Data communication network

Details Data communication network Data communication network

1999-02-18

2002-11-26

Darrow, Justin T. (Department: 2132)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Particular node for directing data and applying cryptography

C713S155000, C713S152000, C380S033000, C380S270000, C380S271000, C455S003050

Reexamination Certificate

active

06487657

ABSTRACT:

FIELD OF THE INVENTION
The invention relates to a data communication network suitable for the exchange of data between computers, which network comprises at least one substantially wireless LAN (Local Area Network) and access points distributed over an area of coverage for linking the computers comprised in the minimally one LAN, with the network.
BACKGROUND OF THE INVENTION
Such a data communication network has been known in practice for years. The wireless local area network (LAN) comprised in such a data communication network is designed to provide a great degree of flexibility, mobility and to lower the otherwise necessary costs for infrastructure and control. Such a wireless LAN may include a laptop computer equipped for wireless communication. In order to provide the communication function, the network is equipped with so-called access points which are set up in the geographical area served by the wireless LAN. Usually an access point serves a small area called Cell, having a radius of between 10 an 100 metres. Therefore, for serving a somewhat extensive area of coverage, the application of several access points is required. Among themselves, these access points are linked by means of network techniques which are known as such, and which may or may not be wired, such as for example, the ethernet infrastructure.
The data communication network forming the object of the present invention, comprises at least one wireless local area network, and may otherwise be wired for linking with possibly further virtual local area networks, for example, in accordance with the IEEE 802.1Q standard for virtual LANs or, similarly, as known from W096/04734. When such a data communication network provides the possibility of applying several wireless local area networks, a problem arises that is intrinsic to the type of wireless communication. When computers from different local area networks operate in the same geographical area it is, in view of the fact that wireless communication takes place via the ether, very difficult to maintain the integrity of the data traffic in the respective local area networks according to the prior art.
There are various solutions to this problem. On the one hand, the number of access points may be enlarged in concurrence with the number of local area networks present in a certain area of coverage; however, this is very costly and with respect to the utilization of the available transmitter frequencies, very inefficient. Another solution is not to increase the number of access points, but to restrict the mobility of the computers in local area networks. However, instead of solving a problem it merely avoids a problem. Another possibility is to abandon the idea of the smaller local area networks and to equip the system as one integral network. This would indeed avoid the indicated problem, but would create problems relating to the security of the data traffic, and will produce an exponential increase of the control problem. Accordingly, the performance of the system will deteriorate because data which is destined for a limited number of computers, will be sent to every-one.
U.S. Pat. No. 5,199,072 concerns wireless local area networks and means for restricting access within such networks. The wireless LAN according to this publication utilizes a control module to control communication with user modules that are linked with such devices as terminals, personal computers and similar equipment. Access to the wireless LAN is controlled by the control module and for each user module a unique identification number is employed, which information is stored in the memory of the control module. Prior to permitting network access the control module verifies the identification of the requesting user module. The users that are active in a certain geographical area, form part of a group sharing the same control module and when the mobile users are roaming, a transfer of the user concerned from one user group to the next is required, necessitating the assignment of a new password into the user module seeking access into the next user group. According to U.S. Pat. No. 5,199,072 a particular user is, however, not able to roam from one area to the other whilst maintaining membership to one particular virtual LAN.
SUMMARY OF THE INVENTION
It is the object of the invention to provide a system in which the data communication network can be used whilst being able to encompass several wireless LANs, without unduly aggravating the control problem with respect to the data traffic in the system, and without requiring concessions with regard to the mobility of the various computer users who are part of a wireless LAN.
According to the invention the data communication network is therefore equipped such that the minimally one wireless LAN is virtual and that the data traffic with the computers belonging to that particular LAN is individualized by encoding the data exchanged between the computers and the access points by using for each LAN a unique key.
In one preferred embodiment therefore every computer is provided with its own unique key. In this manner point-to-point data links can be established between the various computers wirelessly encompassed in the network and the access points. To this end, data encoding techniques may be applied that are generally known from the literature. The only prerequisite being, that the keys applied are capable of distinguishing the individual data links between the respective computers and the access points. By providing said keys, the respective access points can be equipped such that they recognize to which virtual LAN or virtual LANs they belong and also, to which LAN the computers sending and/or receiving data to and from said access points, belong. The various keys may be determined beforehand for each LAN.
In one particular embodiment, however, it is advantageous that the data communication network is equipped to generate the unique key the moment that data traffic between one or more computers from a LAN and the network is established. This is advantageous with regard to controllability.
One suitable embodiment endowed with the necessary guarantees regarding authentication of the data traffic, is characterized in that the generation of the unique key occurs with the public-key algorithm, which is known as such; see W. Diffie and M. E. Hellman, “New Directions in Cryptography”, IEEE Transactions on Information Theory, v.IT-22, n. 6, November 1976, pp. 644-654.
Advantageously, the access points are among themselves linked to wired network connections that are known as such. However, this is not a prerequisite; the network connections may also be wireless.
In order to restrict the load constituted by the data traffic in the data communication network according to the invention, it is desirable that every access point possesses a filter unit for deleting data destined for a computer belonging to a LAN other than the one present in the area of coverage of that particular access point, or which stems from a computer of a first LAN while being destined for a computer of a second LAN. In addition, this guarantees the virtual star structure of the network.
With a view to data traffic security it is desirable that the filter unit be equipped to delete from the data traffic predetermined types of data, for example, data that could be classified as infringing the security or integrity of a network or a part thereof. This may be of particular importance with regard to data exchange in a WINDOWS-NT environment.
To further serve the controllability of the system, every computer in a wireless LAN is provided with a device for rejecting messages sent by other computers. This procedure effectively provides a star structure between the various access points and the computers communicating with said access points.
It is further desirable that each computer be provided with one or more additional keys for encoding and decoding the data traffic destined for a group of computers, or for all computers in the same virtual LAN. In addition to the point-to-point data messa

Affiliated with

Also associated with

Rating

Data communication network does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Data communication network, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Data communication network will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-2937279