System and method for multicasting IPSEC protected communications
View Patent ↗A system and method is provided which allows multicast communications encrypted using IPSec protocol to be received by receivers in a network. In order to allow the receivers to receive the encrypted multicast communication, the address information of the received multicast communication is modified to appear as a unicast communication being transmitted directly to the address of the receiver, such that the receiver may then decrypt the received multicast communication using IPSec decryption capabilities or may, alternatively, forward the received multicast communication in its encrypted state to other devices. The system and method further provide IPSec encryption key delivery to the receiver using an encrypted markup language file. Multiple keys may also be generated for a given IP address of a receiver with each key being generated for a particular multicasting hierarchical classification.
1. A method comprising:
generating, with a processor, a key to be used to encrypt and decrypt data for an IP multicast communication, wherein the IP multicast communication includes at least one event;
placing the generated key into a markup language file;
encrypting the markup language file including the generated key;
transmitting the encrypted markup language file to a plurality of receivers;
decrypting the encrypted markup language file at the receivers to determine the generated key;
encrypting each event using a different respective event encryption key; and
delivering each respective event encryption key for each event to a respective subset of the receivers.
2. The method of claim 1 , wherein the markup language file is an Extensible Markup Language (XML) file.
3. The method of claim 1 , wherein the key allows data to be encrypted and decrypted according to Internet Protocol Security (IPSec) protocol.
4. The method of claim 1 , further comprising:
encrypting a communication using the generated key;
transmitting the encrypted communication to the receiver; and
decrypting the encrypted communication using the generated key.
5. A device for providing an encrypted key to a remote location, said device comprising:
a processor;
a memory;
a key server for generating a key to be used to encrypt and decrypt data for an IP multicast communication and for placing the generated key into a markup language file, wherein the IP multicast communication includes at least one event;
an encryption device for encrypting the markup language file including the generated key and encrypting each event using a different respective event encryption key;
a transmitter for transmitting the encrypted markup language file to a plurality of receivers and delivering each respective event encryption key for each event to a respective subset of the receivers; and
a decryption device decrypting the encrypted markup language file at the receivers to determine the generated key.
6. The device of claim 5 , wherein the markup language file is an Extensible Markup Language (XML) file.
7. The device of claim 5 , wherein the key allows data to be encrypted and decrypted according to Internet Protocol Security (IPSec) protocol.
8. The device of claim 1 , wherein:
the encryption device further encrypts a communication using the generated key;
the transmitter further transmits the encrypted communication to the receiver; and
the decryption device further decrypts the encrypted communication using the generated key.
9. A non-transitory machine-readable medium having program instructions stored thereon executable by a processing unit for performing the steps of:
generating a key to be used to encrypt and decrypt data for an IP multicast communication, wherein the IP multicast communication includes at least one event;
placing the generated key into a markup language file;
encrypting the markup language file including the generated key;
transmitting the encrypted markup language file to a plurality of receivers;
decrypting the encrypted markup language file at the receivers to determine the generated key;
encrypting each event using a different respective event encryption key; and
delivering each respective event encryption key for each event to a respective subset of the receivers.
10. The non-transitory machine-readable medium of claim 9 , wherein the markup language file is an Extensible Markup Language (XML) file.
11. The non-transitory machine-readable medium of claim 9 , wherein the key allows data to be encrypted and decrypted according to Internet Protocol Security (IPSec) protocol.
12. The non-transitory machine-readable medium of claim 9 , further comprising program instructions stored thereon executable by a processing unit for:
encrypting a communication using the generated key;
transmitting the encrypted communication to the receiver; and
decrypting the encrypted communication using the generated key.
13. A method of broadcasting a secure multicast communication, said method comprising:
assigning content to be delivered in various hierarchies in an IP multicast communication, the various hierarchies including at least broadcast channels;
assigning, with a processor, different encryption keys for each respective hierarchy of the IP multicast communication;
encrypting the content in the various hierarchies in the IP multicast communication using respectively assigned encryption keys;
transmitting the encryption keys for the various hierarchies of the IP multicast communication to a plurality of receivers intended to receive respective encryption keys;
transmitting the encrypted IP multicast communication to each of the receivers;
decrypting the content in the various hierarchies of the IP multicast communication at only those receivers having the respective encryption keys for such content, wherein the IP multicast communication includes at least one event;
encrypting each event using a different respective event encryption key; and
delivering each respective event encryption key for each event to a respective subset of the receivers.
14. The method of claim 13 , comprising:
encrypting a first multicast communication using a first encryption key;
delivering the first encryption key to a plurality of receivers for decrypting the encrypted first multicast communication;
transmitting the encrypted first multicast communication to the plurality of receivers;
encrypting at least one additional multicast communication using at least one additional encryption key, wherein each additional multicast communication is encrypted with its own respective encryption key;
delivering the at least one additional encryption key to a subset of the plurality of receivers for decrypting the encrypted at least one additional multicast communication;
transmitting the encrypted at least one additional multicast communication to the plurality of receivers, wherein all of the plurality of receivers having the first encryption key will be capable of decrypting the encrypted first multicast communication while only the subset of the plurality of receivers having the at least one additional encryption key will be capable of decrypting the encrypted additional multicast communication.
15. The method of claim 13 , wherein each multicast communication includes at least one broadcast channel, the method further comprising:
encrypting each broadcast channel using a different respective channel encryption key; and
delivering each respective channel encryption key for each broadcast channel to a respective subset of the plurality of channels.
16. The method of claim 15 , wherein each wherein each broadcast channel of a multicast communication includes at least one event.
17. The method of claim 16 , further comprising:
transmitting the at least one broadcast channel and the at least one event to respective subsets of receivers, wherein a key hierarchy is formed such that:
all of the plurality of receivers having the first encryption key will be capable of decrypting the encrypted first multicast communication,
only the subsets of the plurality of receivers having the respective channel encryption keys will be capable of further decrypting the encrypted at least one broadcast channel, and
only the further subsets of the plurality of channel-receiving receivers having the respective event encryption keys will be capable of further decrypting the encrypted at least one event.
18. The method of claim 17 , wherein each event encryption key is only valid for a predetermined period of time associated with the transmitted event.
19. A method of broadcasting a secure multicast communication, said method comprising:
assigning content to be delivered in various hierarchies in an IP multicast communication, the various hierarchies including at least broadcast channels;
assigning, with a processor, different encryption keys for each respective hierarchy of the IP multicast communication;
encrypting the content in the various hierarchies in the IP multicast communication using respectively assigned encryption keys;
transmitting the encryption keys for the various hierarchies of the IP multicast communication to a plurality of receivers intended to receive respective encryption keys;
transmitting the encrypted IP multicast communication to each of the receivers;
decrypting the content in the various hierarchies of the IP multicast communication at only those receivers having the respective encryption keys for such content, wherein the IP multicast communication includes at least one event; and
encrypting each event using a different respective event encryption key, wherein each event encryption key is only valid for a predetermined period of time associated with a transmitted event.
20. A method comprising:
generating, with a processor, a key to be used to encrypt and decrypt data for an IP multicast communication, wherein the IP multicast communication includes at least one event;
placing the generated key into a markup language file;
encrypting the markup language file including the generated key;
transmitting the encrypted markup language file to a receiver; and
decrypting the encrypted markup language file at the receiver to determine the generated key; and
encrypting each event using a different respective event encryption key, wherein each event encryption key is only valid for a predetermined period of time associated with a transmitted event.
21. A device for providing an encrypted key to a remote location, said device comprising:
a processor;
a memory;
a key server for generating a key to be used to encrypt and decrypt data for an IP multicast communication and for placing the generated key into a markup language file, wherein the IP multicast communication includes at least one event;
an encryption device for encrypting the markup language file including the generated key and encrypting each event using a different respective event encryption key, wherein each event encryption key is only valid for a predetermined period of time associated with a transmitted event;
a transmitter for transmitting the encrypted markup language file to a receiver; and
a decryption device decrypting the encrypted markup language file at the receiver to determine the generated key.
22. A non-transitory machine-readable medium having program instructions stored thereon executable by a processing unit for performing the steps of:
generating a key to be used to encrypt and decrypt data for an IP multicast communication, wherein the IP multicast communication includes at least one event;
placing the generated key into a markup language file;
encrypting the markup language file including the generated key;
transmitting the encrypted markup language file to a receiver; and
decrypting the encrypted markup language file at the receiver to determine the generated key; and
encrypting each event using a different respective event encryption key, wherein each event encryption key is only valid for a predetermined period of time associated with a transmitted event.