An apparatus comprising: a cryptographic data processor configured to encrypt and to decrypt data packets; group key management logic coupled to the cryptographic data processor and that is configured to send and receive messages in conformance with a Group Key Management, GKM, protocol; and Key Generation System, KGS, logic; wherein the group key management logic is configured to perform, in relation to adding a group member, receiving in a security association, SA, message secret data for use in the KGS; wherein the group key management logic is configured to derive keys for secure communication with one or more peer VPN gateways using the secret data; wherein while registering with a key server to obtain keying material for deriving keys, the group key management logic is configured to receive, in a SA message from the key server, a logical key hierarchy array, a KGS matrix row encrypted by a first key, and replacement key data encrypted by a second key, wherein the replacement key data comprises an encrypted replacement matrix row for replacing the KGS matrix row; wherein the keys derived from the KGS matrix row encrypted by the first key are used for communicating with the one or more peer VPN gateways; wherein subsequent to using the keys derived from the KGS matrix row encrypted by the first key, the group key management logic receives a rekey message, the rekey message comprising the second key; wherein the group key management logic decrypts the replacement key data using the second key to obtain the replacement matrix row in response to the rekey message; wherein the group key management logic derives new keying material from the replacement matrix row after decrypting the replacement key data using the second key; and wherein the keys derived from the replacement matrix row are used for communicating with the one or more peer VPN gateways after receiving the rekey message. a cryptographic data processor configured to encrypt and to decrypt data packets; group key management logic coupled to the cryptographic data processor and that is configured to send and receive messages in conformance with a Group Key Management, GKM, protocol; and Key Generation System, KGS, logic; wherein the group key management logic is configured to perform, in relation to adding a group member, receiving in a security association, SA, message secret data for use in the KGS; wherein the group key management logic is configured to derive keys for secure communication with one or more peer VPN gateways using the secret data; wherein while registering with a key server to obtain keying material for deriving keys, the group key management logic is configured to receive, in a SA message from the key server, a logical key hierarchy array, a KGS matrix row encrypted by a first key, and replacement key data encrypted by a second key, wherein the replacement key data comprises an encrypted replacement matrix row for replacing the KGS matrix row; wherein the keys derived from the KGS matrix row encrypted by the first key are used for communicating with the one or more peer VPN gateways; wherein subsequent to using the keys derived from the KGS matrix row encrypted by the first key, the group key management logic receives a rekey message, the rekey message comprising the second key; wherein the group key management logic decrypts the replacement key data using the second key to obtain the replacement matrix row in response to the rekey message; wherein the group key management logic derives new keying material from the replacement matrix row after decrypting the replacement key data using the second key; and wherein the keys derived from the replacement matrix row are used for communicating with the one or more peer VPN gateways after receiving the rekey message.