Back to results
US 11,706,625 B2Granted
Malicious black hole node detection and circumvention
AssigneeCisco Technology, Inc.
InventorsLele Zhang, Yajun Xia, Chuanwei Li, Li Zhao
Life of this patent
Estimating the term…
Abstract
A method includes identifying a potentially malicious node using a rating assigned to nodes within the network and decrementing the rating based on detected dropped messages to identify a potentially malicious node. The malicious node is identified based on location information obtained from the nodes within the network and comparable distances from the potentially malicious node. The method further includes ending communications with the malicious node and selecting a new parent node based on a presumption that any of the plurality of nodes other than the malicious node are non-malicious.
Claims18
A device comprising:
- one or more processors;
- and
- one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- assigning a first rating to a plurality of nodes within a mesh network;
- determining a number of drops of a plurality of messages sent to a first node of the plurality of nodes;
- determining that the number of drops of the plurality of messages exceeds a threshold number of drops for a time period;
- based at least in part on the number of drops of the plurality of messages exceeding the threshold number of drops for the time period, decrementing the first rating assigned to the first node to a second rating assigned to the first node;
- determining that the second rating assigned to the first node is below a rating threshold;
- based at least in part on the second rating being below the rating threshold, determining that the first node is a potentially malicious node;
- receiving first location information indicating a first location of the first node;
- receiving second location information indicating a second location of a second node;
- determining a distance threshold based at least in part on a second distance determined using the second location information;
- determining, using the first location information, that a first distance to the first node is greater than or equal to the distance threshold;
- and
- based at least in part on the first distance to the first node being larger than the distance threshold, identifying that the first node is a malicious node.
12 more elements
A method comprising:
- determining a number of drops of a plurality of messages sent to a first node within a mesh network of a plurality of nodes;
- based at least in part on a determination that a number of the plurality of messages have been dropped within a time period, decrementing a first rating assigned to the first node to a second rating;
- determining that the second rating assigned to the first node is below a rating threshold;
- based at least in part on the second rating being below the rating threshold, determining that the first node is a potentially malicious node,
- receiving first location information indicating a first location of the first node;
- receiving second location information indicating a second location of a second node;
- determining a distance threshold based at least in part on a second distance determined using the second location information;
- determining, using the first location information, that a first distance to the first node is greater than or equal to the distance threshold;
- and
- based at least in part on the first distance to the first node being larger than the distance threshold, identifying that the first node is a malicious node.
7 more elements
A non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform operations, comprising:
- determining a number of drops of a plurality of messages sent to a first node of a plurality of nodes;
- determining that the number of drops of the plurality of messages exceeds a threshold number of drops for a time period;
- based at least in part on the number of drops of the plurality of messages exceeding the threshold number of drops for the time period, decrementing a first rating assigned to the first node to a second rating assigned to the first node;
- determining that the second rating assigned to the first node is below a rating threshold;
- and
- based at least in part on the second rating being below the rating threshold, determining that the first node is a potentially malicious node;
- sending a first request to the first node for first location information of the first node;
- sending a second request to at least a second node for second location information of at least the second node;
- receiving the first location information of the first node from the first node;
- receiving the second location information of at least the second node from at least the second node;
- determining a first distance to the first node and a distance threshold defined by a second distance to at least the second node;
- and
- based at least in part on a determination that the first distance to the first node is larger than the distance threshold, identifying that the first node is a malicious node.
10 more elements
Dependencies are inferred from the claim text.