Patent ID: 8346925

Claim:
Network security apparatus comprising a processor and a computer readable apparatus having a storage medium with at least one computer program stored thereon, the at least one computer program comprising a plurality of computer executable instructions that when executed by the processor are configured to communicate with a computerized host device and other network security apparatus on a network having components that may be individually secure or non-secure, the apparatus comprising: a message process disposed on the computer readable apparatus that is adapted to, when executed by the processor, exchange first security association information including a digital certificate between the security apparatus and at least one of said other security apparatus on the network via one or more messages, said digital certificate comprising a first encryption key; a cryptographic material management process disposed on the computer readable apparatus, said cryptographic material management process adapted to, when executed by the processor, package cryptographic material comprising at least one second encryption key for distribution to said at least one other security apparatus; and an association process disposed on the computer readable apparatus that is configured to, when executed by the processor, establish a security association between said network apparatus and said at least one other network security apparatus based at least in part on said first security association information; wherein said apparatus further comprises a key exchange protocol disposed on the computer readable apparatus, said key exchange protocol being adapted to, when executed by the processor, exchange said at least one second encryption key between said network security apparatus and said at least one other security apparatus using at least one message generated by said message process.