Key management protocol

A key distribution system for a communications group, the key distribution system comprising:

• an encryption key distribution server including means for maintaining a tree of nodes including a root node that has at least one child node, and at least one leaf node that has a parent node,
• the distribution server including means for servicing a communication group comprising at least one member client device, wherein a served encryption key defined in a server memory device comprises a join field and a leave field, and wherein:
• each member client device of the group knows the join field of the encryption key;
• each node of the key distribution system is associated with a leave key;
• the leave field of the encryption key is derived from the leave key of the root node;
• and
• the first key of parent nodes in the tree is generated from the first key of each of its child nodes by two one-way functions and a mixing function, the mixing function including an offset representing a distance between two chains of one-way functions, as a parameter.