Patent ID: 6901510

Claim:
An apparatus for communicating a session key from a first node of a secure multicast group to a plurality of other nodes of the multicast group, wherein each of the nodes is represented by a leaf node of a binary tree stored in a domain of a directory service that is distributed across a wide area network, wherein each of the nodes is capable of establishing multicast communication and serving as a key distribution center, the apparatus comprising: one or more processors; a network interface that communicatively couples the one or more processors to a network; a memory communicatively coupled to the one or more processors and comprising one or more sequences of instructions which, when executed by the one or more processors, cause the one or more processors to perform the steps of: creating and storing a group session key associated with the multicast group and a private key associated with each node in a directory; receiving information indicating that the first node is joining the multicast group; communicating first messages to a subset of nodes in a branch of the binary tree that contains the joining node, wherein the first messages cause the subset of nodes to update all affected keys thereof; receiving a new group session key for the multicast group, for use after addition of the first node, and a new private key for the first node, from a local group manager node; communicating a second message to the subset of nodes that causes the subset of nodes to update their private keys.