Patent ID: 8429400

Claim:
A method, comprising: sending a request from a network device in a network to a service broker device in a service insertion architecture (SIA) to join a first secure group that is identifiable by a group identification (ID) in the request, the SIA comprising the service broker device configured to handle control traffic for managing secure groups in the network, one or more network devices configured to exchange data traffic as members of the secure groups, and one or more key servers configured to generate policy and encryption keys for the secure groups; receiving, at the network device and from the service broker device, a list of key servers configured for servicing the first secure group, the list including an ordering of the key servers based on meta information associated with the key servers, wherein key servers are included in the list based on being authenticated by the service broker device; selecting, using the network device, a key server from the list based on the meta information; sending, using the network device, registration information to the selected key server to join the first secure group; receiving, at the network device and from the selected key server, policy and encryption keys for the first secure group responsive to the network device being authenticated by the selected key server and established as a group member of the first secure group based on the registration information; and establishing encrypted communication, by the network device and based on the policy and encryption keys received from the selected key server, with one or more group members of the first secure group.