Method for ensuring security and privacy in a wireless cognitive network

Patent metadata

Field	Value
Publication number	US-9420454-B2
Application number	US-201414528505-A
Country	US
Kind code	B2
Filing date	Oct 30, 2014
Priority date	Dec 8, 2009
Publication date	Aug 16, 2016
Grant date	Aug 16, 2016

Abstract

In some embodiments, authentication, confidentiality, and privacy are enhanced for a wireless network of cognitive radios by encryption of network management and control messages as well as data traffic, thereby protecting information pertaining to node identification, node location, node-sensed incumbent transmissions, CRN frequency channel selections, and such like. During initial network registration, a temporary ID can be issued to a node, and then replaced once encrypted communication has been established. This prevents association of initial, clear-text messages with later encrypted transmissions. Elliptic curve cryptography can be used for mutual authentication between subscribers and the base station. ECC-based implicit digital certificates can be embedded in co-existence beacons used by CRN nodes to coordinate use of frequency channels, thereby preventing denial of service attacks due to transmitting of falsified beacons. Similar certificates can be embedded within identity beacons used to protect certain incumbents from interference by the CRN.

First claim

What is claimed is:

1. A method for sharing access to a frequency channel among nodes of at least one wireless network of cognitive radios (“CRN”) while resisting malicious interference, each CRN including a base station node in communication with at least one subscriber node, the method comprising:
assigning to each of the nodes a unique Eliptic Curve Cryptography (“ECC”) based implicit certificate having a certificate public key and a certificate private key; and
transmitting and receiving of co-existence beacons by the nodes of the CRN's,
each of the co-existence beacons including information that facilitates sharing of the frequency channel by the nodes,
each of the co-existence beacons being protected by the ECC-based implicit certificate of the transmitting node, and
each of the co-existence beacons including an ECC-based beacon signature having a signature public key that is shorter than the certificate public key of the transmitting node and is not longer than 128 bits, the signature public key being generated by a key derivation function (“KDF”) that incorporates into the signature public key information derived from the certificate public key of the transmitting node and from a time stamp;
wherein assigning an ECC-based implicit certificate to each of the nodes includes communicating by the base station node with at least one external database server, at least one digital certificate being used by the base station to verify an identity of the external database server; and
wherein each of the implicit certificates includes at least one of:
a Certificate Authority ID Number (“CA ID”);
a key validity starting date that specifies a date before which the certificate is not valid;
a key validity ending date that specifies a date after which the certificate is not valid; and
public key reconstruction data.

2. The method of claim 1 , wherein CRN includes a plurality of base station nodes, and wherein if a first base station node receives a coexistence beacon from a second base station node, and if the certificate public key of the second base station node has not been distributed to the first base station node, then the method further includes:
transmitting by the first base station node to the second base station node of a certificate request that includes a request signature and the certificate public key of the first base station node;
verifying by the second base station node of the request signature and the certificate public key of the first base station;
sending by the second base station node to the first base station node of a certificate response that includes the implicit certificate of the second base station node; and
verifying by the first base station node of the implicit certificate of the second base station node.

3. The method of claim 1 , wherein assigning an ECC-based implicit certificate to each of the nodes includes pre-distribution of the ECC-based implicit certificate to the base station node.

4. The method of claim 3 , wherein pre-distributing the ECC-based implicit certificate to the base station node includes pre-loading the ECC-based implicit certificate on a memory device and distributing the memory device to the base station node.

5. The method of claim 4 , wherein the memory device is a SIM card.

6. The method of claim 3 , wherein the ECC-based implicit certificate is distributed to at least one of the nodes when the node is activated.

7. The method of claim 3 , wherein the ECC-based implicit certificate is distributed to at least one of the nodes using Network Communication Management Software (“NCMS”).

8. The method of claim 1 , wherein the ECC-based signature is contained in an information element that includes at least one of:
a key identification number;
a key serial number; and
a time stamp.

Assignees

• Bae Sys Inf & Elect Sys Integ

Inventors

• Reddy Ranga
• Kiernan Thomas
• Mody Apurva N

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04K3/65

  using deceptive jamming or spoofing, e.g. transmission of false signals for premature triggering of RCIED, for forced connection or disconnection to/from a network or for generation of dummy target signal · CPC title

• H04L9/0822

  using key encryption key · CPC title

• H04K2203/18

  for wireless local area networks or WLAN · CPC title

• H04W16/14

  Spectrum sharing arrangements {between different networks} · CPC title