This architecture uses reliable multicast and our group key management protocol as the main building block. In the group key management protocol Trent acts as the trusted server and is responsible for admitting and expelling members, while updating group keys during the process. In addition, Trent maintains an access control list of authorized senders. Upon receiving a ``send'' request, Trent broadcasts the message to the group only if the sender is in the access control list. No one other than Trent can broadcast to the group.