# US 11,122,060 B2 · Detection of security threats in a mesh network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,060 B2 - Document ID: US11122060B2 - Status: Granted - Kind: B2 - Application number: 16/203,572 - Filed: 2018-11-28 - Published: 2020-05-28 - Granted: 2021-09-14 - Earliest claimed: 2018-11-28 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: Sourabh Jana; Chirag Manojkumar Kharvar; Ravi Shekhar; Ravi Kiran Bamidi - Web page: https://patentgrep.com/patent/US11122060B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication - H04W 12/033: of the user plane, e.g. user's traffic - H04W 12/041: Key generation or derivation - H04W 12/0471: Key exchange - H04W 12/06: Authentication - H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS] - H04W 24/08: Testing, {supervising or monitoring} using real traffic - H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed are techniques for detecting a security threat in a wireless mesh network. In an aspect, a monitoring device in the wireless mesh network detects a first message transmitted by a source node in the wireless mesh network to a destination node in the wireless mesh network via at least one relay node in the wireless mesh network, collects information from the first message as it is transmitted in the wireless mesh network, determines that the first message has been corrupted based on analysis of the information from the first message, and detects the security threat in the wireless mesh network based on the first message being corrupted. ## Claims ### Claim 1 A method for detecting a security threat in a wireless mesh network, comprising: detecting, by a monitoring device in the wireless mesh network, a first message transmitted by a source node in the wireless mesh network to a destination node in the wireless mesh network via at least one relay node in the wireless mesh network and the monitoring device is separate from the destination node, wherein the monitoring device sniffs messages as they are being transmitted between the source node and destination mode in the wireless mesh network; collecting, by the monitoring device, information from the first message as it is transmitted in the wireless mesh network by directly collecting the information while listening to the first message as it is transmitted from the source node to the destination node over the wireless mesh network; determining, by the monitoring device, that the first message has been corrupted based on analysis of the information from the first message; and detecting, by the monitoring device, the security threat in the wireless mesh network based on the first message being corrupted. ### Claim 2 (depends on 1) The method of claim 1, wherein the detecting the security threat comprises: identifying, by the monitoring device, the at least one relay node as the security threat in the wireless mesh network based on a determination that the first message has been corrupted by the at least one relay node. ### Claim 3 (depends on 2) The method of claim 2, further comprising: notifying, by the monitoring device, a user of the wireless mesh network that the at least one relay node is the security threat. ### Claim 4 (depends on 2) The method of claim 2, further comprising: notifying, by the monitoring device, a manufacturer of the at least one relay node that the at least one relay node is the security threat. ### Claim 5 (depends on 2) The method of claim 2, further comprising: recording, by the monitoring device, information about the at least one relay node in response to the identifying. ### Claim 6 (depends on 5) The method of claim 5, wherein the information comprises a make and model of the at least one relay node. ### Claim 7 (depends on 2) The method of claim 2, further comprising: removing, by the monitoring device, the at least one relay node from the wireless mesh network. ### Claim 8 (depends on 7) The method of claim 7, further comprising: initiating, by the monitoring device, a network key refresh procedure for all remaining nodes in the wireless mesh network. ### Claim 9 (depends on 7) The method of claim 7, further comprising: instructing, by the monitoring device, all remaining nodes in the wireless mesh network to flush their local source and sequence number cache. ### Claim 10 (depends on 1) The method of claim 1, wherein the information from the first message comprises an address of the source node, an address of the destination node, and a sequence number associated with the address of the source node. ### Claim 11 (depends on 10) The method of claim 10, wherein the monitoring device determines that the first message has been corrupted based on the address of the destination node, the sequence number, or both, being changed as the first message is transmitted in the wireless mesh network. ### Claim 12 (depends on 11) The method of claim 11, further comprising: identifying, by the monitoring device, the at least one relay node as the security threat in the wireless mesh network based on a determination that the at least one relay node changed the address of the destination node, the sequence number, or both. ### Claim 13 (depends on 1) The method of claim 1, wherein the information from the first message comprises a time-to-live (TTL) field that is decremented by each relay node that relays the first message as it is transmitted in the wireless mesh network. ### Claim 14 (depends on 13) The method of claim 13, wherein the monitoring device determines that the first message has been corrupted based on the TTL field being changed to 0 before it reached the destination node or to a value greater than a threshold indicative of a corrupted TTL field. ### Claim 15 (depends on 14) The method of claim 14, further comprising: identifying, by the monitoring device, the at least one relay node as the security threat in the wireless mesh network based on a determination that the at least one relay node changed the TTL field to 0 before it reached the destination node or to the value greater than the threshold indicative of a corrupted TTL field. ### Claim 16 (depends on 1) The method of claim 1, wherein the determining comprises: uploading, by the monitoring device, the information from the first message to a remote server, wherein the remote server performs the analysis of the information from the first message; and receiving, at the monitoring device, a notification from the remote server that the first message has been corrupted. ### Claim 17 (depends on 1) The method of claim 1, wherein the monitoring device is a provisioner node in the wireless mesh network. ### Claim 18 (depends on 1) The method of claim 1, wherein the monitoring device is not a provisioner node or controller node in the wireless mesh network. ### Claim 19 (depends on 1) The method of claim 1, wherein the monitoring device is a stationary mains-powered device in the wireless mesh network. ### Claim 20 (depends on 1) The method of claim 1, wherein the monitoring device is a battery-powered mobile device in the wireless mesh network. ### Claim 21 (depends on 1) The method of claim 1, wherein the wireless mesh network comprises a Bluetooth® mesh network. ### Claim 22 An apparatus for detecting a security threat in a wireless mesh network, comprising: at least one hardware processor of a monitoring device in the wireless mesh network configured to: detect a first message transmitted by a source node in the wireless mesh network to a destination node in the wireless mesh network via at least one relay node in the wireless mesh network and the monitoring device is separate from the destination node, wherein the monitoring device sniffs messages as they are being transmitted between the source node and destination mode in the wireless mesh network; collect information from the first message as it is transmitted in the wireless mesh network by directly collecting the information while listening to the first message as it is transmitted from the source node to the destination node over the wireless mesh network; determine that the first message has been corrupted based on analysis of the information from the first message; and detect the security threat in the wireless mesh network based on the first message being corrupted. ### Claim 23 (depends on 22) The apparatus of claim 22, wherein the at least one processor being configured to detect the security threat comprises the at least one processor being configured to: identify the at least one relay node as the security threat in the wireless mesh network based on a determination that the first message has been corrupted by the at least one relay node. ### Claim 24 (depends on 23) The apparatus of claim 23, wherein the at least one processor is further configured to: notify a user of the wireless mesh network that the at least one relay node is the security threat. ### Claim 25 (depends on 23) The apparatus of claim 23, wherein the at least one processor is further configured to: notify a manufacturer of the at least one relay node that the at least one relay node is the security threat. ### Claim 26 (depends on 23) The apparatus of claim 23, wherein the at least one processor is further configured to: record information about the at least one relay node in response to the identifying. ### Claim 27 (depends on 26) The apparatus of claim 26, wherein the information comprises a make and model of the at least one relay node. ### Claim 28 (depends on 23) The apparatus of claim 23, wherein the at least one processor is further configured to: remove the at least one relay node from the wireless mesh network. ### Claim 29 (depends on 28) The apparatus of claim 28, wherein the at least one processor is further configured to: initiate a network key refresh procedure for all remaining nodes in the wireless mesh network. ### Claim 30 (depends on 28) The apparatus of claim 28, wherein the at least one processor is further configured to: instruct all remaining nodes in the wireless mesh network to flush their local source and sequence number cache. ### Claim 31 (depends on 22) The apparatus of claim 22, wherein the information from the first message comprises an address of the source node, an address of the destination node, and a sequence number associated with the address of the source node. ### Claim 32 (depends on 31) The apparatus of claim 31, wherein the monitoring device determines that the first message has been corrupted based on the address of the destination node, the sequence number, or both, being changed as the first message is transmitted in the wireless mesh network. ### Claim 33 (depends on 32) The apparatus of claim 32, wherein the at least one processor is further configured to: identify the at least one relay node as the security threat in the wireless mesh network based on a determination that the at least one relay node changed the address of the destination node, the sequence number, or both. ### Claim 34 (depends on 22) The apparatus of claim 22, wherein the information from the first message comprises a time-to-live (TTL) field that is decremented by each relay node that relays the first message as it is transmitted in the wireless mesh network. ### Claim 35 (depends on 34) The apparatus of claim 34, wherein the monitoring device determines that the first message has been corrupted based on the TTL field being changed to 0 before it reached the destination node or to a value greater than a threshold indicative of a corrupted TTL field. ### Claim 36 (depends on 35) The apparatus of claim 35, wherein the at least one processor is further configured to: identify the at least one relay node as the security threat in the wireless mesh network based on a determination that the at least one relay node changed the TTL field to 0 before it reached the destination node or to the value greater than the threshold indicative of a corrupted TTL field. ### Claim 37 (depends on 22) The apparatus of claim 22, wherein the at least one processor being configured to determine comprises the at least one processor being configured to: upload the information from the first message to a remote server, wherein the remote server performs the analysis of the information from the first message; and receive a notification from the remote server that the first message has been corrupted. ### Claim 38 (depends on 22) The apparatus of claim 22, wherein the monitoring device is a provisioner node in the wireless mesh network. ### Claim 39 (depends on 22) The apparatus of claim 22, wherein the monitoring device is not a provisioner node or controller node in the wireless mesh network. ### Claim 40 (depends on 22) The apparatus of claim 22, wherein the monitoring device is a stationary mains-powered device in the wireless mesh network. ### Claim 41 (depends on 22) The apparatus of claim 22, wherein the monitoring device is a battery-powered mobile device in the wireless mesh network. ### Claim 42 (depends on 22) The apparatus of claim 22, wherein the wireless mesh network comprises a Bluetooth® mesh network. ### Claim 43 A non-transitory computer-readable medium storing computer executable instructions when executed by a hardware processor for detecting a security threat in a wireless mesh network, the computer-executable instructions comprising: at least one instruction instructing a monitoring device in the wireless mesh network to detect a first message transmitted by a source node in the wireless mesh network to a destination node in the wireless mesh network via at least one relay node in the wireless mesh network and the monitoring device is separate from the destination node, wherein the monitoring device sniffs messages as they are being transmitted between the source node and destination mode in the wireless mesh network; at least one instruction instructing the monitoring device to collect information from the first message as it is transmitted in the wireless mesh network by directly collecting the information while listening to the first message as it is transmitted from the source node to the destination node over the wireless mesh network; at least one instruction instructing the monitoring device to determine that the first message has been corrupted based on analysis of the information from the first message; and at least one instruction instructing the monitoring device to detect the security threat in the wireless mesh network based on the first message being corrupted. ### Claim 44 An apparatus for detecting a security threat in a wireless mesh network, comprising: means for processing of a monitoring device in the wireless mesh network configured to: detect a first message transmitted by a source node in the wireless mesh network to a destination node in the wireless mesh network via at least one relay node in the wireless mesh network and the monitoring device is separate from the destination device, wherein the monitoring device sniffs messages as they are being transmitted between the source node and destination mode in the wireless mesh network; collect information from the first message as it is transmitted in the wireless mesh network by directly collecting the information while listening to the first message as it is transmitted from the source device to the destination device over the wireless mesh network; determine that the first message has been corrupted based on analysis of the information from the first message; and detect the security threat in the wireless mesh network based on the first message being corrupted.