Method and system for source authentication in group communications

1. A central node for issuing certificates to a plurality of nodes associated with the central node in a network, the central node comprising:

a receiver that is configured to receive a first key from at least one node from among the plurality of nodes;

a processor which is configured to generate a second key based on the received first key and generate a certificate for the at least one node; and

a transmitter that is configured to transmit the generated certificate to the at least one node, wherein:

the first key is a key from a first authentication key chain comprising a plurality of keys generated by the at least one node for use in authenticating messages transmitted by the at least one node, the at least one node configured to generate a third authentication key chain comprising a plurality of keys and further configured to authenticate messages using at least two message authentication codes that are computed using a unique key from each of the first authentication key chain and the third authentication key chain, and

the certificate generated by the processor includes the second key and an identity of the at least one node.

2. The central node according to claim 1 , wherein the first key is a first randomly generated seed key generated by the at least one node, which uses the first randomly generated seed key to generate remaining keys in the first authentication key chain of the at least one node by repeatedly applying a first one-way function.

3. The central node according to claim 2 , wherein the processor is further configured to generate the first authentication key chain using the received first key by applying the first one-way function to the received first key.

4. The central node according to claim 3 , wherein the processor is further configured to generate a second authentication key chain by randomly generating a second seed key and repeatedly applying the first one-way function, wherein the second key is encrypted by a key from the second authentication key chain and the encrypted second key is included in the certificate for the at least one node.

5. The central node according to claim 3 , wherein the transmitter is configured to broadcast to the network a unique key from among the keys in the first authentication key chain, and wherein the broadcast repeatedly occurs in time after a fixed interval.

6. The central node according to claim 2 , wherein the receiver is further configured to receive a third key from the at least one node, and wherein the processor is further configured to generate a fourth key based on the received third key.

7. The central node according to claim 6 , wherein the third key is a randomly generated seed key generated by the at least one node, which uses the third key to generate remaining keys in the third authentication key chain of the at least one node by repeatedly applying a third one-way function.

8. The central node according to claim 7 , wherein the third one-way function is same as the first one-way function.

9. The central node according to claim 7 , wherein the processor is further configured to generate the third authentication key chain using the received third key by applying the third one-way function to the received first key.

10. The central node according to claim 6 , wherein the fourth key is the anchor element in the third authentication key chain of the at least one node.

11. The central node according to claim 1 , wherein the second key is the anchor element in the first authentication key chain of the at least one node.

12. A non-transitory computer-readable storage medium storing program instructions for execution by a processor, the program instructions, when executed, configured to cause the processor to perform operations comprising:

receiving a first key from at least one node from among a plurality of nodes;

generating a second key based on the received first key and generating a certificate for the at least one node; and

transmitting the generated certificate to the at least one node, wherein:

the first key is a key from a first authentication key chain comprising a plurality of keys generated by the at least one node for use in authenticating messages transmitted by the at least one node, the at least one node configured to generate a third authentication key chain comprising a plurality of keys and further configured to authenticate messages using at least two message authentication codes that are computed using a unique key from each of the first authentication key chain and the third authentication key chain, and

the certificate generated by the processor includes the second key and an identity of the at least one node.

13. The computer-readable storage medium of claim 12 , wherein the program instructions are configured to cause the processor to perform operations further comprising:

generating the first authentication key chain by applying a one-way function to the received first key.

14. The computer-readable storage medium of claim 12 , wherein the program instructions are configured to cause the processor to perform operations further comprising:

receiving a third key from the at least one node; and

generating a fourth key based on the received third key.

15. The computer-readable storage medium of claim 14 , wherein the third key is a key from the third authentication key chain comprising a plurality of keys generated by the at least one node for use in authenticating messages transmitted by the at least one node.

16. The computer-readable storage medium of claim 14 , wherein the second key is the anchor element in the first authentication key chain and the fourth key is the anchor element in the third authentication key chain.

17. The computer-readable storage medium of claim 14 , wherein the certificate generated by the processor includes the fourth key.

18. A system comprising:

a central node;

a first node; and

a second node, wherein the central node is trusted by the first and second nodes, and wherein:

the central node generates and stores a first authentication key chain comprising a plurality of first keys,

the first node generates a second authentication key chain comprising a plurality of second keys and a third authentication key chain,

the plurality of first keys and the plurality of second keys overlap at least partially,

the first node authenticates a message sent to the second node using at least two message authentication codes, each of the at least two message authentication codes computed using a unique key from the second authentication key chain and the third authentication key chain, and

the central node broadcasts a key that is used by the second node to verify the message as coming from the first node.

19. The system of claim 18 , wherein the central node generates a fourth authentication key chain comprising a plurality of fourth keys and randomly selects the broadcast key from the plurality of first keys and the plurality of fourth keys.

20. The system of claim 18 , wherein the first node selects the broadcast key from the first authentication key chain.