MOBILITY SIGNALING DELEGATION

Abstract

Systems and methods are described which delegate reachability testing for mobility signaling in communication networks. A mobile node transmits a mobility signaling package to other network nodes, which can use the information contained therein to perform the delegated reachability testing.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings illustrate exemplary embodiments, wherein:

FIG. 1( a) depicts the message traffic flow for a return routability procedure under OMIPv6;

FIG. 1( b) shows the contents of the message data section of a Care of Test Init message;

FIG. 1( c) shows the contents of the message data section of a Care of Test message;

FIG. 2( a) depicts a mobile node (MN) communicating with a correspondent node (CN) through a home agent;

FIG. 2( b) depicts a mobile node (MN) communicating with a correspondent node (CN) through an access router (AR);

FIG. 3 illustrates communication paths and a sequence for communications according to an exemplary embodiment;

FIG. 4 shows the contents of the message data section of a router mobility solicitation (RtMobSol) message according to exemplary embodiments;

FIG. 5 shows the contents of the message data section of a Prefix Test Init (PreTI) message according to exemplary embodiments;

FIG. 6 depicts a network node according to exemplary embodiments.

DETAILED DESCRIPTION

The following detailed description of the exemplary embodiments refers to the accompanying drawings. The same reference numbers in different drawings identify the same or similar elements. Also, the following detailed description does not limit the invention. Instead, the scope of the invention is defined by the appended claims.

In order to provide some context for this discussion, a brief discussion of exemplary components used by a mobile network (MN) for communications will now be described according to FIGS. 2(a) and 2(b). FIG. 2(a) depicts an initial communication setup for a MN 202 that is currently attached to its home network 204. The home network 204 contains MN 202 and a home personal computer (PC) 214. MN 202 is in communication with correspondent node (CN) 212. Communications for MN 202 flow through its home agent 206 (typically a router) then to the Internet 210 and ending at CN 212. Additionally, an access router (AR) 208 is also shown to be connected to the Internet. It is to be understood that there typically would be a plurality of routers (not shown) within Internet 210 through which communications between MN 202 and CN 212 flow. In FIG. 2(b) MN 202 has left its home network 204 and is now communicating to CN 212 through AR 208 and the Internet 210.

According to exemplary embodiments the task of performing the care of address (CoA) reachability test(s) is delegated by the MN to parts of the network infrastructure, such as access routers. This delegation eliminates residual latency due to the CoA reachability test for the MN, ensures that the messages exchanged are authenticated, and optimizes the battery power consumption of the device associated with the MN. This exemplary protocol achieves this goal by using the MN's 64-bit subnet prefix for testing the reachability of the new CoA. Exemplary embodiments will now be described with respect to FIGS. 3-5.

FIG. 3 depicts communication paths and signaling according to exemplary embodiments of the present invention. Initially, a MN 302 enters the communication area of a new AR (AR-1304 in this example) and transmits a mobility package 312 to the new AR-1304. The mobility package 312 can be sent as an Internet Control Message Protocol version 6 (ICMPv6) message, e.g., using a format similar to that of the unicast RtAdv message. The mobility package 312 contains a router mobility solicitation (RtMobSol) message, as shown in FIG. 4, which contains, for example, the CN's IPv6 address 402 and the MN's IPv6 home address 404. The MN's IPv6 home address 404 is the address of the MN 302 when the MN 302 is part of its home network. Additionally, the MN's Layer 2 (link layer) address 410 and an optional “A” bit 406 and/or an “S” bit 408 can be contained in the RtMobSol message.

The RtMobSol message can be authenticated using, for example, the shared key obtained via the OptiSEND protocol. The OptiSEND protocol is described in more detail below. AR-1304 receives the mobility package 312 from MN 302 and replies via a unicast message with an authenticated acknowledgement 314 to MN 302. This authenticated acknowledgement 314 can be transmitted as a router mobility acknowledgement (RtMobAck) message which contains, for example, OptiSEND related parameters such as the value at the tip of the One Way Hash Chain, the shared secret, etc.

Additionally AR-1304 forwards the contents of the RtMobSol message, shown as hint 316 in FIG. 3, to neighboring ARs, which in this exemplary embodiment is AR-2306. Upon receipt of the hint 316 by AR-2306, the contents of the RtMobSol message can be stored along with the data obtained from running the OptiSEND protocol on the access routers. AR-2306 forwards a hint 324, which contains the contents of the RtMobSol message, to its neighboring ARs, in this case, AR-3308. This forwarding can continue as long as the MN 302 is moving within the same domain. When AR-2306 detects a Layer two attachment from MN 302, AR-2306 performs a CoA reachability test with CN 310. This CoA reachability test can be delegated to, and performed by, AR-2306 because the forwarded contents of the RtMobSol message contain the information needed to perform the CoA reachability test, such as the CN's IPv6 addresses 402 and the MN's IPv6 home address 404. Note that in addition to, or as an alternative to, hint forwarding as described above, ARs can also use hints received via the link layer. The delegated CoA reachability test according to an exemplary embodiment will now be described.

The CoA reachability test is initiated by AR-2306. Initially, AR-2306 sends a Prefix Test nit (PreTI) message 326 to CN 310. As shown in FIG. 5, the PreTI message 326 contains the MN's home IPv6 address 502, the CN's IPv6 address 504 and a source address 506. The source address 506 contains a subnet prefix which is advertised to the MN 302, in this example, the subnet prefix of AR-2306. The PreTI message 326 contains the MN's home IPv6 address 502 to allow CN 310 to fetch the corresponding key mobility signaling key (Kms) from its correspondent binding cache entry (BCE) in order to validate the PreTI message 326.

Returning to FIG. 3, CN 310 receives a valid PreTI message 326 from AR-2306. CN 310 computes a prefix keygen token from the 64-bit prefix used in the IPv6 source address and the long lifetime shared secret between the MN 302 and CN 310, e.g., the key binding mechanism (Kbmperm) generated from using the OMIPv6 protocol. According to some exemplary embodiments, the prekey token calculation 328 is computed by CN 310 using the following equation:

Prekey Token=First (64, SHA1 (SA_Prefix|nonce|SHA1(Kbmperm))   (1)

where SA_Prefix is the 64-bit prefix carried by the IPv6 source address sent in the PreTI message 326 and Kbmperm is the long lifetime shared secret generated by the CN 310 when running under OMIPv6 protocol. Alternatively, other methods for prekey token calculation 328 could be used.

After token calculation step 328, the CN 310 generates a prefix test (PreT) message 330. This PreT message 330 is an acknowledgement message which is sent back to the same IPv6 source address that was carried in the PreTI message 326, which in this example is the source address of AR-2306. Again it should be noted that the specific address used as the source address is not important as long as an appropriate subnet prefix is used. Additionally, the PreT message 330 contains the MN's 302 home address and is authenticated with the Kms. AR-2306 then receives PreT message 330 from CN 310.

Upon completion of the CoA reachability test, AR-2304 sends an acknowledgement message to MN 302. MN 304 then transmits a binding update (BU) message to CN 310. CN 310 receives the BU message from MN 302. This then allows follow on communications to occur and be transmitted via normal MIPv6 protocols for MN 302 and CN 310.

Subsequent reachability test messages will also be sent by the MN's current AR on behalf of the MN. Additionally, as a MN continues to roam, this procedure can be used when a MN enters a region where a MN needs to use a new AR. To assist in this process, when a MN establishes a session with new CN, it can send a RtMobSol message to its current AR that sets a new bit. Two exemplary bit options, as shown in FIG. 4, are an “A” or add bit 406 and “S” or suppress bit 408. The “A” bit 406, e.g., if set to “1”, can request the AR to forward the new CN's IPv6 address to potential new AR(s). The “S” bit 408, e.g., if set to “1”, can be used to request the AR(s) to remove an existing CN's IPv6 address from its list. Additionally, other bit options can be created and used as desired in a RtMobSol message.

Security is useful for the communications used when a MN attaches to a new AR and the CoA test is performed with a CN. Without appropriate security measures, malicious nodes can attempt to enter a network and imitate the MN with respect to ARs and CNs. According to exemplary embodiments, and as briefly mentioned above, the MN shares some aspects of security with the ARs. More specifically, a shared secret is created that the MN, ARs and CN share. Thus, when a malicious node enters a network imitating a valid MN and attempts to correspond with an AR, the malicious node will be denied access due its lacking a shared secret with the AR.

Secure Neighbor Protocol Discovery (SEND) was designed to mitigate potential threats against the IPv6 Neighbor Discovery Protocol (NDP). SEND is based upon a Cryptographically Generated Address (CGA) and relies upon using a RSA signature. RSA is an algorithm typically used in public key encryption. An improvement upon SEND is Optimized SEND (OptiSEND) which reduces the processing requirements for mobile devices while still maintaining security and efficiency. OptiSEND provides that the ARs rely on one-way hash chains and shared secretes to authenticate messages, such as, router advertisement messages. OptiSEND also provides that outside nodes (ONs) authenticate a special set of messages by using a shared secret obtained from using CGA technology when exchanging a particular message with an AR. Additionally, OptiSEND provides that ON auto-configures additional IPv6 addresses (as needed) by using the shared secret and other parameters to compute new interface identifiers.

In the above exemplary embodiment, the CoA reachability test, or prefix reachability test, was authenticated. This authentication is desirable for some exemplary embodiments, but not always required. In order to perform the authentication, the hash of the symmetric key generated from running the OptiSEND protocol can be used. This key, Kms, is preferably sent from the MN to each CN in the first binding update (BU) message. Additionally, the Kms is preferably sent in an encrypted form to each CN. In order to do this, the MN will typically use the Kbm generated during the first (and typically only unless the shared secret life has expired) return routability test performed in OMIPv6 to encrypt the kms. The Kms will be carried in a new option called signaling delegation (SID). The SID will reach a CN upon receiving a BU containing a SID option from a MN. A CN will then, preferably, decrypt the Kms and store the decrypted Kms in the MN's corresponding binding cache entry (BCE).

The exemplary embodiments described above provide for messages and protocols involving access routers and other network nodes. An exemplary network node 600 will now be described with respect to FIG. 6. Network node 600 can contain a processor 602 (or multiple processor cores), memory 604, one or more secondary storage devices 606 and an interface unit 608 to facilitate communications between network node 600 and the rest of the network. The memory can be used for storage of exemplary items described above such as the contents of a RtMobSol message, BCE, decrypted Kms or any other desirable information such as address lookup tables. Thus, a network node according to an exemplary embodiment may include a processor for transmitting and receiving messages associated with at least one of CoA information related to a mobile network and/or a correspondent node.

The above-described exemplary embodiments are intended to be illustrative in all respects, rather than restrictive, of the present invention. Thus the present invention is capable of many variations in detailed implementation that can be derived from the description contained herein by a person skilled in the art. All such variations and modifications are considered to be within the scope and spirit of the present invention as defined by the following claims. No element, act, or instruction used in the description of the present application should be construed as critical or essential to the invention unless explicitly described as such. Also, as used herein, the article “a” is intended to include one or more items.

Claims

1. A method of exchanging mobility signaling in a session between a mobile node and a correspondent node comprising the steps of: sending from said mobile node, to a first access router: a home address of said mobile node;a Layer two address of said mobile node; andan address of said correspondent node;sending from said first access router, to a second access router: said home address of said mobile node;said Layer two address of said mobile node; andsaid address of said correspondent node;detecting at said second access router a Layer two attachment of said mobile node;sending from said second access router to said correspondent node a test init message comprising said home address of said mobile node;calculating at said correspondent node a token for said mobile node;sending from said correspondent node, to said second access router a test init response message comprising said token; andsending from said second access router to said mobile node said token.

2. The method of claim 1, wherein said mobile node sends to said first access router said home address of said mobile node, said Layer two address of said mobile node, and said address of said correspondent node upon acquiring a first care of address from said first access router.

3. The method of claim 2, further comprising: acquiring for said mobile node a second care of address from said second router; andsending from said mobile node said home address of said mobile node, said Layer two address of said mobile node, and said address of said correspondent node once per session.

4. The method of claim 1, further comprising a plurality of second access routers, wherein said first access router sends said home address of said mobile node, said Layer two address of said mobile node, and said address of said correspondent node to each of said plurality of second access routers.

5. The method of claim 1, further comprising a plurality of correspondent nodes wherein: said second access router sends test init messages to each correspondent node;said each correspondent node calculates a specific token;said each correspondent node sends test init response messages comprising said specific token to said second access router in said test init response messages; andsaid second access router forwards all specific tokens to said mobile node.

6. The method of claim 1, wherein the mobile node uses said token to authenticate messages exchanged between said mobile node and said correspondent node.

7. A mobile node comprising: a processor in communications with a memory unit;wherein said processor transmits a first message to a network node which connects said mobile node to a network, said first message containing information usable to perform a reachability test, said information including: said mobile node's home address; andsaid correspondent node's address.

8. The mobile node of claim 7, wherein said first message further includes a bit for indicating an address of a correspondent node.

9. The mobile node of claim 7, wherein said first message further includes a bit for suppressing an address of a correspondent node.

10. The mobile node of claim 7, wherein said first message is authenticated.

11. The mobile node of claim 7, wherein said first message is authenticated via a shared secret obtained from OptiSEND.

12. A network node for receiving a first message from a mobile node comprising: a processor in communications with a memory unit;wherein said processor receives said first message from said mobile node, said first message including said mobile node's home address and a correspondent node's address, and transmits a second message containing the contents of said first message to a plurality of network nodes.

13. The network node of claim 12, wherein one of said plurality of network nodes receives said second message and transmits a third message to a correspondent node, said third message comprising: said mobile node's home address;said correspondent node's address; anda source address.

14. The network node of claim 12, wherein said network node is an access router.

15. A correspondent node for receiving messages comprising: a processor in communications with a memory unit;wherein said processor, upon receiving a first message from a network node including a mobile node's home address and a source address calculates a token and sends a second message to a network node related to said source address contained in said first message, said second message comprising: said token; andsaid mobile node's home address.

16. The correspondent node of claim 15, wherein said source address has a subnet prefix associated with at least one of: said mobile node and an access router through which the mobile node communicates with said correspondent node.

17. A method for mobility signaling in a network comprising: receiving, by a network node, a first message from a mobile node, said first message including said mobile node's home address and a correspondent node's address;transmitting a second message containing contents of said first message to a plurality of other network nodes;receiving, by one of said plurality of other network nodes, said second message, and transmitting a third message to a correspondent node, said third message comprising: said mobile node's home address;said correspondent node's address; anda source address.

18. The method of claim 17, wherein said network node is an access router.