System and method for key management across geographic domains
View Patent ↗A method for managing encryption keys in a communication system having a plurality of communication devices includes establishing a set of cryptographic keys for secure communication. Each of the cryptographic keys is associated with a geographic region. A geographic region is determined for a communication device and at least one cryptographic key is distributed to the communication device based on the geographic region of the communication device. At least one cryptographic key may be used to derive further cryptographic keys associated with a set of sub-regions of the geographic region associated with the communication device.
1. A method for managing encryption keys in a communication system having a plurality of communication devices, the method comprising:
establishing a set of cryptographic keys for secure communication, each cryptographic key associated with a different geographic region;
determining a geographic region associated with a mobile communication device based on the geographic region of the mobile communication device;
forwarding one of the cryptographic keys in the set of cryptographic keys to the mobile communication device, the forwarded one of the cryptographic keys being selected in response to the determined geographic region of the mobile communication device and the geographic region associated with the forwarded one of the cryptographic keys;
detecting that the mobile device has moved to a new geographic region; and
forwarding a different one of the cryptographic keys to the communication device, the different one of the cryptographic keys being selected responsive to the new geographic region and the associated geographic region of the different one of the cryptographic keys.
2. A method according to claim 1 , wherein the at least one cryptographic key is used to derive further cryptographic keys associated with a set of sub-regions of the geographic region associated with the mobile communication device.
3. A communication system comprising:
a plurality of mobile communication devices;
a plurality of geographic regions and sub-regions;
a hierarchical tree of cryptographic keys, each cryptographic key associated with a geographic region or sub-region; and
wherein each mobile communication device changes which one of the cryptographic key is used for encrypting and decrypting transmissions as the mobile device changes geographic regions and wherein a selected cryptographic key is selected based on a geographic region of the mobile communication device and a geographic region associated with the selected cryptographic key.
4. A communication system according to claim 3 , wherein at least one cryptographic key in the hierarchical tree is derived by applying a mathematical function to the cryptographic key of the next higher level in the hierarchical tree.
5. A computer program product for use on a computer system for managing encryption keys in a communication system having a plurality of mobile communication devices, the computer system comprising a processing device and a storage device having computer readable code of the computer program product stored thereon, the computer readable program code comprising:
program code operable when executed to establish a set of cryptographic keys for secure communication, each cryptographic key associated with a geographic region;
program code operable when executed to determine a geographic region associated with a mobile communication device;
program code operable when executed to select and distribute at least one cryptographic key to the mobile communication device based on the geographic region of the mobile communication device, the at least one cryptographic key being selected in response to the geographic region associated with the at least one cryptographic key and the determined geographic region associated with the mobile communication device;
program code operable when executed to detect that the mobile communication device has moved to a new geographic region; and
program code operable when executed to distribute at least one cryptographic key to the mobile communication device based on the new geographic region of the mobile communication device and the geographic region associated with the at least one cryptographic key.
6. A computer program product according to claim 5 , wherein the at least one cryptographic key is used to derive further cryptographic keys associated with a set of sub-regions of the geographic region associated with the mobile communication device.