1. 7/11/2006IETF-66 MSEC applied to RMT page 1 George Gross IdentAware ™ Multicast Security gmgross@IdentAware.com IETF-66, Montreal, Canada July 11 th 2006 Secure Multicast Applied to Reliable Multicast Transport

2. 7/11/2006IETF-66 MSEC applied to RMT page 2 Problem Statement Several RMT protocols and building blocks are approaching final standardization phase To date, no comprehensive survey or solution for the security problems latent in these protocols: –denial of service attacks are easy –adversaries along the path could alter data in transit and/or masquerade as a group speaker –no provision for confidentiality

3. 7/11/2006IETF-66 MSEC applied to RMT page 3 RMT over MSEC IPsec Crypto- token I/O driver UDP RMT protocol library multicast IP security (SPD/SAD) SPD/SAD control Group Key Management Subsystem GKM protocol API IP-v4 or IP-v6 or link layer Reliable multicast application DBMS library Operating system PKI and crypto library

4. 7/11/2006IETF-66 MSEC applied to RMT page 4 Reliable Multicast TLS Crypto- token I/O driver UDP RMTLS security library Group Key Management Protocol GKM protocol API IP-v4 or IP-v6 or link layer Reliable multicast application DBMS library Operating system RMTLS control API PKI and crypto library RMT library

5. 7/11/2006IETF-66 MSEC applied to RMT page 5 RMT and MSEC Have Worked In Parallel, Orthogonal Efforts Until now, it was assumed that IPsec protected NORM, FLUTE, ALC, & LCT MSEC has an IPsec standard in progress, yet a transport or application layer mechanism may be preferred for security that passes the “grandmother test”. Expertise needed from both RMT and MSEC areas to formulate that alternative