Authentication scheme for ad hoc and sensor wireless networks

• US 20020124169A1
• Filed: 03/01/2001
• Published: 09/05/2002
• Est. Priority Date: 03/01/2001
• Status: Active Grant

• Current Assignee: University of Cincinnati
• Original Assignee: University of Cincinnati
• Inventors: Agrawal, Dharma P., Venkataraman, Lakshmi
• Granted Patent: US 7,096,359 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

Strong authentication of packets sent between nodes of different clusters in a two-tier ad hoc network is provided by the cluster heads. Each cluster head authenticates nodes that enter the cluster. Thereafter, when a sending node requests a session from its cluster head with a receiving node in another cluster, the cluster head negotiates a session secret key (SSK) with the corresponding cluster head of the receiving node. Further, the cluster head provides authentication tags for the sending node to use with each packet. Each authentication tag is time-stamped, digitally signed by the cluster head, encrypted with the SSK, and includes indicators of message integrity, including a sequence number and TCP header field of checksum. The sending node further calculates a check result from a number of the authentication tags, encrypted with the SSK, so that the receiving node can authenticate the number of packets.

Claims

1. A method for authenticating packet communication in an ad hoc network between a sending node of a first cluster having a first cluster head and a receiving node of a second cluster having a second cluster head, the method comprising:

said first and second cluster heads establishing a session encryption key and communicating said session encryption key to the sending and receiving nodes; and

said sending and receiving nodes encrypting packet communication at least in part with said session encryption key.

2. The method of claim 1, further comprising:

said sending node encrypting a sequentially selected one of a plurality of authentication tags with the session encryption key; and

sequentially appending each encrypted authentication tag to a packet.

3. The method of claim 2, further comprising:

encrypting a tag sequence number; and

appending the encrypted tag sequence number to a plurality of packets.

4. The method of claim 2, further comprising:

in response to a request for authentication tags by the sending node to the cluster head of the first cluster, generating the plurality of authentication tags;

associating a time stamp with each authentication tag;

encrypting each authentication tag with the corresponding time stamp; and

sending the encrypted plurality of authentication tags to the sending unit.

5. The method of claim 4, wherein generating the plurality of authentication tags further comprises generating a plurality of prime numbers.

6. The method of claim 2, further comprising:

calculating a check result based on a predetermined plurality of the appended tags;

encrypting the check result with the session encryption key; and

appending the encrypted check result to a plurality of authentication tagged packets.

7. The method of claim 6, wherein calculating a check result comprises performing an arithmetic operation on the authentication tags.

8. The method of claim 6, wherein generating the plurality of authentication tags further comprises generating a plurality of prime numbers, and wherein performing the arithmetic operation comprises multiplying the authentication tags.

9. The method of claim 2, wherein appending the encrypted check result further comprises encrypting a checksum field with the session encryption key.

10. The method of claim 2, further comprising:

in response to receiving the plurality of authentication tagged packets, decrypting the authentication tags and appended check result with the session encryption key;

calculating a check result from the authentication tags; and

determining a valid authentication by comparing the calculated check result with the appended check result.

11. The method of claim 2, further comprising:

in response to a message from the sending node to the cluster head of the first cluster, determining whether the sending node is a trusted node of the ad hoc system by challenging the sending node to respond with a system private encryption key.

13. The apparatus of claim 12, wherein the program is further configured when acting as said sending node to encrypt a sequentially selected one of a plurality of authentication tags with the session encryption key, and to sequentially append each encrypted authentication tag to a packet.

14. The apparatus of claim 13, wherein the program is further configured to encrypt a tag sequence number and to append the encrypted tag sequence number to a plurality of packets.

15. The apparatus of claim 13, wherein the program is further configured to perform as said first cluster head of said first cluster, and in response to a request for authentication tags by another sending node of said first cluster, to generate a plurality of authentication tags, and to associate a time stamp with each authentication tag, to encrypt each authentication tag with the corresponding time stamp, and to send the encrypted plurality of authentication tags to the sending node.

16. The apparatus of claim 15, wherein the program is configured to generate the plurality of authentication tags by generating a plurality of random prime numbers.

17. The apparatus of claim 13, wherein the program is further configured when acting as said sending node to calculate a check result based on a predetermined plurality of the appended tags, to encrypt the check result with the session encryption key, and to append the encrypted check result to a plurality of authentication tagged packets.

18. The apparatus of claim 17, wherein the program is configured when acting as said sending node to calculate a check result by performing an arithmetic operation on the authentication tags.

19. The apparatus of claim 17, wherein the program is configured when acting as said first cluster head to generate the plurality of authentication tags by generating a plurality of prime numbers.

20. The apparatus of claim 17, wherein the program is configured when acting as said sending node to perform the arithmetic operation by multiplying the authentication tags.

21. The apparatus of claim 13, wherein the program is further configured to encrypt a checksum field with the session encryption key.

22. The apparatus of claim 13, wherein the program is further configured when acting as said receiving node, in response to receiving the plurality of authentication tagged packets, to decrypt the authentication tags and appended check result with the session encryption key, and to calculate a check result from the authentication tags, and to determine a valid authentication by comparing the calculated check result with the appended check result.

23. The apparatus of claim 13, wherein the program is further configured when acting as said first cluster head, in response to a message from said sending node, to determine whether the sending node is a trusted node of the ad hoc system by challenging said sending node to respond with a system public encryption key.

25. The program product of claim 24, wherein the signal bearing media is transmission type media.

26. The program product of claim 24, wherein the signal bearing media is recordable media.

12. An apparatus, comprising:

a memory; and

a program, resident in the memory, the program configured to act as a sending node of a first cluster having a first cluster head, and a receiving node of, and configured to receive a session encryption key established by said first cluster head and a second cluster having a second cluster head, and to encrypt packet communication to a receiving node of said second cluster using said session encryption key when acting as said sending node.

24. A program product, comprising:

a program configured to act as a selected one of the group consisting of a sending node, a first cluster head of a first cluster, and a receiving node of a second cluster having a second cluster head, and configured to receive a session encryption key established by said first cluster head and said second cluster head, and to encrypt packet communication to said receiving node using said session encryption key when acting as said sending node; and

a signal bearing media bearing the program.