MIXED MODE SECURITY FOR MESH NETWORKS

• US 20090313464A1
• Filed: 06/11/2009
• Published: 12/17/2009
• Est. Priority Date: 06/11/2008
• Status: Active Grant

• Current Assignee: NXP USA, Inc. (NXP Semiconductors NV)
• Original Assignee: Marvell World Trade Limited (Marvell Technology Group Limited)
• Inventors: Goel, Sandesh, Shukla, Ashish K., Bhagwat, Rajesh Shreeram
• Granted Patent: US 9,232,389 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Mixed mode security is provided for a mesh network comprising a plurality of open mesh points and at least one secure mesh point that is capable of sending and receiving encrypted traffic. Aspects of the exemplary embodiment include configuring the secure mesh point to forward unencrypted traffic received from one of the plurality of open mesh points; and configuring the secure mesh point to be a source of unencrypted source traffic, and to receive unencrypted traffic that is destined for the secure mesh point to enable routes in the mesh network to terminate at the secure mesh point.

Claims

1. A method for providing mixed mode security for a mesh network comprising a plurality of open mesh points and at least one secure mesh point that is capable of sending and receiving encrypted traffic, the method comprising:

configuring the secure mesh point to forward unencrypted traffic received from one of the plurality of open mesh points; and

configuring the secure mesh point to be a source of unencrypted source traffic, and to receive unencrypted traffic that is destined for the secure mesh point to enable routes in the mesh network to terminate at the secure mesh point.

2. The method of claim 1 further comprising providing the secure mesh point with configurable first and second security modes, wherein when the first security mode is enabled, the secure mesh point forwards the unencrypted traffic, and when the second security mode is enabled, the secure mesh point originates the unencrypted source traffic, and receives the unencrypted traffic that is destined for the secure mesh point.

3. The method of claim 2 wherein when the first security mode is enabled, the secure mesh point is configured to set up routes between the secure mesh point and the plurality of open mesh points.

4. The method of claim 2 wherein when the second security mode is enabled, the secure mesh point is configured to send a received frame with a flag set indicating whether frame was received encrypted or unencrypted up an Open Systems Interconnection (OSI) layer stack.

5. The method of claim 4 further comprising configuring the secure mesh point to receive a packet sent down the OSI layer stack by an end application or service, the packet having a flag set to indicate whether the secure mesh point should encrypt the packet or not when transmitting the packet.

6. The method of claim 2 wherein the encrypted traffic and the unencrypted traffic are transmitted through the mesh network, the method further comprising using at least one reserved bit in a management frame to indicate secure route discovery or open route discovery.

7. The method of claim 2 wherein when route discovery is originated by a first open mesh point for a second open mesh point, the first open mesh point generates a route request message indicating open route discovery, and the route request message is forwarded by intermediate open mesh points and secure mesh points that are configured to forward the unencrypted traffic received from the first open mesh point.

8. The method of claim 2 wherein when route discovery is originated by a first open mesh point for the secure mesh point, the first open mesh point generates a route request message indicating open route discovery, and the route request message is forwarded by intermediate open mesh points and any other secure mesh points that are configured to forward the unencrypted traffic destined for the secure mesh point, and the route request message is accepted and responded to by the secure mesh point if the secure mesh point has the second security mode enabled.

9. The method of claim 2 wherein the mesh network includes multiple secure mesh points, and wherein when route discovery is originated by a first secure mesh point for a second secure mesh point, the first secure mesh point originating the route discovery generates a route request message indicating secure route discovery, such that intermediate secure mesh points only send a secure route response message if any secure route exists, and wherein intermediate open mesh points ignore and discard the route request message.

10. The method of claim 2 wherein when route discovery is originated by the secure mesh point for one of the open mesh points, the secure mesh point, which has the second security mode enabled, generates a route request message indicating open route discovery, and the route request message is forwarded by intermediate open mesh points and secure mesh points which are configured to forward the unencrypted source traffic.

11. The method of claim 2 wherein when the secure mesh point starts a first route discovery for a final destination, but is unaware of a security mode of the final destination, the secure mesh point generates a first route request message indicating secure route discovery, wherein if the first route discovery fails and the secure mesh point has the second security mode enabled, the secure mesh point initiates a second route discovery using a second route request message indicating open route discovery.

12. The method of claim 1 wherein the secure mesh point is configured to maintain security capability information of the open mesh points that are not 1-hop neighbors by listening to traffic originated by open mesh points during forwarding.

13. A wireless device, comprising:

a processor;

a mixed mode security protocol executing on the processor, the mixed mode security protocol functional for;

configuring the wireless device as a secure mesh point in a mesh network comprising a plurality of open mesh points;

configuring the secure mesh point to forward unencrypted traffic received from one of the plurality of open mesh points; and

configuring the secure mesh point to be a source of unencrypted source traffic, and to receive unencrypted traffic that is destined for the secure mesh point to enable routes in the mesh network to terminate at the secure mesh point.

14. The device of claim 13 wherein the secure mesh point includes configurable first and second security modes, wherein when the first security mode is enabled, the secure mesh point forwards the unencrypted traffic, and when the second security mode is enabled, the secure mesh point originates the unencrypted source traffic, and receives the unencrypted traffic that is destined for the secure mesh point.

15. The device of claim 14 wherein when the first security mode is enabled, the secure mesh point is configured to set up routes between the secure mesh point and the plurality of open mesh points.

16. The device of claim 14 wherein when route discovery is originated by a first open mesh point for a second open mesh point, the first open mesh point generates a route request message indicating open route discovery, and the route request message is forwarded by intermediate open mesh points and secure mesh points that are configured to forward the unencrypted traffic received from the first open mesh point.

17. The device of claim 14 wherein when route discovery is originated by a first open mesh point for the secure mesh point, the first open mesh point generates a route request message indicating open route discovery, and the route request message is forwarded by intermediate open mesh points and any other secure mesh points that are configured to forward the unencrypted traffic destined for the secure mesh point, and the route request message is accepted and responded to by the secure mesh point if the secure mesh point has the second security mode enabled.

18. The device of claim 14 wherein the mesh network includes multiple secure mesh points, and wherein when route discovery is originated by a first secure mesh point for a second secure mesh point, the first secure mesh point originating the route discovery generates a route request message indicating secure route discovery, such that intermediate secure mesh points only send a secure route response message if any secure route exists, and wherein intermediate open mesh points ignore and discard the route request message.

19. The device of claim 14 wherein when route discovery is originated by the secure mesh point for one of the open mesh points, the secure mesh point, which has the second security mode enabled, generates a route request message indicating open route discovery, and the route request message is forwarded by intermediate open mesh points and secure mesh points which are configured to forward the unencrypted source traffic.

20. The device of claim 14 wherein when the secure mesh point starts a first route discovery for a final destination, but is unaware of a security mode of the final destination, the secure mesh point generates a first route request message indicating secure route discovery, wherein if the first route discovery fails and the secure mesh point has the second security mode enabled, the secure mesh point initiates a second route discovery using a second route request message indicating open route discovery.