Cooperative Key Server Protocol (COOP) is a feature of GET VPN that allows you to configure multiple key servers (KSs) in
a VPN network. It is used for KS redundancy.
GETVPN CRL checking integrates with COOP by enabling group member (GM) reauthentication on all KSs. However there is always
a possibility that a COOP split may occur, where connectivity is temporarily lost among cooperative KSs.
No COOP Split when Reauthentication is Triggered
If no COOP split occurs the primary GM device deletes the Key Encryption Key (KEK) to secondary KSs and sends a reauthentication
message to GMs. The secondary KSs then have the current policies synchronized with the primary policies before the GMs start
to reregister. All GMs reregister and reauthenticate to an available KS and receive the new KEK.
COOP Split when Reauthentication is Triggered
If a COOP split occurs before reauthentication is triggered and there are only two primary KSs, they both send out the reauthentication
message. Each primary KS creates a new and different KEK. The GM only understands the first reauthentication message it receives
as it deletes all the existing KEKs immediately after receiving the message. The GM then reregisters to an available KS and
a CRL check takes place. When reregistering, the GM receives either the KEK of the first primary or the KEK of the second
primary, depending on which KS the GM reregistered. The GM then installs that KEK and receives further rekeys only from that
primary KS. When the COOP merge occurs, the KSs sync up the policies and send rekeys so that all GMs have the current KEK
and traffic encryption keys (TEKs).
Avoiding the Creation of Different KEKs
Reauthentication and CRL checking still occurs if reauthentication is triggered during a COOP split. However, triggering
the creation of different KEKs in the KSs is avoided by delaying reauthentication. A primary KS only starts the reauthentication
if all COOP KSs are reachable (not split). If one COOP KS is not reachable, the primary KS delays sending the reauthentication
message until all COOP KSs are reachable.