Application layer multicast (ALM) has been proposed to overcome current limitations in IP multicast. We address, for the first time, offering data confidentiality in ALM. To achieve confidentiality, a node may need to continuously re-encrypt packets before forwarding them downstream. Furthermore, keys have to be changed whenever there is a membership change, leading to re-key processing overhead at the nodes. For a large and dynamic group, these re-encryption and re-keying operations incur high processing overhead at the nodes. We introduce a scalable scheme called Secure Overlay Multicast (SOM) which clusters ALM peers so as to localize re-keying within a cluster and to limit re-encryption at cluster boundaries, thereby minimizing the total nodal processing overhead. We describe the op...[ Read more ]

Application layer multicast (ALM) has been proposed to overcome current limitations in IP multicast. We address, for the first time, offering data confidentiality in ALM. To achieve confidentiality, a node may need to continuously re-encrypt packets before forwarding them downstream. Furthermore, keys have to be changed whenever there is a membership change, leading to re-key processing overhead at the nodes. For a large and dynamic group, these re-encryption and re-keying operations incur high processing overhead at the nodes. We introduce a scalable scheme called Secure Overlay Multicast (SOM) which clusters ALM peers so as to localize re-keying within a cluster and to limit re-encryption at cluster boundaries, thereby minimizing the total nodal processing overhead. We describe the operations of SOM and compare its nodal processing overhead with two other basic approaches, namely, host-to-host encryption and whole group encryption. We present an analytic model for SOM and show that there exists an optimal cluster size to minimize the total nodal processing overhead. By comparing with a recently proposed ALM scheme (DT protocol), SOM achieves substantial reduction in nodal processing overhead with similar network performance in terms of network stress and delay.