A system, device, and method for controlling access in a multicast communication network uses a distributed host authentication scheme to prevent unauthorized hosts from joining a shared multicast distribution tree. An authorized host is provided with access information for accessing the shared tree. Certain access information is also distributed to at least a designated device associated with the host, although the access information may be distributed to other devices as well. The designated device uses the access information to authenticate the host and establish a security agreement with the host. Other devices may use the access information to authenticate the host in the event that the designated device is unable to authenticate the host. An authenticated host is added to the shared tree, while a host that cannot be authenticated is prevented from joining the shared tree.