Secure communications system

• US 6,629,243 B1
• Filed: 10/07/1999
• Issued: 09/30/2003
• Est. Priority Date: 10/07/1998
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: NDS Limited (Cisco Systems, Inc.)
• Inventors: Kleinman, Amit, Kipnis, Shlomo
• Primary Examiner(s): Barrón, Gilberto
• Assistant Examiner(s): GURSHMAN, GRIGORY
• Application Number:
  US09/414,061
• Time in Patent Office: 1,454 Days
• Field of Search: 713/163, 713/171
• US Class Current: 713/163
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A key distribution method for distributing, via a communications network, a key in a multicast communications system in which each one of a plurality of communications is directed to an associated multicast group including a plurality of recipients intended to receive the one communication. The method includes providing a plurality of implemented key distribution methods, dynamically choosing one implemented key distribution method of the plurality of key distribution methods, and distributing at least one key using the one implemented key distribution method.

Related apparatus and methods are also provided.

Claims

1. A key distribution method for distributing, via a communications network, a key in a multicast communications system in which each one of a plurality of communications is directed to an associated multicast group comprising a plurality of recipients intended to receive the one communication, the method comprising:

providing a plurality of implemented key distribution methods;

dynamically choosing one implemented key distribution method of the plurality of key distribution methods; and

distributing at least one key using the one implemented key distribution method.

2. A method according to claim 1 and wherein the step of dynamically choosing comprises choosing based, at least in part, on at least one of the following:

a characteristic of the associated multicast group;

a location of at least one recipient comprised in the multicast group;

a characteristic of the key;

a multicast traffic characteristic; and

a multicast content characteristic.

3. A method according to claim 2 and wherein the characteristic of the associated multicast group comprises at least one of the following:

a size of the multicast group; and

a dynamic parameter associated with the multicast group.

4. A method according to claim 2 and wherein the location comprises at least one of the following:

an absolute location;

a relative location; and

an association between the at least one recipient and a sub-domain of the communications network.

5. A method according to claim 3 and wherein the location comprises at least one of the following:

an absolute location;

a relative location; and

an association between the at least one recipient and a sub-domain of the communications network.

6. A method according to claim 2 and wherein the characteristic of the key comprises a distribution characteristic.

7. A method according to claim 3 and wherein the characteristic of the key comprises a distribution characteristic.

8. A method according to claim 1 and wherein the communications network comprises the Internet.

9. A method according to claim 2 and wherein the communications network comprises the Internet.

10. A method according to claim 1 and wherein the communications network comprises an Intranet.

11. A method according to claim 2 and wherein the communications network comprises an Intranet.

12. A method according to claim 1 and wherein the plurality of implemented key distribution methods comprises at least one of the following:

a star distribution method;

a multicast distribution method;

a group distribution method; and

a tree distribution method.

13. A method according to claim 2 and wherein the plurality of implemented key distribution methods comprises at least one of the following:

a star distribution method;

a multicast distribution method;

a group distribution method; and

a tree distribution method.

14. Key distribution apparatus for distributing, via a communications network, a key in a multicast communications system in which each one of a plurality of communications is directed to an associated multicast group comprising a plurality of recipients intended to receive the one communication the apparatus comprising:

a plurality of implemented key distribution methods;

a decision maker and selector for dynamically choosing one implemented key distribution method from the plurality of implemented key distribution methods, and

a multicast distribution unit for distributing at least one key using the one implemented key-distribution method.

15. Apparatus according to claim 14 and wherein the plurality of implemented key distribution methods comprises at least one of the following:

a star distribution method;

a multicast distribution method;

a group distribution method; and

a tree distribution method.

16. Apparatus according to claim 14 and wherein said dynamically choosing comprises choosing based, at least in part, on at least one of the following:

a characteristic of the associated multicast group;

a location of at least one recipient comprised in the multicast group;

a characteristic of the key;

a multi cast traffic characteristic; and

a multicast content characteristic.

17. Key reception apparatus for receiving, via a communications network, a key in a multicast communications system in which each one of a plurality of communications is directed to an associated multicast group comprising a plurality of recipients intended to receive the one communication, the key being distributed using one implemented key distribution method chosen from a plurality of methods, and indication of the one implemented key distribution method being transmitted via the communications network, the apparatus comprising:

a plurality of implemented key distribution methods;

a selector, responsive to the indication of the one implemented key distribution method, for dynamically choosing the one implemented key distribution method from the plurality of implemented key distribution methods; and

utilization apparatus for utilizing the key in accordance with the one implemented key distribution method.

18. Apparatus according to claim 17 and wherein the plurality of implemented key distribution methods comprises at least one of the following:

a star distribution method;

a multicast distribution method;

a group distribution method; and

a tree distribution method.

19. Apparatus according to claim 17 and wherein said dynamically choosing comprises choosing based, at least in part, on at least one of the following:

a characteristic of the associated multicast group;

a location of at least one recipient comprised in the multicast group;

a characteristic of the key;

a multicast traffic characteristic; and

a multicast content characteristic.