Apparatus, method, and medium for self-organizing multi-hop wireless access networks

Abstract

A wireless computer network includes a backbone network including backbone network nodes authenticated to each other and in communication with each other. The wireless computer network also includes a master authenticator node and a proxy authenticator node among the backbone network nodes. When an unauthenticated new node requests authentication to the backbone network and the unauthenticated new node is in communication with at least one of the backbone network nodes, the at least one of the backbone network nodes becoming the proxy authenticator node for the unauthenticated new node and communicates with the master authenticator node to authenticate the unauthenticated new node to the backbone network.

1 . A wireless computer network in communication with mobile client computing devices comprising client wireless devices, the wireless computer network comprising: 
 a wireless backbone network providing a wireless networking service to the mobile client computing devices, the wireless backbone network comprising: 
 portable wireless network node devices providing wireless local access service to the mobile client computing devices in their respective coverage areas and providing the wireless networking service to forward and deliver communication data of the mobile client computing devices on the wireless backbone network in a multi-hop manner to other of the mobile client computing devices or to other networks in communication with the wireless computer network, one or more of the portable wireless network node devices performing routing and storing a routing table comprising first data of subnet routes of network layer addresses for the mobile client computing devices and portable wireless network node devices, and second data of subnet routes to gateways for external network addresses and per-host routes of network layer addresses for the mobile client computing devices that have roamed from their initial access service network node coverage area, and per-host routes of link layer addresses for the mobile client computing devices and portable wireless network node devices,  
   wherein a backbone network node configured as a master authenticator node and another computer configured as authentication server, authenticating an unauthenticated new network node to the backbone network with the assistance of another backbone node configured as a proxy authenticator node for the unauthenticated new network node    
   
   
       2 . The wireless computer network as in  claim 1 , wherein the routing table specifies the local interface and the neighboring interface to the respective wireless network node device that is the next hop-destination in a routing path, and wherein the wireless network node devices performing routing updating their routing table by periodically exchanging routing update control messages that include IP addresses and link layer addresses.  
   
   
       3 . The wireless computer network as in  claim 2 , wherein one or more of the portable wireless network node devices provides a gateway service and comprises multiple interfaces, wherein each gateway service node device having one of the multiple interfaces provides communication to the wireless backbone network and at least one of the multiple interfaces provides communication to the other network in communication with the wireless computer network.  
   
   
       4 . The wireless computer network as in  claim 2 , wherein the portable wireless network node devices comprises multiple wireless interfaces, wherein at least one of the multiple wireless interfaces providing local access service for the mobile client computing devices and at least one of the multiple wireless interfaces providing communication with the wireless backbone service.  
   
   
       5 . The wireless computer network as in  claim 2 , wherein each of the portable wireless network node devices comprising internal tables controlling communications forwarding through one of bridging and routing, wherein the wireless computer network automatically and dynamically adjusting for the movement of the portable wireless network node devices within the wireless computer network, the introduction of additional portable wireless network node devices to the wireless computer network, and the deletion or failure of current portable wireless network node devices by updating its internal tables controlling communications forwarding either through the bridging or the routing implemented in the portable wireless network node devices.  
   
   
       6 . The wireless computer network as in  claim 5 , wherein when the network is operating in routing mode the wireless computer network shares an Internet-style, network layer, address space among the portable wireless network node devices and the mobile client computing devices.  
   
   
       7 . The wireless computer network as in  claim 6 , wherein a portable wireless network node device serving as an address manager dynamically assigns a backbone network layer address as well as one or more address space segments from the address space of the wireless computer network to a new portable wireless network node device after the new portable wireless network node device is authenticated to the wireless computer network.  
   
   
       8 . The wireless computer network as in  claim 7 , wherein the wireless network node device provides an internal routable address for the mobile client computing device from the assigned address space segment of the wireless network node device using a procedure comprising a DHCP function on the wireless network node device.  
   
   
       9 . The wireless computer network as in  claim 5 , wherein the wireless network node devices forward communication data on behalf of the mobile client computing devices using a dynamic routing protocol adapted to the wireless network node devices.  
   
   
       10 . The wireless computer network as in  claim 5 , wherein the wireless network node devices forward communication data on behalf of mobile client computing devices using a dynamic bridging protocol adapted to the wireless network node devices.  
   
   
       11 . The wireless computer network as in  claim 10 , wherein the bridging protocol is based on the IEEE 802.11 WDS links that are dynamically created and removed by the network nodes based on their current local neighboring network node connections.  
   
   
       12 . The wireless computer network as in  claim 10 , wherein the wireless network node devices performing bridging store a Bridging Table comprising a local interface and neighboring interfaces to the respective wireless network node devices that are the next hop destination in the bridging path.  
   
   
       13 . The wireless computer network as in  claim 12 , wherein the wireless network node devices performing bridging update their Bridging Table by periodically exchanging bridging update control messages that includes link layer addresses for all attached devices and clients.  
   
   
       14 . The wireless computer network as in  claim 2 , wherein at least one of the wireless network node devices serves as a gateway to another network in communication with the wireless computer network, and the network routing protocol, periodically executed by the wireless network node devices, automatically determines the shortest path routes between mobile client computing devices in the wireless computer network or to the gateway.  
   
   
       15 . The wireless computer network as in  claim 5 , wherein the network wireless node devices transfer authentication information between themselves when a mobile client computing device roams from the coverage area of one wireless network node device to another wireless network node device to establish authentication and local access at the wireless network node device to provide access service.  
   
   
       16 . The wireless computer network as in  claim 15 , wherein the mobile client computing device that roams from the coverage area of one of the wireless network node devices to another of the wireless network node devices maintains the same address and the routing protocol continues to efficiently route communication data to the mobile client computing device by automatically updating a client-specific host address entry in the routing tables of the wireless network node devices  
   
   
       17 . The wireless computer network as in  claim 2  wherein secure communications are provided by encryption of messages and authentication of the wireless network node devices and the mobile client computing devices.  
   
   
       18 . The wireless computer network as in  claim 2 , further comprising an authentication server in communication with the wireless network node devices, wherein the wireless network node devices automatically configure themselves for communication forwarding in the wireless computer network by initiating their operating systems, determining their network addresses when operating in routing mode, contacting the authentication server, obtaining encryption keys and authentication, setting their backbone wireless network and local access service channels, and initiating a dynamic routing or bridging protocol that discovers neighboring wireless network node devices and establishes communication forwarding paths on the backbone wireless network.  
   
   
       19 . The wireless computer network as in  claim 17 , the unauthenticated new node in communication with at least one of the already authenticated backbone network nodes as the proxy authenticator node to request authentication to the backbone network, the proxy authenticator node communicating with the master authenticator node to authenticate the unauthenticated new node to the backbone network.  
   
   
       20 . The wireless computer network as in  claim 19 , wherein when operating in a routing mode, the unauthenticated new node transmitting identification data to neighboring proxy authenticator nodes, the proxy authenticator nodes receiving the identification data, encapsulating the identification data in a message envelope, and forwarding the encapsulated data to the master authenticator using the routing scheme.  
   
   
       21 . The wireless computer network as in  claim 19 , wherein the master authenticator node selects one backbone node as the proxy authenticator node if more than one backbone node receives and forwards the new node identification data to the master authenticator.  
   
   
       22 . The wireless computer network as in  claim 21 , further comprising an authentication server in communication with the master authenticator node and authenticating the unauthenticated new node to the backbone network.  
   
   
       23 . The wireless computer network as in  claim 22 , wherein the new node, once authenticated to the backbone network, is enabled to become a proxy authenticator for an unauthenticated new wireless node.  
   
   
       24 . The wireless computer network as in  claim 17 , wherein a common group key is used as part of the encryption scheme for the backbone communications, the group key is used by another key generating method to produce the actual per packet communication encryption key, and the group key is changed periodically and is only valid for a specified period of time, denoted by a start and end time.  
   
   
       25 . The wireless computer network as in  claim 24 , wherein the master authenticator periodically generates a new group key and transmits the new group key to each node in the backbone network by encrypting the group key using a public key based method that only that destination node can decrypt.  
   
   
       26 . The wireless computer network as in  claim 24 , wherein the master authenticator transmits the current active group key to a newly authenticated node by encrypting the group key using a public key based method that only the new node can decrypt, the new node then uses the group key to encrypt backbone communication.  
   
   
       27 . The wireless computer network as in  claim 24 , wherein each key periodically generated by the master authenticator has a specific valid period, which is specified in each new key transmission, and the received newly generated group key is stored by backbone node devices and only loaded into encryption/decryption engine during the key effective period.  
   
   
       28 . The wireless computer network as in  claim 27 , wherein the valid periods of consecutively generated group keys by the master authenticator may overlap at the beginning and ending of their valid periods, during which both group keys are valid and the encrypting node devices use the newer group key to encrypt messages but the decrypting node devices may need to try both to decrypt messages, to ensure smooth group key change.  
   
   
       29 . The wireless computer network as in  claim 17 , wherein a wireless network node providing access service to at least one of the mobile client computing devices becoming an authenticator for authenticating client devices.  
   
   
       30 . The wireless computer network as in  claim 29 , wherein one of the wireless network nodes providing access service to at least one of the mobile client computing devices or a separate computer in communication with the wireless network node, being configured as an authentication server for the mobile client computing devices.  
   
   
       31 . The wireless computer network as in  claim 30 , wherein at least one of the mobile client computing devices is authenticated by an authenticator and an authentication server using the IEEE 802.1x protocol.  
   
   
       32 . The wireless computer network as in  claim 17  in which the authentication and encryption mechanisms are the WiFi Protected Access (WPA) scheme modified to allow the authenticator, master authenticator and authentication server to communicate over multiple hops.  
   
   
       33 . A method of wireless computer network in communication with mobile client computing devices comprising client wireless devices, the method of the wireless computer network comprising: 
 providing, by a wireless backbone network, a wireless networking service to the mobile client computing devices, comprising: 
 providing, by portable wireless network node devices of the wireless backbone network, wireless local access service to the mobile client computing devices in their respective coverage areas,  
 providing the wireless networking service to forward and deliver communication data of the mobile client computing devices on the wireless backbone network in a multi-hop manner to other of the mobile client computing devices or to other networks in communication with the wireless computer network,  
 performing routing, by one or more of the portable wireless network node devices,  
 storing, by the one or more of the portable wireless network node devices, a routing table comprising first data of subnet routes of wireless network layer addresses for the mobile client computing devices and portable wireless network node devices, and second data of subnet routes to gateways for external network addresses and per-host routes of network layer addresses for the mobile client computing devices that have roamed from their initial access service network node coverage area, and per-host routes of link layer addresses for the mobile client computing devices and portable wireless network node devices, and  
 authenticating, by a backbone network node configured as a master authenticator node and another backbone node configured as an authentication server, an unauthenticated new network node to the backbone network with the assistance of another backbone node configured as a proxy authenticator node for the unauthenticated new network node.  
   
   
   
       34 . The method of  claim 33 , further comprising: 
 specifying, by the routing table, the local interface and the neighboring interface to the respective wireless network node device that is the next hop-destination in a routing path, and    updating, by the wireless network node devices performing routing, their routing table by periodically exchanging routing update control messages that include IP addresses and link layer addresses.    
   
   
       35 . The method as in  claim 34 , further comprising: 
 providing, by one or more of the portable wireless network node devices, a gateway service, the one or more of the portable network node devices comprising multiple interfaces,    providing, by each gateway service node device having one of the multiple interfaces provides, communication to the wireless backbone network, and    providing, by at least one of the multiple interfaces, communication to the other network in communication with the wireless computer network.    
   
   
       36 . The method as in  claim 34 , wherein the portable wireless network node devices comprises multiple wireless interfaces, the method further comprising: 
 providing, by at least one of the multiple wireless interfaces, local access service for the mobile client computing devices, and    providing, by at least one of the multiple wireless interfaces, communication with the wireless backbone service.    
   
   
       37 . The method as in  claim 34 , further comprising: 
 controlling, by internal tables provided in each of the portable wireless network node devices, communications forwarding through one of bridging and routing,    automatically and dynamically, by the wireless computer network, adjusting for the movement of the portable wireless network node devices within the wireless computer network, the introduction of additional portable wireless network node devices to the wireless computer network, and the deletion or failure of current portable wireless network node devices by updating its internal tables controlling communications forwarding either through the bridging or the routing implemented in the portable wireless network node devices.    
   
   
       38 . The method as in  claim 37 , wherein when the network is operating in routing mode, sharing, by the wireless computer network, an Internet-style, network layer, address space among the portable wireless network node devices and the mobile client computing devices.  
   
   
       39 . The method as in  claim 37 , further comprising serving, by a portable wireless network node device, as an address manager dynamically assigns a backbone network layer address as well as one or more address space segments from the address space of the wireless computer network to a new portable wireless network node device after the new portable wireless network node device is authenticated to the wireless computer network.  
   
   
       40 . The method as in  claim 39 , further comprising providing, by the wireless network node device, an internal routable address for the mobile client computing device from the assigned address space segment of the wireless network node device using a procedure comprising a DHCP function on the wireless network node device.  
   
   
       41 . The method as in  claim 37 , wherein the wireless network node devices forwarding communication data on behalf of the mobile client computing devices using a dynamic routing protocol adapted to the wireless network node devices.  
   
   
       42 . The method as in  claim 37 , wherein the wireless network node devices forwarding communication data on behalf of mobile client computing devices using a dynamic bridging protocol adapted to the wireless network node devices.  
   
   
       43 . The method as in  claim 42 , wherein the bridging protocol is based on the IEEE 802.11 WDS links that are dynamically created and removed by the network nodes based on their current local neighboring network node connections.  
   
   
       44 . The method as in  claim 42 , wherein the wireless network node devices performing bridging store a Bridging Table comprising a local interface and neighboring interfaces to the respective wireless network node devices that are the next hop destination in the bridging path.  
   
   
       45 . The method as in  claim 44 , wherein the wireless network node devices performing bridging update their Bridging Table by periodically exchanging bridging update control messages that includes link layer addresses for all attached devices and clients.  
   
   
       46 . The method as in  claim 34 , further comprising serving, by at least one of the wireless network node devices, as a gateway to another network in communication with the wireless computer network, and 
 automatically determining, in accordance with the network routing protocol, periodically executed by the wireless network node devices, the shortest path routes between mobile client computing devices in the wireless computer network or to the gateway.    
   
   
       47 . The method as in  claim 37 , further comprising transferring, by the network wireless node devices, authentication information between themselves when a mobile client computing device roams from the coverage area of one wireless network node device to another wireless network node device to establish authentication and local access at the wireless network node device to provide access service.  
   
   
       48 . The method as in  claim 47 , further comprising maintaining, by the mobile client computing device that roams from the coverage area of one of the wireless network node devices to another of the wireless network node devices, the same address and the routing protocol continues to efficiently route communication data to the mobile client computing device by automatically updating a client-specific host address entry in the routing tables of the wireless network node devices  
   
   
       49 . The method as in  claim 34 , further comprising providing secure communications by encryption of messages and authentication of the wireless network node devices and the mobile client computing devices.  
   
   
       49 . The method as in  claim 34 , wherein the wireless computer network further comprising an authentication server in communication with the wireless network node devices, the method further comprising automatically configuring, by the wireless network node devices, themselves for communication forwarding in the wireless computer network by initiating their operating systems, determining their network addresses when operating in routing mode, contacting the authentication server, obtaining encryption keys and authentication, setting their backbone wireless network and local access service channels, and initiating a dynamic routing or bridging protocol that discovers neighboring wireless network node devices and establishes communication forwarding paths on the backbone wireless network.  
   
   
       51 . The method as in  claim 49 , further comprising requesting, by the unauthenticated new network node, authentication to the backbone network, the unauthenticated new node in communication with at least one of the already authenticated backbone network nodes, one of these backbone network nodes becoming the proxy authenticator node for the unauthenticated new node and communicating with the master authenticator node to authenticate the unauthenticated new node to the backbone network.  
   
   
       52 . The method as in  claim 51 , wherein when operating in a routing mode, further comprising: 
 transmitting, by the unauthenticated new node, identification data to neighboring proxy authenticator nodes,    receiving, by the proxy authenticator nodes, the identification data,    encapsulating the identification data in a message envelope, and    forwarding the encapsulated data to the master authenticator using the routing scheme.    
   
   
       53 . The method as in  claim 51 , further comprising selecting, by the master authenticator node, one backbone node as the proxy authenticator node if more than one backbone node receives and forwards the new node identification data to the master authenticator.  
   
   
       54 . The method as in  claim 53 , wherein the wireless computer network further comprising an authentication server in communication with the master authenticator node and authenticating the unauthenticated new node to the backbone network.  
   
   
       55 . The method as in  claim 54 , further comprising enabling the new node, once authenticated to the backbone network, to become a proxy authenticator for an unauthenticated new wireless node.  
   
   
       56 . The method as in  claim 49 , further comprising using a common group key as part of the encryption scheme for the backbone communications, wherein the group key is used by another key generating method to produce the actual per packet communication encryption key, and the group key is changed periodically and is only valid for a specified period of time, denoted by a start and end time.  
   
   
       57 . The method as in  claim 56 , further comprising periodically generating, by the master authenticator, a new group key and transmitting the new group key to each node in the backbone network by encrypting the group key using a public key based method that only that destination node can decrypt.  
   
   
       58 . The method as in  claim 56 , further comprising transmitting, by the master authenticator, the current active group key to a newly authenticated node by encrypting the group key using a public key based method that only the new node can decrypt, the new node then uses the group key to encrypt backbone communication.  
   
   
       59 . The method as in  claim 56 , wherein each key periodically generated by the master authenticator has a specific valid period, which is specified in each new key transmission, and the received newly generated group key is stored by backbone node devices and only loaded into encryption/decryption engine during the key effective period.  
   
   
       60 . The method as in  claim 59 , wherein the valid periods of consecutively generated group keys by the master authenticator may overlap at the beginning and ending of their valid periods, during which both group keys are valid and the encrypting node devices use the newer group key to encrypt messages but the decrypting node devices may need to try both to decrypt messages, to ensure smooth group key change.  
   
   
       61 . The method as in  claim 59 , further comprising providing, by a wireless network node, access service to at least one of the mobile client computing devices becoming an authenticator for authenticating client devices.  
   
   
       62 . The method as in  claim 61 , wherein one of the wireless network nodes providing access service to at least one of the mobile client computing devices or a separate computer in communication with the wireless network node, being configured as an authentication server for the mobile client computing devices.  
   
   
       63 . The method as in  claim 62 , further comprising authenticating at least one of the mobile client computing devices by an authenticator and an authentication server using the IEEE 802.1x protocol.  
   
   
       64 . The method as in  claim 49 , wherein the authentication and encryption mechanisms are the WiFi Protected Access (WPA) scheme modified to allow the authenticator, master authenticator and authentication server to communicate over multiple hops.  
   
   
       65 . A computer-readable medium storing a program executed by a wireless computer network in communication with mobile client computing devices comprising client wireless devices, the program causing the wireless computer network to execute the functions further comprising: 
 providing, by a wireless backbone network, a wireless networking service to the mobile client computing devices, comprising: 
 providing, by portable wireless network node devices of the wireless backbone network, wireless local access service to the mobile client computing devices in their respective coverage areas,  
 providing the wireless networking service to forward and deliver communication data of the mobile client computing devices on the wireless backbone network in a multi-hop manner to other of the mobile client computing devices or to other networks in communication with the wireless computer network,  
 performing routing, by one or more of the portable wireless network node devices,  
 storing, by the one or more of the portable wireless network node devices, a routing table comprising first data of subnet routes of network layer addresses for the mobile client computing devices and portable wireless network node devices, and second data of subnet routes to gateways for external network addresses and per-host routes of network layer addresses for the mobile client computing devices that have roamed from their initial access service network node coverage area, and per-host routes of link layer addresses for the mobile client computing devices and portable wireless network node devices, and  
 authenticating, by a backbone network node configured as a master authenticator node and another backbone node configured as an authentication server, an unauthenticated new network node to the backbone network with the assistance of another backbone node configured as a proxy authenticator node for the unauthenticated new network node.  
   
   
   
       66 . The medium as in  claim 65 , further comprising: 
 specifying, by the routing table, the local interface and the neighboring interface to the respective wireless network node device that is the next hop-destination in a routing path, and    updating, by the wireless network node devices performing routing, their routing table by periodically exchanging routing update control messages that include IP addresses and link layer addresses.    
   
   
       67 . The computer-readable medium as in  claim 66 , further comprising: 
 providing, by one or more of the portable wireless network node devices, a gateway service, the one or more of the portable network node devices comprising multiple interfaces,    providing, by each gateway service node device having one of the multiple interfaces provides, communication to the wireless backbone network, and    providing, by at least one of the multiple interfaces, communication to the other network in communication with the wireless computer network.    
   
   
       68 . The computer-readable medium as in  claim 66 , wherein the portable wireless network node devices comprises multiple wireless interfaces, the functions further comprising: 
 providing, by at least one of the multiple wireless interfaces, local access service for the mobile client computing devices, and    providing, by at least one of the multiple wireless interfaces, communication with the wireless backbone service.    
   
   
       69 . The computer-readable medium as in  claim 66 , further comprising: 
 controlling, by internal tables provided in each of the portable wireless network node devices, communications forwarding through one of bridging and routing,    automatically and dynamically, by the wireless computer network, adjusting for the movement of the portable wireless network node devices within the wireless computer network, the introduction of additional portable wireless network node devices to the wireless computer network, and the deletion or failure of current portable wireless network node devices by updating its internal tables controlling communications forwarding either through the bridging or the routing implemented in the portable wireless network node devices.    
   
   
       70 . The computer-readable medium as in  claim 69 , wherein when the network is operating in routing mode, sharing, by the wireless computer network, an Internet-style, network layer, address space among the portable wireless network node devices and the mobile client computing devices.  
   
   
       71 . The computer-readable medium as in  claim 70 , further comprising serving, by a portable wireless network node device, as an address manager dynamically assigns a backbone network layer address as well as one or more address space segments from the address space of the wireless computer network to a new portable wireless network node device after the new portable wireless network node device is authenticated to the wireless computer network.  
   
   
       72 . The computer-readable medium as in  claim 71 , further comprising providing, by the wireless network node device, an internal routable address for the mobile client computing device from the assigned address space segment of the wireless network node device using a procedure comprising a DHCP function on the wireless network node device.  
   
   
       73 . The computer-readable medium as in  claim 69 , wherein the wireless network node devices forwarding communication data on behalf of the mobile client computing devices using a dynamic routing protocol adapted to the wireless network node devices.  
   
   
       74 . The computer-readable medium as in  claim 69 , wherein the wireless network node devices forwarding communication data on behalf of mobile client computing devices using a dynamic bridging protocol adapted to the wireless network node devices.  
   
   
       75 . The computer-readable medium as in  claim 74 , wherein the bridging protocol is based on the IEEE 802.11 WDS links that are dynamically created and removed by the network nodes based on their current local neighboring network node connections.  
   
   
       76 . The computer-readable medium as in  claim 74 , wherein the wireless network node devices performing bridging store a Bridging Table comprising a local interface and neighboring interfaces to the respective wireless network node devices that are the next hop destination in the bridging path.  
   
   
       77 . The computer-readable medium as in  claim 76 , wherein the wireless network node devices performing bridging update their Bridging Table by periodically exchanging bridging update control messages that includes link layer addresses for all attached devices and clients.  
   
   
       78 . The computer-readable medium as in  claim 66 , further comprising serving, by at least one of the wireless network node devices, as a gateway to another network in communication with the wireless computer network, and 
 automatically determining, in accordance with the network routing protocol, periodically executed by the wireless network node devices, the shortest path routes between mobile client computing devices in the wireless computer network or to the gateway.    
   
   
       79 . The computer-readable medium as in  claim 69 , further comprising transferring, by the network wireless node devices, authentication information between themselves when a mobile client computing device roams from the coverage area of one wireless network node device to another wireless network node device to establish authentication and local access at the wireless network node device to provide access service.  
   
   
       80 . The computer-readable medium as in  claim 79 , further comprising maintaining, by the mobile client computing device that roams from the coverage area of one of the wireless network node devices to another of the wireless network node devices, the same address and the routing protocol continues to efficiently route communication data to the mobile client computing device by automatically updating a client-specific host address entry in the routing tables of the wireless network node devices  
   
   
       81 . The computer-readable medium as in  claim 66 , further comprising providing secure communications by encryption of messages and authentication of the wireless network node devices and the mobile client computing devices.  
   
   
       82 . The computer-readable medium as in  claim 66 , wherein the wireless computer network further comprising an authentication server in communication with the wireless network node devices, the functions further comprising automatically configuring, by the wireless network node devices, themselves for communication forwarding in the wireless computer network by initiating their operating systems, determining their network addresses when operating in routing mode, contacting the authentication server, obtaining encryption keys and authentication, setting their backbone wireless network and local access service channels, and initiating a dynamic routing or bridging protocol that discovers neighboring wireless network node devices and establishes communication forwarding paths on the backbone wireless network.  
   
   
       83 . The computer-readable medium as in  claim 81 , further comprising requesting, by the unauthenticated new network node, authentication to the backbone network, the unauthenticated new node in communication with at least one of the already authenticated backbone network nodes, one of these backbone network nodes becoming the proxy authenticator node for the unauthenticated new node and communicating with the master authenticator node to authenticate the unauthenticated new node to the backbone network.  
   
   
       84 . The computer-readable medium as in  claim 83 , wherein when operating in a routing mode, further comprising: 
 transmitting, by the unauthenticated new node, identification data to neighboring proxy authenticator nodes,    receiving, by the proxy authenticator nodes, the identification data,    encapsulating the identification data in a message envelope, and    forwarding the encapsulated data to the master authenticator using the routing scheme.    
   
   
       85 . The computer-readable medium as in  claim 83 , further comprising selecting, by the master authenticator node, one backbone node as the proxy authenticator node if more than one backbone node receives and forwards the new node identification data to the master authenticator.  
   
   
       86 . The computer-readable medium as in  claim 85 , wherein the wireless computer network further comprising an authentication server in communication with the master authenticator node and authenticating the unauthenticated new node to the backbone network.  
   
   
       87 . The computer-readable medium as in  claim 86 , further comprising enabling the new node, once authenticated to the backbone network, to become a proxy authenticator for an unauthenticated new wireless node.  
   
   
       88 . The computer-readable medium as in  claim 81 , further comprising using a common group key as part of the encryption scheme for the backbone communications, wherein the group key is used by another key generating method to produce the actual per packet communication encryption key, and the group key is changed periodically and is only valid for a specified period of time, denoted by a start and end time.  
   
   
       89 . The computer-readable medium as in  claim 88 , further comprising periodically generating, by the master authenticator, a new group key and transmitting the new group key to each node in the backbone network by encrypting the group key using a public key based method that only that destination node can decrypt.  
   
   
       90 . The computer-readable medium as in  claim 88 , further comprising transmitting, by the master authenticator, the current active group key to a newly authenticated node by encrypting the group key using a public key based method that only the new node can decrypt, the new node then uses the group key to encrypt backbone communication.  
   
   
       91 . The computer-readable medium as in  claim 88 , wherein each key periodically generated by the master authenticator has a specific valid period, which is specified in each new key transmission, and the received newly generated group key is stored by backbone node devices and only loaded into encryption/decryption engine during the key effective period.  
   
   
       92 . The computer-readable medium as in  claim 91 , wherein the valid periods of consecutively generated group keys by the master authenticator may overlap at the beginning and ending of their valid periods, during which both group keys are valid and the encrypting node devices use the newer group key to encrypt messages but the decrypting node devices may need to try both to decrypt messages, to ensure smooth group key change.  
   
   
       93 . The computer-readable medium as in  claim 91 , further comprising providing, by a wireless network node, access service to at least one of the mobile client computing devices becoming an authenticator for authenticating client devices.  
   
   
       94 . The computer-readable medium as in  claim 93 , wherein one of the wireless network nodes providing access service to at least one of the mobile client computing devices or a separate computer in communication with the wireless network node, being configured as an authentication server for the mobile client computing devices.  
   
   
       95 . The computer-readable medium as in  claim 94 , further comprising authenticating at least one of the mobile client computing devices by an authenticator and an authentication server using the IEEE 802.1x protocol.  
   
   
       96 . The computer-readable medium as in  claim 81 , wherein the authentication and encryption mechanisms are the WiFi Protected Access (WPA) scheme modified to allow the authenticator, master authenticator and authentication server to communicate over multiple hops.