Abstract: A unique, strong, shared, symmetric network-wide key (or a limited number of group-wide keys) is generated by a central authority and initially provisioned to nodes in a network, which use it for ensuing traffic encryption. Nodes establish trust by sending each other authentication messages encrypted with the shared secret key, and thereupon adding each other to their respective trust lists. Also, an optional rekeying scheme whereby an existing shared secret key can be replaced by a new secret key that is introduced by the central authority and automatically propagated from node to node through the network.

Abstract: An apparatus and method for protecting packet-switched network links, intermediate nodes, and/or end nodes from unauthorized traffic identifies authorized traffic via a signature contained in each packet that is associated with a stored cryptographic key. Packets are forwarded (or passed through) only if they contain a signature having a pre-defined correlation to the associated key. Optionally, means for controlling the protection can be provided, so that unauthorized traffic is rejected when the protection is operative but is passed when it is not. Also optionally, intermediate degrees of protection such as prioritization of authorized traffic over unauthorized traffic can be provided.