Wireless service points having unique identifiers for secure communication

• US 7,522,731 B2
• Filed: 04/28/2003
• Issued: 04/21/2009
• Est. Priority Date: 04/28/2003
• Status: Expired due to Term

• Current Assignee: Agilent Technologies, Inc., FireTide Incorporated (UNICOM Global, Inc.)
• Original Assignee: FireTide Incorporated (UNICOM Global, Inc.)
• Inventors: Nassi, Isaac Robert, Cornejo, David Neil, Rosenthal, Lawrence Alan, Klemba, Keith Stuart
• Primary Examiner(s): Lipman; Jacob
• Application Number:
  US10/426,162
• Publication Number:
  US 20040228490A1
• Time in Patent Office: 2,185 Days
• Field of Search: 380/285, 713/163
• US Class Current: 380/285
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04W 52/46 in multi hop networks, e.g. wireless relay networks

Abstract

System, apparatus, and methods are disclosed wherewith a group of independent wireless routing devices known as Service Points work cooperatively to form an ad hoc mesh communication network. The resulting Service Point Network is used to provide reliable address-directed communication services between devices attached by conventional means (wired or wireless) to respective Service Ports on any of the Service Points. Attached Utilizing Devices are not considered a part of the Service Point Network and need not contain any custom software or hardware related to the operations of the Service Point Network. To protect the security of network communications and the integrity of the network, the Service Points are assigned internal IP addresses and unique identifiers that need not be disclosed to the Utilizing Devices. The unique identifiers in turn are used to derive public and private encryption key pairs for each Service Point.

Claims

1. A method of communication via a secure wireless communication network, the method comprising:

joining a plurality of Service Points (SPs) to form a Service Point Network (SPN);

connecting each of a plurality of Utilizing Devices (UDs) to a corresponding Service Port of one or more of the SPs, the UDs being distinct from the SPs and not part of the SPN;

associating a unique Service Port identifier with each Service Port of each SP and thereby with each UD;

preparing a communication selectively destined for one or more Destination UDs of the plurality of UDs, the communication originating from an Originator UD of the plurality of UDs, the SP corresponding to the Originator UD being an Entry SP of the communication, and the SPs corresponding to the Destination UDs being Terminal SPs of the communication; and

for each Destination UD, encrypting the communication in the Entry SP to facilitate decryption in the corresponding Terminal SP and in a manner based at least in part on the unique Service Port identifier associated with the Destination UD, the encrypting otherwise securing the communication from general access including securing against decryption by other than the SP corresponding to the Destination UD.

2. The method of claim 1, wherein the SPN is an ad hoc network.

3. The method of claim 1, wherein the SPN is a mesh network.

4. The method of claim 1, further including:

generating one or more associated encryption keys based on each Service Port identifier.

5. The method of claim 4, further including:

as part of the key generating, creating a public key and a private key associated with each Service Port of each SP;

in the Entry SP, using the public key of the Service Port corresponding to each Destination UD to carry out the encrypting; and

in each Terminal SP, using the private key of the Service Port corresponding to each Destination UD to decrypt the encrypted communication.

6. The method of claim 5, further including:

establishing at least one management key-pair associated with a recipient SP of the SPs, each management key-pair comprising a management private key and a corresponding management public key;

using the management public key, encrypting one or more management directives sent to the recipient SP related to at least one of SPN formation and SP configuration, each of the management directives incorporating an embedded second key for purposes of authentication;

decrypting each management directive using the management private key of the recipient SP;

the recipient SP using the embedded second key to encrypt a reply to each management directive; and

authenticating the recipient SP based on the encrypted reply to each management directive.

7. The method of claim 6, wherein each management directives includes one or more of the following message types:

{hello, welcome, join, accept, leave, goodbye}.

8. The method of claim 6, wherein the embedded second key is a nonce value.

9. The method of claim 6, wherein the recipient SP has multiple management key-pairs corresponding to respective different classes of the management directives.

10. The method of claim 1, further including:

as each of the SPs joins the SPN, dynamically assigning an SPN-unique SP-identifier to the SP; and

routing the encrypted communication through the SPN to the Destination UDs in a manner based upon the SP-identifiers of the Terminal SPs and not revealed to the UDs.

11. The method of claim 10, wherein each SP-identifier is an IP address for internal use within the SPN.

12. A method of communication via a secure wireless communication network, the method comprising:

joining a plurality of Service Points (SPs) to form a Service Point Network (SPN);

assigning an SPN-unique SP-identifier to each SP joined to the SPN;

connecting each of a plurality of Utilizing Devices (UDs) to a corresponding Service Port of one or more of the SPs, the UDs being distinct from the SPs and not part of the SPN; and

in the SP corresponding to a first UD of the plurality of UDs, encrypting a communication originating from the first UD and destined for a second UD of the plurality of UDs, the encrypting being performed to facilitate decryption in the SP corresponding to the second UD and in a manner based at least in part on a unique Service Port identifier associated with the Service Port corresponding to the second UD, the encrypting otherwise securing the communication from general access including securing against decryption by other than the SP corresponding to the second UD.

13. A method for providing access to resources via a secure wireless communication network, comprising:

providing a Service Point Network (SPN) comprising a plurality of Service Points;

connecting each of a plurality of Utilizing Devices to a corresponding one or more of the Service Points, the Utilizing Devices being distinct from the Service Points and not part of the SPN;

providing first and second of the Utilizing Devices with access to each other conveyed via dedicated secure communication through the SPN between an Entry Service Point connected to the first Utilizing Device and a Terminal Service Point connected to the second Utilizing Device; and

encrypting said secure communication at the Entry Service Point, in such a manner that the communication can only be decrypted by the Terminal Service Point.

14. The method of claim 13, wherein each of the Service Points has one or more associated Service Port identifiers, and said encryption is based at least partly on one of the Service Port identifiers of the Terminal Service Point.

15. A method of communication via a secure wireless communication network, the method comprising:

joining a plurality of Service Points (SPs) to form a Service Point Network (SPN);

connecting each of a plurality of Utilizing Devices (UDs) to a corresponding Service Port of one or more of the SPs, the UDs being distinct from the SPs and not part of the SPN;

associating a unique Service Port identifier with each Service Port of each SP and thereby with each UD;

preparing a communication selectively destined for one or more Destination UDs of the plurality of UDs, the communication originating from an Originator UD of the plurality of UDs, the SP corresponding to the Originator UD being an Entry SP of the communication, and the SPs corresponding to the Destination UDs being Terminal SPs of the communication;

for each Destination UD, encrypting the communication in the Entry SP to facilitate decrypting the communication in the corresponding Terminal SP and in a manner based at least in part on the unique Service Port identifier associated with the Destination UD, the encrypting otherwise securing the communication from general access including securing against decrypting by other than the SP corresponding to the Destination UD;

generating one or more associated encryption keys based on each Service Port identifier;

as part of the key generating, creating a public key and a private key associated with each Service Port of each SP;

in the Entry SP, using the public key of the Service Port corresponding to each Destination UD to carry out the encrypting; and

in each Terminal SP, using the private key of the Service Port corresponding to each Destination UD to carry out the decrypting; and

wherein the UDs are client devices that do not actively participate in the encrypting and the decrypting, the communication is one or more instances of client data communications, the encrypting and the decrypting are asymmetric, the client data communications are unrelated to and not used for key distribution related to the encrypting and the decrypting, and only the SPs corresponding to the Destination UDs are capable of performing the decrypting.

16. The method of claim 15, further including:

as each of the SPs joins the SPN, dynamically assigning an SPN-unique SP-identifier to the SP;

routing the encrypted communication through the SPN to the Destination UDs in a manner based upon the SP-identifiers of the Terminal SPs and not revealed to the UDs; and

wherein each SP-identifier is an IP address for internal use within the SPN.

17. The method of claim 15, further including:

establishing at least one management key-pair associated with a recipient SP of the SPs, each management key-pair comprising a management private key and a corresponding management public key;

using the management public key, encrypting one or more management directives sent to the recipient SP related to at least one of SPN formation and SP configuration, each of the management directives incorporating an embedded second key for purposes of authentication;

decrypting each management directive using the management private key of the recipient SP;

the recipient SP using the embedded second key to encrypt a reply to each management directive; and

authenticating the recipient SP based on the encrypted reply to each management directive.

18. The method of claim 17, wherein each management directive includes one or more of the following message types:

{hello, welcome, join, accept, leave, goodbye}.

19. The method of claim 17, wherein the embedded second key is a nonce value.

20. The method of claim 17, wherein the recipient SP has multiple management key-pairs corresponding to respective different classes of the management directives.