Method and apparatus for creating a secure communication channel among multiple event service nodes

• US 7,660,983 B1
• Filed: 04/18/2005
• Issued: 02/09/2010
• Est. Priority Date: 09/29/1999
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Trostle, Jonathan, Bell, Raymond, Golla, Ramprasad, Srivastava, Sunil K.
• Primary Examiner(s): Brown; Christopher J
• Application Number:
  US11/109,211
• Time in Patent Office: 1,758 Days
• Field of Search: 713/163, 713/171
• US Class Current: 713/163
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

An approach for establishing secure multicast communication among multiple event service nodes is disclosed. The event service nodes, which can be distributed throughout an enterprise domain, are organized in a logical tree that mimics the logical tree arrangement of domains in a directory server system. The attributes of the event service nodes include the group session key and the private keys of the event service nodes that are members of the multicast or broadcast groups. The private keys provide unique identification values for the event service nodes, thereby facilitating distribution of such keys. Because keys as well as key version information are housed in the directory, multicast security can readily be achieved over any number of network domains across the entire enterprise. Key information is stored in, and the logical tree is supported by, a directory service.

Claims

1. A method for adding a first event service node to a multicast group that includes a plurality of event service nodes in a communication network, the method comprising the steps of:

receiving a plurality of private keys from a subset of event service nodes of the plurality of event service nodes, wherein the subset of event service nodes comprises nodes that are affected by adding the first event service node to the multicast group; and

communicating the plurality of private keys to the first event service node,

wherein the method is performed by one or more processors.

2. A method as recited in claim 1, further comprising the step of:

authenticating the first event service node to the subset of event service nodes, based on key information stored in a directory.

3. A method as recited in claim 1, wherein each event service node of the plurality of event service nodes is capable of serving as a key distribution center, and the method further comprises the steps of:

generating a new private key for the first event service node;

communicating the new private key to the first event service node; and

communicating a message to the subset of event service nodes that causes the subset of event service nodes to update their private keys.

4. A method as recited in claim 1, wherein:

each private key in the plurality of private keys uniquely identifies a corresponding node in a binary tree; and

each bit of the private key corresponds to one private key of the plurality of private keys.

5. A method as recited in claim 1, wherein:

the plurality of event service nodes is logically organized according to a binary tree that includes a root node, one or more intermediate nodes, and one or more leaf nodes;

one or more event service nodes of the plurality of event service nodes are represented by the one or more leaf nodes;

a particular event service node is associated with a particular leaf node of the one or more leaf nodes; and

the method further comprises;

in response to determining that the particular event service node is leaving the multicast group, determining that at least one intermediate node is affected;

generating an updated private key based on a private key of the at least one intermediate node;

generating a new group session key;

modifying attribute information based upon the updated private key and the new group session key; and

causing the attribute information to be distributed through replication of a directory.

6. A method as recited in claim 1, wherein:

the plurality of event service nodes is logically organized according to a binary tree that includes a root node, one or more intermediate nodes, and one or more leaf nodes;

one or more event service nodes of the plurality of event service nodes are represented by the one or more leaf nodes; and

the method further comprises;

in response to receiving a request message from a new event service node to join the multicast group, determining that at least one intermediate node is affected by adding a new leaf node that corresponds to the new event service node to the binary tree;

generating an updated private key based on a private key of the at least one intermediate node;

generating a new group session key;

generating a new private key for the new leaf node;

modifying attribute information based upon the new private key and the new group session key; and

causing the attribute information to be distributed through replication of a directory.

7. A secure network communication system, comprising a plurality of group controllers coupled to a communication network, wherein at least one group controller of the plurality of group controllers comprises:

a processor;

a memory coupled to the processor using a bus;

one or more sequences of instructions stored in the memory for adding a first event service node to a multicast group that includes a plurality of event service nodes in the communication network, wherein execution of the one or more sequences of instructions by the processor causes the processor to perform the steps of;

receiving a plurality of private keys from a subset of event service nodes of the plurality of event service nodes, wherein the subset of event service nodes comprises nodes that are affected by adding the first event service node to the multicast group; and

communicating the plurality of private keys to the first event service node.

8. A system as recited in claim 7, wherein the at least one group controller further comprises one or more additional sequences of instructions stored in the memory, wherein execution of the one or more additional sequences of instructions by the processor causes the processor to perform the step of:

authenticating the first event service node to the subset of event service nodes, based on key information stored in a directory.

9. A system as recited in claim 7, wherein each event service node of the plurality of event service nodes is capable of serving as a key distribution center, and the at least one group controller further comprises one or more additional sequences of instructions stored in the memory, wherein execution of the one or more additional sequences of instructions by the processor causes the processor to perform the steps of:

generating a new private key for the first event service node;

communicating the new private key to the first event service node; and

communicating a message to the subset of event service nodes that causes the subset of event service nodes to update their private keys.

10. A system as recited in claim 7, wherein:

each private key in the plurality of private keys uniquely identifies a corresponding node in a binary tree; and

each bit of the private key corresponds to one private key of the plurality of private keys.

11. A system as recited in claim 7, wherein:

the plurality of event service nodes is logically organized according to a binary tree that includes a root node, one or more intermediate nodes, and one or more leaf nodes;

one or more event service nodes of the plurality of event service nodes are represented by the one or more leaf nodes;

a particular event service node is associated with a particular leaf node of the one or more leaf nodes; and

the at least one group controller further comprises one or more additional sequences of instructions stored in the memory, wherein execution of the one or more additional sequences of instructions by the processor causes the processor to perform the steps of;

in response to determining that the particular event service node is leaving the multicast group, determining that at least one intermediate node is affected;

generating an updated private key based on a private key of the at least one intermediate node;

generating a new group session key;

modifying attribute information based upon the updated private key and the new group session key; and

causing the attribute information to be distributed through replication of a directory.

12. A system as recited in claim 7, wherein:

the plurality of event service nodes is logically organized according to a binary tree that includes a root node, one or more intermediate nodes, and one or more leaf nodes;

one or more event service nodes of the plurality of event service nodes are represented by the one or more leaf nodes; and

the at least one group controller further comprises one or more additional sequences of instructions stored in the memory, wherein execution of the one or more additional sequences of instructions by the processor causes the processor to perform the steps of;

in response to receiving a request message from a new event service node to join the multicast group, determining that at least one intermediate node is affected by adding a new leaf node that corresponds to the new event service node to the binary tree;

generating an updated private key based on a private key of the at least one intermediate node;

generating a new group session key;

generating a new private key for the new leaf node;

modifying attribute information based upon the new private key and the new group session key; and

causing the attribute information to be distributed through replication of a directory.

13. An apparatus for adding a first event service node to a multicast group that includes a plurality of event service nodes in a communication network, the apparatus comprising:

one or more processors;

means for receiving a plurality of private keys from a subset of event service nodes of the plurality of event service nodes, wherein the subset of event service nodes comprises nodes that are affected by adding the first event service node to the multicast group; and

means for communicating the plurality of private keys to the first event service node.

14. An apparatus as recited in claim 13, further comprising:

means for authenticating the first event service node to the subset of event service nodes, based on key information stored in a directory.

15. An apparatus as recited in claim 13, wherein each event service node of the plurality of event service nodes is capable of serving as a key distribution center, and the apparatus further comprises:

means for generating a new private key for the first event service node;

means for communicating the new private key to the first event service node; and

means for communicating a message to the subset of event service nodes that causes the subset of event service nodes to update their private keys.

16. An apparatus as recited in claim 13, wherein:

each private key in the plurality of private keys uniquely identifies a corresponding node in a binary tree; and

each bit of the private key corresponds to one private key of the plurality of private keys.

17. An apparatus as recited in claim 13, wherein:

the plurality of event service nodes is logically organized according to a binary tree that includes a root node, one or more intermediate nodes, and one or more leaf nodes;

one or more event service nodes of the plurality of event service nodes are represented by the one or more leaf nodes;

a particular event service node is associated with a particular leaf node of the one or more leaf nodes; and

the apparatus further comprises;

means for determining, in response to determining that the particular event service node is leaving the multicast group, that at least one intermediate node is affected;

means for generating an updated private key based on a private key of the at least one intermediate node;

means for generating a new group session key;

means for modifying attribute information based upon the updated private key and the new group session key; and

means for causing the attribute information to be distributed through replication of a directory.

18. An apparatus as recited in claim 13, wherein:

the plurality of event service nodes is logically organized according to a binary tree that includes a root node, one or more intermediate nodes, and one or more leaf nodes;

one or more event service nodes of the plurality of event service nodes are represented by the one or more leaf nodes; and

the apparatus further comprises;

means for determining, in response to receiving a request message from a new event service node to join the multicast group, that at least one intermediate node is affected by adding a new leaf node that corresponds to the new event service node to the binary tree;

means for generating an updated private key based on a private key of the at least one intermediate node;

means for generating a new group session key;

means for generating a new private key for the new leaf node;

means for modifying attribute information based upon the new private key and the new group session key; and

means for causing the attribute information to be distributed through replication of a directory.

19. A method for removing a first event service node of a plurality of event service nodes from a multicast group that includes the plurality of event service nodes in a communication network, wherein the plurality of event service nodes is logically organized according to a binary tree that includes a root node, one or more intermediate nodes, and one or more leaf nodes, the method comprising the steps of:

for a particular node in the binary tree that corresponds to the first event service node, encrypting an authentication key for an immediate ancestral node that is logically above the particular node in the binary tree using one or more private keys of one or more nodes that are logically below the particular node;

iteratively repeating said encrypting step for each successive ancestral node of the first event service node in the binary tree until the authentication key of the root node has been encrypted; and

communicating the authentication keys to each event service node that is represented in a branch of the binary tree that includes the particular node that corresponds to the first event service node,

wherein the method is performed by one or more processors.

20. A method as recited in claim 19, wherein:

each event service node of the plurality of event service nodes is capable of serving as a key distribution center; and

the step of communicating the authentication keys comprises the step of using one message containing 2 log₂N+1 keys to communicate the authentication keys to each event service node that is represented in a branch of the binary tree that includes the first event service node.

21. A method as recited in claim 19, further comprising:

for a particular node in the binary tree that corresponds to the first event service node, creating and storing a new authentication key for a logical parent node of the particular node;

iteratively repeating said creating and storing steps for each successive ancestral node of the first event service node in the binary tree until the new authentication key for the root node has been created and stored; and

encrypting the new authentication key for the logical parent node for the particular node corresponding to the first event service node using a private key of an adjacent node.

22. A method as recited in claim 21, wherein creating and storing the new authentication key for the logical parent node of the particular node comprises the step of creating and storing a new group session key for use in multicast communications by all nodes in a branch of the binary tree that includes the particular node that corresponds to the first event service node.

23. A secure network communication system, comprising a plurality of group controllers coupled to a communication network, wherein at least one group controller of the plurality of group controllers comprises:

a processor;

a memory coupled to the processor using a bus;

one or more sequences of instructions stored in the memory for removing a first event service node of a plurality of event service nodes from a multicast group that includes the plurality of event service nodes in a communication network, wherein the plurality of event service nodes is logically organized according to a binary tree that includes a root node, one or more intermediate nodes, and one or more leaf nodes, wherein execution of the one or more sequences of instructions by the processor causes the processor to perform the steps of;

for a particular node in the binary tree that corresponds to the first event service node, encrypting an authentication key for an immediate ancestral node that is logically above the particular node in the binary tree using one or more private keys of one or more nodes that are logically below the particular node;

iteratively repeating said encrypting step for each successive ancestral node of the first event service node in the binary tree until the authentication key of the root node has been encrypted; and

communicating the authentication keys to each event service node that is represented in a branch of the binary tree that includes the particular node that corresponds to the first event service node.

24. A system as recited in claim 23, wherein:

each event service node of the plurality of event service nodes is capable of serving as a key distribution center; and

the instructions for communicating the authentication keys comprises one or more additional sequences of instructions, wherein execution of the one or more sequences of instructions by the processor causes the processor to perform the step of using one message containing 2 log₂N+1 keys to communicate the authentication keys to each event service node that is represented in a branch of the binary tree that includes the first event service node.

25. A system as recited in claim 23, further comprising one or more additional sequences of instructions, wherein execution of the one or more sequences of instructions by the processor causes the processor to perform the steps of:

for a particular node in the binary tree that corresponds to the first event service node, creating and storing a new authentication key for a logical parent node of the particular node;

iteratively repeating said creating and storing steps for each successive ancestral node of the first event service node in the binary tree until the new authentication key for the root node has been created and stored; and

encrypting the new authentication key for the logical parent node for the particular node corresponding to the first event service node using a private key of an adjacent node.

26. A system as recited in claim 25, wherein the instructions for creating and storing the new authentication key for the logical parent node of the particular node comprises one or more additional sequences of instructions, wherein execution of the one or more sequences of instructions by the processor causes the processor to perform the steps of creating and storing a new group session key for use in multicast communications by all nodes in a branch of the binary tree that includes the particular node that corresponds to the first event service node.

27. An apparatus for removing a first event service node of a plurality of event service nodes from a multicast group that includes the plurality of event service nodes in a communication network, wherein the plurality of event service nodes is logically organized according to a binary tree that includes a root node, one or more intermediate nodes, and one or more leaf nodes, the apparatus comprising:

one or more processors;

means for encrypting, for a particular node in the binary tree that corresponds to the first event service node, an authentication key for an immediate ancestral node that is logically above the particular node in the binary tree using one or more private keys of one or more nodes that are logically below the particular node;

means for iteratively repeating said encrypting step for each successive ancestral node of the first event service node in the binary tree until the authentication key of the root node has been encrypted; and

means for communicating the authentication keys to each event service node that is represented in a branch of the binary tree that includes the particular node that corresponds to the first event service node.

28. An apparatus as recited in claim 27, wherein:

each event service node of the plurality of event service nodes is capable of serving as a key distribution center; and

the means for communicating the authentication keys comprises means for using one message containing 2 log₂N+1 keys to communicate the authentication keys to each event service node that is represented in a branch of the binary tree that includes the first event service node.

29. An apparatus as recited in claim 27, further comprising:

means for creating and storing, for a particular node in the binary tree that corresponds to the first event service node, a new authentication key for a logical parent node of the particular node;

means for iteratively repeating said creating and storing steps for each successive ancestral node of the first event service node in the binary tree until the new authentication key for the root node has been created and stored; and

means for encrypting the new authentication key for the logical parent node for the particular node corresponding to the first event service node using a private key of an adjacent node.

30. An apparatus as recited in claim 29, wherein the means for creating and storing the new authentication key for the logical parent node of the particular node comprises means for creating and storing a new group session key for use in multicast communications by all nodes in a branch of the binary tree that includes the particular node that corresponds to the first event service node.