Asymmetrical multi-channel communication security
The described techniques address issues related to secured communications via asymmetrical data communications, e.g. when one of the secured channels has a higher-bandwidth than the other secured channel. The techniques facilitate the detection of an impending expiration of a cryptographic key used for secured communications prior to its actual expiration and, in response, updating the cryptographic key for that secured channel. The updated cryptographic key for one secured channel may then be transmitted via the other secured channel as part of secured (e.g. encrypted) data communications. The techniques also allow for the use of different cryptographic algorithms per secured channel, different key lengths for the cryptographic keys, and/or different software or hardware solutions to be implemented per secured channel.
1 . A device configured to communicate data over a set of secure channels, the device comprising:
first secured channel circuitry configured to perform, via a first secured channel, secured bidirectional data communications with a further device using a first key;
second secured channel circuitry configured to perform, via a second secured channel, secured unidirectional data communications with the further device using a second key; and
processing circuitry configured to update the second key based upon an index value satisfying a predetermined condition,
wherein the first secured channel circuitry is further configured to transmit the updated second key to the further device via the first secured channel as part of the secured bidirectional data communications, and
wherein the second secured channel circuitry is configured to perform the secured unidirectional data communications with the further device using the updated second key.
2 . The device of claim 1 , wherein the second secured channel circuitry is configured to update the index value in response to data being transmitted or received via the second secured channel, and
wherein the secured unidirectional data communications utilizes the second key and the index value.
3 . The device of claim 1 , wherein the first secured channel and the second secured channel are configured to operate at different bandwidths.
4 . The device of claim 1 , wherein the processing circuitry is configured to update the first key based upon a further index value satisfying a further predetermined condition, and
wherein the processing circuitry is configured to update the second key at a faster rate than the first key.
5 . The device of claim 1 , wherein:
the secured bidirectional data communications comprises communications in accordance with a first layer security protocol,
the secured unidirectional data communications comprises communications in accordance with a second layer security protocol, and
the first layer security protocol is a higher layer security protocol than the second layer security protocol.
6 . The device of claim 5 , wherein the first layer security protocol comprises an Internet Protocol Security (IPsec) security protocol, and
wherein the second layer security protocol comprises a Media Access Control Security (MACsec) security protocol.
7 . The device of claim 1 , wherein the first secured channel and the second secured channel are physically separated from one another between the device and the further device.
8 . The device of claim 1 , wherein the first and the second keys comprise different key lengths.
9 . The device of claim 1 , wherein the first secured channel circuitry is configured to perform the secured bidirectional data communications with the further device via execution of computer-readable instructions by the processing circuitry, and
wherein the second secured channel circuitry is configured to perform the secured unidirectional data communications with the further device via hardware components.
10 . The device of claim 1 , wherein the secured bidirectional data communications comprises an authenticated encryption with associated data (AEAD) encryption scheme, and
wherein the secured unidirectional data communications comprises an authentication only scheme.
11 . The device of claim 1 , wherein the secured bidirectional data communications comprises an authentication only scheme, and
wherein the secured unidirectional data communications comprises an authenticated encryption with associated data (AEAD) encryption scheme.
12 . The device of claim 1 , wherein the secured bidirectional data communications and the secured unidirectional data communications transfer different types of data between the device and the further device.
13 . A method for communicating data over a set of secure channels, comprising:
performing, via a first secured channel, secured bidirectional data communications with a device using a first key;
performing, via a second secured channel, secured unidirectional data communications with the device using a second key;
updating the second key based upon an index value satisfying a predetermined condition;
transmitting the updated second key to the device via the first secured channel as part of the secured bidirectional data communications; and
performing, via the second secured channel, the secured unidirectional data communications with the device using the updated second key.
14 . The method of claim 13 , further comprising:
updating the index value in response to data being transmitted or received via the second secured channel,
wherein the performing the secured unidirectional data communications comprises utilizing the second key and the index value.
15 . The method of claim 13 , wherein the first secured channel and the second secured channel are configured to operate at different bandwidths.
16 . The method of claim 13 , further comprising:
updating the first key based upon a further index value satisfying a further predetermined condition,
wherein updating the second key comprises updating the second key at a faster rate than the first key.
17 . The method of claim 13 , wherein the secured bidirectional data communications comprises communications in accordance with a first layer security protocol, and
wherein the secured unidirectional data communications comprises communications in accordance with a second layer security protocol.
18 . The method of claim 17 , wherein the first layer security protocol comprises an Internet Protocol Security (IPsec) security protocol, and
wherein the second layer security protocol comprises a Media Access Control Security (MACsec) security protocol.
19 . The method of claim 13 , wherein the first secured channel and the second secured channel are physically separated from one another.
20 . The method of claim 13 , wherein the first and the second keys comprise different key lengths.
21 . The method of claim 13 , wherein the performing the secured bidirectional data communications comprises performing the secured bidirectional data communications using a software implementation, and
wherein the performing the secured unidirectional data communications comprises performing the secured unidirectional data communications using a hardware implementation.
22 . The method of claim 13 , wherein the performing the secured bidirectional data communications comprises communications in accordance with an authenticated encryption with associated data (AEAD) encryption scheme, and
wherein the performing the secured unidirectional data communications comprises communications in accordance with an authentication only scheme.
23 . The method of claim 13 , wherein the performing the secured bidirectional data communications comprises communications in accordance with an authentication only scheme, and
wherein the performing the secured unidirectional data communications comprises communications in accordance with an authenticated encryption with associated data (AEAD) encryption scheme.
24 . The method of claim 13 , wherein the secured bidirectional data communications and the secured unidirectional data communications transfer different types of data.