SECURE MOBILE AD HOC NETWORK

• US 20110299685A1
• Filed: 06/03/2010
• Published: 12/08/2011
• Est. Priority Date: 06/03/2010
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Hall, Robert
• Granted Patent: US 8,712,056 B2
• Time in Patent Office: Days
• US Class Current: 380/273
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Security in a mobile ad hoc network is maintained by using various forms of encryption, various encryption schemes, and various multi-phase keying techniques. In one configuration, an over the air, three-phase, re-keying technique is utilized to ensure that no authorized nodes are lost during re-keying and that nodes that are intended to be excluded from re-keying are excluded. In another configuration, an over the air, two-phase keying technique, is utilized to maintain backwards secrecy.

Claims

1. A method comprising:

from a first node in a mobile ad hoc network comprising a first plurality of nodes, providing a first message comprising an encrypted shared key to each node of a second plurality of nodes, wherein;

the second plurality of nodes is selected from the first plurality of nodes;

each node of the second plurality of nodes has associated therewith a respective key encryption key (KEK); and

each KEK is known only to the first node and a node to which the KEK is associated; and

the shared key is encrypted with a KEK associated with a respective node of the second plurality of nodes to generate a respective plurality of encrypted shared keys;

to each node of the second plurality of nodes from which acknowledgment of receipt of a respective first message is received, providing a second message comprising an indication to use the received shared key for communications within the mobile ad hoc network, wherein decryption of a message using a previous shared key is allowed; and

to each node of the second plurality of nodes from which acknowledgment of receipt of a respective second message is received, providing a third message comprising an indication to not use a respective previous shared key for communications within the mobile ad hoc network.

2. The method of claim 1, further comprising, prior to providing a second message to an intended recipient node, encrypting the second message using a KEK associated with the intended recipient node.

3. The method of claim 1, wherein further comprising, prior to providing a third message to an intended recipient node, encrypting the third message using a KEK associated with the intended recipient node.

4. The method of claim 1, wherein an acknowledgment of receipt of a first message from an acknowledging node is encrypted using a KEK associated with the acknowledging node.

5. The method of claim 1, wherein an acknowledgment of receipt of a second message from an acknowledging node is encrypted using a KEK associated with the acknowledging node.

6. The method of claim 1, wherein the method is repeated periodically.

7. The method of claim 1, wherein the method is performed when triggered by an event.

8. The method of claim 1, wherein the trigger comprises an indication that a node of the plurality of nodes has been compromised.

9. The method of claim 1, wherein:

each first message provided to each node of the second plurality of nodes is a geocast message comprising an indication of a respective location of a geographic region of intended reception of each first message;

each second message provided to each node of the second plurality of nodes is a geocast message comprising an indication of a respective location of a geographic region of intended reception of each first message; and

each third message provided to each node of the second plurality of nodes is a geocast message comprising an indication of a respective location of a geographic region of intended reception of each first message.

10. A method comprising:

generating a different key encryption key (KEK) for each of a plurality of nodes in a mobile ad hoc network, wherein each node of the plurality of nodes has associated therewith a current node-specific KEK;

encrypting each generated KEK, using a different current node-specific KEK;

providing a respective first message to each node of the plurality of nodes, wherein a respective first message comprises an encrypted KEK associated with a node to which a respective first message is being provided;

to each node of the plurality of nodes from which acknowledgment of receipt of a respective first message is received, providing a second message comprising an indication to use the received KEK for communications within the mobile ad hoc network and to stop using a respective current node-specific KEK for communications within the mobile ad hoc network, wherein upon acknowledging receipt of a respective second message, a respective current node-specific KEK is deleted and replaced with the received KEK.

11. The method of claim 10, wherein the method is repeated periodically.

12. The method of claim 10, wherein the method is performed when triggered by an event.

13. The method of claim 12, wherein the trigger comprises an indication that a node of the plurality of nodes has been compromised.

14. A communications device comprising:

an input/output portion configured to;

provide a first message comprising an encrypted shared key to each node of a plurality of nodes in a mobile ad hoc network, wherein;

each node of the plurality of nodes has associated therewith a respective key encryption key (KEK); and

each KEK is known only to the communications device and a node to which the KEK is associated; and

each encrypted shared key is encrypted with a KEK associated with a respective node;

receive acknowledgment of receipt of a respective first message from a node of the plurality of nodes;

to each node of the plurality of nodes from which acknowledgment of receipt of a respective first message is received, provide a second message comprising an indication to use the received shared key for communications within the mobile ad hoc network, wherein decryption of a message using a previous shared key is allowed; and

to each node of the plurality of nodes from which acknowledgment of receipt of a respective second message is received, provide a third message comprising an indication to not use a respective previous shared key for communications within the mobile ad hoc network;

a processing portion configured to;

encrypt the shared key;

generate the first message;

generate the second message; and

generate the third message; and

a memory portion configured to store therein each KEK.

15. The communications device of claim 14, the processing portion further configured to, prior to a second message being provided to an intended recipient node, encrypt the second message using a KEK associated with the intended recipient node.

16. The communications device of claim 14, the processing portion further configured to, prior to a third message being provided to an intended recipient node, encrypting the third message using a KEK associated with the intended recipient node.

17. The communications device of claim 14, wherein an acknowledgment of receipt of a first message from an acknowledging node is encrypted using a KEK associated with the acknowledging node, the processing portion further configured to decrypt the acknowledgment of receipt.

18. The communications device of claim 14, wherein an acknowledgment of receipt of a second message from an acknowledging node is encrypted using a KEK associated with the acknowledging node, the processing portion further configured to decrypt the acknowledgment of receipt.

19. The method of claim 14, wherein:

each first message provided to each node of the plurality of nodes is a geocast message comprising an indication of a respective location of a geographic region of intended reception of each first message; and

each second message provided to each node of the plurality of nodes is a geocast message comprising an indication of a respective location of a geographic region of intended reception of each first message.