A survey of key management for secure group communication <s> Cipher Sequences <s> In this paper we propose a new framework for multicast security based on distributed computation of security transforms by intermediate nodes. The involvement of intermediate nodes in the security process causes a new type of dependency between group membership and the topology of the multicast network. Thanks to this dependency, the containment of security exposures in large multicast groups is assured. The framework also assures both the scalability for large dynamic groups and the security of individual members. Two different key distribution protocols complying with the framework are introduced. The first protocol is an extension of the El Gamal encryption scheme whereas the second is based on a multi-exponent version of RSA. <s> BIB001 </s> A survey of key management for secure group communication <s> Cipher Sequences <s> The authors describe a novel approach to scalable group re-keying for secure multicast. Our approach, which we call Kronos, is based upon the idea of periodic group re-keying. We first motivate our approach by showing that if a group is re-keyed on each membership change, as the size of the group increases and/or the rate at which members leave and join the group increases, the frequency of rekeying becomes the primary bottle neck for scalable group re-keying. In contrast, Kronos can scale to handle large and dynamic groups because the frequency of re-keying is independent of the size and membership dynamics of the group. Next, we describe how Kronos can be used in conjunction with distributed key management frameworks such as IGKMP (T. Hardjono et al., 1998) that use a single group-wide session key for encrypting communications between members of the group. Using a detailed simulation, we compare the performance tradeoffs between Kronos and other key management protocols. <s> BIB002
Molva presented a framework for multicast security BIB001 that is based on Cipher Sequences (CS). A function f (S, a) is called Cipher Group (CG) if it has the following characteristics: there is a sequence of n elements, such as a 1≤i≤n ; and there is a sequence of n + 1 elements, such as S 0≤i≤n , where , for i > 0 and S 0 is the initial value; and for every couple (i, j ), where i < j , there exists a function h i, j such as S i = h i, j ( j ). The multicast group is placed in a tree, where the root of the tree is the multicast source, the leaves of the tree are group members and the internal nodes of the tree are intermediate elements in the multicast communication. Now let S 0 be the information to be multicast and let every node N i be assigned a value a i > 1. Every node N i can perform function f , so that when N i receives a value S j from its parent N j , it computes S i = f (S j , a i ) and sends S i to its children in the tree (note that the children can be other nodes or leaves). The leaves were assigned the function h 0,n , which enables them to compute S 0 from S n , since S 0 = h 0,n (S n ), and therefore recovers the original data. Figure 10 shows an example of Molva's scheme that may be described as: -the root calculates S 1 = f (S 0 , a 1 ) and sends S 1 to N 1 ; -node N 1 calculates S 2 = f (S 1 , a 6 ) and sends S 2 to N 2 ; -node N 2 calculates S 3 = f (S 2 , a 7 ) and sends S 3 to leaf L 3 ; -leaf L 3 calculates S 0 = h 0,3 (S 3 ) and recovers the original data (S 0 ). A leaf may be composed of several group members and all members in the same leaf share the same function h 0,n . When a membership change occurs in a leaf, the node N n receives a new value a n and all members in the leaf receive a new function h 0,n . Naturally, if the membership change occurred because of member removal, the removed member will not receive the new h 0,n , thus will not be able to recover S 0 . BIB002 proposed Kronos. It is an approach driven by periodic rekeys rather than membership changes, which means a new group key is generated after a certain period of time, disregarding whether any member has joined, left or been ejected from the group. Although Kronos can be used within a distributed framework such as IGKMP, it works differently because the DKD does not directly generate the group key. Instead, each AKD independently generates the same group key and transmits it to its members at the end of the predetermined period.