Detection of stale encryption policy by group members

Patent metadata

Field	Value
Publication number	US-10243928-B2
Application number	US-201615010679-A
Country	US
Kind code	B2
Filing date	Jan 29, 2016
Priority date	Jan 5, 2010
Publication date	Mar 26, 2019
Grant date	Mar 26, 2019

Abstract

Various techniques that allow group members to detect the use of stale encryption policy by other group members are disclosed. One method involves receiving a message from a first group member via a network. The message is received by a second group member. The method then detects that the first group member is not using a most recent policy update supplied by a key server, in response to information in the message. In response, a notification message can be sent from the second group member. The notification message indicates that at least one group member is not using the most recently policy update. The notification message can be sent to the key server or towards the first group member.

First claim

What is claimed is:

1. A method comprising:
transmitting, by a key server, a current encryption policy to a plurality of group members of a group, wherein
the group comprises at least a first group member and a second group member;

subsequent to transmitting the current encryption policy, detecting, by the key server, that the first group member is not using the current encryption policy, wherein
the detecting comprises
receiving, at the key server, a notification message indicating that the first group member is not using the current encryption policy, wherein
the notification message is received from the second group member but not from the first group member,
the notification message is received in response to the second group member comparing a first value included in an encrypted message with a second value maintained by the second group member, and
the second value identifies an encryption key currently used by the second group member to decrypt messages;

transmitting, by the key server, an update message to the first group member, wherein the update message comprises the current encryption policy;
determining, by the key server, whether the first group member has acknowledged the update message; and

in response to the determining that the first group member has not acknowledged the update message, excluding the first group member from the group.

2. The method of claim 1 , wherein
the notification message identifies the first group member.

3. The method of claim 1 , wherein
the notification message identifies a plurality of group members.

4. The method of claim 1 , wherein
the current encryption policy was transmitted to the group using multicast, and
transmitting the update message is performed using unicast.

5. A network device comprising:
a plurality of hardware ports, wherein
each of the plurality of hardware ports is configured to be coupled to a network; and

a processor coupled to the plurality of hardware ports and configured to:
transmit a current encryption policy to a plurality of group members of a group, wherein the group comprises at least a first group member and a second group member;
subsequent to transmitting the current encryption policy, detect that the first group member is not using the current encryption policy, wherein
detecting that the first group member is not using the current encryption policy comprises
receiving, at a key server, a notification message indicating that the first group member is not using the current encryption policy, wherein
 the notification message is received from the second group member but not from the first group member,
 the notification message is received in response to the second group member comparing a first value included in an encrypted message with a second value maintained by the second group member, and
 the second value identifies an encryption key currently used by the second group member to decrypt messages;

transmit an update message to the first group member, wherein
the update message comprises the current encryption policy;

determine whether the first group member has acknowledged the update message; and
in response to determining that the first group member has not acknowledged the update message, exclude the first group member from the group.

6. The network device of claim 5 , wherein
the current encryption policy was transmitted to the group using multicast, and
transmitting the update message is performed using unicast.

7. A system, comprising:
means for transmitting, by a key server, a current encryption policy to a plurality of group members of a group, wherein
the group comprises at least a first group member and a second group member;

means for detecting, by the key server and subsequent to transmitting the current encryption policy, that the first group member is not using the current encryption policy, wherein
the detecting comprises receiving, at the key server, a notification message indicating that the first group member is not using the current encryption policy, wherein
the notification message is received from the second group member but not from the first group member,
the notification message is received in response to the second group member comparing a first value included in an encrypted message with a second value maintained by the second group member, and
the second value identifies an encryption key currently used by the second group member to decrypt messages;

means for transmitting, by the key server, an update message to the first group member, wherein the update message comprises the current encryption policy;
means for determining, by the key server, whether the first group member has acknowledged the update message, wherein
the key server is configured to transmit policy updates to members of the group; and

means for excluding the first group member from the group, wherein
the first group member is excluded from the group in response to the determining that the first group member has not acknowledged the update message.

8. The system of claim 7 , wherein the current encryption policy was transmitted to the group using multicast, and transmitting the update message is performed using unicast.

Assignees

• Cisco Tech Inc

Inventors

• Wainner Warren Scott
• Rowles Sheela D
• Weis Brian E
• Mcgrew David Arthur
• Fluhrer Scott R
• Kamarthy Kavitha

Classifications

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L12/1818

  Conference organisation arrangements, e.g. handling schedules, setting up parameters needed by nodes to attend a conference, booking network resources, notifying involved parties · CPC title