Method and apparatus for distributing and updating private keys of multicast group managers using directory replication

• US 20050044356A1
• Filed: 09/29/2004
• Published: 02/24/2005
• Est. Priority Date: 12/22/1999
• Status: Active Grant

• Current Assignee: Jonathon Trostle, Ramprasad Golla, Raymond Bell, Sunil Srivastava
• Original Assignee: Jonathon Trostle, Ramprasad Golla, Raymond Bell, Sunil Srivastava
• Inventors: Trostle, Jonathon, Bell, Raymond, Golla, Ramprasad, Srivastava, Sunil
• Granted Patent: US 7,383,436 B2
• Time in Patent Office: Days
• US Class Current: 713/163
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

An approach for establishing secure multicast communication among multiple multicast proxy service nodes is disclosed. The multicast proxy service nodes, which can be distributed throughout an enterprise domain, are organized in a logical tree that mimics the logical tree arrangement of domains in a directory server system. The attributes of the multicast proxy service nodes include the group session keys that are members of the secure multicast or broadcast groups. Because keys as well as key version information are housed in the directory, multicast security can be achieved over any number of network domains across the entire enterprise. Key information is stored in, and the logical tree is supported by, a directory service. Replication of the directory accomplishes distribution of keys. Multicast proxy service nodes may obtain current key information from a local copy of the replicated directory.

Claims

1. A method for communicating a session key from a first multicast proxy service node of a secure multicast group to a plurality of other multicast proxy service nodes of the secure multicast group in a communication network, wherein each of the multicast proxy service nodes is capable of establishing multicast communication and serving as a key distribution center, the method comprising the steps of:

creating and storing an original group session key associated with the secure multicast group in a first directory; and

receiving a new group session key for the secure multicast group, for use after addition of the first multicast proxy service node, from a local multicast proxy service node that has received the original group session key through periodic replication of the first directory.

2. A method as recited in claim 1, further comprising the steps of:

authenticating the first multicast proxy service node with a subset of the multicast proxy service nodes that are affected by an addition of the first multicast proxy service node to the secure multicast group, based on the original group session key stored in the first directory; and

receiving a plurality of private keys from the subset of the multicast proxy service nodes.

3. A method as recited in claim 1, further comprising the steps of:

communicating the new group session key to the first multicast proxy service node; and

communicating a message to the subset of the multicast proxy service nodes that causes the subset of the multicast proxy service nodes to update their private keys.

4. A method as recited in claim 2, wherein authenticating the first multicast proxy service node includes authenticating the first multicast proxy service node based on a second directory that comprises a directory system agent (DSA) that communicates with one or more of the multicast proxy service nodes and a replication service agent (RSA) that replicates attribute information of the one or more multicast proxy service nodes.

5. A method as recited in claim 1, wherein receiving the new group session key includes receiving the new group session key from a node of a second directory that comprises a directory system agent (DSA) for communicating with one or more of the multicast proxy service nodes and a replication service agent (RSA) for replicating key information of the one or more multicast proxy service nodes.

6. A method as recited in claim 5, further comprising the step of signaling the replication service agent to carry out replication by storing an updated group session key in a local node of the first directory.

7. A method as recited in claim 1, further comprising distributing the original group session key to all nodes by creating and storing the original group session key using a first multicast proxy service node of one domain of the first directory;

replicating the first directory; and

obtaining the original group session key from a local multicast proxy service node that is a replica of the first multicast proxy service node.

8. A method as recited in claim 1, further comprising distributing the new group session key to all nodes by creating and storing the new group session key using a first multicast proxy service node of one domain of the first directory;

replicating the first directory; and

obtaining the new group session key from a local multicast proxy service node that is a replica of the first multicast proxy service node.

9. A communication system for communicating a session key from a first multicast proxy service node of a secure multicast group to a plurality of other multicast proxy service nodes of the secure multicast group in a communication network, wherein each of the multicast proxy service nodes is capable of establishing multicast communication and serving as a key distribution center, the communication system comprising:

a group controller that creates and manages secure multicast communication among the other multicast proxy service nodes, having a private key;

a computer-readable medium comprising one or more instructions which, when executed by one or more processors, cause the one or more processors to carry out the steps of;

creating and storing an original group session key associated with the secure multicast group in a first directory;

authenticating the first multicast proxy service node with a subset of the multicast proxy service nodes that are affected by an addition of the multicast proxy service node to the secure multicast group, based on the original group session key stored in the first directory;

receiving a plurality of private keys from the subset of the multicast proxy service nodes;

receiving a new group session key for the secure multicast group, for use after addition of the first multicast proxy service node, from a local multicast proxy service node that has received the original group session key through periodic replication of the first directory;

communicating the new group session key to the first multicast proxy service node; and

communicating a message to the subset of the multicast proxy service nodes that causes the subset of the multicast proxy service nodes to update their private keys.

20. A communication system as recited in claim 9, wherein the one or more instructions for authenticating the first multicast proxy service node further comprise one or more instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of:

authenticating the first multicast proxy service node based on a second directory that comprises a directory system agent (DSA) that communicates with one or more of the multicast proxy service nodes and a replication service agent (RSA) that replicates attribute information of the one or more multicast proxy service nodes

21. A communication system as recited in claim 9, wherein the one or more instructions for receiving the new group session key further comprise one or more instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of:

receiving the new group session key from a node of a second directory that comprises a directory system agent (DSA) for communicating with one or more of the multicast proxy service nodes and a replication service agent (RSA) for replicating key information of the one or more multicast proxy service nodes.

22. A communication system as recited in claim 21, further comprising one or more instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of signaling the replication service agent to carry out replication by storing an updated group session key in a local node of the first directory.

23. A communication system as recited in claim 9, further comprising one or more instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of distributing the original group session key to all nodes by creating and storing the original group session key using a first multicast proxy service node of one domain of the first directory;

replicating the first directory; and

obtaining the original group session key from a local multicast proxy service node that is a replica of the first multicast proxy service node.

24. A communication system as recited in claim 9, further comprising one or more instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of distributing the new group session key to all nodes by creating and storing the new group session key using a first multicast proxy service node of one domain of the first directory;

replicating the first directory; and

obtaining the new group session key from a local multicast proxy service node that is a replica of the first multicast proxy service node.

10. A communication system for creating a secure multicast or broadcast group wherein one of the multicast proxy service nodes generates a first group session key for establishing the secure multicast or broadcast group among the plurality of multicast proxy service nodes and distributes the first group session key to other multicast proxy service nodes in the secure multicast or broadcast group using directory replication.

11. A communication system as recited in claim 10 comprising:

a plurality of multicast proxy service nodes, each node of the plurality of multicast proxy service nodes having attribute information comprising a group identification value for uniquely identifying a particular node of the multicast proxy service nodes; and

a directory comprising a directory system agent (DSA) for communicating with one or more of the multicast proxy service nodes to authenticate each of the multicast proxy service nodes and a replication service agent (RSA) for replicating the attribute information of the one or more multicast proxy service nodes.

25. A communication system as recited in claim 11, further comprising:

a plurality of client nodes coupled to one of the multicast proxy service nodes, the one multicast proxy service node creating a secure multicast or broadcast client group that is separate from the secure multicast or broadcast group.

26. A communication system as recited in claim 11, wherein the plurality of multicast proxy service nodes form a logical arrangement of the plurality of multicast proxy service nodes according to a tree structure, the tree structure having a root node, one or more intermediate nodes, and one or more leaf nodes, one of the multicast proxy service node nodes being designated as a primary multicast proxy service node, the primary multicast proxy service node being mapped to the root node, the other multicast proxy service nodes having private keys corresponding to the group identification values and being mapped to the one or more intermediate nodes and the one or more leaf nodes

12. A computer-readable medium carrying one or more sequences of instructions for communicating a session key from a first multicast proxy service node of a secure multicast group to a plurality of other multicast proxy service nodes of the secure multicast group in a communication network, wherein each of the multicast proxy service nodes is capable of establishing multicast communication and serving as a key distribution center, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

creating and storing an original group session key associated with the secure multicast group in a first directory; and

receiving a new group session key for the secure multicast group for use after addition of the first multicast proxy service node from a local multicast proxy service node that has received the original group session key through periodic replication of the first directory.

13. A computer-readable medium as recited in claim 12, further comprising the steps of:

authenticating the first multicast proxy service node with a subset of the multicast proxy service nodes that are affected by an addition of the first multicast proxy service node to the secure multicast group, based on the original group session key stored in the first directory; and

receiving a plurality of private keys from the subset of the multicast proxy service nodes.

14. A computer-readable medium as recited in claim 12, further comprising the steps of:

communicating the new group session key to the first multicast proxy service node; and

communicating a message to the subset of the multicast proxy service nodes that causes the subset of the multicast proxy service nodes to update their private keys.

15. A computer-readable medium as recited in claim 13, wherein the instructions for authenticating the first multicast proxy service node further comprises instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of authenticating the first multicast proxy service node based on a second directory that comprises a directory system agent (DSA) that communicates with one or more of the multicast proxy service nodes and a replication service agent (RSA) that replicates attribute information of the one or more multicast proxy service nodes.

16. A computer-readable medium as recited in claim 12, wherein the instructions for receiving the new group session key further comprises instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of receiving the new group session key from a node of a second directory that comprises a directory system agent (DSA) for communicating with one or more of the multicast proxy service nodes and a replication service agent (RSA) for replicating key information of the one or more multicast proxy service nodes.

17. A computer-readable medium as recited in claim 16, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of signaling the replication service agent to carry out replication by storing an updated group session key in a local node of the first directory.

18. A computer-readable medium as recited in claim 12, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of distributing the original group session key to all nodes by creating and storing the original group session key using a first multicast proxy service node of one domain of the first directory;

replicating the first directory; and

obtaining the original group session key from a local multicast proxy service node that is a replica of the first multicast proxy service node.

19. A computer-readable medium as recited in claim 12, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the steps of distributing the new group session key to all nodes by creating and storing the new group session key using a first multicast proxy service node of one domain of the first directory;

replicating the first directory; and

obtaining the new group session key from a local multicast proxy service node that is a replica of the first multicast proxy service node.

27. An apparatus for communicating a session key from a first multicast proxy service node of a secure multicast group to a plurality of other multicast proxy service nodes of the secure multicast group in a communication network, wherein each of the multicast proxy service nodes is capable of establishing multicast communication and serving as a key distribution center, the method comprising:

a means for creating and storing an original group session key associated with the secure multicast group in a first directory; and

a means for receiving a new group session key for the secure multicast group, for use after addition of the first multicast proxy service node, from a local multicast proxy service node that has received the original group session key through periodic replication of the first directory.

28. An apparatus as recited in claim 27, further comprising:

a means for authenticating the first multicast proxy service node with a subset of the multicast proxy service nodes that are affected by an addition of the first multicast proxy service node to the secure multicast group, based on the original group session key stored in the first directory; and

a means for receiving a plurality of private keys from the subset of the multicast proxy service nodes.

29. An apparatus as recited in claim 27, further comprising:

a means for communicating the new group session key to the first multicast proxy service node; and

a means for communicating a message to the subset of the multicast proxy service nodes that causes the subset of the multicast proxy service nodes to update their private keys.