Method and apparatus for secure communications and resource sharing between anonymous non-trusting parties with no central administration
A unifying network model with a structure and architecture configured to address security, interoperability, mobility, and resource management, including priority and quality of services is provided. The network of the network model is structured as a hierarchical mesh network, with dynamically generated routing tables. The configuration of the network model optimizes routing and distributes communication load. Every device on the network is capable of being both an endpoint and a forwarder of communications. The network model may include underlying networks that are represented with one of two models, the link model or the star model. The nodes are organized in a hierarchical relationship structure to optimizes throughput. The model may include a cryptographic method of dynamically assigning local network addresses.
1. A system for organizing without central administration of a network of non-trusting computing devices so that the computing devices can securely share network resources and communicate with each other, comprising:
a recipient computing device; and
a sending computing device that sends a signed circuit establishment request to the recipient computing device via the network of non-trusting computing devices,
wherein the sending computing device communicates the circuit establishment request comprising a first identity document and a computational challenge to the recipient computing device, wherein the first identity document identifies the sending computing device to the recipient computing device, and wherein the first identity document includes a first public key signed by the sending computing device, and wherein the first public key is associated with a first private key known only to the sending computing device;
wherein the recipient computing device communicates a signed challenge with a solution and a second identity document to the sending computing device, wherein the second identity document identifies the recipient computing device to the sending computing device, wherein the second identity document includes a second public key signed by the recipient computing device, and wherein the second public key is associated with a second private key known only to the recipient computing device, wherein the solution of the signed challenge includes a missing portion of data which results in a cryptographic hash that is to be computationally solved by the sending computing device to complete the circuit establishment;
wherein the sending computing device solves the signed challenge by computing the missing portion of data of the solution of the signed challenge, wherein the first private key and the first public key unique to the first identity document identify the sending computing device to the recipient computing device;
wherein the second private key and the second public key uniquely identify the recipient computing device to the sending computing device;
wherein a communications circuit is established between the sending computing device and the recipient computing device in response to the recipient computing device identifying the sending computing device based on the first identity document, in response to the sending computing device identifying the recipient computing device based on the second identity document, and in response to the sending computing device computationally solving the received signed challenge,
wherein the recipient computing device saves challenge/response state information associated with the sending computing device only in response to the sending computing device computationally solving the received signed challenge, such that no challenge/response state information is kept for challenge requests, only for successful challenge responses,
wherein, in response to the recipient computing device sending the sending computing device the signed challenge, the sending computing device determines the missing portion of data of the cryptographic hash, wherein the determined missing portion of data computationally is used to solve the challenge, and
wherein the sending computing device determines the missing portion of data of the cryptographic hash by performing a brute force search for a number of missing bits of the cryptographic hash, wherein the number of missing bits are specified by the signed challenge.
2. The system of claim 1 , wherein the sending computing device sends a packet to the recipient computing device using a hierarchical dynamic routing protocol.
3. The system of claim 2 , wherein the hierarchical dynamic routing protocol propagates quality of service information to each intermediate computing device.
4. The system of claim 2 , wherein the hierarchical dynamic routing protocol employs a cryptographic method to encrypt communications.
5. The system of claim 2 , wherein the sending computing device sends a document that is used by at least one of the recipient computing device and intermediate computing devices to make decisions.
6. The system of claim 5 , wherein the document describes a quality of service.
7. The system of claim 6 , wherein the document further describes rights and delegations of rights for usage of the network by at least one of the recipient computing device and the intermediate computing devices.
8. The system of claim 5 , wherein the document describes a delegation of a permission.
9. The system of claim 8 , wherein the delegation of the permission enables at least one of the recipient computing device and the intermediate computing devices to make a data movement decision.
10. The system of claim 2 , wherein the hierarchical dynamic routing protocol can use either a reliable or unreliable underlying communications protocol.
11. The system of claim 1 , wherein the network is organized as a hierarchical mesh network.
12. The system of claim 11 , wherein the sending computing device, the recipient computing device, and intermediate computing devices of the hierarchical mesh network are each identified by a name comprising a set of identifiers separated by a separator.
13. The system of claim 12 , wherein the identifiers are organized in the name from specific to general.
14. The system of claim 11 , wherein the hierarchical mesh network includes a meta-node.
15. The system of claim 14 , wherein the meta-node indicates a computing device and a network of computing devices, and wherein the indicated computing device and the indicated network of computing devices represents peers in a hierarchy.
16. A method comprising:
sending, from a sending computing device, a signed circuit establishment request to a recipient computing device via a network of non-trusting computing devices, wherein the signed circuit establishment request includes a first identity document that identifies the sending computing device to the recipient computing device, and wherein the first identity document includes a first public key signed by the sending computing device, and wherein the first public key is associated with a first private key known only to the sending computing device;
receiving, at the sending computing device, a second identity document communicated from the recipient computing device, and wherein the second identity document identifies the recipient computing device to the sending computing device, wherein the second identity document includes a second public key signed by the recipient computing device, wherein the second public key is associated with a second private key known only to the recipient computing device;
computing, at the sending device, the missing portion of data of the solution of the signed challenge to solve the signed challenge;
establishing a communications circuit between the sending computing device and the recipient computing device in response to the recipient computing device identifying the sending computing device based on the first identity document, in response to the recipient computing device sending the sending computing device a signed challenge with a solution that includes a missing portion of data which results in a cryptographic hash that is to be computationally solved by the sending computing device, in response to the sending computing device identifying the recipient computing device based on the second identity document, and in response to the sending computing device computationally solving the received signed challenge; and
in response to the recipient computing device sending the sending computing device the signed challenge, determining, by the sending computing device, the missing portion of data of the cryptographic hash, wherein the determined missing portion of data computationally is used to solve the challenge,
wherein the recipient computing device saves challenge/response state information associated with the sending computing device only in response to the sending computing device computationally solving the received signed challenge, such that no challenge/response state information is kept for challenge requests, only for successful challenge responses, and
wherein determining, by the sending computing device, the missing portion of data of the cryptographic hash includes performing a brute force search for a number of missing bits of the cryptographic hash, wherein the number of missing bits are specified by the signed challenge.
17. The method of claim 16 , further comprising:
sending a packet from the sending computing device to the recipient computing device using a hierarchical dynamic routing protocol.
18. The method of claim 16 , further comprising:
sending a document from the sending computing device to the recipient computing device, wherein the document is used by intermediate computing devices to make decisions.
19. The system of claim 18 , wherein the document describes rights and delegations of rights for usage of the network by at least one of the recipient computing device and the intermediate computing devices.
20. The system of claim 18 , wherein the document describes a delegation of a permission, and wherein the delegation of the permission enables at least one of the recipient computing device and the intermediate computing devices to make a data movement decision.