Renewing session key I have a system which (should) never shut down, there are keep alive messages every 30 seconds and normal traffic is very variable, might be a few KB/sec might be nothing more than the keep alive message.

Normally one would create a new key when you start a new connection but since our connection could (should) be up for weeks or months there is not standard re-negotiation for a session key.

My question is how much time should be between the generation of a new session key? should it be every day at midnight? or would that make the system vulnerable if the negotiation for a session key is always on the same time (or after a set time frame). Does TLS have something for this?

extra
Renewing a masterkey for our scenario is a bit tricky, we could do this by going to all the devices and manually setting it, something we would like to avoid. But it will be necessary to renew a master key once in a while, how often should you do that? given that it will be quite difficult to do.

EDIT
There is no DH or ECDH, well not in the first versions anyway. I am trying to push it (and certificates). A problem the company has is that we assume DH and ECDH will take to much time on our devices (we only have a few milliseconds to work with (about 10 to 15 ms) ) and I have not looked into the DH and ECDH times. on our Renessas controler (about 100 Mhz)
Note: Until told otherwise this answer will assume the following things:


The "Master-Key" is secure. (unextractable, 128-bit+ entropy)
Ephermal (EC-) Diffie-Hellman is available and secure (keys unextractable, 2048 bit DH / 256 bit ECDH available)
The random number generator used is secure. (i.e. not just relies on the time, e.g. it's a cryptographically secure RNG, which should be available and used by a good TLS implementation)


Now the answer:

You don't have to renew keys if the above points apply.
If the assumptions apply all keys will be unbreakable (for at least a decade).

Well it looks like you want to have forward secrecy and to get this you may want to renew session keys every now and then. If possible I'd suggest renewing the session key after each time some sort of "action" is finished.If you don't have something like this "action" or "large chunk" you may want to renew keys at regular intervals. If the above assumptions apply rekeying at static intervals shouldn't be a problem. As Interval I'd suggest: "As often as possible" which may translate to something in between an hour and a day.

For completely renewing the session key TLS does have a feature called "renegotiation". You can trigger such a handshake whenever you need a new key.

Concerning the renewal of the master-key:

If the above assumptions apply you don't have to renew the keys. Renewing the keys is of interested if you believe that the key might be extracted. Depending on how easy that is you may want to re-new rather often than less. If you're Device is tamper-proofed or you're encrypting the key using ephermal data I'd say that once in a year up to once a decade is ok. If you're device is planned to be used for more than 50 years you may want to consider using 192-bit keys.