System for providing secure multi-cast broadcasts over a network

• US 7,610,485 B1
• Filed: 08/06/2003
• Issued: 10/27/2009
• Est. Priority Date: 08/06/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Yadav, Navindra
• Primary Examiner(s): Moazzami; Nasser G
• Assistant Examiner(s): Traore; Fatoumata
• Application Number:
  US10/636,377
• Time in Patent Office: 2,274 Days
• Field of Search: 713/150, 713/162, 713/163, 713/169
• US Class Current: 713/163
• CPC Class Codes: H04H 20/82 using signals not modulated onto a carrier
• CPC Class Codes: H04H 60/23 using cryptography, e.g. encryption, authentication, key distribution
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065

Abstract

A system for providing secure multi-cast broadcasts. The system includes a broadcasting processing system, a security server processing system, and at least one receiving processing system. The security server provides an encryption key to the broadcasting processing system and the at least one receiving processing system. The broadcasting processing system then encrypts broadcast data with the encryption data and transmits the encrypted data over the network. The at least one receiving processing systems then receive the encrypted data and decrypt the data using the encryption key.

Claims

1. A method for providing multicast broadcasts of data over a network, comprising:

receiving an encryption key by a broadcasting processing system that is transmitting a multicast broadcast of data, wherein said encryption key is used to encrypt said data of said multicast broadcast; and

providing said encryption key to each of a plurality of receiving processing systems connected to said network receiving said multicast broadcast, wherein said encryption key is used by each of said plurality of receiving processing systems to decrypt said data of said multicast broadcast;

wherein said step of providing said encryption key to each of said plurality of receiving processing systems comprises;

generating a broadcast advertisement message in said broadcasting processing system;

transmitting said broadcast advertisement message from said broadcasting processing system to at least one said plurality of receiving processing systems;

receiving a response message including a response to said broadcast advertisement message from at least one of said plurality of receiving processing systems, each response message indicating that the corresponding one of said plurality of receiving processing systems is to receive said multicast broadcast;

providing said encryption key to said at least one of said plurality of receiving processing systems responsive to said response message.

2. The method of claim 1, wherein said broadcast advertisement message indicates said multicast broadcast is a secure transmission.

3. The method of claim 1, further comprising:

inserting a network address of a security server processing system into a secure field in said broadcast advertisement message.

4. The method of claim 1, further comprising:

inserting a network address of a domain including a security server processing system into said broadcast advertisement message.

5. The method of claim 1, wherein providing said encryption key further comprises:

transmitting said encryption key from said broadcasting processing system to said one of said plurality of receiving processing systems responsive to receiving said response message in said broadcasting processing system.

6. The method of claim 1, wherein receiving said response message comprises:

receiving said response message by a security server processing system.

7. The method of claim 6, wherein providing said encryption key further comprises:

transmitting said encryption key from said security server processing system to said one of said plurality of receiving processing systems.

8. The method of claim 1, wherein said step of transmitting said broadcast advertisement message comprises:

determining said multicast broadcast is a secure transmission;

generating a query message, wherein said query message indicates said multicast broadcast is secure;

transmitting said query message to said at least one of said plurality of receiving processing systems;

receiving said response message from said one of said plurality of receiving processing systems responsive to said query message; and

transmitting said encryption key to said one of said plurality of receiving processing systems responsive to receiving said response message.

9. The method of claim 1, wherein said response message includes security information for said one of said plurality of receiving processing systems.

10. The method of claim 1, wherein providing said encryption key comprises:

obtaining security information for said one of said plurality of receiving processing systems from said response message;

encrypting said encryption key with said security information for said one of said plurality receiving processing systems; and

transmitting said encrypted encryption key to said one of said receiving processing systems.

11. The method of claim 1, further comprising:

transmitting an identification of said one of said plurality of receiving processing systems.

12. The method of claim 1, further comprising:

updating records of a group for said multicast broadcast responsive to receiving an identification of said one of said plurality of receiving processing systems.

13. The method of claim 1, further comprising:

determining whether said encryption key for said multicast broadcast is stored in a memory; and

transmitting a request for said encryption key responsive to a determination that said encryption key is not stored in said memory.

14. The method of claim 13, wherein transmitting a request includes transmitting said request to a security server processing system, the method further comprising:

receiving said encryption key from said security server processing system.

15. A system for providing multicast broadcasts of data over a network, comprising:

a security server processing system configured to provide an encryption key to a broadcasting processing system transmitting a multicast broadcast of data, wherein said encryption key is used to encrypt said data of said multicast broadcast, wherein said security server processing system includes a processor and a memory, and wherein said broadcasting processing system includes a processor and a memory;

said security server processing system configured to provide said encryption key to each of a plurality of receiving processing systems connected to said network receiving said multicast broadcast, wherein said encryption key is used by each of said plurality of receiving processing systems to decrypt said data of said multicast broadcast;

said broadcasting processing system configured to generate a broadcast advertisement message and transmit said broadcast advertisement message to said plurality of receiving processing systems prior to said multi-cast broadcast, said broadcast advertisement message identifying said security server processing system in order to enable said plurality of receiving processing systems to request said encryption key from said security server processing system.

16. The system of claim 15, further comprising:

said broadcasting processing system configured to determine whether said multicast broadcast is a secure broadcast.

17. The system of claim 16, further comprising:

said broadcasting processing system configured to transmit a request to said security server processing system for said encryption key responsive to a determination that said multicast broadcast is secure; and

said broadcasting processing system configured to receive said encryption key from said security server processing system responsive to transmitting said request from said broadcasting processing system.

18. The system of claim 17, further comprising:

said broadcasting processing system configured to establish a secure communication between said broadcasting processing system and said security server processing system.

19. The system of claim 18, further comprising:

said security server processing system configured to transmit said encryption key from said security server processing system to said broadcasting processing system over said secure communication.

20. The system of claim 19, further comprising:

said security server processing system configured to assign said encryption key to said multicast broadcast responsive to receiving said request.

21. The system of claim 20, further comprising:

said security server processing system configured to store a record of said encryption key assigned to said multicast broadcast responsive to assigning said encryption key to said multicast broadcast.

22. The system of claim 15, further comprising:

said plurality processing systems configured to generate and transmit a response message to said broadcast advertisement message.

23. The system of claim 22, said plurality of receiving processing systems configured to transmit said response message to said security server processing system.

24. The system of claim 23, further comprising:

said security server processing system configured to transmit said encryption key to said plurality of receiving processing systems.

25. The system of claim 22, further comprising

a router processing system connected to at least one of said plurality of receiving processing systems configured to receive said advertisement message;

said router processing system configured to read said advertisement message;

said router processing system configured to determine said multicast broadcast is a secure transmission responsive to reading said advertisement message;

said router processing system configured to generate a query message, wherein said query message indicates said multicast broadcast is secure;

said router processing system configured to transmit said query message to said at least one of said plurality of receiving processing systems connected to said router processing system;

said router processing system configured to receive said response message from said one of said plurality of receiving processing systems responsive to said query message; and

said router processing system configured to transmit said encryption key to said one of said plurality of receiving processing systems responsive to receiving said response message.

26. The system of claim 25, said one of said plurality of receiving processing systems configured to retrieve security information for said one of said plurality of receiving processing systems;

and

said one of said plurality of receiving processing systems configured to insert said security information into said response message.

27. The system of claim 26, wherein said one of said plurality of receiving processing systems is configured to:

receive a user identification from a user;

retrieve a user secret key for said user;

retrieve a network address of said one of said plurality of receiving processing systems;

generate a random number;

concatenate said user identification, said network address, said user secret key, and said random number; and

hash a result of said concatenating to determine said security information.

28. The system of claim 25, further comprising:

said router processing system configured to receive said response message; and

said router processing system configured to transmit said encryption key to said one of said plurality of receiving processing systems.

29. The system of claim 28, said router processing system configured to read security information for said one of said plurality of receiving processing systems from said response message;

said router processing system configured to encrypt said encryption key with said security information for said one of said plurality receiving processing systems; and

said router processing system configured to transmit said encrypted encryption key to said one of said receiving processing systems.

30. The system of claim 28, said router processing system configured to transmit an identification of said one of said plurality of receiving processing systems to said security server processing system.

31. The system of claim 28, further comprising:

said router processing system configured to determine whether said router processing system has said encryption key for said multicast broadcast stored in a memory; and

said router processing system configured to transmit a request for said encryption to said security server processing system responsive to a determination that said encryption key is not stored in said memory.

32. The system of claim 15, said broadcasting processing system configured to insert a flag into a secure field in said advertisement message indicating said multicast broadcast is a secure transmission.

33. The system of claim 15, said broadcasting processing system configured to insert a network address of said security server processing system into a secure field in said advertisement message.

34. The system of claim 15, said broadcasting processing system configured to insert a network address of a domain including said security server processing system into said advertisement message.

35. The system of claim 15, said security server configured to update records of a group for said multicast broadcast responsive to receiving an identification of one of said plurality of receiving processing systems.

36. The system of claim 15, said security server processing system configured to receive a request for said encryption key;

and

said security server processing system configured to transmit said encryption key in response to said request.

37. A system for providing multicast broadcasts of data over a network, comprising:

a security server processing system configured to provide an encryption key to a broadcasting processing system transmitting a multicast broadcast of data, wherein said encryption key is used to encrypt said data of said multicast broadcast, wherein said security server processing system includes a processor and a memory, and wherein said broadcasting processing system includes a processor and a memory;

said broadcast processing system configured to provide said encryption key to each of a plurality of receiving processing systems connected to said network receiving said multicast broadcast, wherein said encryption key is used by each of said plurality of receiving processing systems to decrypt said data of said multicast broadcast;

said broadcasting processing system configured to generate a broadcast advertisement message and transmit said broadcast advertisement message to said plurality of receiving processing systems prior to said multi-cast broadcast in order to identify said plurality of receiving processing systems that are to receive said encryption key.

38. The system of claim 37, further comprising:

said broadcasting processing system configured to transmit said encryption key to one of said plurality of receiving processing systems responsive to receiving a response message from said one of said plurality of receiving processing systems.

39. An apparatus for providing multicast broadcasts of data over a network, comprising:

means for providing an encryption key from a security server means to a broadcasting processing means transmitting a multicast broadcast of data, wherein said encryption key is used to encrypt said data of said multicast broadcast; and

said security server means for providing said encryption key to each of a plurality of receiving processing systems connected to said network receiving said multicast broadcast, wherein said encryption key is used by each of said plurality of receiving processing systems to decrypt said data of said multicast broadcast;

said broadcasting processing means for generating a broadcast advertisement message and transmitting said broadcast advertisement message to said plurality of receiving processing systems prior to said multicast broadcast, said broadcast advertisement message identifying said security server means in order to enable said plurality of receiving processing systems to request said encryption key from said security server means.

40. The apparatus of claim 39, further comprising:

means for determining said multicast broadcast is a secure broadcast in said broadcasting processing means.

41. The apparatus of claim 39, further comprising:

means for transmitting a request in said broadcasting processing means to said security server means for said encryption key responsive to a determination that said multicast broadcast is secure; and

means for receiving said encryption key from said security server means in said broadcasting processing means responsive to transmitting said request from said broadcasting processing system.

42. The apparatus of claim 41, further comprising:

means for establishing a secure communication between said broadcasting processing means and said security server means.

43. The apparatus of claim 42, further comprising:

means for transmitting said encryption key from said security server means to said broadcasting processing means over said secure communication.

44. The apparatus of claim 43, further comprising:

means for assigning said encryption key to said multicast broadcast in said security server processing means responsive to receiving said request.

45. The apparatus of claim 44, further comprising:

means for storing a record of said encryption key assigned to said multicast broadcast responsive to assigning said encryption key to said multicast broadcast.

46. The apparatus of claim 39, further comprising:

means for inserting a network address of said security server processing system into a secure field in said advertisement message.

47. The apparatus of claim 39, further comprising:

means for inserting a network address of a domain including said security server processing system into said advertisement message.

48. The apparatus of claim 39, wherein said means for transmitting said response message comprises:

means for transmitting a response message from said one of said plurality of receiving processing means to said security server means.

49. The apparatus of claim 48, further comprising:

means for transmitting said encryption key from said security server means to said one of said plurality of receiving processing means.

50. The apparatus of claim 39, further comprising:

means for receiving a request for said encryption key in said security server means; and

means for transmitting said encryption key from said security server means in response to said request.

51. An apparatus for providing multicast broadcasts of data over a network, comprising:

a security server processing means for providing an encryption key to a broadcasting processing system means configured for transmitting a multicast broadcast of data, wherein said encryption key is used to encrypt said data of said multicast broadcast;

said broadcast processing system means configured to provide said encryption key to each of a plurality of receiving processing systems connected to said network receiving said multicast broadcast, wherein said encryption key is used by each of said plurality of receiving processing systems to decrypt said data of said multicast broadcast;

said broadcasting processing system means being further configured to generate a broadcast advertisement message and transmit said broadcast advertisement message to said plurality of receiving processing systems prior to said multi-cast broadcast in order to identify said plurality of receiving processing systems that are to receive said encryption key.

52. The apparatus of claim 51, further comprising:

means for inserting a flag into a secure field in said advertisement message indicating said multicast broadcast is a secure transmission.

53. The apparatus of claim 51, further comprising:

means for generating a response message to said broadcast advertisement message in one of said plurality processing means;

means for transmitting said response message from said one of said plurality of receiving processing means; and

means for receiving said encryption key in said one of said plurality of receiving processing means responsive to transmitting said response message.

54. The apparatus of claim 53, further comprising:

means for transmitting said encryption key in said broadcasting processing means to said one of said plurality of receiving processing means responsive to receiving said response message.

55. The apparatus of claim 51, wherein said means for transmitting said advertisement message comprises:

means for receiving said advertisement message from said broadcasting processing means in a router means connected to at least one of said plurality of receiving processing means;

means for reading said advertisement message in said router means;

means for determining said multicast broadcast is a secure transmission in said router means responsive to reading said advertisement message;

means in said router processing system for generating a query message wherein said query message indicates said multicast broadcast is secure;

means in said router processing system for transmitting said query message to said at least one of said plurality of receiving processing systems connected to said router processing system;

means for receiving said response message from said one of said plurality of receiving processing means in said router processing means responsive to said query message; and

means for transmitting said encryption key in said router processing means to said one of said plurality of receiving processing means responsive to receiving said response message.

56. The apparatus of claim 55, wherein said means for generating said response message in said one of said plurality of receiving processing means comprises:

means in said one of said plurality of receiving processing means configured to retrieve security information for said one of said plurality of receiving processing systems; and

means for inserting said security information into said response message in said one of said plurality of receiving processing means.

57. The apparatus of claim 55, wherein said means for retrieving said security information comprises:

means for receiving a user identification from a user in said one of said plurality of receiving processing means;

means for retrieving a user secret key for said user in said one of said plurality of receiving processing means;

means in said one of said plurality of receiving processing means for retrieving a network address of said one of said plurality of receiving processing systems;

means for generating a random number in said one of said plurality of receiving processing means;

means for concatenating said user identification, said network address, said user secret key, and said random number added to one in said one of said plurality of receiving processing means; and

means for hashing a result of said concatenating to determine said security information in said one of said plurality of receiving processing means.

58. The apparatus of claim 55, further comprising:

means for receiving said response message in said router processing means; and

means for transmitting said encryption key from said router processing means to said one of said plurality of receiving processing means.

59. The apparatus of claim 58, wherein said means for transmitting said encryption key to said one of said plurality of receiving processing means comprises:

means for reading security information for said one of said plurality of receiving processing means from said response message in said router processing means;

means for encrypting said encryption key with said security information in said router means for said one of said plurality of receiving processing means; and

means for transmitting said encrypted encryption key from said router processing means to said one of said receiving processing means.

60. The apparatus of claim 58, further comprising:

means for transmitting an identification of said one of said plurality of receiving processing systems from said router means to said security server means.

61. The apparatus of claim 58, further comprising:

means for updating records of a group for said multicast broadcast in said security server means responsive to receiving said identification of said one of said plurality of receiving processing systems from said router processing system.

62. The apparatus of claim 58, further comprising:

means for determining whether said router processing system has said encryption key for said multicast broadcast stored in a memory of said router means; and

means for transmitting a request for said encryption key from said router means to said security server means responsive to a determination that said encryption key is not stored in said memory.

63. A computer readable storage medium carrying one or more instructions for providing multicast broadcasts of data over a network, the one more instructions including instructions which executed by one or more processors, cause the one or more processors to perform the method, comprising:

receiving an encryption key by a broadcasting processing system that is transmitting a multicast broadcast of data, wherein said encryption key is used to encrypt said data of said multicast broadcast; and

providing said encryption key to each of a plurality of receiving processing systems connected to said network receiving said multicast broadcast, wherein said encryption key is used by each of said plurality of receiving processing systems to decrypt said data of said multicast broadcast;

wherein said step of providing said encryption key to each of said plurality of receiving processing systems comprises;

generating a broadcast advertisement message in said broadcasting processing system;

transmitting said broadcast advertisement message from said broadcasting processing system to at least one said plurality of receiving processing systems;

receiving a response message including a response to said broadcast advertisement message from at least one of said plurality of receiving processing systems, each response message indicating that the corresponding one of said plurality of receiving processing systems is to receive said multicast broadcast;

providing said encryption key to said at least one of said plurality of receiving processing systems responsive to said response message.

64. The computer readable storage medium of claim 63, the method further comprising:

determining said multicast broadcast is a secure broadcast in said broadcasting processing system.

65. The computer readable storage medium of claim 64, further comprising:

transmitting a request to a security server processing system for said encryption key responsive to a determination that said multicast broadcast is secure; and

receiving said encryption key from said security server processing system in said broadcasting processing system responsive to transmitting said request from said broadcasting processing system.

66. The computer readable storage medium of claim 65, wherein said method further comprises:

establishing a secure communication between said broadcasting processing system and said security server processing system.

67. The computer readable storage medium of claim 66, wherein said method further comprises:

transmitting said encryption key from said security server processing system to said broadcasting processing system over said secure communication.

68. The computer readable storage medium of claim 65, wherein said method further comprises:

assigning said encryption key to said multicast broadcast in said security server processing system responsive to receiving said request.

69. The computer readable storage medium of claim 68, wherein said method further comprises:

storing a record of said encryption key assigned to said multicast broadcast responsive to assigning said encryption key to said multicast broadcast.

70. The computer readable storage medium of claim 63, wherein said step of providing said encryption key comprises:

receiving said broadcast advertisement message by one of said plurality of receiving processing systems;

generating a response message by said one of said plurality of receiving processing systems, said response message including a response to said broadcast advertisement message;

transmitting said response message from said one of said plurality of receiving processing systems; and

receiving said encryption key by said one of said plurality of receiving processing systems responsive to transmitting said response message.

71. The computer readable storage medium of claim 70, wherein said step of transmitting said response message of said method comprises:

transmitting said response message from said one of said plurality of said receiving processing systems to said broadcasting system.

72. The computer readable storage medium of claim 71 wherein said method further comprises:

transmitting said encryption key from said broadcasting processing system to said one of said plurality of receiving processing systems responsive to receiving said response message in said broadcasting processing system.

73. The computer readable storage medium of claim 70, wherein said step of transmitting said advertisement message of said method comprises:

receiving said advertisement message in a routing processing system connected to at least one of said plurality of receiving processing systems;

reading advertisement message in said router processing system;

determining said multicast broadcast is a secure transmission in said routing processing system responsive to reading said advertisement message;

generating a query message in said router processing system wherein said query message indicates said multicast broadcast is secure;

transmitting said query message from said router processing system to said at least one of said plurality of receiving processing systems connected to said router processing system;

receiving said response message from said one of said plurality of receiving processing systems to said router processing systems responsive to said query message; and

transmitting said encryption key from said router processing system to said one of said plurality of receiving processing systems responsive to receiving said response message.

74. The computer readable storage medium of claim 73, wherein said step of retrieving said security information of said method comprises:

receiving a user identification from a user in said one of said plurality of receiving processing systems;

retrieving a user secret key for said user in said one of said plurality of receiving processing systems;

retrieving a network address of said one of said plurality of receiving processing systems in said one of said plurality of receiving processing systems;

generating a random number in said one of said plurality of receiving processing systems;

concatenating said user identification, said network address, said user secret key, and said random number added to one in said one of said plurality of receiving processing systems; and

hashing a result of said concatenating to determine said security information.

75. The computer readable storage medium of claim 73, wherein said method further comprises:

receiving said response message in said router processing system; and

transmitting said encryption key from said router processing system to said one of said plurality of receiving processing systems.

76. The computer readable storage medium of claim 75, wherein said step transmitting said encryption key from said server processing system to said one of said plurality of receiving processing systems of said method comprises:

reading security information for said one of said plurality of receiving processing systems from said response message in said router processing system;

encrypting said encryption key in said router processing system with said security information for said one of said plurality receiving processing systems; and

transmitting said encrypted encryption key from said router processing system to said one of said receiving processing systems.

77. The computer readable storage medium of claim 75, wherein said method further comprises:

transmitting an identification of said one of said plurality of receiving processing systems from said router processing to said security server processing system.

78. The computer readable storage medium of claim 77, wherein said method further comprises:

updating records of a group for said multicast broadcast responsive to receiving said identification of said one of said plurality of receiving processing systems from said router processing system.

79. The computer readable storage medium of claim 77, wherein said method further comprises:

determining whether said router processing system has said encryption key for said multicast broadcast stored in a memory; and

transmitting a request for said encryption key from said router processing system to said security server processing system responsive to a determination that said encryption key is not stored in said memory.

80. The computer readable storage medium of claim 79, wherein said method further comprises:

receiving said request for said encryption key in said security server processing system; and

transmitting said encryption key from said security server processing system to said router processing system.

81. The computer readable storage medium of claim 80, wherein said step of transmitting said encryption key from said security server processing system to said router processing system of said method comprises:

establishing a secure communication between said router processing system and said security server processing system to transmit said encryption key.

82. The computer readable storage medium of claim 70, further comprising:

retrieving security information for said one of said plurality of receiving processing systems; and

inserting said security information into said response message.

83. The computer readable storage medium of claim 63, further comprising:

inserting a flag into a secure field in said advertisement message indicating said multicast broadcast is a secure transmission.

84. The computer readable storage medium of claim 63, wherein said step of generating said response message of said method comprises:

inserting a network address of a security server processing system from which said encryption key is to be obtained into a secure field in said advertisement message.

85. The computer readable storage medium of claim 63, further comprising:

inserting a network address of a domain including a security server processing system from which said encryption key is to be obtained into said advertisement message.

86. The computer readable storage medium of claim 63, wherein said step of transmitting said response message of said method comprises:

transmitting said response message from said one of said plurality of receiving processing systems to a security server processing system from which said encryption key is to be obtained.

87. The computer readable storage medium of claim 86, wherein said method further comprises:

transmitting said encryption key from said security server processing system to said one of said plurality of receiving processing systems.

88. A system for providing secure multi-cast broadcast, comprising:

a security server processing system that provides an encryption key, wherein said security server processing system includes a processor and a memory;

a broadcasting processing system that receives said encryption key from said security server processing system transmitted over a network, encrypts data for a multi-cast broadcast with said encryption key and transmits encrypted data of said multi-cast broadcast over said network, wherein said broadcasting processing system includes a processor and a memory; and

at least one receiving processing system that receives said encryption key from said security processing system over said network, receives said encrypted data from said broadcasting processing system over said network, and decrypts said encrypted data;

wherein said broadcasting processing system transmits a multi-cast advertisement message prior to said multi-cast broadcast, the multi-cast advertisement message identifying said security processing system in order to enable said at least one receiving processing system to obtain said encryption key in order to decrypt said encrypted data of said multi-cast broadcast.

89. The system of claim 88, further comprising:

an intermediate router processing system connecting said at least one receiving processing system to said network, wherein said intermediate router processing system receives said multi-cast advertisement, generates a request to join said multi-cast broadcast and transmits said request to said at least one receiving processing system.

90. The system of claim 89, wherein said at least one receiving processing system receives said request, determines whether said at least one receiving processing system is to receive said multi-cast broadcast, generates a response responsive to a determination that said at least one receiving processing system is to receive said multi-cast broadcast and transmitting said response to said intermediate router processing system.

91. The system of claim 90, wherein said intermediate router processing system transmits said encryption key to said at least one receiving processing system responsive to receiving said request.

92. The system of claim 91, wherein said intermediate router processing system determines whether said encryption key is stored in a memory of said intermediate router processing system, transmits a request for said encryption key to said security server processing system in response to a determination that said encryption key is not stored in said memory, and receiving said encryption key from said security server processing system.

93. The system of claim 92, wherein said security server processing system receives said request from said intermediate router processing system and transmits said encryption key to said intermediate router processing system responsive to receiving said request.

94. The system of claim 93, wherein said intermediate processor system and said security server processing system establish a secure connection over which to transmit said encryption key.

95. The system of claim 91, wherein said intermediate processing system transmits identification of said at least one receiving processing system to said security server responsive to receiving said request.

96. The system of claim 95, wherein said security server processing system stores said identification information in a record for said multi-cast broadcast.

97. An apparatus for providing secure multi-cast broadcast comprising:

a security server means including means for providing an encryption key;

a broadcasting means including;

means for receiving said encryption key from said security server means transmitted over a network,

means for encrypting data for a multi-cast broadcast with said encryption key, and

means for transmitting encrypted data of said multi-cast broadcast over said network; and

at least one receiving means comprising;

means for receiving said encryption key from said security server means over said network,

means for receiving said encrypted data from said broadcasting means over said network, and

means for decrypting said encrypted data; and

means for transmitting a multi-cast advertisement message prior to said multi-cast broadcast, the multi-cast advertisement message identifying said security server means in order to enable said at least one receiving means to obtain said encryption key in order to decrypt said encrypted data of said multi-cast broadcast.

98. The apparatus of claim 97, further comprising:

an intermediate router means connecting said at least one receiving means to said network wherein said intermediate router means includes;

means for receiving said multi-cast advertisement,

means for generating a request to join said multi-cast broadcast, and

means for transmitting said request to said at least one receiving means.

99. The apparatus of claim 98, wherein said at least one receiving means further includes:

means for receiving said request;

means for determining whether said at least one receiving means is to receive said multi-cast broadcast;

means for generating a response responsive to a determination that said at least one receiving means is to receive said multi-cast broadcast; and

means for transmitting said response to said intermediate router means.

100. The apparatus of claim 99, wherein said intermediate router means further includes:

means for transmitting said encryption key to said at least one receiving means responsive to receiving said request.

101. The apparatus of claim 100, wherein said intermediate router means further comprises:

means for determining whether said encryption key is stored in a memory of said intermediate router means;

means for transmitting a request for said encryption key to said security server means in response to a determination that said encryption key is not stored in said memory; and

means for receiving said encryption key from said security server means.

102. The apparatus of claim 101, wherein said security server means further comprises:

means for receiving said request from said intermediate router means; and

means for transmitting said encryption key to said intermediate router means responsive to receiving said request.

103. The apparatus of claim 102 wherein said intermediate processor means and said security server means comprise:

means for establishing a secure connection over which to transmit said encryption key.

104. The apparatus of claim 100, wherein said intermediate router means comprises:

means for transmitting identification of said at least one receiving means to said security server responsive to receiving said request.

105. The apparatus of claim 104, wherein said security server means includes:

means for storing said identification information in a record for said multi-cast broadcast.

106. A method for providing secure multi-cast broadcasts comprising:

receiving an encryption key from a security server processing system;

transmitted over a network in a broadcasting processing system;

encrypting data for a multi-cast broadcast with said encryption key in said broadcasting processing system;

transmitting encrypted data of said multi-cast broadcast over said network from said broadcasting processing system to at least one receiving processing system;

receiving said encryption key from said security server processing system over said network in at least one receiving processing system;

receiving said encrypted data from said broadcasting processing system in said at least one receiving processing system over said network; and

decrypting said encrypted data with said encryption key in said at least one receiving processing system; and

transmitting a multi-cast advertisement message from said broadcasting processing system prior to said multi-cast broadcast, said multi-cast advertisement message soliciting a response message from said at least one receiving processing system in order to identify said at least one receiving processing system to receive said encryption key.

107. The method of claim 106, further comprising:

receiving said multi-cast advertisement in an intermediate router processing system;

generating a request to join said multi-cast broadcast in said intermediate router processing system; and

transmitting said request from said intermediate router processing system to said at least one receiving processing system.

108. The method of claim 107, further comprising:

receiving said request in said at least one receiving processing system;

determining whether said at least one receiving processing system is to receive said multi-cast broadcast;

generating a response responsive to a determination that said at least one receiving processing system is to receive said multi-cast broadcast; and

transmitting said response from said at least one receiving processing system to said intermediate router processing system.

109. The method of claim 108, further comprising:

transmitting said encryption key from said intermediate router processing system to said at least one receiving processing system responsive to receiving said request.

110. The method of claim 109, further comprising:

determining whether said encryption key is stored in a memory of said intermediate router processing system;

transmitting a request for said encryption key from said intermediate router processing system to said security server processing system in response to a determination that said encryption key is not stored in said memory; and

receiving said encryption key in said intermediate router processing system from said security server processing system.

111. The method of claim 110, further comprising:

receiving said request from said intermediate router processing system in said security server processing system; and

transmitting said encryption key from said security server processing system to said intermediate router processing system responsive to receiving said request.

112. The method of claim 111, further comprising:

establishing a secure connection between said intermediate router processing system and said security server processing system over which to transmit said encryption key.

113. The method of claim 111, further comprising:

transmitting identification of said at least one receiving processing system from said intermediate router processing system to said security server processing system responsive to receiving said request.

114. The method of claim 113, further comprising:

storing said identification information for said multi-cast broadcast in a record in a memory of said security server processing system.

115. A system for providing secure multi-cast broadcast, comprising:

a security server processing system that provides an encryption key;

a broadcasting processing system that receives said encryption key from said security server processing system transmitted over a network, encrypts data for a multi-cast broadcast with said encryption key and transmits encrypted data of said multi-cast broadcast over said network, wherein said security server processing system includes a processor and a memory, and wherein said broadcasting processing system includes a processor and a memory; and

at least one receiving processing system that receives said encryption key from said security processing system over said network, receives said encrypted data from said broadcasting processing system over said network, and decrypts said encrypted data;

wherein said broadcasting processing system transmits a multi-cast advertisement message prior to said multi-cast broadcast, said multi-cast advertisement message soliciting a response message from said at least one receiving processing system in order to identify said at least one receiving processing system to receive said encryption key.