Patent ID: 8548171

Claim:
An apparatus comprising: a cryptographic data processor configured to encrypt and to decrypt data packets; group key management logic coupled to the cryptographic data processor and that is configured to send and receive messages in conformance with a Group Key Management (GKM) protocol; and Key Generation System (KGS) logic; wherein the group key management logic is configured to perform, in relation to adding a group member, receiving in a security association (SA) message comprising secret data for use in the KGS; wherein the group key management logic is configured to derive keys for secure communication with one or more peer VPN gateways using the secret data; and wherein while registering with a key server to obtain keying material for deriving keys, the group key management logic is configured to receive in a SA message from the key server a logical hierarchy key array, a KGS matrix row encrypted by a first key, and replacement key data encrypted by a second key, wherein the replacement key data comprises an encrypted replacement matrix row for replacing the KGS matrix row; wherein the keys derived from the KGS matrix row encrypted by the first key are used for communicating with the one or more peer VPN gateways; wherein subsequent to using the keys derived from the KGS matrix row encrypted by the first key, the group key management logic receives a rekey message, the rekey message comprising the second key and data representative of a phased re-register flag; wherein the group key management logic decrypts the replacement key data using the second key to obtain the replacement matrix row in response to receiving the rekey message; wherein the group key management logic derives new keying material from the replacement matrix row after decrypting the replacement key data using the second key; and wherein keys derived from the replacement matrix row are used for selectively re-registering with the one or more peer VPN gateways after receiving the rekey message on a phased basis relative to one or more associated apparatus in communication with the one or more peer VPN gateways in accordance with the data representative of a phased re-register flag.