Secured communication for local area network

• US 9,356,778 B2
• Filed: 02/10/2014
• Issued: 05/31/2016
• Est. Priority Date: 03/08/2002
• Status: Expired due to Term

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Certicom Corporation (Blackberry Limited)
• Inventors: Vanstone, Scott Alexander, Struik, Marinus
• Primary Examiner(s): Moorthy, Aravind
• Application Number:
  US14/176,803
• Publication Number:
  US 20140173276A1
• Time in Patent Office: 841 Days
• Field of Search: 713/153, 713/168, 380/255, 380/278
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A method and system for distributed security for a plurality of devices in a communication network, each of the devices being responsible for generating, distributing and controlling its own keys for access to the communication network and using the keys to establish a trusted network, each device'"'"'s membership to the communication network being checked periodically by other devices by using a challenge response protocol to establish which devices arc allowed access to the communication network and the trusted network.

Claims

1. A method, by a security manager in a first ad hoc network, of facilitating communications between a first device located in the first ad-hoc network and a second device located in a second ad-hoc network, said method comprising:

sending the first device a first group key;

receiving, via a relay channel between said first ad-hoc network and said second ad-hoc network, a request for authentication from the second device, wherein said first ad-hoc network includes a first plurality of devices, said second ad-hoc network includes a second plurality of devices, and the relay channel is established using first and second transceivers, the first transceiver being in said first ad-hoc network, and the second transceiver being in said second ad-hoc network; and

sending the second device the first group key.

2. The method according to claim 1, wherein the first ad-hoc network includes a master device configured to activate an access controller using identifiers of devices in the first ad-hoc network.

3. The method according to claim 2, wherein the master device uses an access control list to admit only devices that have been positively authenticated to the first ad-hoc network.

4. The method according to claim 2, wherein the master device further comprises a traffic controller to regulate data flow within the first ad-hoc network.

5. The method according to claim 4, wherein the master device allocates a time slot to each of the devices for message distribution.

6. The method according to claim 1, further comprising determining which other devices are presently active in the first ad-hoc network.

7. The method according to claim 6, wherein the determining comprises re-authenticating each of the other devices at a predetermined time.

8. The method according to claim 7, wherein the re-authenticating comprises performing a challenge-response protocol with each of the other devices to determine which of the other devices are present in the first ad-hoc network.

9. An apparatus in a first ad-hoc network, the apparatus comprising instructions embodied on a tangible, non-transitory computer-readable medium, the instructions operable when executed to cause a computing system to perform operations for facilitating communications between a first device located in the first ad-hoc network and a second device located in a second ad-hoc network, the operations comprising:

sending the first device a first group key;

receiving, via a relay channel between said first ad-hoc network and said second ad-hoc network, a request for authentication from the second device, wherein said first ad-hoc network includes a first plurality of devices, said second ad-hoc network includes a second plurality of devices, and the relay channel is established using first and second transceivers, the first transceiver being in said first ad-hoc network and the second transceiver being in said second ad-hoc network; and

sending the second device the first group key.

10. The apparatus according to claim 9, wherein the first ad-hoc network includes a master device configured to activate an access controller using identifiers of devices in the first ad-hoc network.

11. The apparatus according to claim 10, wherein the master device uses an access control list to admit only devices that have been positively authenticated to the first ad-hoc network.

12. The apparatus according to claim 10, wherein the master device further comprises a traffic controller to regulate data flow within the first ad-hoc network.

13. The apparatus according to claim 12, wherein the master device allocates a time slot to each of the devices for message distribution.

14. A communication device in a first ad-hoc network, comprises:

a processor;

memory, the memory comprising computer executable instructions that, when executed by the processor, perform operations for facilitating communications between a first device located in the first ad-hoc network and a second device located in a second ad-hoc network, the operations comprising;

sending the first device a first group key;

receiving, via a relay channel between said first ad-hoc network and said second ad-hoc network, a request for authentication from the second device, wherein said first ad-hoc network includes a first plurality of devices, said second ad-hoc network includes a second plurality of devices, and the relay channel is established using first and second transceivers, the first transceiver being in said first ad-hoc network and the second transceiver being in said second ad-hoc network; and

sending the second device the first group key.

15. The communication device according to claim 14, wherein the first ad-hoc network includes a master device configured to activate an access controller using identifiers of devices in the first ad-hoc network.

16. The communication device according to claim 15, wherein the master device uses an access control list to admit only devices that have been positively authenticated to the first ad-hoc network.

17. The communication device according to claim 15, wherein the master device further comprises a traffic controller to regulate data flow within the first ad-hoc network.

18. The communication device according to claim 17, wherein the master device allocates a time slot to each of the devices for message distribution.