Local area network

• US 9,871,776 B2
• Filed: 05/11/2016
• Issued: 01/16/2018
• Est. Priority Date: 03/08/2002
• Status: Expired due to Term

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Certicom Corporation (Blackberry Limited)
• Inventors: Vanstone, Scott Alexander, Struik, Marinus
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US15/152,250
• Publication Number:
  US 20160261574A1
• Time in Patent Office: 615 Days
• Field of Search: 713154, 713153, 713168, 380255, 380278
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A method and system for distributed security for a plurality of devices in a communication network, each of the devices being responsible for generating, distributing and controlling its own keys for access to the communication network and using the keys to establish a trusted network, each device'"'"'s membership to the communication network being checked periodically by other devices by using a challenge response protocol to establish which devices are allowed access to the communication network and the trusted network.

Claims

1. A method, by a security manager in a first ad-hoc network, of facilitating communication between a first device located in the first ad-hoc network and a second device located in a second ad-hoc network, the method comprising:

authenticating with the first device;

sending the first device a first group key;

receiving, via first and second relay agents, a request for authentication from the second device, wherein the first ad-hoc network includes a first plurality of devices, the second ad-hoc network includes a second plurality of devices, and the first relay agent is in the first ad-hoc network and the second relay agent is in the second ad-hoc network; and

sending the second device the first group key.

2. The method of claim 1, wherein the first relay agent includes a router.

3. The method of claim 1, wherein a first plurality of devices in the first ad-hoc network communicate with each other based on the first group key, and a second plurality of devices in the second ad-hoc network communicate with each other based on a second group key.

4. The method of claim 1, wherein the first relay agent acts only as a data relay agent in the first ad-hoc network, and the second relay agent acts only as a data relay agent in the second ad-hoc network.

5. The method of claim 1, wherein the first relay agent periodically queries the second relay agent and receives periodic queries from the second relay agent to enable information pertaining to their respective ad-hoc networks to be updated, and wherein the periodic queries are sent at predetermined intervals.

6. The method of claim 1, wherein the first relay agent and the second relay agent include transceivers that establish a relay channel.

7. The method of claim 1, wherein upon receipt of traffic destined to the second device, the second relay agent transmits the traffic to the second device.

8. The method of claim 1, wherein the first ad-hoc network includes a first controller that allocates time slots for communication in the first ad-hoc network, and the second ad-hoc network includes a second controller that allocates time slots for communication in the second ad-hoc network.

9. The method of claim 1, wherein the request for authentication includes a key created by the second device.

10. A security manager in a first ad-hoc network configured to perform operations to facilitate communication between a first device located in the first ad-hoc network and a second device located in a second ad-hoc network, the operations comprising:

authenticating with the first device;

sending the first device a first group key;

receiving, via first and second relay agents, a request for authentication from the second device, wherein the first ad-hoc network includes a first plurality of devices, the second ad-hoc network includes a second plurality of devices, and the first relay agent is in the first ad-hoc network and the second relay agent is in the second ad-hoc network; and

sending the second device the first group key.

11. The security manager of claim 10, wherein the first relay agent periodically queries the second relay agent and receives periodic queries from the second relay agent to enable information pertaining to their respective ad-hoc networks to be updated, and wherein the periodic queries are sent at predetermined intervals.