Secure Multicast Research Articles

Secure Multicast in WiMAX

Multicast enables efficient large-scale content distribution and has become more and more popular in network service. Security is a critical issue for multicast because many applications require access control and privacy. This issue is more sensitive to wireless network, which is lack of physical boundaries. IEEE 802.16 is the standard for next generation wireless network, which aims to provide the last mile access for Wireless Metropolitan Area Network (WirelessMAN). Multicast is also supported in IEEE 802.16, and a Multicast and Broadcast Rekeying Algorithm (MBRA) was proposed in the standard as an optional function for secure multicast. However, this algorithm does not provide backward and forward secrecy. It is not scalable to a large group either. This paper reviews the above two deficiencies of MBRA and proposes revision to address these problems for Intra-BS multicast. We also propose algorithms for secure multicast in different scenarios of WirelessMAN besides its basic schema, including Inter-BS multicast, multicast for mesh network, and multicast during handover.

Security enhancement to a password-authenticated group key exchange protocol for mobile Ad-hoc networks

Group key exchange protocols allow a group of parties communicating over a public network to come up with a common secret key called a session key. Due to their critical role in building secure multicast channels, a number of group key exchange protocols have been suggested over the years for a variety of settings. Among these is the so-called NEKED protocol proposed by Byun et al. for password-authenticated group key exchange in mobile ad-hoc networks overseen by unmanned aerial vehicles. In the current work, we are concerned with improving the security of the NEKED protocol. We first show that the NEKED protocol is vulnerable not only to an attack against backward secrecy but also to an attack against password security. We then figure out how to eliminate the security vulnerabilities of NEKED.

A Peer-Based Recovery Scheme for Group Rekeying in Secure Multicast

The Logical Key Hierarchy (LKH) provides a scalable and efficient way to distribute session keys to authorized group members in secure group (multicast) communication. However, because multicast is a best-effort service, it requires additional mechanism to ensure that every member receives the rekey information. To solve this problem, several FEC-based schemes have been proposed. Although these schemes significantly enhance the reliability of the rekey transmissions, they require significant additional resources at the key server. In this paper we propose a distributed scheme for recovering lost rekey packets. Our scheme allows each member to contact other members to get the missing packets during rekey events, thus avoiding the extra computation and bandwidth resources at the key server. We compare our scheme with a well-known FEC scheme with respect to latencies experienced by receivers in reasonably large groups. Results show that our scheme yields lower average and 95th-percentile latencies than the FEC-based scheme across several operating regimes.

Efficient and Secure Multicast in WirelessMAN: A Cross-layer Design

Effectively adding security measures to a multicast service is an intriguing problem, especially when the service isdeployed in a wireless setting. Next generation IEEE 802.16standard WirelessMAN networks are a perfect example of this problem, and the latest draft specification of the standard includes a secure protocol solution called Multicast and Broadcast Rekeying Algorithm (MBRA). In this paper, we expose the security problems of MBRA, including non-scalability and omission of backward and forward secrecy, and propose new approaches, ELAPSE and ELAPSE+, to address these problems. In particular, ELAPSE+ makes use of membership and mobility information gathered in the application layer to augment the adaptive group management in the MAC layer. We analyze the security property of ELAPSE and ELAPSE+, and compare their performances with MBRA by simulating group rekeying scenarios.

Weakness of the Synchro-Difference LKH Scheme for Secure Multicast

Zhu proposed a synchro-difference LKH scheme for secure multicast that appeared in IEEE Communications Letters, vol. 9, no. 5, pp. 477-479, May 2005, which is an enhancement of the well-known LKH scheme. In this letter, we show that Zhu's scheme is insecure against collusion of two or more malicious adversaries by presenting two kinds of attack scenarios.

A hierarchical group key management scheme for secure multicast increasing efficiency of key distribution in leave operation

This paper proposes an efficient protocol and associate algorithm for group key management in secure multicast. This protocol is based on a hierarchy approach in which the group is logically divided into subgroups. The group key is organized using member secrets assigned to each member and server secrets assigned to each subgroup, and the inverse value of the member secrets are also used to manage the group key when a member leaves. In this case, each member in a single subgroup needs to store the inverse values of the other members in that subgroup with the exception of its own. When a member joins the group, after updating the previous group key in the server, the new key is sent to all existing group members, and the inverse value of the new member is sent to subgroup members (where there is a join), by exploiting IP multicast. Most importantly, the server just sends the inverse value of the leaving member to the subgroups when a member leaves. Then, the group key is updated by each remaining member in the subgroups by using that inverse value. Consequently, the benefits are two-fold. First, only one key needs to be generated by the server at each event. Second, not only the computational overhead is reduced but also new key information can be multicast to all members simultaneously. This paper describes the details of our novel protocol and the related algorithm.

Resource-aware protocols for authenticated group key exchange in integrated wired and wireless networks

Protocols for group key exchange are cryptographic algorithms that describe how a group of parties communicating over a public network can come up with a common secret key. Due to their critical role in building secure multicast channels, a number of group key exchange protocols have been proposed over the years in a variety of settings. However despite many impressive achievements, there seems to have been no previous systematic look at the growing problem of key exchange over integrated wired and wireless (IWW) networks which consist of two distinct types of users: users having low-performance mobile devices with some form of battery power and users having high-performance stationary computers with no power constraint. The contribution of the present work is to fill this deficiency by providing a secure and efficient protocol for resource-aware group key exchange over the rapidly expanding IWW networks. By evenly spreading much of the total amount of computation across high power users, our protocol avoids any potential performance bottleneck of the system while keeping the burden on low power users at minimal. Our protocol also achieves provable security against powerful active adversaries under the decisional Diffie–Hellman assumption. We provide a rigorous proof of security for the protocol in a well-defined formal model of communication and adversarial capabilities.

Dynamic Balanced Key Tree Management for Secure Multicast Communications

A secure multicast communication is important for applications such as pay-per-view and secure videoconferencing. A key tree approach has been proposed by other authors to distribute the multicast group key in such a way that the rekeying cost scales with the logarithm of the group size for a join or depart request. The efficiency of this key tree approach critically depends on whether the key tree remains balanced over time as members join or depart. In this paper, we present two Merging Algorithms suitable for batch join requests. To additionally handle batch depart requests, we extend these two algorithms to a Batch Balanced Algorithm. Simulation results show that our three algorithms not only maintain a balanced key tree, but their rekeying costs are lower compared with those of existing algorithms.

Scalable solutions for secure group communications

With the advent of digital technologies and widening Internet bandwidth in recent years there has been a marked rise in new multimedia services, including teleconferencing, pay-per-view TV, interactive simulations, software updates and real-time delivery of stock market information. Multicast data distribution has been used in controlled environments to deliver such services. However, the lack of secure, accountable multicast data distribution has prevented its use in general Internet environments. Proposals for multicast security solutions so far are complex and often require trust in intermediate components or are inefficient. A secure multicast protocol suite must provide data confidentiality and multicast packet source authentication. In this paper we present a robust, simple and efficient multicast key management protocol based on proxy encryption and a multicast data source authentication mechanism based on symmetric message authentication codes. The solutions are analyzed and compared to previously published schemes. The results show that the proposed schemes are efficient and scalable relative to existing schemes.

Improving Satellite Multicast Security Scalability by Reducing Rekeying Requirements

As multicasting technologies grow in popularity, so does the need for scalable security architectures to support the user base. Significant research efforts are ongoing in the areas of group-key distribution and management. However, little research has addressed the security of very large, distributed groups communicating via low-earth orbit satellite networks. In this article, we review the requirements common to most secure, multicast networking environments; discuss existing scalable multicast security architectures; and present a novel modular scalable architecture for secure multicast, adapted to a low-earth orbit satellite system. Simulated results reveal a twelve-fold reduction in average user rekeying and an order of magnitude reduction in required key distribution versus the baseline architecture.

Secure multicast in dynamic environments

A secure multicast framework should only allow authorized members of a group to decrypt received messages; usually, one ''group key'' is shared by all approved members. However, this raises the problem of ''one affects all'', whereby the actions of one member affect the whole group. Many researchers have solved the problem by dividing a group into several subgroups, but most current solutions require key distribution centers to coordinate secure data communications between subgroups. We believe this is a constraint on network scalability. In this paper, we propose a novel framework to solve key management problems in multicast networks. Our contribution is threefold: (1) We exploit the ElGamal cryptosystem and propose a technique of key composition. (2) Using key composition with proxy cryptography, the key distribution centers used in secure multicast frameworks are eliminated. (3) For key composition, the framework is designed to resist node failures and support topology reconstruction, which makes it suitable for dynamic network environments. Without reducing the security or performance of proxy cryptography, we successfully eliminate the need for key distribution centers. Our analysis shows that the proposed framework is secure, and comparison with other similar frameworks demonstrates that it is efficient in terms of time and space complexity. In addition, the costs of most protocol operations are bounded by constants, regardless of a group's size and the number of branches of transit nodes.

M-CLIQUES: Modified CLIQUES key agreement for secure multicast

In secure multicast applications, members may join or leave frequently and key management is one of the most challenging problems. In this research, we proposed a modified CLIQUES key management protocol. It was the modification of CLIQUES that consisted of two stages: Static CLIQUES and Hierarchical CLIQUES. In Static CLIQUES, a static group controller was used to distribute the partial keys to group members. Compared with traditional CLIQUES, the Static CLIQUES was more secure for key storage, less complex, less processing requirement in the user machine, and easier to provide member privacy protection. In Hierarchical CLIQUES, a hierarchical structure was employed to support larger size of group members. Our experiments showed that the modified CLIQUES protocol was more scalable than CLIQUES. Also, it required less processing power than the Key Tree-Based approaches.

GKMPAN: An Efficient Group Rekeying Scheme for Secure Multicast in Ad-Hoc Networks*

We present GKMPAN, an efficient and scalable group rekeying protocol for secure multicast in ad hoc networks. Our protocol exploits the property of ad hoc networks that each member of a group is both a host and a router, and distributes the group key to member nodes via a secure hop-by-hop propagation scheme. A probabilistic scheme based on pre-deployed symmetric keys is used for implementing secure channels between members for group key distribution. GKMPAN also includes a novel distributed scheme for efficiently updating the pre-deployed keys. GKMPAN has three attractive properties. First, it is significantly more efficient than group rekeying schemes that were adapted from those proposed for wired networks. Second, GKMPAN has the property of partial statelessness; that is, a node can decode the current group key even if it has missed a certain number of previous group rekeying operations. This makes it very attractive for ad hoc networks where nodes may lose packets due to transmission link errors or temporary network partitions. Third, in GKMPAN the key server does not need any information about the topology of the ad hoc network or the geographic location of the members of the group. We study the security and performance of GKMPAN through detailed analysis and simulation; we have also implemented GKMPAN in a sensor network testbed.

Key Management for Secure Multicast over IPv6 Wireless Networks

Multicasting is an efficient method for transmission and routing of packets to multiple destinations using fewer network resources. Along with widespread deployment of wireless networks, secure multicast over wireless networks is an important and challenging goal. In this paper, we extend the scope of a recent new key distribution scheme to a security framework that offers a novel solution for secure multicast over IPv6 wireless networks. Our key management framework includes two scenarios for securely distributing the group key and rekey messages for joining and leaving a mobile host in secure multicast group. In addition, we perform the security analysis and provide performance comparisons between our approach and two recently published scenarios. The benefits of our proposed techniques are that they minimize the number of transmissions required to rekey the multicast group and impose minimal storage requirements on the multicast group. In addition, our proposed schemes are also very desirable from the viewpoint of transmission bandwidth savings since an efficient rekeying mechanism is provided for membership changes and they significantly reduce the required bandwidth due to key updating in mobile networks. Moreover, they achieve the security and scalability requirements in wireless networks.

Efficient Key Agreement for Large and Dynamic Multicast Groups

Secure multicast represents the core component of many web and multimedia applications such as pay-TV, teleconferencing, real-time distribution of stock market price and etc. The main challenges for secure multicast is scalability, efficiency and authenticity. In this paper, we propose a scalable, efficient, authenticated group key agreement scheme for large and dynamic multicast systems. The proposed key agreement scheme is identity-based which uses the bilinear map over the elliptic curves. Compared with the previously published schemes, our scheme pro- vides group member authenticity without imposing extra mechanism. Furthermore, we give a scalability solution based on the subgroups, which has advantages over the existing schemes. Security analysis shows that our scheme satisfies both forward secrecy and backward secrecy.

Design of Optimum Key Tree with Minimized Overheads for Secure Multicasting using Genetic Algorithm

Secure multicasting is an important requirement in today's networks due to the advancements in Internet technology. The multicast security problems are abstracted into key management and distribution problems. Generally, the centralized approaches maintain a virtual key tree for the set of keys used in the secured communication with the help of an entity called Central Controller. The question of whether the storage requirement of the central controller can be minimized while preserving the communication budget constraint is posed as an optimization problem. The hybrid method addresses this problem based on the clustering technique using information theoretic approach. The degree of the tree is another important constraint in this problem. The objective of minimizing the total cost involving the storage and communication overheads with respect to the cluster size and degree is formulated as a multi-objective optimization problem and it is solved using Genetic algorithm. The optimum key tree size is recommended for large groups.

Power proximity based key management for secure multicast in ad hoc networks

As group-oriented services become the focal point of ad hoc network applications, securing the group communications becomes a default requirement. In this paper, we address the problem of group access in secure multicast communications for wireless ad hoc networks. We argue that energy expenditure is a scarce resource for the energy-limited ad hoc network devices and introduce a cross-layer approach for designing energy-efficient, balanced key distribution trees to perform key management. To conserve energy, we incorporate the network topology (node location), the power proximity between network nodes and the path loss characteristics of the medium in the key distribution tree design. We develop new algorithms for homogeneous as well as heterogeneous environments and derive their computational complexity. We present simulation studies showing the improvements achieved for three different but common environments of interest, thus illustrating the need for cross-layer design approaches for security in wireless networks.

CASM: a content-aware protocol for secure video multicast

Information security has been a critical issue in the design and development of reliable distributed communication systems and has attracted significant research efforts. A challenging task is how to maintain information security at a high level for multiple-destination video applications with the huge volume of data and dynamic property of clients. This paper proposes a novel Content-Aware Secure Multicast (CASM) protocol for video distribution that seamlessly integrates three important modules: 1)a scalable light-weight algorithm for group key management; 2) a content-aware key embedding algorithm that can make video quality distortion imperceptible and is reliable for clients to detect embedded keys; and 3) a smart two-level video encryption algorithm that can selectively encrypt a small set of video data only, and yet ensure the video as well as the embedded keys unrecognizable without a genuine key. The implementation of the CASM protocol is independent of the underlying multicast mechanism and is fully compatible with existing coding standards. Performance evaluation studies built upon a CASM prototype have demonstrated that CASM is highly robust and scalable in dynamic multicast environments. Moreover, it ensures secure distribution of key and video data with minimized communication and computation overheads. The proposed content-aware key embedding and encryption algorithms are fast enough to support real-time video multicasting.

An efficient group key agreement protocol

Group key agreement protocol is important for collaborative and group-oriented application. Recently, for a network that consists of devices with limited resource, group key management has become an issue for secure routing or multicast. In this letter, we present an efficient group key agreement protocol that is an improvement of the Burrnester-Desmedt algorithm. We generalize the Improvement, which doesn't need the same modulus group for discrete logarithm problem

A Computationally Efficient Key-Hiding Based Group Re-Keying Scheme For Secure Multicasting

Multicast security is becoming an important networking issue because of the growing number of network applications that rely on multicast communication. Scalable group re-keying is one of the biggest challenges that needs to be addressed in order to support secure multicasting. In this paper, we present and analyze a new group re-keying algorithm for establishing cryptographic keys in multicast groups. Our re-keying algorithm is based on hiding the cryptographic group key in a numerical matrix. Our algorithm does not need computationally expensive encryption/decryption for group re-keying. Re-keying message construction and group key retrieval processes need only simple logical operations. For a given re-keying matrix, the computational cost for group re-keying is constant regardless of the number of group members.