Key distribution
View Patent ↗Methods and systems are provided for trusted key distribution. A key distribution or an identity service acts as an intermediary between participants to a secure network. The service provisions and manages the distribution of keys. The keys are used for encrypting communications occurring within the secure network.
1. A machine-implemented method to execute on a router, comprising:
servicing, by the router, network transactions for a participant in a homogeneous network, the network transactions are encrypted with a first key;
detecting, by the router, a transition of the participant to a neighboring network serviced by a neighboring service provider, the neighboring network is a heterogeneous network;
contacting, by the router, the neighboring service provider on behalf of the participant to acquire a second key for use with other network transactions serviced through the neighboring service provider, the other network transactions are encrypted with the second key;
distributing, by the router, the second key to the participant for transitioning to the participant to the neighboring service provider, the second key acquired by the participant in advance of communication being lost by the participant with the homogeneous network and communicating, by the router, changed communication keys made by the participant to each of other participants associated with the homogenous or heterogeneous networks; and
managing, by the router, key policies for both the homogeneous and the heterogeneous networks to ensure key entropy has not degraded beyond a predefined threshold, the key entropy referring to a length of time that the key is considered safe for usage based on: the length of the key, a total amount of network traffic that the key is used for encryption, and a repetitive nature of encrypted traffic using the key.
2. The method of claim 1 , wherein detecting further includes noticing a degradation in signal strength from the participant indicating the transition is approaching.
3. The method of claim 1 , wherein contacting further includes authenticating to the neighboring service provider.
4. The method of claim 1 , wherein contacting further includes authenticating to an identity service for acquiring an authentication mechanism which is processed to authenticate to the neighboring service provider.
5. The method of claim 1 , wherein contacting further includes acquiring the second key from an identity service.
6. The method of claim 1 further comprising, determining, by the router, an identity for the neighboring service provider via interactions with an identity service.
7. The method of claim 1 further comprising, determining, by the router, an identity for the neighboring service provider from a list of available neighboring service providers based at least in part on a direction from which signals are being received from the participant.
8. A machine-implemented method to execute on a router, comprising:
moving, by the router, a connection of a processing device from a local homogeneous secure network to a heterogeneous secure network when the processing device is determined to be in process of transitioning out of the homogeneous secure network service area;
acquiring, by the router, a second key from a neighboring service provider before the processing device transitions out of the homogeneous secure network service area and before communication is lost with the homogeneous secure network;
configuring, by the router, the processing device to use encrypted communications that utilize the second key when the processing device transitions to the heterogeneous secure network of the neighboring service provider and managing a change in an Internet Protocol (IP) address for the processing device that changes when the processing device transitions from the homogeneous secure network to the heterogeneous secure network, and communication, by the router, changed keys used for communication, the changed keys provided by the processing device of the participant that provides the changed keys and the changed keys communicated to other participants of the homogeneous secure network and the heterogeneous secure network when it is no longer considered safe to use original keys based on key lengths, a total amount of network traffic that the keys have been used for encryption, and a repetitive nature of encrypted traffic.
9. The method of claim 8 , wherein acquiring further includes using, by the router, a key distribution service or an identity service of the neighboring service provider to acquire the second key.
10. The method of claim 9 , wherein using further includes, authenticating, by the router, to the key distribution service or the identity service before acquiring the second key.
11. The method of claim 9 , wherein acquiring further includes, enlisting, by the router, a third-party service to provide an identity and authentication mechanism for interacting with the neighboring service provider.
12. The method of claim 9 , wherein acquiring further includes, accessing, by the router service, a predefined list of available neighboring service providers to identify and interact with the neighboring service provider.
13. The method of claim 9 , wherein acquiring further includes monitoring, by the router, signal degradation to acquire the second key when the signal degradation falls below a threshold established via a policy managed by the router.
14. The method of claim 9 further comprising, migrating an Internet Protocol (IP) address of the processing device from a first IP address to a second and new IP address when the processing device is migrated to the neighboring service provider.
15. A machine-implemented system, comprising:
a router configured to interact with key distribution service and the key distribution service configured to authenticate the router and to provide the router with a new encryption key for an edge device that is transitioning from a first secure network to a second secure network, the first secure network is a homogeneous network and the second secure network is a heterogeneous network and communication with the edge device is transitioned from the homogeneous network to the heterogeneous network before communication with the edge device is lost with the homogeneous network, and an IP address from the edge device is managed and changed when the edge device migrates to the heterogeneous network, and the router further configured to communicate other encryption keys provided by the edge device including other encryption keys replacing specific keys that are no longer considered safe for use based on key lengths, a total amount of network traffic that the specific keys have been used for encryption, and a repetitive nature of encrypted traffic, the edge device a laptop, a personal digital assistant, or a phone, and the other encryption keys supplied by a participant and communicated to other participants of the first secure network and the second secure network.
16. The system of claim 15 , wherein the key distribution service is enabled to interact with the participants in both the first and second secure networks.
17. The system of claim 15 , wherein the router is configured to forward unrecognized traffic in the first secure network to the key distribution service within the second secure network.
18. The system of claim 15 , wherein the key distribution service is enabled to manage key entropy policies for both the first and second secure networks.
19. The system of claim 15 , wherein the router is preconfigured to identify and interact with the key distribution service.
20. The system of claim 15 , wherein the router is configured to dynamically identify and dynamically interact with the key distribution service.