A method executed by a first network entity in communication with a second network entity. The method comprises maintaining a first key bank containing a key designated as an active key for the first network entity; maintaining a second key bank containing a key designated as a standby key for the first network entity; encrypting data for transmission to the second network entity using the active key for the first network entity; attempting to detect a match between (i) a representation of the standby key for the first network entity and (ii) a representation of a standby key for the second network entity received from the second network entity; and upon detecting a match, causing the active key for the first network entity to designate thereafter the key contained in the second key bank.