Lattice mesh

Patent metadata

Field	Value
Publication number	US-10812978-B2
Application number	US-201916673194-A
Country	US
Kind code	B2
Filing date	Nov 4, 2019
Priority date	Jun 11, 2018
Publication date	Oct 20, 2020
Grant date	Oct 20, 2020

Abstract

A system for a lattice mesh comprises an interface and a processor. The interface is configured to receive a request to join a publish group from a client. The processor is configured to determine a group key; determine whether the client is allowed access to a topic of the publish group; in response to the client being allowed access to the topic of the publish group, provide the group key to the client; publish a group message including metadata; determine whether it is time to rotate the group key; and in response to it being time to rotate the group key, determine a new group key.

First claim

What is claimed is:

1. A system for a lattice mesh, comprising:
an interface configured to receive a request to join a publish group from a client;
a processor configured to:
determine a group key;
determine whether the client is allowed access to a topic of the publish group;
in response to the client being allowed access to the topic of the publish group, provide the group key to the client;
publish a group message including metadata, wherein publishing the group message uses the group key, wherein the group key includes group key metadata for filtering messages at the client nodes, wherein the group key metadata includes keys that allow exact matching or prefix matching to the keys for filtering published group messages;
determine whether it is time to rotate the group key; and
in response to it being time to rotate the group key, determine a new group key.

2. A system of claim 1 , wherein, the group key is determined by querying an asset database for authorization that was provided initially by a resource authority.

3. A system of claim 1 , wherein determining whether the client is allowed access to the topic of the publish group comprises inquiring to a topic database whether the client has access permission to the topic of the publish group.

4. A system of claim 1 , wherein providing the group key to the client comprises transmitting the group key to the client.

5. A system of claim 1 , wherein the metadata comprises unencrypted filtering data.

6. A system of claim 1 , wherein the metadata comprises encrypted filtering data.

7. A system of claim 1 , wherein a key of the keys is associated with one or more of the following: a producer of a message, a timestamp, a date stamp, a media type, a topic type, and a file type.

8. A system of claim 1 , wherein the time to rotate the group key comprises every N times 10 minutes.

9. A system of claim 1 , wherein the time to rotate the group key comprises every N hours.

10. A system of claim 1 , wherein the time to rotate the group key comprises every N seconds.

11. A system of claim 1 , wherein the processor is further configured to determine whether there is another group message in response to determining it is not time to rotate the group key.

12. A system of claim 11 , wherein the processor is further configured to determine whether it is time to rotate the group key in response to determining that there is not another group message.

13. A system of claim 1 , wherein determining the group key comprises determining a keyId used to encrypt a message and a bearer token that proves the client has access.

14. A system of claim 1 , wherein the group message is encrypted with the group key.

15. A system of claim 1 , wherein the group message is signed by a private key to prevent other hosts with access to the group key from forging messages.

16. A method for a lattice mesh, comprising:
receiving a request to join a publish group from a client;
determining, using a processor, a group key;
determining whether the client is allowed access to a topic of the publish group;
in response to the client being allowed access to the topic of the publish group, providing the group key to the client;
publishing a group message including metadata, wherein publishing the group message uses the group key, wherein the group key includes group key metadata for filtering messages at the client nodes, wherein the group key metadata includes keys that allow exact matching or prefix matching to the keys for filtering published group messages;
determining whether it is time to rotate the group key; and
in response to it being time to rotate the group key, determining a new group key.

17. A computer program product for a lattice mesh, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
receiving a request to join a publish group from a client;
determining, using a processor, a group key;
determining whether the client is allowed access to a topic of the publish group;
in response to the client being allowed access to the topic of the publish group, providing the group key to the client;
publishing a group message including metadata, wherein publishing the group message uses the group key, wherein the group key includes group key metadata for filtering messages at the client nodes, wherein the group key metadata includes keys that allow exact matching or prefix matching to the keys for filtering published group messages;
determining whether it is time to rotate the group key; and
in response to it being time to rotate the group key, determining a new group key.

18. A system for a lattice mesh, comprising:
an interface configured to receive a request to join a publish group from a client;
a processor configured to:
determine a group key;
determine whether the client is allowed access to a topic of the publish group;
in response to the client being allowed access to the topic of the publish group, provide the group key to the client;
publish a group message including metadata;
determine whether it is time to rotate the group key; and
in response to it being time to rotate the group key, determine a new group key; and
in response to determining it is not time to rotate the group key, determine whether there is another group message.

19. A system of claim 18 , wherein, the group key is determined by querying an asset database for authorization that was provided initially by a resource authority.

20. A system of claim 18 , wherein determining whether the client is allowed access to the topic of the publish group comprises inquiring to a topic database whether the client has access permission to the topic of the publish group.

21. A system of claim 18 , wherein providing the group key to the client comprises transmitting the group key to the client.

22. A system of claim 18 , wherein publishing a group message using the group key.

23. A system of claim 22 , wherein the group key includes metadata for filtering messages at the client nodes.

24. A system of claim 23 , wherein the metadata comprises unencrypted filtering data.

25. A system of claim 23 , wherein the metadata comprises encrypted filtering data.

26. A system of claim 23 , wherein the metadata includes keys that allow exact matching or prefix matching to the keys for filtering published group messages.

27. A system of claim 26 , wherein a key of the keys is associated with one or more of the following: a producer of a message, a timestamp, a date stamp, a media type, a topic type, and a file type.

28. A system of claim 18 , wherein the time to rotate the group key comprises every N times 10 minutes.

29. A system of claim 18 , wherein the time to rotate the group key comprises every N hours.

30. A system of claim 18 , wherein the time to rotate the group key comprises every N seconds.

31. A system of claim 18 , wherein the processor is further configured to determine whether it is time to rotate the group key in response to determining that there is not another group message.

32. A system of claim 18 , wherein determining the group key comprises determining a keyId used to encrypt a message and a bearer token that proves the client has access.

33. A

Assignees

• Anduril Industries Inc

Inventors

• Newman Jared
• Brown Ryan
• Schimpf Brian W
• Luckey Palmer F
• Hammerstein Julian
• Whitaker Travis M
• Levin Jason
• Chen Joseph

Classifications

• H04L9/0833 Primary

  involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065) · CPC title

• H04L67/55

  Push-based network services · CPC title

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04W12/069 Primary

  using certificates or pre-shared keys · CPC title