Key negotiation and management for third party access to a secure communication session
View Patent ↗Described are a method and system for establishing a secure communication session with third-party access at a later time. A first communication subsession is established between two original devices using a first key generated by a two-party key and security association protocol. At least one of the original devices is established as a group key server. A request from a joining device to join the secure communication session is received and a second communication subsession is established between the original devices using a second key generated by the two-party key and security association protocol. The second key is provided to the joining device to enable participation in the second communication subsession.
1. A method for establishing a secure communication session with third-party access at a later time, the method comprising:
establishing a first communication subsession between two original devices using a first key generated by a two-party key and security association protocol;
establishing one of the original devices as a group key server;
receiving a request from a joining device to join the secure communication session;
after receiving the request, establishing a second communication subsession between the original devices using a second key generated by the two-party key and security association protocol; and
providing the second key to the joining device to enable participation in the second communication subsession.
2. The method of claim 1 further comprising verifying credentials of the joining device for authorization to join the secure communication session prior to establishing the second communication subsession.
3. The method of claim 1 wherein the two-party key and security association protocol comprises a SSL protocol.
4. The method of claim 1 wherein the two-party key and security association protocol comprises an IKE protocol.
5. The method of claim 1 wherein establishing one of the original devices as a group key server comprises executing a group key distribution protocol.
6. The method of claim 5 wherein the group key distribution protocol comprises one of a GDOI protocol, MIKEY protocol and GSAKMP protocol.
7. A system for establishing a secure communication session enabling third-party access at a later time, the system comprising a first original device and a second original device each configured to establish a first communication subsession with the other original device using a first key generated by a two-party key and security association protocol, the first original device adapted to receive a request to participate in the secure communication session from a joining device and to generate and download a group key for a second communication subsession to the joining device in response thereto wherein the first communication subsession between the first and second original devices is terminated and a second communication subsession between the first and second original devices is established, and the second original device having a group authorization module adapted to receive a request to participate in a secure communication session from a second joining device and to provide a second group key for a third communication subsession wherein the second communication subsession between the first and second original devices is terminated and a third communication subsession between the first and second original devices is established.
8. The system of claim 7 further comprising a joining device in communication with the first original device and adapted for participation in the second communication subsession using the group key.