Extensible Authentication Protocol for Layer 3 Mesh Networks - Patent Application – PRIOR ART REQUEST

Question

This Patent Application has received a non-final rejection by the US Patent Office! An initial rejection is part of the typical course of a patent application. The applicant (or his attorney) was compelled to submit the prior art below to the US Patent Office after discovering it on Ask Patents.

---

Thanks to YOU, the Ask Patents community, overly-broad claims have at least been narrowed. Follow @askpatents to block more overly-broad patent applications. 10 minutes of your time can help narrow US patent applications before they become patents.

HELP SAVE MESH NETWORKING —This application from Cisco seeks to patent a technique for authenticating devices seeking to join a mesh network.

QUESTION: Have you seen anything that was published before July 6, 2011 that discusses:

1. A device sending an authentication packet to an authenticated device in the mesh network (through one or more hops);

2. The authenticated device encapsulating the authentication packet in Layer 3 packets for transmission over an Internet Protocol (IP) tunnel to an authenticator device; OR

3. The authenticated device receiving an authentication packet that is encapsulated in Layer 3 packets from the authenticator, decapsulating the authentication packet, and transmitting it over the mesh network to the device seeking authentication.

If so, please submit evidence of prior art as an answer to this question. Please submit only one piece of prior art per answer below. We welcome multiple answers from the same individual.

EXTRA CREDIT --- A reference to anything that meets all of the criteria above AND ALSO where the authentication message is sent as a Layer 2 message.

A reference to anything that meets all of the criteria above AND ALSO uses the IEEE 802.1X standard.

A reference to anything that meets all of the criteria above AND ALSO where the packets are transmitted wirelessly.

A reference to anything that meets all of the criteria above AND ALSO encapsulates the packet in Universal Datagram Protocol (UDP) Packets OR Transmission Control Protocol (TCP) Packets.

A reference to anything that meets all of the criteria above AND ALSO where the authenticator device forwards a group mesh key to the device seeking authentication.

TITLE: ADAPTING EXTENSIBLE AUTHENTICATION PROTOCOL FOR LAYER 3 MESH NETWORKS

Summary: [Translated from Legalish into English] A method and apparatus for authenticating devices in a mesh network by routing authentication packets through the mesh network, over an IP tunnel, and to an authenticator device.

• Publication Number: US 20130014217 A1

• Assignee: Cisco

• Prior Art Date: July 6, 2011

• Open for Challenge at USPTO: open at least through July 10, 2013

Claim 1 requires each and every step below:

A method comprising:

1. At an authenticated device in a network, receiving an authentication packet sent over the network from a device that is seeking authentication; and

2. Encapsulating the authentication packet for transmission in Layer 3 packets over an Internet Protocol (IP) tunnel to an authenticator device associated in the network.

In plain English this could mean:

1. A mesh node that wants access to the network sends an authentication message (this message can be sent, for example, as a Layer 2 or Layer 3 message) over the network to an already authenticated mesh node; and

2. The receiving mesh node encapsulates the message in Layer 3 packets and sends it to an authenticator over an Internet Protocol (IP) network connection.

Claim 10 requires each and every step below:

1. An authenticated device in a network, receiving an authentication packet that is encapsulated in Layer 3 packets from an authenticator device over an Internet Protocol (IP) tunnel; and

2. Decapsulating the authentication packet from the Layer 3 packets and transmitting the authentication packet over the network to a device seeking authentication.

In plain English this could mean:

1. The authenticator sends an authentication message in Layer 3 packets over an IP network connection to an already authenticated mesh node; and

2. The authenticated mesh node decapsulates the authentication message from the Layer 3 packets and sends the message back over the network to the node that requested access.

Claim 13 requires each and every element below:

An apparatus comprising:

1. A transceiver unit configured to transmit and receive signals over a network; and

2. A processor coupled to the transceiver unit, the processor configured to, for an authentication packet received from a device that is seeking authentication in the network, encapsulate the authentication packet for transmission in Layer 3 packets over an Internet protocol (IP) tunnel to an authenticator device associated in the network.

In plain English this could mean:

1. A wireless device that can receive an authentication message from another device and encapsulate that message into Layer 3 packets to be sent to an authenticator over an IP network connection.

Claim 20 requires each and every element below:

One or more computer readable storage media encoded with software comprising computer executable instructions and when software is executed operable to:

1. For an authentication packet received from a device that is seeking authentication in a network, encapsulate the authentication packet for transmission in layer 3 packets over an Internet Protocol (IP) tunnel to an authenticator device associated in the network.

In plain English this could mean:

1. Any memory device that stores software instructions for a controller to encapsulate messages in Layer 3 packets to be sent to an authenticator over an IP network connection.

Claim 24 requires each and every element below:

The computer readable storage media of claim 20, and further comprising instructions that are operable to:

1. For an authentication packet encapsulated in Layer 3 packets received from the authenticator device over the IP tunnel, decapsulate the authentication packet from the Layer 3 packets and to control a transceiver unit to transmit the authentication packet to the device seeking authentication.

In plain English this could mean:

1. Any memory device that stores software instructions for a controller to decapsulate authentication messages from the Layer 3 packets and transmit them to the node seeking access to the network.

Separately, the applicant is claiming a method where the authenticator transmits a group mesh key to the device seeking access, where the key is known only to authenticated devices, and where all packets not encrypted with the mesh key and not part of the authentication negotiation are dropped by nodes in the network.

What is good prior art? Please see our FAQ

Want to help? Please vote or comment on submissions below. We welcome you to post prior art you know about on other questionable US patent applications.

Answer 1

At least from early 2011 the Serval Project anticipated a full overlay mesh network, which we have since implemented (github.com/servalproject/serval-dna).

There is a brief snippet pre-July 2011 where I mention the overlay mesh network:

https://groups.google.com/forum/#!topic/serval-project-developers/Fu9eXx2A9Q4

Some further discussion can be found in the following, which I began writing prior to July 2011, but the copy below is a version from after the prior-art date. Search for "overlay" for overlay over UDP and over wireless networks:

http://developer.servalproject.org/files/CWN_Chapter_Serval.pdf

If the content is useful, poke me and I will dig deeper to try to find earlier drafts. Update: I have found a draft that I emailed to someone on 12Jun2011. It is incomplete, but does mention the overlay mesh. Let me know if you want the email, and we can seek permission from the other party to the conversation.

As you will also note in the document, the mesh design outlined uses public keys as network identifiers ("SID"s), and so almost every packet is effectively an authentication/authenticated packet. By targetting mobile phones it is obvious that the application is wireless.

Paul.

Answer 2

I think anybody who would combine IEEE 802.1X authentication with BATMAN routing protocol would be close to this. :-) BATMAN encapsulates all packages into L3 packages to create an illusion of a L2 network. So anything you send over the BATMAN is in some way encapsulate. So if you send normal RADIUS/IEEE 802.1X packet over the mesh protocol, this would be it.

Answer 3

I can provide an email conversation from may 2011 that includes the following further evidence that we were planning to do overlay mesh networking prior to July 2011:

---

Hello,

Currently we use BATMAN because it was easy for us to do so, and gets us off the ground. However, we have plans to move to something more custom as a user-land mesh overlay so that it doesn't matter what the underlying system is using. It also allows us to solve the problem of limited IPv4 space and the use and reuse of private IP address ranges.

...

Answer 4

The PASER protocol, the first version of which has been sumbitted for publication in April 2011 and has been published in August 2011 - see http://www.paser.info/publications.html (Publication number 9), meets all three points listed above and the authenticator device forwards a group mesh key to the device seeking authentication.

Kind regards Mohamad

Answer 5

Since the PASER authentication messages contain IP addresses and information from higher ISO/OSI layers (see https://datatracker.ietf.org/doc/html/draft-sbeiti-karp-paser-00), it should be traceable that these messages will be encapsulated in IP messages (see for example the implementation details here´http://www.omnet-workshop.org/2013/uploads/slides/OMNeT-Workshop2013-SP-6.pdf). I hope that this argumentation can help. Best regards Mohamad

Answer 6

ZigBee is a wireless mesh specification that has been around awhile. Please take a look at the ZigBee Security presentations. Here is one from 2005: https://docs.zigbee.org/zigbee-docs/dcn/05/docs-05-3411-00-00mg-3559-053411r000zb-members-zigbee-security-layer-technical-overview-pdf.pdf

That presentation touches on the authentication of devices in the mesh network using the Trust Center. It also discusses encryption at different network layers for packet transmission, and how to handle the case where the Trust Center has to send a packet through a different mesh router to reach the end device.

Answer 7

It seems one of the authors (Jonathan Hui) submitted the idea underlying the patent to a IEEE working group prior to filing:

Email from May 5, 2011 - links to a "presentation in the WNG session for a call for 802.1X support"

The presentation is by Jonathan Hui and Wei Hong of Cisco System, uploaded to mentor.ieee.org, dated May 5, 2011. Title: "Problem statement and Call to action for supporting 802.1x over 802.15.4", submitted to IEEE P802.15 Working Group for Wireless Personal Area Networks (WPANs)

Slide 8 of the presentation pretty much wraps up the patent. It is virtually identical to fig. 3 of the patent. There is the joining device (supplicant), EAPOLAN (EAPoL over 15.4), authenticated device (enforcement point), IP Tunnel (EAPoL Tunnel over IP), Field Area Router (Authenticator), and Authentication Server