Abstract — Group communication systems are high-availability distributed systems providing reliable and ordered message delivery as well as a membership service, to group-oriented applications. Many such systems are built using a distributed client-server architecture where a relatively small set of servers provide service to numerous clients. In this work, we show how group communication systems can be enhanced with security services without sacrificing robustness and performance. More specifically, we propose several integrated security architectures for distributed client-server group communication systems. In an integrated architecture, security services are implemented in servers, in contrast to a layered architecture where the same services are implemented in clients. We discuss performance and accompanying trust issues of each proposed architecture and present experimental results that demonstrate the superior scalability of an integrated architecture.

Group key exchange protocols allow a group of servers communicating over an asynchronous network of point-to-point links to establish a common key, such that an adversary which fully controls the network links (but not the group members) cannot learn the key. Currently known group key exchange protocols rely on the assumption that all group members participate in the protocol and if a single server crashes, then no server may terminate the protocol. In this paper, we propose the first purely asynchronous group key exchange protocol that tolerates a minority of servers to crash. Our solution uses a constant number of rounds, which makes it suitable for use in practice. Furthermore, we also investigate how to provide forward secrecy with respect to an adversary that may break into some servers and observe their internal state. We show that any group key exchange protocol among n servers that tolerates tc > 0 servers to crash can only provide forward secrecy if the adversary breaks into less than n 2tc servers, and propose a group key exchange protocol that achieves this bound.

Abstract—We consider several distributed collaborative key agreement and authentication protocols for dynamic peer groups. There are several important characteristics which make this problem different from traditional secure group communication. They are: 1) distributed nature in which there is no centralized key server; 2) collaborative nature in which the group key is contributory (i.e., each group member will collaboratively contribute its part to the global group key); and 3) dynamic nature in which existing members may leave the group while new members may join. Instead of performing individual rekeying operations, i.e., recomputing the group key after every join or leave request, we discuss an interval-based approach of rekeying. We consider three interval-based distributed rekeying algorithms, or interval-based algorithms for short, for updating the group key: 1) the Rebuild algorithm; 2) the Batch algorithm; and 3) the Queue-batch algorithm. Performance of these three interval-based algorithms under different settings, such as different join and leave probabilities, is analyzed. We show that the interval-based algorithms significantly outperform the individual rekeying approach and that the Queue-batch algorithm performs the best among the three interval-based algorithms. More importantly, the Queue-batch algorithm can substantially reduce the computation and communication workload in a highly dynamic environment. We further enhance the interval-based algorithms in two aspects: authentication and implementation. Authentication focuses on the security improvement, while implementation realizes the interval-based algorithms in real network settings. Our work provides a fundamental understanding about establishing a group key via a distributed and collaborative approach for a dynamic peer group. Index Terms—Authentication, dynamic peer groups, group key agreement, rekeying, secure group communication, security. I.

In group communication, users often have different access rights to multiple data streams. Based on the access relation of users and data streams, users can form partially ordered relations, and data streams can form partially ordered relations. In this paper, we propose a key management scheme for hierarchical access control, which considers both partially ordered user relations and partially ordered data stream relations. We also propose an algorithm for constructing a logical key graph, which is suitable even when users and data streams have complex relations. Simulation results show that our scheme can significantly improve the efficiency of key management.

We propose and analyze a scalable and efficient region-based group key management protocol for secure group communications in mobile ad hoc networks. For scalability and dynamic reconfigurability, we take a region-based approach by which group members are broken into region-based subgroups and leaders in subgroups securely communicate with each other to agree on a group key in response to membership change and member mobility events. We show that the secrecy requirement for group communication is satisfied. Further, there exists an optimal regional size that minimizes the total network communication cost as a result of efficiently trading inter-regional vs. intraregional group key management overheads. We give an analytical expression of the cost involved which allows the optimal regional size to be identified, when given a set of parameter values characterizing a group communicating system in mobile ad hoc networks. 1

seguti,nalini ¡

In this paper we analyze the requirements access control mechanisms must fulfill in the context of group communication and define a framework for supporting fine-grained access control in client-server group communication systems. Our framework combines rolebased access control mechanisms with environment parameters (time, IP address, etc.) to provide support for a wide range of applications with very different requirements. While the access control policy is defined by the application, its efficient enforcement is performed by the group communication system. 1

Authenticated key exchange protocols allow two participants A and B, communicating over a public network and each holding an authentication means, to exchange a shared secret value. Methods designed to deal with this cryptographic problem ensure A (resp. B) that no other participants aside from B (resp. A) can learn any information about the agreed value, and often also ensure A and B that their respective partner has actually computed this value. A natural extension to this cryptographic method is to consider a pool of participants exchanging a shared secret value and to provide a formal treatment for it. Starting from the famous 2-party Diffie-Hellman (DH) key exchange protocol, and from its authenticated variants, security experts have extended it to the multi-party setting for over a decade and completed a formal analysis in the framework of modern cryptography in the past few years. The present paper synthesizes this body of work on the provably-secure authenticated group DH key exchange.

Existing collaboration systems have a fundamental limitation: they assume that collaborative groups consist of only of individuals known personally by someone with the authority to add to the group membership. The OC (Open Collaboration) research prototype presented in this paper addresses this problem by introducing trust negotiation into collaboration systems. Our approach separates the profiles used by groups and individuals in order to let entities control their privacy. We extend the family of RT languages to specify the requirements of assigning a role and describe how to create and maintain a collaboration. In addition, we design two modes for disseminating group profiles and classify three kinds of identities according to their sensitivity. 1

Group communication is exploding in Internet applications such as video conferences, online chatting programs, games, and gambling. Since most group communication takes place over the Internet that is a wide open network, security plays a major role. For a secure communication, the integrity of messages, member authentication, and confidentiality must be provided among group members. To maintain message integrity, all group members use a Group Key (GK) for encrypting and decrypting messages during group communication. Secure and efficient group key managements have been developed to generate a GK efficiently. Tree-based Group Diffie-Hellman (TGDH) is an efficient group key agreement protocol to generate the GK. TGDH and other group key generation protocols assume that all members have an equal computing power. However, one of the characteristics of a distributed computing environment is heterogeneity; the member can be at a workstation, a laptop, or even a mobile computer. TGDH and other group key generation protocols assume all members have an equal computing power. However, one of the characteristics of distributed computing is heterogeneity. Therefore, this research considers member’s diversity and proposes enhanced group key generation protocol with filtering out low performance members in group key generating processes to improve the efficiency of GK processes.