An Efficient Structure for LKH Key Tree on Secure Multicast Communications

Naoshi SakamotoTokyo Denki University,

Tokyo, Japansakamoto@c.dendai.ac.jp

Abstract—In order to communicate in cipher over IP multi-cast, each of joining and leaving participants causes renewingkeys. Moreover, the number of renewed keys depends on thekey management system. LKH, one of the key managementsystems, uses a tree structure to manage keys to share withparticipants. Every node of the tree is given a key, and each leafof the tree is corresponding to a participant. If all members arehandled equally, by using a balanced binary tree, the averagenumber of renewed keys per join and leave is estimated at⌈log2 n⌉, where n denotes the number of participants.

In this study, we introduce a scenario that the key manage-ment system can distinguish between inconstant members andstable members, instead of handling members equally. Underthis scenario, our system improves the number of renewingkeys efficiently by considering another tree structure againstthe balanced binary tree structure.

Keywords-IP Multicast; IPsec; GSAKMP; LKH

I. INTRODUCTION

Some video conferences using multicast communicationrequire avoiding a wire tapping. That is, they must communi-cate in safe. IPsec is a framework of secure communicationson IP. In order to manage keys for secure communicationson IP, IKE for unicast and GSAKMP for multicast are used.

For GSAKMP, LKH is proposed as a method to managekeys[1]. In LKH, the key management is based on a keytree, where each of all its nodes corresponds to a key, andeach of all its leaves is corresponded to a participant. It isreported that the balanced binary tree is efficient for a keytree when every member would be handled equally[2].

Meanwhile, it is reported that for some services on theInternet, the fluctuation of the frequency in use stronglydepends on days of the week[3]. According to such inves-tigations, we are expecting that the good user model willbe found in future so that this will be able to estimatethe load of the service well. In this study, we propose anefficient method to manage key for multicast communicationin cipher by assuming that the administrator can obtain theinformation of users’ behavior. While the users are handledequally in the former studies, we take special care with theusers that frequently cause renewing keys. Then, we showthe condition that our method is more efficient than formerones.

In this paper, in section II, we explain the secure multicastcommunication and the related studies. Then, we show and

analyze our method in section III. Finally, in section IV, weconclude our study.

II. SECURE COMMUNICATION AND KEY MANAGEMENT

A. Basic concept

We assume that the base of logarithms is two.The system of multicast communication in cipher requires

not only the same join and leave management as normalmulticast communication, but also the key management. Inthis paper, we assume that this can manage the users suchthat:

• the users are registered in advance,• once a user declares her join, she is enabled to receive

data (we call a joining user a participant),• then, after she declares her leave, she can receive

nothing anymore.Then, this yields that this system must use the keys where

• those who have already left can not decrypt, and• whoever joins can decrypt.

Moreover, the key to decrypt data should be shared by theall participants. Thus, the keys must be renewed in safe forevery joins and leaves. In order to manage joins and leavesand rekey, we assume a key server is installed in the system.

Moreover, we assume that the key server creates log filesso that we can obtain the statistical information with respectto users’ behavior.

B. Framework of secure multicast communication over theInternet

Security Architecture for Internet Protocol (IPsecRFC4301) basically employs a shared key cryptosystem.For safety’s sake, the key management protocol renewskeys whenever a period of time elapses, and the group ofparticipants is renewed.

Group Secure Association Key Management Protocol(GSAKMP RFC4535) is a key management protocol forsecure multicast communication. This organizes and man-ages a group to be protected by secure communication. Thisassumes the key server to manage participants and keys.GSAKMP uses the following two types of key. A trafficencryption key (TEK) denotes the encryption key to protectdata communication channels. On the other hand, a keyencryption key (KEK) denotes the encryption key to encrypt

978-1-4799-5604-3/14/$31.00 copyright 2014 IEEE SNPD 2014, June 30-July 2, 2014, Las Vegas, USA

Figure 1. Key tree of LKH

TEKs in order to distribute TEKs in secure. GSAKMP canapply LKH to rekey efficiently.

C. LKH

LKH(Logical Key Hierarchy [1]) is a method to distributekeys efficiently via multicast for GSAKMP. In LKH, the keyserver manages keys by using a tree structure(see Figure 1.)We call such tree in Figure 1 a key tree. Firstly, the keyserver generates a tree so that each leaf is corresponding toa participant each. Secondly, it generates KEKs and corre-sponds each KEK to a node of the tree each. These KEKsare different from each other. Finally, for each participantp, the key server distributes a key set that consists of anyKEKs over the path from the root to the leaf correspondingto p in the key tree.

For instance, in Figure 1, u1, the most left participant, hasKEK k1, k9, k13, and k15. Note that though the key tree isa binary tree in Figure 1, any ordinal trees are also availablefor a key tree. Nevertheless, we assume that any key treeare all binary trees in this paper.

Now, we show how the key server rekeys for the key treein Figure 1 as follows. Firstly, we explain the action of theperiodic rekeying that is independent of a join and a leave.The periodic rekeying does not need to exclude the particularmembers. Thus, the key server encrypts a new TEK withthe root key k15, and distributes it to all participants viamulticast. Since the all participants share k15, they obtainthe new TEK. This requires only one new TEK.

Secondly, we explain the rekey process for a join and aleave. When a participant leaves, the key server must renewnot only the TEKs, but also the KEKs for all of the leftparticipants. Suppose that participant u1 leaves. Then, k1must be discard, and k9, k13 and k15 must be renewed sinceu1 has owned them. Let new KEKs with respect to theremaining k9, k13 and k15 be k′9, k′13 and k′15 respectively.The key server distributes these new keys, k′9, k′13 and k′15,to the participants by encrypting with KEKs. Note that thekey server uses multicast communication so that it reduces

the number of communications as follows:1) For u5, u6, u7 and u8, it is necessary to renew only

k15. Since they share k14, the key server encrypts thenew key k′15 with k14, and distributes it via multicast.

2) For u3 and u4, it is necessary to renew KEK k15 andk13. Since they share k10, the key server encrypts thekey set that consists of the new key k′15 and k′13 withk10, and distributes it via multicast.

3) Finally, since u2 has KEK k2, the key set that consistsof the new key k′15, k′13 and k′9 encrypted with k2, aredelivered to u2 via unicast.

On the other hand, when a participant joins, all keys onthe path from the root to the node corresponding to theparticipant are renewed and distributed by the same wayfor a leave.

Therefore, for every rekey, the sum of the number of eithercreated or discarded KEKs and renewing KEKs is equal tothe depth of the position of the node for the participant.When the key tree is balanced, the number of renewed keysper a rekey is at most ⌈logn⌉[2]. Moreover, we can estimatethe number of distributed keys as follows. Let the depth ofthe root be one. For a participant such that in her own KEKs,KEKs in depth up to d are being renewed, d KEKs are sentto her by encrypted with the unrenewing KEK in depth d+1that she owns. Thus, since KEKs on the path from the rootto a node in depth up to ⌈logn⌉ − 1 are entirely renewed,the number of distributed keys is given by

1 + 2 + ...+ ⌈logn⌉ − 1

=

⌈logn⌉−1∑i=1

i =⌈log n⌉2 − ⌈log n⌉

2.

D. Related works

On pay TV, it is ordinary that a contract happends to beconcluded and canceled not anytime, but for each program.Therefore, we can assume that we administer the process fora join and a leave only at some intervals. Wong, Gouda andLam provided Batch LKH, a method of key administrationfor this assumption[4]. That is, in Batch LKH, the processfor a join and a leave within a period is handled all at once.Since the root KEK key is renewed every rekey, rekeyingfor more than two of joins and leaves all at once in a periodreduces the number of renewed keys from rekeying every ajoin and a leave. While our method also reduces the numberof times of renewing keys, our method and Batch LKH canbe used together. Moreover, it is expected that using themtogether results more efficient.

Now, according to the former subsection, in LKH, thenumber of keys to renew per rekey depends on the depth ofa key tree. Thus, a balanced tree is considered to be mostefficient for the form of the key tree since the depth of thebalanced tree is shallowest. However, joining and leavingmay make the key tree unbalance gradually. Pegueroles and

Figure 2. Unbalanced key tree

Rico-Novella provided the Balanced Batch LKH[5]. Thisenables a key tree to keep balanced by reconstructing theform of the key tree every rekeying of Batch LKH.

On the other hand, the broadcast encryption[6] is con-nected with multicast communication in cipher. In thismethod, a sender transmits a bunch of keys to each par-ticipant in advance so that sender enables some group ofparticipants to communicate. Abdalla, Shavitt and Woolinvestigates about the number of key transmissions for thebroadcast encryption [7]. They estimated lower bound of thenumber of key transmissions theoretically, and proposed analgorithm for several type of relationships between partici-pants. Particularly, in Section 6.B, they evaluated it for treestructure. This is similar to ours. However, while they showthe upper-bound by using simulation, we show the upper-bound theoretically.

III. PROPOSAL METHOD

In this section, we propose our method. Despite otherrelated works, our method assumes that the key server canobtain some special information of users in advance.

A. Basic Concepts

When the key tree is managed in the form of a balancedbinary tree, the number of renewed keys per each of a joinand a leave is ⌈logM⌉, where M stands for the averagenumber of participants. This is considered to be the mostefficient, when each user joins and leaves independently withthe same probability.

Now, consider an unbalanced key tree like Figure 2. Inthe tree in this figure, when the participant a leaves, thenumber of renewed keys is equal to its depth ha. This isgreater than the number when the key tree is managed inthe form of a balanced tree. On the other hand, when theparticipant b leaves, the number of renewed keys is equal toits depth hb. This is less than the number when the key treeis managed in the form of a balanced tree. If the key servercould know that a certain participant leaves earlier than theother participants, it could reduce the number of renewed

Figure 3. Separability

keys by placing her node to the shallower part of the keytree.

From this idea, we propose more efficient structure of thekey tree then a balanced tree, when the key server can knowthe average number of participants and the join and leaverate.

B. How to construct a key tree

Our method requires to grasp the trend of users. Since thetrend might be affected by the individual characters of theusers and the contents of the service, it may not necessarilypossible to predict the users’ behavior by modeling the trend.

However, Pareto principle usually holds. This is a rule ofthumb; e.g., “20% of participants occupy 80% of resources”.

We assume that we can classify users into more than twogroups where one group contains users that join and leavefrequently and another group contains users that join andleave rarely. If Pareto principle holds with respect to theusers, this assumption can be realized by analyzing the logsof the communications of the users.

On the other hand, in administrating the multicast groups,users are often divided into plural groups in advance forthe network topology. Since for each group a key tree isprepared independently, our method can apply to each keytree separately.

Now, let G1, G2,... be user subgroups that are obtained.For each subgroup G1, G2, ..., let M1, M2, ... be theaverage number of participants in the subgroup respectively.Moreover, let λ1, λ2, ... be the join and leave rate of thesubgroup respectively.

Note that both Mi and λi have additivity. That is, forgroups G0 = G1 ∪G2, G1 ∩G2 = ∅, we have

M0 = M1 +M2,

λ0 = λ1 + λ2.

After this, we denote G = (M,λ) when we pay attention toonly M and λ in the discussion about group G.

C. Division into two groups

At first, we discuss that we divide user group into two.For group G = (M,λ), we discuss the condition how Gis divided into G1 = (M1, λ1) and G2 = (M2 = M −M1, λ2 = λ−λ1) in order to reduce the number of rekeys.

Figure 4. In the case of 0 ≤ r < 2m−2

Figure 5. In the case of 2m−2 ≤ r < 2m−1

Definition 1: G = (M,λ) is separable into G1 =(M1, λ1) and G2 = (M2 = M − M1, λ2 = λ − λ1)iff λ1(1 + ⌈logM1⌉) + (λ − λ1)(1 + ⌈logM −M1⌉) ≤λ⌈logM⌉.

Theorem 1: For G = (M,λ), let M = 2m−1 + r and0 ≤ r < 2m−1, where m is a positive integer and r is apositive real number. G is separable into G1 = (M1, λ1)and G2 = (M −M1, λ − λ1) if the following condition ofG1 holds:

G1 ∈ S1 ∪ S2 ∪ S3,whereS1 = {(M1, λ1) | 0 < M1 ≤ min{r, 2m−2},

∧ λ1

m− ⌈logM1⌉≤ λ1 ≤ 1},

S2 = {(M1, λ1) | r ≤ M1 ≤ 2m−1 ∧ 0 ≤ λ1 ≤ 1}, andS3 = {(M1, λ1) | max{2m−1, 2m−2 + r} < M1 ≤ M

∧ 0 ≤ λ1 ≤ λ(1− 1

m− ⌈logM −M1⌉)}.

We show the area of these sets with Figure 4 and 5. In thecase of 0 ≤ r < 2m−2, S1, S2 and S3 are separate fromeach other as in Figure 4. On the other hand, in the case of2m−2 ≤ r < 2m−1, S2 is connected to both S1 and S3 asin Figure 5.

Proof: We show the condition of M1 and λ1 buconsidering separately the cases with respect to M1. Assumethat M1 < M and λ1 < λ.G is separable into G1 and G2, iff the following inequa-

tion holds:

λ1(1 + ⌈logM1⌉) + (λ− λ1)(1 + ⌈logM −M1⌉)≤ λ⌈logM⌉ (1)

1) When 0 < M1 ≤ r, By ⌈logM⌉ = ⌈logM −M1⌉ =m, inequation (1) can be transformed to the following:

λ1(1 + ⌈logM1⌉) + (λ− λ1)(1 +m) ≤ λm.

Thus, we obtain the following condition:

λ1 ≥ λ1

m− ⌈logM1⌉.

Note that from λ1 < λ, ⌈logM⌉ − ⌈logM1⌉ > 1must hold. Therefore, condition M1 ≤ 2m−2 mustalso hold.

2) When r ≤ M1 ≤ M/2, by applying ⌈logM −M1⌉ =m − 1, inequation (1) can be transformed to thefollowing:

λ1(1 + ⌈logM1⌉) + (λ− λ1)(1 +m− 1) ≤ λm,

λ1(1 + ⌈logM1⌉ −m) ≤ 0.

From λ1 > 0, we have m − ⌈logM1⌉ − 1 ≥ 0. Wealso have M1 ≤ 2m−1. However, since M1 < M/2 =2m−2 + r/2 < 2m−1, inequation (1) always holds forany λ1.

3) When M/2 < M1 ≤ 2m−1, then ⌈logM1⌉ = m− 1,by applying M/2 > M −M1 ≥ r. Then, inequation(1) can be transformed to the following:

λ1(1 +m− 1) + (λ− λ1)(1 + ⌈logM −M1⌉) ≤ λm,

(λ− λ1)(m− ⌈logM −M1⌉ − 1) ≥ 0.

From λ > λ1, we have m− ⌈logM −M1⌉ − 1 ≥ 0.Then this can be transformed to M − M1 ≤ 2m−1.However, since M − M1 < M/2 = 2m−2 + r/2 ≤2m−1, inequation (1) always holds for any λ1.

4) When 2m−1 < M1 < M2, by applying ⌈logM1⌉ =m, inequation (1) can be transformed to the following:

λ1(1 +m) + (λ− λ1)(1 + ⌈logM −M1⌉) ≤ λm,

λ1 ≤ λ

(1− 1

m− ⌈logM −M1⌉

).

However, m − ⌈logM −M1⌉ > 1 must hold. Sincethis can be transformed to 2m−2 ≥ M −M1, we havecondition M1 ≥ 2m−2 + r.

While this theorem gives the condition of parameters todivide a group, this can also apply to decide for giventwo groups, which management is better, ether managing

them separately or managing them with mixing into one.Moreover, we can seek a suitable set of parameters for thistheorem. Then, we can try to divide the user group intotwo to adapt the set of parameters. This problem can beformalized that:

• Instance: for given a group that consists of elementswith two kind of parameters and two constraints,

• Question: divide a group into two in order that for eachkind, the sum of parameters in one subgroup satisfiesthe constraint respectively

However, this problem is called the Bounded KnapsackProblem, which is NP-hard. Though some algorithms forthis have been proposed[8], they are not polynomial timecomputable.

Example 2: Now, when the users are obeyed Pareto prin-cipal, we compute how much our method can reduce thenumber of rekeys. That is, when G = (M,λ) is separableinto G1 = (0.2M, 0.8λ) and G2 = (0.8M, 0.2λ), weevaluate the following function:

f(M) = λ⌈logM⌉−(0.8λ(1 + ⌈log 0.2M⌉)+0.2λ(1 + ⌈log 0.8M⌉)).

We assume M > 4.1) When 2m < M ≤ 5 · 2m−2, by applying ⌈logM⌉ =

m + 1, ⌈log 0.2M⌉ = m − 2, and ⌈log 0.8M⌉ = m,we have

f(M) = λ(m+ 1)− (0.8λ(1 + (m− 2))

+0.2λ(1 +m))

= 1.6λ.

2) When 5·2m−2 < M ≤ 2m+1, by applying ⌈logM⌉ =m+1, ⌈log 0.2M⌉ = m−1, and ⌈log 0.8M⌉ = m+1,we have

f(M) = λ(m+ 1)− (0.8λ(1 + (m− 1))

+0.2λ(1 + (m+ 1))

= 0.6λ.

Thus, by the value of M , our method reduces the numberof rekeys by 0.6λ or 1.6λ.

D. Management of the key tree with plural subgroups

Next, we propose the method to construct the key treewith connecting balanced binary trees corresponding to theplural groups G1, G2, ..., Gk each other.

As we saw in the former section, it is complicated todecide which method reduces the number of rekeys more,ether managing two subgroups separately, or managing themtogether by mixing them. Moreover, it should be naturallymore complicated to decide which method reduces thenumber of rekeys more, ether managing plural subgroupsseparately, or managing them by selecting some set of

subgroups and mixing subgroups in the set, since we mustconsider all combinations of selection from the subgroups.

However, if we must manage the plural subgroups byeach separate balanced binary tree, we can have the optimalmethod by constructing the key tree according to Huffmancoding[9] as follows.

Theorem 3: When G1, G2, ..., and Gk must be managedby each separate balanced binary tree, it is optimal to applythe algorithm of Huffman coding for λ1, ..., λk to constructthe key tree.

Proof: We assume that each group Gi is managed thecorresponding balanced binary tree of depth ⌈logMi⌉, fori = 1, ..., k. Let pi denote the depth from the root nodeof the key tree to the root node of the balanced binary treecorresponding to Gi. Then, the average number of rekeyscan be estimated as follows:

k∑i=1

λi(pi + ⌈logMi⌉) =k∑

i=1

λipi +k∑

i=1

λi⌈logMi⌉.

In this formula, the method to construct the key tree onlyaffects the value of the term

∑ki=1 λipi. Since the algorithm

of Huffman coding can construct a binary tree to minimizethis, we can apply this algorithm for λ1, ..., λk.

Now, we discuss the validity for managing more thanone group separately or managing them with mixing somesubgroups. Then, we define “valid-separation” as the trans-formed notation of “separable”.

Definition 2: G2 is a valid-separation for G1 iff G1 ∪G2

is separable into G1 and G2.G1 and G2 are valid-separation iff G1 ∪G2 is separable

into G1 and G2.Theorem 4: G2 = (M2, λ2) is a valid-separation for

G1 = (M1, λ1), if one of the following conditions holdswhere M1 = 2m1 − r1 for a positive integer m1 ≥ 1, apositive real number r1 ≥ 0, and a positive integer l ≥ 1(Figure 6):

1) When 0 < M2 ≤ r1, then

λ2 ≥ λ1

m− 1− ⌈logM2⌉;

2) When r1 < M2 ≤ 2m1 + r1 = 2m1+1 − M1, thenr2 < M2 ≤ 2m1 ;

3) When 2m1+l − M1 < M2 ≤ 2m1+l, then any G2 isvalid;

4) When 2m1+l < M2 ≤ 2m1+l −M1, then λ2 ≤ lλ1.

Since the proof of this theorem is similar to the proof ofTheorem 1, we omit the proof.

By using this theorem, we can evaluate whether onecombination of groups is a valid-separation for anothercombination of groups. However, it is still complicated todecide whether more than two groups are valid-separation.That is, it is complicated to decide whether we can notreduce the average rate of rekeys anymore whatever we mix

Figure 6. Valid-separation

Figure 7. three groups

some combination of groups. In the next section, we discussvalid-separateness for three groups.

E. Valid-separateness for three groups

We yield the condition as valid-separateness for threegroups so that the structure of the key tree in figure 7 isoptimal.

Dividing G = (M,λ) into three groups G1, G2, G3 issuitable, if λ1(1 + ⌈logM1⌉) + λ2(2 + ⌈logM2⌉) + λ3(2 +⌈logM3⌉) is smaller than the following each formula:

(λ1 + λ2 + λ3)⌈logM1 +M2 +M3⌉, (2)λ1(1 + ⌈logM1⌉)

+(λ2 + λ3)(1 + ⌈logM2 +M3⌉), (3)λ2(1 + ⌈logM2⌉)

+(λ1 + λ3)(1 + ⌈logM1 +M3⌉) and (4)λ3(1 + ⌈logM3⌉)

+(λ1 + λ2)(1 + ⌈logM1 +M2⌉). (5)

1) On the average number of rekeys ≤ formula (3) ≤formula (2), it is not trivial that formula (3) ≤ formula(2). Thus, this inequation is a sufficient condition.In order to satisfy this inequation, we may show thatG1 is a valid-separation for G2 ∪ G3, G2 is a valid-separation for G3, and G1 is a valid-separation forboth G2 and G3. Then, once G1 is selected, we select

G2 and G3 to satisfy both the condition whether G2

and G3 are valid-separation, and the condition whetherboth G2 and G3 are valid-separations for G1. We canverify the valid-separateness by verifying whether theselected G2 and G3 are contained in the area yieldedby superimposing the area like Figure 6 on the arealike ether Figure 4 or Figure 5.

2) For the average number of rekeys ≤ ether formula (4)or formula (5);The inequation that the average number of rekeys ≤formula (5) is transformed as follows:

λ1(1 + ⌈logM1⌉)+λ2(2 + ⌈logM2⌉) + λ3(2 + ⌈logM3⌉)

≤ λ3(1 + ⌈logM3⌉) + (λ1 + λ2)(1 + ⌈logM1 +M2⌉).

We consider the condition for this inequation in thefollowing lemma. And we also consider it for formula(4) similarly.

Lemma 5: The average number of rekeys ≤ formula (5),if for M1 = 2m1 − r1 where positive integer m1 ≥ 1 andpositive real number r1 ≥ 0, and positive integer l ≥ 1, oneof the following conditions satisfies(Figure 8).

1) When 0 < M2 ≤ r1, then

λ2 ≥ λ3

m− 1− ⌈logM2⌉;

2) When r1 < M2 ≤ 2m1 + r1 = 2m1+1 −M1, thena) if ⌈logM2⌉ < m, then

λ2 ≥ λ3 − λ1

m1 − ⌈logM2⌉;

b) if ⌈logM2⌉ = m, then λ3 ≤ λ1

c) if ⌈logM2⌉ = m+ 1, then λ2 ≤ λ1 − λ3;3) When 2m1+l−M1 < M2 ≤ 2m1+l, then λ3 ≤ λ1(l+

1);4) When 2m1+l < M2 ≤ 2m1+l−M1, then λ2 ≤ λ1(l+

1)− λ3.Since the proof of this lemma is similar to the proof ofTheorem 1, we omit the proof.

If we have an algorithm A such that it induces a sub-group which satisfies the given constraint, we can inducethree subgroups that are valid-separations by executing thefollowing procedure:

1) Let G = (M,λ) be the given group.2) By giving the constraint that consists of 1/2M as

the maximum number of participants, 1/2λ as theminimum average rate of rekeys, and the conditionof Theorem 1 to the algorithm A, we try to obtainG1 = (M1, λ1) from the algorithm A. If we can notobtain it, we terminate this procedure.

3) Let G = G\G1, λ = λ − λ1, M = M − M1. Bygiving the constraint that consists of the condition ofTheorem 1 and the condition of Theorem 4 for G1

Figure 8. In the case of λ2 + λ3 ≤ λ1

to the algorithm A, we try to obtain G2, G3 fromthe algorithm A such that both G2 and G3 satisfy theconstraint. If we obtain them, we have G1, G2, andG3 as valid-separation. Otherwise, we can not obtainthem, we have G1 and G as valid-separation.

Note that the reason why let λ1 ≥ 1/2λ in the first step, isthat since λ1 > λ2 + λ3 always holds whatever G2 and G3

are selected, G1 must be placed at the most upper level ofthe key tree.

F. Convenient method for selection of three subgroups

In the former section, we propose the method to inducethree subgroups. However, the used constraint in the methodis very complicated. Then, in this section, we proposeanother method whose constraint is simpler.

First, in Theorem 1, the condition that M1 ≤ 1/4M andλ1 ≥ 1/2λ always holds.

By applying this condition for G1, G2 and G3, we have3M1 ≤ M2, 3M1 ≤ M3, 3M2 ≤ M3 and λ1 ≥ λ2 ≥ λ3.This induces 12M1 ≤ M2+M3. Finally, we let the conditionin the first step be M1 ≤ 1/13M , λ1 ≥ 1/2λ. If we can nothave G1 satisfies the above condition, we try to consider tofind valid-separation of two groups.

If we have G1 where M1 ≤ 1/13M , we let the conditionin the second step be 3M1 ≤ M2 ≤ 1/4(M−M1) and λ2 ≥1/2(λ − λ1). If we get G2 satisfying the above condition,G3 also satisfies it. Moreover, G1, G2 and G3 obtained forthese constraints, also satisfy the condition of Theorem 4and the condition of Lemma 5. Therefore, G1, G2 and G3

are valid-separation.

IV. CONCLUSION

For LKH, which is the key management method forIP Multicast communication in cipher, the former studyproposed the method that managing the key tree by using abalanced binary tree. In this paper, we proposed a methodthat managing the key tree by separate user group fromthe behavior of users. Then, we show the condition thatwe reduce the average number of rekeys. Moreover, we canimprove our method by applying the method of Batch LKH.

We are improving our method in efficiency in future.

REFERENCES

[1] D. Wallner, E. Harder, and R. Agee, “Key Managementfor Multicast: Issues and Architectures,” RFC 2627(Informational), Internet Engineering Task Force, Jun. 1999.[Online]. Available: http://www.ietf.org/rfc/rfc2627.txt

[2] C. K. Wong, M. Gouda, and S. S. Lam, “Secure groupcommunications using key graphs,” in IEEE/ACM Transactionson Networking, vol. 8, 2000, pp. 16–30.

[3] P.-Y. Tarng, K.-T. Chen, and P. Huang, “An analysis of WoWplayers’ game hours,” in Proceedings of the 7th ACM SIG-COMM Workshop on Network and System Support for Games,2008, pp. 47–52.

[4] X. S. Li, Y. R. Yang, M. G. Gouda, and S. S. Lam, “Batchrekeying for secure group communications,” in Proceedingsof Tenth International World Wide Web Conference, 2001, pp.525–534.

[5] J. Pegueroles and F. Rico-Novella, “Balanced batch LKH:New proposal, implementation and performance evaluation.” inEighth IEEE Symposium on Computers and Communications,2003, p. 815, iscc.

[6] M. Baugher, R. Canetti, L. Dondeti, and F. Lindholm,“Multicast Security (MSEC) Group Key ManagementArchitecture,” RFC 4046 (Informational), Internet En-gineering Task Force, Apr. 2005. [Online]. Available:http://www.ietf.org/rfc/rfc4046.txt

[7] M. Abdalla, Y. Shavitt, and A. Wool, “Key management forrestricted multicast using broadcast encryption,” IEEE/ACMTrans. Netw., vol. 8, no. 4, pp. 443–454, 2000.

[8] D. Pisinger, “A minimal algorithm for the bounded knap-sack problem,” in Integer Programming and CombinatorialOptimization, Fourth IPCO conference, ser. Lecture Notes inComputer Science, J. C. E. Balas, Ed., vol. 920. Springer,Berlin, 1995, pp. 95–109.

[9] D. A. Huffman, “A method for the construction of minimum-redundancy codes,” Proceedings of the Institute of RadioEngineers, vol. 40, no. 9, pp. 1098–1101, September 1952.