for sending the new encryption key individually sends a unique message having the changed key to each of the members separately.

21. The system of claim 20 further comprising, a means for encrypting each of the unique messages and for optionally signing each of the unique messages.

22. The system of claim 20 further comprising, a means for deciding whether to remove select members due to non responsiveness.

23. The system of claim 20, wherein the means for sending further includes a means for determining a rate at which each unique message is sent out to the members.

24. The system of claim 20 wherein the means for sending further includes a means for assigning a sequence number to each unique message, wherein a particular sequence number is associated with the new encryption key.

25. The system of claim 24 further comprising, a means for updating the records in response to acknowledgments received from the members, wherein each acknowledgement includes an identity of one of the responding members and the sequence number.