Method and System for Secure Transmission of Data in an Ad Hoc Network

• US 20100042831A1
• Filed: 05/05/2006
• Published: 02/18/2010
• Est. Priority Date: 06/13/2005
• Status: Abandoned Application

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Kutschenreuter, Matthias, Vicari, Norbert, Schwingenschlögl, Christian, Finkenzeller, Michael, Bahr, Michael
• Application Number:
  US11/922,094
• Publication Number:
  US 20100042831A1
• Time in Patent Office: Days
• US Class Current: 713/160
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/064 Hierarchical key distribution, e.g. by multi-tier trusted parties
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability

Abstract

Using at least one network consisting of at least one node, a multi-hop communication system is formed in which data are received and forwarded from a transmitting first node to a second node receiving the data via at least one third node interposed between the first and the second node. For transmission, the data are subdivided into packets that have a useful data portion (payload) and at least one first control data portion associated with the multi-hop method and a second control data portion associated with the network. The data are encrypted using a first public key determined by the first node and the second node, but only the useful data portion is encrypted using the first public key.

Claims

1-15. -15. (canceled)

16. A method for the transmission of data in a multi-hop communication system forwarded by at least one network having at least one node, in which the data is received and forwarded by a transmitting first node to a second node via at least one third node interposed between the first and second nodes, comprising:

subdividing the data for transmission into packets that have a payload data portion and at least one first control data portion associated with the multi-hop method and a second control data portion associated with the network; and

encrypting the data using at least one first master key determined by the first node and the second node, with only the payload data portion encrypted using the first master key.

17. The method according to claim 16, further comprising determining a second master key by the transmitting first node and an adjacent node used as one of the at least one third node.

18. The method according to claim 17, further comprising encrypting the first control data portion using the second master key.

19. The method according to claim 18, further comprising:

deriving a first key from the second master key;

deriving a second key from the first master key;

encrypting the packets for the transmission in the transmitting first node with the first control data portion encrypted using the first key, the payload data portion encrypted using the second key, and the second control data portion remaining unencrypted;

transmitting the packets to the at least one third node;

decrypting at the at least one third node the first control data portion encrypted using the first key;

reading the control data portion at the at least one third node, deriving a new first key for another node adjacent the at least one third node and repeating said encrypting and transmitting of the packets at the at least one third node and decrypting of the first control data portion at the other node, until the other node is the second node; and

decrypting the payload data using the second key at the second node.

20. The method according to claim 19, wherein routing message packets containing only routing messages are encrypted completely.

21. The method according to claim 20, wherein the routing message packets are generated according to a routing protocol.

22. The method according to claim 21, wherein the routing message packets are generated within a second layer of an Open Systems Interconnection reference model.

23. The method according to claim 20, wherein the routing message packets are generated within a third layer of the Open Systems Interconnection reference model.

24. The method according to claim 20, using at least one of an Ad-Hoc On-Demand Distance Vector protocol, an Optimized Link State Routing protocol and a derivative of either.

25. The method according to claim 19, wherein said encrypting is carried out in compliance with security procedures according to at least one of IEEE802.1X and IEEE802.11i.

26. The method according to claim 25, wherein at least one of the networks functions in accordance with IEEE802.11 or a derivative thereof.

27. The method according to claim 26, wherein the second control data portion is formed by header data in accordance with IEEE802.11.

28. The method according to claim 27, wherein the first control data portion is formed by header data in accordance with a multi-hop transmission protocol.

29. The method according to claim 28, wherein said encrypting uses a 128 bit long key in accordance with the Counter Mode Cipher Block Chaining-Message Authentication Code Protocol.

30. The method according to claim 18, wherein routing message packets containing only routing messages are encrypted completely.

31. The method according to claim 30, wherein the routing message packets are generated according to a routing protocol.

32. The method according to claim 31, wherein the routing message packets are generated within a second layer of an Open Systems Interconnection reference model.

33. The method according to claim 30, wherein the routing message packets are generated within a third layer of the Open Systems Interconnection reference model.

34. The method according to claim 30, using at least one of an Ad-Hoc On-Demand Distance Vector protocol, an Optimized Link State Routing protocol and a derivative of either.

35. The method according to claim 17, wherein routing message packets containing only routing messages are encrypted completely.

36. The method according to claim 35, wherein the routing message packets are generated according to a routing protocol.

37. The method according to claim 35, wherein the routing message packets are generated within a second layer of an Open Systems Interconnection reference model.

38. The method according to claim 35, wherein the routing message packets are generated within a third layer of the Open Systems Interconnection reference model.

39. The method according to claim 35, using at least one of an Ad-Hoc On-Demand Distance Vector protocol, an Optimized Link State Routing protocol and a derivative of either.

40. The method according to claim 16, wherein routing message packets containing only routing messages are encrypted completely.

41. The method according to claim 40, wherein the routing message packets are generated according to a routing protocol.

42. The method according to claim 41, wherein the routing message packets are generated within a second layer of an Open Systems Interconnection reference model.

43. The method according to claim 40, wherein the routing message packets are generated within a third layer of the Open Systems Interconnection reference model.

44. The method according to claim 40, using at least one of an Ad-Hoc On-Demand Distance Vector protocol, an Optimized Link State Routing protocol and a derivative of either.

45. The method according to claim 16, wherein said encrypting is carried out in compliance with security procedures according to at least one of IEEE802.1X and IEEE802.11i.

46. The method according to claim 45, wherein at least one of the networks functions in accordance with IEEE802.11 or a derivative thereof.

47. The method according to claim 46, wherein the second control data portion is formed by header data in accordance with IEEE802.11.

48. The method according to claim 47, wherein the first control data portion is formed by header data in accordance with a multi-hop transmission protocol.

49. The method according to claim 48, wherein said encrypting uses a 128 bit long key in accordance with the Counter Mode Cipher Block Chaining-Message Authentication Code Protocol.

50. A system for transmitting data in a multi-hop method, comprising:

means for subdividing the data for transmission into packets that have a payload data portion and at least one first control data portion associated with the multi-hop method and a second control data portion associated with the network; and

means for encrypting the data using at least one first master key determined by the first node and the second node, with only the payload data portion encrypted using the first master key.