Apparatus, method, and medium for self-organizing multi-hop wireless access networks

• US 20050152305A1
• Filed: 08/31/2004
• Published: 07/14/2005
• Est. Priority Date: 11/25/2002
• Status: Abandoned Application

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Ji, Lusheng, Agre, Jonathan Russell, Feldman, Brian
• Application Number:
  US10/929,772
• Publication Number:
  US 20050152305A1
• Time in Patent Office: Days
• US Class Current: 370/328
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 40/20 based on geographic position or location
• CPC Class Codes: H04W 40/248 Connectivity information update
• CPC Class Codes: H04W 40/26 for hybrid routing by combining proactive and reactive routing
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks
• CPC Class Codes: H04W 88/04 adapted for relaying to or from another terminal or user

Abstract

A wireless computer network includes a backbone network including backbone network nodes authenticated to each other and in communication with each other. The wireless computer network also includes a master authenticator node and a proxy authenticator node among the backbone network nodes. When an unauthenticated new node requests authentication to the backbone network and the unauthenticated new node is in communication with at least one of the backbone network nodes, the at least one of the backbone network nodes becoming the proxy authenticator node for the unauthenticated new node and communicates with the master authenticator node to authenticate the unauthenticated new node to the backbone network.

Claims

33. A method of wireless computer network in communication with mobile client computing devices comprising client wireless devices, the method of the wireless computer network comprising:

providing, by a wireless backbone network, a wireless networking service to the mobile client computing devices, comprising;

providing, by portable wireless network node devices of the wireless backbone network, wireless local access service to the mobile client computing devices in their respective coverage areas,

providing the wireless networking service to forward and deliver communication data of the mobile client computing devices on the wireless backbone network in a multi-hop manner to other of the mobile client computing devices or to other networks in communication with the wireless computer network,

performing routing, by one or more of the portable wireless network node devices,

storing, by the one or more of the portable wireless network node devices, a routing table comprising first data of subnet routes of wireless network layer addresses for the mobile client computing devices and portable wireless network node devices, and second data of subnet routes to gateways for external network addresses and per-host routes of network layer addresses for the mobile client computing devices that have roamed from their initial access service network node coverage area, and per-host routes of link layer addresses for the mobile client computing devices and portable wireless network node devices, and

authenticating, by a backbone network node configured as a master authenticator node and another backbone node configured as an authentication server, an unauthenticated new network node to the backbone network with the assistance of another backbone node configured as a proxy authenticator node for the unauthenticated new network node.

1. A wireless computer network in communication with mobile client computing devices comprising client wireless devices, the wireless computer network comprising:

a wireless backbone network providing a wireless networking service to the mobile client computing devices, the wireless backbone network comprising;

portable wireless network node devices providing wireless local access service to the mobile client computing devices in their respective coverage areas and providing the wireless networking service to forward and deliver communication data of the mobile client computing devices on the wireless backbone network in a multi-hop manner to other of the mobile client computing devices or to other networks in communication with the wireless computer network, one or more of the portable wireless network node devices performing routing and storing a routing table comprising first data of subnet routes of network layer addresses for the mobile client computing devices and portable wireless network node devices, and second data of subnet routes to gateways for external network addresses and per-host routes of network layer addresses for the mobile client computing devices that have roamed from their initial access service network node coverage area, and per-host routes of link layer addresses for the mobile client computing devices and portable wireless network node devices,

wherein a backbone network node configured as a master authenticator node and another computer configured as authentication server, authenticating an unauthenticated new network node to the backbone network with the assistance of another backbone node configured as a proxy authenticator node for the unauthenticated new network node

2. The wireless computer network as in claim 1, wherein the routing table specifies the local interface and the neighboring interface to the respective wireless network node device that is the next hop-destination in a routing path, and wherein the wireless network node devices performing routing updating their routing table by periodically exchanging routing update control messages that include IP addresses and link layer addresses.

3. The wireless computer network as in claim 2, wherein one or more of the portable wireless network node devices provides a gateway service and comprises multiple interfaces, wherein each gateway service node device having one of the multiple interfaces provides communication to the wireless backbone network and at least one of the multiple interfaces provides communication to the other network in communication with the wireless computer network.

4. The wireless computer network as in claim 2, wherein the portable wireless network node devices comprises multiple wireless interfaces, wherein at least one of the multiple wireless interfaces providing local access service for the mobile client computing devices and at least one of the multiple wireless interfaces providing communication with the wireless backbone service.

5. The wireless computer network as in claim 2, wherein each of the portable wireless network node devices comprising internal tables controlling communications forwarding through one of bridging and routing, wherein the wireless computer network automatically and dynamically adjusting for the movement of the portable wireless network node devices within the wireless computer network, the introduction of additional portable wireless network node devices to the wireless computer network, and the deletion or failure of current portable wireless network node devices by updating its internal tables controlling communications forwarding either through the bridging or the routing implemented in the portable wireless network node devices.

6. The wireless computer network as in claim 5, wherein when the network is operating in routing mode the wireless computer network shares an Internet-style, network layer, address space among the portable wireless network node devices and the mobile client computing devices.

7. The wireless computer network as in claim 6, wherein a portable wireless network node device serving as an address manager dynamically assigns a backbone network layer address as well as one or more address space segments from the address space of the wireless computer network to a new portable wireless network node device after the new portable wireless network node device is authenticated to the wireless computer network.

8. The wireless computer network as in claim 7, wherein the wireless network node device provides an internal routable address for the mobile client computing device from the assigned address space segment of the wireless network node device using a procedure comprising a DHCP function on the wireless network node device.

9. The wireless computer network as in claim 5, wherein the wireless network node devices forward communication data on behalf of the mobile client computing devices using a dynamic routing protocol adapted to the wireless network node devices.

10. The wireless computer network as in claim 5, wherein the wireless network node devices forward communication data on behalf of mobile client computing devices using a dynamic bridging protocol adapted to the wireless network node devices.

11. The wireless computer network as in claim 10, wherein the bridging protocol is based on the IEEE 802.11 WDS links that are dynamically created and removed by the network nodes based on their current local neighboring network node connections.

12. The wireless computer network as in claim 10, wherein the wireless network node devices performing bridging store a Bridging Table comprising a local interface and neighboring interfaces to the respective wireless network node devices that are the next hop destination in the bridging path.

13. The wireless computer network as in claim 12, wherein the wireless network node devices performing bridging update their Bridging Table by periodically exchanging bridging update control messages that includes link layer addresses for all attached devices and clients.

14. The wireless computer network as in claim 2, wherein at least one of the wireless network node devices serves as a gateway to another network in communication with the wireless computer network, and the network routing protocol, periodically executed by the wireless network node devices, automatically determines the shortest path routes between mobile client computing devices in the wireless computer network or to the gateway.

15. The wireless computer network as in claim 5, wherein the network wireless node devices transfer authentication information between themselves when a mobile client computing device roams from the coverage area of one wireless network node device to another wireless network node device to establish authentication and local access at the wireless network node device to provide access service.

16. The wireless computer network as in claim 15, wherein the mobile client computing device that roams from the coverage area of one of the wireless network node devices to another of the wireless network node devices maintains the same address and the routing protocol continues to efficiently route communication data to the mobile client computing device by automatically updating a client-specific host address entry in the routing tables of the wireless network node devices

17. The wireless computer network as in claim 2 wherein secure communications are provided by encryption of messages and authentication of the wireless network node devices and the mobile client computing devices.

18. The wireless computer network as in claim 2, further comprising an authentication server in communication with the wireless network node devices, wherein the wireless network node devices automatically configure themselves for communication forwarding in the wireless computer network by initiating their operating systems, determining their network addresses when operating in routing mode, contacting the authentication server, obtaining encryption keys and authentication, setting their backbone wireless network and local access service channels, and initiating a dynamic routing or bridging protocol that discovers neighboring wireless network node devices and establishes communication forwarding paths on the backbone wireless network.

19. The wireless computer network as in claim 17, the unauthenticated new node in communication with at least one of the already authenticated backbone network nodes as the proxy authenticator node to request authentication to the backbone network, the proxy authenticator node communicating with the master authenticator node to authenticate the unauthenticated new node to the backbone network.

20. The wireless computer network as in claim 19, wherein when operating in a routing mode, the unauthenticated new node transmitting identification data to neighboring proxy authenticator nodes, the proxy authenticator nodes receiving the identification data, encapsulating the identification data in a message envelope, and forwarding the encapsulated data to the master authenticator using the routing scheme.

21. The wireless computer network as in claim 19, wherein the master authenticator node selects one backbone node as the proxy authenticator node if more than one backbone node receives and forwards the new node identification data to the master authenticator.

22. The wireless computer network as in claim 21, further comprising an authentication server in communication with the master authenticator node and authenticating the unauthenticated new node to the backbone network.

23. The wireless computer network as in claim 22, wherein the new node, once authenticated to the backbone network, is enabled to become a proxy authenticator for an unauthenticated new wireless node.

24. The wireless computer network as in claim 17, wherein a common group key is used as part of the encryption scheme for the backbone communications, the group key is used by another key generating method to produce the actual per packet communication encryption key, and the group key is changed periodically and is only valid for a specified period of time, denoted by a start and end time.

25. The wireless computer network as in claim 24, wherein the master authenticator periodically generates a new group key and transmits the new group key to each node in the backbone network by encrypting the group key using a public key based method that only that destination node can decrypt.

26. The wireless computer network as in claim 24, wherein the master authenticator transmits the current active group key to a newly authenticated node by encrypting the group key using a public key based method that only the new node can decrypt, the new node then uses the group key to encrypt backbone communication.

27. The wireless computer network as in claim 24, wherein each key periodically generated by the master authenticator has a specific valid period, which is specified in each new key transmission, and the received newly generated group key is stored by backbone node devices and only loaded into encryption/decryption engine during the key effective period.

28. The wireless computer network as in claim 27, wherein the valid periods of consecutively generated group keys by the master authenticator may overlap at the beginning and ending of their valid periods, during which both group keys are valid and the encrypting node devices use the newer group key to encrypt messages but the decrypting node devices may need to try both to decrypt messages, to ensure smooth group key change.

29. The wireless computer network as in claim 17, wherein a wireless network node providing access service to at least one of the mobile client computing devices becoming an authenticator for authenticating client devices.

30. The wireless computer network as in claim 29, wherein one of the wireless network nodes providing access service to at least one of the mobile client computing devices or a separate computer in communication with the wireless network node, being configured as an authentication server for the mobile client computing devices.

31. The wireless computer network as in claim 30, wherein at least one of the mobile client computing devices is authenticated by an authenticator and an authentication server using the IEEE 802.1x protocol.

32. The wireless computer network as in claim 17 in which the authentication and encryption mechanisms are the WiFi Protected Access (WPA) scheme modified to allow the authenticator, master authenticator and authentication server to communicate over multiple hops.

34. The method of claim 33, further comprising:

specifying, by the routing table, the local interface and the neighboring interface to the respective wireless network node device that is the next hop-destination in a routing path, and

updating, by the wireless network node devices performing routing, their routing table by periodically exchanging routing update control messages that include IP addresses and link layer addresses.

35. The method as in claim 34, further comprising:

providing, by one or more of the portable wireless network node devices, a gateway service, the one or more of the portable network node devices comprising multiple interfaces,

providing, by each gateway service node device having one of the multiple interfaces provides, communication to the wireless backbone network, and

providing, by at least one of the multiple interfaces, communication to the other network in communication with the wireless computer network.

36. The method as in claim 34, wherein the portable wireless network node devices comprises multiple wireless interfaces, the method further comprising:

providing, by at least one of the multiple wireless interfaces, local access service for the mobile client computing devices, and

providing, by at least one of the multiple wireless interfaces, communication with the wireless backbone service.

37. The method as in claim 34, further comprising:

controlling, by internal tables provided in each of the portable wireless network node devices, communications forwarding through one of bridging and routing,

automatically and dynamically, by the wireless computer network, adjusting for the movement of the portable wireless network node devices within the wireless computer network, the introduction of additional portable wireless network node devices to the wireless computer network, and the deletion or failure of current portable wireless network node devices by updating its internal tables controlling communications forwarding either through the bridging or the routing implemented in the portable wireless network node devices.

38. The method as in claim 37, wherein when the network is operating in routing mode, sharing, by the wireless computer network, an Internet-style, network layer, address space among the portable wireless network node devices and the mobile client computing devices.

39. The method as in claim 37, further comprising serving, by a portable wireless network node device, as an address manager dynamically assigns a backbone network layer address as well as one or more address space segments from the address space of the wireless computer network to a new portable wireless network node device after the new portable wireless network node device is authenticated to the wireless computer network.

40. The method as in claim 39, further comprising providing, by the wireless network node device, an internal routable address for the mobile client computing device from the assigned address space segment of the wireless network node device using a procedure comprising a DHCP function on the wireless network node device.

41. The method as in claim 37, wherein the wireless network node devices forwarding communication data on behalf of the mobile client computing devices using a dynamic routing protocol adapted to the wireless network node devices.

42. The method as in claim 37, wherein the wireless network node devices forwarding communication data on behalf of mobile client computing devices using a dynamic bridging protocol adapted to the wireless network node devices.

43. The method as in claim 42, wherein the bridging protocol is based on the IEEE 802.11 WDS links that are dynamically created and removed by the network nodes based on their current local neighboring network node connections.

44. The method as in claim 42, wherein the wireless network node devices performing bridging store a Bridging Table comprising a local interface and neighboring interfaces to the respective wireless network node devices that are the next hop destination in the bridging path.

45. The method as in claim 44, wherein the wireless network node devices performing bridging update their Bridging Table by periodically exchanging bridging update control messages that includes link layer addresses for all attached devices and clients.

46. The method as in claim 34, further comprising serving, by at least one of the wireless network node devices, as a gateway to another network in communication with the wireless computer network, and

automatically determining, in accordance with the network routing protocol, periodically executed by the wireless network node devices, the shortest path routes between mobile client computing devices in the wireless computer network or to the gateway.

47. The method as in claim 37, further comprising transferring, by the network wireless node devices, authentication information between themselves when a mobile client computing device roams from the coverage area of one wireless network node device to another wireless network node device to establish authentication and local access at the wireless network node device to provide access service.

48. The method as in claim 47, further comprising maintaining, by the mobile client computing device that roams from the coverage area of one of the wireless network node devices to another of the wireless network node devices, the same address and the routing protocol continues to efficiently route communication data to the mobile client computing device by automatically updating a client-specific host address entry in the routing tables of the wireless network node devices

49. The method as in claim 34, further comprising providing secure communications by encryption of messages and authentication of the wireless network node devices and the mobile client computing devices.

51. The method as in claim 49, further comprising requesting, by the unauthenticated new network node, authentication to the backbone network, the unauthenticated new node in communication with at least one of the already authenticated backbone network nodes, one of these backbone network nodes becoming the proxy authenticator node for the unauthenticated new node and communicating with the master authenticator node to authenticate the unauthenticated new node to the backbone network.

52. The method as in claim 51, wherein when operating in a routing mode, further comprising:

transmitting, by the unauthenticated new node, identification data to neighboring proxy authenticator nodes,

receiving, by the proxy authenticator nodes, the identification data,

encapsulating the identification data in a message envelope, and

forwarding the encapsulated data to the master authenticator using the routing scheme.

53. The method as in claim 51, further comprising selecting, by the master authenticator node, one backbone node as the proxy authenticator node if more than one backbone node receives and forwards the new node identification data to the master authenticator.

54. The method as in claim 53, wherein the wireless computer network further comprising an authentication server in communication with the master authenticator node and authenticating the unauthenticated new node to the backbone network.

55. The method as in claim 54, further comprising enabling the new node, once authenticated to the backbone network, to become a proxy authenticator for an unauthenticated new wireless node.

56. The method as in claim 49, further comprising using a common group key as part of the encryption scheme for the backbone communications, wherein the group key is used by another key generating method to produce the actual per packet communication encryption key, and the group key is changed periodically and is only valid for a specified period of time, denoted by a start and end time.

57. The method as in claim 56, further comprising periodically generating, by the master authenticator, a new group key and transmitting the new group key to each node in the backbone network by encrypting the group key using a public key based method that only that destination node can decrypt.

58. The method as in claim 56, further comprising transmitting, by the master authenticator, the current active group key to a newly authenticated node by encrypting the group key using a public key based method that only the new node can decrypt, the new node then uses the group key to encrypt backbone communication.

59. The method as in claim 56, wherein each key periodically generated by the master authenticator has a specific valid period, which is specified in each new key transmission, and the received newly generated group key is stored by backbone node devices and only loaded into encryption/decryption engine during the key effective period.

60. The method as in claim 59, wherein the valid periods of consecutively generated group keys by the master authenticator may overlap at the beginning and ending of their valid periods, during which both group keys are valid and the encrypting node devices use the newer group key to encrypt messages but the decrypting node devices may need to try both to decrypt messages, to ensure smooth group key change.

61. The method as in claim 59, further comprising providing, by a wireless network node, access service to at least one of the mobile client computing devices becoming an authenticator for authenticating client devices.

62. The method as in claim 61, wherein one of the wireless network nodes providing access service to at least one of the mobile client computing devices or a separate computer in communication with the wireless network node, being configured as an authentication server for the mobile client computing devices.

63. The method as in claim 62, further comprising authenticating at least one of the mobile client computing devices by an authenticator and an authentication server using the IEEE 802.1x protocol.

64. The method as in claim 49, wherein the authentication and encryption mechanisms are the WiFi Protected Access (WPA) scheme modified to allow the authenticator, master authenticator and authentication server to communicate over multiple hops.

49-1. The method as in claim 34, wherein the wireless computer network further comprising an authentication server in communication with the wireless network node devices, the method further comprising automatically configuring, by the wireless network node devices, themselves for communication forwarding in the wireless computer network by initiating their operating systems, determining their network addresses when operating in routing mode, contacting the authentication server, obtaining encryption keys and authentication, setting their backbone wireless network and local access service channels, and initiating a dynamic routing or bridging protocol that discovers neighboring wireless network node devices and establishes communication forwarding paths on the backbone wireless network.

65. A computer-readable medium storing a program executed by a wireless computer network in communication with mobile client computing devices comprising client wireless devices, the program causing the wireless computer network to execute the functions further comprising:

providing, by a wireless backbone network, a wireless networking service to the mobile client computing devices, comprising;

providing, by portable wireless network node devices of the wireless backbone network, wireless local access service to the mobile client computing devices in their respective coverage areas,

providing the wireless networking service to forward and deliver communication data of the mobile client computing devices on the wireless backbone network in a multi-hop manner to other of the mobile client computing devices or to other networks in communication with the wireless computer network,

performing routing, by one or more of the portable wireless network node devices,

storing, by the one or more of the portable wireless network node devices, a routing table comprising first data of subnet routes of network layer addresses for the mobile client computing devices and portable wireless network node devices, and second data of subnet routes to gateways for external network addresses and per-host routes of network layer addresses for the mobile client computing devices that have roamed from their initial access service network node coverage area, and per-host routes of link layer addresses for the mobile client computing devices and portable wireless network node devices, and

authenticating, by a backbone network node configured as a master authenticator node and another backbone node configured as an authentication server, an unauthenticated new network node to the backbone network with the assistance of another backbone node configured as a proxy authenticator node for the unauthenticated new network node.

66. The medium as in claim 65, further comprising:

specifying, by the routing table, the local interface and the neighboring interface to the respective wireless network node device that is the next hop-destination in a routing path, and

updating, by the wireless network node devices performing routing, their routing table by periodically exchanging routing update control messages that include IP addresses and link layer addresses.

67. The computer-readable medium as in claim 66, further comprising:

providing, by one or more of the portable wireless network node devices, a gateway service, the one or more of the portable network node devices comprising multiple interfaces,

providing, by each gateway service node device having one of the multiple interfaces provides, communication to the wireless backbone network, and

providing, by at least one of the multiple interfaces, communication to the other network in communication with the wireless computer network.

68. The computer-readable medium as in claim 66, wherein the portable wireless network node devices comprises multiple wireless interfaces, the functions further comprising:

providing, by at least one of the multiple wireless interfaces, local access service for the mobile client computing devices, and

providing, by at least one of the multiple wireless interfaces, communication with the wireless backbone service.

69. The computer-readable medium as in claim 66, further comprising:

controlling, by internal tables provided in each of the portable wireless network node devices, communications forwarding through one of bridging and routing,

automatically and dynamically, by the wireless computer network, adjusting for the movement of the portable wireless network node devices within the wireless computer network, the introduction of additional portable wireless network node devices to the wireless computer network, and the deletion or failure of current portable wireless network node devices by updating its internal tables controlling communications forwarding either through the bridging or the routing implemented in the portable wireless network node devices.

70. The computer-readable medium as in claim 69, wherein when the network is operating in routing mode, sharing, by the wireless computer network, an Internet-style, network layer, address space among the portable wireless network node devices and the mobile client computing devices.

71. The computer-readable medium as in claim 70, further comprising serving, by a portable wireless network node device, as an address manager dynamically assigns a backbone network layer address as well as one or more address space segments from the address space of the wireless computer network to a new portable wireless network node device after the new portable wireless network node device is authenticated to the wireless computer network.

72. The computer-readable medium as in claim 71, further comprising providing, by the wireless network node device, an internal routable address for the mobile client computing device from the assigned address space segment of the wireless network node device using a procedure comprising a DHCP function on the wireless network node device.

73. The computer-readable medium as in claim 69, wherein the wireless network node devices forwarding communication data on behalf of the mobile client computing devices using a dynamic routing protocol adapted to the wireless network node devices.

74. The computer-readable medium as in claim 69, wherein the wireless network node devices forwarding communication data on behalf of mobile client computing devices using a dynamic bridging protocol adapted to the wireless network node devices.

75. The computer-readable medium as in claim 74, wherein the bridging protocol is based on the IEEE 802.11 WDS links that are dynamically created and removed by the network nodes based on their current local neighboring network node connections.

76. The computer-readable medium as in claim 74, wherein the wireless network node devices performing bridging store a Bridging Table comprising a local interface and neighboring interfaces to the respective wireless network node devices that are the next hop destination in the bridging path.

77. The computer-readable medium as in claim 76, wherein the wireless network node devices performing bridging update their Bridging Table by periodically exchanging bridging update control messages that includes link layer addresses for all attached devices and clients.

78. The computer-readable medium as in claim 66, further comprising serving, by at least one of the wireless network node devices, as a gateway to another network in communication with the wireless computer network, and

automatically determining, in accordance with the network routing protocol, periodically executed by the wireless network node devices, the shortest path routes between mobile client computing devices in the wireless computer network or to the gateway.

79. The computer-readable medium as in claim 69, further comprising transferring, by the network wireless node devices, authentication information between themselves when a mobile client computing device roams from the coverage area of one wireless network node device to another wireless network node device to establish authentication and local access at the wireless network node device to provide access service.

80. The computer-readable medium as in claim 79, further comprising maintaining, by the mobile client computing device that roams from the coverage area of one of the wireless network node devices to another of the wireless network node devices, the same address and the routing protocol continues to efficiently route communication data to the mobile client computing device by automatically updating a client-specific host address entry in the routing tables of the wireless network node devices

81. The computer-readable medium as in claim 66, further comprising providing secure communications by encryption of messages and authentication of the wireless network node devices and the mobile client computing devices.

82. The computer-readable medium as in claim 66, wherein the wireless computer network further comprising an authentication server in communication with the wireless network node devices, the functions further comprising automatically configuring, by the wireless network node devices, themselves for communication forwarding in the wireless computer network by initiating their operating systems, determining their network addresses when operating in routing mode, contacting the authentication server, obtaining encryption keys and authentication, setting their backbone wireless network and local access service channels, and initiating a dynamic routing or bridging protocol that discovers neighboring wireless network node devices and establishes communication forwarding paths on the backbone wireless network.

83. The computer-readable medium as in claim 81, further comprising requesting, by the unauthenticated new network node, authentication to the backbone network, the unauthenticated new node in communication with at least one of the already authenticated backbone network nodes, one of these backbone network nodes becoming the proxy authenticator node for the unauthenticated new node and communicating with the master authenticator node to authenticate the unauthenticated new node to the backbone network.

84. The computer-readable medium as in claim 83, wherein when operating in a routing mode, further comprising:

transmitting, by the unauthenticated new node, identification data to neighboring proxy authenticator nodes,

receiving, by the proxy authenticator nodes, the identification data,

encapsulating the identification data in a message envelope, and

forwarding the encapsulated data to the master authenticator using the routing scheme.

85. The computer-readable medium as in claim 83, further comprising selecting, by the master authenticator node, one backbone node as the proxy authenticator node if more than one backbone node receives and forwards the new node identification data to the master authenticator.

86. The computer-readable medium as in claim 85, wherein the wireless computer network further comprising an authentication server in communication with the master authenticator node and authenticating the unauthenticated new node to the backbone network.

87. The computer-readable medium as in claim 86, further comprising enabling the new node, once authenticated to the backbone network, to become a proxy authenticator for an unauthenticated new wireless node.

88. The computer-readable medium as in claim 81, further comprising using a common group key as part of the encryption scheme for the backbone communications, wherein the group key is used by another key generating method to produce the actual per packet communication encryption key, and the group key is changed periodically and is only valid for a specified period of time, denoted by a start and end time.

89. The computer-readable medium as in claim 88, further comprising periodically generating, by the master authenticator, a new group key and transmitting the new group key to each node in the backbone network by encrypting the group key using a public key based method that only that destination node can decrypt.

90. The computer-readable medium as in claim 88, further comprising transmitting, by the master authenticator, the current active group key to a newly authenticated node by encrypting the group key using a public key based method that only the new node can decrypt, the new node then uses the group key to encrypt backbone communication.

91. The computer-readable medium as in claim 88, wherein each key periodically generated by the master authenticator has a specific valid period, which is specified in each new key transmission, and the received newly generated group key is stored by backbone node devices and only loaded into encryption/decryption engine during the key effective period.

92. The computer-readable medium as in claim 91, wherein the valid periods of consecutively generated group keys by the master authenticator may overlap at the beginning and ending of their valid periods, during which both group keys are valid and the encrypting node devices use the newer group key to encrypt messages but the decrypting node devices may need to try both to decrypt messages, to ensure smooth group key change.

93. The computer-readable medium as in claim 91, further comprising providing, by a wireless network node, access service to at least one of the mobile client computing devices becoming an authenticator for authenticating client devices.

94. The computer-readable medium as in claim 93, wherein one of the wireless network nodes providing access service to at least one of the mobile client computing devices or a separate computer in communication with the wireless network node, being configured as an authentication server for the mobile client computing devices.

95. The computer-readable medium as in claim 94, further comprising authenticating at least one of the mobile client computing devices by an authenticator and an authentication server using the IEEE 802.1x protocol.

96. The computer-readable medium as in claim 81, wherein the authentication and encryption mechanisms are the WiFi Protected Access (WPA) scheme modified to allow the authenticator, master authenticator and authentication server to communicate over multiple hops.