GROUP KEY MANAGEMENT RE-REGISTRATION METHOD

• US 20100142711A1
• Filed: 12/09/2008
• Published: 06/10/2010
• Est. Priority Date: 12/09/2008
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Weis, Brian, McGrew, David
• Granted Patent: US 8,204,228 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

In an embodiment, a fast group key management re-registration is described. One computer-implemented method comprises, at a key server: receiving a registration request from a network element to join a group of network elements managed by the key server; generating and storing a group member registration state comprising information identifying the network element within the group of network elements; generating a token using information from the group member registration state, wherein the token identifies the network element within the group; deleting the group member registration state for the network element at the key server; generating an encrypted token by encrypting the token using a secret key that is local to the key server; sending the encrypted token to the network element; receiving the encrypted token along with a re-registration request from the network element to re-join the group of network elements; and re-registering the network element using the encrypted token.

Claims

1. A computer-implemented method comprising:

at a key server;

receiving a registration request from a network element to join a group of network elements managed by the key server;

generating and storing a group member registration state comprising information identifying the network element belonging to the group of network elements;

generating a token using information from the group member registration state, wherein the token identifies the network element belonging to the group of network elements;

deleting the group member registration state for the network element at the key server;

generating an encrypted token by encrypting the token using a secret key that is local to the key server;

sending the encrypted token to the network element;

receiving a re-registration request from the network element to rejoin the group of network elements, wherein the re-registration request comprises the encrypted token;

generating a decrypted token by decrypting the encrypted token using the secret key;

using data from the decrypted token, recovering and storing the group member registration state, comprising information identifying the network element belonging to the group of network elements; and

re-registering the network element using the information from the group member registration state.

2. The method of claim 1, further comprising:

generating a new token using information from the group member registration state, wherein the new token identifies the network element that has been re-registered;

deleting the group member registration state for the network element that has been re-registered;

generating an encrypted new token by encrypting the new token using the secret key that is local to the key server; and

sending the encrypted new token to the network element that has been re-registered.

3. The method of claim 1, wherein communications between the network element and the key server are implemented using a Group Domain Of Interpretation (GDOI) protocol.

4. The method of claim 1, wherein the token further comprises data identifying a communication session between the network element and the key server.

5. The method of claim 1, wherein the sending the encrypted token to the network element further comprises sending a time stamp associated with a moment in time when the token was generated.

6. The method of claim 1, wherein the sending the encrypted token to the network element further comprises encapsulating the encrypted token into an IKE NOTIFY message.

7. The method of claim 1, wherein the encrypted token is treated by the network element as an opaque blob.

8. The method of claim 1, wherein the secret key that is local to the key server is also shared by at least one other key server.

9. A computer-implemented method comprising:

at a network element;

sending a registration request to a key server to join a group of network elements managed by the key server;

receiving a token generated by the key server, wherein the token identifies the network element belonging to the group of network elements;

generating a group member registration state comprising information identifying the network element belonging to the group of network elements;

storing the token in the group member registration state; and

sending a re-registration request along with the token to the key server to re-join the group of network elements managed by the key server.

10. The method of claim 9, further comprising:

awaiting receiving of a new token from the key server as a confirmation that the network element is re-registered with the group managed by the key server.

11. The method of claim 9, wherein communications between the network element and the key server are implemented using a Group Domain Of Interpretation (GDOI) protocol.

12. The method of claim 9, wherein the token further comprises data identifying a communication session between the network element and the key server.

13. The method of claim 9, wherein the token is sent encapsulated in an IKE NOTIFY message.

14. The method of claim 9, wherein the network element treats the token as an opaque blob.

15. A computer-readable storage medium storing one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform:

at a key server;

receiving a registration request from a network element to join a group of network elements managed by the key server;

generating and storing a group member registration state comprising information identifying the network element belonging to the group of network elements;

generating a token using information from the group member registration state, wherein the token identifies the network element belonging to the group of network element;

deleting the group member registration state for the network element at the key server;

generating an encrypted token by encrypting the token with a secret key that is local to the key server;

sending the encrypted token to the network element;

receiving a re-registration request from the network element to rejoin the group of network elements, wherein the re-registration request comprises the encrypted token;

generating a decrypted token by decrypting the encrypted token using the secret key;

using data from the decrypted token, recovering and storing the group member registration state, comprising information identifying the network element belonging to the group of network elements; and

re-registering the network element using the information from the group member registration state.

16. The computer-readable storage medium of claim 15, further comprising instructions which when executed cause:

generating a new token using information from the group member registration state;

deleting the group member registration state for the network element that has been re-registered;

generating an encrypted new token by encrypting the new token using the secret key that is local to the key server; and

sending the encrypted new token to the network element that has been re-registered.

17. The computer-readable storage medium of claim 15, wherein communications between the network element and the key server are implemented using a Group Domain Of Interpretation (GDOI) protocol.

18. The computer-readable storage medium of claim 15, wherein the token further comprises data identifying a communication session between the network element and the key server.

19. The computer-readable storage medium of claim 15, wherein the sending the encrypted token to the network element further comprises sending a time stamp associated with a moment in time when the token was generated.

20. The computer-readable storage medium of claim 15, wherein the sending the encrypted token to the network element further comprises encapsulating the encrypted token into an IKE NOTIFY message.