Authentication service and certificate exchange protocol in wireless ad hoc networks

A method for protecting the transmission of data in an ad hoc network, said network comprising a plurality of nodes, with the data being transmitted according to a routing protocol from a first node to a second node, each node comprising a private key, a public key, a certificate of the public key signed by a certification authority, a temporary private key and a temporary public key, wherein the temporary keys comprise a predefined life span, with a new pair being generated at the end of the life span of the preceding pair, the method comprising transmitting by the first node to the second node:

• at least one first message signed with the temporary private key of the first node;
• at least one third message when a second message coming from the second node is received by the first node following the transmission of the first message, the third message comprising a fourth set of initialisation data comprising:
• a second certificate comprising the temporary public key of the first node signed with the private key of the first node;
• a fifth data set comprising:
• an IP address of the first node;
• the second certificate associated with the IP address of the first node,
• wherein the fifth data set is signed with the temporary private key of the first node.

A method for protecting the transmission of data in an ad hoc network, said network comprising a plurality of nodes, with the data being transmitted according to a routing protocol from a first node to a second node, each node comprising a private key, a public key, a certificate of the public key signed by a certification authority, a temporary private key, and a temporary public key, wherein each of the temporary keys comprises a predefined life span, with a new pair being generated at the end of the life span of the preceeding pair, the method comprising transmitting by the first node to the second node:

• at least one first message signed with the private key of the first node;
• at least one third message when a second message coming from the second node is received by the first node following the transmission of the first message, the third message containing a first set of initialisation data comprising:
• a first certificate including the public key of the first node signed by the certification authority;
• a second data set comprising:
• an IP address of the first node;
• the first certificate associated with the IP address of the first node;
• wherein the second data set is signed with the private key of the first node;
• at least one fourth message signed with the temporary private key of the first node after transmitting the third message;
• at least one sixth message when a fifth message coming from the second node is received by the first node following the transmission of the fourth message, the sixth message comprising a fourth set of initialisation data comprising:
• a second certificate comprising the temporary public key of the first node signed with the private key of the first node;
• a fifth data set comprising:
• the IP address of the first node;
• the second certificate associated with the IP address of the first node,
• wherein the fifth data set is signed with the temporary private key of the first node.

A method for protecting the transmission of data in an ad hoc network, said network comprising a plurality of nodes, with the data being transmitted according to a routing protocol of a pth node to a qth node, with each node comprising a private key, a public key, a certificate of the public key signed by a certification authority, a temporary private key and a temporary public key, wherein the temporary keys comprise a predefined life span, with a new pair generated at the end of the life span of the preceding pair, the method comprising transmitting by the pth node to a qth node routing data coming from the first node, with said data transmitted comprising:

• at least one first message signed with the temporary private key of the first node;
• at least one third message when a second message coming from the second node is received by the first node following the transmission of the first message, the third message comprising:
• either a first set of initialisation data comprising:
• the first certificate comprising the public key of the first node signed by the certification authority;
• a second data set comprising:
• an IP address of the first node;
• the first certificate associated with the IP address of the first node;
• wherein the second data set is signed with the private key of the first node,
• or the first set of initialisation data further comprising:
• a second certificate comprising the temporary public key of the first node signed with the private key of the first node;
• a third data set further comprising:
• the IP address of the first node;
• the second certificate associated with the IP address of the first node;
• wherein the third data set is signed with the temporary private key of the first node,
• or a fourth set of initialisation data comprising:
• a second certificate comprising the temporary public key of the first node signed with the private key of the first node;
• a fifth data set comprising:
• the IP address of the first node;
• the second certificate associated with the IP address of the first node;
• wherein the fifth data set is signed with the temporary private key of the first node.

A method for controlling authentication data by a second node, with the authentication data making it possible to provide the protecting of useful data exchange transiting from a first node to a second node, with the data being transmitted according to a routing protocol from a first node to a second node, each node comprising a private key, a public key, and a certificate of the public key signed by a certification authority, the method comprising:

• transmitting by the first node to the second node:
• at least one first message signed with the private key of the first node;
• at least one third message when a second message coming from the second node is received by the first node following the transmission of the first message, the third message containing a first set of initialisation data comprising:
• a first certificate including the public key of the first node signed by the certification authority;
• a second data set comprising:
• an IP address of the first node;
• the first certificate associated with the IP address of the first node, wherein the second data set is signed with the private key of the first node;
• extracting the data received by the second node including:
• an identifier of a generator node extracted from a header of the signature of the first message sent by the first node and;
• the signature of the first message sent by the first node and;
• the first certificate extracted from the third message sent by the first node and;
• the second data set signed with the private key of the first node of the third message;
• generating a request for the security elements upon receiving the first message to the first node if the first node is unknown to the second node or if the first message is not authenticated by the second node;
• recording the data extracted in a memory of the second node;
• verifying the signature associated with the first certificate signed by the certification authority also known to the second node;
• verifying possession of the set of keys by the first node with IP address by verifying the signature of the second data set signed with the private key of the first node;
• comparing the IP addresses and the identifiers of the first node contained in respectively the first and third messages allowing for a verification of the authentication of the first node;
• and
• verifying the signature of the message using the public key signed by the certification authority.

A method for transmitting revoked certificates, wherein

• if said method is initiated by an owning node of a first certificate:
• the owning node of the first certificate transmits a message signed by its current private key to a nearest trusted node stipulating the revocation of its certificates;
• the owning node of the first certificate definitively deletes its security elements when it has received a sufficient number of acknowledgement messages of which it has controlled the authenticity;
• if said method is initiated by a certification authority:
• the certification authority instructs one or several nodes to transmit its list of revoked certificates by an intermediary of a message signed by the certification authority;
• if said method is serviced by the nodes of the network:
• a node periodically sends its list of revoked certificates by intermediary of a message signed with its temporary private key.

A method for managing a certificate revocation list managed by a node in protecting transmission of data in an ad hoc network, the data being transmitted according to a routing protocol from a first node to a second node, each node comprising a private key, a public key, a certificate of the public key signed by a certification authority, a temporary private key, and a temporary public key, wherein the temporary keys comprise a predefined life span, the method comprising:

• renewing first and second obsolete certificates by generator nodes;
• signing with the private key of the first node at least one first message;
• transmitting, by the first node to the second node, the signed first message;
• transmitting, by the first node to the second node, at least one third message when a second message coming from the second node is received by the first node following the transmission of the first message, the third message containing a first set of initialisation data comprising:
• the first certificate including the public key of the first node signed by the certification authority;
• a second data set comprising:
• an IP address of the first node;
• and
• the first certificate associated with the IP address of the first node,
• wherein the second data set is signed with the private key of the first node;
• a second certificate comprising the temporary public key of the first node signed with the private key of the first node;
• and
• a third data set comprising:
• the IP address of the first node;
• and
• the second certificate associated with the IP address of the first node,
• wherein the third data set is signed with the temporary private key of the first node;
• integrating, by the node, into its list the first and second certificates after the third message is transmitted from the first node to the second node;
• integrating, by the node, into its list first and second revoked certificates extracted from an authenticated message, coming from the node that has the ownership and signed with the temporary private key of this node, and transmits an acknowledgement signed with its temporary key to the generator node that owns the revoked certificates;
• integrating, by the node, into its list the revoked certificates extracted from a sufficient number of authenticated messages, coming from several nodes and signed with the temporary private key of these nodes;
• and
• integrating, by the node, into its list the revoked certificates extracted from an authenticated message, signed by the certification authority and transmitted by third-party nodes.

A first node of an ad hoc network comprising a plurality of nodes, the first node comprising:

• one or more processors;
• memory communicatively coupled to at least some of the processors and storing a first private key, a first public key, a first certificate of the first public key signed by a certification authority, and instructions that when executed by at least some of the processors cause operations comprising
• signing with the private key of the first node at least one first message;
• transmitting to a second node having a second private key, a second public key, and a second certificate of the second public key signed by the certification authority the signed first message according to a routing protocol;
• transmitting to the second node at least one third message according to the routing protocol when a second message coming from the second node is received by the first node following the transmission of the first message, the third message comprising a first set of initialisation data comprising:
• the first certificate including the first public key signed by the certification authority;
• a second data set comprising:
• an IP address of the first node;
• and
• the first certificate associated with the IP address of the first node,
• wherein the second data set is signed with the private key of the first node.

A receiving node of an ad hoc network comprising a plurality of nodes for controlling authentication data of an emitting node to make possible protecting useful data exchange transiting from the emitting node to the receiving node, the receiving node comprising:

• one or more processors;
• memory communicatively coupled to at least some of the processors and storing a first private key, a first public key, a first certificate of the first public key signed by a certification authority, and instructions that when executed by at least some of the processors cause operations comprising:
• receiving by the receiving node from the emitting node:
• at least one first message signed with a private key of the emitting node;
• at least one third message after a second message coming from the receiving node is received by the emitting node following the reception of the first message, the third message containing a first set of initialisation data comprising:
• a second certificate including a public key of the emitting node signed by the certification authority;
• a second data set comprising:
• an IP address of the emitting node;
• the second certificate associated with the IP address of the emitting node, wherein the second data set is signed with the private key of the emitting node;
• extracting the data received by the receiving node including:
• an identifier of a generator node extracted from a header of the signature of the first message sent by the emitting node and;
• the signature of the first message sent by the emitting node and;
• the second certificate extracted from the third message sent by the emitting node and;
• the second data set signed with the private key of the emitting node of the third message;
• generating a request for the security elements upon receiving the first message to the emitting node if the emitting node is unknown to the receiving node or if the first message is not authenticated by the receiving node;
• recording the data extracted in a memory of the receiving node;
• verifying the signature associated with the second certificate signed by the certification authority also known to the receiving node;
• verifying possession Of the set of keys by the emitting node with IP address by verifying the signature of the second data set signed with the private key of the emitting node;
• comparing the IP addresses and the identifiers of the emitting node contained in respectively the first and third messages allowing for a verification of the authentication of the emitting node;
• and
• verifying the signature of the message using the public key signed by the certification authority.