Secure node admission in a communication network
View Patent ↗A system and method for node admission in a communication network having a NC and a plurality of associated network nodes. Key determination in a communication network includes a NN sending to the NC a request for a SALT; the NN receiving the SALT from the NC, combining the SALT with its network password w calculate a static key, and submitting an admission request to the NC to request a dynamic key. The SALT can be a random number generated by the NC, and the admission request can be encrypted by the NN using the static key.
1. A method for key determination in a communication network having a Network Coordinator (NC) and a plurality of associated network nodes, the method comprising:
a new node (NN) receiving an indication from the NC, the indication scheduling a time slot when the NN is capable of sending a request for a SALT;
the NN sending to the NC the request for the SALT in the time slot;
the NN receiving the SALT from the NC; and
the NN combining the SALT with its network password to calculate a static key to be admitted to the communication network wherein, the NN submitting a key request for at least one dynamic key, the request being encrypted by the NN using the static key, wherein the at least one dynamic key encrypts communications of the communication network.
2. The method of claim 1 , wherein the request for the SALT is in the form of discovery request.
3. The method of claim 1 , further comprising the NN receiving a key response including at least one dynamic key, wherein the key response is encrypted using the static key.
4. The method of claim 1 , further comprising the NN, after receiving the at least one dynamic key, sending messages to other network nodes, the messages being encrypted using the at least one dynamic key.
5. The method of claim 1 , wherein the SALT is the same for a plurality of nodes seeking admission to the network, the plurality of nodes having the same network password and the static key remaining unchanged for an admission of the plurality of nodes.
6. The method of claim 1 , wherein the static key comprises an initial privacy management key.
7. The method of claim 6 , further comprising the NN calculating a second static key, wherein the second static key is a MAC management key.
8. The method of claim 1 , wherein the at least one dynamic key comprises a dynamic privacy management key, and wherein the method further comprises the NN, after being admitted to the network, receiving updated dynamic keys from the NC, wherein the updated keys are encrypted using a then-current dynamic privacy management key.
9. The method of claim 1 , wherein the NN combining the SALT with its network password to calculate the static key comprises applying a version of RFC 2898/PKCS#5 to derive the static key from the network password, the SALT, and an encoded string.
10. The method of claim 9 , wherein the encoded string comprises an ASCII encoded string MACManagementKey.
11. The method of claim 9 , wherein the encoded string comprises an ASCII encoded string PrivacyManagementKey.
12. The method of claim 1 , wherein the step of the NN combining the SALT with its network password comprises hashing the SALT with the network password and an encoded string to calculate the static key.
13. The method of claim 1 , wherein the calculated static key has a strength of 128 bits.
14. The method of claim 1 , further comprising the NC combining the SALT with the network password to calculate a second static key to be used by the NC for communications with the NN.
15. A network node (NN), comprising:
a processor; and
a computer readable medium having a computer executable program code embodied thereon, the executable program code configured to cause the network node to perform the operations of:
receiving an indication from a Network Coordinator (NC), the indication scheduling a time slot when the network node is capable of sending a request for a SALT;
sending to the Network Coordinator (NC) the request for the SALT in the time slot;
receiving the SALT from the NC, wherein the SALT is a random number generated by the NC;
combining the SALT with its network password to calculate a static key; and
submitting a key request to the network coordinator requesting a dynamic key, wherein the key request is encrypted by the NN using the static key and wherein the dynamic key encrypts communications of the communication network.
16. The network node of claim 15 , wherein the request for the SALT is in the form of discovery request.
17. A network node (NN), comprising:
a processor; and
computer executable program code embodied on a non-transitory computer readable medium, the computer executable program code configured to cause the network node to perform the operations of:
receiving a first indication from a Network Coordinator (NC), the first indication scheduling a first time slot when the network node is capable of sending a request for a SALT;
sending to the NC the request for the SALT in the first time slot;
receiving the SALT from the NC;
combining the SALT with a network password to calculate a static key;
receiving a second indication from the NC, the second indication scheduling a second time slot when the network node to send an admission request;
submitting the admission request to the NC in the second time slot, wherein the admission request is encrypted using the static key; and
requesting a dynamic key, wherein the request for the dynamic key is encrypted using the static key and wherein the dynamic key encrypts communications of the communication network.
18. The network node of claim 17 , wherein the request for a SALT is in the form of discovery request.
19. The network node of claim 17 , wherein the SALT is a random number generated by the NC.
20. The network node of claim 17 , wherein the executable program code is further configured to cause the network node to receive the requested dynamic key, wherein the received dynamic key is encrypted using the static key.
21. The network node of claim 17 , wherein the executable program code is further configured to cause the network node to, after receiving the dynamic key, send messages to other network nodes, the messages being encrypted using the dynamic key.
22. The network node of claim 17 , wherein the SALT is the same for a plurality of nodes seeking admission to the network, the plurality of nodes have the same network password and the static key remains unchanged for an admission of the plurality of nodes.
23. The network node of claim 17 , wherein the executable program code is further configured to cause the network node to calculate a second static key, wherein the static keys comprise an initial privacy management key and a MAC management key.
24. The network node of claim 17 , wherein the static key comprises an initial privacy management key.
25. The network node of claim 17 , wherein the dynamic key comprises a dynamic privacy management key, and wherein the executable program code is further configured to cause the network node to, after being admitted to the network, receive updated dynamic keys from the NC, wherein the updated keys are encrypted using a then-current privacy management key.
26. The network node of claim 17 , wherein the operation of the network node combining the SALT with its network password to calculate the static key comprises applying a version of RFC 2898/PKCS#5 to derive the static key from the network password, the SALT, and an encoded string.
27. The network node of claim 17 , wherein the calculated static key has a strength of 128 bits.
28. The network node of claim 26 , wherein the encoded string comprises an ASCII encoded string “MACManagementKey”.
29. The network node of claim 17 , wherein a second static key is generated.
30. The network node of claim 29 , wherein the second static key is an ASCII encoded string “PrivacyManagementKey”.
31. The network node of claim 17 , wherein the step of combining the SALT with the network password comprises hashing the SALT with the network password and an encoded string to calculate the static key.
32. The network node of claim 17 , wherein the executable program code is configured to cause the NC to combine the SALT with the network password to calculate a second static key to be used by the NC for communications with the network node.