Apparatus and methods for transmission security in a computer network

• US 6,032,258 A
• Filed: 07/11/1997
• Issued: 02/29/2000
• Est. Priority Date: 07/12/1996
• Status: Expired due to Fees

• Current Assignee: Glenayre Electronics Incorporated (EDCI Holdings Incorporated)
• Original Assignee: Glenayre Electronics Incorporated (EDCI Holdings Incorporated)
• Inventors: Godoroja, Andrei, Fawcett, Glenn S., Tosey, Joseph P. R.
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US08/893,529
• Time in Patent Office: 963 Days
• Field of Search: 713/160, 713/161, 713/178, 713/171, 713/200, 713/201, 380/36, 380/278, 380/283
• US Class Current: 726/3
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/16 Multipoint routing
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/12 Avoiding congestion; Recovering from congestion
• CPC Class Codes: H04L 47/263 Rate modification at the source after receiving feedback
• CPC Class Codes: H04L 47/28 in relation to timing considerations
• CPC Class Codes: H04L 47/37 Slow start
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/61 : Time-dependent
• CPC Class Codes: H04W 24/04 : Arrangements for maintaining operational condition
• CPC Class Codes: H04W 28/02 : Traffic management, e.g. flow control or congestion control
• CPC Class Codes: H04W 28/10 : Flow control between communication endpoints
• CPC Class Codes: H04W 28/12 : using signalling between network elements
• CPC Class Codes: H04W 28/14 : using intermediate storage
• CPC Class Codes: H04W 60/00 : Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 72/30 : Resource management for broadcast services
• CPC Class Codes: H04W 8/04 : Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 8/08 : Mobility data transfer
• CPC Class Codes: H04W 80/06 : Transport layer protocols, e.g. TCP [Transport Control Protocol] over wireless transmission control protocol/Internet protocol [TCP/IP] or user datagram protocol [UDP] H04L69/16
• CPC Class Codes: H04W 84/022 : One-way selective calling networks, e.g. wide area paging
• CPC Class Codes: H04W 84/027 : providing paging services
• CPC Class Codes: H04W 92/16 : Interfaces between hierarchically similar devices
• CPC Class Codes: H04W 92/24 : between backbone network devices

Abstract

A method for validating a message packet communicated from a source node to a destination node in a computer network is disclosed. The source node and destination node have access to a clock mechanism synchronized with a common time frame. The method comprises generating a first security key using a time reference obtained from the clock mechanism and a password known by the source node and destination node, communicating the first security key with a message packet from the source node to the destination node, and when the first security key and message packet are received by the destination node, generating a second security key using the password and the time reference and comparing the second security key with the first security key. The message packet is discarded if the second security key does not correspond with the first security key.

In another aspect of the invention, the method further comprises communicating a first time reference obtained from the clock mechanism with a message packet, and when the first time reference and message packet are received by the destination node, comparing the first time reference with a second time reference obtained from the clock mechanism. The message packet is discarded if the time difference between the first time reference and the second time reference is greater than a predetermined amount of time. The predetermined amount of time may be based on a calculated normal packet transmission delay.

Claims

1. A method for validating a message packet communicated from a source node to a destination node in a computer network, the source node and destination node having access to a clock mechanism synchronized with a common time frame, the method comprising:

(a) generating a first security key using a time reference obtained from said clock mechanism and a password known by said source node and said destination node;

(b) communicating said first security key with a message packet from said source node to said destination node;

(c) when said first security key and said message packet are received by said destination node, generating a second security key using said password and said time reference and comparing said second security key with said first security key; and

(d) discarding said message packet if said second security key does not correspond with said first security key.

2. A method for validating a message packet according to claim 1, wherein generating said first security key and said second security key further uses information selected from a group consisting of node identifiers, packet length information, sequence numbers, actual packet data, and randomly selected numbers.

3. A method for validating a message packet according to claim 1, wherein said message packet is comprised of a header and a body, and wherein said first security key is stored in said message packet header.

4. A method for validating a message packet according to claim 1, further comprising logging information regarding said message packet if said message packet is discarded.

5. A method for validating a message packet according to claim 1, further comprising:

(a) communicating a first time reference obtained from said clock mechanism with said message packet;

(b) when said first time reference and said message packet are received by said destination node, comparing said first time reference with a second time reference obtained from said clock mechanism; and

(c) discarding said message packet if the difference in time between said first time reference and said second time reference is greater than a predetermined amount of time.

6. A method for validating a message packet according to claim 5, wherein said message packet has a header and a body, and wherein said first time reference is recorded in said message packet header.

7. A method for validating a message packet according to claim 5, wherein said predetermined amount of time is based on a calculated normal packet transmission delay.

8. A method for validating a message packet according to claim 5, wherein said first time reference and said second time reference use a UNIX time format.

12. A computer network according to claim 3, wherein said message packet includes a first time reference, wherein said destination node compares said first time reference with a second time reference, and wherein said message packet is discarded if the difference in time between the first and second time references is greater than a predetermined amount of time.

13. A computer network according to claim 12, wherein said predetermined amount of time is based on a calculated normal packet transmission delay.

14. A computer network according to claim 12, wherein said first time reference and said second time reference use a UNIX time format.

9. A computer network comprising a plurality of communicatively interconnected components represented by nodes, wherein a message packet communicated from a source node to a destination node includes a first security key generated using a password and a time reference, and wherein said destination node generates a second security key using said password and said time reference and compares said second security key with said first security key, said destination node discarding the message packet if said second security key does not correspond with said first security key.

10. A computer network according to claim 9, wherein the generation of said first security key and said second security key further uses information selected from a group consisting of node identifiers, packet length information, sequence numbers, actual packet data, and randomly selected numbers.

11. A computer network according to claim 9, further comprising a log for recording information regarding said message packet if said message packet is discarded.