WO2005002147A1

WO2005002147A1 - Wireless local-area network architecture

Info

Publication number: WO2005002147A1
Application number: PCT/FR2004/050225
Authority: WO
Inventors: Jean-René LABARRIERE; Vincent Jamoulle; Jean-Paul Mallet; Stephen Turner
Original assignee: Filfree Networks
Priority date: 2003-06-19
Filing date: 2004-06-18
Publication date: 2005-01-06
Also published as: FR2856540A1

Abstract

The invention relates to a method of implementing a wireless local-area network architecture for the exchange of digital data. The invention consists of a plurality of devices each comprising client resources and server resources as well as means for interconnecting said devices by means of networking. The inventive method is characterised in that it comprises: steps involving the definition of network deployment rules, and steps involving the application of said rules whenever a connection is established between a client resource of a device and a server resource of another device of said local-area network. The invention also relates to an architecture which is used to implement said method.

Description

WIRELESS LOCAL AREA NETWORK ARCHITECTURE

The present invention relates to the field of wireless local area networks. The present invention relates more particularly to a method of implementing a wireless local area network architecture for digital data exchange comprising a plurality of equipment each comprising client resources and server resources as well as means of interconnection of said equipment by mesh. Modern computing is essentially network-based. This notion of network is omnipresent, the connection between computers is at the origin of a revolution in communication tools, a vector of culture and freedom. The place of the computer has evolved from the status of a super calculating machine, then of a work or leisure tool to that of a multi-media station, a kind of window open to the world. The appearance and then the ubiquity of the Internet, a kind of network of networks, represents one more step. Even if the Internet is only a set of hardware and software to ensure communications between computers, it has become a political, economic, cultural and philosophical stake of planetary dimension much more by the content of the information that it conveys than by its technology. The Internet has lost its exclusively technological color at the same time as it became available to everyone, we “connect” today as naturally as we buy a newspaper. From the users' point of view, it is interesting to associate the trivialization of the Internet with that of mobile telephony. If the synergy appears natural for the users of these two technologies, it was appropriate until present to oppose the mobility of the telephone to the sedentary lifestyle linked to the essentially wired nature of broadband access to the Internet, access mobility being at the cost of performance. This link between mobility and performance appeared with wireless network technology today largely supported by WLAN and WiFi type products aligned with IEEE 802.11 standards. However, the problems posed by this technology appeared very early, in particular the ability of this technology to support the geographic extension of networks as well as the security and integrity of the data exchanged. The invention described solves these problems in an innovative way. In order to understand the differences in architecture, implementation and the benefits of the invention it is important to recall the current state of wireless technologies. Overcoming cabling constraints represents advantages of mobility and flexibility; current technologies and more particularly WLAN and Wifi offer these advantages. These products adopt the IEEE 802.11 standard suite which mainly defines a method of wireless access, or connectivity, to a wired network. We generally speak of access points (AP). In its generic form, an access point is a wireless transmitter that allows wireless connection to a wired LAN type network. An access point manages this connection in such a way that clients of the wired network and clients of the wireless network have the illusion of being members of the same network. The main constraints and limitations of these WLAN products are: "Security. The authentication mechanisms are not based on mutual authentication. "Limited control of the topology of the wireless network. ¹ No integrated wireless network supervision tools. ^A Problem of hidden or faulty nodes. The possibility of connecting and the quality of this connection are not deterministic. ¹ Problem geographic coverage of the wireless network. The extension of the wireless network is linked to the availability of a wired network. "The protocols work mainly at level 2 of the ISO model. Bandwidth is often degraded by broadcasts from the LAN and multicast traffic.

Access points use data encryption mechanisms to guarantee the confidentiality and integrity of transfers. Unfortunately, the mechanism used, WEP, has many weaknesses. WEP uses the RC4 coding algorithm which uses the same key to encrypt and decrypt packets, this key can be 40 to 128 bits. The weaknesses of this protocol and of the key exchange mechanisms are such that a hacker can decrypt a message by analyzing the equivalent of approximately five hours of data transmission. In addition, the WEP coding key manager can reuse the same keys in a sufficiently "predictable" manner, so that it becomes possible to analyze network traffic and correlate the data to the keys used, which then makes it possible to crack the codes. These hacking techniques are just as effective on 40-bit RC4 encodings as on 128-bit ones. An access point in its basic form only allows connection of wireless clients (1 in Figure 1), the other access points are not recognized or connected. The maximum distance between the access point and the customer is the "radio range limit", between 50 meters indoors and a few hundred meters outdoors. Beyond this maximum distance, connectivity can no longer be ensured. Some manufacturers have included the possibility of using access points to create network "bridges" and relay wired networks (2 in Figure 1). In this configuration, the access points become network bridges without allowing the connection of wireless clients. By extension, the two functionalities have been integrated to create wireless bridges between wired network segments and also allow the connection of clients (3 in Figure 1). This category of equipment can be confusing since the implementation remains limited due to the following constraints: • The implementation is often specific to a given manufacturer. In most cases, equipment from the same manufacturer should be used. • The functionality of the lower equipment is limited to the network bridge, it cannot behave as an access point. A LAN can be characterized as a medium offering high bandwidth, supporting broadcast and allowing multiple and shared access. This definition fully applies to WLANs. However, several important aspects are often overlooked when the capabilities and functionality of LANs are transposed to the wireless world: "LANs generally support extremely low error rates of around 10 ^{" 9} while WLANs have error rates of the order of 10 ^"5 to 10 ⁶ , or three orders of magnitude." The price / performance ratio of WLANs equipment remains considerably lower than that of LANs. The bandwidth of a wireless network is a much more sensitive resource than that of a wired network.

The combination of a high error rate and a lower bandwidth means that the direct use of LAN-specific protocols with wireless WLANs can generate very serious problems of reliability and efficiency. The problem of hidden or faulty nodes can seriously compromise the proper functioning of a wireless network since this network is not deterministic in terms of basic connectivity and bandwidth. An example of this problem is the use of wireless bridges operating in point-to-point mode or in point-to-multipoint mode. In a transversal LAN, one of the objectives of the broadcasting tree management algorithms is to eliminate network loops. The consequence is that the path between two stations may be sub-optimal in terms of the transit “distance” of a data packet. This is however insignificant due to the high bandwidth, the relatively low cost and the segmentation of the collision domains.

In a current WLAN environment, optimizations only occur when the direct path is used between two stations due to the lower bandwidth and the possibility of a shared collision domain at the physical level (layer 1 of the ISO model). In addition, the correct functioning of the algorithm broadcast depends on "network bridge" command packets which can be corrupted or lost. The lack of cohesion and convergence of the network can have disastrous consequences if loops are created, even for a very short period.

Although new standards which should correct some of the shortcomings of WLANs are under study, we believe that products using current protocols should be used only as access facilities and that great care should be taken to understand the fundamental differences between these two types of media. The range of WLANs equipment is limited by the low power authorized for transmission but also by the frequency band used (2.4GHz). This range is around 50 meters indoors and a few hundred meters outdoors. Beyond this limit, the connection being no longer ensured, it is necessary to add access equipment connected to the wired network or to configure the equipment in network bridge mode. This last solution is not satisfactory essentially because of the problem of hidden or defective nodes exposed previously. In addition, security problems may arise insofar as the increase in geographic coverage increases the visibility of the network and the risk of hacking. Very often, users are content to think that the short range of their wireless network is a way to protect themselves.

The prior art already knows, by American patent application US 2003/0104829, a technique for establishing a virtual bone bac in an ad hoc wireless network. An algorithm for creating a virtual backbone in an ad hoc wireless network uses three phases to establish an efficient network among devices independent of the ad hoc wireless network. Independent equipment in the transmission fields of others is nearby. A phase of selecting a “leader” and constructing a tree makes it possible to construct a tree of neighboring equipment, one of the equipment being designated as the root and each equipment establishing and recording its position in the tree structure and neighbor identifiers; and sending a message when the tree is built. A level calculation phase determines the distance of each item of equipment from the root equipment, each item of equipment recording the level (or distance to the root) of its neighbors. The priority for each item of equipment is established by considering the level in the tree of each item of equipment and its identifier, the level in the tree being essential for determining the priority. In addition, a message is issued when the tree levels are established. A backbone construction phase makes it possible to qualify all the equipment as dominator or dominated, the dominators forming the network backbone and the dominated being neighbors of a dominator. Within the network, each device only needs to know the information of its neighboring devices.

The aim of the present invention is to define a new approach to wireless networks which fulfills the following objectives: "Define an architecture which makes it possible to retain the advantages of flexibility and flexibility of wireless networks, to extend its capacities and to circumvent the problems inherent in this technology in order to provide a alternative at least equivalent or even superior to the services offered by cable networks. "Build an operating system that implements this architecture independently of the hardware platform and define protocols, services, tools and interfaces independent of the radio technology used. The goal is to extend the architecture to other technologies than WiFi. This is one of the key points of the invention. "Reduce, or even remove constraints on users of the infrastructure and integrated services. ¹ Eliminate the deployment constraints symptomatic of current WLAN products and their dependence on wired infrastructure. ¹ Overall control of the wireless infrastructure using predefined rules and policies. "Supporting the extension virtually unlimited wireless network infrastructure and geographical coverage of the network without any dependence on network-vis a ^'wired ¹ Maximizing resilience and reliability of the network through a multi-route mesh network architecture. "Support simple integration without constraints within a wired network infrastructure when it is already present. "Eliminate wireless network security problems by defining protocols independent of the ISOl and IS02 network layers and implement this security through reliable and transparent encryption methods which do not require the use of specific methods by the end user . "Optimize the use of the radio spectrum by eliminating topology and deployment constraints." Minimize the steps necessary to configure the wireless infrastructure while remaining flexible and flexible. "Support standard network management protocols so that you can supervise the wireless infrastructure in the same way as a wired network using the most popular configuration, incident management and performance analysis tools.

To this end, the present invention relates, in its most general sense, to a method for implementing a wireless local area network architecture for the exchange of digital data comprising a plurality of devices each comprising client resources and server resources as well as means of interconnection of said equipment by mesh, characterized in that said method comprises steps for defining rules for network deployment, and steps for applying these rules at the time of each creation of a connection between a client resource of a device and a server resource of another device of said local network. Preferably, said rules are hierarchically distributed at several levels, each of said levels comprising sufficient resources for its operation. Advantageously, said exchanges of digital data are secure thanks to specific encryption means independent of the radio protocol used. Preferably, the wireless network implements a standard of the 802.11, BlueTooth or DECT type. According to a particular mode of implementation, the method further comprises steps for supervising said data exchanges and the traffic of said digital data. According to a variant, the method further comprises steps for optimizing the network structure in real time, these steps making it possible to guarantee the quality of service of said network. According to another variant, the method further comprises a step of integrating at least one new piece of equipment, this integration making it possible to extend the coverage of the network and being carried out by implementing said deployment rules. The present invention also relates to a local area network architecture for implementing the method.

The invention will be better understood using the description, given below for purely explanatory purposes, of an embodiment of the invention, with reference to the appended figures: • Figure 1 illustrates the elementary architecture of the IEEE802.il wireless equipment; • Figure 2 illustrates a comparison between different networks; • Figure 3 illustrates the delineation between backbone and access; • Figure 4 shows the FMP channels; • Figure 5 illustrates the extended structured mesh topology; • Figure β represents the distribution of the overall network policy; FIG. 7 represents the creation of a connection, and more particularly the negotiation; • Figure 8 illustrates the creation of connection, and more particularly authentication and encryption; • Figure 9 illustrates a non-partitioned network; • Figure 10 shows a partitioned network; • Figure 11 illustrates a multi-zone network; and • Figure 12 illustrates a multi-zone network, in which the zones are connected; • Figure 13 shows the packet exchange mechanism as part of the security process; and • Figure 14 shows the creation of links at the link access level as part of the security process.

The concept of the invention is mainly based on that of a structured mesh network using a wireless medium. In point-to-point (ad hoc) networks, all stations wishing to exchange data must establish a direct connection with the adjacent stations. If a station integrates the capacity to transmit data transparently, the network then becomes a mesh and this need for a directly adjacent connection disappears. Figure 2 illustrates a comparison of different types of networks. This data transfer capacity is supported by many types of stations and makes it possible to create highly dynamic and flexible network structures at low cost. This solution has already been implemented for cable networks as well as for wireless networks. However in the case of wireless networks, the integration of heterogeneous stations, including stations dedicated to end users (PC type), within this mesh network creates many weaknesses. The network becomes non-deterministic at the level of the stations themselves and the highly dynamic and heterogeneous nature of this architecture makes it difficult to manage, control and secure. The approach of the invention is to retain the advantages inherent in the flexibility and flexibility of deployment of mesh networks while constraining the structure and topology of this network by applying predefined policies. This control of the structure of the mesh network applies at three levels: 1. At the architectural level, the data routing network (called backbone) is clearly differentiated from the network offering access to users, 2. The backbone is made up of homogeneous stations forming the data routing service infrastructure. 3. Control rules are imposed on the entire network topology in terms of its deployment, transfer and routing of data and the security and integrity of this data. The technology thus implemented applies the principles of mesh networks to the construction of a wireless network infrastructure capable of delivering communication services of quality, performance, predictability and equivalent security. and even superior in some aspects to those offered by cable network infrastructures. The architecture implemented by the invention defines two distinct layers, respectively the routing layer (backbone) and the access layer. These two layers are logically distinct and isolated. The specific characteristics of the wireless networks described above (broadcast transmission, multi-access) are not propagated from one layer to the other, thus creating a strong delineation between these two layers. Within these two layers, the point-to-point network paradigm is systematically applied in order to maximize its efficiency and facilitate the control of its deployment and security. The concept of wireless LAN (WLAN) absolutely does not apply to the invention since the defined architecture is completely different. However, from the point of view of the end users connected to this network, its operational behavior is completely transparent and relates entirely to that of a LAN. At the routing layer (backbone), a wireless mesh network is created between the homogeneous stations supporting our architecture in order to form a deterministic infrastructure to which end users will be able to connect with their wireless network interface to across the access layer. The combination and the interactions between these two layers create this notion of infrastructure really freed from all wiring constraints (WireFrβe infrastructure). Figure 3 describes the delineation between the two architecture layers: • The routing and access layers are architecturally separate, but can be implemented using either the same or two different radio devices. • The separation between the two layers allows the use of different radio technologies for the backbone and access, for example WiFi backbone IEEE802.11b and Bluetooth access.

The backbone layer is managed through the protocol specific to the invention, the FMP, which manages the deployment of the mesh network while respecting the predefined rules. By default, a resilient backbone is automatically created using the information from the ISOl to 3 layers. This information is used to establish an optimized mesh from methods specific to the invention which use convergence algorithms based on fuzzy logic. By extension, these deployment rules make it possible to fully control the topology and the structure of the mesh. This FMP protocol is only used to create the backbone layer. It uses two communication channels. Figure 4 shows the FMP channels. The command channel is used to exchange information making it possible to optimize the initial structure of the mesh at the time of its creation but also to make this structure evolve in real time as a function of variations in the quality of propagation or the very topology of the network. . This communication takes place directly over the wireless interface if no point-to-point link is yet established, or through a point-to-point link if a connection has been established. The backbone is thus automatically organized and optimized and terms of connectivity but also control of data flows.

The communication channel is used for the exchange of encrypted data between the adjacent devices present in the backbone. This communication channel is encrypted by a type algorithm Blo Fish and uses 128-bit encoding keys. This is a key point of the invention since the data is encrypted at the point-to-point link and does not use the functionalities included in the radio interfaces. The protocol is “radio agnostic”, that is to say that it does not depend in any way on the type of radio interface or on the level 1 protocol used. This technique guarantees a very long life of the equipment insofar as the encryption standards integrated in this equipment are constantly being renewed.

The backbone management protocol is completely transparent to network users, the equipment offering resilient and secure TCP / IP services. Finally the backbone can be extended by adding equipment. The addition of new equipment has two consequences: ¹ The increase in the network topology. A new station appears and allows to extend the coverage of the wireless mesh network. The consolidation of the backbone insofar as the structured mesh network integrates the automatic routing functionalities and therefore makes it possible to take into account a new station as an element likely to increase the resilience of the whole. Figure 5 illustrates an extended structured mesh topology. The addition of the equipment implementing the method according to the invention also makes it possible to increase the overall bandwidth of the network. Since each piece of equipment implementing the method according to the invention builds a radio cell with a given bandwidth, an additional radio cell created by another piece of equipment implementing the method according to the invention will add the bandwidth of this cell to the total aggregate bandwidth of the network. Of course, it is necessary to ensure overlap between the radio cells of at least one pair of equipment implementing the method according to the invention so that the network mesh can be established, but this mesh operating essentially at the level ISO 3, broadcast aspects are limited to the lower layers. However, emission possibilities broadcast at ISO 3 level remain throughout the network, but these broadcast emissions are entirely controlled by the TCP / IP layer.

Client connections to the backbone, through the access layer, are also based on a point-to-point link mechanism, implying that all communications, including between clients, pass through the equipment implementing the process. according to the invention. This architecture offers the advantage of rationalizing and standardizing the network supervision mechanisms and controlling the overall security of the infrastructure. It should be noted that the additional traffic generated by the routing mechanisms between the clients remains low since the majority of the data flows generated by these wireless clients will be intended for fixed, or weakly dynamic, host centers. The overall control of the backbone is managed by a controller agent (the FilFree Mesh Controller, FMC) present in each device which uses the FMP protocol on the command channel to distribute, implement and maintain the overall network policy in real time. This functionality is a major differentiating element of the invention. The concept of global policy brings together four types of information: "Topology, quality of service and network deployment," Security, "Supervision and management, • Application and specific services The policy is dynamic and distributed information that can be divided into three levels: ¹ At the level of the company. the general rules applied to all stations "At the network level. These are the rules specific to a given network. "At the level of a sub-network. These are the rules specific to a given zone. Each level inherits the rules of the higher level when this exists. Specifics can be introduced locally in order to allow satisfactory operation of the system in the event top-level service failure or when it is not present Figure 6 illustrates the distribution of the overall network policy Each FMC agent integrates client and connection server functionality and still offers dual roles The establishment of a connection takes place as illustrated in Figure 7: "a client sends a connection request (FMPDRQ) in multiple transmission. All servers located in the client's radio cell overlay area receive this request. "On receipt of the client's request, the server performs a first check of the deployment policy and checks whether it can accept the request. If so, it sends a response to the client in targeted transmission (FMPDRS). This response contains the first level of information, essentially relating to ISO level 3, that the client will use when selecting the "best" server. A client can receive responses from multiple servers. "On receiving the response from a server, the client begins to exchange FMPBCN type messages in targeted transmission in order to characterize the radio link with this server. This exchange is initiated with each server having responded to the connection request. "Each server receiving an FMPBCN message responds with an FMPBCN message in targeted transmission, in order to characterize the radio link in a bidirectional manner. "After a limited number of FMPBCN exchanges, the client evaluates the information relating to each server. This evaluation uses a complex algorithm based on fuzzy logic which correlates the parameters measured with the deployment policy. At the end of this evaluation , if the evaluation results permit, the client sends a session creation request (FMPSRQ) in targeted transmission to the selected server. "On receipt of the client's session creation request, the server responds with a session creation response (FMPSRS) in targeted transmission to the client. After this negotiation, the authentication and encryption negotiation phase can begin.

All equipment in a structured mesh network must be authenticated before it is allowed to join the network and offer access services. This authentication and encryption represent two second-level elements of the overall deployment policy scheme and another major element differentiating from the invention. The authentication control on the backbone and the encryption management are managed by the agent present in each device using the FMP protocol on the communication channel. The principle, illustrated in Figure 8, is as follows: ¹ The client issues an authentication request which contains a specific name and a challenge. This challenge is an encryption of a password which makes it possible to avoid transferring this password directly on the network. The use of a challenge instead of a clear password is important in terms of security because the link is not yet encrypted. ¹ On receipt of the authentication request, the link server contacts the authentication server through the communication channel. This server can be local, integrated into the server equipment, or remote accessible through the LAN. "At the end of the verification of the authentication parameters, the negotiation of the encryption keys begins. One of the key points of the invention is to support different encryption keys for each of the links between devices. Unlike protocols of the type WEP described previously, the keys are unique, private and unidirectional which means that at any time the discovery of one of these keys makes it possible to hack the entire network. using a Diffie-Hellman algorithm using 4096-bit secret keys, compared to the 24-bit RC4 of WEP. "Once the keys have been synchronized, the last phase consists in assigning TCP / IP addresses to each of the connections. At this point, the point-to-point link becomes active and is automatically associated with the communication channel. It should be noted that the FMP protocol is used to establish links between devices and to maintain the state of these links using information from layers ISO 1 to ISO 3. The FMP protocol is only used to communicate and establish the state between adjacent stations through point-to-point links. This link state and routing information is distributed within the network using a convergence protocol such that each station maintains an identical view of the portion of the mesh network in which it is integrated. The role of this protocol is to: ¹ determine the routing rules between the different nodes of the mesh network, "determine the routing rules between the ends of the mesh network, notion of gateway, ¹ establish and optimize in real-time data flow routing paths through the communication channel, "to support quality of service management functions.

Another key point of the invention is to combine the two protocols, FMP and link state management, in order to ensure the convergence of the information of the mesh network, from the ISO layer 1 to the ISO layer 3. This combination opens the possibility of exploiting the unique characteristics of radio, specifically, the ability to create, destroy and adjust the physical links between the equipment and therefore optimize the topology, performance and overall reliability of the mesh network. Each piece of equipment actively participates in the consolidation of the mesh network, but also in the possibility of extending this network by adding new stations. After joining the network through the client component of its FMC agent, the equipment activates the server component of this agent in order to accept requests from other potential clients. The behavior of the FMC agent with respect to the established links is as follows: ¹ the FMP communication channel allows the exchange of encrypted data flows, ¹ once the link is established, the command channel of the

FMP is however maintained and used to exchange information on the status of the links that the equipment supports, ¹ This multidimensional information on link status is maintained in real time in each device, "Consolidated information on link status is also distributed to all equipment in order to dynamically optimize the network. "Consolidated link state information can also be collected by supervision tools such as the FilFree Mesh Manager (FMM). "The topology deployment policy is constantly evaluated to determine if and when alternative or additional links should be created," The topology optimization policy is also constantly evaluated to determine if links should be deleted.

In any radio network consisting of more than two transmitters and receivers, various methods can be used to control spectrum sharing, avoid collisions and thereby optimize the available bandwidth. The IEEE802 protocol suite is a well-known example that employs an RTS / CTS mechanism to try to solve the problem of hidden nodes in ad hoc networks. However the various techniques which trying to solve this problem at MAC / ISO 2 level are far from being effective. The FMP protocol allows additional and variable optimizations by using generic information from the physical layer to determine if, when and where links should be made or removed. This innovative approach is independent of the mechanisms implemented at MAC / ISO 2 level in the radio device itself. If the technique described in the invention based on deployment policies does not entirely eliminate the risks of packet corruption, it significantly reduces them, thereby increasing bandwidth and overall network performance. The structured mesh network architecture describes an infrastructure to which a highly dynamic component is attached. This approach eliminates the need for heavy protocols for routing data streams by broadcast transmission, which significantly contribute to packet corruption and reduce the available bandwidth. The FMP protocol uses the broadcast broadcast only for the discovery of MeshPro ™ and at a frequency which decreases exponentially according to the number of links already created. Backbone and access layers provide ISO level 3 service over a point-to-point link network, unlike wireless access points or network bridges that provide ISO level 2 services only . Thanks to this approach, the following optimizations become possible: • Topologies constructed from ISO 2 level mechanisms must exclude any possibility of loops being created. This limitation may lead to the exclusion of the use of paths which could provide a more direct connection between two stations. The radio spectrum is a precious resource and by creating an additional duplicate in the same radio cell, we divide the available bandwidth of this cell by two. By using an ISO level 3 topology above an ISO 2 point to point network of links, we eliminate topological constraints, we optimize the packet routing paths and therefore the bandwidth and spectral efficiency. • The use of conventional access points operating as ISO 2 level devices connected to a wired LAN implies that all the programs broadcast from any station in the network are propagated to all stations in the network. Cable networks use very high efficiency switches and segmentation of collision domains to minimize this problem. Unfortunately, the radio collision domain cannot be segmented in this way and even a moderate level of broadcast emission can significantly reduce the useful bandwidth of the wireless network. Here again, the use of an ISO level 3 topology makes it possible to eliminate the programs broadcast from ISO level 2 on the wireless network and not to propagate the programs broadcast from the LAN to the wireless domain. • The Microsoft network architecture still relies heavily on the NetBIOS o / TCPIP protocol and broadcast broadcast announcement mechanisms to establish connectivity in a domain or workgroup. This has a major impact on the bandwidth available to users of wireless access points. However, eliminating broadcast shows compromises the ability of PCs to connect to a network. For this reason, the invention includes a mechanism for managing NetBIOS connections which makes it possible to integrate equipment. wirelessly to Microsoft networks without loss of bandwidth caused by the use of broadcast programming. The following points must be taken into account concerning the applicability, the use and the efficiency of the invention: ¹ Each wireless mesh network is typically composed of a group of equipment of the order of ten rather than a hundred. "Each wireless mesh network must be relatively stable in terms of the number of devices that connect or disappear. The technology described by the invention does not resemble that of systems such as mobile telephony." The frequency of modifications of the topology due to the appearance or disappearance of equipment must be of the order of a few seconds rather than fraction of a second for the same reasons as the previous point. "The dynamics of the network are largely linked to those of the access layer." No element connected through the access layer must contribute to the routing of data flows through the network. "The network architecture described by the invention may require the use of multiple deployment areas, multiple user domains, or multiple security perimeters." Centralized or distributed security management methods may be required.

The network architecture described by the invention is distinct from typical wireless environments and so-called "ad hoc" networks, although some aspects of both scenarios be used. This architecture is typically adapted in scenarios where the availability of services and where the aspects of security, control and characterized environment are paramount. Such possibilities are generally associated with fixed wireless systems, but the structured mesh network approach of the invention makes it possible to benefit from these advantages while integrating more dynamic environments. On the other hand, ad hoc wireless networks are generally considered to have a significant dynamic, with optimized methods of routing data flows allowing establishment times of the order of a second. Such possibilities are ideal for short-term scenarios, but ensuring availability and performance in such a context is very problematic. By definition, such networks are "ad hoc", and require a large deployment autonomy, unlike the structured approach of the invention in which deployment and operating policies can be imposed.

The wireless structured mesh network architecture has the ability to operate independently of any wired infrastructure, but also to extend, integrate or merge with wired LAN networks. Several network topologies are supported and can be deployed. Connections between devices can only be made within the same zone. A simple contiguous network functionally equivalent to a wireless LAN is created. Figure 9 depicts a simple stand-alone unpartitioned network. Gateway equipment performs two functions: "It typically provides connectivity between the wireless mesh network and an external network such as the Internet. This connectivity can be varied such as ADSL, ISDN, Ethernet LAN etc." This gateway equipment represents the

“Root” of the network and must be present before the wireless mesh network can be created. Multiple gateways can be used to build resilience, however direct connectivity between these gateways must be ensured. Unpartitioned networks (like those in Figure 10) offer security and simplified management benefits, but they require the construction of a contiguous wireless network. The connections between devices are made within the same logical zone, but partitioning is authorized. This configuration has the effect of reducing determinism as well as the level of security and ease of network management. If an item of equipment from one partition manages to join the radio cell of an item of equipment belonging to another partition, then the two partitioned networks can be combined into a single contiguous network. Multi-zone networks (as in Figure 11) are completely independent and behave like separate networks. In this scenario, it is impossible for the equipment in zone 1 to connect to the equipment in zone 2, even if the radio cells of these equipment overlap. Each network has its own security perimeter and users in one zone will not be able to access resources in the other zone. It becomes possible to create completely independent networks in the same building or even in the same physical perimeter. These separate networks can however communicate via their respective gateway or by using the connected multi-zone configuration.

In the multi-zone network scenario connected (Figure 12), two independent zones are interconnected directly or indirectly through a shared zone. In both cases, the gateways exist simultaneously in each zone, respectively the “private” zone (zone # 1 or zone # 2 in the example below) and the shared zone. When a gateway is connected in multi-zone mode, a security perimeter is built at the intersection of the two zones without compromising the security of either of the private zones. This topology offers the capacity to establish a global infrastructure while making it possible to establish secure private sub-infrastructures. The independent zones can connect securely to this global infrastructure through their respective gateways. It becomes possible to create completely independent subnets in the same building or even in the same physical perimeter which possibly share the resources of the shared area without compromising the security or the integrity of its private resources. The extensibility and flexibility of this topology is a fundamental characteristic of the invention.

The present invention also relates to a new method for securing a wireless network allowing the secure distribution of the data routed. This method includes a new communication protocol between the members of the network as well as authentication mechanisms. When used, this process provides advantages in terms of data security and integrity and verification of the use of this network. The current technology of wireless networks poses many security and integrity of the data exchanged. The invention makes it possible to solve these problems in an innovative way. Current wireless network technologies and more particularly WLAN and Wifi adopt the IEEE 802.11 standard suite. This standard mainly defines a method of access, or connectivity, wirelessly to a wired network. We generally speak of access points (AP). An access point is a wireless transmitter that allows wireless connection to a wired LAN type network. An access point manages this connection in such a way that clients of the wired network and clients of the wireless network have the illusion of being members of the same network. There are two operating modes: the so-called "Infrastructure" mode and the "Ad hoc" mode. In "Infrastructure" mode, each station is linked to a base station which acts as a bridge between the wired network and the wireless clients. If several base stations are connected to the same wired network, the wireless client can freely switch from one station to another. The standard configuration parameters are as follows: "All devices must be put in" Infrastructure "mode. ¹ All clients must use the same network name (SSID parameter)." All access points must use the same name network (ESSID parameter). "All stations must use the same encryption key (WEP parameter) or no key. You must choose the channels used by each access point. Clients will automatically connect to the nearest access point. For the assignment of TCP / IP addresses, you can either use the DHCP service if it exists on the wired network or assign TCP / IP addresses as if the extension is part of the wired network.

The "Ad Hoc" mode allows you to create mobile workgroups without a base station. The machines directly exchange messages with each other. The configuration constraints are as follows: "All clients must be put in" Ad Hoc "mode." All clients must use the same network name (SSID parameter). "All clients must use the same encryption key (WEP parameter) or no key. ^U All clients must use the same communication channel.

The connection to the wireless network is made at ISO level 3. Each wireless interface has a TCP / IP address which can be assigned at the time of configuration (fixed TCP / IP address) or by a DHCP service available on the wired network. In order to guarantee the correct routing of data, each station must be assigned a different TCP / IP address in the same subnet. The data encryption method is called WEP. This mechanism has many weaknesses. WEP uses the RC4 coding algorithm which uses the same key to encrypt and decrypt packets, this key can be 40 to 128 bits. The weaknesses of this protocol and the key exchange mechanisms are such that a Hacker can decrypt a message by scanning the equivalent of about five hours of data transmission. In addition, the WEP coding key manager can reuse the same keys cyclically, it becomes possible to analyze network traffic and correlate the data to the keys used, which then makes it possible to break the codes. These hacking techniques are just as effective on 40-bit RC4 encodings as on 128-bit ones. Finally, the authentication mechanisms are not based on mutual authentication. An object of the present invention is to provide a method for securing wireless networks which is independent of the mechanisms integrated in WLAN equipment. This process, by extension, can be applied not only to Wifi / 802 type equipment. 11 but also to any network equipment which respects the ISO model.

Another object of the invention is to use one. high reliability data encryption method between each node of the wireless network.

Another object of the invention is to use different encryption keys for each node of the wireless network. These goals are achieved by using a protocol for creating links between network nodes adapted to the constraints of wireless networks. This specific invention protocol (FMP) includes at least one algorithm for discovering adjacent nodes and at least one algorithm for controlling link creation. These aims are achieved by the use of a method which does not use the WEP encryption mechanism but a method of encrypting the data packets which pass through the wireless interface. These goals are achieved by using the wireless interface at ISO 2 level without it having a TCP / IP address. These goals are achieved by using a point-to-point protocol (PPP) to create connectivity at ISO level 3 (TCP / IP). The TCP / IP address is assigned only after the station wishing to connect has been authenticated. These aims are achieved by the use of a method for exchanging encryption keys between the nodes of the network. This method includes at least one encryption key exchange algorithm. These aims are achieved by the use of an encryption method of the data packets exchanged between the nodes of the network. This method includes at least one data encryption algorithm using private keys. The mechanism for exchanging data packets is shown in Figure 13. This figure describes a secure connection between two stations. This process is then extended to all the connections of the stations of the wireless network which participate in the network.

The operation of the process is as follows

• PHYSICAL access

PHYSICAL connectivity is provided by the wireless interface. The following parameters are assigned: "All clients must be put into Mode" Ad

Hoc "." All clients must use the same communication channel. "All clients must use the same network name (SSID setting)." Not all clients must use an encryption key (WEP setting).

• LINK access

Links are created at this level using the FMP protocol. This protocol describes a creation process, the operation of which, illustrated in FIG. 14, is as follows

"A client transmits a connection request (FMPDRQ) in multiple transmission. All stations located in the client's radio cell overlap area receive this request. ¹ On receipt of the client's request, the station checks whether it can accept the request. If yes, it sends a response to the client in targeted transmission (FMPDRS). "On receipt of the FMPDRS response, the client begins to exchange messages of type FMPBCN in targeted transmission in order to characterize the link. This exchange is initiated with each server that responded to the connection request. "Each server receiving an FMPBCN message responds with an FMPBCN message in targeted transmission, in order to characterize the link bidirectionally." After a limited number of FMPBCN exchanges, the client evaluates the information relating to each station. At the end of this evaluation, if the result of the evaluation allows, the client sends a session creation request (FMPSRQ) in targeted transmission to the selected station. "On receipt of the session creation request from the client, the server responds with a session creation response (FMPSRS) in targeted transmission to the client. At the end of this negotiation, the level 3 creation phase through the PPP protocol as well as authentication and encryption negotiation can begin.

Key exchanges and packet encryption are implemented as described above.

The invention is described in the foregoing by way of example. It is understood that a person skilled in the art is able to carry out different variants of the invention without going beyond the scope of the patent.

Claims

1 - Method for implementing a wireless local area network architecture for digital data exchange comprising a plurality of devices each comprising client resources and server resources as well as means for interconnecting said devices by mesh, characterized in that said method comprises steps for defining network deployment rules, and steps for applying these rules at the time of each creation of a connection between a client resource of an equipment and a server resource of a other equipment from said local network. 2 - Method for implementing a wireless local area network architecture according to claim 1, characterized in that said rules are hierarchically distributed at several levels, each of said levels comprising sufficient resources for its operation.

3 - Method for implementing a wireless local area network architecture according to claim 1 or 2, characterized in that said exchanges of digital data are secure thanks to specific encryption means and independent of the radio protocol used.

4 - Method for implementing a wireless local area network architecture according to at least one of the preceding claims, characterized in that the wireless network implements a standard of the 802.11, BlueTooth or DECT type.

5 - Method for implementing a wireless local area network architecture according to at least one of the preceding claims, characterized in that it further comprises steps for supervising said data exchanges and the traffic of said digital data.

6 - Method for implementing a wireless local area network architecture according to at least one of the preceding claims, characterized in that it also comprises steps for optimizing the network structure in real time, these steps to guarantee the quality of service of said network.

7 - Method for implementing a wireless local area network architecture according to at least one of the preceding claims, characterized in that it further comprises a step of integrating at least one new piece of equipment, this integration allowing to extend the network coverage and being carried out by implementing said deployment rules.

8 - Local network architecture for the implementation of the method according to at least one of the preceding claims.