Mesh networks with exclusion capability

• US 20050138359A1
• Filed: 12/17/2003
• Published: 06/23/2005
• Est. Priority Date: 12/17/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bahl, Paramvir, Simon, Daniel R., Wang, Helen Jiahe
• Granted Patent: US 7,665,126 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 40/00 Communication routing or communication path finding
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 88/14 Backbone network devices
• CPC Class Codes: H04W 88/18 Service support devices; Network management devices

Abstract

In an exemplary method implementation, a method includes: designating a neighborhood administrator; receiving notification of a delinquent router from the designated neighborhood administrator; and excluding the delinquent router responsive to the notification. In an exemplary mesh router implementation, a mesh router is capable of establishing a wireless mesh network with other mesh routers, the mesh router is further capable of designating a neighborhood administrator mesh router; and the mesh router is adapted to exclude another mesh router that is associated with a particular certificate when the particular certificate has been identified as delinquent by the designated neighborhood administrator. mesh router.

Claims

1. A router comprising:

at least one processor; and

one or more media including processor-executable instructions that are capable of being executed by the at least one processor, the processor-executable instructions adapted to direct the router to perform actions comprising;

designating a neighborhood administrator;

receiving notification of a delinquent router and an associated delinquent certificate from the designated neighborhood administrator; and

excluding the delinquent router responsive to the notification based on the associated delinquent certificate;

2. The router as recited in claim 1, wherein the router further comprises:

a wireless transceiver that enables wireless communication with end devices and/or other routers.

3. The router as recited in claim 1, wherein the router is associated with a certificate;

and wherein the certificate associated with the router and the associated delinquent certificate of the delinquent router are both signed by a producing entity.

4. The router as recited in claim 1, wherein the one or more media further include a data structure;

and wherein the processor-executable instructions are adapted to direct the router to perform a further action comprising;

mapping an exclusion indication in the data structure to at least one of (i) the associated delinquent certificate and (ii) an identifier of the delinquent router.

5. The router as recited in claim 4, wherein the data structure further maps respective shared secret keys to respective routers.

6. The router as recited in claim 1, wherein the router comprises a mesh router that effectively treats the associated delinquent certificate as being revoked and/or invalid based on the notification from the designated neighborhood administrator even when the associated delinquent certificate is issued by an entity other than the designated neighborhood administrator.

7. The router as recited in claim 1, wherein the designating action comprises:

designating the neighborhood administrator wherein the designated neighborhood administrator comprises another router.

8. A method for implementing an exclusion capability, the method comprising:

designating a neighborhood administrator;

receiving notification of a delinquent router from the designated neighborhood administrator; and

excluding the delinquent router responsive to the notification.

9. The method as recited in claim 8, further comprising:

receiving an offer from a node to be the neighborhood administrator; and

wherein the designating comprises;

informing the node of an intent to join a neighborhood of the neighborhood administrator.

10. The method as recited in claim 8, wherein the receiving comprises:

receiving one or more packets via at least one wireless communication.

11. The method as recited in claim 8, wherein the receiving comprises:

receiving the notification via an out-of-band avenue.

12. The method as recited in claim 8, wherein the receiving comprises:

receiving an identification of the delinquent router.

13. The method as recited in claim 8, wherein the receiving comprises:

receiving an identification of a certificate that is associated with the delinquent router.

14. The method as recited in claim 13, wherein the certificate includes (i) a name of the associated delinquent router, (ii) a public key of a public-private key pair that is associated with the delinquent router, and (iii) a signature.

15. The method as recited in claim 13, wherein the certificate includes a signature that was signed by an entity that differs from the neighborhood administrator.

16. The method as recited in claim 13, wherein the identification of the certificate comprises a copy of the certificate.

17. The method as recited in claim 8, wherein the excluding comprises:

storing an exclusion indication that is mapped to an identification of the delinquent router.

18. The method as recited in claim 8, wherein the excluding comprises:

storing an exclusion indication that is mapped to a certificate that is associated with the delinquent router.

19. The method as recited in claim 8, wherein the excluding comprises:

refusing to complete communications with or on behalf of the delinquent router.

20. A mesh router that is capable of establishing a wireless mesh network with other mesh routers, the mesh router further capable of designating a neighborhood administrator mesh router;

the mesh router adapted to exclude another mesh router that is associated with a particular certificate when the particular certificate has been identified as delinquent by the designated neighborhood administrator mesh router.

21. The mesh router as recited in claim 20, wherein the mesh router is associated with a certificate signed by a producing entity.

22. The mesh router as recited in claim 21, wherein the certificate that is signed by the producing entity is included in the mesh router during production.

23. The mesh router as recited in claim 21, wherein the certificate of the mesh router includes (i) a name of the mesh router, (ii) a public key of a public-private key pair that is associated with the mesh router, and (iii) a signature that is signed by a private signing key of the producing entity.

24. The mesh router as recited in claim 20, wherein the mesh router is further adapted to exclude the other mesh router by refusing to forward packets that are authenticated by the other mesh router.

25. The mesh router as recited in claim 20, wherein the mesh router is further adapted to exclude the other mesh router by refusing to perform an authentication key exchange protocol with the other mesh router.

26. The mesh router as recited in claim 20, wherein the mesh router is further adapted to exclude the other mesh router by mapping, in a data structure of the mesh router, an exclusion indication to (i) an identifier of the other mesh router, (ii) the particular certificate, and/or (iii) a secret key shared between the mesh router and the other mesh router.

27. The mesh router as recited in claim 20, wherein the particular certificate that is associated with the other mesh router is signed by a producing entity.

28. One or more processor-accessible media comprising processor-executable instructions that, when executed, direct a device to perform actions comprising:

receiving notification of a delinquent mesh router certificate from a neighborhood administrator as designated by the device, the delinquent mesh router certificate signed by an entity other than the neighborhood administrator; and

excluding the delinquent mesh router certificate responsive to the 9 notification received from the neighborhood administrator.

29. The one or more processor-accessible media as recited in claim 28, comprising the processor-executable instructions that, when executed, direct the device to perform a further action comprising:

designating the neighborhood administrator, the neighborhood administrator comprising a mesh router.

30. The one or more processor-accessible media as recited in claim 28, wherein the one or more processor-accessible media comprise at least one of (i) one or more storage media and (ii) one or more transmission media.

31. The one or more processor-accessible media as recited in claim 28, wherein the action of receiving comprises an action of:

receiving the notification wherein the notification identifies the delinquent mesh router certificate such that a mesh router that is associated with the delinquent mesh router certificate can be determined directly from the delinquent mesh router certificate and/or from a stored data structure.

32. The one or more processor-accessible media as recited in claim 28, wherein the action of excluding comprises an action of:

mapping an exclusion indication to at least one of the delinquent mesh router certificate and an identifier of a mesh router that is associated with the delinquent mesh router certificate.

33. An arrangement for implementing an exclusion capability, the arrangement comprising:

designation means for designating a neighborhood administrator;

receiving means for receiving notification of a delinquent router from the designated neighborhood administrator; and

exclusion means for excluding the delinquent router responsive to the notification.

34. The arrangement as recited in claim 33, wherein the receiving means comprises:

means for receiving an identification of at least one of (i) the delinquent router and (ii) a certificate that is associated with the delinquent router.

35. The arrangement as recited in claim 33, wherein the exclusion means comprises:

means for excluding the delinquent router based on a certificate associated with the delinquent router.

36. The arrangement as recited in claim 35, wherein the certificate includes (i) a name of the delinquent router, (ii) a public key of a public-private key pair that is associated with the delinquent router, and (iii) a signature from an entity that produced the arrangement and the delinquent router.

37. The arrangement as recited in claim 33, wherein the exclusion means comprises:

storage means for storing one or more exclusion indications that are mapped to at least one of (i) an identification of the delinquent router and (ii) a certificate associated with the delinquent router.

38. The arrangement as recited in claim 33, wherein the exclusion means comprises:

refusal means for refusing to forward packets that are authenticated by the delinquent router and/or for refusing to perform an authentication key exchange protocol with the delinquent router.

39. The arrangement as recited in claim 33, wherein the arrangement comprises a mesh router.

40. The arrangement as recited in claim 33, wherein the arrangement comprises one or more processor-accessible media.