System and method to improve encrypted transmissions between nodes
Systems and methods for improving encrypted transmissions between nodes in a network are disclosed. In one embodiment, two sets of nonce values are used to monitor communications between each pair of network devices, wherein one set of nonce values is used for packets transmitted from a first node to a second node, and the second set of nonce values is used for packets transmitted from the second node to the first node. These nonce values are used to encrypt packets transmitted between the two nodes. In this way, the probability of loss of synchronization may be reduced, especially in configurations where there is an intermediate node between the first node and the second node. In another embodiment, the possibility of a delay attack is minimized by the intentional resetting of security parameters.
1. A method of minimizing a risk of a delay attack between a first node and a second node transmitting encrypted packets, comprising:
creating, in the first node and the second node, an initial value for a first nonce value used for transmissions from the first node to the second node;
updating, at the first node, the first nonce value whenever a packet destined for the second node is successfully transmitted; and
updating, at the second node, the first nonce value whenever a packet from the first node is successfully received;
wherein the first nonce value is used by the first node to encrypt packets transmitted to the second node and by the second node to decrypt packets received from the first node; and
initiating a resynchronization process based on a predetermined parameter, wherein the resynchronization process resets security parameters associated with the first node and the second node.
2. The method of claim 1 , wherein the predetermined parameter comprises a time duration since a packet was received.
3. The method of claim 1 , wherein the predetermined parameter comprises a regular time interval.
4. The method of claim 1 , wherein the predetermined parameter comprises noise or RSSI levels.
5. The method of claim 1 , wherein the security parameters comprise the initial value of the first nonce value.
6. The method of claim 1 , further comprising:
creating, in the first node and the second node, an initial value for a second nonce value used for transmissions from the second node to the first node;
updating, at the second node, the second nonce value whenever a packet destined for the first node is successfully transmitted; and
updating, at the first node, the second nonce value whenever a packet from the second node is successfully received;
wherein the second nonce value is used by the second node to encrypt packets transmitted to the first node and by the first node to decrypt packets received from the second node.
7. The method of claim 6 , wherein the security parameters comprise the initial value of the first nonce value and the initial value of the second nonce value.
8. A network device, comprising:
a wireless network interface to communicate with a second network device;
a processing unit; and
a memory device, comprising instructions, which when executed by the processing unit, enable the network device to:
create an initial value for a first nonce value used for transmissions from the network device to a second network device;
update the first nonce value whenever a packet destined for the second network device is successfully transmitted;
wherein the first nonce value is used to encrypt a packet transmitted to the second network device; and
initiate a resynchronization process to reset the first nonce value based on a predetermined parameter.
9. The network device of claim 8 , wherein the predetermined parameter comprises a time duration since a packet was received.
10. The network device of claim 8 , wherein the predetermined parameter comprises a regular time interval.
11. The network device of claim 8 , wherein the predetermined parameter comprises noise or RSSI levels.
12. The network device of claim 8 , further comprising instructions to enable the network device to:
create an initial value for a second nonce value used for transmissions from the second network device to the network device; and
update the second nonce value whenever a packet from the second network device is successfully received;
wherein the second nonce value is used to decrypt a packet transmitted from the second network device, and wherein the resynchronization process resets the second nonce value.
13. A network, comprising:
the network device of claim 12 ;
the second network device;
wherein the second network device updates the first nonce value whenever a packet is successfully received from the network device; and
updates the second nonce value whenever a packet is successfully transmitted to the network device.
14. A network, comprising:
the network device of claim 8 ;
the second network device;
wherein the second network device updates the first nonce value whenever a packet is successfully received from the network device.