Detection of stale encryption policy by group members
Various techniques that allow group members to detect the use of stale encryption policy by other group members are disclosed. One method involves receiving a message from a first group member via a network. The message is received by a second group member. The method then detects that the first group member is not using a most recent policy update supplied by a key server, in response to information in the message. In response, a notification message can be sent from the second group member. The notification message indicates that at least one group member is not using the most recently policy update. The notification message can be sent to the key server or towards the first group member.
1. A method, comprising:
receiving one or more policy messages via a control plane of a network;
receiving a message from a first group member of a group via a data plane of the network, wherein
the message comprises client content encrypted by the first group member using a first encryption policy applicable to the group,
the message is received by a second group member of the group,
the second group member is a network device,
the control plane carries messages containing policy information used to manage an encryption scheme,
the encryption scheme is implemented by the group,
the group comprises the first and second group members, and
the data plane carries messages containing content generated by clients of the first and second group members;
in response to the receiving the message
decrypting information in the message using an unexpired key, wherein the unexpired key existed prior to a time at which the most recent policy update was generated by a key server, and
detecting that the first encryption policy differs from the most recent policy update supplied by the key server, wherein the most recent policy update is applicable to the group, and
the detecting comprises comparing at least a portion of the decrypted information to information maintained by the second group member, wherein the information maintained by the second group member indicates the most recent policy update received by the second group member; and
sending a notification message from the second group member, wherein the notification message indicates that at least one group member is not using the most recent policy update.
2. The method of claim 1 , wherein the detecting comprises comparing a first value included in the message with a second value maintained by the second group member, and wherein the second value identifies a key currently used by the second group member to decrypt messages.
3. The method of claim 1 , wherein the notification message is sent to the key server.
4. The method of claim 3 , wherein the notification message identifies the first group member.
5. The method of claim 3 , further comprising: sending a second notification message to the first group member, wherein the second notification message indicates that the first group member is not using the most recent policy update.
6. The method of claim 1 , wherein the notification message is sent to the first group member.
7. The method of claim 6 , wherein the notification message comprises the most recent policy update.
8. A first network device, wherein the first network device comprises:
a plurality of hardware ports, wherein
each of the plurality of hardware ports is configured to be coupled to a network,
the plurality of hardware ports is configured to receive policy messages
via a control plane of the network and to receive a message sent by a second network device of a group via a data plane of the network,
the message comprises client content encrypted by the second network device using a first encryption policy applicable to the group,
the control plane carries messages containing policy information used to manage an encryption scheme,
the encryption scheme is implemented by the group,
the group comprises the first network device and the second network device, and
the data plane carries messages containing content generated by clients of the first and second network devices;
a processor coupled to the plurality of hardware ports and configured to implement a stale policy detection module, wherein the stale policy detection module is configured to:
decrypt, in response to receiving the message, information in the message using an unexpired key, wherein
the unexpired key existed prior to a time at which the most recent policy update was generated by a key server, and
detect, in response to the receiving the message, that the first encryption policy differs from the most recent policy update supplied to the first network device by the key server, wherein the most recent policy update is applicable to the group, and
detecting that the first encryption policy differs from the most recent policy update comprises comparing at least a portion of the decrypted information to information maintained by the first network device, wherein the information maintained by the first network device indicates the most recent policy update received by the first network device; and
send a notification message, via one of the plurality of hardware ports, if the second network device is not using the most recent policy update, wherein the notification message indicates that at least one of a plurality of group members is not using the most recent policy update.
9. The first network device of claim 8 , wherein the stale policy detection module is configured to:
detect whether the second network device is using the most recent policy update by comparing a first value included in the message with a second value maintained by the first network device, wherein the second value identifies a key currently used by the first network device to decrypt messages.
10. The network first device of claim 8 , wherein the notification message is sent to the key server.
11. The first network device of claim 10 , wherein the stale policy detection module is configured to: send a second notification message to the second network device via the plurality of hardware ports, wherein the second notification message indicates that the second network device is not using the most recent policy update.
12. The first network device of claim 8 , wherein the notification message is sent to the second network device.
13. The first network device of claim 12 , wherein the notification message comprises the most recent policy update.
14. A system, comprising:
network interface means for receiving policy messages via a control plane of a network and a message from a first group member of a group via a data plane of the network, wherein
the message comprises client content encrypted by the first group member using a first encryption policy applicable to the group,
a second group member comprises the network interface means,
the control plane carries messages containing policy information used to manage an encryption scheme,
the encryption scheme is implemented by the group,
the group comprises the first and second group members, and
the data plane carries messages containing content generated by clients of the first and second group members;
means for decrypting information in the message using an unexpired key,
wherein the unexpired key existed prior to a time at which the most recent policy update was generated by a key server;
means for detecting that the first encryption policy differs from the most recent policy update supplied by the key server, wherein
the most recent policy update is applicable to the group, and
the detecting comprises comparing at least a portion of the decrypted information to information maintained by the second group member, wherein the information maintained by the second group member indicates the most recent policy update received by the second group member; and
means for sending a notification message from the second group member, wherein the notification message indicates that at least one group member is not using the most recent policy update.
15. The system of claim 14 , wherein the notification message is sent to the key server.
16. The system of claim 14 , wherein the notification message is sent to the first group member.
17. The system of claim 14 , wherein the means for detecting comprise means for comparing a first value included in the message with a second value maintained by the second group member, and wherein the second value identifies a key currently used by the second group member to decrypt messages.
18. The method of claim 1 , wherein the information indicates a version of the first encryption policy used by the first group member.
19. The method of claim 1 , further comprising:
in response to detecting that the message was not encrypted using a key currently used by the second group member to decrypt messages, detecting whether the message was encrypted using the unexpired key for sending the notification message.