Patent ID: 7283629

Claim:
In a distributed system including a first message processor that is communicatively coupled to one or more other message processors such that the first message processor and the one or more other message processors can communicate by transferring electronic messages, a method for the first message processor to express to at least one of the other message processors how to identify a key that can be used to securely process an electronic message, the method comprising: an act of receiving an electronic message including shared secret information from a second message processor, the shared secret information indicating one or more key derivation data elements; an act of computing a key sequence of one or more randomly generated bytes based on the received shared secret information, a plurality of specific identifiable portions within the computed key sequence allocated for a plurality of corresponding different versions of a key such that any one of the plurality of keys can be identified within the computed key sequence depending on key derivation data; an act of detecting that at least one key derivation data element is absent from the received one or more key derivation elements included in the electronic message; in response to the detection, an act of inferring the at least one absent key derivation data element from a second one or more key derivation data elements that the first and second message processor previously exchanged, the previously exchanged second one or more key derivation data elements providing a context for deriving keys from the computed key sequence; an act of generating key derivation data from the one or more received key derivation data elements and the at least one inferred key derivation data element, the key derivation data used to identify a particular key from among the plurality of keys allocated within the computed key sequence; an act of sending a security token that includes the received one or more key derivation data elements to express to the second message processor how to identify the particular key from within the computed key sequence such that an electronic message may be securely processed using the particular key; an act of applying the generated key derivation data to the computed key sequence to identify the particular key from within the computed key sequence; and an act of using the identified key to securely process the electronic message.