Method for ensuring security and privacy in a wireless cognitive network

A method for ensuring security and privacy of communications over a wireless network of cognitive radios (“CRN”), the CRN including a managing base station in communication with at least one candidate node, the method comprising:

• the managing base station receiving from the candidate node a request to join the CRN;
• the managing base station transmitting to the candidate node a temporary node identifier;
• the managing base station establishing encrypted communication with the candidate node using the temporary node identifier;
• the managing base station authorizing the candidate node to join the CRN;
• the managing base station conveying to the candidate node by encrypted transmission a permanent node identifier in replacement of the temporary node identifier;
• and
• the candidate node joining the CRN using the permanent node identifier,
• wherein establishing encrypted communication and authorizing the candidate node to join the CRN includes:
• receiving a registration request from the candidate node, the registration request including a subscriber digital certificate and a subscriber public key;
• determining an authenticity of the subscriber digital certificate;
• if the subscriber digital certificate is authentic, applying authorization criteria to the candidate node;
• if the authorization criteria are met, authorizing participation of the candidate node in the CRN;
• using the subscriber public key, encrypting an authorization key and transmitting the encrypted authorization key to the candidate node, the candidate node being able to derive therefrom a key-encryption-key (“KEK”), and a “management-message-protection-key (“MMP”), an MMP expiration criterion being associated with the MMP so as to cause the MMP to expire when the MMP expiration criterion is met;
• generating a transmission-encryption-key (“TEK”), encrypting the TEK using the KEK, and transmitting the encrypted TEK to the candidate node, a TEK expiration criterion being associated with the TEK so as to cause the TEK to expire when the TEK expiration criterion is met;
• using the TEK, encrypting all data communication with the candidate node over the CRN;
• using the MMP, encrypting all management and control communication with the candidate node over the CRN;
• using the KEK, encrypting a replacement TEK and transmitting the encrypted replacement TEK to the candidate node before the TEK expiration criterion is met;
• using the KEK, encrypting a replacement MMP and transmitting the encrypted replacement MMP to the candidate node before the MMP expiration criterion is met;
• and
• so long as the candidate node continues to participate in the CRN, repeating the encrypting of a replacement TEK and of a replacement MMP, and the transmitting the encrypted replacement TEK and the encrypted replacement MMP to the candidate node before the TEK and MMP expiration criteria are met.