A system for managing secure communications between modules (105, 106) in a Controller Area Network, CAN, comprising: a key management module configured to: organize CAN identities of the CAN into sub-sets based on functionalities of the CAN identities, wherein each sub-set is arranged as a tree structure having a root node which could represent a function of the sub-set; arrange the sub-sets of CAN identities into a tree structure having a root node N R, wherein the root nodes of the sub-sets are arranged as descendant nodes of root node N R; set a key for the root node N R and compute keys for each node in each level in the tree structure, starting from child nodes of the root node N R, wherein a key of a child node in the tree structure is computed using a key of a parent node and an identifier identifying the child node; a broadcast module communicatively connected to the key management module, configured to: generate a frame to be transmitted on the CAN whereby the frame is associated with a CAN identity id c1 selected from the CAN identities; compute a CAN identity key k c1 using an ascendant key k 1 associated with an ascendant node of the CAN identity id c1 node and a root-node path identifier associated with the CAN identity id c1 node wherein the ascendant key k 1 is retrieved from the key management module and the root-node path identifier comprises a value assigned to the CAN identity id c1 node; obtain a scheme parameter p and compute a verification parameter v d based on the scheme parameter p, the key k c1, the CAN identity id c1 and the frame to be transmitted, wherein the scheme parameter p comprises a variable unique to the scheme; broadcast information comprising the frame associated with the CAN identity id c1 and the verification parameter v d on the CAN such that a receiver module on the CAN having a filter that comprises the CAN identity id c1 receives the broadcasted information and validates the received frame using the received verification parameter v d. a key management module configured to: organize CAN identities of the CAN into sub-sets based on functionalities of the CAN identities, wherein each sub-set is arranged as a tree structure having a root node which could represent a function of the sub-set; arrange the sub-sets of CAN identities into a tree structure having a root node N R, wherein the root nodes of the sub-sets are arranged as descendant nodes of root node N R; set a key for the root node N R and compute keys for each node in each level in the tree structure, starting from child nodes of the root node N R, wherein a key of a child node in the tree structure is computed using a key of a parent node and an identifier identifying the child node; organize CAN identities of the CAN into sub-sets based on functionalities of the CAN identities, wherein each sub-set is arranged as a tree structure having a root node which could represent a function of the sub-set; arrange the sub-sets of CAN identities into a tree structure having a root node N R, wherein the root nodes of the sub-sets are arranged as descendant nodes of root node N R; set a key for the root node N R and compute keys for each node in each level in the tree structure, starting from child nodes of the root node N R, wherein a key of a child node in the tree structure is computed using a key of a parent node and an identifier identifying the child node; a broadcast module communicatively connected to the key management module, configured to: generate a frame to be transmitted on the CAN whereby the frame is associated with a CAN identity id c1 selected from the CAN identities; compute a CAN identity key k c1 using an ascendant key k 1 associated with an ascendant node of the CAN identity id c1 node and a root-node path identifier associated with the CAN identity id c1 node wherein the ascendant key k 1 is retrieved from the key management module and the root-node path identifier comprises a value assigned to the CAN identity id c1 node; obtain a scheme parameter p and compute a verification parameter v d based on the scheme parameter p, the key k c1, the CAN identity id c1 and the frame to be transmitted, wherein the scheme parameter p comprises a variable unique to the scheme; broadcast information comprising the frame associated with the CAN identity id c1 and the verification parameter v d on the CAN such that a receiver module on the CAN having a filter that comprises the CAN identity id c1 receives the broadcasted information and validates the received frame using the received verification parameter v d. generate a frame to be transmitted on the CAN whereby the frame is associated with a CAN identity id c1 selected from the CAN identities; compute a CAN identity key k c1 using an ascendant key k 1 associated with an ascendant node of the CAN identity id c1 node and a root-node path identifier associated with the CAN identity id c1 node wherein the ascendant key k 1 is retrieved from the key management module and the root-node path identifier comprises a value assigned to the CAN identity id c1 node; obtain a scheme parameter p and compute a verification parameter v d based on the scheme parameter p, the key k c1, the CAN identity id c1 and the frame to be transmitted, wherein the scheme parameter p comprises a variable unique to the scheme; broadcast information comprising the frame associated with the CAN identity id c1 and the verification parameter v d on the CAN such that a receiver module on the CAN having a filter that comprises the CAN identity id c1 receives the broadcasted information and validates the received frame using the received verification parameter v d.