Patent ID: 8082574

Claim:
A method for securing message traffic in a data network using a security protocol, comprising the steps of: at a Management and Policy Server (MAP) within a network: determining a security policy definition to be applied to traffic in the network, the policy definition including at least a definition of traffic to be secured and parameters to be applied to the secured traffic; at a Key Authority Point (KAP) within the network: receiving at least one security policy definition from the MAP; generating one or more keys to be used in securing the traffic according to the policy definition; and distributing the security policy definition and the keys to two or more peer Policy Enforcement Points (PEPs) over respective secure tunnels through the network; and at a PEP within the network located at a network node that is separate from both the MAP and the KAP and within a device separate from the MAP and the KAP: receiving the security policy definition and the keys from the KAP over the secure tunnels through the network; receiving a network traffic packet; determining, based on the security policy definition, if the network traffic packet falls within the definition of traffic to be secured; and applying security processing to the network traffic packet according to the keys and the parameters of the security policy definition.