Method and apparatus for providing a high security mode in a network
View Patent ↗Systems and methods systems and methods for efficiently and securely forming a communication network. As a non-limiting example, various aspects of the present disclosure provide systems and methods, for example utilizing a plurality of different security modes, for forming a premises-based network (e.g., a MoCA network).
1. A network comprising:
a first network node; and
a network coordinator node, wherein:
the first network node comprises at least one circuit operable to, at least:
transmit a discovery request message, the discovery request message comprising first security information in an information element field of the discovery request message, wherein a value of the first security information explicitly identifies a security mode in which the first network node is operating;
receive a discovery response message from the network coordinator node in reply to the transmitted discovery request message, the discovery response message comprising second security information in an information field of the discovery response message, wherein a value of the second security information explicitly identifies a security mode in which the network coordinator node is operating;
analyze at least the second security information to determine whether the first network node is authorized to join the network; and
if it is determined that the first network node is authorized to join the network, then join the network; and
the network coordinator node comprises at least one circuit operable to, at least:
receive the discovery request message from the first network node;
analyze at least the first security information to determine whether the first network node is authorized to join the network; and
if it is determined that the first network node is authorized to join the network then join the first network node to the network,
wherein the discovery request message comprises second information in an information element field of the discovery request message, wherein the second information indicates to the network coordinator node whether to send another beacon before sending a discovery response message in response to the discovery request message.
2. The network of claim 1 , wherein:
the at least one circuit of the first network node operates to analyze the second security information by, at least in part, comparing the second security information to a security control parameter maintained by the first network node; and
the at least one circuit of the network coordinator node operates to analyze the first security information by, at least in part, comparing the first security information to a security control parameter maintained by the network coordinator node.
3. The network of claim 2 , wherein:
the at least one circuit of the first network node operates to, if the second security information does not match the security control parameter maintained by the first network node, then set a second control parameter maintained by the first network node that indicates a security mismatch has occurred; and
the at least one circuit of the network coordinator node operates to, if the first security information does not match the security control parameter maintained by the network coordinator node, then set a second control parameter maintained by the network coordinator node that indicates a security mismatch has occurred.
4. A network node comprising:
at least one circuit operable to, at least:
transmit a first beacon comprising first timing information that indicates when a second node looking to gain admission to a network may transmit a discovery request message;
receive a discovery request message from the second node, the discovery request message comprising first security information in an information element field of the discovery request message, wherein a value of the first security information explicitly identifies a security mode in which the second node is operating;
analyze at least the first security information to determine whether the second node is authorized to join the network; and
if it is determined that the second node is authorized to join the network then join the second node to the network,
wherein:
the at least one circuit is operable to analyze the first security information by, at least in part, comparing the first security information to a security control parameter maintained by the network node;
the at least one circuit is operable to, if the at least one circuit determines that the first security information does not match the security control parameter maintained by the network node, then refrain from joining the second node to the network; and
the discovery request message comprises second information in an information element field, wherein the second information indicates to the second node whether to send another beacon before sending a discovery response message.
5. The network node of claim 4 , wherein:
the network node operates in accordance with a set of protocol versions; and
the first timing information indicates when a node operating only in accordance with a first subset of the set of protocol versions may transmit a discovery request message.
6. The network node of claim 5 , wherein the at least one circuit is operable to transmit a second beacon comprising second timing information that indicates when a node operating only in accordance with a second subset of the set of protocol versions and looking to gain admission to a network may transmit an admission request message, wherein the second subset is mutually exclusive of the first subset.
7. The network node of claim 6 , wherein the at least one circuit is operable to alternate transmitting beacons of different types, the different types comprising a first type of beacon that comprises the first timing information, and a second type of beacon that comprises the second timing information.
8. The network node of claim 7 , wherein the at least one circuit is operable to:
alternate transmitting at least the first and second types of beacons when operating in a first security mode; and
only transmit beacons of the first type when operating in a second security mode.
9. The network node of claim 4 , wherein the at least one circuit is operable to, if the at least one circuit determines that the first security information does not match the security control parameter maintained by the network node, then set a second control parameter maintained by the network node that indicates a security mismatch has occurred.
10. The network node of claim 9 , wherein the at least one circuit utilizes the second control parameter to indicate to a management entity of the network node that the security mismatch has occurred.
11. The network node of claim 4 , wherein the at least one circuit is operable to, if the at least one circuit determines that the second node is authorized to join the network, then analyze said second information of the discovery request message to determine whether to send said discovery response message in response to the received discovery request message before sending said another beacon, or to send said another beacon before sending said discovery response message in response to the received discovery request message.
12. The network node of claim 4 , wherein the at least one circuit is operable to, if the at least one circuit determines that the second node is authorized to join the network, then analyze said second information of the discovery request message to determine whether to send said discovery response message in response to the received discovery request message before receiving a second discovery request message from the second node.
13. A network node comprising:
at least one circuit operable to, at least:
receive a beacon from a second node of a network, the beacon comprising timing information that indicates when a discovery request message may be transmitted;
analyze the timing information in the received beacon to determine when to transmit a discovery request message;
transmit the discovery request message, the discovery request message comprising first security information in an information element field of the discovery request message, wherein a value of the first security information explicitly identifies a security mode in which the network node is operating;
receive a discovery response message from the second node in reply to the transmitted discovery request message, the discovery response message comprising second security information in an information field of the discovery response message, wherein a value of the second security information explicitly identifies a security mode in which the second node is operating;
analyze at least the second security information to determine whether the network node is authorized to join the network; and
if it is determined that the network node is authorized to join the network, then join the network,
wherein the discovery request message comprises second information in an information element field, wherein the second information indicates to the second node whether to send another beacon before sending the discovery response message.
14. The network node of claim 13 , wherein the at least one circuit operates to analyze the second security information by, at least in part, comparing the second security information to a security control parameter maintained by the network node.
15. The network node of claim 14 , wherein the at least one circuit operates to, if the second security information does not match the security control parameter maintained by the network node, then refrain from joining the network.
16. The network node of claim 14 , wherein the at least one circuit operates to, if the second security information does not match the security control parameter maintained by the network node, then set a second control parameter maintained by the network node that indicates a security mismatch has occurred.