# Building Scalable and Secure Multicast Delivery Infrastructure in a Local Area Network
## 1 Introduction  
In a corporate network, delivering Operating System (OS) updates and security patches to all legitimate hosts in the network is a demanding task. In a similar fashion, updating OS, patches and deploying new configuration to all networking devices are also a challenging task. The challenge gets increased by several folds if the organization is spread across multiple cities. Attackers may exploit the complexity of this process to deploy malware and rootkits, pretending to be an OS update.  
Large companies may have hundreds of network devices and several thousand hosts (e.g., university networks). They may spread across multiple campuses. Managing hosts and network devices from a central location is a tedious task. Multicasting is a useful paradigm that is exploited effectively to handle these tasks. In networking terminology, multicasting is a group communication, where data transmission is addressed to a group of hosts, rather than to an individual. Multicast delivery can be one-to-many or many-to-many. There are several security pitfalls in the implementation and the use of multicast schemes in a corporate network. This will be addressed in detail in Section 2.  
In a large-scale network, any rogue or malicious router may immediately become a peer to other routers and send either a forged default route or route to every external network with the best cost.  
This will make a routing table in every legitimate router to point to the malicious router for the best path. The rogue router does so to launch a Denial-of-Service (DoS) attack or to sniff the network for any valuable information. To address this problem, routing protocols use some form of authentication and multicast mechanism to disseminate routing updates. However, they require heavy maintenance. We will discuss this issue in Section 2.  
In our earlier paper [1], we proposed a new paradigm called PrECast to address several security issues such as Address Resolution Protocol (ARP)-Poisoning, man-in-the-middle attack, etc. in a corporate network. The PrECast protocol assumes the existence of a secure multicast tree in a corporate network. In this paper, we address the gap by providing an efficient algorithm to establish a robust and secure multicast tree. Our proposed algorithm can also be efficiently used to distribute OS and patches to both hosts and network devices, and can be effectively used by routing protocols to distribute their routing information across the network.  
The rest of the paper is organized as follows. In Section 2, we discuss various weaknesses in the implementation of a multicast mechanism in a local area network. We then discuss the current mechanism by which routing protocols exchange information in a LAN. We also outline the PrECast architecture introduced in [1]. These form a strong motivation for this research work. The heart of a secure multicast delivery mechanism is its underlying cryptosystem. The current system does not address all the security requirements. In Section 3, we outline the pseudo identity-based cryptosystem and how it is tailored to the multicast delivery mechanism. In Section 4, we outline how a core-based tree can be used to build the multicast delivery tree. Section 5 presents the conclusions and future direction.