Patent ID: 8843737

Claim:
A method in a network element for supporting Transmission Control Protocol Authentication Option (TCP-AO) with a Key Management Protocol (KMP) to authenticate TCP segments over a TCP session, the method comprising: in response to a request to create a first TCP session with a peer network element, determining whether a first Master Key Tuple (MKT) associated with the first TCP session has been previously created; in response to determining the first MKT has not been previously created, creating the first MKT that includes a send key field, a receive key field, and a Key Derivation Function (KDF) field; negotiating, over a first secure encrypted channel, a first plurality of traffic keys including a send key used for authenticating outgoing TCP segments transmitted to the peer network element over the first TCP session and a receive key for authenticating incoming TCP segments received from the peer network element over the first TCP session; populating the send key field and the receive key field of the first MKT with the negotiated send key and receive key, respectively, and the KDF field of the first MKT with a value indicating a KDF direct function is to be used, wherein the KDF direct function causes the send key populated in the send key field of the first MKT to be set as a send_SYN_traffic key and send_other_traffic_key and the receive key populated in the receive key field of the first MKT to be set as a receive_SYN_traffic_key and receive_other_traffic_key, instead of negotiating a shared master key and using a KDF to derive the send_SYN_traffic_key, send_other_traffic_key, receive_SYN_traffic_key, and receive_other_traffic_key from the master key; and protecting the first TCP session with the TCP-AO by using the send_SYN_traffic_key, send_other_traffic_key, receive_SYN_traffic_key, and receive_other_traffic_key, whereby the first TCP session is protected by the TCP-AO by directly using negotiated traffic keys, instead of using traffic keys derived from a negotiated master key.