Secure Path Discovery in Mesh Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Wireless mesh networks are vulnerable to third-party attackers using man-in-the-middle, spoofing, and jammer attacks during path discovery, compromising communication security between nodes.
Innovation Solution
A method for secure path discovery in mesh networks involves receiving a path discovery request, selecting a path, transmitting the path selection, and generating an authentication code based on a random seed, with verification by a provisioner device to ensure secure communication, blocking unauthorized nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Area of stationary object
If mesh networks use multiple relay nodes for extended communication range, then communication coverage is improved, but vulnerability to third-party attacks increases
Solution Approach 1:
The system performs preliminary authentication and key establishment between the originator node and destination node before actual data transmission. The originator node establishes a secure tunnel with the destination node using pre-shared keys, and intermediate relay nodes are authenticated in advance. This preliminary security setup prevents man-in-the-middle attacks and ensures that only authorized nodes can participate in the communication path.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism where the originator node acts as a mediator to establish secure connections with intermediate relay nodes and the destination node. The originator node verifies the authenticity of relay nodes and establishes encrypted tunnels through them, preventing unauthorized nodes from injecting themselves into the communication path.
2Reliability
If mesh networks implement authentication for each node, then security is improved, but communication overhead increases
Solution Approach 1:
Nodes perform authentication and establish security credentials in advance during network initialization or before joining the mesh network. The originator node and destination node pre-establish secure tunnels and exchange authentication credentials before actual data transmission begins. This eliminates the need for real-time authentication during communication, reducing overhead time.
Solution Approach 2:
The patent implements a universal authentication mechanism where a single authentication protocol and set of credentials can be used across all nodes in the mesh network. The same pre-shared key mechanism works for authenticating the originator node, destination node, and all intermediate relay nodes, simplifying the authentication process and reducing overhead compared to node-specific authentication schemes.
3Reliability
If mesh networks use encrypted communication channels, then security is improved, but processing complexity increases
Solution Approach 1:
The patent uses parameter changes by implementing variable tunnel establishment based on network conditions and security requirements. The encryption parameters such as key length, authentication strength, and tunnel establishment frequency can be adjusted dynamically. For example, in high-security scenarios, stronger encryption is used, while in low-risk environments, lighter encryption reduces processing complexity.
Solution Approach 2:
The encryption process is segmented into distinct phases: key generation, tunnel establishment, and data transmission encryption. Each phase uses appropriate encryption strength - heavy encryption for key exchange and tunnel setup, and optimized encryption for bulk data transmission. This segmentation reduces overall processing complexity by applying computational intensity only where necessary.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for secure path discovery in a mesh network at a destination device is disclosed. The method includes receiving a path discovery request from an originator device and selecting a path selection in response to the path discovery request. The method also includes transmitting the path selection to the originator device and receiving a random seed from a provisioner device. The method also includes generating an authentication code based on the random seed, transmitting an authentication code message to an originator device and receiving communications from the originator device only if the originator device receives a verification response message from the provisioner device which confirms that the destination device has been verified.