Methods and apparatus for system having denial of services (DOS) resistant multicast

A non-transitory processor readable medium storing code representing instructions configured to be executed by a processor, the code comprising code to cause the processor to:

• receive, during a first time period, first data for routing to a group via a first multicast address, the first multicast address based, at least in part on a first group key;
• perform a calculation on at least one shared secret to determine a first accepted group key associated with the first time period;
• send the first data to the group via the first multicast address in response to the first group key matching the first accepted group key;
• receive, during a second time period after the first time period, second data for routing to the group via a second multicast address that is different from the first multicast address, the second multicast address based, at least in part, on a second group key that is different from the first group key;
• perform a calculation on the at least one shared secret to determine a second accepted group key associated with the second time period, the second accepted group key different from the first accepted group key;
• send the second data to the group via the second multicast address in response to the second group key matching the second accepted group key
• depreciate, at a first time, the first accepted group key;
• receive, during a third time period occurring after the first time, third data for routing to the group via the first multicast address;
• and
• drop the third data based on the first multicast address being depreciated before the third time period.

An apparatus, comprising:

• an input port configured to receive a plurality of data packets for distribution to a group, each data packet from the plurality of data packets including a multicast address from a plurality of multicast addresses;
• a processor operatively coupled to the input port, the processor configured to:
• calculate, at a first time from a plurality of times, a first group key from a plurality of group keys, the first group key calculated based on a first shared secret, the first group key associated with the group and a first time period;
• calculate, at a predetermined time after the first time, a second group key from the plurality of group keys, the second group key calculated based on a second shared secret, the second group key associated with the group and a second time period;
• manage the plurality of group keys such that at any time from the plurality of times at least one accepted group key exists, the at least one accepted group key being from the plurality of group keys;
• compare at least a portion of each multicast address from the plurality of multicast addresses to a value determined based on an accepted group key from the at least one accepted group key;
• monitor a frequency with which the multicast address from the plurality of multicast addresses received at the input port does not match the at least one accepted group key;
• and
• send an indication of an attack to a compute device associated with an administrator when the frequency exceeds a predetermined threshold;
• and
• an output port operatively coupled to the processor, the output port configured to send a first data packet from the plurality of data packets to the group, the first data packet including a first multicast address from the plurality of multicast addresses, the output port configured to send the first data packet to the group in response to the processor indicating that a portion of the first multicast address is associated with the group and matches the value determined based on the accepted group key from the at least one accepted group key.