IP Library Granted Patent US 8,769,267
Granted Patent B2
US 8,769,267 · App. 13/586,705 · Granted Jul 1, 2014

Geothentication based on new network packet structure

Inventors: Gregory M. Gutt (Ashburn, VA); Arun Ayyagari (Seattle, WA); David A. Whelan (Newport Coast, CA); Michael L. O'Connor (Redwood City, CA); David G. Lawrence (Santa Clara, CA)
Assignee: The Boeing Company
H04L45/00H04L63/0442H04L63/0428
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,769,267
App. No.
13/586,705
Granted
Jul 1, 2014
Kind
B2
Abstract

A system and method for verifying and/or geolocating network nodes in a network in attenuated environments for cyber and network security applications are disclosed. The system involves an origination network node, a destination network node, and at least one router network node. The origination network node is configured for transmitting a data packet downstream to the destination network node through at least one router network node. The data packet contains a header portion and a payload data portion. At least one of the network nodes is an enabled network node. The enabled network node(s) is configured to verify any of the network nodes that are located upstream from the enabled network node(s) by analyzing the header portion and/or the payload data portion of the data packet.

Claims (54)

1. A system for data routing security, the system comprising:

an origination network node;

a destination network node; and

at least one router network node,

wherein at least one of the origination network node, the destination network node, and the at least one router network node is an enabled network node;

wherein the origination network node and the destination network node are connected to each other via the at least one router network node,

wherein the origination network node is configured for transmitting a data packet downstream to the destination network node through the at least one router network node,

wherein the data packet comprises a payload data portion and a header portion,

wherein the header portion comprises a security signature portion and a routing data portion,

wherein the security signature portion comprises geolocation information relating to at least one of the network nodes the data packet has traveled through, and

wherein the at least one enabled network node is configured to verify at least one of the network nodes that are located upstream from the at least one enabled network node by analyzing at least one of the header portion and the payload data portion of the data packet.

2. The system of claim 1 , wherein the geolocation information relating to the at least one network node that the data packet has traveled through is obtained by receiving a resultant signal that is transmitted from at least one transmission source,

wherein the resultant signal contains at least one authentication signal, and

wherein a location of the at least one network node the data packet has traveled through is verified by comparing properties of the resultant signal the at least one network node the data packet has traveled through receives to expected properties of the resultant signal that the at least one network node the data packet has traveled through should receive due to its location.

3. The system of claim 2 , wherein the at least one transmission source is at least one of a satellite, a pseudo-satellite, and a terrestrial transmission source.

4. The system of claim 3 , wherein the satellite is one of a low Earth orbiting (LEO) satellite, a medium Earth orbiting (MEO) satellite, and a geosynchronous Earth orbiting (GEO) satellite.

5. The system of claim 1 , wherein the geolocation information relating to the at least one network node that the data packet has traveled through is determined from ranging information obtained by a signal transmitted by the at least one network node the data has traveled through to another network node at a verified location, and by a signal received by the at least one network node the data has traveled through from the network node at the verified location.

6. The system of claim 1 , wherein the header portion of the data packet employs an Internet Protocol version 6 (IPv6) data packet header.

7. The system of claim 6 , wherein geolocation information is stored within the IPv6 data packet header.

8. The system of claim 1 , wherein when the at least one enabled network node verifies any of the network nodes, the at least one enabled network node removes at least a portion of data contained in the header portion of the data packet.

9. The system of claim 1 , wherein the header portion of the data packet contains data relating to all of the network nodes that the data packet has traveled through.

10. The system of claim 1 , wherein when the at least one enabled network node verifies at least one of the network nodes, the at least one enabled network node adds data to the header portion of the data packet regarding the at least one of the network nodes that was verified.

11. The system of claim 10 , wherein the added data to the header portion is regarding geolocation information related to the at least one of the network nodes that was verified.

12. The system of claim 1 , wherein at least one of the at least one enabled network node is configured to only transmit data packets that the at least one enabled network node receives directly from any of the verified network nodes.

13. The system of claim 1 , wherein at least one of the at least one enabled network node is configured to only transmit data packets that have traveled through only the verified network nodes.

14. The system of claim 1 , wherein at least one of the at least one enabled network node is configured to determine which of the network nodes are geotag-capable network nodes.

15. The system of claim 1 , wherein at least one of the at least one enabled network node is configured to determine which of the network nodes are enabled network nodes.

16. The system of claim 1 , wherein at least one of the at least one enabled network node additionally utilizes received signals that are transmitted from at least one transmission source to verify at least one of the network nodes that are located upstream from the at least one enabled network node.

17. The system of claim 1 , wherein the data packet is transmitted from the origination network node downstream to the destination network node only through enabled network nodes.

18. A method for data routing security, the method comprising:

transmitting a data packet from an origination network node downstream to a destination network node through at least one router network node,

wherein the data packet comprises a payload data portion and a header portion,

wherein the header portion comprises a security signature portion and a routing data portion,

wherein the security signature portion comprises geolocation information relating to at least one of the network nodes the data packet has traveled through; and

verifying, by at least one enabled network node, at least one of the network nodes that are located upstream from the at least one enabled network node by analyzing at least one of the header portion and the payload data portion of the data packet,

wherein the at least one enabled network node is at least one of the origination network node, the destination network node, and the at least one router network node.

19. The method of claim 18 , wherein the geolocation information relating to the at least one network node that the data packet has traveled through is obtained by receiving a resultant signal that is transmitted from at least one transmission source,

wherein the resultant signal contains at least one authentication signal, and

wherein a location of the at least one network node the data packet has traveled through is verified by comparing properties of the resultant signal the at least one network node the data packet has traveled through receives to expected properties of the resultant signal that the at least one network node the data packet has traveled through should receive due to its location.

20. The method of claim 19 , wherein the at least one transmission source is at least one of a satellite, a pseudo-satellite, and a terrestrial transmission source.

21. The method of claim 20 , wherein the satellite is one of a low Earth orbiting (LEO) satellite, a medium Earth orbiting (MEO) satellite, and a geosynchronous Earth orbiting (GEO) satellite.

22. The method of claim 18 , wherein the geolocation information relating to the at least one network node that the data packet has traveled through is determined from ranging information obtained by a signal transmitted by the at least one network node the data has traveled through to another network node at a verified location, and by a signal received by the at least one network node the data has traveled through from the network node at the verified location.

23. The method of claim 18 , wherein the header portion of the data packet employs an Internet Protocol version 24 (IPv6) data packet header.

24. The method of claim 23 , wherein geolocation information is stored within the IPv6 data packet header.

25. The method of claim 18 , wherein when the at least one enabled network node verifies any of the network nodes, the at least one enabled network node removes at least a portion of data contained in the header portion of the data packet.

26. The method of claim 18 , wherein the header portion of the data packet contains data relating to all of the network nodes that the data packet has traveled through.

27. The method of claim 18 , wherein when the at least one enabled network node verifies at least one of the network nodes, the at least one enabled network node adds data to the header portion of the data packet regarding the at least one of the network nodes that was verified.

28. The method of claim 27 , wherein the added data to the header portion is regarding geolocation information related to the at least one of the network nodes that was verified.

29. The method of claim 18 , wherein at least one of the at least one enabled network node is configured to only transmit data packets that the at least one enabled network node receives directly from any of the verified network nodes.

30. The method of claim 18 , wherein at least one of the at least one enabled network node is configured to only transmit data packets that have traveled through only the verified network nodes.

31. The method of claim 18 , wherein at least one of the at least one enabled network node is configured to determine which of the network nodes are geotag-capable network nodes.

32. The method of claim 18 , wherein at least one of the at least one enabled network node is configured to determine which of the network nodes are enabled network nodes.

33. The method of claim 18 , wherein at least one of the at least one enabled network node additionally utilizes received signals that are transmitted from at least one transmission source to verify at least one of the network nodes that are located upstream from the at least one enabled network node.

34. The method of claim 18 , wherein the data packet is transmitted from the origination network node downstream to the destination network node only through enabled network nodes.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Aug 15, 2012
From: GUTT, GREGORY M.; AYYAGARI, ARUN; WHELAN, DAVID A.; O'CONNOR, MICHAEL L.; LAWRENCE, DAVID G.
To: THE BOEING COMPANY
Reel/Frame 028793/0735 →
Continuity (3)
Continuation In Part 13114013 · May 23, 2011
Continuation In Part 12130880 · May 30, 2008
Related Publication 20130305044A1 · Nov 14, 2013