Secure group management in large distributed systems: what is a group and what does it do?

The secure management of groups containing thousands or possibly hundreds of thousands of members with very high rates of membership turnover is claimed to be a critical need for high confidence networking. Among the needs mentioned are the ability to ensure that former group members can no longer obtain access to group materials and to prevent new members from accessing material distributed to the group prior to their entry. Suggestions made in this area exhibit a strong bias towards cryptographic techniques and key management to realize these goals, pointing out the weaknesses in currently available techniques. The purpose of the present paper is to examine some of the assumptions that appear to be implicit in these suggestions. An examination of group function and behavior might indicate alternative ways to manage large groups securely. We note that the call for ever more complex technological solutions to problems that may be sociological in nature continues a disturbing (and largely unsuccessful) trend that began in the pre-TCSEC days and that continues into the present.