Patent ID: 11968302
Assignee: nan
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 13:
14. A method of generating, distributing, and managing a lifecycle of a symmetric pre-shared key (PSK) used in secure communications (S-PSK), for use between applications executing on distributed devices including a client application executing on a client device, a server application executing on a server device, a key distribution service (KDS), a KDS proxy, a KDS interface, a symmetric KDS member M-PSK, a M-PSK identity hint, a tenant identifier, a device group identifier associated with the tenant identifier, a member domain associated with the group identifier, an application identifier associated with the group identifier, a S-PSK identity hint, a derived device key (D-PSK), a key record, a dynamic host configuration protocol (DHCP) server, and a domain name system (DNS) server, the method comprising:
authenticating with the KDS, by the client application executing on the client device, using the tenant identifier, the symmetric KDS member PSK (M-PSK), and the M-PSK identity hint, wherein the client device is registered by a first DNS hostname on the DNS server configured with the KDS or the KDS proxy, and the client device is configured as a first member of a device group on the KDS; and
acquiring, by the client application, the S-PSK from the KDS, using at least the group identifier and the S-PSK identity hint, wherein the C-PSK is used as a shared symmetric key to secure communications over an insecure transport protocol during communication with a server application executing on the server device, wherein the server device is registered by a second DNS hostname on the DNS server, wherein the server device is configured as a second member of the device group; and
authenticating with the KDS, by the server application executing on the server device, using the tenant identifier, the symmetric KDS member PSK (M-PSK), and the M-PSK identity hint, wherein the server device is registered by a second DNS hostname on the DNS server configured with the KDS or the KDS proxy; and
acquiring, by the server application, the S-PSK from the KDS, using at least the group identifier and the S-PSK identity hint, wherein the S-PSK is used as the shared symmetric key to secure communications over the insecure transport protocol during communication with the client application executing on the client device, wherein the client device is registered by a first DNS hostname on the DNS server; and
protecting, by the client application executing on the client device, using the acquired S-PSK the authenticity and/or the confidentiality of data in communications with the server application executing on the server device over an insecure connection-oriented or a connection-less transport protocol; and
protecting, by the server application executing on the server device, using the acquired S-PSK the authenticity and/or the confidentiality of data in communications with the client application executing on the client device over the insecure connection-oriented or the connection-less transport protocol; and
renewing, by the client application and the server application, the S-PSK, programmatically and automatically using the KDS interface, without requiring human intervention, and without service disruption, and wherein a further client authentication is executed upon expiry or wherein a high velocity key rotation is executed.