Encrypted group communications

1. A method of operating a remote management system, the method comprising:

receiving attribute data from a first communication node and a second communication node;

forming a communication node group comprising multiple members, wherein the multiple members comprise the first communication node and the second communication node;

receiving a group encryption key request from the first communication node to enable secure communications between the first communication node and the second communication node using one or more transport channels, wherein the group encryption key request is received via one or more control channels, further wherein the one or more control channels are separate from the one or more transport channels, further wherein the group encryption key request comprises identity data comprising at least one of:

the communication node group; and/or

the first communication node:

generating a group encryption key based on the received group encryption key request and further based on the membership of the first and second communication nodes in the communication node group;

encrypting the group encryption key using a first device key obtained from the first communication node to generate a first encrypted group encryption key;

encrypting the group encryption key using a second device key obtained from the second communication node to generate a second encrypted group encryption key wherein the first device key and the second device key are different; and

transferring the first encrypted group encryption key to the first communication node and transferring the second encrypted group encryption key to the group encryption key to the second communication node through the one or more control channels.

2. The method of claim 1 wherein the identity data comprises the first device key.

3. The method of claim 1 wherein the first device key is a first device public key.

4. The method of claim 1 wherein the group encryption key is a symmetric key.

5. The method of claim 2 wherein the first device key is a first ephemeral device key negotiated by the remote management system and the first communication node.

6. A remote management system for managing group communications among communication nodes, the system comprising: one or more processors;

a computer readable storage medium having instructions stored thereon that, when executed by the one or more processors, cause the management system to:

receive attribute data from a first communication node and a second communication node;

form a communication node group comprising multiple members,

wherein the multiple members comprise the first communication node and the second communication node;

receive a group encryption key request from the first communication node to enable secure communications between the first communication node and the second communication node using one or more transport channels, wherein the group encryption key request is received via one or more control channels, further wherein the one or more control channels are separate from the one or more transport channels, further wherein the group encryption key request comprises identity data comprising at least one of:

the communication node group; and/or

the first communication node;

generate a group encryption key based on the received group encryption key request and further based on the membership of the first and second communication nodes in the communication node group;

encrypt the group encryption key using a first device key obtained from the first communication node to generate a first encrypted group encryption key;

encrypt the group encryption key using a second device key obtained from the second communication node to generate a second encrypted group encryption key, wherein the first device key and the second device key are different; and

transfer the first encrypted group encryption key to the first communication node and transferring the second encrypted group encryption key to the second communication node through the one or more control channels.

7. The system of claim 6 wherein the identity data comprises the first communication node device key.

8. The system of claim 6 wherein the first device key is a first device public key.

9. The system of claim 6 wherein the group encryption key is a symmetric key.

10. The system of claim 7 wherein the device key is a first ephemeral device key negotiated by the remote management system and the first communication node.

11. A method of operating a first communication node in a group communication system, the method comprising:

transmitting attribute data to a remote management system;

transmitting a group encryption key request to the remote management system through one or more control channels to enable secure communications between the first communication node and a second communication node, wherein the first and second communication nodes are members of a first communication group, wherein first communication group membership is controlled by the remote management system;

receiving a first encrypted group encryption key from the remote management system based on the transmitted group encryption key request and the membership of the first communication node in the first communication group, wherein the encrypted group encryption key comprises the group encryption key encrypted using a first device public key;

decrypting the encrypted group encryption key using a first device private key, wherein the first device public key and the first device private key are not shared with any other communication node;

encrypting user data to generate encrypted user data using the group encryption key; and

transmitting the encrypted user data through a data transport network to the second communication node, wherein the one or more control channels are separate from the one or more transport channels.

12. The method of claim 11 wherein the group encryption key request comprises at least one of the following:

identity data identifying the first communication group;

identity data identifying the first communication node; and/or

identity data comprising the first a first communication node device public key.

13. The method of claim 11 wherein the group encryption key is a symmetric key.

14. The method of claim 11 wherein the first and second communication nodes exchange the secure communications to the exclusion of eavesdropping by the remote management system.

15. The method of claim 12 wherein the first device public key is an ephemeral device key negotiated by the remote management system and the first communication node.