Method and system for key generation, distribution and management

1. A method comprising:

at a network including a plurality of nodes and a controller connected to each of the plurality of nodes via respective secure control channels:

generating by a first node of the plurality of nodes, security parameters for the first node;

transmitting by the first node, the security parameters to the controller over a first secure control channel, of the respective secure control channels, between the first node and the controller;

maintaining by the controller the security parameters for the first node;

receiving by the controller a request from a second node of the plurality of nodes for the security parameters of the first node;

retrieving by the controller the security parameters of the first node;

transmitting by the controller the security parameters of the first node to the second node over a second secure control channel, of the respective secure control channels, between the second node and the controller; and

receiving by the controller a rekey message with a new key for the first node, the rekey message generated according to a rekey timer before a current key for the first node expires.

2. The method of claim 1 , further comprising:

determining, via an old-key timer, how long to maintain an old key after the receiving of the new key;

identifying current peers of the first node; and

pushing the new key to each of the current peers.

3. The method of claim 1 , further comprising:

selectively invalidating an old key by each node when all of the current peers have transitioned to a new key.

4. A method comprising:

at a controller of a network including a plurality of nodes and the controller:

maintaining respective secure control channels with each of the plurality of nodes;

receiving from a first node of the plurality of nodes, security parameters for the first node generated by the first node and transmitted via a first secure control channel, of the respective secure control channels, between the controller and the first node;

storing the security parameters received for the first node;

receiving from a second node of the plurality of nodes, via a second secure control channel, of the respective secure control channels, between the controller and the second node, a request for the security parameters associated with the first node;

responsive to the request, sending the security parameters associated with the first node to the second node via the second secure control channel; and

receiving a rekey message with a new key for the first node, the rekey message generated according to a rekey timer before a current key for the first node expires.

5. The method of claim 4 , further comprising:

storing the new key as associated with the first node;

determining, via an old-key timer, how long to maintain an old key after the receiving of the new key;

determining current peers for the first node; and

pushing the new key to each node that is a current peer of the first node via the corresponding secure control channel.

6. A controller comprising;

a processor; and

a memory coupled to the processor, the memory storing instructions which when executed perform a method for key distribution, comprising:

maintaining respective secure control channels with each of a plurality of nodes of a network;

receiving from a first node of the plurality of nodes, security parameters for the first node generated by the first node N(i) and transmitted via a first secure control channel, of the respective secure control channels, between the controller and the first node;

storing the security parameters received for the first node;

receiving from a second node of the plurality of nodes, via a second secure control channel, of the respective secure control channels, between the controller and the second node, a request for the security parameters associated with the first node;

responsive to the request, sending the security parameters associated with the first node to the second node via the second secure control channel; and

receiving a rekey message with a new key for the first node, the rekey message generated according to a rekey timer before a current key for the first node expires.

7. The controller of claim 6 , wherein the method further comprises:

storing the new key as associated with the first node;

determining, via an old-key timer, how long to maintain an old key after the receiving of the new key;

determining current peers for the first node; and

pushing the new key to each node that is a current peer of the first node via the corresponding secure control channel.

8. The method of claim 1 , further comprising:

establishing, by the first node, the first secure control channel between the first node and the controller.

9. The method of claim 1 , further comprising:

establishing, by the second node, the second secure control channel between the second node and the controller.

10. The method of claim 1 , wherein the security parameters include an encryption key and a decryption key.

11. The method of claim 1 , wherein the security parameters include a security profile.

12. The method of claim 4 , further comprising:

establishing the respective secure control channels with each of the plurality of nodes.

13. The method of claim 12 , wherein establishing the respective secure control channels comprises:

establishing the first secure control channel between the controller and the first node.

14. The method of claim 12 , wherein establishing the respective secure control channels comprises:

establishing the second secure control channel between the controller and the second node.

15. The method of claim 4 , wherein receiving the security parameters for the first node comprises receiving an encryption key and a decryption key from the first node.

16. The method of claim 4 , wherein receiving the security parameters for the first node comprises receiving a security profile from the first node.

17. The method of claim 6 , further comprising:

establishing the first secure control channel between the controller and the first node.

18. The method of claim 6 , further comprising:

establishing the second secure control channel between the controller and the second node.

19. The method of claim 6 , wherein receiving the security parameters for the first node comprises receiving an encryption key and a decryption key from the first node.

20. The method of claim 6 , wherein receiving the security parameters for the first node comprises receiving a security profile from the first node.