Group admission control apparatus and methods
View Patent ↗The present invention uses a group key management scheme for admission control while enabling various conventional approaches toward establishing peer-to-peer security. Various embodiments of the invention can provide peer-to-peer confidentiality and authenticity, such that other parties, such as group members, can not understand communications not intended for them. A group key may be used in combination with known unicast security protocols to establish, implicitly or explicitly, proof of group membership together with bi-lateral secure communication.
1. A method for admission control for a group, said group comprising a plurality of members and having a group key used for encryption of messages, said method comprising the steps of:
a first party to be admitted to the group:
receiving, from a group administrator, a first key, wherein said first key is an updated group key, said updated group key being sent from the administrator, to the plurality of members;
receiving, from the group administrator, a second key unique to said first party; and
verifying group membership by receiving a challenge and replying to said challenge, wherein said replying to said challenge is performed by modifying data by the use of a one-way function having said first key as an input.
2. The method of claim 1 , wherein said first key is updated at least once during a predetermined time interval.
3. The method of claim 1 , wherein said step of verifying group membership is performed anonymously.
4. A method for admission control for a group, said group comprising a plurality of members and having a group key used for encryption of messages, said method comprising the steps of:
enabling a first party to verify group membership to at least one of the plurality of members by:
sending a first key to the first party, wherein said first key is an updated group key;
sending a second key to said first party; and
sending said first key to the plurality of members of said group; wherein
said second key is unique to said first party,
wherein,
said first party verifies group membership by receiving a challenge and replying to said challenge, said replying to said challenge is performed by modifying data by the use of a one-way function having said first key as an input.
5. The method of claim 4 , wherein said first key is updated at least once during a predetermined time interval.
6. An electronic device, comprising:
an admission control facility for controlling access to a group, said group comprising a plurality of members and having a group key used for encryption of messages, said admission control facility comprising:
a receiver adapted to receive a request from a first party for admission to said group; and
a sender adapted to enable said first party to verify group membership to at least one of the plurality of members by sending a first key and a second key to said first party, wherein
said first key is an updated group key and is sent to said plurality of members;
said second key is unique to first said party and is sent exclusively to said first party; and
said first party verifies group membership by receiving a challenge and replying to said challenge, said replying to said challenge is performed by modifying data by use of a one-way function having said first key as an input.
7. The electronic device of claim 6 , wherein said first key is updated upon addition of at least one member to said group.
8. The electronic device of claim 6 , wherein said first key is updated upon removal of at least one member from said group.
9. The electronic device of claim 6 , wherein said sender is adapted to send said first key at least once during a predetermined time interval to said members of said group.
10. The electronic device of claim 6 , wherein said first key is updated at least once during a predetermined time interval.
11. The electronic device of claim 6 wherein the admission control facility is a server.
12. The electronic device of claim 6 wherein the admission control facility is a web server.
13. The electronic device of claim 6 wherein the admission control facility is an intermediary between a client and a server.
14. An electronic device holding computer-executable instructions for performing a method of admission control for a group, comprising the steps of:
enabling a first party to verify group membership to at least one of the plurality of members by:
sending a first key to the first party, wherein said first key is an updated group key;
sending a second key to said first party; and
sending said first key to the plurality of members of said group; wherein
said second key is unique to said first party,
wherein,
said first party verifies group membership by receiving a challenge and replying to said challenge, said replying to said challenge is performed by modifying data by the use of a one-way function having said first key as an input.