Distributed network management hierarchy in a multi-station communication network

• US 8,347,361 B2
• Filed: 12/14/2007
• Issued: 01/01/2013
• Est. Priority Date: 12/14/2006
• Status: Active Grant

• Current Assignee: Taiwan Semiconductor Manufacturing Company Limited
• Original Assignee: MOSAID Technologies Inc. (f/k/a Conversant Intellectual Property Management)
• Inventors: Larsen, James David
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Okeke, Izunna
• Application Number:
  US12/518,961
• Publication Number:
  US 20100017608A1
• Time in Patent Office: 1,845 Days
• Field of Search: 713/155, 713/156, 713/157, 713/161, 713/168, 713/169, 713/170, 713/173, 713/175, 713/176, 726/2, 726/4, 726/5, 726/6, 726/7, 726/8
• US Class Current: 726/4
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The invention relates to a network and to a method of operating a network. The network comprises a plurality of stations each able to transmit and receive data so that the network can transmit data between stations via at least one selected intermediate station. The network further comprises a plurality of levels of stations including a first level comprising user and/or seed stations, a second level comprising auxiliary stations providing access to auxiliary networks, a third level comprising at least one location management station, and a fourth level comprising at least one authentication station. The method comprises transmitting, from or on behalf of a station on the first level requiring authentication, to an authentication station via one or more stations, an authentication request message. In response, the authentication station transmits authentication data via one or more stations to the station on the first level to authenticate the station on the first level. The authentication station maintains a record of each authenticated station on the first level. A location management station monitors the location of each authenticated station on the first level with respect to its connectivity, whether directly or indirectly, with one or more stations on the second level. Where a station on the first level attempts to communicate with another station on any level and is assisted by a station on another level, the assisting station transmits connectivity data directly, or indirectly via other stations, to the station on the first level and/or to an intermediate station.

Claims

1. A method of operating a network comprising a plurality of stations each able to transmit and receive data so that the network can transmit data between stations via at least one selected intermediate station, wherein the network comprises a plurality of levels of stations including a first level comprising user and/or seed stations, a second level comprising auxiliary stations providing access to auxiliary networks, a third level comprising at least one location management station, and a fourth level comprising at least one authentication station, the method comprising:

transmitting, from or on behalf of a station on the first level requiring authentication, to said at least one authentication station via one or more stations, an authentication request message, said at least one authentication station transmitting authentication data via one or more stations to the station on the first level to authenticate the station on the first level;

maintaining, at said at least one authentication station, a record of each authenticated station on the first level;

monitoring, at said at least one location management station, the location of each authenticated station on the first level with respect to the connectivity of said authenticated stations, whether directly or indirectly, with one or more stations on the second level; and

where a station on the first level attempting to communicate with another station on any level is assisted by a station on another level, transmitting connectivity data from said station on another level directly, or indirectly via other stations, to said station on the first level and/or to an intermediate station, the connectivity data identifying other stations with which said station on the first level or the said intermediate station is likely to be able to communicate.

2. A method according to claim 1 wherein assistance is provided to said station on the first level by a station on the second level in preference to a station on the third level, and by a station on the third level in preference to a station on the fourth level.

3. A method according to claim 1 or claim 2 wherein the connectivity data is transmitted from the location management station to said station on the first level directly or via at least one intermediate station on a level between the location management station and the station on the first level.

4. A method according to claim 1 or claim 2 wherein the connectivity data is transmitted from time to time from the location management station to an auxiliary station on the second level, said auxiliary station transmitting the connectivity data to said station on the first level independently of the location management station when required.

5. A method according to claim 1, wherein stations on a level other than the first level maintain a record of connectivity with other stations so that a station on the first level that is attempting to communicate with other stations on any level can communicate with a station on another level to obtain connectivity data when required.

6. A method according to claim 1, wherein, when a station on the first level requiring authentication transmits an authentication request message to the authentication station or an authorised location management station via an intermediate station on a level other than the first level, said station on such other level adds data to the authentication request message to verify said station'"'"'s use in the path followed by the authentication request message.

7. A method according to claim 6 wherein said station on such other level provides a signed certificate which is associated with the authentication request message to prove the utilization of said station on another level to forward the authentication request message.

8. A method according to claim 1, wherein the network includes a plurality of authentication stations and/or a plurality of location management stations, the method including communicating, at least one location management station, with at least one of the authentication stations so that said at least one location management station has access to the record of authenticated stations on the first level maintained at said at least one authentication station.

9. A method according to claim 1, wherein authentication request messages are transmitted, from or on behalf of stations on the second and third levels requiring authentication, to said at least one authentication station via one or more stations, said at least one authentication station transmitting authentication data via one or more stations to the stations on the second and third levels to authenticate the stations.

10. A method according to claim 9 wherein the method further comprises the step of transmitting at least one of the authentication request messages to at least one location management station, which transmits the authentication request message to said at least one authentication station on behalf of the station requiring authentication.

11. A method according to claim 1, wherein each station stores station specific and/or user specific security data that corresponds to security data maintained at said at least one authentication station, the authentication request messages containing security data of the station requiring authentication which is used as input at said at least one authentication station into a challenge and response algorithm to generate challenge data and expected result data, said at least one authentication station transmitting challenge data to the station requiring authentication, directly or indirectly, the station requiring authentication using the challenge data as input into a challenge and response algorithm to generate response data, the response data being transmitted by the station requiring authentication to the authentication station, directly or indirectly, said at least one authentication station comparing the response data to the expected result data and, if the response data and the expected result data match, said at least one authentication station transmitting authentication data to the station requiring authentication, directly or indirectly.

12. A method according to claim 11 wherein one or more transmissions between the stations after receipt of the authentication request messages are encrypted using challenge data and response data respectively, to provide a secure channel between the stations for the authentication exchanges and for exchange of other data thereafter.

13. A method according to claim 1, wherein the authentication message comprises a certificate, an authentication station public key and a station- and/or user-specific private key to the station requiring authentication.

14. A method according to claim 13 wherein the certificate provides details relating to the respective station including an assigned address, the station'"'"'s authorized capabilities and degrees of access to network resources.

15. A method according to claim 14 wherein a station receiving a message as an intermediate or destination station from another station, transmits a certificate request message, directly or indirectly, to the source station requesting that the source station send its certificate to the said receiving station to enable the said receiving station to verify the authentication status and/or the authorization and access permitted.

16. A method according to claim 1, including transmitting neighbor gathering probe signals from one or more stations, other neighboring stations which receive the neighbor gathering probe signals from a probing station responding directly, or indirectly via other stations, to thereby indicate to the probing station their availability as destination or intermediate stations.

17. A method according to claim 16 wherein certificates are included in at least some probe signals transmitted by a station to indicate, to stations receiving the probe signals, the probing stations capabilities and access to network resources.

18. A method according to claim 1, wherein one or more additional network management stations are provided which are operable to receive and/or monitor network activity data from one or more other stations on the network, the network activity data including throughputs utilized, initiation and termination of services, applications utilized, utilization of gateway, quality of service information, performance information and/or connectivity information.

19. A method according to claim 18 wherein the one or more network management stations include a network monitoring station and/or a billing station.

20. A method according to claim 19 wherein the location management stations, the authentication stations and the network management stations are each operable to manage the network collaboratively.

21. A network comprising a plurality of stations each able to transmit and receive data so that the network can transmit data between stations via at least one selected intermediate station, the network including:

a plurality of levels of stations including a first level comprising user and/or seed stations, a second level comprising auxiliary stations providing access to auxiliary networks, a third level comprising at least one location management station, and a fourth level comprising at least one authentication station;

each station being operable to;

transmit, from or on behalf of a station on the first level requiring authentication, to said at least one authentication station via one or more stations, an authentication request message, said at least one authentication station transmitting authentication data via one or more stations to the station on the first level to authenticate the station on the first level;

maintain, at said at least one authentication station, a record of each authenticated station on the first level;

monitor, at said at least one location management station, the location of each authenticated station on the first level with respect to the connectivity of said authenticated stations, whether directly or indirectly, with one or more stations on the second level; and

where a station on the first level attempting to communicate with another station on any level is assisted by a station on another level, transmit connectivity data from said station on another level directly, or indirectly via other stations, to said station on the first level and/or to an intermediate station, the connectivity data identifying other stations with which said station on the first level or the said intermediate station is likely to be able to communicate.