Methods and apparatus for secure, portable, wireless and multi-hop data networking

• US 20040103275A1
• Filed: 06/18/2003
• Published: 05/27/2004
• Est. Priority Date: 11/25/2002
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Ji, Lusheng, Agre, Jonathan, Mishra, Arunesh, Thakkar, Sohil
• Granted Patent: US 7,634,230 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 40/20 based on geographic position or location
• CPC Class Codes: H04W 40/26 for hybrid routing by combining proactive and reactive routing
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A mobile network solution provides secure and portable wireless networking service to mobile users with devices equipped with wireless network interfaces. The Secure Nomadic Wireless Network, or SNOWNET, follows a hierarchical approach. Special SNOWNET nodes are deployed in the area where networking service is needed and form a backbone network. At the same time, SNOWNET nodes provide local access service to regular mobile clients. SNOWNET provides security through authentication of the nodes and clients, as well as through encryption of the data.

Claims

1. A wireless network comprising:

mobile client computing devices, each comprising a client wireless device;

a wireless backbone network providing a wireless backbone service to the mobile client computing devices, the wireless backbone network comprising portable wireless network node devices providing wireless local access service to the mobile client computing devices in their respective coverage areas and providing the wireless backbone service to forward and deliver communication data of the mobile client computing devices on the wireless backbone network in a multi-hop manner to other of the mobile client computing devices or to other networks in communication with the wireless network.

2. The wireless network as in claim 1, wherein the wireless network operates as a secure network and further comprising an authentication server, wherein the communications of the mobile client computing devices are secure and the mobile client computing devices are authenticated by the network using an authentication protocol and the authentication server.

3. The wireless network as in claim 2, wherein one of the portable wireless network node devices is configured to serve as the authentication server for the wireless network.

4. The wireless network as in claim 2, wherein the authentication server resides on another machine that is accessible by the portable network node devices.

5. The wireless network as in claim 2, wherein the portable wireless network node devices are authenticated by the wireless network using an authentication protocol and the authentication server.

6. The wireless network as in claim 1, wherein one of the portable wireless network node devices provides a gateway service and comprises multiple interfaces, wherein one of the multiple interfaces provides communication to the wireless backbone network and at least one of the multiple interfaces provides communication to the other network in communication with the wireless network.

7. The wireless network as in claim 1, wherein one of the portable wireless network node devices comprises multiple wireless interfaces, wherein at least one of the multiple wireless interfaces providing local access service for the mobile client computing devices and at least one of the multiple wireless interfaces providing communication with the wireless backbone service.

8. The wireless network as in claim 1, wherein each of the portable wireless network node devices comprising internal tables controlling communications forwarding through one of bridging and routing, wherein the wireless network automatically and dynamically adjusting for the movement of the portable wireless network node devices within the wireless network, the introduction of additional portable wireless network node devices to the wireless network, and the deletion or failure of current portable wireless network node devices by updating its internal tables controlling communications forwarding either through the bridging or the routing implemented in the portable wireless network node devices.

9. The wireless network as in claim 5, wherein the wireless network authenticates the introduction of an additional portable wireless network node device into the wireless network using a protocol executed by the additional portable wireless network node device, a previously authenticated portable wireless network node device currently in the wireless network and the authentication server.

10. The wireless network as in claim 9, wherein

an authenticated portable wireless network node device currently in the wireless network and providing local access service serves as an authenticator and together with the authentication server, authenticates a new mobile client computing device using a protocol based on the IEEE 802.1x standard and then only forwards communication data from authenticated mobile client computing devices.

11. The wireless network as in claim 9, wherein the wireless network uses a shared secret key known to all authenticated portable wireless network node devices to encrypt data transmitted through the wireless backbone network.

12. The wireless network as in claim 11, wherein the authenticated wireless portable network node devices periodically obtain a new backbone session key in a secure manner from the authentication server for encrypting the data transmitted through the wireless backbone network.

13. The wireless network as in claim 12, wherein the authentication server provides a new backbone session key only to authenticated wireless portable network node devices which have participated in wireless network communication within a predetermined period of time, and wherein only the authenticated wireless portable network node devices with a new session key will be permitted to forward communication data on the wireless backbone network.

14. The wireless network as in claim 1, wherein a portable wireless network node device includes an encrypted file system to protect information stored in its memory.

15. The wireless network as in claim 1, wherein the wireless network shares an Internet-style address space among the portable wireless network node devices and the mobile client computing devices.

16. The wireless network as in claim 5, wherein the wireless network shares an Internet-style address space among the portable wireless network node devices and the mobile client computing devices, and wherein a portable wireless network node device serving as an authenticator dynamically assigns a backbone address as well as one or more address space segments from the address space of the wireless network to a new portable wireless network node device after the new portable wireless network node device is authenticated to the wireless network.

17. The wireless network as in claim 16, wherein the portable wireless network node device, after authenticating a mobile client computing device, provides a a, routable address for the mobile client computing device from the assigned address space segment of the portable wireless network node device using a procedure on the portable wireless network node device.

18. The wireless network as in claim 17, wherein the procedure comprises DHCP.

19. The wireless network as in claim 8, wherein the portable wireless network node devices forward communication data on behalf of the mobile client computing devices using a secure, dynamic routing protocol adapted to the portable wireless network node devices.

20. The wireless network as in claim 8, wherein the portable wireless network node devices forward communication data on behalf of mobile client computing devices using a secure, dynamic, spanning tree, bridging protocol.

21. The wireless network as in claim 20, wherein the bridging protocol is based on WDS links that are dynamically created and removed by the portable network nodes based on their current local neighboring portable node connections.

22. The wireless network as in claim 20, wherein the portable wireless network node devices performing bridging store a Bridging Table comprising a local interface and neighboring interfaces to the respective portable wireless network node devices that are the next hop destination in the bridging path.

23. The wireless network as in claim 22, wherein the portable wireless network node devices performing bridging update their Bridging Table by periodically exchanging bridging update heartbeat messages.

24. The wireless network as in claim 19, wherein portable wireless network node devices performing routing store a Routing Table comprising information on subnet routes for wireless network addresses, subnet routes to gateways for external network addresses and per-host routes for mobile client computing devices that have roamed from their initial access service portable network node coverage area, wherein the Routing Table specifies the local interface and the neighboring interface to the respective portable wireless network node device that is the next hop-destination in a routing path, and wherein the portable wireless network node devices performing routing update their Routing Table by periodically exchanging routing update heartbeat messages.

25. The wireless network as in claim 19, wherein at least one of the portable wireless network node devices serves as a gateway to another network in communication with the wireless network, and the network routing protocol, periodically executed by the portable wireless network node devices, automatically determines the shortest path routes between mobile client computing devices in the wireless network or to the gateway.

26. The wireless network as in claim 5, wherein the portable network wireless node devices transfer authentication information between themselves when a mobile client computing device roams from the coverage area of one of the portable wireless network node devices to another of the portable wireless network node devices that will efficiently, securely and rapidly establish authentication and local access at the new portable wireless network node device.

27. The wireless network as in claim 24, wherein the mobile client computing device that roams from the coverage area of one of the portable wireless network node devices to another of the portable wireless network node devices maintains the same address and the routing protocol continues to efficiently route communication data to the mobile client computing device by automatically updating a client-specific host address entry in the routing tables of the portable wireless network node devices

28. The wireless network as in claim 5, wherein the portable wireless network node devices automatically configure themselves for communication forwarding in the wireless network by initiating their operating systems, determining their network addresses, contacting the authentication server, obtaining encryption keys and authentication, setting their backbone wireless network and local access service channels, and initiating a dynamic routing or bridging protocol that discovers neighboring portable wireless network node devices and establishes communication forwarding paths on the backbone wireless network.

29. The wireless network as in claim 1, wherein one of the portable wireless network node devices comprising one wireless interface providing local access service for the mobile client computing devices and providing communication with the wireless backbone network.

35. The wireless network as in claim 15, wherein there are gateway portable node devices connecting the Internet and the wireless network sharing Internet-style address space and all mobile client devices and portable node devices within the wireless network are able to communicate with hosts on the Internet via the gateway portable node devices.

36. The wireless network as in claim 35, wherein the wireless network shares a “

Private”

Internet-style address space the gateway portable node devices perform NAT (Network Address Translation) to convert between private addresses and public addresses to enable communication between the wireless network and the Internet.

37. The wireless network as in claim 16, wherein to the best knowledge of the authenticator node device the dynamic address selection algorithm ensures there is no conflict between the newly selected addresses and any existing portable node device'"'"'s addresses.

38. The wireless network as in claim 37, due the distributed nature of the problem if the best knowledge of the authenticator node device does not accurately reflect the state of the wireless network and the selected addresses conflict with other portable node devices in the wireless network, the portable node device with the lower node identifier keeps its address selections and the other portable node device needs to reselect addresses.

30. A method of providing wireless local access service to mobile client computing devices each including a wireless client device, comprising:

establishing a wireless backbone network of portable wireless network node devices;

authenticating the portable wireless network node devices to each other;

authenticating the mobile client computing devices to the wireless backbone network;

providing by the wireless backbone network a wireless backbone network service to the mobile client computing devices;

providing by the portable wireless network node devices local access service to the mobile client computing devices in the respective coverage areas of the wireless network node devices;

forwarding and delivering communication data of the mobile client computing devices by the wireless backbone network service to each other or to other networks in communication with the wireless network, through the wireless backbone network in a multi-hop manner.

31. The method as in claim 30, further comprising:

authenticating by the wireless network the introduction of an additional portable wireless network node device to the wireless backbone network using a protocol executed by the additional portable wireless network node device, a previously-authenticated portable wireless network node device currently in the wireless network, and an authentication server.

32. A computer-readable medium storing a program to control a computer to execute the functions of providing wireless local access service to mobile client computing devices each including a wireless client device, comprising:

establishing a wireless backbone network of portable wireless network node devices;

authenticating the portable wireless network node devices to each other;

authenticating the mobile client computing devices to the wireless backbone network;

providing by the wireless backbone network a wireless backbone network service to the mobile client computing devices;

providing by the portable wireless network node devices local access service to the mobile client computing devices in the respective coverage areas of the wireless network node devices;

forwarding and delivering communication data of the mobile client computing devices by the wireless backbone network service to each other or to other networks in communication with the wireless network, through the wireless backbone network in a multi-hop manner.

33. The computer-readable medium as in claim 32, further comprising:

authenticating by the wireless network the introduction of an additional portable wireless network node device to the wireless backbone network using a protocol executed by the additional portable wireless network node device, a previously-authenticated portable wireless network node device currently in the wireless network, and an authentication server.

34. A wireless network comprising:

mobile client computing devices, each comprising a wireless client device;

non-mobile client computing devices, each comprising a wired client device;

a wireless backbone network providing a wireless backbone service to the mobile client computing devices and to the non-mobile client computing devices, the wireless backbone network comprising portable wireless network node devices providing local access service to the wired client devices connected to the respective portable wireless network node devices and to the wireless client devices in the respective coverage areas of the portable wireless network node devices and providing the wireless backbone service to forward and deliver communication data of the mobile client computing devices and the non-mobile client computing devices on the wireless backbone network in a multi-hop manner to other of the mobile client computing devices and the non-mobile client computing devices or to other networks in communication with the wireless network.