System and method to improve encrypted transmissions between nodes
Systems and methods for improving encrypted transmissions between nodes in a network are disclosed. In one embodiment, two sets of nonce values are used to monitor communications between each pair of network devices, wherein one set of nonce values is used for packets transmitted from a first node to a second node, and the second set of nonce values is used for packets transmitted from the second node to the first node. These nonce values are used to encrypt packets transmitted between the two nodes. In this way, the probability of loss of synchronization may be reduced, especially in configurations where there is an intermediate node between the first node and the second node. In another embodiment, the possibility of a delay attack is minimized by the intentional resetting of security parameters.
1. A method of maintaining synchronization between a first node and a second node transmitting encrypted packets, comprising:
creating, in the first node and the second node, an initial value for a first nonce value used for transmissions from the first node to the second node;
updating, at the first node, the first nonce value whenever a packet destined for the second node is successfully transmitted; and
updating, at the second node, the first nonce value whenever a packet from the first node is successfully received;
wherein the first nonce value is used by the first node to encrypt packets transmitted to the second node and by the second node to decrypt packets received from the first node.
2. The method of claim 1 , further comprising:
creating, in the first node and the second node, an initial value for a second nonce value used for transmissions from the second node to the first node;
updating, at the second node, the second nonce value whenever a packet destined for the first node is successfully transmitted; and
updating, at the first node, the second nonce value whenever a packet from the second node is successfully received;
wherein the second nonce value is used by the second node to encrypt packets transmitted to the first node and by the first node to decrypt packets received from the second node.
3. The method of claim 2 , wherein the first nonce value and the second nonce value differ over time due to a difference in events that cause each nonce value to be updated.
4. The method of claim 2 , wherein the first node and the second node each comprise a sequence of nonce values, and updating the first nonce value comprises incrementing a first index into the sequence of nonce values and updating the second nonce value comprises incrementing a second index into the sequence of nonce values.
5. The method of claim 2 , wherein the first node and the second node each comprise a sequence of first nonce values and a sequence of second nonce values, and updating the first nonce value comprises incrementing a first index into the sequence of first nonce values and updating the second nonce value comprises incrementing a second index into the sequence of second nonce values.
6. The method of claim 1 , wherein the first node and the second node each comprise a sequence of first nonce values, and updating the first nonce value comprises incrementing an index into the sequence of first nonce values.
7. The method of claim 1 , wherein updating the first nonce value comprises invoking a software function, wherein a new first nonce value is generated each time the software function is invoked.
8. The method of claim 1 , wherein updating the first nonce value comprises incrementing a previous first nonce value.
9. A network device, comprising:
a wireless network interface to communicate with a second network device;
a processing unit; and
a memory device, comprising instructions, which when executed by the processing unit, enable the network device to:
create an initial value for a first nonce value used for transmissions from the network device to a second network device; and
update the first nonce value whenever a packet destined for the second network device is successfully transmitted;
wherein the first nonce value is used to encrypt a packet transmitted to the second network device.
10. The network device of claim 9 , further comprising instructions, which when executed by the processing unit, enable the network device to:
create an initial value for a second nonce value used for transmissions from the second network device to the network device; and
update the second nonce value whenever a packet from the second network device is successfully received;
wherein the second nonce value is used to decrypt a packet transmitted from second network device.
11. The network device of claim 10 , wherein the first nonce value and the second nonce value differ over time due to a difference in events that cause each nonce value to be updated.
12. The network device of claim 10 , wherein the network device comprises a sequence of nonce values, and updating the first nonce value comprises incrementing a first index into the sequence of nonce values and updating the second nonce value comprises incrementing a second index into the sequence of nonce values.
13. The network device of claim 10 , wherein the network device comprises a sequence of first nonce values and a sequence of second nonce values, and updating the first nonce value comprises incrementing a first index into the sequence of first nonce values and updating the second nonce value comprises incrementing a second index into the sequence of second nonce values.
14. The network device of claim 9 , wherein the network device comprises a sequence of first nonce values, and updating the first nonce value comprises incrementing an index into the sequence of first nonce values.
15. The network device of claim 9 , wherein updating the first nonce value comprises invoking a software function, wherein a new first nonce value is generated each time the software function is invoked.