System And Methods For Efficient Authentication Of Medical Wireless Ad Hoc Network Nodes

• US 20070214357A1
• Filed: 06/07/2005
• Published: 09/13/2007
• Est. Priority Date: 06/29/2004
• Status: Active Grant

• Current Assignee: Koninklijke Philips N.V.
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Sanchez Sanchez, David, Baldus, Heribert
• Granted Patent: US 7,965,845 B2
• Time in Patent Office: Days
• US Class Current: 713/157
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2209/88 Medical equipments
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A medical ad hoc wireless network (10) is deployed in a healthcare medical facility surrounding individual patients and including wireless nodes (A, B, . . . , Z). Before deployment, each node (A, B, . . . , Z) is pre-initialized with a public key certificate (22) and offers a trust and symmetric key distribution service (32). In joining the ad hoc network (10), a node (B) authenticates and registers to one randomly self-chosen node (A) by using certified public keys (20). Such node (A) becomes Trusted Portal (TP_A) of the node (B). The node (B) dynamically registers to a new self-chosen TP node when its old TP node leaves the ad hoc network (10). The network (10) supports symmetric key authentication between nodes registered to the same TP node. Additionally, it supports symmetric key authentication between nodes registered to different TP nodes.

Claims

1. A security system for an ad hoc wireless network comprising:

a plurality of local wireless network nodes; and

a means for distributing trust and symmetric keys among the local wireless network nodes.

2. The system as set forth in claim 1, further including:

a trust initialization means for establishing a trust relationship among the network nodes of the ad hoc network.

3. The system as set forth in claim 2, wherein the trust initialization means establishes a trust relationship between a first and a second node, wherein the first node is arbitrarily selected by the second node from the network nodes to be a trusted portal of the ad hoc network and further including:

an authentication means for performing an authentication between the first node and the second node; and

a symmetric key means for computing a symmetric key which establishes a long-term trust relationship between the trusted portal and the second node.

4. The system as set forth in claim 3, wherein the authentication is mutually performed by a use of certified public keys which are issued to the first and second nodes by an offline certification authority preceding the establishment of the trusted portal.

5. The system as set forth in claim 3, wherein the tust relationship means establisies a trust relationship between the first node and one or more nodes such that a TP-domain of the trusted portal grows.

6. The system as set forth in claim 3, further including:

an intra-domain trust and key distribution means for distributing trust information to two or more nodes that have previously established the trust relationship with the trusted portal.

7. The system as set forth in claim 6, wherein, in response to a request by the second node, the symmetric key computing means calculates a symmetric key associated to the identities of the two or more nodes.

8. The system as set forth in claim 7, wherein authentication means uses the calculated symmetric key (K_BC) to mutually authenticate the two or more nodes.

9. The system as set forth in claim 3, further including:

a cross-domain trust and key distribution means for distributing trust information to two or more nodes that have previously established trust relationships with different corresponding trusted portals.

10. The system as set forth in claim 9, wherein, in response to a request to the trusted portal by the second node, the symmetric key computing means calculates a symmetric key which is associated to the identities of the two or nodes and which key is sent securely encrypted from the trusted portal to the second node, and another of the two or more nodes via at least the trusted portal.

11. The system as set forth in claim 10, wherein authentication means uses the symmetric key to mutually authenticate the two or more nodes.

12. The system as set forth in claim 1, further including:

a plurality of devices including at least one of physiological condition monitors, controllable medication dosing devices, and PDAs, each device being associated with one of the network nodes.

13. A method of key management comprising:

distributing trust and symmetric keys among nodes of an ad hoc network.

14. The method as set forth in claim 13, further including:

establishing a first trusted portal which is arbitrarily selected from the nodes of the network by a first node;

performing an initial authentication between the first trusted portal and the first node; and

computing a symmetric key which establishes a long term trust relationship between the first trusted portal and the first node.

15. The method as set forth in claim 14, wherein the step of authentication includes:

performing the authentication by a use of certified public keys which have been issued to each node of the ad hoc network by an offline certification authority preceding the establishment of the trusted portal.

16. The method as set forth in claim 14, further including:

distributing the symmetric key between nodes that have previously established trusted relationships with the same trusted portal.

17. The method as set forth in claim 16, further including:

in response to a request by the first node, computing a symmetric key associated to the identities of the nodes that previously established trust relationship; and

authenticating the nodes that previously established trust relationships with the calculated symmetric key.

18. The method as set forth in claim 14, further including:

distributing the symmetric key between a second set of nodes that have previously established trust relationships with different corresponding first and second trusted portals.

19. The method as set forth in claim 18, further including:

in response to a request to the first trusted portal by the first node, computing a symmetric key;

sending the symmetric key from the first trusted portal to the first node which symmetric key is securely encrypted and integrity protected;

sending the symmetric key from the first trusted portal to the second trusted portal which symmetric key is securely encrypted and integrity protected;

sending the symmetric key from the second trusted portal to the second of the second set of nodes that previously establish trust relationships which symmetric key is securely encrypted and integrity protected; and

authenticating the second set of nodes and with the symmetric key.

20. A network having a plurality of nodes programmed for performing the method of claim 13.