System and method for secure group communications via multicast or broadcast

A system for implementing a secure multicast group in a scalable manner, said system including:

• a group security controller;
• a trusted intermediary server which communicates with the group security controller over a multicast network;
• and
• at least a first receiver which communicates with the trusted intermediary server over a second multicast network, wherein the trusted intermediary server is programmed with software for responding to a request from a prospective group member to join the secure multicast group by performing an authorization operation, and upon successful completion of the authorization operation determining a new group key and sending the new group key to the prospective group member and to the first receiver over the second multicast network.

A system for implementing a secure multicast group in a scalable manner, said system including:

• a group security controller;
• a first trusted intermediary server which communicates with the group security controller over a first multicast network;
• a second trusted intermediary server which communicates with the first trusted intermediary server over a second multicast network;
• and
• at least a first receiver which communicates with the second trusted intermediary server over a third multicast network, wherein the second trusted intermediary server is programmed with software for responding to a request from a prospective group member to join the secure multicast group by performing an authorization operation, and upon successful completion of the authorization operation determining a new group key and sending the new group key to the prospective group member over a secure channel and to the first receiver over the third multicast network.

A method for implementing a secure multicast group in a scalable manner, said method including the steps of:

• in response to a request from a prospective group member to join the secure multicast group, operating a first device to perform an authorization operation;
• upon successful completion of the authorization operation, operating the first device to determine a new group key, and causing the new group key to be sent from the first device to the prospective group member over a unicast communication line and to current members of at least a sub-group of the group over a multicast network;
• and
• in response to a request to cause a first current member of the sub-group to leave said sub-group, operating the first device to determine a second new group key, and causing the second new group key to be sent to current members of the sub-group, other than said first current member, over said multicast network.

A method for adding a new receiver to an existing group of receivers, the group currently receiving data over a multicast network, said data being encrypted with one of a first group key or a third key encrypted with said first group key, and said data being distributed via at least one of a group security controller and a sender, said method comprising the steps of:

• transmitting a request to join the existing group of receivers by the new receiver to the group security controller;
• performing an authorization procedure which includes supplying a second group key to the new receiver from the group security controller, said authorization procedure being carried out over a unicast communication line;
• transmitting the second group key encrypted with the first group key to the existing group of receivers over the multicast network;
• and
• transmitting data over the multicast network encrypted with one of the second group key or a fourth key encrypted with said second group key.

A network protocol method for dropping a receiver from a group of receivers, the group currently receiving data over a multicast network encrypted with a first group key, said data being distributed via at least one of a group security controller and a sender, said method comprising the steps of:

• generating, at the group security controller, a second group key;
• distributing the second group key to each of the receivers remaining in the group;
• and
• transmitting data over the multicast network encrypted with the second group key.