AN EFFICIENT GROUP KEY MANAGEMENT USING CODE FOR KEY CALCULATION FOR SIMULTANEOUS JOIN/LEAVE: CKCS

Transcription

1 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 AN EFFICIENT GROUP KEY MANAGEMENT USING CODE FOR KEY CALCULATION FOR SIMULTANEOUS JOIN/LEAVE: CKCS Melisa Hajyvahabzadeh 1, Elia Eidkhai 1, S. Aahita Mortazavi 1, ad Alireza Nemaey Pour 1 Dept. of IT Egieerig, Sharif Uiversity of Techology, Kish Islad, Ira melisa.vahabzadeh@gmail.com; elia.eidkhai@gmail.com; mortazavi.aahita@gmail.com Dept. of Computer Software Techology Egieerig, Islamic Azad Uiversity of Abhar, Ira pour@abhariau.ac.ir ABSTRACT This paper presets a efficiet group key maagemet protocol, CKCS (Code for Key Calculatio i Simultaeous joi/leave) for simultaeous joi/leave i secure multicast. This protocol is based o logical key hierarchy. I this protocol, whe ew members joi the group simultaeously, server seds oly the group key for those ew members. The, curret members ad ew members calculate the ecessary keys by ode codes ad oe-way hash fuctio. A ode code is a radom umber which is assiged to each key to help users calculate the ecessary keys. Agai, at leave, the server just seds the ew group key to remaiig members. The results show that CKCS reduces computatioal ad commuicatio overhead, ad also message size i simultaeous joi/leave. KEYWORDS Secure Multicast, Group Key Maagemet, Group Security, Simultaeous joi/leave, Code for Key Calculatio, Re-keyig 1. INTRODUCTION IP multicast (hereiafter multicast) is a efficiet group commuicatio protocol to deliver multicast cotet from a sigle source to multiple users. This commuicatio techology uses IGMP (Iteret Group Maagemet Protocol) [1] for group membership that allows members to joi the group ad receive cotet freely. As a result, ope group membership by IGMP leads to eavesdroppig. I order to avoid this threat, group key maagemet has bee proposed. Group key is a key that is shared by all group members ad the seder for ecryptig data by the seder ad decryptig trasmitted data by the group members. The security requiremets of secure multicast are forward secrecy ad backward secrecy []. Forward secrecy esures whe a member leaves the group, he/she caot access successfully the curret cotet. Backward secrecy esures that a ew member caot access ay data which is set before its joi process. Because of these requiremets, group key eeds to be updated o each membership chage ad to be distributed to the valid group members securely. This process is called group re-keyig or re-keyig i short. Two types of group membership, sigle ad simultaeous exist i multicast. Figure 1 illustrates the process of joi/leave i which oly oe member, u +1 jois/leaves the multicast group. I sigle joi/leave, the server is cosidered to reply oly oe user s joi/leave request. However i real world, simultaeous joi/leave occurs more frequetly. Simultaeous joi/leave refers to DOI : /ijcc

2 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 u 1 u u 3... u group members u +1 jois u +1 leaves u 1 u u 3... u u +1 group members Figure 1. Sigle joi/leave Figure. Simultaeous joi/leave multiple requests from differet users to the server at the same time. Figure shows the simultaeous joi/leave operatios which occur cocurretly i a multicast group. I simultaeous joi/leave, the server eeds to respose multiple requests sychroously. As providig forward/backward secrecy is importat i sigle joi/leave, these requiremets are crucial i simultaeous case as well. Re-keyig implies large overhead o each membership chage for dyamic groups. Usually, the overhead at leave is larger tha the overhead at joi. Because whe a ew member jois the group, the ew group key ca be ecrypted by the previous oe ad distributed by multicast to the existig members except the ew member who receives the group key by uicast beig ecrypted by his/her idividual key. But whe a member leaves the group, the group key is ecrypted by each member s idividual key ad is trasmitted by uicast to the remaiig members idividually. I this case, the previous group key is supposed compromised. So, for a group with members, the re-keyig overhead is O(). May protocols have bee proposed for group key maagemet [3]-[10]. The mai purpose of them is how to distribute group key to valid members efficietly at leave. The proposed protocols are based o logical hierarchy model. The commo issue with all of these protocols is that they focus oly o sigle joi/leave. Although these protocols reduce the re-keyig overhead largely at leave from O() to O(log ), they icrease re-keyig overhead from O(1) to O(log ) at joi [3]-[8]. While proposals i [9],[10] reduce re-keyig overhead at joi for multicast commuicatio compared with [3]-[8], oe of them [3]-[10] focus o reducig rekeyig overhead for a ew member at joi. I fact, reducig re-keyig overhead for ew members at joi is a importat factor for simultaeous mode. Because, whe m members joi the group simultaeously, the server should deliver the ecessary keys to both the ew ad the curret members. For the curret members, the overhead has already bee decreased, but for ew member the overhead still remais. So, i simultaeous mode, reducig overhead of key delivery to ew members at joi is a critical factor. Therefore, it is ecessary to have the miimum overhead for the ew members at joi. 6

3 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 For this purpose, the overhead of re-keyig for ew member i sigle joi/leave should be miimized at first. The, by improvig that method, the proposed protocol ca be used i simultaeous mode. As stated before, most of the previous approaches do ot cosider simultaeous joi/leave. [11] is the oly research that addresses simultaeous joi/leave by periodic re-keyig. However, this proposal does ot support forward ad backward secrecies. This is the mai problem with this protocol because some members may repeat joi/leave withi a period. Moreover, this approach does ot propose ay specific method for re-keyig. This paper develops the mechaism of key tree maagemet i [1] ad adopts the protocol to simultaeous joi/leave. CKCS is a hierarchical protocol which has the miimum re-keyig overhead at joi/leave compared to [3]-[10]. I CKCS, all ecessary keys are calculated by members usig code for key calculatio rather tha distributed by the key server. As a result, key geeratio, key ecryptio ad message size overhead are reduced to O(m) where m deotes the umber of members who joi the group simultaeously. This paper is orgaized as follows. Sectio shows the overview of the secure multicast etwork, ad discusses the researches which are based o the hierarchical approach. The desig priciples ad detailed desig of our proposal are show i sectios 3 ad 4, respectively. At the ed of sectio 5, we discuss the security of our protocol. I sectio 6, we compare our protocol with the hierarchical based researches. Sectio 7 is the coclusio.. RELATED WORK.1. Network Structure Figure 3 illustrates the etwork structure of secure multicast. This etwork has three major parts; key server, multicast seder ad multicast members. Key server is resposible for geeratig the keys ad deliverig them to both multicast seder ad the existig members. Multicast seder ecrypts the cotets by the key which is received from the key server ad distributes the ecrypted cotet to all the group members. Multicast members are the authorized users who receive group cotet from multicast seder ad also the ecessary keys from the key server. Whe a ew member jois a multicast group, he/she should sed IGMP request to his/her earest router to receive multicast data from the etwork. Also, the ew member eeds to sed a joi request to the key server. Whe the ew member s request is accepted by the key server, rekeyig process should be started. All the updated keys must be delivered by the key server to multicast seder, the ew member ad all the existig members. Whe a member leaves a multicast group, he/she eeds to sed IGMP leave message to stop cotet delivery at first. The, this member should iform the key server by sedig a leave message. I ext subsectio, re-keyig process of some previously proposed protocols is reviewed... Existig LKH Approaches Waller et al. i [3] proposed LKH (Logical Key Hierarchy) approach for group key maagemet i secure multicast. Later, several versios of LKH based protocols were proposed [4]-[10]. I these protocols, a cetralized server is resposible for maagig the group ad distributig the group key to all group members. I LKH based protocols, the members of multicast group are mapped to the leaves of a logical key tree. This tree is a d-ary tree, typically a biary oe. Each member stores all the keys from the leaf ode alog the path to the root. The root key is the group key. Whe a member jois or leaves the group, all the keys i his/her possessio eed to be chaged to ew oes. The lowest level i the tree ca be the startig poit i a way that a ew paret key is ecrypted by usig its two child keys ad distributed to 63

4 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 users. Sice the height of the key tree is log, as a resultthe complexity of re-keyig is also O(log ). Figure 3. Network structure of secure multicast [9] Figure 4 shows the outlie of re-keyig procedure for LKH at joi. This figure depicts the logical key tree with seve existig members, u 1 through u 7, whe u 8 jois the group. At this time, the affected middle ode keys, K 7,8 ad K 5,8, ad the group key, K G, are chaged to K 7,8, K 5,8, ad K G respectively, because these odes are o the path from u 8 to the root. The, the key server seds the ew keys to the related members. First, all the keys which u 8 eeds to have, K 7,8, K 5,8 ad K G are set by uicast to u 8 beig ecrypted with K 8, K 7,8 ad K 5,8, respectively. Next, K 7,8 is set to u 7 beig ecrypted by K 7. For the existig members, the updated keys are set by multicast. I this example, K 5,8 is set to {u 5,u 6 }, ad u 7 beig ecrypted with K 5,6 ad K 7,8 respectively. K G is set for {u 1,u, u 3, u 4 } ad for {u 5, u 6, u 7 } beig ecrypted with K 1,4 ad K 5,8, respectively. Figure 4. A example of logical key tree for LKH ad OFT at joi/leave For leave operatio, the same procedure is performed. Whe a member leaves the group, for example u 8, the ode key of the leavig member should be deleted from the key tree at first. Next, all the affected middle odes i the path to the root are updated to ew oes ad are set to remaiig members. By this method, LKH reduces re-keyig overhead at leave from O() to O(log ). OFT [4] is aother LKH based approach. The mai idea of this approach is to reduce the key distributio overhead of the server by shiftig a part of key calculatio to users side. The key of 64

5 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 ode (i), K i,is calculated by usig the formula K i = f(g (K left (i) ),g (K right (i) )). I this formula, f(x) is a mixig fuctio ad g(x) is a oe-way hash fuctio. The value of g(x) is called blided key. K left (i) deotes the key of left child while K right (i) deotes the key of right childe of the ode. I OFT, whe a member jois a multicast group, he/she receives some iformatio icludes the group key, his/her siblig s blided key, ad acestors siblig blided keys. For example, i Figure 4 whe u 8 jois the group, he/she should receive the siblig blided key, g(k 7 ), ad his acestors sibligs blided keys which are g(k 5,6 ) ad g(k 1,4 ). These keys are ecrypted by K 8. O the other had, u 8 calculates K 7,8, K 5,8 ad K G by usig the followig formulas. ( ( ) ( )) K = f g K, g K, 7,8 7 8 ( ( ) ( )) ( ( 1,4 ), ( 5,8 )). K = f g K, g K, 5,8 5,6 7,8 K = f g K g K G After u 8 jois the group, the blided keys of K 7,8, K 5,8 ad K G are ecrypted with their siblig keys ad advertised by multicast to the existig group members as follows: ( ( 5,8 )) ( ( 7,8 )) 1 4 u u : g K 7 u : ( g ( K8 )) K7 multicast 5 6 s u u : g K Now, by receivig these blided keys, all the group members ca update the ecessary keys through the above formula. I this method, whe a member leaves the group, the key updatig process will be doe as well as joi operatio. Therefore, OFT reduces the overhead of rekeyig from O(log ) to O(1/ log ). I [9], authors divide the group members ito some subgroups ad assig a subgroup key to each subgroup. I this protocol, the key server assigs a secret to each joiig member, ad the group key is geerated usig those secrets. Moreover, each member is give the iverse value of secrets of all the other members except its ow. Those iverse values help the remaiig members to update the group key at leave. Whe a member leaves the group, the key server oly iforms the remaiig members that the member has left the group. The ew key is geerated by idividual members usig the iverse value of the leavig member. I order to reduce the burde of maitaiig the iverse values, this protocol divides the curret members ito subgroups. By this mechaism, the protocol ca reduce the computatioal ad commuicatioal overhead at member leave ad the maiteace overhead of iverse values at idividual members. Although this protocol focuses o reducig the re-keyig overhead at leave but it also reduces re-keyig overhead at joi. Cosequetly, this protocol reduces re-keyig overhead at leave from O(log ) i LKH to O(log [/m]) at leave whe m is the umber of subgroups. OKD [10] is defied based o oe-way key derivatio. I this method, users compute some of the updated keys i each group membership chage istead of receivig all ew keys from the server. A derivatio fuctio, f (x) is used to geerate ew keys from the old oes. OKD cosiders 3-ary tree for key tree. I OKD, whe a ew member jois the group, he/she is assiged to a suitable brach of the key tree ad all the ecessary keys are set by uicast to the ew member but the curret group members calculate their ecessary keys by themselves. While OKD reduces re-keyig overhead at joi for multicast commuicatio compared with other LKH based protocols []-[7], it does ot focus o reducig re-keyig overhead for a ew K1,4 K5,6 (1) () 65

6 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 member at joi. So, OKD is ot suitable whe several members joi a group simultaeously. The details of OKD exist i [10]. As show above, LKH based methods are acceptable because they reduce re-keyig overhead largely. If the group size is small, for example less tha hudred members, oe might ot use a hierarchical approach. However, whe the group size grows to several thousads or millios, hierarchical approaches such as LKH based protocols are eeded. More importat, whe simultaeous joi is cosidered for a system, the overhead of re-keyig for the ew members is crucial because the server has to geerate the ew keys ad ecrypt them for each ew member idividually to sed them. While protocols i [9],[10] reduce re-keyig overhead at joi for multicast commuicatio compared to the other LKH based oes [3]-[8], they do ot focus o reducig re-keyig overhead for the ew members which is ecessary for simultaeous joi. Therefore, the overhead of re-keyig for ew members i simultaeous mode is a crucial factor. To hadle this issue, we develop the mechaism of the key tree for simultaeous joi/leave i our previously proposed protocol [1] ad ow we evaluate its performace i simultaeous mode. 3. DESIGN PRINCIPLE We ow preset our ew efficiet protocol for group key maagemet i simultaeous mode. I fact, this work (CKCS: Code for Key Calculatio i Simultaeous), is a extesio of our origial idea [1]. We add some features ad adopt them to simultaeous mode. The followig desig priciples have bee performed i our protocol. (1) Figure 3 illustrates the etwork structure of secure multicast. Usig the same etwork structure for CKCS, the key server is resposible for geeratig ad distributig oly the group key to ew members at joi. First of all, ew users sed a IGMP message to the earest router for receivig the multicast cotet from a multicast seder. Next, ew users eed to sed a joi request to the key server for receivig the sessio group key for decryptig the ecrypted cotet. Fially, whe members leave the group, they sed the leave requests to the key server. The key server updates the group key ad redistributes it to the remaiig members ad multicast seder by multicast. () Figure 5 illustrates the logical key tree i CKCS. The tree applies the cocept of key tree i LKH approaches. Whe m members joi a group simultaeously, the server creates a key tree for those users, ad combies it with the curret key tree by addig a ew ode to top of these two trees. Here, this top ode is cosidered as the group key. By this techique, the height of the key tree remais uchaged ad as a result we have a balaced tree. (3) Similar to LKH based approaches, i CKCS, some keys eed to be updated after each membership chage. The updated keys are calculated by the group members rather tha distributed by the key server. For this purpose, each ode of the key tree is assiged to a specific code called ode code. A ode code is a radom umber which is assiged to each middle ode key to help the users calculate the ecessary keys. This code is delivered to the ew member at joi as a positio of that member i the key tree. It is calculated by cocateatig a radom umber to right digit of its paret ode code. Geerally, each paret ode code ca be obtaied by deletig the rightmost digit from his/her child code. By this mechaism, each member kows the codes of all odes i his/her path to the root. So, members ca update the affected ode keys usig these codes ad the hash fuctio after each membership chage (Figure 6). (4) I this step, we explai simultaeous joi i CKCS. Whe several users joi a group cocurretly, the server creates a ew key tree for ew users by assigig a positio code to the top ode of the ew key tree. The previous key tree ad the ew oe are cocateated to each other by addig a top ode which is cosidered as a ew group key. The key server ecrypts the ew group key with each ew user's idividual key ad seds them by oe 66

7 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 Figure 5. The logical key tree i CKCS (a) (b) Figure 6. Node code maagemet (a) ode code geeratio (b) simple example multicast message. Each ew member geerates the middle ode keys i his/her path to the root by applyig hash fuctio o bitwise XOR of the group key with each ode code. Curret members oly eed to compute the top ode of ew key tree which is calculated by applyig hash fuctio o the previous group key. (5) This step describes simultaeous leave i CKCS. Depedig o the positio of leavig members, two cases are cosidered; the worst case ad the best case (Figure 7). The worst case occurs whe members leave the group from differet leaves of the key tree while the best case happes whe members who are located i oe half of the key tree. At leave, the siblig ode of each leavig member is moved to his/her paret positio i the key tree. To provide forward secrecy, the server is resposible for updatig the group key ad sedig it to the remaiig members. The server ecrypts the ew group key with top ode of each part ad seds it by multicast to all remaiig group members. The re-keyig overhead at leave has the lowest value by cosiderig the best case. leavig members remaiig members (a) (b) Figure 7. Leave operatio i simultaeous mode (a) worst case (b) best case 67

8 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July DETAILED DESIGN I this sectio, we preset CKCS i details. CKCS focuses o user side key calculatio rather tha server side key distributio. I this protocol, a code is assiged to each middle ode of the key tree to help users calculate the ecessary middle ode keys Key Tree Structure ad Node Code Maagemet i CKCS The key server maages the group members ad seds them oly the group key. Whe ew members joi the group, they eed to kow their idividual keys ad their positios i the key tree accordig to the basic iformatio. After receivig joi requests, the key server seds the ew members their idividual keys, ad also their positio codes i the key tree. The idividual keys of the ew members ad their positio codes are set via a secure chael. Each ode of the key tree has a uique code. New members ca calculate the ecessary middle ode keys i their path to the root by usig ode codes. Each middle ode key is updated by applyig hash fuctio o bitwise XOR of the group key ad the correspodig ode code as below. Kmiddle _ ode = f ( KG ode _ code) (3) Moreover, the group key is updated after each membership chage. New members receive the group key from the key server ecrypted by their idividual keys. The curret members ca calculate it by applyig oe-way hash fuctio o the previous group key as below. K G = f ( KG ) (4) I simultaeous joi, whe multiple users joi the multicast group, the server creates the key tree of ew users at first ad allocates each ew user to oe leaf of the key tree. The key tree of old group members ad ew simultaeous users are combied with each other by addig a ew ode to the top. At this time, the top ode is assumed as the ew group key. The code of the ew top ode (root ode) is calculated by deletig a digit from the rightmost digit of the previous root code. The, the codes of middle odes for simultaeous joi are created by cocateatig a radom umber to the rightmost digit of the paret code as below. Childode_code = (Paretode_code Radom digit(s)). (5) Figure 8 shows the ode code maagemet procedure i simultaeous mode. Here, by joiig the ew users,{u 5, u 6, u 7, u 8 }, simultaeously, ew ode key, K 1,8, is created o top of the previous root ode key, K 1,4. The key tree of ew members, {u 5, u 6, u 7, u 8 }, is located to the right child positio of the ew root ode. Here, the code of ew root is 7 calculated by deletig 8 from the right side of 78. The middle ode codes of doted braches (key tree of ew members) are created by attachig a radom umber to the right side of their parets code. Figure 8. Node code maagemet key tree i simultaeous case 68

9 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July Joi Operatio We use Figure 9 to explai how re-keyig is doe i simultaeous joi by a simple example of a multicast group with 4curret members {u 1, u, u 3, u 4 } while {u 5, u 6, u 7 } joi the group simultaeously. The procedure is doe as follows: (1) {u 5, u 6, u 7 } sed joi requests to the key server cocurretly. The server creates their key tree ad geerates their idividual keys. Idividual keys of the ew members, {K 5, K 6, K 7 }, are set through a secure chael to them. The key tree of ew members is attached to the curret key tree by addig a top ode, K 1,7, to the top ofk 1,4. This ew top ode, K 1,7, is the ew group key. () There server calculates code of K 1,7 ad all the ew middle odes i the ew key tree. 7 is assiged to K 1,7 by deletig 8 from the rightmost digit of 78 assiged to K 1,4. I the ew members key tree, code of each middle ode is geerated by attachig a radom umber to the rightmost digit of his/her paret ode code. These codes are 73, 734 assiged to K 5,7 ad K 5,6, respectively. After geeratig these odes codes, the server seds the positio codes to them through a secure chael. (3) The key server updates the group key from K G to K G, usig oe-way hash fuctio. K = f ( K ) (6) G 1,4 (4) The, K G is ecrypted by each ew member s idividual key ad set by oe multicast message. (7) multicast s { u, u, u }: ( KG ) K,( K ),( ). 5 G K K 6 G K7 (5) The curret group members, {u 1, u, u 3, u 4 }, who are located i curret key tree, calculate the ew group key, K G, by applyig oe-way hash fuctio to the previous group key K G.,,, : = ( ) (8) u u u u KG f K1,4 (6) The ew members, {u 5, u 6, u 7 }, compute all their ecessary middle ode keys i their path to the root by the followig formula:, : ( ), 5 6 u u K5,6 = f KG 734,, : ( ) u u u K5,7 = f KG 73 (9) 7 K 1, K 1,4 K 5, K 1, K 3,4 K 5,6 u 7 u 1 u u 3 u 4 u 5 u 6 K 7 K 1 K K 3 K 4 K 5 K 6 curret key tree ew key tree Figure 9. Updatig key tree i simultaeous joi i CKCS 69

10 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July Leave Operatio I CKCS, whe several members leave the group, the key tree is divided ito two equal parts. As Figure 10 shows, the deleted odes belog to oe half of the key tree. So, these parts will be divided agai ad agai util just the leavig members braches are remaied. The umber of tree divisios is equal to (log -1) where is the umber of group members. The key server ecrypts the ew group key by the keys of the top ode of each half. We ow use Figure 10 to explai how re-keyig is doe i simultaeous leave by a simple example of a multicast group with 8 members {u 1,..., u 8 } whe {u 1, u 4, u 8 }leave the group. The procedure is doe as follows: (1) Whe {u 1, u 4, u 8 } leave the group, the odes of K 1,, K 3,4, ad K 7,8 are deleted from the key tree ad u, u 3 ad u 7 are promoted to their top ode positios. () The key server geerates a radom group key, K G. (3) K G is set to the remaiig group members by multicast, beig ecrypted by the top ode key of each part, K, K 3, K 5, 6, K 7. The group key is set to the members who are located i each part, part-1, part-, part-3, ad part-4 respectively. s u : ( K G ) u : ( K ) K 3 multicast G K3 5 6 u, u : ( K G ) K5,6 7 u : ( K G ) K7 (10) (4) Now, {u, u 3, u 5, u 6, u 7 } whose their middle odes are affected from this simultaeous leave, update K 1,4 ad K 5,7 to K 1,4 ad K 5,7 respectively by applyig oe-way hash fuctio o bitwise XOR of the group key ad the related ode codes., : ( ), 3 u u K1,4 = f KG 78,, : ( ) u u u K5,7 = f KG 73 (11) Figure 10. Simultaeous leave for CKCS 70

11 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July SECURITY ANALYSIS I this sectio, we aalyze the security requiremets of CKCS. Backward secrecy esures that ew members at joi caot achieve the archived cotets i the group. I CKCS, the ew group key is orgaized by applyig oe-way hash fuctio to the previous group key. Oe-way hash fuctio has the property of oe-wayess which meas that it is easy to calculate y = E(x), but by give y it is computatioally hard to fid x. Therefore, it is impossible for a ew member to fid the previous group key. Forward secrecy esures that whe several members leave the group, they caot access successfully the curret cotets. I CKCS, the ew members caot geerate the curret sessio keys with their previous iformatio because the group key is geerated by the key server at leave, ad is trasmitted by the ode keys that the leavig members do ot have them. 6. COMPARISON I this sectio, we compare CKCS protocol with some previously proposed oes, LKH, OFT, ad OKD. We compare these protocols at joi ad leave operatios for simultaeous mode. The compariso measures are based o key geeratio, key ecryptio, commuicatio overhead, ad message size. Tables 1,, 3 ad 4 summarize our comparisos, focusig o the followig measures: Computatioal overhead o Key geeratio overhead: the umber of keys that must be geerated at joi/leave. o Ecryptio overhead: the umber of ecryptios. Commuicatio overhead: the umber of trasmissios from the key server. Message size: the total umber of keys i oe message. The computatioal overhead is the sum of key geeratio ad key ecryptio. I our comparisos show i the followig tables, deotes the group size which is the umber of members i the multicast group after joi ad before leave operatios. I additio, i simultaeous mode, m deotes the umber of members that joi or leave multicast group cocurretly. Fially, i simultaeous mode we cosider that m. I other words, the umber of simultaeous users is less tha or equal to the umber of group members. Biary key tree is assumed for key degree i compariso. As stated before, i biary key tree the height of tree is log which shows the umber of odes i each brach. Obviously, the efficiecy of a protocol is related to the height of the key tree. I other words, a key tree with smaller height is more efficiet tha a tree with larger height. Cosequetly, sice the tree height for all of these protocols is equal, the factors that make differeces i decreasig overhead are the re-keyig procedure ad the key distributio techique. The re-keyig method itself is a effective way to reduce the overhead. Regardig re-keyig method i LKH, OFT, ad OKD, the server has more loads for geeratig, ecryptig, ad deliverig keys to the members. I LKH ad OFT, the members do ot participate i key calculatio o each membership chages. While i OKD the members ivolve key update process with the key server but the re-keyig overhead problem for ew members still remais. Coversely i CKCS, the cotributio of curret members i re-keyig process ad miimum umber of key delivery to ew members are two decisive factors which make it more effective tha the other oes. Fially, the previously proposed protocols do ot cosider the simultaeous mode at all. So, the overhead of these approaches is ot acceptable for this mode. Assumig simultaeous mode for these protocols, the results are show i Tables 1,, 3 ad 4. I additio, we have implemeted programs to compare the overhead of these metioed protocols. These programs compare the processig time that each protocol speds for geeratig ad ecryptig ecessary keys after each membership chages based o the umber of users. 71

12 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 The source code of the programs is based o the script laguage program, ruby, usig OpeSSL cryptography library. These programs have bee ru o a 1.66 GHz Widows 7 processor with GB of RAM. We have used AES-56-OFB to geerate keys for LKH. The key geeratio algorithm for OFT, OKD, ad CKCSS is based o AES-56-OFB ad SHA-1. Fially, we sketch some plots (Figures 11, 1, 13, 14, 15, ad 16) for showig umerical compariso. For this purpose, we cosider that there are 100,000 group members ad 104, 048, 4096, ad 819 simultaeous users for joi/leave Computatioal Overhead The computatioal overhead for these Protocols deped o the umber of keys that eed to be geerated ad ecrypted by the server. Table 1 shows the key geeratio overhead at simultaeous joi/leave operatio. I LKH, group members do ot participate i middle ode keys calculatio i each joi/leave operatio. I OFT, oly a ew member at joi ad the remaiig members at leave eed to update the keys i their paths. I OKD, whe a member jois the group all the ecessary keys should be delivered to him/her by uicast ad all the remaiig members ca update their middle ode keys by themselves, but at leave some odes are resposible for updatig the affected keys. So,i these protocols, the key geeratio overhead islog for a sigle member admlogwhe m members joi/leave the group simultaeously. CKCS has the smallest overhead for key geeratio comparig with the others. Table 1.The comparisos of key geeratio overhead i simultaeous joi/leave operatios. Protocols Joi Leave LKH m log m log OFT m log m log OKD m log m log CKCS m+1 1 As metioed above, the previously proposed protocols do ot cosider the simultaeous mode. Accordig to the results, i LKH, OFT, ad OKD whe m members joi/leave the multicast group, the server geerates keys to update the key tree (all the keys i the paths of m members to the root). If m=1, these amouts are equal to the sigle mode. I CKCS, this overhead is decreased to m at joi ad to 1 at simultaeous leave operatio. Whe m members joi the group sychroously, the server geerates a idividual key for each of them (m idividual keys for m members) ad oe group key. Also, whe m members leave the group, the server geerates oly a ew group key for the remaiig members. All the ecessary keys i CKCS are calculated by the group members. Table illustrates the key ecryptio overhead for m simultaeous joi/leave. The results show that LKH, OFT ad OKD have high overhead at joi/leave. But i CKCS, this overhead is the lowest oe because i each joi operatio the server ecrypts oly the ew group key with each ew member s idividual key. I CKCS, the key ecryptio overhead at leave is equal to the height of the key tree because the server ecrypts the group key by the top ode of each part for users who are located at that part. Table.The compariso of key ecryptio overhead at simultaeous joi/leave operatios. Protocols Joi Leave LKH 3m log m log OFT m log m log OKD m log m log CKCS m log 7

13 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 Figures11 ad 1 illustrate the computatioal overhead (processig time versus the umber of simultaeous users) for simultaeous joi/leave. As show, LKH has the highest gradiet whe m members joi/leave the group cocurretly. OFT ad OKD have the lower computatioal overhead tha LKH i simultaeous joi/leave. I simultaeous joi operatio, the computatioal overhead of OFT is higher tha OKD but at leave these protocols have almost the same overhead. CKCSS has the lowest overhead at both simultaeous membership chages LKH OFT OKD CKCSS processig time (sec) simultaeous users Figure 11. Computatioal overhead versus umber of group members at simultaeous joi LKH OFT OKD CKCSS processig time (sec) OFT,OKD overlap simultaeous users Figure 1. Computatioal overhead versus umber of group members at simultaeous leave 6.. Commuicatio Overhead ad Message Size Table 3 depicts the commuicatio overhead at simultaeous joi/leave operatio. Commuicatio overhead at simultaeous joi is divided ito two categories, uicast ad multicast overhead. As show i this table, LKH ad OFT have the same commuicatio overhead at joi/leave which is the highest oe. These two protocols have both uicast ad multicast commuicatio i each simultaeous joi. This happes because ecessary keys for ew members are set by uicast ad for remaiig members by multicast. I OKD ad CKCS, 73

14 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 all the keys are collected i oe message, ad set to ew members by oe multicast message. So, there is o overhead for uicast but 1 multicast trasmissio exists whe m members joi the group.figures13 ad 14 illustrate the umerical results for commuicatio overhead at simultaeous joi/leave respectively. Table 3.The commuicatio overhead at simultaeous joi/leave operatios. Protocols Joi Leave Uicast Multicast Multicast LKH log log log OFT log log log OKD log - log CKCS - 1 log LKH OFT OKD CKCSS uicast commuicatio (times) LKH,OFT,OKD overlap 0000 CKCSS simultaeous users (a) multicast commuicatio (times) LKH OFT OKD CKCSS LKH, OFT overlap OKD, CKCSS overlap simultaeous users (b) Figure 13. Commuicatio overhead versus umber of group memberssimultaeous joi (a) uicast commuicatio (b) multicast commuicatio

15 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 multicast commuicatio (times) LKH OFT OKD CKCSS OFT,OKD overlap CKCSS 4096 simultaeous users Figure 14. Commuicatio overhead versus umber of group members atsimultaeous leave Table 4 shows message size i simultaeous joi/leave. For simultaeous joi/leave, CKCS has the lowest message size i each message trasmissio. All the other protocols have large message size for simultaeous because of their ecessary trasmissios. I CKCS, the server seds oe multicast message which icludes m keys. Each of these keys cotais the group key ecrypted by the idividual key of each simultaeous user.figures15 ad 16 illustrate the umerical results for message size at simultaeous joi/leave respectively. 819 Table 4.Message size at simultaeous joi/leave operatios Protocols Joi Leave LKH m log m log OFT m log + 1 m log + 1 OKD m log m log CKCS m m message size (umber of keys i oe message) LKH OFT OKD CKCSS OFT,OKD overlap 4096 simultaeous users Figure 15. Message size at simultaeous joi

16 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 message size (umber of keys i oe message) LKH OFT OKD CKCSS OFT,OKD overlap 4096 simultaeous users Figure16. Message size at simultaeous leave Although LKH based protocols miimized the overhead of leave operatio to log, they added uecessary overhead to joi operatio. This amout gets larger whe umber of users icreases. With a glace at Tables 1,, 3, ad 4 it is ot difficult to see that CKCSS has two major features. First, the overhead of CKCSS at joi does ot deped o the umber of users. It meas that the overhead for ew member is a costat amout while there is o overhead for curret users. Secod, reducig the overhead for ew user at sigle joi is the other importat factor for simultaeous mode. This factor is crucial for simultaeous joi. 7. CONCLUSIONS This paper proposed a ew group key maagemet protocol, CKCS, for simultaeous joi/leave. The protocol is based o logical key hierarchy. I simultaeous mode, whe members joi the multicast group simultaeously, the server creates a ew key tree for the members ad their idividual keys. The ew key tree is attached to the old oe by addig a ew ode to the top of the previous oe. Whe several members leave the group, oly the ew group key is set to the remaiig members. At the ed, we coclude our proposal with some of its cotributios: CKCS reduces key geeratio ad key ecryptio overhead largely i simultaeous joi/leave. CKCS reduces uicast ad multicast commuicatio overhead largely at joi i simultaeous mode. CKCS reduces message size for uicast commuicatio. REFERENCES [1] Feer, W., (1997) Iteret Group Maagemet Protocol, Xerox PARC, RFC 36, Versio. [] Jiag, B. &Hu, X., (008) A Survey of Group Key Maagemet, IEEE, Iteratioal Coferece o Computer Sciece ad Software Egieerig, Vol. 3, pp [3] Waller, D., Harder, E. & Agee, R., (1999) Key Maagemet for Multicast: Issues ad Architectures, Natioal Security Agecy, RFC67. [4] McGrew, D.A. & Sherma,A.T., (003) Key Establishmet i Large Dyamic Groups Usig Oe- Way Fuctio Trees, IEEE Trasactios o Software Egieerig, Vol. 9/5, pp

17 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 [5] Je, D., Seo,S., Park, Y.& Lee, J., (010) Computatio-ad-storage-efficiet key tree maagemet protocol for secure multicast commuicatios, Elsevier, Computer Commuicatios, Vol. 33/, pp [6] He, Z. & Li, Y., (008) Dyamic Key Maagemet i a User Hierarchy, d Iteratioal Coferece o Ati-couterfeitig, Security ad Idetificatio, ASID 008, pp [7] Kwak, D., Lee, S. & Kim, J., (006) A Efficiet LKH Tree Balacig Algorithm for Group Key Maagemet, IEEE Commuicatio Letters, Vol. 10/3, pp. -4. [8] Lu, R., Li,X., Ho, P., She, X. & Cao,Z., (008) A New Dyamic Group Key Maagemet Scheme with Low Rekeyig Cost, IEEE, Wireless Commuicatios ad Networkig Coferece, WCNC 008, pp [9] Nemaey Pour, A., Kumekawa, K., Kato, T. &Itoh, S., (007) A Hierarchical Group Key Maagemet Scheme for Secure Multicast Icreasig Efficiecy of Key Distributio i Leave Operatio, Elsevier, Computer Networks, Vol. 51/17, pp [10] Li, J., Lai, F. &Lee,H., (005) Efficiet Group Key Maagemet Protocol with Oe-Way Key Derivatio, Proceedigs of the IEEE Coferece o Local Computer Networks 30th Aiversary (LCN 5), pp [11] Zhu, F., Noubir, G.&Cha, A. H., (003) Optimal Tree Structure for Key Maagemet of Simultaeous Joi/Leave i Secure Multicast, Techical Report, Wireless Security Laboratory, Northeaster Uiversity, Bosto, MA, USA. [1] Hajivahabzade, M., Eidkhai, E., Mortazavi, A., Nemaey Pour, A. (010) A New Group Key Maagemet Protocol usig Code for Key Calculatio: CKC, Proceedigs of IEEE, IEEE Computer Society, the Iteratioal Coferece o Iformatio Sciece ad Applicatios (ICISA010), Seoul, Korea, pp Authors Melisa Hajyvahabzadehreceived her B.Sc. ad M.Sc. degree i Iformatio Techology fromsharif Uiversity of Techology, Iteratioal Campus, Ira. Her research itrests iclude Security, IP Multicast, Group Key Maagemet Protocols, Autheticatio i various type of etworks. Elia Eidkhaireceived her B.Sc.ad M.Sc. degree i Iformatio Techology fromsharif Uiversity of Techology, Iteratioal Campus, Ira. Her research itrests iclude Security, Wireless Networks, IP Multicast, Group Key Maagemet Protocols i various type of etworks. Seyedeh Aahita Mortazavireceived her B.Sc. ad M.Sc. degree i Iformatio Techology fromsharif Uiversity of Techology, Iteratioal Campus, Ira. Her research itrests iclude Security, IP Multicast, Group Key Maagemet Protocols i various type of etworks. 77

18 Iteratioal Joural of Computer Networks & Commuicatios (IJCNC) Vol.4, No.4, July 01 Alireza Nemaey Pour has received his B.S degree i Computer Sciece from Sao Uiversity, Japa, M.S i Computer Sciece from Japa Advaced Istitute of Sciece Ad Techology, Japa, ad Ph.D. degree i Iformatio Network Sciece from Graduate School of Iformatio Systems,the Uiversity of Electro-Commuicatios, Japa. He is curretly a faculty memberof Islamic Azad Uiversity of Abhar i Ira. I additio, He is a techical advisor of J-Tech Corporatio i Japa. His research iterests iclude Network Security, Group Commuicatio Security, Protocol Security, Iformatio Leakage, Spam Mail Prevetio, Web Spam Detectio, Group Autheticatio, ad Cryptography. 78