Mechanism for co-ordinated authentication key transition for IS-IS protocol

1. An automated key transition method executed by a node in a network, the network including a set of nodes that are directly and indirectly interconnected, reachable and utilizing a current key identifier, a key identifier specifies an authentication protocol and an authentication key for use in the authentication of intermediate-system to intermediate-system (IS-IS) protocol data units within an IS-IS network, area or domain, the method including a set of steps comprising:

receiving a message at the node, the message having a most recent key field to hold a most recent key identifier, the message indicating to replace the current key identifier with the most recent key identifier;

advertising receipt of the most recent key to all reachable nodes of the set of nodes;

verifying, by the node, whether all reachable nodes in the set of nodes have advertised the most recent key identifier;

continuing authentication using the current key identifier until all reachable nodes in the set of nodes have been verified to advertise the most recent key identifier; and

switching authentication at the node to use the most recent key identifier upon verification that all reachable nodes in the set of nodes have advertised the most recent key identifier.

2. The automated key transition method of claim 1 , further comprising the steps of:

starting a time out counter in response to receiving the most recent key identifier; and

generating a notification of a failure of a node to transition in response to expiration of the counter without verification of all reachable nodes in the set of nodes advertising the most recent key identifier.

3. The automated key transition method of claim 1 , further comprising the steps of:

counting a reachable node as verified in response to receiving a message including the most recent key identifier from the reachable node.

4. The automated key transition method of claim 1 , wherein the advertising further comprises:

sending an IS-IS hello message containing the most recent key field in a type length value (TLV).

5. The automated key transition method of claim 1 , further comprising the step of:

removing the current key identifier in response to switching authentication to use the most recent key identifier.

6. The automated key transition method of claim 1 , further comprising:

advertising the most recent key identifier to all reachable nodes in the set of nodes; and

sending a Sequence Number Packet (SNP) message including the most recent key field in a type length value (TLV).

7. The automated key transition method of claim 1 , further comprising the step of:

generating a link state protocol (LSP)-0 with a new sequence number including the most recent key field in a type length value (TLV).

8. A node configured to execute an automated key transition method for a network, the network including a set of nodes that are directly and indirectly interconnected, reachable and utilizing a current key identifier, a key identifier specifies an authentication protocol and an authentication key for use in the authentication of intermediate-system to intermediate-system (IS-IS) protocol data units within an IS-IS network, area, or domain, the node comprising:

a network interface for sending and receiving IS-IS messages to the set of nodes via adjacent nodes in the network; and

a network processor coupled to the network interface, the network processor configured to execute a local key database manager and an IS-IS module,

the local key database manager configured to receive a message having a most recent key field to hold a most recent key identifier, the message indicating to replace the current key identifier with the most recent key identifier,

the IS-IS module including an IS-IS key manager that is configured to continue authentication using the current key identifier until all reachable nodes in the set of nodes have been verified to advertise the most recent key identifier, to advertise receipt of the most recent key to all reachable nodes of the set of nodes, to verify whether all reachable nodes in the set of nodes have advertised the most recent key identifier, and to switch authentication to use the most recent key identifier upon verification that all reachable nodes in the set of nodes have advertised the most recent key identifier.

9. The node of claim 8 , wherein the IS-IS key manager further comprises:

a time-out module coupled to or executed by the network processor, the time-out module is configured to start a time out counter in response to receiving the most recent key identifier, and configured to generate a notification of a failure of a node to transition in response to expiration of the counter without verification of all reachable nodes in the set of nodes advertising the most recent key identifier.

10. The node of claim 8 , wherein the IS-IS key manager is further configured to count a reachable node as verified in response to receiving a message including the most recent key identifier from the reachable node.

11. The node of claim 8 , wherein the IS-IS key manager is further configured to advertise by sending an IS-IS hello message containing the most recent key field in a type length value (TLV).

12. The node of claim 8 , wherein the local key database manager is further configured to remove the current key identifier in response to the IS-IS module switching authentication to use the most recent key identifier.

13. The node of claim 8 , wherein the IS-IS key manager is further configured to advertise the most recent key identifier to all reachable nodes in the set of nodes by sending a Sequence Number Packet (SNP) message including the most recent key field in a type length value (TLV).

14. The node of claim 8 , wherein the IS-IS key manager is further configured to generate a link state protocol (LSP)-0 with a new sequence number including the most recent key field in a type length value (TLV).