Abstract: A network node for a mesh network may control processing of an incoming PDU with reference to a stage one cache. The incoming PDU may be received in an obfuscated state in which a control portion is obfuscated. The control portion comprises information identifying the incoming PDU, and/or destination information indicative of at least one destination node for the incoming PDU. A stage one cache lookup is performed, based on at least a portion of the incoming PDU in the obfuscated state, to determine whether the incoming PDU matches information on a previously received PDU cached in a stage one cache. Depending on the stage one cache lookup, the node determines whether to perform a deobfuscation operation to deobfuscate the control portion of the incoming PDU and whether to perform continued processing the incoming PDU. This limits the number of deobfuscation operations required, which can save processing resource and power.

Abstract: A network node for a mesh network may control processing of an incoming PDU with reference to a stage one cache. The incoming PDU may be received in an obfuscated state in which a control portion is obfuscated. The control portion comprises information identifying the incoming PDU, and/or destination information indicative of at least one destination node for the incoming PDU. A stage one cache lookup is performed, based on at least a portion of the incoming PDU in the obfuscated state, to determine whether the incoming PDU matches information on a previously received PDU cached in a stage one cache. Depending on the stage one cache lookup, the node determines whether to perform a deobfuscation operation to deobfuscate the control portion of the incoming PDU and whether to perform continued processing the incoming PDU. This limits the number of deobfuscation operations required, which can save processing resource and power.

Abstract: Various embodiments include a network manager for managing network keys in a network having a plurality of nodes, the device including: a memory; and a processor configured to: determine N nodes to blacklist, wherein N is an integer; select a polynomial function from a plurality of polynomial functions of degree K and wherein the polynomial functions define plurality of secret network keys; generate K-N random abscissa values, wherein none of the random abscissa values are not found in a list of node abscissa values; calculate K-N polynomial function values for the K-N random abscissa values; calculate N polynomial function values for N node abscissa values associated with the N blacklisted nodes; transmit a message to nodes in the network including an indication of the selected polynomial function, the K-N random abscissa values, the N node abscissa values associated with the N blacklisted nodes, the K-N calculated polynomial function values, and the N calculated polynomial function values.

Abstract: Various embodiments described herein relate to network key manager which is configured to manage keys in nodes in the network, wherein the network key manager including a memory configured to store an update data structure; a processor configured to: determine which nodes are blacklisted; generate the update data structure of volatile private keys for each node that is not blacklisted, wherein the volatile private key is based upon secret information associated with the node and an index, wherein the volatile private key is used for the indexth key update; determine a neighbor node of the network key manager; remove the volatile private key for the neighbor node from the update data structure; encrypt the resulting update data structure and a new network key with the private key for the neighbor node to produce an encrypted message; and send the encrypted message to the neighbor node.

Abstract: Adaptive message caches are disclosed for packet replay and/or flood protection in mesh network devices. The adaptive message cache includes a replay protection area (RPA) and a flood protection area (FPA). For each received packet, a packet security processor compares packet metadata to metadata entries stored for prior packets within the RPA to provide a replay protection check. If a replay protection check is not passed, the packet is dropped. If passed, the packet security processor compares the packet metadata to metadata entries stored for prior packets within the FPA to provide a flood protection check. If the flood protection check is not passed, the packet is dropped. If passed, the received packet is authenticated for the mesh network. Entries within the RPA/FPA are then updated using the packet metadata. Further, the sizes of the RPA and FPA can be adaptively adjusted based upon the packet metadata.

Abstract: Various embodiments described herein relate to network key manager which is configured to manage keys in nodes in the network, wherein the network key manager including a memory configured to store an update data structure; a processor configured to: determine which nodes are blacklisted; generate the update data structure of volatile private keys for each node that is not blacklisted, wherein the volatile private key is based upon secret information associated with the node and an index, wherein the volatile private key is used for the indexth key update; determine a neighbor node of the network key manager; remove the volatile private key for the neighbor node from the update data structure; encrypt the resulting update data structure and a new network key with the private key for the neighbor node to produce an encrypted message; and send the encrypted message to the neighbor node.

Abstract: Various embodiments include a network manager for managing network keys in a network having a plurality of nodes, the device including: a memory; and a processor configured to: determine N nodes to blacklist, wherein N is an integer; select a polynomial function from a plurality of polynomial functions of degree K and wherein the polynomial functions define plurality of secret network keys; generate K-N random abscissa values, wherein none of the random abscissa values are not found in a list of node abscissa values; calculate K-N polynomial function values for the K-N random abscissa values; calculate N polynomial function values for N node abscissa values associated with the N blacklisted nodes; transmit a message to nodes in the network including an indication of the selected polynomial function, the K-N random abscissa values, the N node abscissa values associated with the N blacklisted nodes, the K-N calculated polynomial function values, and the N calculated polynomial function values.

Abstract: Adaptive message caches are disclosed for packet replay and/or flood protection in mesh network devices. The adaptive message cache includes a replay protection area (RPA) and a flood protection area (FPA). For each received packet, a packet security processor compares packet metadata to metadata entries stored for prior packets within the RPA to provide a replay protection check. If a replay protection check is not passed, the packet is dropped. If passed, the packet security processor compares the packet metadata to metadata entries stored for prior packets within the FPA to provide a flood protection check. If the flood protection check is not passed, the packet is dropped. If passed, the received packet is authenticated for the mesh network. Entries within the RPA/FPA are then updated using the packet metadata. Further, the sizes of the RPA and FPA can be adaptively adjusted based upon the packet metadata.