Mechanisms for role negotiation in the establishment of secure communication channels in peer-to-peer environments

• US 8,671,202 B2
• Filed: 10/06/2011
• Issued: 03/11/2014
• Est. Priority Date: 12/20/2007
• Status: Active Grant

• Current Assignee: Ooma Incorporated
• Original Assignee: Ooma Incorporated
• Inventors: Deverick, James W., Broadbent, Tiffany L., Bryan, Marcia Z.
• Primary Examiner(s): BARQADLE, YASIN M
• Application Number:
  US13/317,015
• Publication Number:
  US 20120271955A1
• Time in Patent Office: 887 Days
• Field of Search: 709225-230, 709235-237, 726 1- 21
• US Class Current: 709/227
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities

Abstract

Methods of establishing secure communication channels in peer-to-peer environments are provided that eliminate role conflicts between peers by determining which peer will act as a client and which the peer will act as a server in a secure connection handshake. In one embodiment, an attribute of the handshake messages are used in a tiebreaker process to determine which peer assumes the role of the server. In another embodiment, the attribute may be used to compute a wait period for each peer, or the wait period may be based on a random time period, and the peers cancel their request and resent requests after waiting their respective time periods.

Claims

1. In a peer-to-peer (P2P) network, a method for establishing a secure connection between a first peer (P1) in the P2P network and a second peer (P2) in the P2P network using an unmodified client/server handshake protocol, the method comprising:

sending by P1 a first secure connection request (R1) to P2;

receiving by P1 a second secure connection request (R2) from P2;

generating by P1 an error condition E in a negotiation of the secure connection between P1 and P2;

computing by P1 a random value (V1);

cancelling by P1 the request R1;

discarding by P1 the request R2;

resending by P1 the request R1 to P2 after waiting a period of time based on the value V1;

wherein the method is applied at an application level, wherein P1 and P2 engage in secure communication using an unmodified client/server handshake protocol, wherein R1 and R2 are handshake messages of the unmodified client/server handshake protocol.

2. In a peer-to-peer (P2P) network, a method for establishing a secure connection between a first peer (P1) in the P2P network and a second peer (P2) in the P2P network using an unmodified client/server handshake protocol, the method comprising:

sending by P1 a first secure connection request (R1) to P2;

receiving by P1 a second secure connection request (R2) from P2;

generating by P1 an error condition E in a negotiation of the secure connection between P1 and P2;

computing by P1 a wait period value (V1) from an attribute of R1;

compelling by P1 the request R1;

discarding by P1 the request R2;

resending R1 to P2 after waiting a period of time based on the value V1;

wherein the method is applied at an application level wherein P1 and P2 engage in secure communication using an unmodified client/server handshake protocol, wherein R1 and R2 are handshake messages of the unmodified client/server handshake protocol.

3. The method of claim 2 wherein the attribute of R1 is selected from the group consisting of a random value of a TLS message and a random value of a DTLS ClientHello message.

5. The method of claim 3 further comprising, if P1 is assigned a server role based on the comparison of V1 and V2, then cancelling by P1 the request R1.

6. The method of claim 3 further comprising, if P1 is assigned a client role based on the comparison of V1 and V2, then discarding by P1 the request R2.

4. In a peer-to-peer (P2P) network, a method for establishing a secure connection between a first peer (P1) in the P2P network and a second peer (P2) in the P2P network, using an unmodified client/server handshake protocol, the method comprising:

sending by P1 a first secure connection request (R1) to P2;

receiving by P1 a second secure connection request (R2) from P2;

generating by P1 an error condition E in a negotiation of the secure connection between P1 and P2;

computing by P1 a first value (V1) from a attribute of R1;

computing by P1 a second value (V2) from an attribute of R2;

comparing by P1 the values V1 and V2 to determine a tie breaker result for P1 and P2;

assigning by P1 a client/server role to P1 based on the comparison of V1 and V2;

wherein the method is applied at an application level wherein P1 and P2 engage in secure communication using an unmodified client/server handshake protocol, wherein R1 and R2 are handshake messages of the unmodified client/server handshake protocol.

7. The method of claim 4 wherein the attribute of R1 is selected from the group consisting of a random value of a TLS message and a random value of a DTLS ClientHello message.