Group Membership Operations. A comprehensive group key agreement must handle adjustments to group secrets subsequent to all membership operations in the underlying group communication system. We distinguish among single and multiple member operations. Single mem- ber changes include member addition or deletion. This occurs when a member wants to join(or leave) a group. Multiple member changes also include addition and deletion: Member Join and Leave . We refer to the multiple addition oper- ation as Group Merge , in which case two or more groups merge to form a single group. We refer to the multiple leave operation as Group Partition , whereby a group is split into smaller groups. Group Merge and Partition event are com- mon owing to network misconfiguration and router failures. Hence, dealing with Group Partition and Merge is a crucial component of group key agreement. In addition to the single and multiple membership operations, periodic re- freshes of group secrets are advisable so as to limit the amount of ciphertext gen- erated with the same key and to recover from potential compromise of member’s contribution or prior session keys. Key Refresh is one of the most important security requirements of a group key agreement. The special member, referred to as sponsor, is responsible for broadcasting all link values of the current tree to the members. Note that the sponsor is not a privileged member. His task is only to broadcast the current tree information to the group members. Any current member could perform this task. We assume that every member can unambiguously determine both the sponsors and the insertion location in the key tree. Key Refresh operation can be considered to be a special case of Member Leave without any members actually leaving the group. Group key agreement of dynamic group must provide four security proper- ties: Group key secrecy is basically supported property in group communication. Forward secrecy means that any leaving member from a group can not gener- ate new group key. Backward secrecy means that any joining member into a group can not discover previously-used group key. The combination of backward secrecy and forward secrecy forms key independence.
Group Membership Operations. A good group key agreement system must be able to handle adjustments in a simple, efficient, and secure manner. Adjustments are taken place when members attempt to join (Member Join) or leave (Member Leave) the group. In the proposed scheme, a quad tree is adopted as the underlying key tree. Each individual member in the system is assigned to a leaf node of the key tree, and each node of the key tree is associated with a key which is shared by all the members of the subtree rooted at this node. A member can use his /her own private secret and some public information to derive the keys on the path from its leaf node to the root, which is also called the key path. When a Member Join event happens, a new node will be inserted into the key tree, and the new member is assigned to the new node. The keys on the key path of the new node should be refreshed for assuring backward secrecy. When a Member Leave event happens, the node assigned to the leaving member should be deleted form the tree, and the keys on the key path of the deleted node should be refreshed for assuring forward secrecy. All communication channels are considered public but authentic in the proposed protocol.
