Wireless Mesh Network Security via Type of Protection Values

The patent segments the security protection into two independent layers: group keys for encrypting data traffic to prevent eavesdropping, and individual cryptographic signatures for each data packet to prevent alteration. This segmentation allows each mechanism to address its specific security concern without compromising the other, resolving the contradiction between eavesdropping protection and data integrity in multi-hop environments.

The patent creates a composite security mechanism by combining group key encryption with individual digital signatures. The group key provides confidentiality for multi-hop transmission, while the digital signature provides integrity verification at each hop. This composite approach leverages the strengths of both mechanisms to simultaneously achieve both protection goals.

The patent extracts the integrity verification function from the key management system and implements it through digital signatures attached to individual data packets. This extraction eliminates the need for complex pairwise key management between nodes, as each node only needs its own private key and the public keys of other nodes for verification, significantly simplifying the key management infrastructure while maintaining protection against internal attackers.

Each node generates and manages its own cryptographic key pair independently, and includes its own digital signature on each data packet it forwards. This self-service approach eliminates the need for a centralized key distribution system or complex pairwise key negotiation, reducing overall system complexity while ensuring each node can verify the authenticity of packets it receives.

The patent implements feedback by including a digital signature from the original source node on each data packet that travels through the mesh network. Each intermediate node can verify this signature to confirm the packet's authenticity and intended routing. If a node attempts selective forwarding or routing disruption, the verification fails and the packet is rejected, providing continuous feedback that prevents such attacks while maintaining authentication.

The source node performs preliminary action by digitally signing the data packet before it enters the mesh network. This pre-established authentication marker travels with the packet through all intermediate nodes, enabling them to verify the packet's legitimacy and intended routing path without requiring complex real-time authentication negotiations, thus preventing routing disruptions before they can occur.