WO2019165235A1 - Secure encrypted network tunnels using osi layer 2 protocol - Google Patents

Abstract

Embodiments for establishing a secure link between network nodes implementing the seven-layer OSI model, by creating a set of encryption keys to be shared between the nodes; validating the keys using a two-way handshake; creating a virtual network device driver in each node to generate OSI Layer 2 media access controller (MAC) addresses to transmit data traffic through physical network interface controller (NIC) devices in each node; and encoding, using mutating encryption, data at Layer 2 using the virtual network device drivers and at least one encryption key to allow for transmission over a secure tunnel between the nodes using a defined protocol, such as user datagram protocol (UDP).

Description

SECURE ENCRYPTED NETWORK TUNNELS USING OSI LAYER 2 PROTOCOL

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims the benefit of U.S. Provisional Application No. 62/634,736, filed February 23, 2018, and U.S. Provisional Application No. 62/644,188, filed March 16, 2018.

TECHNICAL FIELD

[0002] Embodiments are generally directed to network connections, and more specifically to establishing secure encrypted network tunnels using OSI Layer 2 protocols.

COPYRIGHT NOTICE

[0003] A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever.

BACKGROUND

[0004] The OSI (Open Systems Interconnection) model defines a networking scheme to implement communication protocols in seven separate functional layers with control passed from one layer to the next in a logical progression. As is known, the layers from layer 1 to layer 7 are as follows: Physical - Data Link - Network - Transport - Session - Presentation - Application.

[0005] The OSI model was developed to allow different layers to work without knowledge of each other. This means that if one layer is hacked or corrupted, communications are compromised without the other layers being aware of the problem. A large number of common threats must be considered when securing a network, and a great deal of focus is spent on implementing security at higher levels, i.e., layer 3 and above, while overlooking the security of the LAN itself. In practical networks, layer 2 can be a very weak link, where security measures are often lacking, and where any exploitation can compromise the other layers without indication of such compromise.

[0006] FIG. 1 illustrates potential problems of network security from OSI layer 2 attacks, as currently known. As shown in diagram 100 of FIG. 1, Host A 102 and Host B 104 each implement the seven-layer OSI model with communications between the layers comprising their own respective data protocols and elements 103. If an attack occurs at the data link layer (Layer 2 or L2), the higher levels may well be compromised as well.

[0007] As stated above, the data link layer is often a particularly weak link in typical networks. Layer 2 can be subject to various different types of attacks, such as Spanning Tree Protocol (STP) protocol attacks, Address Resolution Protocol (ARP) attacks, Media Access Control (MAC) spoofing, Content Addressable Memory (CAM) overflows, virtual LAN hopping, DHCP spoofing, and others. Such attacks generally try to change the network by altering or re-routing traffic flows, inserting man-in-the-middle (MITM) components, degrading network performance, and so on.

[0008] What is needed, therefore, is an effective way to secure OSI network links at the data link layer to ensure that any attack does not compromise communications over the higher layers.

[0009] The subject matter discussed in the background section should not be assumed to be prior art merely as a result of its mention in the background section. Similarly, a problem mentioned in the background section or associated with the subject matter of the background section should not be assumed to have been previously recognized in the prior art. The subject matter in the background section merely represents different approaches, which in and of themselves may also be inventions.

BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In the following drawings like reference numerals designate like structural elements. Although the figures depict various examples, the one or more embodiments and

implementations described herein are not limited to the examples depicted in the figures.

[0011] FIG. 1 illustrates potential problems of network security from OSI Layer 2 attacks, as currently known.

[0012] FIG. 2 illustrates a large-scale network including wired and wireless links that implements an OSI Layer 2 security control process under some embodiments.

[0013] FIG. 3 illustrates a node interconnection system having a secure tunnel created using mutating encryption keys and virtual network device drivers, under some embodiments.

[0014] FIG. 4A is a flow diagram illustrating a method of creating a secure Layer 2 tunnel, under some embodiments.

[0015] FIG. 4B illustrates a table that lists three encryption keys used in the process of FIG. 4A, under an embodiment.

[0016] FIG. 5A illustrates the composition of changing segments within a data packet using mutating keys, under some embodiments.

[0017] FIG. 5B illustrates mutation of OSI L2 and L3 payload data packets over time, under an example embodiment.

[0018] FIG. 6 illustrates binding node connections to OSI layer 2 using a secure L2 tunnel, under some embodiments.

[0019] FIG. 7 illustrates an example Marconi network that globally organizes and enables the formation of autonomous networks, under some embodiments. [0020] FIG. 8 illustrates an implementation of an mPipe, under some embodiments.

[0021] FIG. 9 is a block diagram of a computer system used to execute one or more software components of a secure Layer 2 tunnel mechanism for mesh networks, under some embodiments.

DETAILED DESCRIPTION

[0022] A detailed description of one or more embodiments is provided below along with accompanying figures that illustrate the principles of the described embodiments. While aspects of the invention are described in conjunction with such embodiments, it should be understood that it is not limited to any one embodiment. On the contrary, the scope is limited only by the claims and the invention encompasses numerous alternatives, modifications, and equivalents. For the purpose of example, numerous specific details are set forth in the following description in order to provide a thorough understanding of the described embodiments, which may be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the embodiments has not been described in detail so that the described embodiments are not unnecessarily obscured.

[0023] It should be appreciated that the described embodiments can be implemented in numerous ways, including as a process, an apparatus, a system, a device, a method, or a computer-readable medium such as a computer-readable storage medium containing computer-readable instructions or computer program code, or as a computer program product, comprising a computer-usable medium having a computer-readable program code embodied therein. In the context of this disclosure, a computer-usable medium or computer- readable medium may be any physical medium that can contain or store the program for use by or in connection with the instruction execution system, apparatus or device. For example, the computer-readable storage medium or computer-usable medium may be, but is not limited to, a random-access memory (RAM), read-only memory (ROM), or a persistent store, such as a mass storage device, hard drives, CDROM, DVDROM, tape, erasable

programmable read-only memory (EPROM or flash memory), or any magnetic,

electromagnetic, optical, or electrical means or system, apparatus or device for storing information. Alternatively, or additionally, the computer-readable storage medium or computer-usable medium may be any combination of these devices or even paper or another suitable medium upon which the program code is printed, as the program code can be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.

[0024] Applications, software programs or computer-readable instructions may be referred to as components or modules. Applications may be hardwired or hard coded in hardware or take the form of software executing on a general-purpose computer or be hardwired or hard coded in hardware such that when the software is loaded into and/or executed by the computer, the computer becomes an apparatus for practicing the invention. Applications may also be downloaded, in whole or in part, through the use of a software development kit or toolkit that enables the creation and implementation of the described embodiments. In this specification, these implementations, or any other form that the invention may take, may be referred to as techniques. In general, the order of the steps of disclosed processes may be altered within the scope of the described embodiments.

[0025] Embodiments are directed to a process and system of providing secure OSI Layer 2 links in large scale IP networks that may include mesh, wired, and wireless networks. FIG. 2 illustrates a large-scale network that implements secure Layer 2 tunnels under some embodiments. As shown in FIG. 2, network 200 comprises a number of network elements such as wireless and/or wired routers 201, computers (servers, desktops, laptops, etc.) 203, transmission interfaces, gateways 205, and the like. Network 200 includes different types of links, such as wireless links 210, wired links 214, and long-distance transmission links 212 that utilize antennas 207.

[0026] Each device or network element represents a node in the network and is coupled to at least one or more other nodes for transmission of messages (data packets) in accordance with defined routing protocols. In a wireless mesh network (WMN), mesh clients are typically computers (e.g., 211), laptop/notebook computers (e.g., 203), tablets, cell phones and other wireless devices while the mesh routers forward traffic to and from the gateways (e.g., 205), which may be connected to the Internet. The wireless protocols may be implemented using IEEE 802.1, Bluetooth, or any other appropriate wireless standard. The transmission links 212 may represent cellular communication links or any other telephonic or WAN/LAN network link, and wired links 214 may be implemented using copper, fiber, or any other appropriate hardwired link. FIG. 2 illustrates one example of a large-scale WMN, and embodiments are not so limited. A mesh network of any size, composition, and transmission media over some or all of the links may be used. Though network 100 illustrates a partial mesh network in which not every node is connected to every other node, a mesh network under embodiments may be a fully meshed network or partial network, or a hybrid network including full and/or partial sub-networks.

[0027] Network 200 may include any number of sub-networks that may be wired or wireless LAN or mesh networks containing different devices or network elements. Each device may be assigned a unique network address (e.g., " lO.x.y.z") that specifies a network, sub-network, and device identifier, or similar unique attribute. It should be noted that FIG. 2 illustrates an example network and many different network configurations and topographies are possible. [0028] In mesh network 100, data packets are transmitted through hops from one device to another until they reach their destination using dynamic routing algorithms that are implemented in each device. Using dynamic routing, each device determines what to do with the data it receives, which is to either pass it on to the next device or keep it, depending on the protocol. Routing algorithms typically try to ensure that the data takes the most appropriate (fastest) route to its destination. Many different routing algorithms are generally available, and network 100 may be configured to operate with any appropriate algorithm, such as dynamic source routing (DSR), associativity-based routing (ABR), optimized link state routing (OLSR), Babel, or any other defined or ad hoc routing protocol using any appropriate routing provider and product. Embodiments may be configured to work with either flooding, routing, or hybrid (flooding/routing) protocols.

[0029] As stated above, the OSI reference model describes how information from a software application in one computer moves through a network medium to a software application in another computer. Each layer specifies particular network functions with tasks involved with moving information assigned to each of the seven OSI layers and is self-contained so that the tasks assigned to each layer can be implemented independently. The physical layer (Layer 1) is concerned with the transmission of data bits over physical mediums. The data link layer (Layer 2) specifies transmission of frames between connected nodes on the physical layer. The network layer (Layer 3) describes addressing, routing and traffic control of a multi-node network. The transport layer (Layer 4) describes segmentation, acknowledgement and multiplexing between points on a network; the session layer (Layer 5) looks at the continuous exchange of data between two nodes; the presentation layer (Layer 6) performs data compression and encryption / decryption between a network service and application; and the application layer (Layer 7) which does resource sharing, high level APIs and remote file access. [0030] In the OSI model, layers 1, 2 and 3 are media layers while layers 4 along with layers 5, 6 and 7 are host layers. The data link layer (L2) is a broadcast MAC (media access control) level network. It provides error-free transfer of data frames between nodes, where the data frames contain MAC addresses. Layer 2 establishes and terminates the logical link between nodes, provides frame traffic control, sequencing, acknowledgement, delimiting, and error checking. The network layer (L3) provides segmented routing over IP network and controls operations of the subnet by deciding which physical path the data takes. It processes data packets that contain the IP addresses. Layer 3 provides routing, subnet traffic control, frame fragmentation, logical-physical address mapping, and usage accounting functions.

[0031] As used herein and corresponding to known conventions, a MAC address or Media Access Control address of a device is a unique identifier assigned to a network interface controller (NIC) for communications at the Data Link layer of a network segment. MAC addresses are typically used in the medium access control protocol sublayer, and are usually presented as six groups of two hexadecimal digits. A MAC address may also be referred to as the bumed-in address (BIA), hardware address or Ethernet hardware address (EHA), or physical address. A node may have multiple NICs and each NIC must have a unique MAC address. MAC addresses are most often assigned by the manufacturer of a NIC and are stored in its hardware.

[0032] Under the OSI model 300, Layer 3 works on top of Layer 2, which works on top of Layer 1. While the actual data bits are transferred over the physical or wireless medium, frames are used to define the data between two nodes on a data link. When there are more than two nodes, an address or routing protocol is used to route and control the traffic flow. Thus, traditional switching operates at layer 2 of the OSI model, where packets are sent to a specific switch port based on destination MAC addresses. Routing operates at Layer 3, where packets are sent to a specific next-hop IP address, based on destination IP addresses. Devices in the same Layer 2 segment do not need routing to reach local peers. The destination MAC address is resolved through an Address Resolution Protocol (ARP).

[0033] With respect to data addressing, Layer 2 defines the protocol to both establish and terminate a physical connection between two devices. Layer 2 works with the device MAC addresses, which are unique identifiers for the network adaptor present in each device. A MAC address is thus a fixed address to the network adaptor and cannot be changed on a device without changing the hardware adaptor. Layer 2 networks forward all their traffic so data transmitted by one device on L2 will be forwarded to ail devices on the network. Such broadcast traffic is fast, but as the network grows it creates congestion and leads to inefficiency.

[0034] In contrast to Layer 2, Layer 3 works with IP addresses, which are essentially leased’ or‘assigned’ generally to the nodes by a DHCP (dynamic host configuration protocol) server. As IP addresses are a layer of abstraction higher than MAC addresses, traffic using this layer is generally slower than Layer 2. Furthermore, Layer 3 traffic restricts broadcast traffic through segmentation and restricting broadcast traffic to subnetworks. In a Layer 3 transmission, for each data package, the IP portion is read by stripping the data link layer (Layer 2) frame information and is then reassembled again. From there, the hop count is decremented, the header checksum recalculated and a routing lookup executed.

[0035] In general, a network interface controller (NIC) implements the electronic circuitry required to communicate using a specific physical and data link layers to enable the IP protocol. The NIC is both a physical layer and data link layer device, as it provides physical access to a networking medium and, for IEEE 802 and similar networks, provides a low-level addressing system through the use of MAC addresses that are uniquely assigned to network interfaces. In an embodiment, the virtual NIC is implemented by virtualizing hardware components of a standard physical NIC. Secure OSI Laver 2 Tunnel

[0036] Embodiments include a component and process that establishes secure connections between nodes or hosts in the L2 data link layer. Mechanisms of this process that establishes a secure L2 tunnel or pipe include (1) a secure using a virtual device driver (e.g., Tap driver)_ to virtualize L2 communication which allows for multiple tunnels to be created from one device, and (2) use of mutating encryption that allows the encryptions keys to change over time for more secure communication.

[0037] For the embodiment of FIG. 2, a secure tunnel process 204 is executed by a server computer 202 that is coupled to the network 200 through one or more devices, such as a router or other computer. The implementation of a secure tunnel process 204 as a server executed process is just one example of any number of possible implementations. Such a process may be embodied as a standalone or integrated network component or as an software or firmware program executed by any of the processing devices of network 200.

[0038] Process 204 provides a tunneling protocol that allows a network user to access or provide a network service that the underlying network does not support or provide directly.

In general, tunneling involves some degree of repackaging the traffic data into a different form, such as through encryption to hide the nature of the traffic that is run through the tunnels. A tunneling protocol works by using the data portion of a packet or payload to carry the packets that actually provide the sendee.

[0039] In general, a tunnel is defined as a communications link that uses a tunneling protocol to repackage data traffic into a different form for transmission between network nodes. A tunnel is a mechanism used to ship a foreign protocol across a network that normally would not support it. For example, a tunnel allows IP networks to send another protocol in the data portion of the IP datagram. In this case, the tunneling protocol uses the data portion of a packet (payload) to carry the packets that provide the service. In the OSI layered protocol model, it can be used to break the layering when using the payload to carry a service not normally provided by the network. In an embodiment, the tunneling protocol of the OSI model of FIG. 1 uses the data link layer, such as using the Layer 2 Tunneling Protocol (L2TP). Other tunneling protocols can also be used, such as SSH (secure shell), GRE (generic, routing encapsulation), and so on.

[0040] In an embodiment, the individual OSI Layer 2 tunnel connection that implements the L2 node connections is referred to as a "Marconi Pipe" (mPipe) Since the network peers are connected and bridged through OSI Layer 2 tunnels, this bridge mechanism provides similar redundancy and recoverability in physical network layers. For example, if one of the direct network layer 2 tunnel connections with a peer node is disconnected, (unintentionally or intentionally), the network utilizes the Layer 2 protocol address resolution protocol (ARP) to find an alternative OSI Layer 3 path to transmit the data, while the lost Layer 2 tunnel connection is recovered or replaced with other network service nodes.

[0041] In an embodiment, the Ethernet bridge mechanism is implemented through a secure Layer 2 tunnel/pipe that uses a virtual network device driver, such as a TUN/TAP (or similar) driver to facilitate virtual Layer 2 communication which allows for multiple tunnels to be created from one device. For this embodiment, TUN and TAP are virtual network kernel devices where the TUN (Network Tunnel) simulates a network layer device and operates with Layer 3 (IP) packets, and the TAP (Network Tap) simulates a link layer device and operates with Layer 2 packets, like Ethernet frames. TUN is generally used with routing, while TAP is used for creating a network bridge. Packets sent via a TUN/TAP device are delivered to a user-space program that attaches itself to the device. The program may also pass packets into a TUN/TAP device. In this case the TUN/TAP device delivers (or "injects") these packets to the operating system network stack, thus emulating their reception from an external source. It should be noted that any other virtualization or tunnel mechanism may be used, such as a secure shell (SSH) tunnel, or proprietary (e.g., mPipe) method.

[0042] Although embodiments are described with respect to TUN/TAP drivers, it should be noted that other virtual network device drivers can also be used, such as a MacVTap or other drivers that provide or simplify virtualized bridged networking.

[0043] FIG. 3 illustrates a node interconnection system having a secure tunnel created using mutating encryption keys and virtual network device (e g., TAP) drivers, under some embodiments. As shown in diagram 300 of FIG. 3, Host A 302 and Host B 304 each implement the seven-layer OSI model. A secure encrypted tunnel 301 is created between the two hosts over the physical Layer 1 using respective physical NICs 304 and 306. TAP drivers 308 and 310 are created in the operating system (OS) space of each host across Layers 2 to 6. The TAP drivers 308 and 310 represent virtual NICs interact with the respective physical NICs 304 and 306 through frame/packet forwarding links 309 and 311. Operation of these components will be described with reference to the flowchart of FIG. 4A, which illustrates a method of creating a secure Layer 2 tunnel, under some embodiments.

[0044] The process of FIG. 4A starts by creating encryption keys between the nodes (e.g., Hosts A and B), step 402. In an embodiment, the keys are created using the Diffie-Hellman technique, which is a known method of securely exchanging cryptographic keys over a public channel. Alternatively, other exchange methods may also be used. In an embodiment, three separate encryption keys are created and shared between the two nodes.

[0045] FIG. 4B illustrates a table that lists the three keys, under an embodiment. As shown in Table 1, each key is a symmetric key, such as an AES (advanced encryption standard) cipher key, as known to those of ordinary skill in the art. It should be noted, however that embodiments are not so limited and other types of cipher techniques to embody the keys may also be used. The L2 key is used for checksum and data integrity, the L2/L3 key is used for data encryption and the master key is used for mutating the L2 and L3 encryption by implementing key changes over time, such as by modifying a time stamp.

[0046] Once the three keys are generated and shared, a two-way handshake occurs to validate the keys, step 404.

[0047] As shown in step 406, the nodes create a virtual device driver (e g., TAP driver) that generates a Layer 2 MAC address to receive and send traffic to the physical NICs. Traffic is now securely encrypted/decrypted at OSI Layer 2 using the mutating encryption technique, step 408. Data traffic is then transmitted over the higher OSI levels via a user datagram protocol (UDP), which enables certain features, such as net or firewall punch-through, and other features. This mechanism effectively provides two-factor encryption or authentication to create a secure L2 tunnel for communications using higher level OSI layers between two nodes. UDP is generally known as an alternative communications protocol to TCP and is used primarily for establishing low-latency and loss-tolerating connections between applications using the IP protocol.

[0048] The L2 and L2/L3 keys are mutating keys that change over time according to the following function: L2/L3 Key = f(master key, t, seed nonce).

[0049] FIG. 5A illustrates the composition of changing segments within a data packet using mutating keys, under some embodiments. As shown in FIG. 5A, data packet 500 includes a number of segments 502, 504 and 506 that are streamed as time (t) increases. Each segment may be of a pre-defmed amount of data, such as 1GB or similar, or generated on a regular period dictated by a timer or timestamp increment, such as every second, 10 seconds, etc. Each segment is encoded using a different L2 key. As shown, segment 502 is encoded using L2keyl, segment 504 is encoded using L2key2, segment 506 is encoded using L2key3, and so on. In this manner, the time mutating keys provide a very high level of security since breaking a key will only result in partial decryption of the data. As soon as the data segment changes, the breach is nullified.

[0050] In an embodiment, the Marconi Pipe payload mutation can be either a OSI L2 or OSI L3 payload by configuration. It is not necessarily tied to an OSI L2 payload/frame mutation specifically and is instead capable for mutating both OSI L2 frame and OSI L3/L4 packet payloads. FIG. 5B illustrates mutation of OSI L2 and L3 payload data packets over time, under an example embodiment. The example of diagram 510 illustrates five L2/L3 keys denoted Keyl to Key5. Each key has an OSI L2/L3 payload indicated by sequential numbers of varying lengths. An important feature shown in FIG. 5B is that the time intervals between each payload mutations are not static which makes it harder to tamper with the system. Each time interval/new nonce (TimedSeedNonce) is refreshed through the Diffie-Hellrnan process in advance to void a static time interval, which is more predictable, and hence easier to tamper with. It should be noted that FIG. 5B is provided for purposes of example only, and any number and configuration of OSI packet payloads and keys may be used.

[0051] For the embodiment described above, the mutation is based on changing time as recorded by a time stamp associated with the data packets. Alternatively, a different changing parameter may be used, such as a packet number counter, or similar changing value.

[0052] Provided below is example programming code to implement the process of FIG. 4, under some embodiments.

(A) Use Diffie-Hellrnan to create three common secret (symmetric cryptography key) and an initial seed for time-base OTP for OSI layer 2 secure communication:

1) $ INTEGRY_KEY : The common secret for data integrity

(append sha256/checksum of timestamped data)

2) $DATA_ENC_KEY : the common secret for data encryption 3) $SEED NONCE: Seed Nonces for TOTP to mutate primary and secondary common secret

(B) Verify credentials created on #1 using two-way handshake model (ping and pong):

$TIMED_SEED_NONCE = ( $TIMESTAMP % $SEED_NONCE)

$SECURE_DATA = SymmetricEncrypt ( ( "ping" + $TIMESTAMP ) , ($DATA_ENC_KEY + $TIMED_SEED_NONCE ) )

$SIGNED_SECURE_DATA =

$SECURE_DATA + HMAC-SHA256 ( $SECURE_DATA, $ INTEGRY_KEY + $TIMED_SEED_NONCE + ( $TIMESTAMP )

(C) The other node uses the same credential to respond back:

$TIMED_SEED_NONCE = ( ( $TIMESTAMP + $delta ) % $SEED_NONCE )

$SECURE_DATA = SymmetricEncrypt ( ( "pong" + ( $TIMESTAMP + $del ta ) ) , $DATA_ENC_KEY + $TIMED_SEED_NONCE )

$S IGNED_SECURE_DATA =

$SECURE_DATA + HMAC-SHA256 ( $SECURE_DATA, $ INTEGRY_KEY +

$TIMED_SEED_NONCE ) + ( $TIMESTAMP + $delta )

(D) After step 3, one or both nodes can initiate the tunnel process using the keys.

[0053] It should be noted that the term "nonce" in the above programming code refers to a symmetric cryptographic key data structure, and not necessarily an arbitrary hash-based number as may be otherwise known.

Applications

[0054] The secure Layer 2 tunneling method described above using mutating keys and L2 TAP drivers can be used for various different applications. One such application is for hole punching, which is the ability to generate a secure tunnel using non-TCP protocols through penetrate network protections, such as firewalls and similar mechanisms. [0055] Another application provided by the secure pipe and tunneling method is to provide access to network packets (entry point) for smart routing and processing, which is facilitated by implementation down to Layer 2 of the OSI stack. As described above, the rnPipe is an implementation of a virtualized data link layer that provides a communication channel (pipe) for transporting network traffic between peers. Conceptually this is similar to the Layer 2 Tunneling Protocol (L2TP). These pipes are a fundamental building block of the Marconi Network, and because they are established ail the way down to layer 2 of the OSI model, they allow several important capabilities such as custom packet routing and processing, increased security via packet-level encryption, and easy discovery' of neighboring peers transmitting on the same local wired or wireless medium. When creating a pipe, a secure connection is formed between two peers by using a Diffie-Hellman exchange to create three shared secrets: one for data encryption, one for checksums to achieve data integrity, and one used as a seed, as described above. Each peer combines this seed with the current time truncated to a pre defined granularity (e.g., one minute) to obtain a new seed which changes over time. This in turn is used to mutate the data encryption secret and data integrity secret based on the current time interval, similar to a time-based one-time password (TOTP), to help protect against traffic pattern analysis. The use of symmetric keys provides for greatly increased

performance. Packets will constantly be traversing many pipes, and useful cryptographic operations as defined in the Advanced Encryption Standard (AES) are directly supported in the instruction sets of common hardware. The Marconi Pipe enables several interesting network features including:

(1) Packet Relay: within the network, packets can be relayed through multiple hops before exiting into the internet or private networks. Similar to onion routing, this improves privacy and helps protect against snooping, as only the network edge node is aware of the end user. (2) Packet Throttling: because connections are at OSI layer 2, the network has access to maximal information, therefore can easily throttle network packets using a variety of different strategies to meet network requirements.

(3) Packet Inspection: again because the network can access data from all the above OSI layers, it can make decisions based on payload contents. Even if data is encrypted at higher layers, interesting metadata is still available such as domain names and header information.

[0056] Another use of the secure Layer 2 tunnel is in implementing Layer 2/Layer 3 binding. FIG. 6 illustrates binding node connections to OSI Layer 2 using a secure L2 tunnel, under some embodiments. In an embodiment, a binding process groups or "binds" connections in a mesh network to reduce the complexity of connections between sets of nodes in a mesh network. This binding is performed by implementing the node connections at the OSI Layer 2 data link layer. An Ethernet bridge is created to bind all the tunnel connections with a specific node. A virtual NIC (network interface controller) is used to generate a single MAC address for the bound connections. The virtual NIC behaves as a switch in routing traffic from the MAC address to bound tunnels from the bridge. A new IP address is generated to represent the MAC. Communication between newly generated IP addresses will then work with any Internet protocols. As shown in diagram 600, node A 602 is coupled to node C 604 over network link 602, which may be a wired or wireless link in a meshed network.

Communication over link 603 utilizes layer 3 IP addresses assigned to nodes A and C. In an embodiment, nodes A and C are coupled to link 402 through respective virtual NIC (VNIC) devices 606 and 608, as denoted VNIC_A and VNIC_B. The coupling between the nodes and their respective VNICs each comprise and Ethernet bridge 603 and 605. These bridges operate on layer 2 utilizing the MAC addresses for the respective nodes. The overall connection between nodes A and C over bridge 603, link 602, and bridge 605 may be implemented as a secure L2 tunnel as described above.

[0057] Following is an example of program code that outlines the steps for binding OSI Layer 2 using bridge utilities in Linux which interface with bridge-module in the kernel, under some embodiments.

1. virtual tunnel is created using tap/tun driver and named 'tunXX' or 'tapXX' (XX is number)

2. brctl addbr brO;

- This create bridge network interface through bridge- module in the kernel

3. brctl addif brO tap$ {MCC_NODE_ID_TUN } ;

- This adds L2 tunnel/pipe created during step #1 with virtual bridge network interface.

4. ifconfig brO up;

- This activates the virtual bridge interface

5. brctl stp brO on;

- This is additional step to avoid loop/flooding in L2 bridge/network interface

6. ifconfig tap$ {MCC_NODE_ID_TUN} up;

- This activates tap/12 tunnel interface

7. ifconfig brO 172.20.0. $ {MCC_NODE_MGM_IP_D } netmask 255.255.255.0;

- Assign L3 information into virtual bridge interface

[0054] After these steps are complete, the brO interface should be able to communicate within the network or the private IP range defined in last step. With respect to the binding implementation, the secure L2 tunnel method can be considered to be a pairwise pipe that establishes communications between pairs of nodes.

Smart Contract Network Protocol

[0058] In an embodiment, the secure tunnel process 104 described herein is used in a large scale mesh network utilizing a protocol, referred to as the "Marconi Protocol" that defines the rules and provides the primitives by which peers can securely connect and communicate in order to form and participate in the network "Marconi Network," which can be a global-scale network in which nodes can join and leave at will using the mechanism of smart contracts.

[0059] The Marconi protocol facilitates secure network communication and smart contracts for network packets. It is designed down to Layer 2 of the OSI model and works with wired and wireless standards. It is interoperable with existing Internet infrastructures and provides enhanced Layer 2 and Layer 3 functionality, such as transmission layer security. In an embodiment, there are three main components of the protocol.

[0060] The first component is the Marconi Pipe (mPipe), which provides a secure communication channel for transporting network traffic between peers. The pipes are established all the way down to Layer 2 of the OSI model and provide encryption, routing, and processing capabilities. The second component is a system of smart packet contracts allowing network packets to be routed and processed using smart contracts. This technology unlocks numerous use-cases for smart decentralized networking applications such as software-defined networking, intrusion detection and prevention systems, content delivery networks, and distributed virtual private networks. The third component is the Marconi link, which works with wired standards to allow the protocol to be used as an overlay on existing internet infrastructure. With Marconi Link, the protocol has also been designed to be used with wireless protocols such as Bluetooth, Wi-Fi, and the U-NII-3 radio band to power scalable mesh networks, both public and private. [0061] FIG. 7 illustrates an example Marconi network that globally organizes and enables the formation of autonomous networks, under some embodiments. The network connects peers 701 (which may be infrastructure service nodes, Internet-enabled computing devices, or network end users) through smart contracts 702 that are agreements between these peers defining how much data will be exchanged, for how long, what types of smart packet contracts will be enabled, and at what fuel price. The connections can be implemented through mPipes 703 or wireless Marconi links 704

[0062] In an embodiment, individuals, network operators, and Internet service providers can participate in the network by contributing their band-width or compute resources to the network. In return for contributing resources and processing smart packet contracts, network nodes periodically receive network tokens that serve as the base unit for distributed networking and computing, the fuel consumed for network usage, administration, and smart contract processing.

[0063] While the Marconi Network can interoperate with existing internet infrastructure, it is also self-sustaining, capable of obviating existing network infrastructure by forming direct peer-to-peer connections to facilitate wireless mesh networks that remove the need for hardware switches, routers, and bridges. In essence, the Marconi Network enables and incentivizes users to assemble and securely exchange network infrastructure resources without the physical, financial, and regulatory limitations that hinder traditional approaches to building, connecting, operating, and maintaining network infrastructure at scale. End users can utilize the network to access the Internet or nearby compute power, either by procuring tokens or by mining them through operating a contributing service node. Developers can utilize the network to create and deploy intelligent, decentralized networking applications that can be run by end users or service nodes. Private institutions and enterprises can utilize the network and the platform its built on to manage their infrastructure and develop smart distributed networking and cybersecurity services.

[0064] The mPipe (Marconi pipe) 1003 implements a virtualized data link layer which provides a communication channel, or pipe, for transporting network traffic between peers. Conceptually this is similar to the Layer 2 Tunneling Protocol (L2TP). These pipes are a fundamental building block of the Marconi Network, and because they are established all the way down to Layer 2 of the OSI model, they allow several important capabilities such as custom packet routing and processing, increased security via packet-level encryption, and easy discovery of neighboring peers transmitting on the same local medium. FIG. 8 illustrates an implementation of an mPipe, under some embodiments. FIG. 8 shows the hierarchy of the seven OSI Layers 802 with an mPipe 804 implemented between drivers in Layer 2.

[0065] When creating a pipe, a secure connection is formed between two peers by using a Diffie-Hellman (or similar) exchange to create three shared secrets: one for data encryption, one for checksums to achieve data integrity, and one used as a seed. Each peer combines this seed with the current time truncated to a pre-defmed granularity (e g., one minute) to obtain a new seed that changes over time. This in turn, is used to mutate the data encryption secret and data integrity secret based on the current time interval, similar to a time-based one-time password (TOTP), to help harden the data stream against attacks such as traffic pattern analysis.

[0066] A system of symmetric keys is used for performance. Packets will constantly be traversing many pipes, and useful cryptographic operations as defined in AES are directly supported in the instructions sets of many hardware components. The mPipe operates at the level of a network driver and can thus be very performant both in terms

encryption/decryption, as well as in terms of packet-level processing. This enables several interesting network features, such as packet relay, packet throttling, and packet inspection. [0067] With respect to the smart contract component, with smart packet contracts, developers have the ability to run smart contracts against network packets to do smart routing and packet processing. The Marconi network provides a platform where developers can create decentralized networking applications using smart packet contracts.

System Implementation

[0068] As described above, in an embodiment, system 100 includes a secure Layer 2 tunnel mechanism that may be implemented as a computer implemented software process, or as a hardware component, or both in a computer such as server 202 in FIG. 2. As such, it may be an executable module executed by the one or more computers in the network, or it may be embodied as a hardware component or circuit provided in the system. The network environment of FIG. 2 may comprise any number of individual client-server networks coupled over the Internet or similar large-scale network or portion thereof. Each node in the network(s) comprises a computing device capable of executing software code to perform the processing steps described herein. FIG. 9 is a block diagram of a computer system used to execute one or more software components of process 204, under some embodiments. The computer system 1000 includes a monitor 1011, keyboard 1017, and mass storage devices 1020. Computer system 1000 further includes subsystems such as central processor 1010, system memory 1015, input/output (I/O) controller 1021, display adapter 1025, serial or universal serial bus (USB) port 1030, network interface 1035, and speaker 1040. The system may also be used with computer systems with additional or fewer subsystems. For example, a computer system could include more than one processor 1010 (i.e., a multiprocessor system) or a system may include a cache memory.

[0069] Arrows such as 1045 represent the system bus architecture of computer system 1000. However, these arrows are illustrative of any interconnection scheme serving to link the subsystems. For example, speaker 1040 could be connected to the other subsystems through a port or have an internal direct connection to central processor 1010 The processor may include multiple processors or a multicore processor, which may permit parallel processing of information. Computer system 1000 is an example of a computer system suitable for use with the present system. Other configurations of subsystems suitable for use with the present invention will be readily apparent to one of ordinary skill in the art.

[0070] Computer software products may be written in any of various suitable programming languages. The computer software product may be an independent application with data input and data display modules. Alternatively, the computer software products may be classes that may be instantiated as distributed objects. The computer software products may also be component software.

[0071] Embodiments are include a method of establishing a secure link for transfer of data packets between network nodes implementing a seven-layer OSI model, by creating a set of encryption keys to be shared between the nodes; validating the keys using a two-way handshake; creating a virtual network device driver in each node to generate respective OSI Layer 2 (L2) media access controller (MAC) addresses to transmit data traffic through physical network interface controller (NIC) devices in each node; and encoding, using mutating encryption, data at Layer 2 using the virtual network device drivers and at least one encryption key to allow for transmission over a secure tunnel between the nodes using a user datagram protocol (UDP). The set of encryption keys comprise: an L2 symmetric key for checksum and data integrity, an L2/L3 symmetric key for data encryption, and a master key. The master key mutates the L2 and L3 (Layer 3) encryption keys over time. The master mutates the L2 and L3 encryption keys through the following function: L2/L3 Key = f(master key, t, seed nonce).

[0072] In this method, the data packets may include a number of segments that are streamed as time increases, and each segment may comprise one of a pre-defmed amount of data or data generated on a regular period dictated by a timer or timestamp increment. Each segment may be encrypted using a different L2 key. The mutating encryption serves to time mutate the encryption keys to provide a degree of security that ensures that breaking an encryption key only results in partial decryption of the data due to the fact that upon a change in a data segment any breach is nullified. The data comprises one of a Layer 2 payload or a Layer 3 payload, and the time mutation is capable of mutating OSI L2 frame data and OSI L3/L4 packet payloads.

[0073] This method may further comprise changing a time interval between successive time mutations, and it may yet further comprise using a time nonce to represent the time interval, and refreshing the time interval through a Diffie-He!lman process in advance to prevent a static time interval for successive time intervals. The time interval may be recorded by one of: a time stamp associated with the data packets, a data packet number counter, or a dynamically randomly generated value. The virtual network device driver may comprise one of a TUN/TAP driver or MacVTap driver, and if a TUN/TAP driver, the driver comprises virtual network kernel devices where the TUN (Network Tunnel) simulates a network layer device and operates with Layer 3 data packets, and the TAP (Network Tap) simulates a link layer device and operates with Layer 2 data packets. The network nodes may be part of a mesh network comprising a large-scale network implementing a smart contract based protocol to route and process data packets among nodes of the mesh network.

[0074] Embodiments are further directed to a method of transferring data over a secure link between nodes implementing an OSI seven layer model by generating a Layer 2 media access controller (MAC) address to receive and send data comprising data segments to physical network interface controllers (NICs) within the nodes; applying a mutating encryption process over time to change data segments within the data using mutating encryption keys, the encryption keys comprising a first layer key, a second layer key, and a seed; transmitting the data over the higher OSI level than Layer 2 using a user datagram protocol (UDP); and changing the mutating encryption keys through the following functions: first layer key = /(first layer key, t, seed), and second layer Key = /(second layer key, t, seed). In this method, the first layer may comprise OSI Layer 2 (L2) and the second layer comprises OSI Layer 3 (L3), and wherein the set of encryption keys comprise: an L2 symmetric key for checksum and data integrity, an L2/L3 symmetric key for data encryption, and a master key.

[0075] Embodiments are yet further directed to a system for establishing a secure link for transfer of data packets between network nodes implementing a seven-layer OSI model, comprising: a first processing component creating a set of encryption keys to be shared between the nodes and validating the keys using a two-way handshake; a second processing component creating a virtual network device driver in each node to generate respective OSI Layer 2 (L2) media access controller (MAC) addresses to transmit data traffic through physical network interface controller (NIC) devices in each node; and a mutating encryption encoder encoding data at Layer 2 using the virtual network device drivers and at least one encryption key to allow for transmission over a secure tunnel between the nodes using a user datagram protocol (UDP). The set of encryption keys comprise: an L2 asymmetric key for checksum and data integrity, an L2/L3 symmetric key for data encryption, and a master key, and wherein the master key mutates the L2 and L3 (Layer 3) encryption keys over time. The data packets include a number of segments that are streamed as time increases, and wherein each segment comprises one of a pre-defmed amount of data or data generated on a regular period dictated by a timer or timestamp increment, and wherein the mutating encryption serves to time mutate the encryption keys to provide a degree of security that ensures that breaking an encryption key only results in partial decryption of the data due to the fact that upon a change in a data segment any breach is nullified. The first processing component may encode each segment using a different L2 key and changes a time interval between successive time mutations using a time nonce to represent the time interval.

[0058] Although certain embodiments have been described and illustrated with respect to certain example network topographies and node names and configurations, it should be understood that embodiments are not so limited, and any practical network topography is possible, and node names and configurations may be used. Likewise, certain specific programming syntax and data structures are provided herein. Such examples are intended to be for illustration only, and embodiments are not so limited. Any appropriate alternative language or programming convention may be used by those of ordinary skill in the art to achieve the functionality described.

[0059] Embodiments as described herein may be applied to mesh networks of any scale (full or partial), and may also be applied to any other physical, virtual or hybrid physical/virtual network, such as a very large-scale wide area network (WAN), metropolitan area network (MAN), or cloud-based network system. Aspects of the one or more embodiments described herein may be implemented on one or more computers executing software instructions, and the computers may be networked in a client-server arrangement or similar distributed computer network. The network provides connectivity to the various systems, components, and resources, and may be implemented using protocols such as Transmission Control Protocol (TCP) and/or Internet Protocol (IP), well known in the relevant arts.

[0060] For the sake of clarity, the processes and methods herein have been illustrated with a specific flow, but it should be understood that other sequences may be possible and that some may be performed in parallel, without departing from the spirit of the invention. Additionally, steps may be subdivided or combined. As disclosed herein, software written in accordance with the present invention may be stored in some form of computer-readable medium, such as memory or CD-ROM, or transmitted over a network, and executed by a processor. More than one computer may be used, such as by using multiple computers in a parallel or load sharing arrangement or distributing tasks across multiple computers such that, as a whole, they perform the functions of the components identified herein; i.e., they take the place of a single computer. Various functions described above may be performed by a single process or groups of processes, on a single computer or distributed over several computers. Processes may invoke other processes to handle certain tasks.

[0061] Unless the context clearly requires otherwise, throughout the description and the claims, the words“comprise,”“comprising,” and the like are to be construed in an inclusive sense as opposed to an exclusive or exhaustive sense; that is to say, in a sense of“including, but not limited to.” Words using the singular or plural number also include the plural or singular number respectively. Additionally, the words“herein,”“hereunder,”“above,” “below,” and words of similar import refer to this application as a whole and not to any particular portions of this application. When the word“or” is used in reference to a list of two or more items, that word covers all of the following interpretations of the word: any of the items in the list, all of the items in the list and any combination of the items in the list.

[0062] All references cited herein are intended to be incorporated by reference. While one or more implementations have been described by way of example and in terms of the specific embodiments, it is to be understood that one or more implementations are not limited to the disclosed embodiments. To the contrary, it is intended to cover various modifications and similar arrangements as would be apparent to those skilled in the art. Therefore, the scope of the appended claims should be accorded the broadest interpretation so as to encompass all such modifications and similar arrangements.

Claims

CLAIMS What is claimed is:

1. A method of establishing a secure link for transfer of data packets between network nodes implementing a seven-layer OSI model, comprising:

creating a set of encryption keys to be shared between the nodes;

validating the keys using a two-way handshake;

creating a virtual network device driver in each node to generate respective OSI Layer 2 (L2) media access controller (MAC) addresses to transmit data traffic through physical network interface controller (NIC) devices in each node; and

encoding, using mutating encryption, data at Layer 2 using the virtual network device drivers and at least one encryption key to allow for transmission over a secure tunnel between the nodes using a user datagram protocol (UDP).

2. The method of claim 1 wherein the set of encryption keys comprise: an L2 symmetric key for checksum and data integrity, an L2/L3 symmetric key for data encryption, and a master key.

3. The method of claim 3 wherein the master key mutates the L2 and L3 (Layer 3) encryption keys over time.

4. The method of claim 3 wherein the master key mutates the L2 and L3 encryption keys through the following function: L2/L3 Key = f(master key, t, seed nonce).

5. The method of claim 4 wherein the data packets include a number of segments that are streamed as time increases, and wherein each segment comprises one of a pre-defmed amount of data or data generated on a regular period dictated by a timer or timestamp increment.

6. The method of claim 5 further comprising encoding each segment using a different L2 key.

7. The method of claim 6 wherein the mutating encryption serves to time mutate the encryption keys to provide a degree of security that ensures that breaking an encryption key only results in partial decryption of the data due to the fact that upon a change in a data segment any breach is nullified.

8. The method of claim 7 wherein the data comprises one of a Layer 2 payload or a Layer 3 payload, and wherein the time mutation is capable of mutating OSI L2 frame data and OSI L3/L4 packet payloads.

9. The method of claim 7 further comprising changing a time interval between successive time mutations.

10. The method of claim 9 further comprising using a time nonce to represent the time interval, and refreshing the time interval through a Diffie-Hellman process in advance to prevent a static time interval for successive time intervals.

11. The method of claim 10 wherein the time interval is recorded by one of: a time stamp associated with the data packets, a data packet number counter, or a dynamically randomly generated value.

12. The method of claim 1 wherein the virtual network device driver comprises one of a TUN/TAP driver or MacVTap driver, and if a TUN/TAP driver, the driver comprises virtual network kernel devices where the TUN (Network Tunnel) simulates a network layer device and operates with Layer 3 data packets, and the TAP (Network Tap) simulates a link layer device and operates with Layer 2 data packets.

13. The method of claim 1 wherein network nodes are part of a mesh network comprising a large-scale network implementing a smart contract based protocol to route and process data packets among nodes of the mesh network.

14. A method of transferring data over a secure link between nodes implementing an OSI seven layer model, comprising:

generating a Layer 2 media access controller (MAC) address to receive and send data comprising data segments to physical network interface controllers (NICs) within the nodes; applying a mutating encryption process over time to change data segments within the data using mutating encryption keys, the encryption keys comprising a first layer key, a second layer key, and a seed;

transmitting the data over the higher OSI level than Layer 2 using a user datagram protocol (UDP); and

changing the mutating encryption keys through the following function L2/L3 Key = f(master key, t, seed nonce).

15. The method of claim 14 wherein the first layer comprises OSI Layer 2 (L2) and the second layer comprises OSI Layer 3 (L3), and wherein the set of encryption keys comprise: an L2 symmetric key for checksum and data integrity, an L2/L3 symmetric key for data encryption, and a master key.

16. A system for establishing a secure link for transfer of data packets between network nodes implementing a seven-layer OSI model, comprising:

a first processing component creating a set of encryption keys to be shared between the nodes and validating the keys using a two-way handshake;

a second processing component creating a virtual network device driver in each node to generate respective OSI Layer 2 (L2) media access controller (MAC) addresses to transmit data traffic through physical network interface controller (NIC) devices in each node; and a mutating encryption encoder encoding data at Layer 2 using the virtual network device drivers and at least one encryption key to allow for transmission over a secure tunnel between the nodes using a user datagram protocol (UDP).

17. The system of claim 16 wherein the set of encryption keys comprise: an L2 symmetric key for checksum and data integrity, an L2/L3 symmetric key for data encryption, and a master key, and wherein the master key mutates the L2 and L3 (Layer 3) encryption keys over time.

18. The system of claim 17 wherein the data packets include a number of segments that are streamed as time increases, and wherein each segment comprises one of a pre-defmed amount of data or data generated on a regular period dictated by a timer or timestamp increment, and wherein the mutating encryption serves to time mutate the encryption keys to provide a degree of security that ensures that breaking an encryption key only results in partial decryption of the data due to the fact that upon a change in a data segment any breach is nullified.

19. The system of claim 18 wherein the first processing component encodes each segment using a different L2 key and changes a time interval between successive time mutations using a time nonce to represent the time interval.

20. The system of claim 16 wherein network nodes are part of a mesh network comprising a large-scale network implementing a smart contract based protocol to route and process data packets among nodes of the mesh network.