µSTR. Original STR ([7]) is a CGKA protocol suite that ar- ranges members in a binary tree structure from Figure 3. The tree has two kinds of nodes: leaf and internal nodes. An internal node INi has two children: a lower internal node INi−1 and a leaf node LNi. (IN1 = LN1 is the only excep- tion). In the following we describe the structure of the group IN4 k4 IN3 k3,K3 r4,R4 M4 IN2 k2,K2 r3,R3 LN3 M3 r1,R1 r2,R2 LN2 k1 = r1 K1 = R1 key in ECC. Each LNi is associated with member (device) Mi and contains its secretly chosen session random ri. Its public version is Ri = riG. Each INi is associated with a secret key ki and its public counterpart Ki = kiG. Every LN4 IN1 = LN1 M1 M2 Figure 3. STR binary tree (n = 4) structure. CLIQUES mixes unicast and broadcast commu- nication to achieve a better communication performance, since unicast communication requires less costs. Our ellip- tic curve equivalent µCLIQUES is given in Figure 2 with Mn as controller. In additive events new members are ap- pended to the end of the list. To achieve key independence the controller changes its random value r′. Last appended member becomes a controller for the next additive event. The new group key is computed in the same manner as in the setup protocol, except for the difference that the com- putation process starts from the controller’s position in the list. In subtractive events the set of leaving members L is • 1 ≤ i ≤ n − 2: Mi selects random ri ∈R {1, . . . , t − 1}, and unicasts Zi = riZi−1 to Mi+1 . (note, Z1 = r1G) • Mn−1 selects random rn−1 ∈R {1, . . . , t − 1}, and broad- casts Zn−1 = rn−1 Zn−2 . • Mi sends Xx = Zn−1 /ri to Mn. • Mn broadcasts S = {Si = rnXi|1 ≤ i ≤ n}. Mi computes K = riSi = r1r2 . . . rnG with Si ∈ S. Figure 2. µCLIQUES Setup deleted from the list. The controller that is the most recent remaining member chooses new random value r′ and com- putes S′ = {S′ = r′Si|1 ≤ i ≤ n ∧ i ƒ∈ L}. Upon receiv- ing S′ other members compute the new group key as in the last step of the setup protocol. If the controller is a leaving member then any other member can take over its role, as- suming it has saved the previous set S. (µ)CLIQUES do not provide verifiable trust relationship, because no other mem- ber can check whether values Zi or Xi forwarded by Xx, or the set S broadcasted by the controller are correctly built. ki = riki−1G, i > 1 (note that k1 = r1) is computed using tree-based Xxxxxx-Xxxxxxx key exchange method [8] in two different ways: ki = map(riKi−1) or ki ...
µSTR. H protocol suite In this section we describe a CGKA protocol suite for heterogeneous mobile ad-hoc groups, called µSTR-H that results from optimization of communication-efficient STR protocols [10].
