Network watermark

• US 9,060,023 B2
• Filed: 01/06/2014
• Issued: 06/16/2015
• Est. Priority Date: 06/12/2007
• Status: Active Grant

• Current Assignee: Code-X Incorporated
• Original Assignee: Robert W. Twitchell Jr
• Inventors: Twitchell, Robert W. Jr., Smith, Delia J.
• Primary Examiner(s): Ton, Dang
• Assistant Examiner(s): Mansoury, Nourali
• Application Number:
  US14/148,716
• Publication Number:
  US 20140123227A1
• Time in Patent Office: 526 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/102 Route integrity, e.g. using trusted paths
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 40/005 Routing actions in the presence of nodes in sleep or doze mode
• CPC Class Codes: H04W 48/08 Access restriction or access information delivery, e.g. discovery data delivery signalling during connection H04W76/00
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A network communications method utilizing a network watermark for providing security in the communications includes creating a verifiable network communications path of nodes through a network for the transfer of information from a first end node to a second end node; verifying the network communications path of nodes, by the first end node, before communicating by the first end node information intended for receipt by the second end node; and once the network communications path of nodes is verified by the first end node, communicating by the first end node, via the verified communications path of nodes, the information intended for receipt by the second end node; wherein the network watermark represents the verifiable network communications path of nodes.

Claims

1. A method for network communications over a communications path comprising a network of nodes between a first end node and a second end node, the method comprising the steps of:

(a) by the first end node, sending an outgoing communication including an identification of the second end node to an immediately succeeding node in the communications path;

(b) by each of one or more respective intermediate nodes between the first end node and the second end node in the communications path, performing the steps of,

(i) receiving, by the respective intermediate node, an incoming intermediate communication from an immediately preceding node, the incoming intermediate communication including path data,

(ii) verifying the incoming intermediate communication that is received by the respective intermediate node from the immediately preceding node, and

(iii) upon the successful verification of the incoming intermediate communication from the immediately preceding node by the respective intermediate node, sending by the respective intermediate node an outgoing intermediate communication to a respective immediately succeeding node, the outgoing intermediate communication including path data that at least identifies a network communications path from the first end node to the respective intermediate node; and

(c) by the second end node performing the steps of,

(i) receiving an incoming communication from the immediately preceding node, the incoming communication including path data that at least identifies a network communications path from the first end node to the immediately preceding node,

(ii) verifying the incoming communication that is received from the immediately preceding node, and

(iii) validating the communications path of nodes between the first end node and the second end node.

2. The method of claim 1, further comprising storing the communications path in a database for later reference.

3. The method of claim 1, wherein the path data that is included in a communication sent by a respective intermediate node identifies the network communications path from the first end node to the respective intermediate node by identifying a sequence of unique identifiers (UIDs) of the nodes of the communications path.

4. The network communications method of claim 3, wherein the UIDs are MAC addresses.

5. The method of claim 4, wherein the step of validating, by the second end node, the communications path through the network of nodes between the first end node and the second end node includes checking the UIDs of the nodes identified by the path data against valid UIDs of known nodes in order to confirm that the UIDs identified by the path data match valid UIDs.

6. The method of claim 1, wherein the path data of a communication that is sent by a node, to an immediately succeeding node in the communications path through the network of nodes, includes a date and time of the communication.

7. The method of claim 1, further comprising validating, by each respective intermediate node, the communications path of nodes between the first end node and the respective intermediate node by checking the UIDs of the nodes identified in the communications path in order to confirm that the UIDs identified in the communications path match valid UIDs.

8. The method of claim 1, wherein the network communications comprise wireless network communications.

9. The method of claim 1, wherein the communication received by each respective intermediate node in the network communications path between the first end node and the second end node includes path data that identifies a network communications path from the first end node to the second end node.

10. The method of claim 1, wherein the communication received by each respective intermediate node in the network communications path between the first end node and the second end node includes path data that identifies a network communications path from the first end node to the second end node, and wherein the step by each respective intermediate node of sending a communication to an immediately succeeding node comprises sending, by the respective intermediate node, the communication to the node identified as coming next after the respective intermediate node in the network communications path identified by the path data.

11. A method for network communications over a communications path comprising a network of nodes between a first end node and a second end node, the method comprising the steps of:

(a) by the first end node, sending an outgoing communication including an identification of the second end node to an immediately succeeding node in the communications path;

(b) by each of one or more respective intermediate nodes between the first end node and the second end node in the communications path, performing the steps of,

(i) receiving, by the respective intermediate node, an incoming intermediate communication from an immediately preceding node, the incoming intermediate communication including path data,

(ii) generating, based on data contained in the incoming intermediate communication, a result of a function;

(iii) verifying, based on the generated result of the function, the incoming intermediate communication that is received by the respective intermediate node from the immediately preceding node, and

(iii) upon the successful verification of the incoming intermediate communication from the immediately preceding node by the respective intermediate node, sending by the respective intermediate node an outgoing intermediate communication to a respective immediately succeeding node, the outgoing intermediate communication including data for verification of the outgoing intermediate communication; and

(c) by the second end node performing the steps of,

(i) receiving an incoming communication from the immediately preceding node,

(ii) generating, based on data contained in the incoming intermediate communication, a result of a function;

(iii) verifying, based on the generated result of the function, the incoming communication that is received from the immediately preceding node, and

(iii) validating the communications path of nodes between the first end node and the second end node.

12. The method of claim 11, wherein a result of the function included in a communication is unique to the specific instance of sending the communication by the node to the immediately succeeding node.

13. The method of claim 11, wherein the network communications comprise wireless network communications.

14. The method of claim 11, wherein the communication received by each respective intermediate node in the network communications path between the first end node and the second end node includes path data that identifies a network communications path from the first end node to the second end node.

15. The method of claim 11, wherein the communication received by each respective intermediate node in the network communications path between the first end node and the second end node includes path data that identifies a network communications path from the first end node to the second end node, and wherein the step by each respective intermediate node of sending a communication to an immediately succeeding node comprises sending, by the respective intermediate node, the communication to the node identified as coming next after the respective intermediate node in the network communications path identified by the path data.

16. A method for network communications over a communications path comprising a network of nodes between a first end node and a second end node, the method comprising the steps of:

(a) by the first end node, sending an outgoing communication including an identification of the second end node to an immediately succeeding node in the communications path;

(b) by each of one or more respective intermediate nodes between the first end node and the second end node in the communications path, performing the steps of,

(i) receiving, by the respective intermediate node, an incoming intermediate communication from an immediately preceding node, the incoming intermediate communication including path data,

(ii) verifying the incoming intermediate communication that is received by the respective intermediate node from the immediately preceding node, and

(iii) upon the successful verification of the incoming intermediate communication from the immediately preceding node by the respective intermediate node, sending by the respective intermediate node an outgoing intermediate communication to a respective immediately succeeding node, the outgoing intermediate communication including path data that at least identifies a network communications path from the first end node to the respective intermediate node; and

(c) by the second end node performing the steps of,

(i) receiving an incoming communication from the immediately preceding node, the incoming communication including path data that at least identifies a network communications path from the first end node to the immediately preceding node,

(ii) verifying the incoming communication that is received from the immediately preceding node, and

(iii) validating the communications path of nodes between the first end node and the second end node;

(iv) wherein the communication received by the second end node represents a request for the transfer of information to the first end node;

(d) thereafter, in response to the request for the transfer of information, establishing communication links between each of the nodes of the verifiable communications path and transferring the information from the second end node to the first end node of the request over the established communication links.

17. The method of claim 16, wherein the communication links are concurrently maintained between all adjacent nodes of the communications path during the transfer of the information.

18. The method of claim 16, wherein each communication link is established between adjacent nodes in the verifiable communications path as the information is transferred between the adjacent nodes such that the information hops between nodes in being transferred from the second end node to the origination node.

19. The method of claim 16, wherein the communication received by the second end node represents a request for the transfer of information to the first end node for use by a specific application program, and wherein the step of validating, by the second end node, the communications path through the network of nodes between the first end node and the second end node includes checking the UIDs of the nodes identified by the path data against information maintained for valid UIDs of known nodes in order to confirm that the information maintained for each node identified by the path data matches criteria specified by the specific application program.

20. The method of claim 16, wherein the communication received by the second end node represents a request for the transfer of information to the first end node that will be used by a specific application program, and wherein the step of validating, by the second end node, the communications path through the network of nodes between the first end node and the second end node includes checking the UIDs of the nodes identified by the path data against security levels that are maintained for valid UIDs of known nodes in order to confirm that the security levels of each node identified by the path data matches a required security level specified by the specific application program.