Patent ID: 7489645

Claim:
A router comprising: a certificate associated with the router and defined by a producing entity of the router and including a name and a signature, the signature created by performing an operation on the name using a private signing key of the producing entity of the router; a list stored in the router, the list: enumerating one or more routers each being a member of a predetermined neighborhood of which the router is also a member, the one or more routers each authenticating itself with the router; and mapping, for each of the one or more routers in the predetermined neighborhood, a copy of a certificate to a corresponding router; at least one processor; and one or more media including processor-executable instructions that are capable of being executed by the at least one processor, the processor-executable instructions adapted to direct the router to perform actions comprising: receiving, from an end device with which the router has not established trust relationship, a request comprising a first and a second certificate, wherein: the first certificate is a certificate of a first router that authenticates the end device, the first certificate comprising a public key of a public-private key pair associated with the first router; and the second certificate is a certificate associated with the end device, the second certificate having a signature signed by the first router using a private key of the public-private key pair associated with the first router; ascertaining the first router is an authenticated member of the predetermined neighborhood by looking up the first router in the list stored in the router; determining the first certificate is valid by comparing the first certificate with a copy in the list of the certificate mapped to the first router; determining the second certificated is valid without routing the second certificate to the first router for its validation, the determining comprising performing, at the router, a signature verification procedure on the signature of the second certificate to verify, based on the pubic key in the first certificate, that the signature is signed by the first router; and in an event the first router is ascertained to be a member of the predetermined neighborhood and the first and second certificates are determined to be valid, recognizing the end device as having a privileged status; the privileged status relating to level of service.