Tree-based Multicast Key Management in ubiquitous computing environment

Security problems in satellite environments are one of the obstacles to the widespread deployment of satellite IP multicast and, more generally, of satellite multimedia applications (Cruickshank et al., 1998). By satellite environments we refer to networks where the satellite plays an essential role. e.g. those where it is used to multicast IP packets to many nodes of a terrestrial network. We also speak of ”Hybrid Satellite/Terrestrial networks” in such cases. The broadcast nature of satellites makes eavesdropping and active intrusion much easier than in terrestrial ルxed or mobile networks. A further issue is speciルc to multicast: the number of members in a multicast group can be very large and, even worse, can change very dynamically. While the process of performing and securing key management for unicast connections is well understood (Harkins & Carrel, 1998), (Maughan et al., 1998), (Orman, 1998), multicast security is still an open ルeld (see par. 2). Protocols that manage the process of distributing keys in a multicast environment are under development (see par. 2.3 and 2.4). Access to the encryption key is controlled by a group key management system, which is responsible for sending the encryption key to authorized new users and for performing multicast group rekeying whenever the key changes. Speciルcally, a group key management system is said to implement two types of access control: backward access control and forward access control. If the system changes the encryption key after a new user joins, the new user will not be able to decrypt past group communications; this is called backward access control. Similarly, if the system rekeys after a current user leaves, or is expelled from the system, the departed user will not be able to access future group communications; this is called forward access control. Many group key management solutions (see par. 2.2, (Jokela, 2006) (Mah, 2004)) have been proposed and a number of classiルcations of the available approaches can be found in the current literature (Dondeti et al., 1999), (Rafaeli & Hutchison, 2003), (Eskicioglu, 2003). Moreover, security mechanisms regarding satellite networks have been investigated in (Howarth et al., 2004), (Noubir & Allmen, 1999) and (Arslan & Alagoz, 2006). Group key management protocols can be categorized as following:

Services in MANETs tend to be decentralized in order to share their cost between their subscribers. Security is not an exception and thus shared self-organized security schemes must be provided. Group Key Management (GKM) deals with the responsibility of providing privacy and group authentication in group communications focusing in the dynamism of the group (joins and leaves). We present a shared self-organized GKM protocol targeted to MANETs. Main basis of the presented protocol is to extend GKM protocols based on logical trees of keys towards being non-centralized and self-created.

Secure group communication is an increasingly popular research area having received much attention in recent years. However, most existing approaches construct the group key without caring about the type of the group itself and the environment in which it evolves. This leads to inefficient solutions for real multicast groups. In this paper, we propose a new approach to enhance key management performance. In our solution, we take into consideration group characteristics. We first classify the various group characteristics and point out their influence on the efficiency of key management protocols. We, then, propose two key management protocols, which maintain good performance by adapting the key management process to the type of the group. A comparative study and simulation results evaluate the efficiency of our approach.

: This paper presents a robust, scalable extension to the recently proposed multicast Group Key Management Protocol (GKMP), in terms of security administration. The GKMP has two major security related problems, (a) lack of any mechanism to remove a compromised group administrator, (b) lack of scalability. We are able to remove a compromised single panel member from generating the group keys by setting the panel members with shared authority to generate the group keys. We then introduce the sub-controllers who have all the functionalities of the group control panel except the authority to generate the group keys. The sub-control panel helps scalability of the network in terms of the security operations. The sub-controllers are chosen using a threshold based clustering algorithm.

The wireless body area network (WBAN) is considered as one of the emerging wireless techniques in the healthcare system. Typical WBAN sensors, especially implantable sensors, have limited power capability, which restricts their wide applications in the medical environment. In addition, it is necessary for the healthcare center (HC) to broadcast significant notifications to different patient groups. Considering the above issues, in this paper, the novel practical WBAN system model with group message broadcasting is built. Subsequently, a secure and efficient group key management protocol with cooperative sensor association is proposed. In the proposed protocol, the Chinese remainder theorem (CRT) is employed for group key management between HC and the personal controller (PC), which also supports batch key updating. The proposed sensor association scheme is motivated by coded cooperative data exchange (CCDE). The formal security proofs are presented, indicating that the proposed protocol can achieve the desired security properties. Moreover, performance analysis demonstrates that the proposed protocol is efficient compared with state-of-the-art group key management protocols.

This paper proposes an efficient many-to-many group key management protocol in distributed group communication. In this protocol, group members are managed in the hierarchical manner logically. Two kinds of keys are used, asymmetric and symmetric keys. The leaf nodes in the key tree are the asymmetric keys of the corresponding group members and all the intermediate node keys are symmetric keys assigned to each intermediate node. For asymmetric key, Diffie-Hellman key agreement is introduced. To calculate intermediate node keys, members use codes assigned to each intermediate node key tree. Group members calculate intermediate node keys rather than distributed by a sponsor member. The features of this approach are that, no keys are exchanged between existing members at join, and only one key, the group key, is delivered to remaining members at leave.

The need for secure group communication is increasingly evident in a wide variety of governmental, commercial, and Internet communities. Secure group key management is concerned with the methods of issuing and distributing group keys, and the management of those keys over a period of time. To provide perfect secrecy, a central group key manager (GKM) has to perform group rekeying for every join or leave request. Fast rekeying is crucial to an application's performance that has large group size, experiences frequent joins and leaves, or where the GKM is hosted by a group member. Examples of such applications are interactive military simulation, secure video and audio broadcasting, and secure peer-to-peer networks. Traditionally, the rekeying is performed periodically for the batch of requests accumulated during an inter-rekey period. The use of a logical key hierarchy (LKH) by a GKM has been introduced to provide scalable rekeying. If the GKM maintains a LKH of degree d and height h, such that the group size n ≤ dh, and the batch size is R requests, a rekeying requires the GKM to regenerate O(R × h) keys and to perform O(d × R × h) keys encryptions for the new keys distribution. The LKH approach provided a GKM rekeying cost that scales to the logarithm of the group size, however, the number of encryptions increases with increased LKH degree, LKH height, or the batch size. In this dissertation, we introduce a framework for scalable and efficient secure group key management that outperforms the original LKH approach. The framework has six components as follows. First, we present a software model for providing secure group key management that is independent of the application, the security mechanism, and the communication protocol. Second, we focus on a LKH-based GKM and introduce a secure key distribution technique, in which a rekeying requires the GKM to regenerate O( R × h) keys. Instead of encryption, we propose a novel XOR-based key distribution technique, namely XORBP, which performs an XOR operation between keys, and uses random byte patterns (BPs) to distribute the key material in the rekey message to guard against insider attacks. Our experiments show that the XORBP LKH approach substantially reduces a rekeying computation effort by more than 90%. Third, we propose two novel LKH batch rekeying protocols . The first protocol maintains a balanced LKH (B+-LKH) while the other maintains an unbalanced LKH (S-LKH). If a group experiences frequent leaves, keys are deleted form the LKH and maintaining a balanced LKH becomes crucial to the rekeying's process performance. In our experiments, the use of a B+-LKH by a GKM, compared to a S-LKH, is shown to substantially reduce the number of LKH nodes (i.e., storage), and the number of regenerated keys per a rekeying by more than 50%. Moreover, the B +-LKH performance is shown to be bounded with increased group dynamics. Fourth, we introduce a generalized rekey policy that can be used to provide periodic rekeying as well as other versatile rekeying conditions. Fifth, to support distributed group key management, we identify four distributed group-rekeying protocols between a set of peer rekey agents. Finally, we discuss a group member and a GKM's recovery after a short failure time.

The migration from wired network to wireless network has been a global trend in the past few decades because they provide anytime-anywhere networking services. The wireless networks are rapidly deployed in the future, secure wireless environment will be mandatory. As well, The mobility and scalability brought by wireless network made it possible in many applications. Among all the contemporary wireless networks,Mobile Ad hoc Networks (MANET) is one of the most important and unique applications. MANET is a collection of autonomous nodes or terminals which communicate with each other by forming a multihop radio network and maintaining connectivity in a decentralized manner. Due to the nature of unreliable wireless medium data transfer is a major problem in MANET and it lacks security and reliability of data. The most suitable solution to provide the expected level of security to these services is the provision of a key management protocol. A Key management is vital part of security. This issue is even bigger in wireless network compared to wired network. The distribution of keys in an authenticated manner is a difficult task in MANET. When a member leaves or joins the group, it needs to generate a new key to maintain forward and backward secrecy. In this paper, we propose a new group key management schemes namely a Hierarchical, Simple, Efficient and Scalable Group Key (HSESGK) based on clustering management scheme for MANETs and different other schemes are classified. Group members deduce the group key in a distributed manner.

Group key management in cloud computing has become a trending topic in recent decades. This paper deals with the implementation of clustered structure based on centralized key management. In a centralized key management scheme, the Key Server is responsible for generating user keys and group keys of the cloud. The proposed work consists of a single Central Server and a number of sub-servers and each sub-server can manage multiple different groups. To achieve fault tolerance, each group is replicated into multiple different sub-servers. Users are allocated to a specific group and the size of the group is limited. Each group has a separate group key to avoid internal attacks and they can communicate through a central server. The proposed work encourages intergroup communication and essentially reduces the computations and storage complexity of the central server. Also, we propose to remove the rekeying process upon a new user joining by maintaining a file access list for each file, which will reduce the impact of the security features that even there is a leakage of the group key after the user leaves. Further, this paper proposes a contributory key management scheme where each member of the group is responsible for generating the group key.

Group key management is an integral part of secure multicast.Minimizing the number of rekeying messages, maintaining the forward and backward secrecy has always been a challenging task.Though there are many solutions which reduce the rekeying messages from ( ) to ( ) they increase with the increase in group size.In this paper, we present a centralized key table based communication efficient group key management protocol in which number of rekeying messages is independent of the group size.In this protocol key management server (KMS) divides a group of members into subgroups of size and maintains a table of subkeys along with member ID and one group key.Each member has subkeys, which is a subset of subkeys of KMS and one group key.The proposed protocol requires only one multicast rekeying message per joining of a new member as well as per eviction of any existing member.As the number of rekeying messages is not dependent on group size, it requires less computation.

With the proliferation of Internet of Things (IoT) devices that collect sensitive data, access control is more crucial than ever to safeguard IoT data from unauthorized use. To enforce access control policies without trusted online entity, one promising approach is to maintain a group key shared between a device and its current subscribers, such that the device can encrypt its data and only the subscribers can decrypt it. However, prior group key management (GKM) schemes fail to efficiently address new challenges introduced by the massive scale of IoT devices, dynamic memberships of users, and changes in the number of devices. This paper explores efficient GKM to accommodate multiple devices (in addition to multiple users) and to handle frequent membership and device number changes. Inspired by the observation that devices with similar functionalities often have similar access permissions, we propose a two-tier GKM architecture called GroupIt, in which each device is assigned to one of many predefined groups, and key management is performed within each group as well as between groups to improve efficiency. Despite being conceptually simple, GroupIt addresses technical challenges including: 1) preventing a malicious device from obtaining extra information about other devices in the same group and 2) ensuring forward/backward secrecy and preventing collusion attacks when gluing two existing GKMs together. The probability of a successful collusion attack quickly drops to 0.3% after five membership changes even in a small device group (e.g., 8). This paper provides both theoretical analysis and a proof-of-concept implementation based on Alljoyn, an opensource IoT communication framework to demonstrate the feasibility of GroupIt.

Ancestors protocol for scalable key management

This paper presents a new group key management protocol, CKC (Code for Key Calculation). This protocol is based on logical key hierarchy. When a new member joins the group, server sends only the group key for that member. Then, current members and the new member calculate the necessary keys using node codes and one-way hash function. Node code is a code which is assigned to each node of the key tree. Again at leave, server just sends the new group key to remaining members. By this key, members calculate necessary keys using node codes and one-way hash function. The security of the keys is based on one-wayness of hash function. The results show that CKC reduces computational and communication overhead and message size at join while it keeps minimized the overhead of key update at leave.

In this paper we study group distributed key management schemes for wireless sensor networks. We focus on forward secrecy and backward secrecy which means protecting the group keys used in the past and to be used in the future against an adversary who has gained accesses to the network. Unfortunately, most existing distributed schemes for group key management do not guarantee forward and backward secrecy when a certain number of nodes are compromised or some group keys are leaked. In this paper, we propose a new dynamic distributed group key management scheme based on local collaboration that provides both forward and backward secrecy. Also we prove its robustness against various node capture attacks and compare it with two related schemes both analytically and by simulations to verify its efficiency on storage and communication overhead.

In Internet, IP multicast has been used successfully to provide an efficient, best-effort delivery service for group communication applications.However, applications such as multiparty private conference, distribution of stock market information, pay per view and other subscriber services may require secure multicast to protect integrity and confidentiality of the group traffic, and validate message authenticity.Providing secure multicast for group communication is problematic without a robust group key management.In this paper, we propose a group key management scheme based on the secret sharing technology to require each member by itself to generate the group key when receiving a rekeying message multicast by the group key distributor.The proposed scheme enforces mutual authentication between a member and the group key distributor while executing the rekeying process, and provides forward secrecy and backward secrecy properties, and resists replay attack, impersonating attack, group key disclosing attack and malicious insider attack.