METHOD AND DEVICE FOR DYNAMIC DEPLOYMENT OF TRUST BRIDGES IN AN AD HOC WIRELESS NETWORK

• US 20090276841A1
• Filed: 04/30/2008
• Published: 11/05/2009
• Est. Priority Date: 04/30/2008
• Status: Active Grant

• Current Assignee: ARRIS Enterprises LLC (CommScope Holding Company, Inc.)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Guo, Liang, Metke, Anthony R., Bao, Qi, Lee, Whay Chiou, Eastlake, Donald E. III
• Granted Patent: US 8,539,225 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method for deploying a trust bridge in an ad hoc wireless network can provide interoperability for multi-organizational authentication. The method includes processing at a delegate certification authority (DCA) node device authorizations received from of a plurality of certification authorities (CAs) of different organizations, where the authorizations authorize the DCA node device to serve as a DCA representing the CAs (step 1105). The DCA node device then processes context information received from the ad hoc wireless network (step 1110). Next, the DCA node device determines, based on the context information, that a second node device should be enabled as a new trust bridge (step 1115). The DCA node device then performs a trust bridge deployment to enable the second node device to serve as the new trust bridge (step 1120).

Claims

1. A method for deploying a trust bridge in an ad hoc wireless network to provide interoperability for multi-organizational authentication, the method comprising:

processing at a delegate certification authority (DCA) node device authorizations received from of a plurality of certification authorities (CAs) of different organizations, wherein the authorizations authorize the DCA node device to serve as a DCA representing the CAs;

processing at the DCA node device context information received from the ad hoc wireless network;

determining at the DCA node device, based on the context information, that a second node device should be enabled as a new trust bridge; and

performing at the DCA node device a trust bridge deployment to enable the second node device to serve as the new trust bridge.

2. The method of claim 1, wherein the trust bridge deployment comprises:

authenticating the second node device at the DCA node device;

determining at the DCA node device that the second node device has authenticated the DCA node device;

determining at the DCA node device that the second node device is authorized to function as a trust bridge;

transmitting a bridging certificate from the DCA node device to the second node device; and

transmitting a DCA-authorizing certificate from the DCA node device to the second node device, whereby the second node device is authorized to function as a trust bridge in the ad hoc wireless network.

3. The method of claim 2, wherein the bridging certificate comprises data selected from the following:

a bridge name field;

a bridge public key field;

a validity period field;

a foreign certification authority public key field;

a constraints field;

a DCA name filed; and

a signature field.

4. The method of claim 2, wherein the DCA-authorizing certificate comprises data selected from the following:

a DCA name field;

a DCA public key field;

a privileges field;

a conditions field;

a validity period field;

a CA name field; and

a CA signature field.

5. The method of claim 2, wherein the DCA node device can access a predetermined set of trust anchors and a corresponding set of signed certificates received from a plurality of organizations participating in the ad hoc wireless network.

6. The method of claim 5, wherein each organization in the plurality of organizations has granted a DCA-authorizing certificate to the DCA node device, whereby the DCA node device is delegated authority to provide a limited proxy certification authority service on behalf of an organization.

7. The method of claim 2, wherein the DCA node device can function as a master trust bridge in the ad hoc wireless network.

8. The method of claim 2, wherein the DCA node device authorizes the second node device to use a private key of the second node device to facilitate a trust bridging service.

9. The method of claim 2, further comprising, before authenticating the second node device at the DCA node device, processing at the DCA node device a bridging request message received from the second node device.

10. The method of claim 1, wherein the context information comprises network state information, and determining at the DCA node device, based on the context information, that a second node device should be enabled as a new trust bridge employs a predetermined policy based on the network state information.

11. The method of claim 10, wherein the network state information comprises attributes of a node device.

12. The method of claim 10, wherein the network state information comprises network topology data.

13. The method of claim 10, wherein the network state information comprises a plurality of bridging requests.

14. A delegate certification authority (DCA) node device for deploying a trust bridge in an ad hoc wireless network to provide interoperability for multi-organizational authentication, the DCA node device comprising:

computer readable program code for processing at the DCA node device authorizations received from of a plurality of certification authorities (CAs) of different organizations, wherein the authorizations authorize the DCA node device to serve as a DCA representing the CAs;

computer readable program code for processing at the DCA node device context information received from the ad hoc wireless network;

computer readable program code for determining at the DCA node device, based on the context information, that a second node device should be enabled as a new trust bridge; and

computer readable program code for performing at the DCA node device a trust bridge deployment to enable the second node device to serve as the new trust bridge.

15. The DCA node device of claim 14, wherein the computer readable program code for performing at the DCA node device a trust bridge deployment comprises:

computer readable program code for authenticating the second node device at the DCA node device;

computer readable program code for determining at the DCA node device that the second node device has authenticated the DCA node device;

computer readable program code for determining at the DCA node device that the second node device is authorized to function as a trust bridge;

computer readable program code for transmitting a bridging certificate from the DCA node device to the second node device; and

computer readable program code for transmitting a DCA-authorizing certificate from the DCA node device to the second node device, whereby the second node device is authorized to function as a trust bridge in the ad hoc wireless network.

16. The DCA node device of claim 15, wherein the bridging certificate comprises data selected from the following:

a bridge name field;

a bridge public key field;

a validity period field;

a foreign certification authority public key field;

a constraints field;

a DCA name filed; and

a signature field.

17. The DCA node device of claim 15, wherein the DCA-authorizing certificate comprises data selected from the following:

a DCA name field;

a DCA public key field;

a privileges field;

a conditions field;

a validity period field;

a CA name field; and

a CA signature field.

18. The DCA node device of claim 15, wherein the DCA node device can access a predetermined set of trust anchors and a corresponding set of signed certificates received from a plurality of organizations participating in the ad hoc wireless network.

19. The DCA node device of claim 18, wherein each organization in the plurality of organizations has granted a DCA-authorizing certificate to the DCA node device, whereby the DCA node device is delegated authority to provide a limited proxy certification authority service on behalf of an organization.

20. The DCA node device of claim 14, wherein the context information comprises network state information, and determining at the DCA node device, based on the context information, that a second node device should be enabled as a new trust bridge employs a predetermined policy based on the network state information.