US 12,244,576 B2Granted

Methods to strengthen cyber-security and privacy in a deterministic internet of things

OwnerTed H. Szymanskiinventor

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods to strengthen the cyber-security and privacy in a proposed deterministic Internet of Things (IoT) network are described. The proposed deterministic IoT consists of a network of simple deterministic packet switches under the control of a low-complexity ‘Software Defined Networking’ (SDN) control-plane. The network can transport ‘Deterministic Traffic Flows’ (DTFs), where each DTF has a source node, a destination node, a fixed path through the network, and a deterministic or guaranteed rate of transmission. The SDN control-plane can configure millions of distinct interference-free ‘Deterministic Virtual Networks’ (DVNs) into the IoT, where each DVN is a collection of interference-free DTFs. The SDN control-plane can configure each deterministic packet switch to store several deterministic periodic schedules, defined for a scheduling-frame which comprises F time-slots. The schedules of a network determine which DTFs are authorized to transmit data over each fiber-optic link of the network. These schedules also ensure that each DTF will receive a deterministic rate of transmission through every switch it traverses, with full immunity to congestion, interference and Denial-of-Service (DOS) attacks. Any unauthorized transmissions by a cyber-attacker can also be detected quickly, since the schedules also identify unauthorized transmissions. Each source node and destination node of a DTF, and optionally each switch in the network, can have a low-complexity private-key encryption/decryption unit. The SDN control-plane can configure the source and destination nodes of a DTF, and optionally the switches in the network, to encrypt and decrypt the packets of a DTF using these low-complexity encryption/decryption units. To strengthen security and privacy and to lower the energy use, the private keys can be very large, for example several thousands of bits. The SDN control-plane can configure each DTF to achieve a desired level of security well beyond what is possible with existing schemes such as AES, by using very long keys. The encryption/decryption units also use a new serial permutation unit the very low hardware cost, which allows for exceptional security and very-high throughputs in FPGA hardware.

Claims33

Dependent claims

A method for a network control-plane to control a plurality of “deterministic packet switches” (D-switches) to deliver “deterministic traffic flows” (D-flows) through a packet-switched network, wherein each D-flow is associated with a deterministic data-rate requirement given a periodic (repeating) scheduling-frame that includes F time-slots for a positive integer F, wherein each one of said plurality of D-switches includes:

N input ports, each including a data receiver for integer N,
M output ports, each including a data transmitter for integer M,
N×M queues, wherein queue (J,K) buffers data that arrives at input port (J) and that departs from output port (K), for integers J and K wherein 1<=J<=N and 1<=K<=M,
a first memory for storing a secret key,
a decryption unit, for decrypting encrypted data,
a second memory for storing a plurality of schedules,
a switch-controller operable to receive encrypted data from said network control-plane performing said method, and to decrypt said data using said decryption unit and said secret key, to yield a decrypted message from said network control-plane,
for one (or more) of said plurality of D-switches, said method comprising:
determining which of said D-flows (if any) will arrive at each one of said N input ports of said D-switch, and which of said D-flows (if any) will depart from each one of said M output ports of said D-switch,
determining a deterministic data-rate requirement for each input port (J), sufficient to satisfy the sum of the deterministic data-rate requirements of those D-flows which arrive at said input port (J),
determining a deterministic data-rate requirement for each queue (J,K), sufficient to satisfy the sum of the deterministic data-rate requirements of those D-flows which arrive at input port (J) and depart from output port (K);
determining a “periodic queue-schedule” (Q-schedule) associated with each queue (J,K), and also associated with input port (J), which identifies the time-slots within said periodic scheduling-frame with reservations to remove data from said queue (J,K) and forward said data to output port (K),
wherein the Q-schedules associated with input port (J) provide said input port (J) with a guaranteed number of reservations to forward data within said periodic scheduling-frame, sufficient to meet its deterministic data-rate requirement,
wherein said Q-schedule associated with queue (J,K) provides said queue (J,K) with a guaranteed number of reservations to forward data within said periodic scheduling-frame, sufficient to meet its deterministic data-rate requirement,
sending encrypted data to said D-switch, with a message instructing said switch-controller of said D-switch to store one (or more) of said Q-schedules in said second memory.

12 more elements

A “deterministic packet switch” (D-switch) for switching a plurality of “deterministic traffic flows” (D-flows) over a set of output ports, under the control of a network control-plane, wherein each D-flow is associated with a deterministic data-rate requirement given a periodic (repeating) scheduling-frame including F time-slots for positive integer F, said D-switch comprising:

N input ports, each including a data-receiver for integer N,
M output ports, each including a data-transmitter for integer M,
N×M queues, wherein queue (J,K) buffers data that arrives at input port (J) and that departs from output port (K), for integers J and K wherein 1<=J<=N and 1<=K<=M,
a first memory for storing a secret key,
a second memory for storing a plurality of schedules,
a decryption unit, to decrypt encrypted data,
wherein said switch-controller can decrypt encrypted data received from said network control-plane, using said decryption unit and said secret key in said first memory, to yield a decrypted message received from said network control-plane,
wherein each input port (J) is associated with a deterministic data-rate requirement, sufficient to satisfy the sum of the deterministic data-rate requirements of those D-flows which arrive at said input port (J),
wherein each queue (J,K) is associated with a deterministic data-rate requirement, sufficient to satisfy the sum of the deterministic data-rate requirements of those D-flows which arrive at input port (J) and depart from output port (K),
wherein said second memory stores a plurality of “periodic queue-schedules” (Q-schedules), wherein one Q-schedule is associated with each queue (J,K) and is also associated with input port (J),
wherein the Q-schedule associated with queue (J, K) identifies the time-slots with reservations to remove data from said queue (J,K) and forward said data to said output port (K), within said periodic scheduling-frame,
wherein the Q-schedules associated with input port (J) provide said input port (J) with a guaranteed number of reservations to forward data in said periodic scheduling-frame, sufficient to satisfy its deterministic data-rate requirement,
wherein said Q-schedule associated with queue (J,K) provides said queue (J,K) with a guaranteed number of reservations to forward data in said periodic scheduling-frame, sufficient to satisfy its deterministic data-rate requirement,
wherein said decrypted message from said network control-plane instructs said switch-controller to store one (or more) of said Q-schedules stored in said second memory.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/241,650Filed 1 Sep 2023 · continuation
Priority: 3 Feb 2016
Published: US 2024/0244038 A118 Jul 2024
Granted: 4 Mar 2025
Term ends: Not estimatedThe source records don’t support an estimate.

Classification14 codes

H04L 63/0428
For providing a confidential data exchange among entities communicating through data packet networks: wherein the data content is protected, e.g.…
H04L 9/0894
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: escrow, recovery or storing of secret…
H04L 9/14
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: using a plurality of keys…
H04L 47/2483
Traffic characterised by specific attributes, e.g. priority or QoS: involving identification of individual flows

Family

Application62/290,712Us provisional application · filed 3 Feb 2016
PCT/CA2017/050129Parent of this continuation · filed 3 Feb 2017
Application17/234,627Parent of this continuation · filed 19 Apr 2021
US 11,019,038 B2Parent of this continuation · filed 25 May 2021
US 2024/0244038 A1Pre-grant publication · published 18 Jul 2024
US 11,784,984 B2Parent of this continuation
Application16/075,402Parent of this continuation
US 2019/0044920 A1Published application
US 2021/0243172 A1Published application
US 12,244,576 B2This patent

From the US filing history. Foreign family members aren’t listed.