MANAGING ESTABLISHMENT AND REMOVAL OF SECURITY ASSOCIATIONS IN A WIRELESS MESH NETWORK

• US 20080031155A1
• Filed: 09/13/2006
• Published: 02/07/2008
• Est. Priority Date: 08/02/2006
• Status: Active Grant

• Current Assignee: ARRIS Enterprises LLC (CommScope Holding Company, Inc.)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Zeng, Surong, Korus, Michael F., Shatil, Ohad
• Granted Patent: US 7,804,807 B2
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 40/24 Connectivity information management, e.g. connectivity discovery or connectivity update
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Techniques and technologies are provided for managing establishment, maintenance and removal of security associations (SAs) between nodes in an ad hoc network, such as a wireless mesh network.

Claims

1. A node configured to manage a security association with at least one particular neighbor node in a wireless network, the node comprising:

a neighbor node table configured to store an entry for at least one neighbor node comprising attributes associated with the neighbor node;

a security module configured to store security association information associated with each neighbor node, and

a routing module communicatively coupled to the security module, wherein the routing module is configured to;

determine, based on particular attributes associated with each neighbor node in the neighbor node table, at least one of the particular neighbor nodes from the neighbor node table that the node will attempt to establish a security association with;

select at least one of the particular neighbor nodes the node will attempt to establish the security association with; and

send a first message to the security module to trigger the security module to attempt to establish a particular security association with the particular neighbor node that is selected.

2. A node according to claim 1, wherein the security association information comprises:

security association state information between a pair of nodes and key material.

3. A node according to claim 1, wherein the security module is further configured to:

send a second message to attempt to establish the security association with the particular neighbor node, wherein the node and the particular neighbor node attempt establish the security association;

determine whether the security association has been successfully established between the node and the selected neighbor node; and

send a third message to the routing module when the node and the particular neighbor node establish the security association, wherein the third message comprises security association state information, wherein the security association state information comprises either an indication that the nodes have a security association or an indication that the nodes do not have a security association.

4. A node according to claim 3, wherein the routing module is further configured to:

synchronize to the security association state information from the security module.

5. A node according to claim 4, wherein the routing module is further configured to synchronize to the security association state information from the security module by being configured to:

update an entry in the neighbor node table for the particular neighbor node with the security association state information, and

set a security association established flag in the entry in the neighbor node table for the particular neighbor node to indicate that the node and the particular neighbor node share the security association.

6. A node according to claim 4, wherein the routing module is configured to:

establish a route between the node and the particular neighbor node after the security association is established.

7. A node according to claim 1, wherein the routing module is configured to:

determine, based on particular attributes associated with each neighbor node in the neighbor node table, particular neighbor nodes from the neighbor node table that the node will attempt to establish the security association with;

select the particular neighbor nodes which the node will attempt to establish the security association with; and

send a first message to the security module to trigger establishment of security associations with the particular neighbor nodes that are selected.

8. A node according to claim 1, wherein the attributes specified in the neighbor node table comprise at least one of:

Link Quality Measurements (LQMs) which account for the quality of a wireless link with the particular neighbor node;

routing metrics which account for metrics along a route to the particular neighbor node;

mobility domain information comprising a mobility domain value advertised by the particular neighbor node;

mobility information about the particular neighbor node; and

security association state information for the particular node.

9. A node according to claim 1, wherein the wireless network comprises a wireless mesh network, wherein the node comprises a first peer mesh node, and wherein the second node comprises a second peer mesh node.

10. A node according to claim 9, wherein the wireless mesh network comprises a wireless mesh ad hoc network.

11. A node according to claim 1, wherein the routing module is configured to:

remove entries for stale neighbor nodes from the neighbor node table; and

send an indication to the security module which indicates that the stale neighbor node entries have been removed from the neighbor node table.

12. A node according to claim 11, wherein the routing module is further configured to:

detect the presence of neighbor nodes within communication range of the node based on messages received from the neighbor nodes, and modify the neighbor node table, using information received in the messages from the neighbor nodes, to include an entry for each neighbor node, wherein each entry comprises attributes associated with a particular neighbor node, wherein the attributes for each neighbor node comprise security association information which indicates whether the node has established a security association with the particular neighbor node; and

determine which neighbor node entries are stale and to be removed from the neighbor node table; and

notify the security module that;

a security association corresponding to the particular neighbor node has been removed from the neighbor node table.

13. A node according to claim 12, wherein the routing module is configured to determine which neighbor node entries are stale and to be removed from the neighbor node table by being configured to:

check the neighbor node table entry for each particular neighbor node to determine a number of missed messages from the particular neighbor node; and

determine if the number of missed messages from the particular neighbor node exceeds a threshold.

14. A node according to claim 13, wherein the routing module is configured to:

maintain a flag which indicates state of the security association for that particular neighbor node in the neighbor node table if the number of missed messages from the particular neighbor node is less than or equal the threshold.

15. A node according to claim 14, wherein the routing module is configured to remove entries for stale neighbor nodes from the neighbor node table by being configured to:

designate the neighbor node table entry for each particular neighbor node as stale if the number of missed messages from the particular neighbor node exceeds the threshold, wherein the stale entries are removed from the neighbor node table; and

remove entries for stale neighbor nodes from the neighbor table if the number of missed messages from the particular neighbor node is greater than the threshold number.

16. A node according to claim 15, wherein the routing module is further configured to:

send a message to the security module indicating that the routing module has removed the particular neighbor node from the neighbor node list; and

wherein the security module is further configured to

mark a security association for the particular neighbor node as being eligible for removal.

17. A node according to claim 16, wherein the security module is configured to:

remove stale security associations from the security module, wherein stale security associations are marked as removal eligible security associations.

18. A node according to claim 12, wherein the attributes for each neighbor node further comprise at least one of:

Link Quality Measurements (LQMs) which account for the quality of a wireless link with the particular neighbor node;

routing metrics which account for metrics along a route to the particular neighbor node;

mobility domain information comprising a mobility domain value advertised by the particular neighbor node;

mobility information about the particular neighbor node; and

security association state information.

19. A node according to claim 1, wherein the security module further comprises a security association table comprising a timer associated with each security association, and wherein the security module is configured to remove stale security associations from the security association table by being configured to:

start a particular timer when a particular security association is established;

determine if the particular timer has expired; and

remove the particular security association associated with that particular timer from the security association table if the particular timer has expired.

20. A node according to claim 19, wherein the security module is configured to:

send a remove message to the routing module indicating that the security association information for that particular neighbor node has been removed from the security module, and that the routing module should remove the particular security association state information.

21. A node according to claim 19, wherein the routing module is configured to:

receive the remove message from the security module; and

remove a security association flag for that particular neighbor node from the neighbor node table.

22. A method for managing a security association between a node and at least one particular neighbor node in a wireless network, wherein the node comprises:

a neighbor node table configured to store an entry for at least one neighbor node comprising attributes associated with the neighbor node;

a security module configured to store security association information associated with each neighbor node, and a routing module communicatively coupled to the security module, the method comprising;

determining, at the routing module based on particular attributes associated with each neighbor node in the neighbor node table, at least one of the particular neighbor nodes from the neighbor node table that the node will attempt to establish a security association with;

selecting, at the routing module, at least one of the particular neighbor nodes the node will attempt to establish the security association with; and

sending a first message from the routing module to the security module to trigger the security module to attempt to establish a particular security association with the particular neighbor node that is selected.

23. A method according to claim 22, wherein the security association information comprises:

security association state information between a pair of nodes and key material.

24. A method according to claim 22, further comprising:

sending, from the security module, a second message to attempt to establish the security association with the particular neighbor node, wherein the node and the particular neighbor node attempt establish the security association;

determining, at the security module, whether the security association has been successfully established between the node and the selected neighbor node; and

sending a third message from the security module to the routing module when the node and the particular neighbor node establish the security association, wherein the third message comprises security association state information, wherein the security association state information comprises either an indication that the nodes have a security association or an indication that the nodes do not have a security association.

25. A method according to claim 24, further comprising:

synchronizing the routing module to the security association state information from the security module.

26. A method according to claim 25, wherein synchronizing the routing module to the security association state information from the security module, further comprises:

updating an entry in the neighbor node table for the particular neighbor node with the security association state information; and

setting a security association established flag in the entry in the neighbor node table for the particular neighbor node to indicate that the node and the particular neighbor node share the security association.

27. A method according to claim 25, further comprising:

establishing, at the routing module, a route between the node and the particular neighbor node after the security association is established.

28. A method according to claim 22, wherein the routing module is configured to:

determining, at the routing module based on particular attributes associated with each neighbor node in the neighbor node table, particular neighbor nodes from the neighbor node table that the node will attempt to establish the security association with;

selecting, at the routing module, the particular neighbor nodes which the node will attempt to establish the security association with; and

sending a first message from the routing module to the security module to trigger establishment of security associations with the particular neighbor nodes that are selected.

29. A method according to claim 22, wherein the attributes specified in the neighbor node table comprise at least one of:

Link Quality Measurements (LQMs) which account for the quality of a wireless link with the particular neighbor node;

routing metrics which account for metrics along a route to the particular neighbor node;

mobility domain information comprising a mobility domain value advertised by the particular neighbor node;

mobility information about the particular neighbor node; and

security association state information for the particular node.

30. A method according to claim 22, further comprising:

removing entries for stale neighbor nodes from the neighbor node table; and

sending an indication from the routing module to the security module which indicates that the stale neighbor node entries have been removed from the neighbor node table.

31. A method according to claim 30, wherein the routing module is further configured to:

detecting, at the routing module, the presence of neighbor nodes within communication range of the node based on messages received from the neighbor nodes, and modify the neighbor node table, using information received in the messages from the neighbor nodes, to include an entry for each neighbor node, wherein each entry comprises attributes associated with a particular neighbor node, wherein the attributes for each neighbor node comprise security association information which indicates whether the node has established a security association with the particular neighbor node; and

determining, at the routing module, which neighbor node entries are stale and to be removed from the neighbor node table; and

notifying, the security module that a security association corresponding to the particular neighbor node has been removed from the neighbor node table.

32. A method according to claim 31, wherein determining, at the routing module, which neighbor node entries are stale and to be removed from the neighbor node table, further comprises:

checking, at the routing module, the neighbor node table entry for each particular neighbor node to determine a number of missed messages from the particular neighbor node; and

determining, at the routing module, if the number of missed messages from the particular neighbor node exceeds a threshold.

33. A method according to claim 32, further comprising:

maintaining, at the routing module, a flag which indicates state of the security association for that particular neighbor node in the neighbor node table if the number of missed messages from the particular neighbor node is less than or equal the threshold.

34. A method according to claim 33, wherein removing entries for stale neighbor nodes from the neighbor node table, comprises:

designating, at the routing module, the neighbor node table entry for each particular neighbor node as stale if the number of missed messages from the particular neighbor node exceeds the threshold, wherein the stale entries are removed from the neighbor node table; and

removing entries for stale neighbor nodes from the neighbor table if the number of missed messages from the particular neighbor node is greater than the threshold number.

35. A method according to claim 34, further comprising:

sending a message from the routing module to the security module indicating that the routing module has removed the particular neighbor node from the neighbor node list; and

marking, at the security module, a security association for the particular neighbor node as being eligible for removal.

36. A method according to claim 22, wherein the security module further comprises a security association table comprising a timer associated with each security association, and further comprising:

removing stale security associations from the security association table by;

starting a particular timer when a particular security association is established;

determining if the particular timer has expired; and

removing the particular security association associated with that particular timer from the security association table if the particular timer has expired.

37. A system, comprising:

a particular neighbor node; and

a node configured to manage a security association with the particular neighbor node, wherein the node comprises;

a neighbor node table configured to store an entry for at least the particular neighbor node comprising attributes associated with the particular neighbor node;

a security module configured to store security association information associated with each neighbor node, and

a routing module communicatively coupled to the security module, wherein the routing module is configured to;

determine, based on particular attributes associated with each neighbor node in a neighbor node table, at least one of the particular neighbor nodes from the neighbor node table that the node will attempt to establish a security association with;

select at least one of the particular neighbor nodes the node will attempt to establish the security association with; and

send a first message to the security module to trigger the security module to attempt to establish a particular security association with the particular neighbor node that is selected.

38. A system according to claim 37, wherein the routing module is configured to:

remove entries for stale neighbor nodes from the neighbor node table;

send an indication to the security module which indicates that the stale neighbor node entries have been removed from the neighbor node table;

detect the presence of neighbor nodes within communication range of the node based on messages received from the neighbor nodes, and modify the neighbor node table, using information received in the messages from the neighbor nodes, to include an entry for each neighbor node,

wherein each entry comprises attributes associated with a particular neighbor node, wherein the attributes for each neighbor node comprise security association information which indicates whether the node has established a security association with the particular neighbor node; and

determine which neighbor node entries are stale and to be removed from the neighbor node table; and

notify the security module that;

a security association corresponding to the particular neighbor node has been removed from the neighbor node table.

39. A system according to claim 38, wherein the routing module is configured to:

determine which neighbor node entries are stale and to be removed from the neighbor node table by being configured to;

check the neighbor node table entry for each particular neighbor node to determine a number of missed messages from the particular neighbor node; and

determine if the number of missed messages from the particular neighbor node exceeds a threshold, and wherein the routing module is configured to;

maintain a flag which indicates state of the security association for that particular neighbor node in the neighbor node table if the number of missed messages from the particular neighbor node is less than or equal the threshold, and is configured to remove entries for stale neighbor nodes from the neighbor node table by being configured to;

designate the neighbor node table entry for each particular neighbor node as stale if the number of missed messages from the particular neighbor node exceeds the threshold, wherein the stale entries are removed from the neighbor node table; and

remove entries for stale neighbor nodes from the neighbor table if the number of missed messages from the particular neighbor node is greater than the threshold number.

40. A system according to claim 37, wherein the security module further comprises a security association table comprising a timer associated with each security association, and wherein the security module is configured to remove stale security associations from the security association table by being configured to:

start a particular timer when a particular security association is established;

determine if the particular timer has expired; and

remove the particular security association associated with that particular timer from the security association table if the particular timer has expired.

41. A system according to claim 40, wherein the security module is configured to:

send a remove message to the routing module indicating that the security association information for that particular neighbor node has been removed from the security module, and that the routing module should remove the particular security association state information.