Patent ID: 7958356

Claim:
A method for securely establishing a shared secret among a plurality of nodes of a security appliance, the method comprising: notifying each node as to a number of nodes participating in shared secret establishment; generating a private key at each node of the plurality of nodes, wherein each node of the plurality of nodes is configured to send messages containing ephemeral public information to only a first adjacent node and receive messages containing ephemeral public information from only a second adjacent node, wherein the first and second adjacent nodes for each node are different nodes within the plurality of nodes; generating an initial message at each node that includes ephemeral public information associated with the generated private key, and an indication of a source of the generated private key; sending the initial message from each node to each node's first adjacent node of the plurality of nodes; receiving at each node messages generated and sent from each node's second adjacent node; storing the received generated private key in a data structure at each node; in response to each received message containing ephemeral public information, generating a new message with new ephemeral public information at each node by combining the received ephemeral public information with that node's generated private key; in response to generating a new message, sending the new message to each node's first adjacent node until x−1 messages have been received at each node from each node's second adjacent node, where x is the number of nodes participating in the shared secret; wherein once x−1 messages have been received from each node's second adjacent node at each node, the value obtained by combining private key of each node with the new ephemeral public information is a common value among all of the nodes in the plurality of nodes; and deriving the shared secret using the common value.