Patent ID: 11968302
Assignee: nan
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A method of generating, distributing, and managing a lifecycle of a symmetric pre-shared key (PSK) used in client authentication (C-PSK) between applications executing on distributed devices including a client application executing on a client device, a server application executing on a server device, a key distribution service (KDS), a KDS proxy, a KDS interface, a symmetric KDS member PSK (M-PSK), a M-PSK identity hint, a tenant identifier, a device group identifier associated with the tenant identifier, a member domain associated with the group identifier, an application identifier associated with the group identifier, a C-PSK identity hint, a key record, a dynamic host configuration protocol (DHCP) server, and a domain name system (DNS) server, the method comprising:
authenticating with the KDS, by the client application executing on the client device, using the tenant identifier, the symmetric KDS member PSK (M-PSK), and the M-PSK identity hint, wherein the client device is registered by a first DNS hostname on the DNS server configured with the KDS or the KDS proxy, and wherein the client device is configured as a first member of a device group on the KDS; and
acquiring, by the client application, the C-PSK from the KDS using at least the group identifier and the C-PSK identity hint, wherein the C-PSK is used as a shared symmetric key for client authentication over a secure transport protocol during communication with the server application executing on the server device, wherein the server device is registered by a second DNS hostname in the DNS server, wherein the server device is configured as a second member of the device group on the KDS; and
authenticating with the KDS, by the server application executing on the server device, using the tenant identifier, the symmetric KDS member PSK (M-PSK), and the M-PSK identity hint, wherein the server device is registered by a second DNS hostname on the DNS server configured with the KDS or the KDS proxy; and
acquiring, by the server application, the C-PSK from the KDS using at least the group identifier and the C-PSK identity hint, wherein the C-PSK is used as the shared symmetric key for client authentication over the secure transport protocol during communication with the client application executing on the client device, wherein the client device is registered by a first DNS hostname in the DNS server; and
initiating, by the client application, a TLS-PSK session, wherein the session is initiated using the acquired C-PSK for the client device in the device group as the PSK used in client authentication, to establish secure communications with the server application executing on the server device; and
renewing, by the client application and the server applications, the C-PSK programmatically and automatically using the KDS interface, without requiring human intervention, and without service disruption, and wherein a further client authentication is executed upon expiry or wherein a high velocity key rotation is executed.