Enhancing security in a wireless network

• US 8,670,749 B2
• Filed: 08/15/2011
• Issued: 03/11/2014
• Est. Priority Date: 04/13/2007
• Status: Active Grant

• Current Assignee: FieldComm Group, Inc.
• Original Assignee: Hart Communication Foundation (FieldComm Group, Inc.)
• Inventors: Pratt, Wallace A. Jr., Nixon, Mark J., Rotvold, Eric D., Pramanik, Robin S., Phinney, Thomas L., Lennvall, Tomas P., Zats, Yuri, Enns, Frederick
• Primary Examiner(s): Eisner, Ronald
• Application Number:
  US13/209,572
• Publication Number:
  US 20110302635A1
• Time in Patent Office: 939 Days
• Field of Search: 455/401, 455/411, 455/410, 455/26.1, 370/351, 370458-463, 370/395.62, 370503-521, 370389-427, 726 1- 7, 726/14, 726 17- 21, 726 26- 29
• US Class Current: 455/411
• CPC Class Codes: G01D 21/00 Measuring or testing not otherwise provided for
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 56/0015 one node acting as a reference for the others
• CPC Class Codes: H04W 56/002 Mutual synchronization
• CPC Class Codes: H04W 80/00 Wireless network protocols or protocol adaptations to wireless operation

Abstract

A method of enhancing security in a wireless mesh communication network operating in a process control environment and including a plurality of wireless network devices includes processing a join request from a wireless device wishing to join the wireless mesh communication network, providing a limited network functionality to the wireless device if the join request is granted, requesting a complete approval of the wireless device; and granting a full network functionality to the wireless device if the complete approval of the wireless device is received.

Claims

1. A method of enhancing security of a wireless communication protocol servicing a plurality of wireless network devices in a mesh communication network, wherein the mesh communication network operates in a process control environment, the method comprising:

defining a communication timeslot of a predetermined duration;

generating a network schedule including at least one superframe having repeating superframe cycles, each having a number of communication timeslots;

wherein each of the plurality of wireless network devices transmits and receives data according to the network schedule;

maintaining an absolute slot number indicative of a number of communication timeslots scheduled since a start time of the mesh communication network; and

sending a data packet associated with one of a plurality of layers associated with the wireless communication protocol from one of the plurality of wireless network devices to another one of the plurality of wireless network devices, including;

updating a network key at a time based on the absolute slot number (ASN), wherein a respective copy of the ASN is maintained at each wireless network device and the respective copy of the ASN is synchronized with a master ASN maintained at a network manager; and

generating a message integrity code for the data packet using the updated network key.

4. The method of claim 1, wherein the message integrity code is a first message integrity code, and wherein sending a data packet associated with one of a plurality of layers associated with the wireless communication protocol further includes:

enciphering the data packet on another one of the plurality of layers associated with the wireless communication protocol, including generating a second message integrity code associated with the another one of the plurality of layers based on a session-specific nonce counter.

2. A method of enhancing security of a wireless communication protocol servicing a plurality of wireless network devices in a mesh communication network, wherein the mesh communication network operates in a process control environment, the method comprising:

defining a communication timeslot of a predetermined duration;

generating a network schedule including at least one superframe having repeating superframe cycles, each having a number of communication timeslots;

wherein each of the plurality of wireless network devices transmits and receives data according to the network schedule;

maintaining an absolute slot number indicative of a number of communication timeslots scheduled since a start time of the mesh communication network; and

sending a data packet associated with one of a plurality of layers associated with the wireless communication protocol from one of the plurality of wireless network devices to another one of the plurality of wireless network devices, including;

generating a message integrity code for the data packet based on the absolute slot number, wherein generating the message integrity code includes;

forming a nonce value from the absolute slot number;

supplying the nonce value to a message integrity code generator; and

supplying a network key to the message integrity code generator, wherein the network key is shared by each fully operational wireless network device in the plurality of wireless network devices.

3. The method of claim 2, wherein the data packet is associated with a data link layer included in the plurality of layers associated with the wireless communication protocol;

and wherein generating the message integrity code further includes;

supplying a payload of the data packet to a non-enciphering input of the message integrity code generator; and

supplying an empty string to the enciphering input of the message integrity code generator.

5. A method of enhancing security of a wireless communication protocol servicing a plurality of wireless network devices in a mesh communication network, wherein the mesh communication network operates in a process control environment, the method comprising:

defining a communication timeslot of a predetermined duration;

generating a network schedule including at least one superframe having repeating superframe cycles, each having a number of communication timeslots;

wherein each of the plurality of wireless network devices transmits and receives data according to the network schedule;

maintaining an absolute slot number indicative of a number of communication timeslots scheduled since a start time of the mesh communication network; and

sending a data packet associated with one of a plurality of layers associated with the wireless communication protocol from one of the plurality of wireless network devices to another one of the plurality of wireless network devices, including;

generating a message integrity code for the data packet based on the absolute slot number, wherein generating the message integrity code for the data packet based on the absolute slot number includes merging the absolute slot number with a source address associated with the data packet.