Mesh networks with end device recognition

• US 20050135268A1
• Filed: 12/17/2003
• Published: 06/23/2005
• Est. Priority Date: 12/17/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bahl, Paramvir, Simon, Daniel R., Wang, Helen Jiahe
• Granted Patent: US 7,489,645 B2
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: H04L 63/064 Hierarchical key distribution, e.g. by multi-tier trusted parties
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 40/24 Connectivity information management, e.g. connectivity discovery or connectivity update
• CPC Class Codes: H04W 88/14 Backbone network devices

Abstract

An exemplary router performs actions including: receiving at least one certificate from an end device, the at least one certificate issued by another router; ascertaining if the other router is a member of a predetermined neighborhood; determining if the at least one certificate is valid; and if the other router is ascertained to be a member of the predetermined neighborhood and the at least one certificate is determined to be valid, recognizing the end device as privileged. An exemplary mesh router is capable of establishing a wireless mesh network with other mesh routers, the mesh router is further capable of designating a neighborhood administrator mesh router; and the mesh router is adapted to grant privileged status to a particular end device associated with a particular certificate issued by a particular mesh router when the particular mesh router is a member of a neighborhood of the designated neighborhood administrator mesh router.

Claims

1. A router comprising:

at least one processor; and

one or more media including processor-executable instructions that are capable of being executed by the at least one processor, the processor-executable instructions adapted to direct the router to perform actions comprising;

receiving at least one certificate from an end device, the at least one certificate issued by another router;

ascertaining if the other router is a member of a predetermined neighborhood;

determining if the at least one certificate is valid; and

if the other router is ascertained to be a member of the predetermined neighborhood and the at least one certificate is determined to be valid, recognizing the end device as having a privileged status;

the privileged status relating to level of service.

2. The router as recited in claim 1, wherein the router further comprises:

a wireless transceiver that enables wireless communication with end devices and/or other routers.

3. The router as recited in claim 1, wherein the receiving action comprises:

receiving the at least one certificate and an identification of the other router from the end device.

4. The router as recited in claim 1, wherein the receiving action comprises:

receiving the at least one certificate and another certificate from the end device;

wherein the other certificate is associated with the other router, and a private key corresponding to a public key of the other certificate is used to sign the at least one certificate.

5. The router as recited in claim 1, wherein the receiving action comprises:

receiving, from the end device, (i) the at least one certificate;

(ii) another certificate that is associated with the other router and that signed the at least one certificate;

(iii) a membership certificate indicating that the other router is a member of the predetermined neighborhood; and

(iv) a certificate of a neighborhood administrator of the predetermined neighborhood, wherein the certificate of the neighborhood administrator signed the membership certificate.

6. The router as recited in claim 1, wherein the one or more media further include a data structure that enumerates multiple routers that are members of a neighborhood to which the router is also a member;

and wherein the ascertaining action comprises;

accessing the data structure; and

checking if the other router is enumerated in the data structure.

7. The router as recited in claim 6, wherein the data structure further maps respective shared secret keys, which are established with the router, to respective routers of at least a portion of the multiple routers.

8. The router as recited in claim 1, wherein the ascertaining action comprises:

ascertaining if the other router is a member of the predetermined neighborhood, wherein the predetermined neighborhood comprises a neighborhood to which the router is also a member.

9. The router as recited in claim 1, wherein the ascertaining action comprises:

ascertaining if the other router is a member of the predetermined neighborhood, wherein the predetermined neighborhood comprises a neighborhood having a neighborhood administrator that is trusted by a neighborhood administrator of a neighborhood to which the router is a member.

10. The router as recited in claim 1, wherein the determining action comprises:

performing a signature verification procedure on a signature of the at least one certificate.

11. The router as recited in claim 1, wherein the determining action comprises:

performing a public key operation on the at least one certificate using a public key from another certificate that is associated with the other router.

12. The router as recited in claim 1, wherein the recognizing action comprises:

recognizing the end device as being affiliated with the other router wherein the other router is a neighborhood member.

13. The router as recited in claim 1, wherein the recognizing action comprises:

recognizing the end device as being affiliated with the other router wherein the other router is a member of a neighborhood having reciprocity recognition with a neighborhood to which the router is a member.

14. The router as recited in claim 1, wherein the recognizing action comprises:

granting the end device preferred access to a wireless mesh network.

15. The router as recited in claim 1, wherein the processor-executable instructions are adapted to cause the router to perform a further action comprising:

if the other router is not ascertained to be a member of the predetermined neighborhood or the at least one certificate is not determined to be valid, granting the end device standard access to a wireless mesh network.

16. The router as recited in claim 1, wherein the processor-executable instructions are adapted to cause the router to perform a further action comprising:

issuing a different certificate to a different end device, the different certificate capable of being recognized by the other router;

wherein the router and the other router are peers within a wireless mesh network.

17. An arrangement enabling end device recognition, the arrangement comprising:

receiver means for receiving at least one certificate from an end device, wherein the at least one certificate is issued to the end device by a router to which the end device is affiliated;

ascertainment means for ascertaining if the router is a member of a predetermined neighborhood;

determination means for determining if the at least one certificate is valid; and

recognition means for recognizing the end device as having a privileged status responsive to the ascertainment means and the determination means.

18. The arrangement as recited in claim 17, wherein the recognition means is adapted to recognize the end device as having the privileged status if the ascertainment means ascertains that the router is a member of the predetermined neighborhood and if the determination means determines that the at least one certificate is valid.

19. The arrangement as recited in claim 17, wherein the recognition means comprises means for granting preferred access to the end device responsive to the ascertainment means and the determination means.

20. The arrangement as recited in claim 17, wherein the ascertainment means comprises:

data structure means for storing neighborhood members; and

access means for checking if the router is enumerated in the data structure means.

21. The arrangement as recited in claim 17, wherein the ascertainment means comprises:

data structure means for storing trusted neighborhood administrators; and

access means for checking if a neighborhood administrator of the router, as indicated by a membership certificate, is enumerated in the data structure means.

22. The arrangement as recited in claim 17, wherein the determination means comprises:

verification means for performing a signature verification procedure on a signature of the at least one certificate.

23. The arrangement as recited in claim 17, wherein the determination means comprises:

operation means for performing a public key operation on the at least one certificate using a public key from another certificate that is associated with the router to which the end device is affiliated.

24. The arrangement as recited in claim 17, wherein the arrangement comprises at least one of (i) a mesh router and (ii) one or more processor-accessible media.

25. A mesh router configured to perform actions comprising:

establishing a connection with an end device over a wireless link;

receiving at least one certificate from the end device, the at least one certificate having a signature;

performing a signature verification procedure on the signature of the at least one certificate;

if the signature verification procedure is successful, granting the end device preferred access; and

if the signature verification procedure fails, granting the end device standard access.

26. The mesh router as recited in claim 25, wherein the mesh router is configured to perform further actions comprising:

receiving an identifier of another mesh router that issued the at least one certificate to the end device; and

ascertaining, with regard to the identifier, if the other mesh router that issued the at least one certificate is a member of a neighborhood to which the mesh router is also a member.

27. The mesh router as recited in claim 25, wherein the action of receiving comprises:

receiving the at least one certificate and another certificate;

wherein the at least one certificate is associated with the end device, and the other certificate is associated with another mesh router.

28. The mesh router as recited in claim 25, wherein the action of receiving comprises:

receiving the at least one certificate from the end device;

wherein the at least one certificate is associated with the end device, and the signature is a result of a private key operation using a private key that is associated with another mesh router.

29. A mesh router that is capable of establishing a wireless mesh network with other mesh routers, the mesh router further capable of designating a neighborhood administrator mesh router;

the mesh router adapted to grant privileged status to a particular end device associated with a particular certificate issued by a particular mesh router when the particular mesh router is a member of a neighborhood of the designated neighborhood administrator mesh router.

30. The mesh router as recited in claim 29, wherein the particular certificate associated with the particular end device includes (i) a name of the particular end device, (ii) a public key of a public-private key pair that is associated with the particular end device, and (iii) a signature that is signed by a private key of a public-private key pair that is associated with the particular mesh router.

31. The mesh router as recited in claim 29, wherein the mesh router is further adapted to grant preferred access to the particular end device with regard to the wireless mesh network of which the mesh router forms a node.

32. The mesh router as recited in claim 29, wherein the mesh router is further adapted to recognize certificates that have been hierarchically issued to end devices by the other mesh routers that are peers to the mesh router and members of a predetermined neighborhood.

33. The mesh router as recited in claim 32, wherein the predetermined neighborhood comprises at least one of (i) the neighborhood of the designated neighborhood administrator mesh router and (ii) a neighborhood having a trusted neighborhood administrator mesh router.

34. The mesh router as recited in claim 29, wherein the mesh router is further adapted to grant privileged status to a given end device associated with a given certificate issued by a given mesh router when the given mesh router is a member of a neighborhood having a trusted neighborhood administrator mesh router.

35. A method for enabling end device recognition, the method comprising:

receiving at least one certificate from an end device, the at least one certificate issued by a particular router;

ascertaining if the particular router is a member of a predetermined neighborhood;

if the particular router is not a member of the predetermined neighborhood, granting standard access to the end device;

if the particular router is a member of the predetermined neighborhood, determining if the at least one certificate is valid; and

if the at least one certificate is valid, recognizing the end device as having a privileged status.

36. The method as recited in claim 35, further comprising:

signing, by the particular router, the at least one certificate using a private key of the particular router; and

issuing, by the particular router, the at least one certificate to the end device.

37. The method as recited in claim 35, further comprising:

connecting, by the end device, to a neighborhood router; and

providing, by the end device, the at least one certificate and a certificate of the particular router to the neighborhood router;

wherein the neighborhood router performs the receiving, the ascertaining, the determining, and the recognizing.

38. One or more processor-accessible media comprising processor-executable instructions that, when executed, direct a router to perform the method as recited in claim 35.

39. The method as recited in claim 35, wherein the ascertaining comprises:

accessing a data structure that enumerates at least one of (i) routers that are members of a same neighborhood and (ii) trusted neighborhood administrators.

40. The method as recited in claim 35, wherein the ascertaining comprises:

accessing a data structure that enumerates trusted neighborhood administrators with reference to a membership certificate representing that the particular router is a member of a neighborhood having a given neighborhood administrator.