METHOD AND SYSTEM FOR ENFORCING SECURITY POLICES IN MANETS

• US 20100058442A1
• Filed: 12/26/2006
• Published: 03/04/2010
• Est. Priority Date: 12/29/2006
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: Frosali, Federico, Freguglia, Giorgio, Costa, Luciana
• Granted Patent: US 8,370,894 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 40/24 Connectivity information management, e.g. connectivity discovery or connectivity update
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A method of enforcing security policies in a mobile ad-hoc network, includes: entrusting at least one first network node along a data traffic route from a data traffic origin node to a data traffic destination node, with the enforcing of predefined security policies on the data traffic; and entrusting at least one second network node, distinct from said first network node, with the control of the enforcement of the security policies by the first network node.

Claims

1-28. -28. (canceled)

29. A method of enforcing security policies in a mobile ad-hoc network, comprising:

entrusting at least one first network node, along a data traffic route from a data traffic origin node to a data traffic destination node, with enforcing of predefined security policies on said data traffic; and

entrusting at least one second network node, distinct from said first network node, with control of the enforcement of the security policies by said first network node.

30. The method of claim 29, wherein said at least one first network node comprises a network node being a direct neighbour of the origin node.

31. The method of claim 30, wherein said at least one first network node further comprises a network node being a direct neighbour of the destination node.

32. The method of claim 29, further comprising:

providing at least one central security policies distribution server capable of being configured to distribute the predefined security policies to the network nodes.

33. The method of claim 29, comprising:

having the at least one second network node control compliance with the predefined security policies of data traffic passing through at least one third network node along said data traffic route.

34. The method of claim 33, further comprising:

having the at least one second network node selecting said at least one third network node among a set of multipoint relay nodes thereof.

35. The method of claim 34, wherein having the at least one second network node selecting the at least one third network node comprises selecting the at least one third network node among two or more respective multipoint relay nodes as either:

the multipoint relay node through which a lowest number of nodes distant two hops can be reached;

or

in case two or more of the multipoint relay nodes of the second network nodes allow reaching a same, lowest number of nodes distant two hops, the multipoint relay node that has in turn elected a lowest number of multipoint relay nodes.

36. The method of claim 35, wherein having the at least one second network node selecting the at least one third network node further comprises:

in case two or more of the multipoint relay nodes of the second network nodes have elected a same, lowest number of multipoint relay nodes, choosing the at least one third network node at random among said two or more of the multipoint relay nodes of the second network node that have elected the lowest number of multipoint relay nodes.

37. The method of claim 33, wherein, in case the at least one second network node is in a loop, selecting the at least one third network node comprises selecting, among the multipoint relay nodes of the second network node, the network node that, starting from the second network node and passing through a node in the loop having lowest network address, allows reaching a first node announced in a multipoint relay selector set in a transmission control protocol message.

38. The method of claim 33, further comprising:

in case the second network node detects a security policies violation;

having the second network node ascertain whether the third network node is the first network node;

if the third network node is the first network node, having the second network node undertake an action directed to at least temporarily exclude the first network node from the network;

if the third network node is not the first network node, having the second network node;

identify the first network node, and

in case said first network node is a direct neighbour of the second network node, undertake an action directed to at least temporarily exclude the first network node from the network;

in case said first network node is not a direct neighbour of the second network node, or the first network node cannot be identified, broadcast an alarm message capable of being adapted to inform the other network nodes of the security policies violation.

39. The method according to claim 33, further comprising:

having the second network node controlling whether the third network node properly routes data traffic entering thereinto; and

in the negative case, having the second network node undertake an action to temporarily exclude the third network node from the network.

40. The method of claim 39, wherein controlling whether the third network node properly routes data traffic entering thereinto comprises:

having the second network node ascertain that, for each data packet entering the third network node and destined to a destination network node different from the third node, there is a corresponding data packet exiting the third node.

41. A system for enforcing security policies in a mobile ad-hoc network, comprising:

at least one first network node, along a data traffic route from a data traffic origin node to a data traffic destination node, entrusted with enforcing of predefined security policies on data traffic; and

at least one second network node, distinct from said first network node, entrusted with control of enforcement of security policies by said first network node.

42. The system of claim 41, wherein said at least one first network node comprises a network node being a direct neighbour of the origin node.

43. The system of claim 42, wherein said at least one first network node further comprises a network node being a direct neighbour of the destination node.

44. The system of claim 41, further comprising at least one central security policies distribution server capable of being configured to distribute the predefined security policies to the network nodes.

45. The system of claim 41, wherein the at least one second network node is capable of being configured to control a compliance with the predefined security policies of the data traffic passing through at least one third network node along said data traffic route.

46. The system of claim 45, wherein:

the at least one second network node is capable of being adapted to select the at least one third network node among a set of a multipoint relay nodes thereof.

47. The system of claim 46, wherein said at least one second network node is capable of being adapted to select the at least one third network node among two or more respective multipoint relay nodes as either:

the multipoint relay node through which a lowest number of nodes distant two hops can be reached;

or

in case two or more of the multipoint relay nodes of the second network nodes allow reaching a same, lowest number of nodes distant two hops, the multipoint relay node that has in turn elected a lowest number of multipoint relay nodes.

48. The system of claim 47, wherein said at least one second network node is capable of being adapted to select the at least one third network node randomly among two or more of the multipoint relay nodes of the second network node that have elected the lowest number of multipoint relay nodes.

49. The system of claim 46, wherein, in case the at least one second network node is in a loop, the second network node is capable of being adapted to select, among the multipoint relay nodes of the second network node, the network node that, starting from the second network node and passing through a node in the loop having lowest network address, allows reaching a first announced node announced in a multipoint relay selector set in a transmission control protocol message.

50. The system of claim 45, wherein:

in case the second network node detects a security policies violation, the second network node is capable of being adapted to assess whether the third network node is the first network node, and;

in the affirmative case, to undertake an action directed to at least temporarily exclude the first network node from the network;

in the negative case;

to identify the first network node;

in case said first network node is a direct neighbour of the second network node, undertake an action directed to at least temporarily exclude the first network node from the network; and

in case said first network node is not a direct neighbour of the second network node, or the first network node cannot be identified, to broadcast an alarm message capable of being adapted to inform the other network nodes of the security policies violation.

51. The system according to claim 45, wherein the second network node is further capable of being adapted to control whether the third network node properly routes data traffic entering thereinto, and, in the negative case, to undertake an action to temporarily exclude the third network node from the network.

52. The system of claim 51, wherein the second network node is capable of being adapted to ascertain that, for each data packet entering the third network node and destined to a destination network node different from the third node, there is a corresponding data packet exiting the third node.