Patent Description:
In mesh networks, one or more nodes communicate using one more communication media, such as various wired connections (e.g., Ethernet, power line communication (PLC), or the like) and/or wireless connections (e.g., WiFi®, Bluetooth®, radiofrequency (RF) communication, or the like). Many such mesh networks are self-organized as peer-to-peer networks, in which connections are established in response to the nodes discovering one another rather than based on a predefined topology or a centralized server. The document <CIT> (<NUM>/<NUM>/<NUM>), focuses on enhancing group messaging in distributed systems, particularly emphasizing anonymity in group communications.

So that the manner in which the features of the various embodiments can be understood in detail, a description of the inventive concepts may be had by reference to various embodiments, some of which are illustrated in the appended drawings. It is to be noted, however, that the appended drawings illustrate only typical embodiments of the inventive concepts and are therefore not to be considered limiting of scope in any way, and that there are other equally effective embodiments.

In the following description, numerous specific details are set forth to provide a more thorough understanding of the various embodiments. However, it will be apparent to one of skilled in the art that the inventive concepts may be practiced without one or more of these specific details.

In some mesh networks, nodes of the mesh network execute one or more agents, such as one or more software applications that provide various services. For example, in an infrastructure including power meters that are nodes in a mesh network and that measure power supplied to various consumers, agents executing on these power meters can measure power delivered by the power meter over a period and can communicate the information to other nodes for aggregation and transmission to a power utility or provider. The agents can gather information on behalf of various consumers (e.g., various consumers of power delivery services) and/or can collect, receive, and/or transmit various types of information (e.g., power consumption information and/or consumer information). In various embodiments, a given node can operate a communication interface that transmits data on behalf of the agents executing on the node and/or receives information from agents executing on other nodes. Further, the communication interface of one or more nodes can transmit data to and/or from the power utility or provider.

One challenge with these mesh networking scenarios is the distribution of the information. As a first example, a node can request delivery of a message including sensitive data, such as the identities of consumers and/or resource consumption information. If the communication interface were to broadcast the message to all other nodes of the mesh network, the message could be inadvertently transmitted to nodes and/or agents that should not have access to the sensitive information. That is, a broadcast message may be inappropriate for the transmission of various types of data or information. As a second example, an agent can request delivery of a message to other agents that are associated with different consumers. If the communication interfaces of the nodes transmit the message to the other nodes, communication can occur between agents that should not be permitted to communicate (e.g., the power meter at Consumer A's house receives billing information from Consumer B's power meter). As a third example, an agent can request delivery to a particular group of agents, such as all agents that are associated with the same entity (e.g., all agents that are associated with a particular utility company). In order to fulfill this request, the agent and/or communication interface might need to keep track of which other agents are part of the group. Tracking the membership of groups can require additional communication among the nodes. In various embodiments, the nodes communicate over communication media with limited bandwidth, and limiting the number of exchanged messages can conserve bandwidth that can be used for other messages. Further, in some embodiments, nodes operate using battery power, and the exchange of additional messages regarding group membership of agents can reduce the battery life of the nodes.

As discussed below, one solution to the above challenges is to execute a messaging application on the nodes of the mesh network. In various embodiments, the messaging application is operable to receive a request from an agent executing on the first node to join a message group; verify that a policy permits the agent to join the message group; add the agent to the message group; receive, from the agent, content for a message for the message group; and transmit the message to a second messaging application of a second node of the mesh network for delivery to an agent that is executing on the second node and that is included in the message group.

Additionally, in various embodiments, the messaging application is operable to receive a request from an agent executing on the first node to join a message group; verify that a policy permits the agent to join the message group; add the agent to the message group; receive, from a second messaging application executing on a second node of the mesh network, a message for the message group; and deliver content from the message to the agent.

Moreover, in various embodiments, the messaging application is operable to receive content for a first message from an agent executing on the node, the first message being for a first message group; and transmits a composite message to a second node of the mesh network, the composite message including the first message for the first message group and a second message for a second message group.

Furthermore, in various embodiments, the messaging application is operable to obtain a request from an agent executing on the node to join a first message group; determine whether the agent is permitted, by a policy, to join the first message group; in response to determining that the agent is permitted, by the policy, join the first message group, subscribe the agent to the first message group; obtain a first message from the agent, wherein the first message is to be provided to one or more agents that are to the first message group; and send the first message to a second messaging application of another node of the mesh network to be provided to one or more agents that are subscribed to the first message group.

Further embodiments provide, among other things, a system and a non-transitory computer-readable medium configured to implement one or more of the methods set forth above.

At least one technical advantage of the disclosed techniques is that, with the disclosed techniques, nodes are able to manage the transmitting and receiving of messages among agents executing on the nodes by associating the agents with message groups so that only the agents that are permitted to receive messages. Additionally, the disclosed techniques allow nodes to manage the associations between agents and message groups in a decentralized manner. The decentralization reduces the overhead and improves the reliability of the mesh network. Additionally, the disclosed techniques allow nodes to transmit multiple message in one composite message, which reduces the time, bandwidth, and power required to transmit messages among the nodes for delivery to the message groups.

<FIG> illustrates an example of a computer system <NUM>, according to various embodiments. As shown in <FIG>, computer system <NUM> includes, without limitation a node <NUM>-<NUM> and a node <NUM>-<NUM> coupled together via a communication medium <NUM>. As discussed in additional detail in reference to <FIG> and <FIG>, in various embodiments node <NUM>-<NUM> and node <NUM>-<NUM> are nodes of a mesh network that are operable to communicate with each other and with other nodes in the mesh network via communication medium <NUM>. Node <NUM>-<NUM> includes, without limitation, an agent <NUM>-<NUM> and a messaging application <NUM>-<NUM>. Node <NUM>-<NUM> includes, without limitation, an agent <NUM>-<NUM> and a messaging application <NUM>-<NUM>. According to the techniques discussed in greater detail below in <FIG>, Agent <NUM>-<NUM> uses messaging application <NUM>-<NUM> to send messages to and receive messages from other agents operating on other nodes of computing system <NUM>, such as agent <NUM>-<NUM>. Similarly, agent <NUM>-<NUM> uses messaging application <NUM>-<NUM> to send messages to and receive messages from agents operating on other nodes of computing system <NUM>, such as agent <NUM>-<NUM>. The various messaging applications <NUM> transmit the messages to the messaging applications <NUM> on other nodes <NUM> in computing system <NUM> using communication medium <NUM>.

<FIG> illustrates an example messaging flow diagram showing messaging among agents of a mesh network, according to various embodiments. Although the interactions between the two nodes are shown in an order, persons skilled in the art will understand that the interactions may be performed in a different order, interactions may be repeated or skipped, and/or may be performed by components other than those described in <FIG>.

As shown in <FIG>, two nodes <NUM>-<NUM>, <NUM>-<NUM> of a mesh network are connected by communication medium <NUM>. The communication medium <NUM> can be, for example, a wired connection (e.g., an Ethernet connection or a power line communication connection) or a wireless connection (e.g., a WiFi® connection or a Bluetooth® connection). Although not shown, the nodes <NUM>-<NUM>, <NUM>-<NUM> can be in communication with other nodes of the mesh network by the same communication medium <NUM> or different communication media. As shown, each node <NUM>-<NUM>, <NUM>-<NUM> respectively executes at least one agent <NUM>-<NUM>, <NUM>-<NUM>, respectively, that performs functions such as (without limitation) monitoring, analyzing, collecting, storing, transmitting, and/or receiving data. Also, each node <NUM>-<NUM>, <NUM>-<NUM> respectively executes a messaging application <NUM>-<NUM>, <NUM>-<NUM> that enables the nodes <NUM>-<NUM>, <NUM>-<NUM> to exchange messages with each other and, optionally, with other nodes <NUM> of the mesh network.

Messaging application <NUM>-<NUM> executing on node <NUM>-<NUM> receives, from agent <NUM>-<NUM>, a request <NUM>-<NUM> to join a message group. In various embodiments, the message group includes a specific set of agents <NUM> executing on various nodes <NUM> that exchange messages, such as agents <NUM> that provide a utility on behalf of a client or that measure a use of the utility by the particular client. As an example, the message group can be limited to agents <NUM> that are associated with the particular client and can exclude agents <NUM> that are not associated with the particular client. Alternatively or additionally, in various embodiments, the message group includes an exchange of messages including a specific type of data, such as messages exchanged by a set of agents <NUM> involving data that is associated with a particular client and excludes other types of data that are associated with other clients.

In response to the request <NUM>-<NUM> to join the message group, messaging application <NUM>-<NUM> performs a step <NUM>-<NUM> of verifying that a policy permits agent <NUM>-<NUM> to join the message group. In various embodiments, the policy indicates one or more criteria of agents <NUM> that are permitted to join the message group. If the messaging application <NUM>-<NUM> determines that the policy permits agent <NUM>-<NUM> to join the message group, the messaging application <NUM>-<NUM> performs a step <NUM>-<NUM> of adding the agent <NUM>-<NUM> to the message group. In various embodiments, the messaging application <NUM>-<NUM> updates a list stored by the messaging application <NUM>-<NUM> that indicates the agents <NUM> executed on the node <NUM>-<NUM> that are included in the message group. If the messaging application <NUM>-<NUM> determines that the policy does not permit agent <NUM>-<NUM> to join the message group, the messaging application <NUM>-<NUM> refrains from adding agent <NUM>-<NUM> to the message group.

After being added or subscribed to the message group, agent <NUM>-<NUM> performs a step <NUM> of providing, to messaging application <NUM>-<NUM>, content for a message for the message group. Messaging application <NUM>-<NUM> performs a step <NUM> of receiving the content for the message from the agent <NUM>-<NUM>. Messaging application <NUM>-<NUM> performs a step <NUM> of transmitting the message from node <NUM>-<NUM> to node <NUM>-<NUM> via the communication medium <NUM> as a message <NUM>.

In various embodiments, node <NUM>-<NUM> includes one or more agents <NUM> that generate content for messages for the message group and do not receive delivery of messages for the message group. In various embodiments, node <NUM>-<NUM> includes one or more agents <NUM> that receive delivery of messages for the message group. In various embodiments, at least one agent <NUM> is included in two or more message groups. In various embodiments, at least one node <NUM> includes an agent <NUM> that is not included in any message group.

While not shown in <FIG>, in various embodiments, messaging application <NUM>-<NUM> transmits the message <NUM> by enqueuing the message <NUM> in a mailbox (e.g., a mailbox <NUM> in reference to <FIG>). The messaging application <NUM>-<NUM> can dequeue one or more messages <NUM> enqueued in the mailbox and transmit the dequeued one or more messages <NUM> to one or more other nodes <NUM> of the mesh network.

While not shown in <FIG>, in various embodiments, messaging application <NUM>-<NUM> can verify that the policy (e.g., a policy <NUM> in reference to <FIG>) permits the message <NUM> to be transmitted to the message group. If agent <NUM>-<NUM> is not permitted, by the policy, to send the message <NUM> to the message group, the messaging application <NUM>-<NUM> refrains from transmitting the message <NUM> to the second node <NUM>-<NUM>.

While not shown in <FIG>, in various embodiments, rather than transmitting the message <NUM> in plaintext, messaging application <NUM>-<NUM> transmits to messaging application <NUM>-<NUM> an encrypted message, such as a cryptographically encoded message in which the content for the message is encrypted with a cryptographic key that is associated with the message group. Messaging application <NUM>-<NUM> can encrypt the content for the message with the cryptographic key that is associated with the message group. Messaging application <NUM>-<NUM> can decrypt the encrypted message <NUM> with the cryptographic key that is associated with the message group to generate the content for the message for delivery. Various examples of cryptographic techniques that may be employed in various embodiments are discussed herein in reference to <FIG> and <FIG>.

Messaging application <NUM>-<NUM> executing on node <NUM>-<NUM> receives, from agent <NUM>-<NUM>, a request <NUM>-<NUM> to join the same message group. In response to the request <NUM>-<NUM>, messaging application <NUM>-<NUM> performs a step <NUM>-<NUM> of verifying that a policy permits agent <NUM>-<NUM> to join the message group. If the messaging application <NUM>-<NUM> determines that the policy permits agent <NUM>-<NUM> to join the message group, the messaging application <NUM>-<NUM> performs a step <NUM>-<NUM> of adding or subscribing the agent <NUM>-<NUM> to the message group. In various embodiments, the messaging application <NUM>-<NUM> updates a list stored by the messaging application <NUM>-<NUM> that indicates the agents <NUM> executed on the node <NUM>-<NUM> that are included in the message group. If the messaging application <NUM>-<NUM> determines that the policy does not permit agent <NUM>-<NUM> to join the message group, the messaging application <NUM>-<NUM> refrains from adding or subscribing agent <NUM>-<NUM> to the message group.

Messaging application <NUM>-<NUM> performs a step <NUM> of receiving the message <NUM> transmitted by messaging application <NUM>-<NUM> via the communication medium <NUM>. The messaging application <NUM>-<NUM> perform a step <NUM> of delivering the message <NUM> to the agent <NUM>-<NUM> that has been added or subscribed to the message group.

While not shown, in various embodiments, messaging application <NUM>-<NUM> can verify that the policy permits delivery of the message <NUM> to the message group. The messaging application <NUM>-<NUM> performs the step <NUM> of delivering the content from the message <NUM> to the agent <NUM>-<NUM> only after verifying that the policy permits the message <NUM> to be delivered to the agent <NUM>-<NUM>. Alternatively or additionally, while not shown, in various embodiments, messaging application <NUM>-<NUM> transmits, and messaging application <NUM>-<NUM> receives, an encrypted message <NUM> in which the content from the message <NUM> has been encrypted with a cryptographic key that is associated with the message group, and the messaging application <NUM>-<NUM> decrypts the encrypted message using the cryptographic key in order to deliver the content from the message <NUM> to the agent <NUM>-<NUM>.

While not shown, in various embodiments, messaging application <NUM>-<NUM> receives a request from agent <NUM>-<NUM> to create a message group, and in response, the messaging application <NUM>-<NUM> creates the message group. Messaging application <NUM>-<NUM> can also add or subscribe agent <NUM>-<NUM> to the created message group without requiring a separate request <NUM>-<NUM> from agent <NUM>-<NUM> to join the created message group. Messaging application <NUM>-<NUM> can verify that a policy permits agent <NUM>-<NUM> to create the message group. In response to a determination that the policy does not permit agent <NUM>-<NUM> to create the message group, messaging application <NUM>-<NUM> can refrain from creating the message group.

<FIG> illustrates another example messaging flow diagram showing messaging among agents of a mesh network, according to various embodiments. Although the interactions between the two nodes are shown in an order, persons skilled in the art will understand that the interactions may be performed in a different order, interactions may be repeated or skipped, and/or may be performed by components other than those described in <FIG>. In various embodiments, at least some portions of the messaging flow diagram of <FIG> are used in combination with the messaging flow diagram of <FIG>. Alternatively or additionally, in various embodiments, at least some portions of the messaging flow diagram of <FIG> are used in combination with the messaging flow diagram of <FIG>.

As shown in <FIG>, two nodes <NUM>-<NUM>, <NUM>-<NUM> of a mesh network are connected by communication medium <NUM>. The communication medium <NUM> can be, for example, a wired connection (e.g., an Ethernet connection or a power line communication connection) or a wireless connection (e.g., a WiFi® connection or a Bluetooth® connection). Although not shown, the nodes <NUM>-<NUM>, <NUM>-<NUM> can be in communication with other nodes of the mesh network by the same communication medium <NUM> or different communication media. Node <NUM>-<NUM> executes two agents <NUM>-<NUM>, <NUM>-<NUM>, and node <NUM>-<NUM> executes an agent <NUM>-<NUM>, wherein the agents perform functions such as (without limitation) monitoring, analyzing, collecting, storing, transmitting, and receiving data. At least agent <NUM>-<NUM> is associated with a first message group. Also, each node <NUM>-<NUM>, <NUM>-<NUM> respectively executes a messaging application <NUM>-<NUM>, <NUM>-<NUM> that enables the nodes <NUM>-<NUM>, <NUM>-<NUM> to exchange messages with each other and, optionally, with other nodes <NUM> of the mesh network.

Agent <NUM>-<NUM> performs a step <NUM>-<NUM> of providing, to messaging application <NUM>-<NUM>, content for a first message for a first message group. Messaging application <NUM>-<NUM> performs a step <NUM> of receiving the content for first message. In various embodiments, agent <NUM>-<NUM> is included in the first message group, or at least is permitted, by a policy, to send messages to the first message group. Alternatively or additionally, in various embodiments, the content for the first message includes data that is permitted, by a policy, to be delivered to the first message group.

Agent <NUM>-<NUM> performs a step <NUM>-<NUM> of providing, to messaging application <NUM>-<NUM>, content for a second message to a second message group. Messaging application <NUM>-<NUM> performs a step <NUM> of receiving the content for the second message. In various embodiments, agent <NUM>-<NUM> is included in the second message group, or at least is permitted, by a policy, to send messages to the second message group. Alternatively or additionally, in various embodiments, the content for the second message includes data that is permitted, by a policy, to be delivered to the first message group.

Messaging application <NUM>-<NUM> performs a step <NUM> of transmitting a composite message <NUM> to node <NUM>-<NUM> via the communication medium <NUM>. The composite message includes the first message for the first message group and the second message for the second message group.

While not shown, in various embodiments, messaging application <NUM>-<NUM> performs a step of verifying that agent <NUM>-<NUM> is permitted, by a policy, to send the first message to the first message group. If agent <NUM>-<NUM> is not permitted, by the policy, to send the first message to the first message group, the messaging application <NUM>-<NUM> refrains from including the first message in the composite message <NUM> and refrains from transmitting the first message to another node <NUM> of the mesh network. Similarly, in various embodiments, messaging application <NUM>-<NUM> performs a step of verifying that agent <NUM>-<NUM> is permitted, by a policy, to send the second message to the second message group. If agent <NUM>-<NUM> is not permitted, by the policy, to send the second message to the second message group, the messaging application <NUM>-<NUM> refrains from including the second message in the composite message <NUM> and refrains from transmitting the second message to another node <NUM> of the mesh network.

Messaging application <NUM>-<NUM> performs a step <NUM> of receiving the composite message <NUM> from node <NUM>-<NUM> via the communication medium <NUM>. Messaging application <NUM>-<NUM> performs a step <NUM> of delivering the content from the first message included in the composite message <NUM> to the agent <NUM>-<NUM>, which is associated with the first message group. While not shown, in various embodiments, messaging application <NUM>-<NUM> verifies that the agent <NUM>-<NUM> is permitted, by a policy, to receive the first message. If the messaging application <NUM>-<NUM> determines that agent <NUM>-<NUM> is not permitted, by a policy, to receive the first message, the messaging application <NUM>-<NUM> refrains from delivering the content from the first message to agent <NUM>-<NUM>.

Messaging application <NUM>-<NUM> performs a step <NUM> of delivering the content from the second message included in the composite message <NUM> to the agent <NUM>-<NUM>, which is associated with the second message group. While not shown, in various embodiments, messaging application <NUM>-<NUM> can deliver the content from the second message to another agent <NUM> that is executing node <NUM>-<NUM> and that is associated with the second message group. While not shown, in various embodiments, messaging application <NUM>-<NUM> verifies that the agent <NUM>-<NUM> is permitted, by a policy, to receive the second message. If the messaging application <NUM>-<NUM> determines that agent <NUM>-<NUM> is not permitted, by a policy, to receive the second message, the messaging application <NUM>-<NUM> refrains from delivering the content from the second message to agent <NUM>-<NUM>.

While not shown, in various embodiments, rather than including the content for the first message in plaintext, the composite message <NUM> includes a first encrypted message that includes the content for the first message as encrypted by a cryptographic key that is associated with the first message group. Messaging application <NUM>-<NUM> can extract the first encrypted message from the composite message and decrypt the first encrypted message with the cryptographic key that is associated with the first message group to generate the content for the first message for delivery to the agents <NUM> in the first message group. Similarly, in various embodiments, rather than including the content for the second message in plaintext, the composite message <NUM> includes a second encrypted message that includes the content for the second message as encrypted by a cryptographic key that is associated with the second message group. Messaging application <NUM>-<NUM> can extract the encrypted message from the composite message and decrypt the encrypted message with the cryptographic key that is associated with the second message group to generate the content for the second message for delivery to the agents <NUM> in the second message group. Examples of composite message <NUM> and various cryptographic operations that may be used to generate and interpret composite messages <NUM> are discussed in further detail in reference to <FIG> and <FIG>.

As previously discussed, in various embodiments, a messaging application <NUM> receives a request from an agent <NUM> to create a message group, and in response, the messaging application <NUM> creates the message group. The messaging application <NUM> can also add or subscribe the agent <NUM> to the created message group without requiring a separate request <NUM> from the agent <NUM> to join the created message group. A messaging application <NUM> can verify that a policy permits the agent <NUM> to create the message group. In response to a determination that the policy does not permit the agent <NUM> to create the message group, the messaging application <NUM> can refrain from creating the message group.

In various embodiments, the policy used by the first messaging application <NUM>-<NUM> is indicated by a policy file that is stored by the first node <NUM>-<NUM> and accessible to the first messaging application <NUM>-<NUM>. The policy file can be associated with the first agent <NUM>-<NUM>. Alternatively or additionally, in various embodiments, the policy used by the second messaging application <NUM>-<NUM> is indicated by a policy file that is stored by the second node <NUM>-<NUM> and accessible to the second messaging application <NUM>-<NUM>. The policy file can be associated with the second agent <NUM>-<NUM>.

In various embodiments, the policy used by at least one of the messaging applications <NUM>-<NUM>, <NUM>-<NUM> includes one or more permissions, such as a permission of an agent <NUM> to create message group of a message group type, a permission of an agent <NUM> to join one or more message groups, a permission of the agent <NUM> to receive messages for one or more message groups, and/or a permission of an agent <NUM> to transmit messages to one or more message groups. The policy can include one or more rules, wherein each rule includes one or more permissions and one or more criteria by which a messaging application <NUM> determines whether an agent <NUM> is granted the permission.

In various embodiments, a rule of the policy includes a permission to create a message group and a criterion that indicates one or more message group types of message groups that can be created. For example (without limitation), the message group type can include a message group that is associated with a particular client or a message group in which exchanged messages include a particular type of data or information. The messaging application <NUM> can determine whether a particular agent <NUM> can create a message group based on whether the requested message group includes a message group type that is indicated by the criterion.

In various embodiments, a rule of the policy includes a permission to join a message group and a criterion that indicates an association between the agent <NUM> and a client. The messaging application <NUM> determines whether a particular agent <NUM> can join the message group based on whether the particular agent <NUM> is included in an association with the client, as indicated by the criterion. For example (without limitation), the messaging application <NUM> can determine whether an identifier of the particular agent <NUM> is included in a list of agents <NUM> that are associated with the client. Alternatively or additionally, the messaging application <NUM> can determine whether the particular agent <NUM> is permitted to join message groups that are of a particular message group type that is associated with the message group that the particular agent <NUM> has requested to join. Alternatively or additionally, the messaging application <NUM> can contact the client to request verification that the particular agent <NUM> is associated with the client.

In various embodiments, a rule of the policy includes a permission to deliver messages to a message group and a criterion that indicates a type of data or information included in a message that can be delivered to the message group. The messaging application <NUM> determines whether a particular message can be delivered to the message group based on whether the particular message includes data of the type of data or information indicated by the criterion, and/or based on whether the particular message includes any data that is not of the type of data or information indicated by the criterion.

In various embodiments, a messaging application <NUM> encrypts, with a cryptographic key, both the content for a message and additional data. For example (without limitation), the messaging application <NUM> can generate random data, prepend and/or append the random data to the content for the message, and encrypt both the content for the message and the random data together with the cryptographic key. Alternatively or additionally, the messaging application <NUM> can prepend and/or append to the content for the message a timestamp that is associated with the content for the message and/or the composite message <NUM>. Including additional data in the encryption of the content for the message can ensure that an encryption of two identical sets of content results in two different encrypted messages. Additionally, when another messaging application <NUM> decrypts the encrypted message with a cryptographic key, the messaging application <NUM> can separate the content for the message from the prepended and/or appended additional data that is in the decrypted message. The messaging application <NUM> can discard the additional data and deliver the decrypted content for the message to one or more agents <NUM>.

In various embodiments, a messaging application <NUM> encrypts the content for a message with a cryptographic key based on an encryption initialization vector. For example (without limitation), the messaging application <NUM> can generate the initialization vector for a composite message <NUM> and can initialize a cryptographic function with the encryption initialization vector. When the cryptographic function is initialized using different encryption initialization vectors, the cryptographic function generates different encrypted messages from the same content. The messaging application <NUM> can encrypt the content for one or more messages based on a cryptographic function that has been initialized using the encryption initialization vector. The messaging application <NUM> can include the encryption initialization vector in the composite message <NUM>. Additionally, when another messaging application <NUM> receives a composite message <NUM>, the messaging application <NUM> can extract the encryption initialization vector from the composite message <NUM>, initialize the cryptographic function with the encryption initialization vector. The messaging application <NUM> can then decrypt one or more encrypted messages from the composite message <NUM> using the cryptographic function that has been initialized using the same encryption initialization vector by which the encrypted messages of the composite message <NUM> was generated.

<FIG> illustrates an example of messaging <NUM>-<NUM> among nodes of a mesh network by messaging applications, according to various embodiments. And although <FIG> is described using the messaging applications <NUM>-<NUM>, <NUM>-<NUM> of <FIG>, any other technically feasible messaging application capable of performing the described operations can be used. Some elements shown in <FIG> can be interchanged with like numbered elements from other figures.

As shown, the messaging includes one-to-one unicast messaging between an agent <NUM>-<NUM> executed by a first node <NUM>-<NUM> of the mesh network and a message group <NUM> including a plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by a second node <NUM>-<NUM> of the mesh network. Agent <NUM>-<NUM>, executed by a first node <NUM>-<NUM> of the mesh network, generates content for a message <NUM> for the message group <NUM>. Agent <NUM>-<NUM> provides the content for the message <NUM> to a messaging application <NUM>-<NUM> executed by the first node <NUM>-<NUM>. Messaging application <NUM>-<NUM> transmits the content for the message <NUM>, via the communication medium <NUM>, to a messaging application <NUM>-<NUM> executing on the second node <NUM>-<NUM> of the mesh network. The second node <NUM>-<NUM> delivers the content from the message <NUM> to the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> that are included in the message group <NUM>.

The messaging <NUM>-<NUM> shown in <FIG> enables the agent <NUM>-<NUM> executed by the first node <NUM>-<NUM> to send the content for the message <NUM> to the message group <NUM> including the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by the second node <NUM>-<NUM>. In various embodiments, the messaging <NUM>-<NUM> shown in <FIG> enables the agent <NUM>-<NUM> and the node <NUM>-<NUM> to transmit, to the second node <NUM>-<NUM>, the content for the message <NUM> to each of the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by the second node <NUM>-<NUM>, instead of requiring the agent <NUM>-<NUM> to transmit a copy of the content for the message <NUM> to each of the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>. As a result, the messaging <NUM>-<NUM> shown in <FIG> reduces communication overhead in transmitting the content for the message <NUM> to a message group <NUM> in one-to-one unicast messaging scenarios. Alternatively or additionally, in various embodiments, the messaging <NUM>-<NUM> shown in <FIG> enables the agent <NUM>-<NUM> to address the content for the message <NUM> to the message group <NUM>, rather than to each of the agents <NUM> included in the message group <NUM>. As a result, the messaging <NUM>-<NUM> shown in <FIG> reduces communication overhead in one-to-one unicast messaging scenarios that would otherwise be required to inform agent <NUM>-<NUM> of each of the agents <NUM> that are included in the message group <NUM>, so that agent <NUM>-<NUM> could individually and particularly address the content for the message <NUM> to each of the other agents <NUM> in the message group <NUM>.

<FIG> illustrates another example of messaging <NUM>-<NUM> among nodes of a mesh network by the messaging applications of <FIG>, according to various embodiments. And although <FIG> is described using the messaging applications <NUM>-<NUM>, <NUM>-<NUM> of <FIG>, any other technically feasible messaging application capable of performing the described operations can be used. Some elements shown in <FIG> can be interchanged with like numbered elements from other figures.

As shown, the messaging includes one-to-many broadcast messaging between a plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by a first node <NUM>-<NUM> of the mesh network and a message group <NUM> including agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> and as well as agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by a second node <NUM>-<NUM> of the mesh network and agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by a third node <NUM>-<NUM> of the mesh network. Agents <NUM>-<NUM> through <NUM>-<NUM> are included in a message group <NUM>.

Agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>, executed by a first node <NUM>-<NUM> of the mesh network, generate a set of content for messages <NUM> for the message group <NUM>. Agent <NUM>-<NUM> generates content for a first message <NUM>-<NUM> for the message group <NUM> and content for a second message <NUM>-<NUM> for the message group <NUM>. Agent <NUM>-<NUM> generates content for a third message <NUM>-<NUM> for the message group <NUM>. Messaging application <NUM>-<NUM> receives the content for the messages <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>. Messaging application <NUM>-<NUM> transmits content for the messages <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> in a composite message <NUM>, via the communication medium <NUM>, to a messaging application <NUM>-<NUM> executing on the second node <NUM>-<NUM> of the mesh network. The second node <NUM>-<NUM> delivers the content from the messages <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> to the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> that are included in the message group <NUM>. Messaging application <NUM>-<NUM> also transmits the content for the messages <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> in composite message <NUM>, via the communication medium <NUM>, to a messaging application <NUM>-<NUM> executing on the third node <NUM>-<NUM> of the mesh network. The third node <NUM>-<NUM> delivers the content from the messages <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> to the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> that are included in the message group <NUM>.

As shown, the messaging <NUM>-<NUM> shown in <FIG> enables the agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by the first node <NUM>-<NUM> to send the content for the messages <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> to the message group <NUM> including the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by the second node <NUM>-<NUM> and the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by the third node <NUM>-<NUM>. In various embodiments, the messaging <NUM>-<NUM> shown in <FIG> enables the agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> and the node <NUM>-<NUM> to transmit, to the second node <NUM>-<NUM> and the third node <NUM>-<NUM>, the content for the messages <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-3to the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by the second node <NUM>-<NUM> and the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by the third node <NUM>-<NUM>, instead of requiring the agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> to transmit individual copies of each of the content for the messages <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-3to each of the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by the second node <NUM>-<NUM> and the plurality of agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> executed by the third node <NUM>-<NUM>. As a result, the messaging <NUM>-<NUM> shown in <FIG> reduces communication overhead in transmitting messages to a message group <NUM> in one-to-many broadcast messaging scenarios. Alternatively or additionally, in various embodiments, the messaging <NUM>-<NUM> shown in <FIG> enables the agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> to address each of the content for the messages <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> to the message group <NUM>, rather than to each of the agents <NUM> included in the message group <NUM>. As a result, the messaging <NUM>-<NUM> shown in <FIG> reduces communication overhead in one-to-many broadcast messaging scenarios that would otherwise be required to inform agents <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> of each of the agents <NUM> that are included in the message group <NUM>, so that each of the agent <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> could individually and particularly address each of the content for the messages <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> to each of the other agents <NUM> in the message group <NUM>.

<FIG> illustrates an example of generating a composite message <NUM>, according to various embodiments. The composite message <NUM> can be generated, for example, by the messaging application <NUM>-<NUM> of <FIG> and/or 2A-2B. Some elements shown in <FIG> can be interchanged with like numbered elements from other figures.

A messaging application <NUM>-<NUM> receives content for a set of messages for one or more message groups <NUM>. Content for a first message <NUM>-<NUM> and content for a second message <NUM>-<NUM> for a first message group <NUM>-<NUM> and can be delivered only to agents <NUM> that are included in the first message group <NUM>-<NUM>. Content for a third message <NUM>-<NUM> for a second message group <NUM>-<NUM> and can be delivered only to agents <NUM> that are included in the second message group <NUM>-<NUM>. Content for a fourth message <NUM>-<NUM> is not for any message group <NUM> and can be delivered to any agent <NUM>. The first message group <NUM>-<NUM> is associated with a first cryptographic key <NUM>-<NUM> and a first message group identifier <NUM>-<NUM>. The second message group <NUM>-<NUM> is associated with a second cryptographic key <NUM>-<NUM> and a second message group identifier <NUM>-<NUM>. A default cryptographic key <NUM>-<NUM> is not associated with either of the message groups <NUM>-<NUM>, <NUM>-<NUM>. In various embodiments, each of the cryptographic keys <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> includes a symmetric cryptographic key and/or a public portion of an asymmetric cryptographic key. In various embodiments, the messaging application <NUM>-<NUM> uses the cryptographic keys with a cryptographic function, which can be initialized using an encryption initialization vector. For example (without limitation), the messaging application <NUM>-<NUM> can generate the encryption initialization vector for the composite message <NUM> and initialize the cryptographic function with the generated encryption initialization vector.

The messaging application <NUM> generates a first message group data section <NUM>-<NUM> for the content for the first message <NUM>-<NUM> and the content for the second message <NUM>-<NUM> for the first message group <NUM>-<NUM>. The messaging application <NUM> performs a first encryption process <NUM>-<NUM> that encrypts the content for the first message <NUM>-<NUM> and the content for the second message <NUM>-<NUM> with the first cryptographic key <NUM>-<NUM> to generate first encrypted data <NUM>-<NUM>. The messaging application <NUM> stores, in the first message group data section <NUM>-<NUM>, the first message group identifier <NUM>-<NUM> that identifies the first message group <NUM>-<NUM>, and the first encrypted data <NUM>-<NUM>.

The messaging application <NUM> generates a second message group data section <NUM>-<NUM> for the content for the third message <NUM>-<NUM> for the second message group <NUM>-<NUM>. The messaging application <NUM> performs a second encryption process <NUM>-<NUM> that encrypts the content for the third message <NUM>-<NUM> with the second cryptographic key <NUM>-<NUM> to generate second encrypted data <NUM>-<NUM>. The messaging application <NUM> stores, in the second message group data section <NUM>-<NUM>, the second message group identifier <NUM>-<NUM> that identifies the second message group <NUM>-<NUM> and the second encrypted data <NUM>-<NUM>.

The messaging application <NUM> generates a third message group data section <NUM>-<NUM> for the content for the fourth message <NUM>-<NUM> that is not for any message group <NUM>. The messaging application <NUM> performs a third encryption process <NUM>-<NUM> that encrypts the content for the fourth message <NUM>-<NUM> with the default cryptographic key <NUM>-<NUM> to generate third encrypted data <NUM>-<NUM>. The messaging application <NUM> stores, in the third message group data section <NUM>-<NUM>, the third encrypted data <NUM>-<NUM>. The third message group data section <NUM>-<NUM> omits a message group identifier <NUM>-<NUM> to indicate that the content for the fourth message <NUM>-<NUM> included in the encrypted data <NUM>-<NUM> is not for any message group <NUM>. In various embodiments, a numeric indicator of the message group type of a message group <NUM> is encoded in a message group identifier <NUM> of the message group <NUM> (e.g., as the most significant bits of the message group identifier <NUM> and/or as a least significant bits portion of the message group identifier <NUM>).

The messaging application <NUM>-<NUM> generates the composite message <NUM> that includes the message group data sections <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>. In various embodiments, composite message <NUM> may be unencrypted in which the content for various messages is included in plaintext. In other embodiments, however, composite message <NUM> includes one or more encrypted sections (e.g., encrypted versions of the content for the messages). For example, in some embodiments, at least one of the message group data sections <NUM> includes an unencrypted header and an encrypted payload. The unencrypted header can include the message group identifier <NUM>-<NUM> of the message group <NUM> associated with the message group data section <NUM>. The encrypted payload can include the encrypted data <NUM> that includes the encrypted the content for the messages for the message group <NUM> associated with the message group data section <NUM>. The composite message <NUM> can include additional data, such as (without limitation) a timestamp and/or an encryption initialization vector that was used during at least one encryption process <NUM>.

<FIG> illustrates an example of delivering a composite message <NUM>, according to various embodiments. Some elements shown in <FIG> can be interchanged with like numbered elements from other figures.

As shown, the messages in the composite message <NUM> can be delivered, for example, by the messaging application <NUM>-<NUM> of <FIG> and/or 2A-2B. As shown, the composite message <NUM> includes a first message group data section <NUM>-<NUM> including a first message group identifier <NUM>-<NUM> associated with a first message group <NUM>-<NUM> and first encrypted data <NUM>-<NUM>; a second message group data section <NUM>-<NUM> including a second message group identifier <NUM>-<NUM> associated with a second message group <NUM>-<NUM> and second encrypted data <NUM>-<NUM>; and a third message group data section <NUM>-<NUM> including third encrypted data <NUM>-<NUM>. A first agent <NUM>-<NUM> is included in the first message group <NUM>-<NUM>. A second agent <NUM>-<NUM> is included in the first message group <NUM>-<NUM> and the second message group <NUM>-<NUM>. A third agent <NUM>-<NUM> is included in the second message group <NUM>-<NUM>. A fourth agent <NUM>-<NUM> is not included in either the first message group <NUM>-<NUM> or the second message group <NUM>-<NUM>.

In various embodiments, the composite message <NUM> includes an encryption initialization vector. The messaging application <NUM>-<NUM> can extract the encryption initialization vector from the composite message <NUM>. The messaging application <NUM>-<NUM> can initialize a cryptographic function with the extracted encryption initialization vector, wherein the initialized cryptographic function is used to decrypt one or more encrypted messages that are included in the composite message <NUM>.

A messaging application <NUM> determines that the first message group identifier <NUM>-<NUM> is associated with a first message group <NUM>-<NUM> and a first cryptographic key <NUM>-<NUM>. In various embodiments, the first cryptographic key <NUM>-<NUM> includes a symmetric cryptographic key and/or a public portion of an asymmetric cryptographic key. The messaging application <NUM> performs a first decryption process <NUM>-<NUM> using the first encrypted data <NUM>-<NUM> and the first cryptographic key <NUM>-<NUM> to generate, from the first encrypted data <NUM>-<NUM>, the content from the first message <NUM>-<NUM> to the first message group <NUM>-<NUM> and the content from the second message <NUM>-<NUM> to the first message group <NUM>-<NUM>. The messaging application <NUM> delivers the content for the first message <NUM>-<NUM> and the content from the second message <NUM>-<NUM> to each agent <NUM> that is included in the first message group <NUM>-<NUM>, including the first agent <NUM>-<NUM> and the second agent <NUM>-<NUM>.

The messaging application <NUM> determines that the second message group identifier <NUM>-<NUM> is associated with a second message group <NUM>-<NUM> and a second cryptographic key <NUM>-<NUM>. In various embodiments, the second cryptographic key <NUM>-<NUM> includes a symmetric cryptographic key and/or a public portion of an asymmetric cryptographic key. The messaging application <NUM> performs a second decryption process <NUM>-<NUM> using the second encrypted data <NUM>-<NUM> and the second cryptographic key <NUM>-<NUM> to generate, from the second encrypted data <NUM>-<NUM>, the content from the third message <NUM>-<NUM> to the second message group <NUM>-<NUM>. The messaging application <NUM> delivers the content f from or the third message <NUM>-<NUM> to each agent <NUM> that is included in the second message group <NUM>-<NUM>, including the second agent <NUM>-<NUM> and the third agent <NUM>-<NUM>.

The messaging application <NUM> determines that the third message group data section <NUM>-<NUM> does not include a message group identifier <NUM>. The messaging application <NUM> performs a third decryption process <NUM>-<NUM> using the third encrypted data <NUM>-<NUM> and a default cryptographic key <NUM>-<NUM> (i.e., a cryptographic key that is not associated with any particular message group). In various embodiments, the default cryptographic key <NUM>-<NUM> includes a symmetric cryptographic key and/or a public portion of an asymmetric cryptographic key. The messaging application <NUM> generates, from the third encrypted data <NUM>-<NUM>, the content from the fourth message <NUM>-<NUM> that can be delivered to any agent <NUM> that is executing on the same node <NUM> that is executing the messaging application <NUM>. In various embodiments, the messaging application <NUM> delivers the content from the fourth message <NUM>-<NUM> to all agents <NUM> executed by a node <NUM> that is executing the messaging application <NUM>, including the first agent <NUM>-<NUM>, the second agent <NUM>-<NUM>, the third agent <NUM>-<NUM>, and the fourth agent <NUM>-<NUM>.

In various embodiments, the messaging application <NUM> retrieves a cryptographic key <NUM> that is associated with a message group <NUM> in order to decrypt encrypted data <NUM> that is included in the composite message <NUM>. For example (without limitation), responsive to receiving a composite message <NUM> that includes encrypted data <NUM> that is associated with a particular message group identifier <NUM>, the messaging application <NUM> can verify that the node <NUM> executing the messaging application <NUM> stores a cryptographic key <NUM> that is associated with the message group identifier <NUM>. Upon verifying that the node <NUM> executing the messaging application <NUM> stores a cryptographic key <NUM> that is associated with the message group identifier <NUM>, the messaging application <NUM> can retrieve the cryptographic key <NUM> from the node <NUM> and decrypt the encrypted data <NUM> using the cryptographic key <NUM>. Upon failing to verify that the node <NUM> executing the messaging application <NUM> stores a cryptographic key <NUM> that is associated with the message group identifier <NUM>, the messaging application <NUM> can request such a cryptographic key <NUM> from a key store. The key store can be included in the same node <NUM> that executes the messaging application <NUM> or in another node <NUM> of the mesh network. Upon receiving the cryptographic key <NUM> from the key store, the messaging application <NUM> can store the cryptographic key <NUM> in the node <NUM> executing the messaging application <NUM> and decrypt the encrypted data <NUM> using the cryptographic key <NUM>.

In various embodiments, prior to decrypting encrypted data <NUM> that is associated with a message group <NUM>, the messaging application <NUM> first verifies that at least one agent <NUM> executed by the node <NUM> is included in the message group <NUM>. In response to a determination that at least one agent <NUM> executed by the node <NUM> is not included in the message group <NUM>, the messaging application <NUM> refrains from decrypting the encrypted data <NUM>.

<FIG> is a flow diagram of method steps for transmitting messages by a messaging application executing on a node, according to various embodiments. The method steps of <FIG> can be performed, for example, by the first messaging application <NUM>-<NUM> executing on the first node <NUM>-<NUM> of <FIG>. The method steps of <FIG> can be performed, for example, during the messaging <NUM>-<NUM> shown in <FIG> and/or the messaging <NUM>-<NUM> shown in <FIG>.

As shown, a method <NUM> begins at step <NUM> in which the messaging application receives a request from an agent executing on the node to join a message group. In various embodiments, the request also includes a request to create the message group of a message group type.

At step <NUM>, the messaging application verifies that a policy permits the agent to join the message group. In various embodiments, the messaging application determines whether the policy permits the particular agent to join the message group. In various embodiments, the messaging application determines whether the policy permits the particular agent to join message groups of a message group type that is associated with the message group that the particular agent has requested to join. In various embodiments, the messaging application determines whether the policy permits the particular agent to receive messages including a type of data or information that is included in messages for the message group that the particular agent has requested to join. If the policy does not permit the agent to join the message group, the method <NUM> returns to step <NUM>. If the policy permits the agent to join the message group, the method <NUM> proceeds to step <NUM>.

At step <NUM>, the messaging application adds (or subscribes) the agent to the message group. In various embodiments, the messaging application updates a list stored by the messaging application that indicates the agents executed by the node that are included in the message group.

At step <NUM>, the messaging application receives, from the agent, content for a message for the message group. In various embodiments, the content for the message is addressed to the message group, and/or the message includes one or more types of data or information that can be delivered to the message group. In various embodiments, the content for the message is associated with a message group identifier that identifies the message group.

At step <NUM>, the messaging application transmits the content for the message to a second node of the mesh network. In various embodiments, the messaging application transmits the content for the message to the message group to the second node in plaintext. In various embodiments, the messaging application encrypts the content for the message with a cryptographic key that is associated with the message group to generate an encrypted message and then transmits the encrypted the content for the messages to the second node. In various embodiments, the messaging application transmits the content for the message to two or more other nodes of the mesh network. The method <NUM> returns to step <NUM> to receive and transmit content for additional messages for the message group.

<FIG> is a flow diagram of method steps for delivering messages by a messaging application executing on a node, according to various embodiments. The method steps of <FIG> can be performed, for example, by the second messaging application <NUM>-<NUM> executing on the second node <NUM>-<NUM> of <FIG>. The method steps of <FIG> can be performed, for example, during the messaging <NUM>-<NUM> shown in <FIG> and/or the messaging <NUM>-<NUM> shown in <FIG>.

At step <NUM>, the messaging application receives, from a second node of the mesh network, a message for the message group. In various embodiments, the message is addressed to the message group, and/or the message includes content associated with one or more types of data or information that can be delivered to the message group. In various embodiments, the message includes a message group identifier that is associated with the message group. In various embodiments, the messaging application receives, from the second node, an encrypted message, and decrypts the encrypted message with a cryptographic key that is associated with the message group to generate the message.

At step <NUM>, the messaging application delivers content from the message to the agent. In various embodiments, the content from the message is included in a composite message that also includes content from a second message for a second message group, and the messaging agent delivers the content from the second message to an agent executing on the node that is included in the second message group. The method <NUM> returns to step <NUM> to receive and deliver additional messages for the message group.

<FIG> is a flow diagram of method steps for transmitting composite messages by a messaging application executing on a node, according to various embodiments. The method steps of <FIG> can be performed, for example, by the first messaging application <NUM>-<NUM> executing on the first node <NUM>-<NUM> of <FIG>. The method steps of <FIG> can be performed, for example, during the messaging <NUM>-<NUM> shown in <FIG>, the messaging <NUM>-<NUM> shown in <FIG>, and/or generating the composite message <NUM> as shown in <FIG>.

As shown, a method <NUM> begins at step <NUM> in which the messaging application receives, from an agent, content for a first message for a first message group. In various embodiments, the content for the first message is addressed to the first message group, and/or the content for the first message includes one or more types of data or information that can be delivered to the first message group. In various embodiments, the content for the first message is associated with a message group identifier that identifies the first message group. In various embodiments, the messaging agent verifies that the agent is permitted, by a policy, to deliver messages to the first message group.

At step <NUM>, the messaging application encrypts the content for the first message with a first cryptographic key to generate a first encrypted message, wherein the first cryptographic key is associated with the first message group. In various embodiments, the messaging application obtains the first cryptographic key associated with the first message group from a key store. In various embodiments, the messaging application encrypts the first message with the first cryptographic key based on a cryptographic function that is initialized with an encryption initialization vector. In various embodiments, the messaging application encrypts, with the first cryptographic key, the content for the first message and additional data, such as (without limitation) random data and/or a timestamp.

At step <NUM>, the messaging application receives, from an agent, content for a second message for a second message group. In various embodiments, the content for the second message is addressed to the second message group, and/or the content for the second message includes one or more types of data or information that can be delivered to the second message group. In various embodiments, the content for the second message is associated with a message group identifier identifies the second message group. In various embodiments, the messaging application receives both the content for the first message and the content for the second message from the same agent or from different agents. In various embodiments, the messaging agent verifies that the agent is permitted, by a policy, to deliver messages to the second message group.

At step <NUM>, the messaging application encrypts the content for the second message with a first cryptographic key to generate a second encrypted message, wherein the second cryptographic key is associated with the second message group. In various embodiments, the messaging application obtains the second cryptographic key associated with the first message group from a key store. In various embodiments, the messaging application encrypts the second message with the second cryptographic key based on a cryptographic function that is initialized with an encryption initialization vector. In various embodiments, the messaging application encrypts, with the second cryptographic key, the second message and additional data, such as (without limitation) random data and/or a timestamp.

At step <NUM>, the messaging application generates a composite message, wherein the composite message includes the first encrypted message and the second encrypted message. In various embodiments, the composite message includes an encryption initialization vector with which a cryptographic function was initialized before encrypting one or more messages with a cryptographic key. In various embodiments, the composite message includes a third encrypted message based on a third message that is not for any message group, wherein the third encrypted message is encrypted using a default cryptographic key. In various embodiments, the composite message includes one or more message group data sections, wherein each message group data section includes a message group identifier in an unencrypted header and encrypted data, including one or more encrypted messages, in an encrypted payload.

At step <NUM>, the messaging application transmits the composite message to a second node. In various embodiments involving one-to-many broadcast messaging, the messaging application also transmits the composite message to a third node of the message network, wherein the third node executes one or more additional agents that are associated with at least one of the message groups with which at least one message included in the composite message is associated. The method <NUM> returns to step <NUM> to receive and transmit additional composite messages.

<FIG> is another flow diagram of method steps for delivering composite messages by a messaging application <NUM> executing on a node <NUM>, according to various embodiments. The method steps of <FIG> can be performed, for example, by the first node <NUM>-<NUM> of <FIG> and/or the first messaging application <NUM>-<NUM> executing on the first node <NUM>-<NUM> of <FIG>. The method steps of <FIG> can be performed, for example, during the messaging <NUM>-<NUM> shown in <FIG>, the messaging <NUM>-<NUM> shown in <FIG>, and/or delivering messages in a composite message <NUM> as shown in <FIG>.

As shown, a method <NUM> begins at step <NUM> in which the messaging application receives, from a second node of the message network, a composite message that includes a first encrypted message and the second encrypted message. In various embodiments, the composite message includes an encryption initialization vector with which a cryptographic function was initialized before encrypting one or more messages with a cryptographic key. In various embodiments, the composite message includes a third encrypted message based on a third message that is not for any message group, wherein the third encrypted message is encrypted using a default cryptographic key. In various embodiments, the composite message includes one or more message group data sections, wherein each message group data section includes a message group identifier in an unencrypted header and encrypted data, including one or more encrypted messages, in an encrypted payload.

At step <NUM>, the messaging application decrypts the first encrypted message with a first cryptographic key to generate content for a first message for a first message group, wherein the first cryptographic key is associated with the first message group. In various embodiments, the messaging application obtains the first cryptographic key associated with the first message group from a key store. In various embodiments, the messaging application decrypts the first message with the first cryptographic key based on a cryptographic function that is initialized with an encryption initialization vector that is included in the composite message. In various embodiments, the messaging application decrypts, with the first cryptographic key, the first encrypted message to generate the content for the first message and additional data that was included in the first encrypted message, such as (without limitation) random data and/or a timestamp and separates the content for the first message from the additional data.

At step <NUM>, the messaging application delivers the content for the first message to an agent that is included in the first message group. In various embodiments, the messaging application determines that the agent is included in the first message group based on a list stored by the node that indicates the agents executed by the node that are included in the first message group.

At step <NUM>, the messaging application decrypts the second encrypted message with a second cryptographic key to generate content from a second message for a second message group, wherein the second cryptographic key is associated with the second message group.

At step <NUM>, the messaging application delivers the content from the second message to an agent that is included in the second message group. In various embodiments, the messaging application determines that the agent is included in the second message group based on a list stored by the node that indicates the agents executed by the node that are included in the second message group. In various embodiments, one agent is included in both the first message group and the second group, and the messaging application delivers, to the one agent, both the first message and the second message. The method <NUM> returns to step <NUM> to receive additional composite messages and to deliver content from additional messages to agents that are included in one or more message groups.

<FIG> illustrates an exemplary node that can be included in a mesh network and used to implement the techniques discussed above with respect to <FIG>, <FIG>, <FIG>, and <FIG>. Node <NUM> includes, without limitation, one or more processors <NUM>, one or more input/output (I/O) devices <NUM>, one or more transceivers <NUM>, and a memory <NUM>. The memory <NUM> includes, without limitation, a messaging application <NUM>, an agent <NUM>, a mailbox <NUM>, a policy <NUM>, and one or more cryptographic keys <NUM>.

The node <NUM> is a network device and includes computing device hardware configured to perform various processing operations and execute program code. The node can further include various analog-to-digital and digital-to-analog converters, digital signal processors (DSPs), harmonic oscillators, transceivers, and any other components generally associated with RF-based communication hardware. In various embodiments, the node <NUM> includes a battery, renewable energy course (e.g., a solar photovoltaic array), and/or mains connection (not shown) that supplies power to the various computing device hardware included in node <NUM>.

The one or more processors <NUM> can include any hardware configured to process data and execute software applications. At least one of the one or more processors <NUM> can include a real-time clock (RTC) (not shown) according to which processor <NUM> maintains an estimate of the current time. At least one of the one or more processors <NUM> executes an agent <NUM>.

The one or more I/O devices <NUM> include devices configured to receive input, devices configured to provide output, and devices configured to both receive input and provide output. In various embodiments, the one or more I/O devices include a keyboard, a mouse, a joystick, a touchpad, a touchscreen, a microphone, an inertial measurement unit (IMU), a display, a speaker, a haptic generator, or the like.

The one or more transceivers <NUM> can include one more interfaces that are associated with various communication media <NUM>. In various embodiments, the one or more transceivers include at least one of an Ethernet interface, a power line communication interface, a WiFi® interface, or a Bluetooth® interface.

The memory <NUM> can be implemented by any technically feasible storage medium. Memory <NUM> includes, without limitation, a messaging application <NUM> and a mailbox <NUM>. The messaging application <NUM> includes program code that, when executed by the one or more processors <NUM>, performs any of the messaging processes functionality described herein. In various embodiments, the messaging processes can include the various message processes shown in <FIG>.

The memory <NUM> also includes a policy <NUM> that includes one or more rules <NUM>, wherein each rule <NUM> indicates a permission <NUM> (e.g., an action) that is granted based on a fulfillment of one or more criteria one or more criteria <NUM>. In various embodiments, the policy <NUM> is provided as one or more policy files stored by the node <NUM>. The memory <NUM> also includes one or more mailboxes <NUM> that are configured to store messages.

The memory <NUM> further includes the one or more cryptographic keys <NUM>. The one or more cryptographic keys <NUM> are usable by messaging application <NUM> to perform various cryptographic operations during the sending a receiving of messages that are discussed in further detail in reference to <FIG> and <FIG>.

The agent <NUM> executed by the one or more processors <NUM> of the node <NUM> is operable to perform various operations. In various embodiments, the operations include monitoring, analyzing, collecting, storing, transmitting, and/or receiving data. In various embodiments, the agent <NUM> is stored in the memory <NUM> that also stores the messaging application <NUM>.

The agent <NUM> sends a message to the messaging application <NUM>, wherein the message <NUM> is for a message group <NUM>. The messaging application <NUM> receives the message <NUM> from the agent <NUM> and determines, based on the policy <NUM>, whether the agent <NUM> is permitted to deliver the message <NUM> to the message group <NUM>. If the messaging application <NUM> determines, based on the policy <NUM>, that the agent <NUM> is permitted to deliver the message <NUM> to the message group <NUM>, the messaging application <NUM> can transmit the message <NUM> via the one or more transceivers <NUM>. Agent <NUM> also receives, for the messages groups that agent <NUM> is permitted to receive messages as well as for messages that do not belong to a message group, content for messages from messaging application <NUM>.

<FIG> illustrates a network system configured to implement one or more aspects of the present embodiments. As shown, network system <NUM> includes a field area network (FAN) <NUM>, a wide area network (WAN) backhaul <NUM>, and a control center <NUM>. FAN <NUM> is coupled to control center <NUM> via WAN backhaul <NUM>. Control center <NUM> is configured to coordinate the operation of FAN <NUM>.

FAN <NUM> includes personal area network (PANs) A, B, and C. PANs A and B are organized according to a mesh network topology, while PAN C is organized according to a star network topology. Each of PANs A, B, and C includes at least one border router node <NUM> and one or more mains-powered device (MPD) nodes <NUM>. PANs B and C further include one or more battery-powered device (BPD) nodes <NUM>. Any of border router node <NUM>, the one or more MPD nodes <NUM>, or the BPD nodes <NUM> can include the features of node <NUM> and can be used to implement the techniques discussed above with respect to <FIG>.

MPD nodes <NUM> draw power from an external power source, such as mains electricity or a power grid. MPD nodes <NUM> typically operate on a continuous basis without powering down for extended periods of time. BPD nodes <NUM> draw power from an internal power source, such as a battery. BPD nodes <NUM> typically operate intermittently and power down, go to very low power mode, for extended periods of time in order to conserve battery power.

MPD nodes <NUM> and BPD nodes <NUM> are coupled to, or included within, a utility distribution infrastructure (not shown) that distributes a resource to consumers. MPD nodes <NUM> and BPD nodes <NUM> gather sensor data related to the distribution of the resource, process the sensor data, and communicate processing results and other information to control center <NUM>. Border router nodes <NUM> operate as access points to provide MPD nodes <NUM> and BPD nodes <NUM> with access to control center <NUM>.

Any of border router nodes <NUM>, MPD nodes <NUM>, and BPD nodes <NUM> are configured to communicate directly with one or more adjacent nodes via bi-directional communication links, such as bi-directional communication link <NUM>. The communication links may be wired or wireless links, although in practice, adjacent nodes of a given PAN exchange data with one another by transmitting data packets via wireless radio frequency (RF) communications. The various node types are configured to perform a technique known in the art as "channel hopping" in order to periodically receive data packets on varying channels. As known in the art, a "channel" may correspond to a particular range of frequencies. In one embodiment, a node may compute a current receive channel by evaluating a Jenkins hash function based on a total number of channels and the media access control (MAC) address of the node.

Each node within a given PAN can implement a discovery protocol to identify one or more adjacent nodes or "neighbors. " A node that has identified an adjacent, neighboring node can establish a bi-directional communication link with the neighboring node. Each neighboring node may update a respective neighbor table to include information concerning the other node, including the MAC address of the other node as well as a received signal strength indication (RSSI) of the communication link established with that node.

Nodes can compute the channel hopping sequences of adjacent nodes to facilitate the successful transmission of data packets to those nodes. In embodiments where nodes implement the Jenkins hash function, a node computes a current receive channel of an adjacent node using the total number of channels, the MAC address of the adjacent node, and a time slot number assigned to a current time slot of the adjacent node.

Any of the nodes discussed above may operate as a source node, an intermediate node, or a destination node for the transmission of data packets. A given source node can generate a data packet and then transmit the data packet to a destination node via any number of intermediate nodes (in mesh network topologies). The data packet can indicate a destination for the packet and/or a particular sequence of intermediate nodes to traverse in order to reach the destination node. In one embodiment, each intermediate node can include a forwarding database indicating various network routes and cost metrics associated with each route.

Nodes can transmit data packets across a given PAN and across WAN backhaul <NUM> to control center <NUM>. Similarly, control center <NUM> can transmit data packets across WAN backhaul <NUM> and across any given PAN to a particular node included therein. As a general matter, numerous routes can exist which traverse any of PANs A, B, and C and include any number of intermediate nodes, thereby allowing any given node or other component within network system <NUM> to communicate with any other node or component included therein.

Control center <NUM> includes one or more server machines (not shown) configured to operate as sources for, or destinations of, data packets that traverse within network system <NUM>. The server machines can query nodes within network system <NUM> to obtain various data, including raw or processed sensor data, power consumption data, node/network throughput data, status information, and so forth. The server machines can also transmit commands and/or program instructions to any node within network system <NUM> to cause those nodes to perform various operations. In one embodiment, each server machine is a computing device configured to execute, via a processor, a messaging application stored in a memory to enable messaging among agents of the mesh network.

Any and all combinations of any of the claim elements recited in any of the claims and/or any elements described in this application, in any fashion, fall within the contemplated scope of the present invention and protection.

Aspects of the present embodiments may be embodied as a system, method or computer program product. Accordingly, aspects of the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a "module" or "system. " Furthermore, aspects of the present disclosure may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention of the present disclosure.

Claim 1:
A method comprising:
receiving (<NUM>), by a first messaging application (<NUM>) executing on a first node (<NUM>) of a mesh network, content for a first message from an agent (<NUM>) executing on the first node, the first message being for a first message group (<NUM>); and
transmitting (<NUM>), by the first messaging application, a composite message (<NUM>) to a second messaging application (<NUM>) executed by a second node (<NUM>) of the mesh network, the composite message including the first message and a second message for a second message group (<NUM>).