# US 8,543,809 B2 · Method for misbehaviour detection in secure wireless mesh networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,809 B2 - Document ID: US8543809B2 - Status: Granted - Kind: B2 - Application number: 12/676,039 - Filed: 2008-09-03 - Published: 2010-07-15 - Granted: 2013-09-24 - Earliest claimed: 2007-09-06 - Assignees: Siemens Aktiengesellschaft - Applicants: Kalman Graffi; Matthias Hollick; Parag Sudhir Mogre; Andreas Ziller - Inventors: Kalman Graffi; Matthias Hollick; Parag Sudhir Mogre; Andreas Ziller - Web page: https://patentgrep.com/patent/US8543809B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1458: {Denial of Service} - H04W 12/106: Packet or message integrity - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 2463/143: Denial of service attacks involving systematic or selective dropping of packets - H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In a method for secure data transmission in a wireless mesh network, a sending node sends at least one packet to at least one forwarding node which receives the packet from the sending node and forwards the packet to one or more receiving nodes. A destination node receives the packet. A challenge is transmitted from the sending node to the forwarding node causing the forwarding node to reply both to the sending and the receiving node with a response which has transformed information about one or more of the packet/packets. The response is processed to find out whether the forwarding node is misbehaving or not by verifying whether the transformed information is equal to an information which can be or has been derived from the requested packet/packets, wherein the processing is carried out both by the sending node and the receiving node. ## Claims ### Claim 1 A method for secure data transmission in a wireless mesh network a sending node sends at least one packet to at least one forwarding node, the at least one forwarding node receives the at least one packet from the sending node and forwarding the at least one packet to one or more receiving nodes, and a destination node receives the at least one packet from the at least one receiving node, the method comprising the steps of: a transmitter of the sending node, being a challenging node, transmitting a challenge to a forwarding node, the forwarding node, being a challenged node executing computer-readable instructions stored in non-transitory media to: generate a response for each of the sending node and the at least one receiving node, wherein both the response for the sending node and the response for the at least one receiving node include transformed information about one or more of the at least one packet which have been sent form the sending node to the destination node via the at least one forwarding node and the at least one receiving node, and transmit the respective responses to the sending node and the at least one receiving node, and at each of the sending node and the at least one receiving node, executing computer-readable instructions stored in non-transitory media to process the respective response to find out whether the forwarding node is misbehaving or not by verifying whether the same transformed information in the respective response is equal to an information which can be or has been derived from the requested packet/packets, wherein the processing is carried out both by the sending node and the at least one receiving node, wherein the transformed information is a hash sum for the requested packet/packets in the challenge, the hash sum being generated by a logic operation from hash values of respective packets. ### Claim 2 (depends on 1) The method according to claim 1, wherein at least one of the hash sum and the hash values is/are calculated by a one-way hash function. ### Claim 3 (depends on 1) The method according to claim 1, wherein in the challenge, the transformed information about the last x packets is requested which packets have been sent from the sending node to the destination node via forwarding node and the at least one receiving node. ### Claim 4 (depends on 1) The method according to claim 1, wherein the response further comprises an identifier of the challenging node being a previous hop of the challenged node receiving the challenge. ### Claim 5 (depends on 1) The method according to claim 1, wherein the response further comprises an identifier of the next hop of the challenged node receiving the challenge of the requested and transmitted packets. ### Claim 6 (depends on 1) The method according to claim 1, wherein the response further comprises the number of requested packets transmitted from the challenging node to the challenged node. ### Claim 7 (depends on 1) The method according to claim 1, wherein the response to the challenging node and the receiving node will be without encryption. ### Claim 8 (depends on 1) The method according to claim 1, wherein the response to the challenging node and the receiving node will be with encryption. ### Claim 9 (depends on 1) The method according to claim 1, wherein the response is transmitted as a broadcast message. ### Claim 10 (depends on 1) The method according to claim 1, wherein the response will be processed by nodes which are addressed in the response. ### Claim 11 (depends on 1) The method according to claim 1, wherein each of the sending nodes, the forwarding node, the at least one receiving node and the destination node maintains a first list for information about packets received from a neighbour node and a second list for storing information about packets sent to a neighbour node. ### Claim 12 (depends on 11) The method according to claim 11, wherein for each received packets stored in the first list one or more parameters from the group consisting of the following parameters is stored: the hash value, the identifier of the previous neighbour node which transmitted the packet, the identifier of the node which transmitted the packet prior to the previous neighbour node, and an information about the next hop for the packet. ### Claim 13 (depends on 11) The method according to claim 11, wherein for each transmitted packet stored in the second list one or more parameter from the group consisting of the following parameters is stored: the hash value, the identifier of the next neighbour node to which the packet is forwarded, and the identifier of the previous neighbour node which transmitted the packet. ### Claim 14 (depends on 11) The method according to claim 11, wherein the first and the second list in one of the nodes are updated on receiving or transmitting a packet. ### Claim 15 (depends on 11) The method according to claim 11, wherein the challenge is transmitted periodically. ### Claim 16 (depends on 1) A computer program product stored in tangible, non-transitory computer-readable media of a digital computer, comprising software code portions for performing the steps of claim 1 when said product is executed by a processor. ### Claim 17 A node in a wireless mesh network comprising a sending node sending at least one packet to at least one forwarding node, the at least one forwarding node receiving the at least one packet from the sending node and forwarding the at least one packet to one or more receiving nodes, and a destination node receiving the at least one packet from the at least one receiving node, wherein the node, being a challenging node, comprises: a transmitter for transmitting a challenge to the at least one forwarding node causing the at least one forwarding node, being a challenged node, to reply both to the challenging node and the at least one receiving node with a response, wherein both the response for the sending node and the response for the at least one receiving node include the same transformed information about one or more of the at least one packet/packets which has/have been sent form the challenging node to the destination node via the at least one forwarding node and the at least one receiving node, and a processor for processing the response to determine whether the at least one forwarding node is misbehaving or not by verifying whether the transformed information received in the response from the at least one forwarding node is equal to an information which can be or has been derived from the requested packet/packets, wherein the same transformed information is similarly used by the at least one receiving node to determine whether the at least one forwarding node is misbehaving or not, wherein the transformed information is a hash sum for the requested packet/packets in the challenge, and wherein the node comprises further means for generating the hash sum by a logic operation from hash values of respective packets. ### Claim 18 A node in a wireless mesh network comprising a sending node sending at least one packet to at least one forwarding node, the at least one forwarding node receiving the at least one packet from the sending node and forwarding the at least one packet to one or more receiving nodes, and a destination node receiving the at least one packet from the at least one receiving node, wherein the node, being a challenged node, comprises a computer program stored in non-transitory media and executable to: receive a challenge from the sending node, being a challenging node, and in response to receiving the challenge: generate a response for each of the sending node and the at least one receiving node, wherein both the response for the sending node and the response for the at least one receiving node include transformed information about one or more of the at least one packet which have been sent form the sending node to the destination node via the at least one forwarding node and the at least one receiving node, and transmit the respective responses to the sending node and the at least one receiving node, such that both the sending node and the at least one receiving node are able to determine whether the node is misbehaving or not based at least on the same transformed information received from the node, wherein the transformed information is a hash sum for the requested packet/packets in the challenge, and wherein the node comprises further means for generating the hash sum by a logic operation from hash values of respective packets. ### Claim 19 (depends on 1) The method according to claim 1, wherein the transformed information is a hash sum for immutable parts of the requested packet/packets in the challenge. ### Claim 20 (depends on 1) The method according to claim 1, wherein the sending node, being the challenging node, transmits a challenge to multiple forwarding nodes, such that each forwarding node, being a challenged node, generates and transmits responses for each of the sending node and the at least one receiving node. ### Claim 21 (depends on 1) The method according to claim 1, wherein the non-transitory media comprises at least one of: internal memory of a digital computer, a CD-ROM, and a diskette.