SG172425A1

SG172425A1 - Method and system for secured service-oriented nodes discovery and route determination in mobile ad-hoc network

Info

Publication number: SG172425A1
Application number: SG2011047560A
Authority: SG
Inventors: Siew Leong Kan
Original assignee: Nanyang Polytechnic
Priority date: 2009-01-23
Filing date: 2009-01-23
Publication date: 2011-07-28
Also published as: WO2010085210A1

Abstract

The present invention provides a mobile node for generating and transmitting a data packet to a designation mobile node through a mobile Ad-hoc network (MANET). The mobile node comprises a service/application module defining a code for each service/application executable on the mobile node, a security code generator operable to generate a security code, a connection history recorded IDs of the other mobile node connected to the mobile node, a routing table defining possible routes for routing the data packet within the MANET, a packet generator operable to generate a data packet having parameters that include the service/application code, the security code, the IDs and a counter defining a number of hops required for transmission and a communication module for broadcasting the data packet. When the another mobile nodes receives the data packet, the another mobile nodes verifies all the parameters of the data packet to authenticate the transmission.

Description

METHOD AND SYSTEM FOR SECURED SERVICE-ORIENTED NODES

DISCOVERY AND ROUTE DETERMINATION IN MOBILE AD-HOC

NETWORK

FIELD OF INVENTION

The present invention relates to a mobile network. More particularly, the present invention relates to a system and method of securing a mobile ad-hoc network.

BACKGROUND

Mobile Ad-hoc Network (MANET) is an autonomous network system of mobile routers and associated mobile hosts connected via wireless links - the union of which forms an arbitrary graph. The routers and hosts are free to move randomly and organize themselves arbitrarily; thus, the network’s wireless topology changes rapidly and unpredictably.

Current technology and implementation focusing more on IP based MANET system only and use a complex and bulky routing protocol in route determination.

There is no commercial MANET product known to-date and if have they will not have an integrated set of the security and application parameters being used in route determination.

In a wireless network, ad-hoc network particularly, data security is always a concern to eliminate unauthorized access and usage of the data transmits among the network.

FIG. 1 illustrates a simplified MANET that consists three mobile nodes (MN1, MN2, and MN3). As shown, MN1 is able to communicate with MN3 through MN2 when MN1 cannot reach MN3 via a direct communication.

SUMMARY

In accordance with one aspect, the present invention provides a mobile node for generating and transmitting a data packet to a designation mobile node through a mobile Ad-hoc network (MANET). The mobile node comprises a service/application module defining a code for each service/application executable on the mobilenode, a security code generator operable to generate a security code, a connection history recorded IDs of the other mobile node connected to the mobile node, a routing table defining possible routes for routing the data packet within the MANET, a packet generator operable to generate a data packet having parameters that include the service/application code, the security code, the IDs and a counter defining a number of hops required for transmission and a communication module for broadcasting the data packet. When the another mobile nodes receives the data packet, the another mobile nodes verifies all the parameters of the data packet to authenticate the transmission.

In one embodiment, the data packet is transmitted to the designation mobile node through at least one gateway node. It is possible that the gateway node is one of the mobile nodes among the MANET.

In another embodiment, the routing table is updated regularly for increasing the number of possible routs for routing the data packet.

In a further embodiment, the number of hops is decreasing by 1 each time the data packet is transmitted to a designation mobile node. The ID may include a MAC address or other possible physical unique identification. Possibly, the service/application is embedded as part of the security code.

In yet a further embodiment, the security code includes a login ID, a group ID : and an encryption/license key.

Yet, the data packet may further includes dummy characters for filling up a prescribe length of the data packet.

BRIEF DESCRIPTION OF DRAWINGS

This invention will be described by way of non-limiting embodiments of the present invention, with reference to the accompanying drawings, in which;

FIG. 1 illustrates a simplified known MANET;

FIG. 2 illustrates a block diagram of a mobile node in accordance with one embodiment of the present invention;

FIG. 3 illustrates a flow diagram showing communications between three network nodes in accordance with one embodiment of the present invention;

FIG. 4 exemplify a format of a data packet in accordance with one embodiment of the present invention;

FIG. S exemplifies a format of a data packet in accordance with another embodiment of the present invention;

FIG. 6 exemplifies a format of a data packet in accordance with a further embodiment of the present invention; and

FIG. 7 exemplifies a format of a data packet in accordance with yet another embodiment of the present invention.

DETAILED DESCRIPTIONS

In line with the above summary, the following description of a number of specific and alternative embodiments is provided to understand the inventive features of the present invention. It shall be apparent to one skilled in the art, however that this invention may be practiced without such specific details. Some of the details may not be described at length so as not to obscure the invention. For ease of reference, common reference numerals will be used throughout the figures when referring to the same or similar features common to the figures.

The present invention provides a system and method for nodes discovery and route determination with service aware and sufficient security features built-in to support portable wireless devices with limited resources within a Mobile Ad-hoc

Network (MANET). To achieve the objectives, the present invention make use of the increasing deployment of innovative solutions and the popularity wireless handheld devices, coupling with the demands in supporting business and lifestyle of mobile users. Wireless network supporting MANET can either be a single or combinations of wireless Personal Area Network (WPAN), wireless LAN (WLAN) or wireless

Metropolitan Area Network (WMAN).

The present invention provides a system and method to enhance security and mobility of mobile nodes of a Mobile Ad-hoc Network (MANET). Generally, it enables mobile nodes to have a fast nodes discovery and establish secured communications with each other with the use of a unifying security and application codes.

In one embodiment of the present invention, the MANET comprises an 5 automated system that includes security and service aware codes together with the knowledge of previous authorised mobile nodes to speed up the nodes discovery and route determination processes in a MANET. The MANET may comprise mobile nodes (MN) that are Internet Protocol (IP) based devices and the non-IP based devices. Each mobile node can be defined with its own definition of logical address, security and application codes to be used in the determination of route for mobile nodes to enhance security level for MANET devices. The system is able to link the process of nodes discovery and route determination closely to the service that a user using for the benefit of performance. It further links applications, network and systems level parameters in one single logical unit for the purpose of speedy response time. It is a scalable system and method that are able to support small handheld mobile nodes/devices in MANET.

FIG. 2 illustrates a block diagram of a mobile node 200 in accordance with one embodiment of the present invention. The mobile node 200 comprises a service/application a selection module 210, a security code generator 220, and a packet generator 230, a routing table 240, an access history 250, a communication role 260 and a communications module 290, and applications/services module 280.

Briefly, the selection module 210 operationally initiates a communication with other mobile node through the MANET. Once the communication is initiated, the security code generator 220 appends a security code that is required for transmissions between the mobile nodes. The packet generator 230 extracts relevant information, which includes the security code, and forms a data packet based on a predefined format and extracted relevant information for transmission through the MANET. The routing table 240 provides routes for transmitting the data packet within the MANET. The communications among various mobile nodes are carried out by referring to the routing table 240. The access history 250 provides archives/history on neighbouring

MN that communicated with the mobile node 200. The communication module 290 is provided to perform wireless communication with other mobile nodes that includes a corresponding communication module 290. The communication module 290 may include one or more transceiver of different protocols, such as Wi-Fi, GSM, etc. The applications/services module 280 handles the applications/services run on the mobile node 200. During the communications, the MANET requires to execute the same applications/services to provide appropriate communications between the mobile nodes.

FIG. 3 illustrates a flow diagram showing communications between three network nodes (MN1, MN2, MN3) in accordance with one embodiment of the present invention. The network nodes MN1, MN2 and MN3 communicate with each other as shown in FIG. 1. The communication flow is herewith illustrated in conjunction with FIG. 2. In the nutshell, the network node MIN1 communicates with the network node MN3 via the network node MN2 as a MANET gateway. It is understood to a skilled person that the MANET may consist more than one gateway nodes for communications between two mobile nodes. The present embodiment provides only one gateway node MN2 for simplicity reason, not limitations. The relevant steps in FIG. 3 illustrate how a mobile node performs discovery and routing processes to establish communications between MN1 and MN3 through MN2. The mobile nodes include Access Points (AP), wireless base stations, laptop computers,

PCs, personal digital assistants, and any other mobile or stationary wireless devices.

The method further provides security features on the services supported within the

MANET with security parameter(s) and service pre-selected by the users, together with information of previous/recent neighbouring nodes will be grouped together to speed up the nodes discovery and routing process.

The mobile node MN1 initiates a communication with the mobile node MIN3 at step 302 by invoking a suitable service/application on the mobile node MN1 through the service selection module 210. Each of the services/applications is assigned with a relevant service/application code. For examples, an instant messaging application corresponds to the service/application code of APP;; a VoIP (voice over

Internet Protocol) related applications corresponds to the service/application code of

APP,; and a file transfer related applications corresponds to the service/application code APP;. :

Once the required application/service is invoked, at step 304, the security code generator 220 appends a security code, herein denoted as “SEC”. The security code can be a pre-defined security code, or a user-defined key code. Typically, the security code is agreed upon at least at the sender side and the recipient side in order to establish an authenticated communication. Depending on the security requirement, it is possible that, the security code is required to be agreed among other mobile notes that routing the data packet as a gateway in order to establish an authenticated communication. A response to the security code (SECR) is generated by the receiver to serve as authentications for the sender. The security code is a combination of one or more parameters that includes login ID, password, encryption/license key, etc. For example, Group ID + password forms a SEC; ; and login ID + Application Key forms a SEC,.

During any communications, the mobile node MN1 records a connection history of recent neighbouring mobile nodes that connected thereto at step 306. The connection history details is utilised by the packet generator 230 for generating data packets. At step 308, the packet generator 230, searches the connection history record for all mobile nodes that communicated with the mobile node MNI1 under the requested service/application based on the service or application requested. At the same time, a routing table stored on the mobile node MN1 is updated at step 309. The packet generator 230 extracts the mobile node addresses, OldStn, which include any one of user-defined logical address, Medium Address Control (MAC) address, (MAC + IP) address, and (MAC + logical) address. With the mobile node address (from the step 306), the service/application code (from the step 302) and the security code (from the step 304), the packet generator 230 forms the data packet, Py, with the structure as showin FIG. 4.

In FIG. 4, OldStn,. | represents recent/previous mobile notes MN(,.1) addresses that accessed to the mobile node MNI1, APP; represents the requested service/application code, which is generally pre-defined based on the service/application; SEC; represents the encrypted security code; S,.1Add represents source MN.) address (i.e. mobile node MN1’s address), which can by any of the addresses that include MAC address, (MAC + IP) address, (MAC + logical) address and the like; Ty; represents a time or time period that the data packet remains valid for transmission; and Dummy represents dummy characters that make up to a standard packet length, L.

In an alternative embodiment, Ty; represents a maximum number of hop allowed for transmitting the data packet. Further, APP;, SEC; can also be used defined code.

Referring back to FIG. 3, once the packet is formed in accordance with the above data packet format, the packet generator 230 sends the data packet to the communications module 290 at step 310 for broadcasting. A Sent Timer is also activated to track the time required for the data packet P; to be transmitted to mobile node MN3. Any neighbouring mobile nodes with their address matches one of the

OldStn addresses shall serve the MN1 as a gateway to transmit the data packet, which in the case of FIG. 3, the mobile node MN2. The relevant addresses of the neighbouring mobile nodes are stored in the routing table stored in the respective nodes, which is updated regularly. The routing table may include unique identification number of the transmitting nodes, applications served thereon, mode of access, time accessed previously and gateway node identification number and etc.

Still referring to FIG. 3, at step 311, the mobile node MN2 receives the data packet via its communication module 290. At step 312, the mobile node MN2 checks if its own address matches any of the OldStn,.; provided in the data packet. Once a match is found, at step 313, the mobile node MN2 decreases the value of Ty; by 1 where the Ty; represents the maximum number of hop allowable. At step 314, the packet generator 230 subsequently generates a response packet, Pz, as shown in FIG. 5 for acknowledging receipt to the mobile node MN1. Once acknowledged, the mobile node MN2 establishes a communication link with mobile node MN1 at step 315. Further, when the Ty; is greater than 0, the mobile node MN2 broadcasts a new data package Ps, which is generated based the Pi. At step 318, the routing table is updated at step 318.

In FIG. 5, S;_Add represents the original source MN address, i.e. the mobile node MN1 address; APP, represents the service/application code; SEC; r represents an encrypted security response code generated in response to the data packet, and the encrypted security response code is different from the SEC;; OldStn represents the address of the mobile node MIN2 sending out the response packet; Tir represents the number of hop count left after the deduction which should be Tp;i-1; and Dummy represents characters that make up for a standard packet length, D.

Referring back to FIG. 3, once the communication link is established, the required application/service is executed accordingly at step 316. Once the communication ends, the mobile node MIN2 disconnects from the mobile node MN1 at step 319. Referring back to step 312, the mobile node MN2 could not find any matching address among the OldStn addresses from the data packet P;, the mobile node MN2 further checks whether both the application/service code and the security codes contained in the data packet match a predefined code that include combinations of application keys, security codes and addresses as it deems fit. When the match is found, the mobile node MN2 proceeds with the step 313 and thereafter the subsequent steps provided above, which include establishes (the step 315) the communication link between the mobile node MN1 and mobile node MN2 and activates the application/services (the step 316). When neither the address nor the relevant code is matched, the communication link shall cease to establish and the communication module 290 of the MN3 listen to the next broadcast messages of step 321.

Referring back to the step 315 of FIG. 3, the mobile node MN2 further broadcasts the data packet Pj if Ty; is greater than zero value. The data packet Pj; is formatted as shown in FIG. 6, where its packet format is similar to that of Py except that the address of the mobile node MIN2 that generated Pj; is added, and preferably the address code S;_Add representing the MN2 address is placed before the S; Add field in the data packet Pj.

Once the data packet Pj is broadcasted, the neighbouring nodes, such as the mobile node MN3, upon receiving the data packet P3 process the data packet Pj; accordingly. When the mobile node MN3 receives the data packet P3 via its communication module 290 at step 321, the mobile node MN3 checks if its own address matches any of the OldStn,.; provided in the data packet P; at step 322. Ifa match is found, at step 323, the mobile node MN3 further decreases the value of Ty; by 1. Otherwise, the mobile node MN3 further checks whether both the application/service code and the security codes match the data packet Ps at step 327.

If neither of the matches is found, the data packet P; is disregarded/discarded. When a match is found, the mobile node MN3 proceeds to the step 323 to further decreases the value of Tr; by 1. At step 324, its packet generator 230 subsequently generates a response packet, Ps, in a format as shown in FIG. 7 for acknowledging receipt to the mobile node MN2. Once acknowledged, the mobile node MN2 establishes a communication link with mobile node MN2 at step 325. During the communication, mobile node MN1 communicates with the mobile node MN3 via the established connections between MN1 and MN2 and MN3. In step 326, the required application/service is executed accordingly at step 326. Once the communication ends, the mobile node MIN3 disconnects from the mobile mode MIN2.

The format of the data packet P is similar to that of the data packet P,, except that address of the mobile node MN2, S, Add is also included therein.

In one embodiment, when any of the mobile nodes receives a data packet with

Ty, equal to zero, the data packet shall be ignored/deleted accordingly.

Still referring to FIG. 3, the routing table 290 of mobile nodes MN1, MIN2 and MIN3 are provided as a reference to each mobile node to communicate within the

MANET. It recorded the possible routing paths available to communicate from a source mobile node to a designation mobile node. The routing table 290 is also updated once a new data packet or response packet is generated at steps 309, 319, 329.

In another embodiment, the source mobile node, i.e. the mobile node that sends out a data packet, consolidates all response packets that received from other mobile nodes. The response packets are decoded and form the routing table 240. An example of the routing table is provided in TABLE A.

TABLE A : Routing Table of the Mobile Node MN1

Destination Mode Intermediate No of hops Response Last Update

MN MN Time Time

MN2 Direct (1 hop) - 1 10ms 20081208:1103

MN3 Indirect MN2 1 33ms 20081208:1132

MNG6 Indirect MN2 MNS 2 52ms 20081208:1134

Each mobile node keeps a routing table 290 of its own defining possible routs for communication in the MANET. The routing table 290 is built up by recording all address information of destination mobile nodes that are able to respond directly will be saved or updated in the routing table 290. Address information of destination mobile node that received through another/intermediate mobile node, will be compared with those information in the routing table 290. When duplicate record is found, it will be ignored. If not, for a particular destination mobile node, the time that the packet received by the source mobile node from an intermediate mobile node will be used to compare with the receive time of other packet(s) received through another intermediate mobile node(s) if any. Typically, the fastest end-to-end response time of a packet will be used to determine which mobile node will be the intermediate mobile node for the destination mobile node.

In another embodiment, the routing table is updated frequent enough to handle the mobility and changes of topology in any MANET environment. When the time is up, section 3.5 onwards will be repeated. The frequency of updates can be adjusted in relationship with the users’ mobility conditions and applications supported.

The link has to be disconnected properly by a simple detection of application already closed by any mobile node once the application no longer required and the routing table will be updated.

Based on above, the present invention is adapted to provide MANET or Ad- hoc network communication between devices in both Internet protocol (IP) and non-

IP based devices. It is particularly suitable for portably MANET devices as it has a relatively thin nodes discovery and routing process. With application/service key embedded in the security codes, which is detectable at early stage of establishing a communication link, the system enables the mobile nodes/devices to be service- aware.

While specific embodiments have been described and illustrated, it is understood that many changes, modifications, variations and combinations thereof could be made to the present invention without departing from the scope of the invention.

Claims

CLAIMS:

1. A mobile node for generating and transmitting a data packet to a designation mobile node through a mobile Ad-hoc network (MANET), the mobile node comprising: a service/application module defining a code for each service/application executable on the mobile note; a security code generator operable to generate a security code; a connection history recorded IDs of the other mobile node connected to the mobile node; a routing table defining possible routes for routing the data packet within the MANET; a packet generator operable to generate a data packet having parameters that include the service/application code, the security code, the IDs and a counter defining a number of hops required for transmission; and a communication module for broadcasting the data packet, wherein when the another mobile nodes receives the data packet, the another mobile nodes verifies all the parameters of the data packet to authenticate the transmission.

2. The mobile node according to claim 1, wherein the data packet is transmitted to the designation mobile node through at least one gateway node.

3. The mobile node according to claim 2, wherein the gate way node are one of the mobile nodes among the MANET.

4. The mobile node according to claim 1, wherein the routing table is updated regularly for increasing the number of possible routs for routing the data packet.

5. The mobile node according to claim 1, wherein the number of hops is decreasing by 1 each time the data packet is transmitted to a designation mobile node.

6. The mobile node according to claim 1, wherein the ID includes a MAC address.

7. The mobile node according to claim 1, wherein the ID includes a physical unique identification.

8. The mobile node according to claim 1, wherein the service/application is embedded as part of the security code.

9. The mobile node according to claim 1, wherein the security code includes a login ID.

10. The mobile node according to claim 1, wherein the security code includes a group ID.

11. The mobile node according to claim 1, wherein the security code includes an encryption/license key.

12. The mobile node according to claim 1, wherein the data packet further includes dummy characters for filling up a length of the data packet.