Requirements used to define AKM

What if you could replace the asymmetric authentication phase with a much simpler solution that embeds the security credentials containing the Bulk Encryption Keys, seeds, and related secrets, within the endpoints?

What if, each set of security credentials was unique, with no association, either directly or indirectly, with any other set of security credentials and could be defined to represent a cryptographic security relationships of two or more nodes. Thus, enabling true, end-to-end, multipoint-to-multipoint encryption.

Authenticate the sender and the frame on every single frame, without sharing any secrets, creating a Zero Knowledge Authentication (ZKA) solution (but, do so without the need for a 3rd party observer, as is required in classic ZKA solutions).

 Reduce to zero, any latency incurred during security session establishment 

Refresh security credentials every single session, and with Perfect Forward Secrecy.

Automate the security credential refresh process while still maintaining uniqueness between sets of security credentials (hacking one set of security credentials, should not provide any information or insight that could lead to a breach of another set of security credentials).

Eliminate Man-in-the-Middle (MITM) Attacks

Eliminate Replay Attacks

Allow sessions to be established as both/either event driven and/or time driven events.

Use existing standard, NIST approved cryptographic functions.  Do not use proprietary, non-standard, cryptographic functions.

Refresh security credentials with an entropy level exceeding the age of the universe as measured in seconds (must exceed 10**17).

Secure Communication Enclave is defined as a network of device endpoints securely communicating with each other, and where the device endpoints have all been organized in accordance with some aspect of commonality and shared purpose and common set of security credentials. 

Enable contextually defined relationships of trust between devices, VMs, Pods, or other logical entity, while allowing devices, VMs, Pods (or other logical entity), to have as many contextually defined trust relationships as desired.  In other words, trust relationships may be defined amongst different endpoints (physical or virtual) that allow for and support delineation of communication based on the contextual attributes of the trust relationship (ex., endpoints sharing a "secret" attribute).

Code Footprint of Endpoints can be implemented under 10Kbytes.

Require nothing beyond linear complexity for its cryptographic functions. Meaning, no asymmetric encryption. Thus, no need for special cryptographic offload engines   All cryptographic functionality capable of running in software within even small microcontrollers.

Trust relationships need only be configured once. The Endpoint Nodes within a Trust Relationship will run autonomously for perpetuity, refreshing security credentials every session without operator intervention for the life of the device. Hence, AKM can claim that close to zero maintenance is required.

Because nothing is ever shared of a specific Trust Relationship after it has been configured into a device endpoint, there is never another opportunity for a bad actor to breach the system.  As all endpoints refresh their security credentials internally, and remain synch'd for the life of the AKM Trust Relationship.

Trust Relationships operate autonomously, and can automatically recover from a potential breach or problem, without operator intervention 

Collect analytics from all the nodes within an AKM deployed network, so that a network management device could collect and process those analytics to implement machine learning

Drastically reduce the need for expensive cybersecurity personnel, as a consequence of the autonomous methodology of AKM operation, including autonomously recovering from a breach or potential breach.

Associate specific devices to specific copies of firmware to protect against misconfiguration and spoofing, and in the process, authenticate the device. and its associated firmware.

AKM is created so that it can sit directly on top of the transport layer (either TCP or UDP), replacing and in lieu of, PKI+TLS.