Hierarchical deterministic pairwise key predistribution scheme

• US 8,189,791 B2
• Filed: 06/19/2007
• Issued: 05/29/2012
• Est. Priority Date: 06/22/2006
• Status: Active Grant

• Current Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Garcia, Oscar, Baldus, Heribert
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US12/305,449
• Publication Number:
  US 20090129599A1
• Time in Patent Office: 1,806 Days
• Field of Search: 380/279
• US Class Current: 380/279
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2209/88 Medical equipments
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 4/38 for collecting sensor information
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A security system for a hierarchical network (10) includes L hierarchical levels each corresponding to a security domain level (16), and a plurality of local network nodes (A, B, . . . , Z). A keying material generator (24) generates a set (30) of correlated keying material for each network node. Each set (30) of keying material is composed of L sub-sets (32) of keying material one for each security domain level (16). A set up server (34) distributes the generated sets (30) of keying material to each network node (A, B, . . . , Z) to enable the network nodes (A, B, . . . , Z) to communicate with one another at a security domain of a hierarchical level k by a use of a corresponding sub-set (32) of the security keying material.

Claims

1. A security system for a hierarchical network including at least two hierarchical levels each corresponding to a security domain, comprising:

a plurality of local network nodes;

a keying material generator which generates correlated sets of keying material for each network node, which each keying material set includes keying material sub-sets, each sub-set corresponding to an associated security domain including a hospital level security domain associated with a hospital and a department level security domain associated with each of a plurality of departments within the hospital; and

a set up server which distributes the generated keying material sets to each network node to enable the network nodes within each department to communicate with one another at the associated department security domain using a first corresponding sub-set of keying material and to communicate with network nodes in another department at the hospital level security domain using a second corresponding sub-set of the keying material.

2. The system as set forth in claim 1, wherein the network includes:

an enterprise level security domain associated with an enterprise, the enterprise encompassing a plurality of hospitals.

3. The system as set forth in claim 1, wherein the network nodes communicate with one another via at least a normal communication mode and an unusual communication mode.

4. The system as set forth in claim 1, wherein the network nodes include at least one of physiological condition monitors, controllable medication dosing devices, and PDAs.

5. A network node with keying material, that enables communicating at a plurality of hierarchical levels, for use in the system of claim 1.

6. A security system for a hierarchical network including L hierarchical levels each corresponding to a security domain comprising:

a plurality of local network nodes which communicate with one another via at least a normal communication mode and an unusual communication mode;

a keying material generator which generates correlated sets of keying material for each network node, which each keying material set includes L keying material sub-sets, each sub-set corresponding to an associated security domain;

a set up server which distributes the generated keying material sets to each network node to enable the network nodes to communicate with one another at a security domain of a hierarchical level k by using a corresponding sub-set of keying material; and

a security administrator from which the network nodes are programmed to request a permission to communicate in the unusual communication mode.

7. The system as set forth in claim 6, wherein the network nodes are programmed to communicate with one another at the lowest level common security domain.

8. The system as set forth in claim 6, wherein the normal communication mode includes communicating by the sub-set of keying material corresponding to the lowest level security domain L.

9. The system as set forth in claim 8, wherein the unusual communication mode includes communicating at a different level security domain than the lowest level security domain L.

10. The system as set forth in claim 6, wherein each network node includes a set of L identifiers which each identifier includes a device identifier and a security domain identifier corresponding to an associated security domain level of the L level infrastructure for the network devices to mutually authenticate one another.

11. A method of hierarchical security management comprising:

generating correlated sets of keying material for each network node which each set includes a plurality of keying material sub-sets each sub-set corresponding to a security domain associated with one of a plurality of hierarchical levels;

distributing the generated keying material sets to the network nodes; and

establishing normal communications between the network nodes at a first common security domain which coincides with a first hierarchical level by a corresponding first sub-set of the keying material; and

establishing unusual communications at a second common security domain which is different form the first hierarchical level with a corresponding second sub-set of the keying material wherein prior to establishing unusual communications, a permission is requested.

12. The method as set forth in claim 11, wherein each network node includes a set of identifiers which each includes a device identifier and a security domain identifier corresponding to an associated hierarchical level for the network devices to mutually authenticate one another.

13. The method as set forth in claim 11, wherein the network nodes include at least one of physiological condition monitors, controllable medication dosing devices, and PDAs.

14. A network having a plurality of nodes programmed for performing the method of claim 11.

15. A node used in the method of claim 11.

16. A set up server used to distribute the sets of the keying material in the method of claim 11.

17. A network device including:

a physiological condition monitor which includes a memory configured to store a predistributed set of keying material, the set including a plurality of sub-sets of keying material arranged hierarchically in a plurality of hierarchical layers including at least;

a lowest level keying material sub-set associated with a lowest level security domain used by the network devices to communicate securely with other network devices in one group of a family of groups of network devices in a medical facility, and

a higher level keying material sub-set associated with a higher level security domain used by the network device to communicate securely with network devices in other of the groups of the family of groups,

a top level keying material sub-set associated with a top security domain used by the network devices to communicate securely with other medical devices not in the family of groups;

wherein the network device is programmed to authenticate and communicate with other network devices in the one group with the lowest level security domain with the lowest level keying material sub-set associated with the lowest level security domain;

wherein the network device is programmed to authenticate and communicate with other network devices in other groups in the one family of groups with the higher level security domain with the higher level keying material sub-set associated with the higher level security domain; and

wherein the network device is programmed to authenticate and communicate with other network devices in other families of groups with the top level security domain with the top level keying material sub-set associated with the top level security domain.

18. A network including:

a predistributed set of keying material each including at least;

a lowest level keying material sub-set associated with a lowest level security domain, and

a higher level keying material sub-set associated with a higher level security domain,

the network device is programmed to authenticate other network devices at the lowest level common security domain and communicate with one another with the sub-set associated with the lowest level common security domain; and

wherein the network device is programmed to request permission to communicate at a security domain level which does not correspond to the lowest level of hierarchy of the hierarchical structure.

19. The network device as set forth in claim 18, wherein the lowest level sub-set of the keying material is used to communicate in a common security domain which corresponds to the lowest level of hierarchy of a hierarchical structure.

20. A network including a plurality of the network devices according to claim 18.

21. A network comprising:

first, second, third, and fourth groups of network devices, each network device having;

a memory which stores a set of keying material including a first sub-set of the keying material associated with a first security domain, a second sub-set of the keying material associated with a second security domain, and third sub-set of the keying material associated with a third security domain,

a communication system by which the network devices authenticate and communicate with each other,

wherein the first sub-set of the keying material is the same within each of the groups and different from group to group such that the network devices in each group authenticate and communicate with each other in their associated first security domain and cannot authenticate or communicate with network devices in a different group on their first security domains,

wherein the second sub-set of the keying material is the same in the first and second groups such that the network devices in the first and second groups authenticate and communicate with each other in their associated second security domain,

wherein the second sub-set of the keying material in the third and fourth groups is the same and is different form the second sub-set of the keying material in the first and second groups such that the network devices in the third and fourth groups authenticate and communicate with each other in their second security domain but not with the network devices in the first and second groups, and

wherein the third sub-set of the keying material is the same in the first, second, third, and fourth groups such that the network devices in the first, second, third, and fourth groups authenticate and communicate with each other in the third security domain.

22. The network as set forth in claim 21, wherein at least some of the network devices further include:

a physiological condition monitor which monitors a physiological condition of a patient with whom the network device is associated.