Scalable and lightweight key distribution for secure group communications

ABSTRACT

Securing group communications in dynamic and large-scale groups is more complex than securing one-to-one communications due to the inherent scalability issue of group key management. In particular, cost for key establishment and key renewing is usually relevant to the group size and subsequently becomes a performance bottleneck in achieving scalability. To address this problem, this paper proposes a new approach that features decoupling of group size and computation cost for group key management. By using a hierarchical key distribution architecture and load sharing, the load of key management can be shared by a cluster of third parties without revealing group messages to them. The proposed scheme provides better scalability because the cost for key management of each component is independent of the group size. Specifically, our scheme incurs constant computation and communication overheads for key renewing. In this paper, we present the detailed design of the proposed scheme and performance comparisons with other schemes. Briefly, our scheme provides better scalability than existing group key distribution approaches.

REFERENCES

• 1: S. E. Deering, Multicast routing in internetworks and extended LANs, Symposium proceedings on Communications architectures and protocols, p.55-64, August 16-18, 1988, Stanford, California, United States
• 2: 2. Deering S. Host Extensions for IP Multicasting, Aug. 1989; RFC-1112.
• 3: 3. Fenner W. Internet Group Management Protocol, Version 2, Nov. 1997; RFC-2236.
• 4: 4. Waitzman D, Partridge C, Deering S. Distance Vector Multicast Routing Protocol, Nov. 1988; RFC-1075.
• 5: 5. Estrin D, Farinacci D, Helmy A, Thaler D, Deering S, Handley M, Jacobson V, Liu C, Sharma P, Wei L. Protocol Independent Multicast-Sparse Mode (PIMSM): Protocol Specification, Jun. 1998; RFC-2362.
• 6: 6. Ballardie A. Core Based Trees (CBT) Multicast Routing Architecture, Sep. 1997; RFC-2201.
• 7: 7. Ballardie A. Core Based Trees (CBT version 2) Multicast Routing--Protocol Specification, Sep. 1997; RFC-2189.
• 8: Tony Ballardie , Paul Francis , Jon Crowcroft, Core based trees (CBT), ACM SIGCOMM Computer Communication Review, v.23 n.4, p.85-95, Oct. 1993
• 9: 9. Moy J. Multicast Extensions to OSPF, Mar. 1994; RFC-1584.
• 10: 10. Bagnall P, Briscoe R, Poppitt A. Taxonomy of Communication Requirements for Large-scale Multicasting Applications, Dec. 1999; RFC-2729.
• 11: 11. Wallner D, Harder E, Agee R. Key Management for Multicast: Issues and Architectures, Jun. 1999; RFC-2627.
• 12: 12. Moyer MJ, Rao JR, Rohatgi P. A Survey of Security Issues in Multicast Communications, IEEE Network, Nov./Dec. 1999; 13: 12-23.
• 13: Chung Kei Wong , Mohamed Gouda , Simon S. Lam, Secure group communications using key graphs, IEEE/ACM Transactions on Networking (TON), v.8 n.1, p.16-30, Feb. 2000 [doi>10.1109/90.836475]
• 14: 14. Waldvogel M, Caronni G, Sun D, Weiler N, Plattner B. The VersaKey framework: versatile group key management, IEEE Journal Select. Areas Communication , Sep. 1999; 17: 1614-1631.
• 15: Adrian Perrig , Dawn Song , J. D. Tygar, ELK, a New Protocol for Efficient Large-Group Key Distribution, Proceedings of the 2001 IEEE Symposium on Security and Privacy, p.247, May 14-16, 2001
• 16: 16. Wong CK, Lam SS. Keystone: A Group Key Management Service, in International Conference. Telecommunications, 2000.
• 17: Sanjeev Setia , Samir Koussih , Sushil Jajodia , Eric Harder, Kronos: A Scalable Group Re-Keying Approach for Secure Multicast, Proceedings of the 2000 IEEE Symposium on Security and Privacy, p.215, May 14-17, 2000
• 18: Xiaozhou Steve Li , Yang Richard Yang , Mohamed G. Gouda , Simon S. Lam, Batch rekeying for secure group communications, Proceedings of the 10th international conference on World Wide Web, p.525-534, May 01-05, 2001, Hong Kong, Hong Kong [doi>10.1145/371920.372153]
• 19: Suvo Mittra, Iolus: a framework for scalable secure multicasting, Proceedings of the ACM SIGCOMM '97 conference on Applications, technologies, architectures, and protocols for computer communication, p.277-288, September 14-18, 1997, Cannes, France
• 20: Secure and Scalable Inter-Domain Group Key Management for N-to-N Multicast, Proceedings of the 1998 International Conference on Parallel and Distributed Systems, p.478, December 14-16, 1998
• 21: Refik Molva , Alain Pannetrat, Scalable multicast security with dynamic recipient groups, ACM Transactions on Information and System Security (TISSEC), v.3 n.3, p.136-160, Aug. 2000 [doi>10.1145/357830.357834]
• 22: A Dual Encryption Protocol for Scalable Secure Multicasting, Proceedings of the The Fourth IEEE Symposium on Computers and Communications, p.2, July 06-08, 1999
• 23: Wen-Her Yang , Kai-Wei Fan , Shiuh-Pyng Shieh, A secure multicast protocol for the internet's multicast backbone, International Journal of Network Management, v.11 n.2, p.129-136, March-April 2001 [doi>10.1002/nem.392.abs]
• 24: Hans Eriksson, MBONE: the multicast backbone, Communications of the ACM, v.37 n.8, p.54-60, Aug. 1994 [doi>10.1145/179606.179627]

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.2 Network Protocols
          Subjects: Applications (SMTP, FTP, etc.)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)
      C.2.1 Network Architecture and Design
          Subjects: Network communications

  E. Data
  E.3 DATA ENCRYPTION
      Subjects: Public key cryptosystems

General Terms:
Algorithms, Experimentation, Performance, Security