Acknowledgement-based key retirement

1. A computer-implemented method for acknowledgement-based retirement of expired secure association keys (SAK), the method comprising:

generating, by a key server, a new SAK;

transmitting the new SAK to members of a connectivity association (CA);

installing, at the key server, the new SAK for key server ingress traffic;

receiving an ingress SAK installation acknowledgement from each of the members of the CA indicating successful installation of the new SAK for member ingress traffic;

installing, at the key server, the new SAK for key server egress traffic, based on receiving the ingress SAK installation acknowledgement from each of the members of the CA;

transmitting, to each of the members of the CA, a key server egress SAK installation notification, based on installing the new SAK for key server egress traffic;

retiring a prior SAK in response to an earlier occurrence of either:

expiration of a configurable SAK retirement buffer delay time period, the configurable SAK retirement buffer delay time period to start after the key server receives an egress SAK installation acknowledgement from each of the members of the CA, or

expiration of a configurable SAK retirement timeout.

2. The method of claim 1 , wherein the configurable SAK retirement timeout is dynamically adjusted based on previous receipt of the egress SAK installation acknowledgement from prior members of the CA.

3. The method of claim 1 , wherein the configurable SAK retirement buffer delay is determined dynamically based on a previous out-of-order packet time delay associated with out-of-order packets received at the key server.

4. The method of claim 1 , wherein the prior SAK is deleted if the key server does not receive the egress SAK installation acknowledgement from each of the members of the CA prior to the expiration of a configurable SAK retirement timeout.

5. The method of claim 1 , wherein the configurable SAK retirement timeout is forty-five seconds and the configurable SAK retirement buffer delay is ten seconds.

6. The method of claim 1 , further comprising:

receiving subsequent receive network packets from the members of the CA; and

decoding the subsequent receive network packets with the new SAK.

7. The method of claim 1 , further comprising:

encoding subsequent versions of new transmit network packets with the new SAK; and

transmitting the subsequent versions of the new transmit network packets to the members of the CA.

8. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor, perform a method of acknowledgement-based retirement of expired secure association keys (SAK), the method comprising:

generating, by a key server, a new SAK;

transmitting the new SAK to members of a connectivity association (CA);

installing, at the key server, the new SAK for key server ingress traffic;

receiving an ingress SAK installation acknowledgement from each of the members of the CA indicating successful installation of the new SAK for member ingress traffic;

installing, at the key server, the new SAK for key server egress traffic, based on receiving the ingress SAK installation acknowledgement from each of the members of the CA;

transmitting, to each of the members of the CA, a key server egress SAK installation notification, based on installing the new SAK for key server egress traffic;

retiring a prior SAK in response to an earlier occurrence of either:

receipt of an egress SAK installation acknowledgement from each of the members of the CA, or expiration of a configurable SAK retirement timeout.

9. The one or more non-transitory computer-readable media of claim 8 , further includes waiting for expiration of a configurable SAK retirement buffer delay after receipt of the egress SAK installation acknowledgement from each of the members of the CA.

10. The one or more non-transitory computer-readable media of claim 9 , wherein the configurable SAK retirement buffer delay is determined dynamically based a previous out-of-order packet time delay associated with out-of-order packets received at the key server.

11. The one or more non-transitory computer-readable media of claim 8 , wherein the prior SAK is deleted if the key server does not receive the egress SAK installation acknowledgement from each of the members of the CA prior to the expiration of a configurable SAK retirement timeout.

12. The one or more non-transitory computer-readable media of claim 8 , the method further comprising:

encoding subsequent versions of new transmit network packets with the new SAK; and

transmitting the subsequent versions of the new transmit network packets to the members of the connectivity association.

13. The one or more non-transitory computer-readable media of claim 8 , the method further comprising:

receiving subsequent network packets from the members of the CA; and

decoding new network packets with the new SAK.

14. The one or more non-transitory computer-readable media of claim 8 , wherein the method further comprises:

encoding subsequent network packets with the prior SAK; and

transmitting the subsequent network packets to the members of the CA prior to retirement of the prior SAK.

15. A member network device employing acknowledgement-based retirement of expired secure association keys (SAK), the network device comprising:

a processor associated with a control plane of the network device; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the processor, perform a method comprising:

receiving, from a key server, a new secure association key;

installing, at the member network device, the new SAK for peer ingress traffic;

transmitting, to the key server, an ingress SAK installation acknowledgement indicating successful installation of the new SAK for member ingress traffic;

receiving from the key server, a key server egress SAK installation notification, providing notification that the key server has installed the new SAK for key server egress traffic;

installing, at the member network device, the new SAK for peer egress traffic; and

retiring the expired SAK, based on receiving from the key server, a SAK retirement notification, providing notification that the key server has retired the expired SAK.

16. The member network device of claim 15 , wherein the method further comprises waiting for expiration of a configurable SAK retirement buffer delay after receiving the key server egress SAK installation notification.

17. The member network device of claim 16 , wherein the configurable SAK retirement buffer delay is determined dynamically based on a previous out-of-order packet time delay associated with out-of-order packets received at the member network device.

18. The member network device of claim 15 , wherein the expired SAK is retired if the key server does not receive an egress SAK installation acknowledgement from each of the members of a connectivity association (CA) prior to the expiration of a configurable SAK retirement timeout.

19. The member network device of claim 18 , wherein the method further comprises:

encoding subsequent network packets with a prior secure association key; and

transmitting the subsequent network packets to the members of a connectivity association (CA).

20. The member network device of claim 15 , wherein the method further comprises:

receiving subsequent network packets from members of a connectivity association (CA); and

decoding new network packets with the new secure association key.