Secure peer-to-peer communication over wireless mesh networks

1. A method comprising:

receiving, at a first node, a network encryption key from a headend system, wherein the network encryption key is used to encrypt messages between nodes on a wireless mesh network;

receiving, at the first node, a sub-group encryption key that is unique to a sub-group of nodes, a sub-group identifier, and a sub-group node list that lists the sub-group of nodes associated with the sub-group identifier from the headend system, wherein the sub-group of nodes are nodes on the wireless mesh network;

generating, at the first node, an application layer message for a second node of the sub-group of nodes at an application layer;

encrypting, at the first node, the application layer message using the sub-group encryption key;

generating, at the first node, a team packet that is addressed to the second node and includes the encrypted application layer message and the sub-group identifier;

encrypting, at the first node, the team packet using the network encryption key;

transmitting, at the first node, the encrypted team packet to the second node;

receiving, at the first node, a second team packet from the second node; and

responsive to identifying, at the first node, that the second team packet is (i) addressed to the first node and (ii) second team packet includes the sub-group identifier, then decrypting an additional application layer message in the second team packet using the sub-group encryption key.

2. The method of claim 1 , further comprising:

receiving a third team packet;

determining whether the third team packet is addressed to the first node;

when the third team packet is addressed to the first node, determining whether an additional sub-group identifier included in the third team packet corresponds to the sub-group identifier; and

when the additional sub-group identifier does not correspond to the sub-group identifier, then ceasing to process the third team packet.

3. The method of claim 2 , further comprising:

generating an additional application layer message for a third node at the application layer, wherein the third node is excluded from the sub-group of nodes;

encrypting an additional team packet that includes the additional application layer message for the third node using the network encryption key; and

transmitting the encrypted additional team packet to the third node.

4. The method of claim 2 , further comprising receiving, at the first node and from the headend system, a second sub-group encryption key that is unique to a second sub-group of nodes, a second sub-group identifier, and a second sub-group node list that lists the second sub-group of nodes associated with the second sub-group identifier, wherein the second sub-group of nodes omits at least one node from the sub-group of nodes.

5. The method of claim 2 , further comprising:

receiving a message authentication code; and

transmitting the message authentication code with the encrypted application layer message.

6. The method of claim 2 , further comprising:

receiving a message authentication code from a headend system;

receiving an additional message authentication code from a peer node of the nodes; and

verifying the additional message authentication code against the message authentication code.

7. A network node comprising:

a non-transitory computer-readable medium storing computer-executable program instructions; and

a processing device communicatively coupled to the non-transitory computer-readable medium for executing the computer-executable program instructions, wherein executing the computer-executable program instructions configures the processing device to perform operations comprising:

receiving a network encryption key from a headend system, wherein the network encryption key is used to encrypt messages between nodes on a wireless mesh network;

receiving, a sub-group encryption key that is unique to a sub-group of nodes, a sub-group identifier, and a sub-group node list that lists the sub-group of nodes associated with the sub-group identifier from the headend system, wherein the sub-group of nodes are nodes on the wireless mesh network;

generating an application layer message for a second node of the sub-group of nodes at an application layer;

encrypting the application layer message using the sub-group encryption key;

generating a team packet that is addressed to a second node and includes the encrypted application layer message and the sub-group identifier;

encrypting the team packet using the network encryption key;

transmitting the encrypted team packet to the second node;

receiving a second team packet from the second node;

determining whether the second team packet is addressed to the network node;

when the second team packet is addressed to the network node, determining whether the second team packet includes the sub-group identifier; and

when the second team packet includes the sub-group identifier, then decrypting an additional application layer message in the second team packet using the sub-group encryption key.

8. The network node of claim 7 , wherein the operations further comprise:

receiving a third team packet;

determining whether the third team packet is addressed to the network node;

when the third team packet is addressed to the network node, determining whether an additional sub-group identifier included in the third team packet corresponds to the sub-group identifier; and

when the additional sub-group identifier does not correspond to the sub-group identifier, then ceasing to process the third team packet.

9. The network node of claim 7 , wherein the operations further comprise:

generating an additional application layer message for a third node at the application layer, wherein the third node is excluded from the sub-group of nodes;

encrypting an additional team packet that includes the additional application layer message for the third node using the network encryption key; and

transmitting the encrypted additional team packet to the third node.

10. The network node of claim 7 , wherein the operations further comprise receiving, at the network node, a second sub-group encryption key that is unique to a second sub-group of nodes, a second sub-group identifier, and a second sub-group node list that lists the second sub-group of nodes associated with the second sub-group identifier from the headend system, wherein the second sub-group of nodes omits at least one node from the sub-group of nodes.

11. The network node of claim 7 , wherein the operations further comprise:

receiving a message authentication code; and

transmitting the message authentication code with the encrypted application layer message.

12. A non-transitory computer-readable medium embodying program code executable by a processing device, wherein when executed by a processing device, the program code causes the processing device to perform operations comprising:

receiving, at a first node, a network encryption key from a headend system, wherein the network encryption key is used to encrypt messages between nodes on a wireless mesh network;

receiving, at the first node, a sub-group encryption key that is unique to a sub-group of nodes, a sub-group identifier, and a sub-group node list that lists the sub-group of nodes associated with the sub-group identifier from the headend system, wherein the sub-group of nodes are nodes on the wireless mesh network;

generating an application layer message for a second node of the sub-group of nodes at an application layer;

encrypting the application layer message using the sub-group encryption key;

generating a team packet that is addressed to a second node and includes the encrypted application layer message and the sub-group identifier;

encrypting the team packet using the network encryption key;

transmitting the encrypted team packet to the second node;

receiving a second team packet from the second node;

determining whether the second team packet is addressed to the first node;

when the second team packet is addressed to the first node, determining whether an additional sub-group identifier included in the second team packet corresponds to the sub-group identifier; and

when the additional sub-group identifier of the second team packet does not correspond to the sub-group identifier, then ceasing to process the team packet.

13. The non-transitory computer-readable medium of claim 12 , the operations further comprising:

receiving a third team packet;

determining whether the third team packet is addressed to the first node;

when the third team packet is addressed to the first node, determining whether the third team packet includes the sub-group identifier; and

when the third team packet includes the sub-group identifier, then decrypting an additional application layer message in the third team packet using the sub-group encryption key.

14. The non-transitory computer-readable medium of claim 12 , the operations further comprising:

generating an additional application layer message for a third node at the application layer, wherein the third node is excluded from the sub-group of nodes;

encrypting an additional team packet that includes the additional application layer message for the third node using the network encryption key; and

transmitting the encrypted additional team packet to the third node.

15. The non-transitory computer-readable medium of claim 12 , the operations further comprising receiving, at the first node, a second sub-group encryption key that is unique to a second sub-group of nodes, a second sub-group identifier, and a second sub-group node list that lists the second sub-group of nodes associated with the second sub-group identifier from the headend system, wherein the second sub-group of nodes omits at least one node from the sub-group of nodes.

16. The non-transitory computer-readable medium of claim 12 , the operations further comprising:

receiving a message authentication code; and

transmitting the message authentication code with the encrypted application layer message.

17. The non-transitory computer-readable medium of claim 12 , the operations further comprising:

receiving a message authentication code from a headend system;

receiving an additional message authentication code from a peer node of the nodes; and

verifying the additional message authentication code against the message authentication code.