US6330671B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and system for secure distribution of cryptographic keys on multicast networks
Assignee: Oracle America Inc
•
Filing: 1997-06-23
•
Granted: 2001-12-11
•
Expires: 2017-06-23
Abstract
Abstract A method and apparatus for secure and scalable key management in a multicast network environment is provided. In a first portion, one or more seed nodes on the network receive a multicast transmission request for a cryptographic key from a requesting node. The seed node compares the identity of the requesting node with an authenticated predetermined list of nodes having permission to receive the cryptographic key. If the comparison indicates the requesting node is not a member of the authenticated predetermined list, the seed node denies the multicast request. However, if the comparison indicates that the requesting node is a member of the predetermined list of nodes, the cryptographic key is transmitted using a secure unicast key distribution technique such as SKIP. A second portion concerns the requesting node which generates a multicast request to obtain the cryptographic key from one or more seed nodes and one or more keyed nodes on the internetwork. The multicast request for the cryptographic key is initially transmitted a minimum hop count over the internetwork to locate the closest seed node. The requesting node delays a brief time period waiting for at least one response from at least one seed node or keyed node on the internetwork. If the at least one response is not received within this time period, the minimum hop count is increased by a hop count increment and the requesting node repeats the above steps. Eventually, the requesting node increases the hop count and receives the cryptographic key over a secure unicast key management technique such as SKIP. As a final step, the requesting node is convered into a keyed node. The keyed node acts as a seed node and provides the cryptographic key to other requesting nodes on the internetwork.
Inventors
- 👤 Ashar Aziz
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-26 16:39
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L12/00; H04L12/02; H04L12/16; H04L12/18; H04L63/06; H04L63/062; H04L9/00; H04L9/08; H04L9/0816; H04L9/0819; H04L9/0822; H04L9/083; H04L9/0833; H04L9/40
Claims Analysis
Total Claims: 51
Claim 1
Independent Claim
164 words
A method executed on one or more seed nodes and one or more keyed nodes for securely distributing a cryptographic key, initially located on the one or more seed nodes, to a requesting node wherein the one or more seed nodes, the one or more keyed nodes, and the requesting node are each coupled to one or more networks in an internetwork, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, the method comprising the steps of: receiving at a node selected from a group consisting of the one or more seed nodes and the one or more keyed nodes a multicast transmission request for the cryptographic key from the requesting node; encrypting the cryptographic key at the node selected in the receiving step; and transferring from the node selected in the receiving step the encrypted cryptographic key to the requesting node with a secure unicast transmission.
Claim 2
Independent Claim
164 words
A method executed on one or more seed nodes and one or more keyed nodes for securely distributing a cryptographic key, initially located on the one or more seed nodes, to a requesting node wherein the one or more seed nodes, the one or more keyed nodes, and the requesting node are each coupled to one or more networks in an internetwork, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, the method comprising the steps of: receiving at a node selected from a group consisting of the one or more seed nodes and the one or more keyed nodes a multicast transmission request for the cryptographic key from the requesting node; encrypting the cryptographic key at the node selected in the receiving step; and transferring from the node selected in the receiving step the encrypted cryptographic key to the requesting node with a secure unicast transmission.
Claim 3
Dependent Claim
84 words
The method of claim 1 wherein the receiving step further comprises the steps of: determining if the requesting node making the multicast request has permission to receive the cryptographic key by performing the following steps, comparing the identity of the requesting node with an authenticated list of nodes having permission to receive the cryptographic key; and responding to the multicast request if the comparing step indicates the requesting node is a member of the list of nodes having permission to receive the cryptographic key.
Claim 4
Dependent Claim
66 words
The method of claim 1 further comprising the step of converting the requesting node into a keyed node by configuring the requesting node to perform a method comprising the following steps of: receiving a multicast transmission request for the cryptographic key from a subsequent requesting node; encrypting the cryptographic key; and transferring the encrypted cryptographic key to the subsequent requesting node with a secure unicast transmission.
Claim 5
Dependent Claim
31 words
The method of claim 1 wherein the cryptographic key is requested by the requesting node to decrypt data being transmitted over a secure multicast transmission between members of a multicast group.
Claim 6
Dependent Claim
33 words
The method of claim 1 further including the step of including the one or more seed nodes, the one or more keyed nodes, and the requesting nodes as members of a multicast group.
Claim 7
Dependent Claim
48 words
The method of claim 5 further including the step of distributing the one or more seed nodes over the internetwork to minimize the distance over the internetwork between each member of the multicast group on the internetwork and a seed node or a keyed node on the internetwork.
Claim 8
Dependent Claim
23 words
The method of claim 1 wherein the multicast request made by the requesting node to the seed node is neither authenticated nor encrypted.
Claim 9
Dependent Claim
15 words
The method of claim 1 wherein the secure unicast transmission is performed using unicast SKIP.
Claim 10
Independent Claim
204 words
A method executed on a requesting node coupled to a network on an internetwork for obtaining a cryptographic key from one or more seed nodes and one or more keyed nodes coupled to one or more different networks on the internetwork, wherein each of the one or more seed nodes and the one or more keyed nodes are capable of transmitting the cryptographic key to the requesting node, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, the method comprising the steps of: generating a multicast request for the cryptographic key; transmitting the multicast request for the cryptographic key a predetermined number of hops over the internetwork directed to the one or more seed nodes and the one or more keyed nodes coupled to the internetwork; waiting for at least one response from at least one seed node or keyed node coupled to the network; and when the at least one response is not received within a time period, increasing the hop count by a hop count increment and repeating the above steps of generating a multicast request, transmitting the multicast request, and delaying a time period.
Claim 11
Independent Claim
204 words
A method executed on a requesting node coupled to a network on an internetwork for obtaining a cryptographic key from one or more seed nodes and one or more keyed nodes coupled to one or more different networks on the internetwork, wherein each of the one or more seed nodes and the one or more keyed nodes are capable of transmitting the cryptographic key to the requesting node, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, the method comprising the steps of: generating a multicast request for the cryptographic key; transmitting the multicast request for the cryptographic key a predetermined number of hops over the internetwork directed to the one or more seed nodes and the one or more keyed nodes coupled to the internetwork; waiting for at least one response from at least one seed node or keyed node coupled to the network; and when the at least one response is not received within a time period, increasing the hop count by a hop count increment and repeating the above steps of generating a multicast request, transmitting the multicast request, and delaying a time period.
Claim 12
Dependent Claim
44 words
The method of claim 9 further including the step of iteratively performing the steps of generating a multicast request, transmitting the multicast request, delaying a time period, and increasing the hop count until the at least one response is received within the time period.
Claim 13
Dependent Claim
16 words
The method of claim 10 wherein the hop count increment is increased exponentially with each iteration.
Claim 14
Dependent Claim
85 words
The method of claim 9 , further comprising, subsequent to the step of increasing the hop count, the steps of: receiving the at least one response within the time period in the form of a secure unicast transmission from at least one seed node or keyed node which includes the cryptographic key; decrypting the secure unicast transmission to obtain the cryptographic key; and converting the requesting node into a keyed node capable of providing the cryptographic key to other requesting nodes located on the internetwork.
Claim 15
Dependent Claim
31 words
The method of claim 9 wherein the cryptographic key is requested by the requesting node to decrypt data being transmitted over a secure multicast transmission between members of a multicast group.
Claim 16
Dependent Claim
33 words
The method of claim 9 wherein the multicast request made by the requesting node to the one or more seed nodes and the one or more keyed nodes is neither authenticated nor encrypted.
Claim 17
Dependent Claim
15 words
The method of claim 12 wherein the secure unicast transmission is performed using unicast SKIP.
Claim 18
Independent Claim
219 words
An apparatus embedded in one or more seed nodes and one or more keyed nodes which securely distributes a cryptographic key, initially located on the one or more seed nodes, to a requesting node wherein the one or more seed nodes, the one or more keyed nodes, and the requesting node are each coupled to one or more networks in an internetwork, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, the apparatus comprising: a mechanism embedded in one or more nodes selected from a group consisting of the one or more seed nodes and the one or more keyed nodes, the mechanism being configured to receive a multicast transmission request for the cryptography key from the requesting node; a mechanism embedded in one or more nodes selected from a group consisting of the one or more seed nodes and the one or more keyed nodes, the mechanism being configured to encrypt the cryptographic key; and a mechanism embedded in one or more nodes selected from a group consisting of the one or more seed nodes and the one or more keyed nodes, the mechanism being configured to transfer the encrypted cryptographic key to the requesting node with a secure unicast transmission.
Claim 19
Independent Claim
219 words
An apparatus embedded in one or more seed nodes and one or more keyed nodes which securely distributes a cryptographic key, initially located on the one or more seed nodes, to a requesting node wherein the one or more seed nodes, the one or more keyed nodes, and the requesting node are each coupled to one or more networks in an internetwork, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, the apparatus comprising: a mechanism embedded in one or more nodes selected from a group consisting of the one or more seed nodes and the one or more keyed nodes, the mechanism being configured to receive a multicast transmission request for the cryptography key from the requesting node; a mechanism embedded in one or more nodes selected from a group consisting of the one or more seed nodes and the one or more keyed nodes, the mechanism being configured to encrypt the cryptographic key; and a mechanism embedded in one or more nodes selected from a group consisting of the one or more seed nodes and the one or more keyed nodes, the mechanism being configured to transfer the encrypted cryptographic key to the requesting node with a secure unicast transmission.
Claim 20
Dependent Claim
99 words
The apparatus of claim 16 wherein the mechanism configured to receive is further comprised of: a mechanism configured to determine if the requesting node making the multicast request has permission to receive the cryptographic key by performing the following steps, a mechanism configured to compare the identity of the requesting node with an authenticated predetermined list of nodes having permission to receive the cryptographic key; and a mechanism configured to respond to the multicast request if the comparing mechanism indicates the requesting node is a member of the predetermined list of nodes having permission to receive the cryptographic key.
Claim 21
Dependent Claim
77 words
The apparatus of claim 17 , having a mechanism to convert the requesting node into a keyed node capable of distributing the cryptographic key to a subsequent requesting node, further comprising: a mechanism configured to receive a multicast transmission request for the cryptographic key from a subsequent requesting node; a mechanism configured to encrypt the cryptographic key; and a mechanism configured to transfer the encrypted cryptographic key to the subsequent requesting node with a secure unicast transmission.
Claim 22
Dependent Claim
31 words
The apparatus of claim 16 wherein the cryptographic key is requested by the requesting node to decrypt data being transmitted over a secure multicast transmission between members of a multicast group.
Claim 23
Dependent Claim
33 words
The apparatus of claim 16 further including the step of including the one or more seed nodes, the one or more keyed nodes, and the requesting nodes as members of a multicast group.
Claim 24
Dependent Claim
49 words
The apparatus of claim 16 further including an apparatus configured to distribute the one or more seed nodes over the internetwork to minimize the distance over the internetwork between each member of the multicast group on the internetwork and a seed node or a keyed node on the internetwork.
Claim 25
Dependent Claim
23 words
The apparatus of claim 16 wherein the multicast request made from the requesting node to the seed node is neither authenticated nor encrypted.
Claim 26
Dependent Claim
15 words
The apparatus of claim 16 wherein the secure unicast transmission is performed using unicast SKIP.
Claim 27
Independent Claim
202 words
An apparatus embedded in a requesting node coupled to a network on an internetwork configured to obtain a cryptographic key from one or more seed nodes and one or more keyed nodes coupled to one or more different networks on the internetwork, wherein each of the one or more seed nodes and the one or more keyed nodes are capable of transmitting the cryptographic key to the requesting node, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, the apparatus comprising: a mechanism configured to generate a multicast request for the cryptographic key; a mechanism configured to transmit the multicast request for the cryptographic key a predetermined number of hops over the internetwork directed to the one or more seed nodes and the one or more keyed nodes coupled to the internetwork; a mechanism configured to delay a time period for at least one response from at least one seed node or keyed node coupled to the network; and a mechanism configured to increase the hop coount by a hop count increment when the at least one response is not received within the time period.
Claim 28
Independent Claim
202 words
An apparatus embedded in a requesting node coupled to a network on an internetwork configured to obtain a cryptographic key from one or more seed nodes and one or more keyed nodes coupled to one or more different networks on the internetwork, wherein each of the one or more seed nodes and the one or more keyed nodes are capable of transmitting the cryptographic key to the requesting node, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, the apparatus comprising: a mechanism configured to generate a multicast request for the cryptographic key; a mechanism configured to transmit the multicast request for the cryptographic key a predetermined number of hops over the internetwork directed to the one or more seed nodes and the one or more keyed nodes coupled to the internetwork; a mechanism configured to delay a time period for at least one response from at least one seed node or keyed node coupled to the network; and a mechanism configured to increase the hop coount by a hop count increment when the at least one response is not received within the time period.
Claim 29
Dependent Claim
25 words
The apparatus of claim 24 wherein the mechanism configured to increase the hop count increases the hop count increment exponentially each time it is operated.
Claim 30
Dependent Claim
85 words
The apparatus of claim 24 , further comprising: a mechanism configured to receive the at least one response, within the time period, in the form of a secure unicast transmission from at least one seed node or keyed node which includes the cryptographic key; a mechanism configured to decrypt the secure unicast transmission to obtain the cryptographic key; and a mechanism configured to convert the requesting node into a keyed node capable of providing the cryptographic key to other requesting nodes located on the internetwork.
Claim 31
Dependent Claim
31 words
The apparatus of claim 24 wherein the cryptographic key is requested by the requesting node to decrypt data being transmitted over a secure multicast transmission between members of a multicast group.
Claim 32
Dependent Claim
33 words
The apparatus of claim 24 wherein the multicast request made by the requesting node to the one or more seed nodes and the one or more keyed nodes is neither authenticated nor encrypted.
Claim 33
Dependent Claim
15 words
The apparatus of claim 24 wherein the secure unicast transmission is performed using unicast SKIP.
Claim 34
Dependent Claim
181 words
A computer data signal embodied in a carrier wave and representing sequences of instructions which, when executed by a processor, causes one or more seed nodes and one or more keyed nodes to securely distribute a cryptographic key, initially located on the one or more seed nodes, to a requesting node wherein the one or more seed nodes, the one or more keyed nodes, and the requesting node are each coupled to one or more networks in an internetwork, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, by performing the following steps of: receiving at a node selected from a group consisting of the one or more seed nodes and the one or more keyed nodes a multicast transmission request for the cryptographic key from the requesting node; encrypting the cryptographic key at the node selected in the receiving step; and transferring from the node selected in the receiving step the encrypted cryptographic key to the requesting node with a secure unicast transmission.
Claim 35
Dependent Claim
181 words
A computer data signal embodied in a carrier wave and representing sequences of instructions which, when executed by a processor, causes one or more seed nodes and one or more keyed nodes to securely distribute a cryptographic key, initially located on the one or more seed nodes, to a requesting node wherein the one or more seed nodes, the one or more keyed nodes, and the requesting node are each coupled to one or more networks in an internetwork, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, by performing the following steps of: receiving at a node selected from a group consisting of the one or more seed nodes and the one or more keyed nodes a multicast transmission request for the cryptographic key from the requesting node; encrypting the cryptographic key at the node selected in the receiving step; and transferring from the node selected in the receiving step the encrypted cryptographic key to the requesting node with a secure unicast transmission.
Claim 36
Dependent Claim
90 words
The data signal embodied in a carrier wave of claim 30 wherein the receiving step further comprises the steps of: determining if the requesting node making the multicast request has permission to receive the cryptographic key by performing the following steps, comparing the identity of the requesting node with an authenticated list of nodes having permission to receive the cryptographic key; and responding to the multicast request if the comparing step indicates the requesting node is a member of the list of nodes having permission to receive the cryptographic key.
Claim 37
Dependent Claim
72 words
The data signal embodied in a carrier wave of claim 30 further comprising the step of converting the requesting node into a keyed node by configuring the requesting node to perform a method comprising the following steps of: receiving a multicast transmission request for the cryptographic key from a subsequent requesting node; encrypting the cryptographic key; and transferring the encrypted cryptographic key to the subsequent requesting node with a secure unicast transmission.
Claim 38
Dependent Claim
37 words
The data signal embodied in a carrier wave of claim 30 wherein the cryptographic key is requested by the requesting node to decrypt data being transmitted over a secure multicast transmission between members of a multicast group.
Claim 39
Dependent Claim
39 words
The data signal embodied in a carrier wave of claim 30 further including the step of including the one or more seed nodes, the one or more keyed nodes, and the requesting nodes as members of a multicast group.
Claim 40
Dependent Claim
54 words
The data signal embodied in a carrier wave of claim 34 further including the step of distributing the one or more seed nodes over the internetwork to minimize the distance over the internetwork between each member of the multicast group on the internetwork and a seed node or a keyed node on the internetwork.
Claim 41
Dependent Claim
29 words
The data signal embodied in a carrier wave of claim 30 wherein the multicast request made by the requesting node to the seed node is neither authenticated nor encrypted.
Claim 42
Dependent Claim
21 words
The data signal embodied in a carrier wave of claim 30 wherein the secure unicast transmission is performed using unicast SKIP.
Claim 43
Dependent Claim
221 words
A computer data signal embodied in a carrier wave and representing sequences of instructions which, when executed by a processor, causes a requesting node coupled to a network on an internetwork to obtain a cryptographic key from one or more seed nodes and one or more keyed nodes coupled to one or more different networks on the internetwork, wherein each of the one or more seed nodes and the one or more keyed nodes are capable of transmitting the cryptographic key to the requesting node, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, by performing the following steps of: generating a multicast request for the cryptographic key; transmitting the multicast request for the cryptographic key a predetermined number of hops over the internetwork directed to the one or more seed nodes and the one or more keyed nodes coupled to the internetwork; waiting for at least one response from at least one seed node or keyed node coupled to the network; and when the at least one response is not received within a time period, increasing the hop count by a hop count increment and repeating the above steps of generating a multicast request, transmitting the multicast request, and delaying a time period.
Claim 44
Dependent Claim
221 words
A computer data signal embodied in a carrier wave and representing sequences of instructions which, when executed by a processor, causes a requesting node coupled to a network on an internetwork to obtain a cryptographic key from one or more seed nodes and one or more keyed nodes coupled to one or more different networks on the internetwork, wherein each of the one or more seed nodes and the one or more keyed nodes are capable of transmitting the cryptographic key to the requesting node, and wherein the keyed nodes are those nodes which receive the cryptographic key after requesting and receiving the cryptographic key from a seed or keyed node, by performing the following steps of: generating a multicast request for the cryptographic key; transmitting the multicast request for the cryptographic key a predetermined number of hops over the internetwork directed to the one or more seed nodes and the one or more keyed nodes coupled to the internetwork; waiting for at least one response from at least one seed node or keyed node coupled to the network; and when the at least one response is not received within a time period, increasing the hop count by a hop count increment and repeating the above steps of generating a multicast request, transmitting the multicast request, and delaying a time period.
Claim 45
Dependent Claim
44 words
The method of claim 38 further including the step of iteratively performing the steps of generating a multicast request, transmitting the multicast request, delaying a time period, and increasing the hop count until the at least one response is received within the time period.
Claim 46
Dependent Claim
23 words
The computer data signal embodied in a carrier wave of claim 39 wherein the hop count increment is increased exponentially with each iteration.
Claim 47
Dependent Claim
92 words
The computer data signal embodied in a carrier wave of claim 38 , further comprising, subsequent to the step of increasing the hop count, the steps of: receiving the at least one response within the time period in the form of a secure unicast transmission from at least one seed node or keyed node which includes the cryptographic key; decrypting the secure unicast transmission to obtain the cryptographic key; and converting the requesting node into a keyed node capable of providing the cryptographic key to other requesting nodes located on the internetwork.
Claim 48
Dependent Claim
38 words
The computer data signal embodied in a carrier wave of claim 38 wherein the cryptographic key is requested by the requesting node to decrypt data being transmitted over a secure multicast transmission between members of a multicast group.
Claim 49
Dependent Claim
40 words
The computer data signal embodied in a carrier wave of claim 38 wherein the multicast request made by the requesting node to the one or more seed nodes and the one or more keyed nodes is neither authenticated nor encrypted.
Claim 50
Dependent Claim
22 words
The computer data signal embodied in a carrier wave of claim 41 wherein the secure unicast transmission is performed using unicast SKIP.
Claim 51
Dependent Claim
24 words
The method of claim 1 wherein the group has at least two nodes capable of securely distributing the cryptographic key to the requesting node.
References Cited (Backward Citations)
US5109384A
Cited
US5369705A
Cited
EP0575279A2
Cited
US5729608A
Cited
US5668877A
Cited
US5748736A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-12-10 | 2005-06-11 | 2005-12-11 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-12-10 | 2009-06-11 | 2009-12-11 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-12-10 | 2013-06-11 | 2013-12-11 | $7700.00 | Window Closed / Lapsed |