Hierarchical multicast traffic security system in an internetwork

A method for transmitting a multicast data packet in an internetwork from a source node to a destination node, the method comprising:

• encrypting at the source node the multicast data packet to create an encrypted multicast data packet having a first source address field specifying an address of the source node and a first destination address field specifying an multicast address recognized by the destination node;
• transmitting the encrypted multicast data packet to a security broker in a security domain of which the source node and security broker are members;
• decrypting the encrypted multicast data packet at the security broker;
• encrypting at the security broker the multicast data packet to create an encrypted multicast packet having the second source address field specifying the address of the security broker and the second destination address field specifying the multicast address recognized by the destination node;
• encapsulating at the security broker the encrypted multicast data packet to create an encapsulated encrypted multicast data packet having a third source address field specifying the address of the security broker and a third destination address field specifying a multicast address recognized by a border router in the security domain;
• transmitting the encapsulated encrypted multicast data packet to the border router;
• receiving and decapsulating the encapsulated encrypted multicast data packet at the border router;
• encapsulating at the border router the encrypted multicast data packet to create an encapsulated encrypted multicast data packet having the third source address field specifying the address of the border router and the third destination address field specifying an address recognized by a second security broker in a second security domain shared with the border router;
• and
• transmitting the encapsulated encrypted multicast data packet to the second security broker.

A method for transmitting a multicast data packet, comprising:

• a) encrypting the multicast data packet to create an encrypted multicast data packet having two source address fields each specifying an address of a source node and two destination address fields each specifying a multicast address recognized by a destination node;
• b) transmitting the encrypted multicast data packet in a security domain shared by the source node;
• c) decrypting the encrypted multicast data packet at a security broker in the security domain;
• d) modifying one of the source address fields to specify an address of the security broker;
• e) encapsulating the multicast data packet with a third source address field specifying the address of the security broker and a third destination address field specifying an address recognized by a border router in the security domain;
• f) transmitting the encapsulated multicast data packet to the border router;
• g) receiving the encapsulated multicast data packet at the border router;
• h) modifying the third source address field to specify the address of the border router and the third destination address field to specify a unicast address recognized by a second security broker in a second security domain shared with the border router;
• and
• i) transmitting the encapsulated multicast data packet to the second security broker.

An article of manufacture comprising a computer usable medium having computer readable program code embodied therein to cause a multicast data packet to be transmitted, comprising:

• computer readable program code to encrypt the multicast data packet to create an encrypted multicast data packet having two source address fields each specifying an address of a source node and two destination address fields each specifying a multicast address recognized by a destination node;
• computer readable program code to transmit the encrypted multicast data packet in a security domain shared by the source node;
• computer readable program code to decrypt the encrypted multicast data packet at a security broker in the security domain;
• computer readable program code to modify one of the source address fields to specify an address of the security broker;
• computer readable program code to encapsulate the multicast data packet with a third source address field specifying the address of the security broker and a third destination address field specifying a multicast address recognized by a border router in the security domain;
• and
• computer readable program code to transmit the encapsulated multicast data packet to the border router.