M-CLIQUES: Modified CLIQUES key agreement for secure multicast

Abstract

In secure multicast applications, members may join or leave frequently and key management is one of the most challenging problems. In this research, we proposed a modified CLIQUES key management protocol. It was the modification of CLIQUES that consisted of two stages: Static CLIQUES and Hierarchical CLIQUES. In Static CLIQUES, a static group controller was used to distribute the partial keys to group members. Compared with traditional CLIQUES, the Static CLIQUES was more secure for key storage, less complex, less processing requirement in the user machine, and easier to provide member privacy protection. In Hierarchical CLIQUES, a hierarchical structure was employed to support larger size of group members. Our experiments showed that the modified CLIQUES protocol was more scalable than CLIQUES. Also, it required less processing power than the Key Tree-Based approaches.

Introduction

As a result of increasing multicast applications, data confidentiality becomes a challenging problem in secured multicast. In order to achieve data confidentiality, a shared secret key, refer to a group key, must be distributed to every member in the group. Since members may join or leave frequently, the group key must also be changed frequently to achieve forward and backward secrecy. Consequently, Key management mechanism is required to manage group key renewal and storage. A practical and scalable key management requires high security features, efficient key distribution, low key storage cost, and small processing overhead. Several key management mechanisms have been proposed in the literature. CLIQUES (Steiner et al., 2000, Just and Vaudenay, 1996, Burmester and Desmedt, 1995, Ateniese et al., 2000, Chan and Chan, 2003) is a scheme that uses the contributory key agreement approach. It extends the two-party DH algorithm (Diffie and Hellman, 1976) to allow a group of members to “agree” upon a symmetric group key thus imposes less decryption overhead in the user machine. CLIQUES has lower cost in establishing control manager. The main drawback of CLIQUES is that a large number of re-key messages have to be exchanged among members when there is a membership change. The number of messages exchanged is proportional to the size of the membership. Consequently, CLIQUES is not very scalable. In Key Tree-Based Approach (Wallner et al., 1999, Wong et al., 2000, Canetti et al., 1999, Chang et al., 1999, Balenson et al., 1999), a tree is used to divide members into subgroups so as to reduce the number of re-key messages, thus, support a large group of members. However, since it only supports asymmetric group key, higher processing power is required in the user machine. Secure Multicast Framework (Mittra, 1997, Hardjono et al., 1998, Hardjono et al., 1999, Waldvogel et al., 1999) is another key management system for multicast. It is good for wide-area multicast group because it breaks the group into smaller subgroups. However, it introduces packet delay. It is not working very well in real-time multicast systems, especially when the group is very large.

In this paper, we propose a scalable key management mechanism M-CLIQUES, which is also relatively simpler to implement. The proposed scheme is a modification of CLIQUES that consists of two stages. In stage 1, Static CLIQUES is introduced, in which a static group controller (GC) is used to distribute partial keys. In stage 2, we propose Hierarchical CLIQUES, which employs a hierarchical structure, to make the key management mechanism more scalable.

The rest of the paper is organized as follows. Sections 2 Static CLIQUES, 3 Hierarchical CLIQUES describe Static CLIQUES and Hierarchical CLIQUES, respectively. In Section 4, we lay out several security considerations of the mechanism. Section 5 compares the proposed schemes with CLIQUES and the Key Tree-Based approach. Section 6 concludes the paper.