Distributed group key management for multicast security

A computer-implemented method comprising:

• selecting a first key set including an initial common group key and a replacement common group key;
• encrypting said first key set using a set of one or more keys;
• distributing said encrypted first key set to a set of one or more key servers;
• each of said set of one or more key servers performing the following,
• receiving said encrypted first key set,
• decrypting the encrypted first key set, and
• distributing to clients of that key server that are currently members of a multicast group the initial common group key as a current common group key for the multicast group, wherein the replacement common group key is not distributed to the members at this time;
• and
• responsive to a need to re-key the current common group key, performing the following
• at least partially in parallel,
• distributing to said set of one or more key servers an encrypted second key set including a different initial common group key and replacement common group key, and
• each of said set of one or more key servers distributing to their clients who are currently members of said multicast group the replacement common group key from the first key set as the current common group key.

One or more machine-readable media having stored thereon one or more sequences of instructions that when executed cause the following:

• an initiator key server distributing to a plurality of key servers a first key set including an initial common group key and a replacement common group key;
• initially distributing the initial common group key, but not the replacement common group key, to clients of the plurality of key servers that are currently members of a multicast group as a current common group key for multicast messages;
• responsive to a first need to re-key the current common group key of the multicast group, each of the key servers subsequently distributing to their clients that are currently members of the multicast group the previously distributed replacement common group key as the current common group key;
• and
• wherein said subsequently distributing is performed at least in part in parallel with said initiator key server distributing to the plurality of key servers a second key set including a different initial common group key and replacement common group key.

One or more machine-readable media having stored thereon one or more sequences of instructions that when executed cause the following:

• said first key server decrypting an encrypted first key set including an initial common group key and a replacement common group key, said encrypted first key set having been received over a network;
• said first key server initially distributing to clients of said first key server that are currently members of a multicast group the initial common group key as a current common group key;
• responsive to a need to re-key the current common group key of the multicast group, said first key server subsequently distributing to clients of said first key server that are currently members of said multicast group the replacement common group key as the current common group key;
• and
• wherein said first key server receives from said second key server an encrypted second key set including a different initial common group key and replacement common group key.

One or more machine-readable media having stored thereon one or more sequences of instructions that when executed cause the following:

• selecting a first key set including an initial common group key and a replacement common group key;
• encrypting said first key set using a set of one or more keys;
• distributing said encrypted first key set to a set of one or more key servers;
• each of said set of one or more key servers performing the following,
• decrypting said encrypted first key set, and
• distributing to clients of that key server that are currently members of a multicast group the initial common group key as a current common group key for the multicast group, wherein the replacement common group key is not distributed to the members at this time;
• selecting a second key set including a different initial common group key and replacement common group key;
• encrypting said second key set;
• distributing said encrypted second key set to said set of one or more key servers;
• and
• each of said set of one or more key servers performing the following,
• receiving said encrypted second key set,
• decrypting the encrypted second key set, and
• responsive to a second need to re-key the current common group key, distributing the initial common group key from the second key set to clients of that key server that are currently members of the multicast group..