Theoretical Computer Science. Approximately optimal trees for group key management with batch updates

Transcription

1 Theoreical Compuer Science ) Conens liss available a ScienceDirec Theoreical Compuer Science journal homepage: Approximaely opimal rees for group key managemen wih bach updaes Minming Li a,, Ze Feng a, Nan Zang b, Ronald L. Graham b, Frances F. Yao a a Deparmen of Compuer Science, Ciy Universiy of Hong Kong, Hong Kong b Deparmen of Compuer Science and Engineering, Universiy of California a San Diego, Unied Saes a r i c l e i n f o a b s r a c Keywords: Key managemen Key rees Bach updae Approximaion algorihms Opimaliy We invesigae he group key managemen problem for broadcasing applicaions. Previous work showed ha, in handling key updaes, bach rekeying can be more cos effecive han individual rekeying. One model for bach rekeying is o assume ha every user has probabiliy p of being replaced by a new user during a bach period wih he oal number of users unchanged. Under his model, i was recenly shown ha an opimal key ree can be consruced in linear ime when p is a consan and in On 4 ) ime when p 0. In his paper, we invesigae more efficien algorihms for he case p 0, i.e., when membership changes are sparse. We design an On) heurisic algorihm for he sparse case and show ha i produces a nearly 2-approximaion o he opimal key ree. Simulaion resuls show ha is performance is even beer in pracice. We also design a refined heurisic algorihm and show ha i achieves an approximaion raio of 1 + ɛ for any fixed ɛ > 0 and n, as p 0. Finally, we give anoher approximaion algorihm for any p 0, 0.69) which is shown o be quie good by our simulaions Elsevier B.V. All righs reserved. 1. Inroducion Wih he increase of subscripion-based nework services, sraegies for achieving secure mulicas in neworks are becoming more imporan. For example, o limi he service access o he auhorized subscribers only, mechanisms such as conen encrypion and selecive disribuion of decrypion keys have been found useful. One can regard he secure mulicas problem as a group broadcas problem, where we have n subscribers and a group conroller GC) ha periodically broadcass messages e.g., a video clip) o all subscribers over an insecure channel. To guaranee ha only he auhorized users can decode he conens of he messages, he GC will dynamically mainain a key srucure for he whole group. Whenever a user leaves or joins, he GC will generae some new keys as necessary and noify he remaining users of he group in some secure way. Surveys of key managemen for secure group communicaions can be found in [1,2]. In his paper, we consider he key ree model [] for he key managemen problem. We describe his model briefly as follows a precise formulaion is given in Secion 2). Every leaf node of he key ree represens a user and sores his individual key. Every inernal node sores a key shared by all leaf descendans of ha inernal node. Every user possesses all he keys along he pah from he leaf node represening he user) o he roo. To preven revoked users from knowing fuure message This work was suppored in par by he Naional Basic Research Program of China Gran 2007CB807900, 2007CB807901, he US Naional Science Foundaion Gran CCR , grans from he Research Grans Council of Hong Kong under Projec Number CiyU , 1165/04E and a gran from Ciy Universiy of Hong Kong Projec no ). Corresponding auhor. addresses: minmli@cs.ciyu.edu.hk M. Li), fengze@cs.ciyu.edu.hk Z. Feng), nzang@cs.ucsd.edu N. Zang), graham@ucsd.edu R.L. Graham), csfyao@ciyu.edu.hk F.F. Yao) /$ see fron maer 2008 Elsevier B.V. All righs reserved. doi: /j.cs

2 1014 M. Li e al. / Theoreical Compuer Science ) conens and also o preven new users from knowing pas message conens, he GC updaes a subse of keys, whenever a new user joins or a curren user leaves, as follows. As long as here is a user change among he leaf descendans of an inernal node v, he GC will 1) replace he old key sored a v wih a new key, and 2) broadcas o all users) he new key encryped wih he key sored a each child node of v. Noe ha only users corresponding o he leaf descendans of v can decipher useful informaion from he broadcas. Furhermore, his procedure mus be done in a boom-up fashion i.e., saring wih he lowes v whose key mus be updaed see Secion 2 for deails) o guaranee ha a revoked user will no know he new keys. The cos of he above procedure couns he number of encrypions used in sep 2) above or equivalenly, he number of broadcass made by he GC). When users change frequenly, he mehod for updaing he group keys whenever a user leaves or joins may be oo cosly. Thus, a bach rekeying sraegy was proposed by Li e al. in [4], whereby rekeying is done only periodically insead of immediaely afer each membership change. I was shown by simulaion ha among he oally balanced key rees where all inernal nodes of he ree have branching degree 2 i ), degree 4 is he bes when he number of requess leave/join) wihin a bach is no large. For a large number of requess, a sar a ree of deph 1) ouperforms all such balanced key rees. Furher work on he bach rekeying model was done by Zhu e al. in [5]. They inroduced a new model where he number of joins is assumed o be equal o he number of leaves during a bach updaing period and every user has probabiliy p of being replaced by a new user for some p. They sudied he opimal ree srucure subjec o wo resricions: A) he ree is oally balanced, and B) every node on level i has 2 k i children for some parameer k i depending on i. Under hese resricions, characerizaions of he opimal key ree were given ogeher wih a consrucion algorihm. Recenly, Graham, Li, and Yao [6] sudied he srucure of he rue opimal key ree when resricions A) and B) are boh removed. They proved ha, when p > 1 1/ 0.07, he opimal ree is an n-sar. When p 1 1/, hey proved a consan upper bound 4 for he branching degree of any inernal node v oher han he roo, and also an upper bound of 4/ log q, where q = 1 p, for he size of he subree rooed a v. By using hese characerizaions, hey designed an On 4 ) algorihm for compuing he opimal key ree for n users. The running ime of heir algorihm is in fac linear when p is a fixed consan, bu becomes On 4 ) when p approaches 0. Alhough polynomial, he On 4 ) complexiy is sill oo cosly for large scale applicaions. Indeed, he case p 0 when user changes are sparse) is a realisic scenario in many applicaions. In his paper, we invesigae more efficien heurisics for he sparse case. As shown in [6], degree is quie favored in he opimal ree as p 0. In fac, heir resuls implied ha, for n =, he opimal key ree is a balanced ernary ree, and for many oher values of n, he opimal ree is as close o a balanced ernary ree wih n leaves as possible, subjec o some number-heoreical properies of n. In his paper, we invesigae how closely a simple ernary ree can approximae he opimal ree for arbirary n. We propose a heurisic LR which consrucs a ernary ree in a lef o righ manner and prove ha i gives a nearly 2- approximaion o he opimal ree. Simulaion resuls show ha he heurisic performs much beer han he heoreical bound we obain. We hen design a refined heurisic LB whose approximaion raio is shown o be 1 + ɛ as p 0 where ɛ can be made arbirarily small. We also generalize he heurisic LR o a heurisic GLR for he case when p 0, 1 1/ ). The res of he paper is organized as follows. In Secion 2, we describe he bach updae model in deail. In Secion, we esablish a lower bound for he opimal ree cos as p 0. The lower bound is useful for obaining performance raios for our approximaion algorihms. In Secion 4, we describe he heurisic LR and analyze is performance agains he opimal key ree; some simulaion resuls are also given. Then we design a refined heurisic LB and analyze is performance in Secion 5. In Secion 6, we generalize he heurisic LR for p in a more general range, and show ha he generalized LR GLR) performs well by simulaion resuls. Finally, we summarize our resuls and menion some open problems in Secion Preliminaries Before giving a precise formulaion of he key ree opimizaion problem o be considered, we briefly discuss is moivaion and review he basic key ree model for group key managemen. This model is referred o in he lieraure eiher as a key ree [] or LKH logical key hierarchy) [7]. In he key ree model, here are a Group Conroller GC), represened by he roo, and n subscribers or users) represened by he n leaves of he ree. The ree srucure is used by he GC for key managemen purposes. Associaed wih every node of he ree wheher inernal node or leaf) is an encrypion key. The key associaed wih he roo is called he Traffic Encrypion Key TEK), which is used by he subscribers for accessing encryped service conens. The key k v associaed wih each nonroo node v is called a Key Encrypion Key KEK), which is used for updaing he TEK when necessary. Each subscriber possesses all he keys along he pah from he leaf represening he subscriber o he roo. In he bach updae model o be considered, only simulaneous join/leave is allowed; ha is, whenever here is a revoked user, a new user will be assigned o ha vacan posiion. This assumpion is jusified since, in a seady sae, he number of joins and deparures would be roughly equal during a bach processing period. To guaranee forward and backward securiy, a new user assigned o a leaf posiion will be given a new key by he GC and, furhermore, all he keys associaed wih he ancesors of he leaf mus be updaed by he GC. The updaes are performed from he lowes ancesor upward for securiy reasons. We hen explain he updaing procedure ogeher wih he updaing cos in he following. The GC firs communicaes wih each new subscriber separaely o assign a new key o he corresponding leaf. Afer ha, he GC will broadcas cerain encryped messages o all subscribers in such a way ha each valid subscriber will know all he new keys associaed wih is leaf-o-roo pah while he revoked subscribers will no know any of he new keys. The

3 M. Li e al. / Theoreical Compuer Science ) GC accomplishes his ask by broadcasing he new keys, in encryped form, from he lowes level upward as follows. Le v be an inernal node a he lowes level whose key needs o be bu has no ye been) updaed. For each child u of v, he GC broadcass a message conaining E k newk new u v ), which means he encrypion of k new v wih he key k new u. Thus he GC sends ou d v broadcas messages for updaing k v if v has d v children. Updaing his way ensures ha he revoked subscribers will no know any informaion abou he new keys as long as hey do no know he new key k new u in a lower level, hey canno ge he informaion of he new key k new v in a higher level) while curren subscribers can use one of heir KEKs o decryp he useful E k newk new u v ) sequenially unil hey ge he new TEK. We adop he probabilisic model inroduced in [5] ha each of he n posiions has he same probabiliy p o independenly experience subscriber change during a bach rekeying period. Under his model, an inernal node v wih N v leaf descendans will have probabiliy 1 q N v ha is associaed key k v requires updaing, where q = 1 p. The updaing incurs d v 1 q N v ) expeced broadcas messages by he procedure described above. We hus define he expeced updaing cos CT) of a key ree T by CT) = v d v 1 q N v ), where he sum is aken over all he inernal nodes v of T. I is more convenien o remove he facor d v from he formula by associaing he weigh 1 q N v wih each of v s children. This way we express CT) as a node weigh summaion: for each non-roo ree node u, is node weigh is defined o be 1 q N v, where v is u s paren. The opimizaion problem we are ineresed in can now be formulaed as follows. Opimal key ree for bach updaes: We are given wo parameers, 0 p 1 and n > 0. Le q = 1 p. For a rooed ree T wih n leaves and node se V including inernal nodes and leaves), define a weigh funcion wu) on V as follows. Le wr) = 0 for roo r. For every non-roo node u, le wu) = 1 q N v, where v is u s paren. Define he cos of T as CT) = u V wu). Find a T for which CT) is minimized. We say ha such a ree is p, n)-opimal, and denoe is cos by OPTp, n).. Lower bound for opimal ree cos as p 0 In a ree T wih n leaves, denoe he se of leaf nodes as LT), and for each leaf u, le he se of ancesor nodes of u including u iself) be denoed by Ancu). To obain a lower bound for he opimal ree cos, we firs rewrie CT) as CT) = u V wu) = u V N u wu) N u = u LT) x Ancu) wx) = cu), N x where we define cu) = wx) x Ancu). In oher words, we disribue he weigh N x wu) associaed wih every node u V evenly among is leaf descendans, and hen sum he cos over all he leaves of T. Le he pah from a leaf u o he roo r be p 0 p 1... p k 1 p k, where p 0 = u and p k = r. Noe ha cu) = k 1 i=0 u LT) 1 q Np i+1 N pi uniquely deermined by he sequence of numbers {N p0, N p1,..., N pk }, where N p0 = 1 and N pk = n. We will hus exend he definiion of c o all such sequences {a 0, a 1,..., a k }, and analyze he minimum value of c. Definiion 1. Le S n denoe any sequence of inegers {a 0, a 1,..., a k } saisfying 1 = a 1 < a 2 < < a k = n. We call S n an n-progression. Define cp, S n ) o be cp, S n ) = k 1 q a i i=1, and le a i 1 Fp, n) be he minimum of cp, S n ) over all n-progressions S n. For n =, he special n-progression {1,, 9,..., 1, } will be denoed by S n. is Thus, we have CT) n Fp, n) for any ree T wih n leaves, and hence OPTp, n) n Fp, n). Nex we focus on properies of cp, S n ) and Fp, n). Firs, we derive he following monoone propery for Fp, n). 1) Lemma 2. Fp, n) < Fp, n + 1). Proof. Suppose S n+1 = {1, a 1, a 2,..., a k 1, n + 1} is he opimal n + 1)-progression ha achieves he value Fp, n + 1). Le S n = {1, a 1, a 2,..., a k 1, n}. Because 1 qn+1 a k 1 > 1 qn, we know ha a k 1 cp, S n+1 ) > cp, S n ). By definiion, we have Fp, n) cp, S n ). Combining hese wo facs, we have Fp, n) < Fp, n + 1). For a given n-progression S n = {1, a 1, a 2,..., a k 1, n}, he slope of cp, S n ) a p = 0 is denoed by λ Sn and can be expressed as λ Sn = k 1 a i+1 i=0, where a a 0 i = 1 and a k = n. The minimum cp, S n ) as p 0 will be achieved by hose S n wih cp, S n ) having he smalles slope a p = 0. We nex prove he following lemma. Lemma. When n =, he n-progression S n = {1,, 9,..., 1, } saisfies he following relaion: λ Sn λ S n for any S n. Proof. For posiive numbers b 1, b 2,..., k b k, we have i=1 b i k k i=1 b i) 1 k. Therefore, λsn kn 1 k if Sn consiss of k numbers. We now esimae a lower bound for f k) = kn 1 k when n =. Consider gk) = log f k) = ln k +. Noice ln k ha g k) = 1. Therefore, we have k ln k 2 g k) < 0 when k < ln and g k) > 0 when k > ln. This implies

4 1016 M. Li e al. / Theoreical Compuer Science ) Fig. 1. Trees generaed by LR for n = 2 9. ha gk), and hence f k), is minimized when k = ln. Therefore, we have f k) f ln ) = 1 ln ln, which implies λ Sn 1 ln ln. On he oher hand, we know ha λs n = f ) =. Hence we have λ Sn f ln ) 1+ln ln = ln λ S n f ) We obain he following heorem from he above analysis. Theorem 4. For n < +1, we have OPTp, n) n cp, S ) when p 0. Proof. This is a direc consequence of Lemmas 2 and and inequaliy 1). 4. Heurisic LR and is approximaion raio We design he heurisic LR as follows. LR mainains an almos balanced ernary ree i.e., he deph of any wo leaves differ by a mos 1) in which a mos one inernal node has degree less han. Moreover, LR adds new leaves incremenally in a lef o righ order. Fig. 1 shows he ree we ge by using LR for n = 2,..., 9. We can also recursively build a key ree using LR in he following way. For a ree wih n leaves, he number of leaves in he roo s hree subrees is decided by he able below, while for a ree wih 2 leaves, he ree srucure is a roo wih wo children a sar). No. of leaves Lef) Middle) Righ) n < 5 1 n n < 7 1 n n < +1 n 2 We denoe he ree wih n leaves consruced by LR as T n. Noe ha his heurisic only needs linear ime o consruc a ernary ree. Furhermore, he srucure of he ernary ree can be decided in log n ime, because, every ime we go down he ree, here is a mos one subree whose number of leaves is no a power of and needs furher calculaion. Le LRp, n) denoe he cos of he ernary ree consruced by LR for given n and p. To obain an upper bound for LRp, n), we firs prove he following lemmas. Lemma 5. The inequaliy LRp, n) < LRp, n + 1) holds for all n > 0 and 0 < p < 1. Proof. We view CT n ) as he node weigh summaion given in Secion 2 and compare he cos of he corresponding nodes wu) and wu ) in T n and T n+1, respecively. Due o he addiion of one leaf node, if wu) = 1 q k, hen wu ) = wu) or wu ) = 1 q k+1. Therefore we have wu) wu ). There are also addiional weighs associaed wih nodes ha appear in T n+1 bu no in T n. This proves he lemma. Lemma 6. For any ineger > 0 and 0 < q < 1, we have 1 q > 1 q Proof. Noe ha i=1 qi 1 > 1 + q + q 2 ) i=1 qi 1 = +1 i=1 qi 1. The lemma is proved by muliplying 1 q on boh sides. Lemma 7. For any ineger > 0 and 0 < q < 1, we have LRp, +1 ) < ) LRp, ). Proof. By Lemma 6 and he definiions, we have cp, S )/ > cp, S )/ + 1). Therefore, we have +1 LRp, +1 ) = +1 cp, S ) < ) cp, S ) = ) LRp, ). Now we are ready o prove he firs approximaion raio. Theorem 8. When p 0, we have LRp, n) < )OPTp, n).

5 M. Li e al. / Theoreical Compuer Science ) Proof. Suppose n < +1. We claim he following: LRp, n) < LRp, +1 < ) LRp, ) = ) cp, S ) ) OPTp, n). The firs inequaliy is implied by Lemma 5 and he second one by Lemma 7. The las inequaliy holds due o Theorem 4. In he above discussion, we use he smalles balanced ernary ree wih no fewer han n leaves as an upper bound for LRp, n). By adding a small number of leaves insead of filling he whole level, we can obain a beer approximaion raio, which is shown below. We divide he inegers in he range, +1 ] ino hree consecuive subses of equal size H = +1 as follows: P 1 =, + H], P 2 = + H, + 2H], P = + 2H, +1 ]. For any n P i, we can use LRp, n ), where n = max P i o upper bound he value of LRp, n) by Lemma 5. Le = LRp, ) LRp, 1 ) and define a = 1 q +1. Noice ha LRp, +1 ) = a + LRp, ) = a + + LRp, 1 ). I is no hard o verify he following inequaliies based on he definiion of he ree cos: LRp, 7 1 ) < LRp, +1 ), LRp, 5 1 ) < LRp, +1 ) 2. We now derive a lower bound for he value of. Lemma 9. For 0 < p < 1, we have 1 6 LRp, +1 ). Proof. We only need o prove > a + LRp, 1 ). By he definiion of, we know ha = 2 LRp, 1 ) + 1 q ). Then by using Lemma 6, we have 1 q ) 1 q +1 ), which implies LRp, 1 ) + 1 q ) 1 q +1 ). Therefore, we have = 2 LRp, 1 ) + 1 q ) > LRp, 1 ) + a. By making use of Lemma 9, we can obain he following heorem on he performance of LR. Theorem 10. When p 0, we have LRp, n) < )OPTp, n). Proof. We prove he heorem using Lemma 9 and similar argumens used in Theorem 8. The discussion below is divided ino hree cases according o he value of n. Case A). < n 5 1. LRp, n) < LRp, 5 1 ) < 2 LRp, +1 ) < ) OPTp, n) n ) OPTp, n). Case B). 5 1 < n 7 1. LRp, n) < LRp, 7 1 ) < 5 6 LRp, +1 ) < ) OPTp, n) n < ) OPTp, n) 5 ) 1 < OPTp, n).

6 1018 M. Li e al. / Theoreical Compuer Science ) a) p = 0.1 and p = b) p = 0.01/n. Fig. 2. Simulaion resuls on Raiop, n) for p = 0.1, p = 0.01 and p = 0.01/n. Fig.. Simulaion resuls for fixed n. Case C). 7 1 < n +1. LRp, n) < LRp, +1 ) < ) OPTp, n) n < ) OPTp, n) 7 ) 1 < OPTp, n). We run simulaions on he performance of LR for various values of p and n. Define Raiop, n) = LRp, n)/optp, n). Fig. 2a) shows Raiop, n) as a funcion of n for p = 0.1 and p = 0.01 respecively. Wihin he simulaion range, we see ha, for he same n, Raiop, n) is larger when p is larger. For p = 0.1 he maximum raio wihin he range is below We hen simulaed he performance of LR when p 0 as a funcion of n. Fig. 2b) shows Raiop, n) when we se p = 0.01/n. We found he maximum raio reached wihin he simulaion range o be less han Fig. plos Raiop, n) as a funcion of p while n is chosen o be n = 100 and n = 500, respecively. Noice ha each curve has some dips and is no monoonically increasing wih p. 5. Heurisic LB and is approximaion raio In his secion, we consider a more refined heurisic LB Level Balance) and show ha i has an approximaion raio of 1 + ɛ as p 0 for fixed n). The heurisic LB adops wo differen sraegies for adding a new leaf o a ree when n grows from o +1. Le T denoe he ernary ree wih n leaves consruced by LB. When < n 2, he heurisic LB changes he lefmos leaf on level in T 1 ino a 2-sar i.e., an inernal node wih wo leaf children); when 2 < n +1, he heurisic LB changes he lefmos 2-sar on level in T 1 ino a -sar an inernal node wih hree leaf children). In he following discussion, we refer o he iniial formulaion of CT) as a node weigh summaion over all nodes: CT) = u V wu). Define he slope of CT) a p = 0 as and le =. When T changes incremenally o

7 M. Li e al. / Theoreical Compuer Science ) Fig. 4. Approximae ree srucure generaed by GLR when n = 0 p = 0.1. T, where < n 2, every ime he size is increased by 1, we change a single leaf node o a 2-sar. Therefore, in all inermediae levels excep for he roo and he boom level), exac hree nodes will undergo a weigh change: i changes from 1 q N v o 1 q Nv+1. For he wo newly added nodes, he weigh of each node is 1 q 2. Alogeher, hese changes conribue an increase of o he slope. When T 2 is changed incremenally o T, where 2 < n +1, by using a similar argumen, we conclude ha every ime he size is increased by 1, all weigh changes ogeher conribue an increase of = + 5 o he slope, where 9 4 means he slope increase due o 1 q ) 21 q 2 ) because we change a 2-sar o a -sar). To summarize, our new heurisic has he following propery. = { βt n if < n 2, n if 2 < n +1. Using he base value of and he recurrence relaion 2), we have he following lemma. Lemma 11. { + 4)n 4 if = < n 2, + 5)n 6 if 2 < n +1. 2) By Lemma 2 and Theorem 4, we can prove he following heorem. Theorem 12. When p 0, we have CT ) < n )OPTp, n). Proof. To compare he cos of wo rees as p 0 is in fac comparing slopes of he corresponding CT) a p = 0. Noe ha, for a full ernary ree T wih heigh, he slope of CT) a p = 0 equals. Always le = in he following. Using Lemma 4, we can prove he heorem by proving < ) n as follows. Case A). n = + r, where 0 < r. In his case, we have = + r + 4) < + r + ) + = + ) + r) = ) n. Case B). n = 2 + r, where 0 < r. In his case, we have = + + 4) + r + 5) = r + 5r r + r = + )2 + r) = ) n. The upper bound in Theorem 12 can be furher improved o 1+ɛ, where ɛ can be made arbirarily small when p 0. To accomplish his, we make use of he following echnical lemma, which was originally proved in [6] for a differen purpose. Lemma 1. For any ree T wih n leaves, we have { + 4)n 4 if < n 2, + 5)n 6 if 2 < n +1. By comparing Lemmas 11 and 1 we can deduce ha, for he ree T consruced by he heurisic LB, he slope of CT ) is equal o he lower bound of he slope of he opimal key ree wih n leaves. Therefore, as p 0, he approximaion raio of LB can be arbirarily close o 1. This leads o he following heorem. Theorem 14. For any fixed n, we have CT ) < 1 + ɛ)optp, n) when p 0.

8 1020 M. Li e al. / Theoreical Compuer Science ) a) p = 0.. b) p = 0.2. c) p = 0.1. d) p = 0.01, he raio of LR and GLR. Fig. 5. Simulaion resuls on Raiop, n) for p = 0., p = 0.2, p = 0.1, and p = Generalized heurisic LR The consrucion mehod of he heurisic LR can be exended o he case when p is in a more general range. In [6], i was shown ha a sar is he opimal ree when p 1 1/) 1/, 1). Here, for a given value p 0, 1 1/) 1/ ) and a given number of leaves n, we show how o consruc an approximae ree GLRq, n) where q = 1 p). We found by simulaions ha he approximae ree performs very well. The idea of he consrucion is as follows. Firs, we find a good complee ernary ree; hen he roo of he GLRq, n) is forced o conain as many such good complee ernary rees as possible, wih one lefover ree. We will give some definiions before formally inroducing he heurisic. Definiion 15. When n =, we define a special group of n-progressions, SGn) = {T d n = {1,, 9,..., d, } d = 0, 1,..., 1}. For n =, we denoe c q) = min{cq, n T d n ) d = 0,..., 1} and le d q) be he value of d when c n q) is achieved. For example, when n = 27, SG27) = {{1, 27}, {1,, 27}, {1,, 9, 27}}. c q) = 27 min{1 q27, 1 q + 1 q27, 1 q + 1 q q27 }. 9 When q [1/) 1/, 1), cq, T 0 ) is 1 q, which is always larger han cq, T 1 ) = 1 q q ). We observe ha c q) can be calculaed recursively, c q) = 1 q + 1 c 1 q ), when > 1 and q [0.69, 1). There are wo base cases: one is c q) = 1 q ; he oher is c q) = 1 q when q 0, 1/) 1/ ), because he opimal ree is a sar when q 0, 0.69) [6]. From he recursive formula, we can ge he value of d q) = min{ log log q 1 )), 1}, where = log n. For a given q and n, we consruc an approximae ree GLRq, n) as follows: firs we calculae he value d q) = min{ log log q 1 )), 1}, where = log n, and consruc a complee ernary ree T q) of deph d q); he roo of GLRq, n) conains n subrees: n 1 of hem are T q) and one is GLRq, L 1 ), where n 1 = n d q) and L 1 = n mod d q). Take n = 0 and q = 0.9 as an example: d 0.9) = min{ log log )), log n 1} = 2. The good complee ernary ree has d = 9 leaves; he roo has four subrees, hree of which are complee ernary rees wih 9 leaves and one of which is a lefover subree GLR0.9, 2), which can be consruced recursively. The srucure of GLR0.9, 0) is shown in Fig. 4. We ran simulaions on he performance of GLR for various values of p and n. We redefine Raiop, n) = GLRp, n)/optp, n). Fig. 5 shows Raiop, n) as a funcion of n for p = 0., 0.2, 0.1, and Wihin he simulaion range, we see ha, for a fixed value p, he Raio curve oscillaes, bu ends o 0 as n ges larger. For p = 0.1, he maximum raio is below 1.02, when n is in he range [50, 250]. As p 0, boh he heurisic LR and he heurisic GLR mainain almos balanced

9 M. Li e al. / Theoreical Compuer Science ) ernary rees, bu hey deal wih he lefover leaves in wo differen ways: LR pus all he lefover leaves a he boom level of he complee ernary ree; GLR bundles all he lefover leaves as a lefover ree and pus i as a sibling of he complee ernary rees. In Fig. 5d), we compare he approximaion raios of LR and GLR when p = 0.01 and n = From he simulaion resuls, we see ha when n is large, GLR appears o perform beer. 7. Conclusions In his paper, we consider he group key managemen problem for broadcasing applicaions. In paricular, we focus on he case when membership changes are sparse. Under he assumpion ha every user has probabiliy p of being replaced by a new user during a bach rekeying period, he previously available algorihm requires On 4 ) ime o build he opimal key ree as p 0. We design a linear-ime heurisic LR o consruc an approximaely good key ree and analyze is performance as p 0. We prove ha LR produces a nearly 2-approximaion o he opimal key ree. Simulaion resuls show ha LR performs much beer han he heoreical bound we obain. We also design a refined heurisic LB whose approximaion raio is shown o be 1 + ɛ as p 0. A he end of his paper, we exended he heurisic LR o he algorihm GLR for he case when p is in a more general range p 0, 0.69) In [6], i was shown ha a sar is he opimal ree when p 0.07, 1).) Simulaion resuls show ha GLR performs very well as n increases. Some ineresing problems remain open. Alhough simulaion resuls show GLR performs very well for p 0, 0.69), we are no able o prove a consan approximaion raio for his range. In order o prove a consan bound, one needs o undersand beer he mahemaical srucure of he opimal n-progression S n ha achieves he value Fp, n) for arbirary p and n. References [1] S. Rafaeli, D. Huchison, A survey of key managemen for secure group communicaion, ACM Compuing Surveys 5 ) 200) [2] M.T. Goodrich, J.Z. Sun, R. Tamassia, Efficien ree-based revocaion in groups of low-sae devices, in: Proceedings of CRYPTO, [] C.K. Wong, M.G. Gouda, S.S. Lam, Secure group communicaions using key graphs, IEEE/ACM Transacions on Neworking 8 1) 200) 6 0. [4] X.S. Li, Y.R. Yang, M.G. Gouda, S.S. Lam, Bach re-keying for secure group communicaions, WWW10, Hong Kong, May 2 5, [5] F. Zhu, A. Chan, G. Noubir, Opimal ree srucure for key managemen of simulaneous join/leave in secure mulicas, in: Proceedings of MILCOM, 200. [6] R.L. Graham, M. Li, F.F. Yao, Opimal ree srucures for group key managemen wih bach updaes, SIAM Journal on Discree Mahemaics 21 2) 2007) [7] D. Wallner, E. Harder, R.C. Agee, Key managemen for mulicas: Issues and archiecures, RFC 2627, June 1999.