Key distribution
Methods and systems are provided for trusted key distribution. A key distribution or an identity service acts as an intermediary between participants to a secure network. The service provisions and manages the distribution of keys. The keys are used for encrypting communications occurring within the secure network.
1. A machine-implemented system, comprising:
an identity service interface implemented in a processing device and to execute on the processing device;
a service provider interface implemented in a router and to execute on the router; and
a participant interface implemented in an edge device and to execute on the edge device, wherein the identity service interface is configured to interact securely with an identity service to manage keys, the service provider interface and participant interface both configured for communications with one another via the keys, the identity service configured to facilitate secure communications engaged in by the multiple participants via the keys, the identity service also configured: to coordinate any keys from one or more of the participants, to revoke some keys, and to distribute, and wherein the keys are Wired Equivalent Privacy (WEP) encrypted the keys.
2. The network service system of claim 1 , further comprising a list of trusted service providers configured for communication through the service provider interface.
3. The network service system of claim 2 , wherein the list is configured to be dynamically modified or to be augmented through interactions with the identity service through the identity service interface.
4. The network service system of claim 1 , wherein the participant interface is configured to service network traffic received from participants, and wherein the identity service is configured to dynamically encrypt the network traffic with one of the keys.
5. The network service system of claim 1 , wherein the participant interface is configured to generate a new key for encrypted communications between the participant interface and the one or more participants, and wherein the identity service interface is configured to communicate the new key to the identity service.
6. The network service system of claim 1 , wherein the participant interface is configured to communicate wirelessly with the one or more participants.
7. The network service system of claim 1 , wherein the service provider interface is configured to acquire additional keys for interacting with one or more service providers, and wherein the participant interface is configured communicate the additional keys to the one or more participants when one or more of the participants are detected as reaching a diminished signal strength as measured by a predefined threshold, and wherein the additional keys are configured to transition the one or more participants to the one or more service providers.
8. A machine-implemented method to execute on a router, comprising:
authenticating, by the router, to an identity service to acquire an encryption key for a wireless network connection, the encryption key is encrypted via Wired Equivalent Privacy (WEP);
acquiring, by the router, an identity for a service provider using the encryption key; and
transitioning, by the router, a participant of a first secure network to a second secure network using the encryption key when the participant is detected as geographically moving into the second secure network, the second secure network using the encryption key for communications and an original Internet Protocol (IP) address for the participant associated with the first secure network changes when the participant transitions to the second secure network.
9. The method of claim 8 further comprising, monitoring, by the router, a signal strength for the first secure network as held by the participant and comparing against a threshold to determine if a transition of the participant to the second secure network is necessitated.
10. The method of claim 8 further comprising, using, by the router, the identity service to communicate with the participant when the router detects that the participant is using an unrecognized format to communicate within the first secure network.
11. The method of claim 8 , wherein acquiring further includes selecting, by the router, the identity from a list of available service providers supplied by the identity service in accordance with a policy.
12. The method of claim 8 , wherein transitioning further includes detecting a direction and signal strength of communications occurring with the participant within the first secure network with the router to determine when to transition to the second secure network.
13. The method of claim 12 , wherein detecting further includes selecting the identity in response to the direction and the signal strength.
14. The method of claim 8 further comprising, passing control, by the router, of communications sent from and received by the participant to another router associated with the second secure network.
15. A machine-implemented method to execute on a router, comprising:
identifying, by the router, a first secure network having first communications with a participant using a first encryption key;
determining, by the router, that participant is moving out of the service area of the first secure network;
locating, by the router, a second secure network using a second encryption key for second communications; and
configuring, by the router, the participant to use the second communications having the second encryption key of the second secure network and changing an original Internet Protocol (IP) address for the participant as used in the first secure network to a different IP address for the participant in the second secure network, the first encryption key and the second encryption key encrypted via Wired Equivalent Privacy (WEP).
16. The method of claim 15 , wherein determining further includes monitoring signal direction and signal strength to determine when the participant is moving out of the service area.
17. The method of claim 16 , wherein monitoring further includes comparing threshold values against values obtained for the signal direction and the signal strength to determine when the participant is moving out of the service area.
18. The method of claim 16 , wherein locating further includes contacting a third-party authentication service for an identity of the second secure network.
19. The method of claim 16 , wherein locating further includes accessing a predefined list to acquire an identity of the second secure network.