Techniques for securing data flow in internet multicasting

• US 6,816,966 B1
• Filed: 06/30/1997
• Issued: 11/09/2004
• Est. Priority Date: 06/30/1997
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Gupta, Amit, Jardetzky, Paul W.
• Primary Examiner(s): Myhre, James W.
• Application Number:
  US08/885,817
• Time in Patent Office: 2,689 Days
• Field of Search: 380/30, 380/21, 380/25, 713/163
• US Class Current: 713/163
• CPC Class Codes: H04L 12/18 for broadcast or conference , e.g. multicast
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Multicast communications are expanded to include the concept of private multicasts. An address space dedicated to multicast is partitioned into a subspace for public multicasts and a subspace for private multicasts. A public key/private key encryption pair is used for private multicasts and installed on domain name servers or on certification authorities. Portions of a multicast join request are sent together with a corresponding encrypted version. Private multicast equipped routers receive the multicast join request, retrieve the public key from a domain name server or from a certification authority and decrypt the encrypted portion of the join request to determine if the requester is authorized. Group specific multicast joins are also permitted by sending a bit-mask identifying a group of senders which are authorized or prohibited from sending to a user joining a multicast.

Claims

1. A routing element for multicast digital communications, comprising:

a. at least one input port;

b. at least one output port; and

c. a processor for controlling packet routing from an input port to an output port, said processor configured to obtain a public key and to decode at least a portion of a multicast join request comprising encrypted information submitted by a user using said public key to verify that said user is authorized to join a multicast, and further configured to block multicast packets received from senders blocked from sending to a receiver as indicated by a bit-mask received with a multicast join request.

2. Apparatus for participating in a multicast, comprising

a. a communication port;

and

b. a processor for controlling communications over said communications port;

said processor configured to send a private multicast join request comprising first information and encrypted first information.

3. Apparatus of claim 2 in which said first information includes a first field identifying a user requesting participation in a particular multicast and said encrypted first information comprises a second field containing the results of encrypting at least one of said first field or a digest of said first field using a private key.

4. Apparatus of claim 2 in which said encrypted first information comprises a second field contains the results of encrypting one of said first field and a third field containing a randomly generated key or digest of said first field and said third field.

5. Apparatus of claim 2 in which said join request includes at least one bit-mask, a bit-mask specifying one of a group of senders permitted to send to said communications port and a group of senders prohibited to send to said communications port.

6. A method of operating a communications system comprising the step of:

providing a multicast address space having a subspace for public multicasts and a subspace for private multicasts.

7. A method of sending a multicast join request, comprising the step of:

a. sending first information including a user identification together with an encrypted version of said first information.

8. The method of claim 7 in which said first information further includes a random key.

9. A method of sending a multicast join request from a user, comprising the step of:

a. sending a list of bit-masks specifying at least one of a group of senders permitted to send to said user and a group of senders prohibited from sending to said user.

10. A computer program product, comprising:

a. a memory medium; and

b. a computer program stored on said memory medium, said computer program comprising instructions for providing a multicast address space having a subspace for public multicasts and a subspace for private multicasts.

11. The computer program product of claim 10 in which said program is transmitted from said memory medium over a network interface.

12. A computer program product, comprising:

a. a memory medium; and

b. a computer program stored on said memory medium, said computer program comprising instructions for sending a multicast join request, including a user identification together with an encrypted version of said user identification.

13. The computer program product of claim 12 in which said program is transmitted from said memory medium over a network interface.

14. A computer program product, comprising:

a. a memory medium; and

b. a computer program stored on said memory medium, said computer program comprising instructions for sending a group specific multicast join request including a bit-mask specifying at least one of a group of senders permitted to send to said user and a group of senders prohibited from sending to said user.

15. The computer program product of claim 14 in which said program transmitted from said memory medium over a network interface.