Back to results
US 11,962,685 B2Granted
High availability secure network including dual mode authentication
AssigneeRaytheon Company
InventorMichelle D. Coyle
Life of this patent
Estimating the term…
Abstract
A large-scale Ethernet mesh network including a plurality of dual-mode peer devices in signal communication with one another so as to establish a group connectivity association (CA). Each dual-mode peer device simultaneously operates in a supplicant mode and authenticator mode. Each of dual-mode peer device encrypts data using a shared group encryption key (SAK), and exchanges the encrypted data with peer devices in the group CA.
Claims18
A large-scale Ethernet mesh network comprising:
- a plurality of dual-mode peer devices, each of the dual-mode peer devices implementing an authenticator port access state machine (PACP SM) and a supplicant PACP SM each configured to operate in accordance with a modified Institute of Electrical and Electronics Engineers (IEEE) 802.1X standard for port-based network access control, the plurality of dual-mode peer devices in signal communication with one another so as to establish a group connectivity association (CA), the authenticator PACP SM and the supplicant PACP SM configured to simultaneously operate in a supplicant mode and authenticator mode, respectively, to ensure continued presence of at least one of the dual-mode peer devices operating as an authenticator in the group CA,
- wherein each of dual-mode peer device is configured to encrypt data using a shared group encryption key (SAK), and to exchange the encrypted data with peer devices in the group CA, and
- wherein the plurality of dual-mode peer devices are configured to continue operation of the group CA in response to one or more of the dual-mode peer devices leave the group CA,
- wherein the remaining dual-mode peer devices continue simultaneously operating in the supplicant mode and the authenticator mode after the one or more of the dual-mode peer devices leave the group CA, and wherein at least one of the remaining dual-mode peer devices is selected as a newly elected key server in response to a key server change event, and the newly elected key server delivers a new group of Connectivity Association Keys (CAKs) to ensure the integrity of the group CAKs lifetime.
1 more element
A method of exchanging data in a large-scale Ethernet mesh network, the method comprising:
- establishing signal communication between a plurality of dual-mode peer devices, each of the dual-mode peer devices implementing an authenticator port access state machine (PACP SM) and a supplicant PACP SM each operating in accordance with a modified Institute of Electrical and Electronics Engineers (IEEE) 802.1X standard for port-based network access control;
- mutually authenticating a plurality of dual-mode peer devices to form a group connectivity association (CA);
- simultaneously operating the authenticator PACP SM an authenticator mode and the supplicant PACP SM in a supplicant mode to ensure continued presence of at least one of the dual-mode peer devices operating as an authenticator in the group CA;
- exchanging encrypted data between sending dual-mode peer devices and receiving dual-mode peer devices in the group CA, using a shared group encryption key (SAK),
- wherein the plurality of dual-mode peer devices are configured to continue operation of the group CA in response to one or more of the dual-mode peer devices leave the group CA, and
- wherein the continued operation includes:
- selecting at least one of the dual-mode peer devices participating in the group CA as a newly elected dual-mode peer device in response to a key server change event, wherein the remaining dual-mode peer devices continue simultaneously operating in the supplicant mode and the authenticator mode after the one or more of the dual-mode peer devices leave the group CA;
- and
- delivering a new group of Connectivity Association Keys (CAKs) by the newly elected key server to ensure the integrity of the group CAKs lifetime.
6 more elements
Dependencies are inferred from the claim text.