Packet-oriented data communications between mobile and fixed data networks

[0001] The present invention generally relates to packet data communications between mobile and fixed data networks and particularly relates to address handling for such data communications.

[0002] A typical packet -oriented data network comprises a plurality of data processing nodes each having a processor, a memory connected to the processor, computer program code stored in the memory and executable by the processor, and a network interface to couple the node to the network. The computer program code includes application programs for effecting data communication under program control with other nodes in the network via the network interface. Data traffic is communicated from a source node to a destination in discrete packets referred or protocol data units (PDUs). Each PDU comprises a header portion and a payload portion. The payload portion carries data to be communicated. The header portion carries control information for effecting communication of the PDU to the destination. Such PDUs are communicated from an application program in the source node to an application program in the destination node in accordance with the International Standards Organization (ISO) reference model. The ISO reference model defines a stack of logical data processing protocol layers between the application programs in the source node and destination node and the network. Data to be communicated from the source application program to the designation application program is passed from the source application program to the network via the protocol stack at the source node. On receipt, the data is passed from the network to the destination application program via the protocol stack at the destination node.

[0003] The stack at both the source node and the destination node comprises an application layer, a presentation layer, a session layer, a transport layer, a network layer a link layer, and a physical layer. The application layer provides a user interface to a range of network-wide distributed services such as file transfer access and management, as well as general message interchange services such as electronic mail. The application layer is disposed between the application program and the presentation layer. The presentation layer negotiates and selects appropriate transfer syntaxes to be used during a transaction so that the syntax of messages being exchanged between two application entities is maintained. The presentation layer is disposed between the application layer and session layer. The session layer allows two application layer protocol entities to manage data exchanges by, for example, establishing and clearing communication channels between the entities. The session layer is disposed between the presentation layer and the transport layer. The transport layer acts as an interface between higher application oriented layers and lower network oriented layers by providing the session layer with a message transfer facility that is independent of the underlying network type. The transport layer is disposed between the session layer and the network layer. By providing the session layer with a predefined set of message transfer facilities, the transport layer hides the detailed operation of the underlying network from the session layer. The network layer is responsible for establishing and clearing a network connection between to transport layer protocol entities and includes such functionality as network routing. The network layer is disposed between the transport layer and the link layer. The link layer builds on a physical connection provided by the network to provide the network layer with information transfer facilities such as error correction and retransmission of messages in the event of a transmission error. The link layer is disposed between the network layer and the physical layer. The physical layer provides the physical and electrical interfaces between the node and the network.

[0004] At each layer of the protocol stack in the source, a PDU containing data and control information from the previous layer is augmented by control information from the current layer. Data from the source application program is augmented by a header portion containing application layer protocol control information at the application layer to form an application layer PDU (APDU). The APDU is augmented by a header portion containing presentation layer protocol control information at the presentation layer to form a presentation layer PDU (PPDU). The PPDU is augmented by a header portion containing session layer protocol control information at the session layer to form a session layer PDU (SPDU). The SPDU is augmented by a header portion containing transport layer protocol control information at the transport layer to form a transport layer PDU (TPDU). The TPDU is augmented by a header portion contain network layer protocol control information at the network layer to form a network layer PDU (NPDU). The NPDU is augmented by link layer protocol control information at the link layer to form a physical layer PDU or datagram for communication to the destination on the physical network.

[0005] In some data communications environments, the application layer, presentation, and session layer functions may be combined into a single protocol layer. An example of such an environment is that of the Transmission Control Protocol/Internet Protocol (TCP/IP) environment. In the TCP/IP environment, the combined functionality of the application layer, the presentation layer, and the session layer is provided via a plurality of protocols such as the File Transfer Protocol (FTP); the Remote Terminal Protocol (TELNET); the Simple Mail Transfer-Protocol (SMTP), and the Name Server Protocol (NSP). The transport layer is provided by the Transmission Control Protocol and/or the User Datagram Protocol (UDP). The network layer is provided by the Internet Protocol (IP). Data from a source application is augmented by a header portion containing TCP control information at the TCP layer to from a TCP PDU. The TCP PDU is augmented by header information contain IP protocol control information at the IP layer to form a TCP/IP datagram

[0006] In a typical TCP/IP network, the addresses and the source and destination nodes are embedded in each datagram to be communicated. At the application program in the source, the address of the destination is typically symbolic in form. For example, the name of a remote host system connected to the network would be regarded as a symbolic address. To effect communication of a PDU from the source node to the destination node, the symbolic network address is translated into a binary network layer address. The translation process is generally known as address resolution. Address resolution is typically performed at the transport and network layers of the protocol stack at the source node. The network then performs routing at intermediate nodes based on the address of the destination node. Routing tables are employed at the intermediate nodes to direct the datagram to the next best hop on its path to the destination. Further details of address resolution can be found in Douglas E. Comer: Internetworking with TCP/IP Volume 1. Second Edition. Prentice Hall 1991.

[0007] Address resolution typically involves a lookup function in a distributed database. In operation, the database maps the symbolic address to the corresponding binary network layer address. In general, the source node is either connected to the database, or has a locally stored replica thereof. For example, in a typical TCP/IP network, there is usually provided a Domain Name System (DNS) in which distributed name servers are employed for facilitating TCP/IP communications between nodes. Conventionally, the nodes of fixed networks have sufficient computing resources to either perform the aforementioned address look up function over the network or to otherwise cache excerpts of the name services required to perform address resolution. Additionally, the network infrastructure generally has sufficiently low latency and sufficiently high bandwidth to rapidly deliver the data required for address resolution on demand.

[0008] A typical mobile data communications network, such as a Wireless Application Protocol (WAP) network, comprises a plurality of mobile data processing devices. The mobile devices are capable of communicating with each other via the wireless network and also with remote host data processing nodes in a fixed network. Such devices typically comprise a processor, a memory connected to the processor, computer program code stored in the memory and executable by the processor, and a network interface to couple the node to the network. The computer program code includes application programs for effecting data communication under program control with other devices in the network via the network interface. Examples of such devices include mobile telephones and personal digital assistants. The mobile devices typically communicate with the fixed network via a gateway connected to the fixed network. In a WAP network, the host systems in the wired network are known as origin servers. In general, mobile data processing devices do not have as much memory available as data processing nodes of a fixed network. Also, mobile devices are usually limited in data storage capability for a variety of reasons, including power consumption, physical volume, and weight. Mobile networks have lower bandwidth and higher latency than fixed networks. Therefore, the data traffic handling capability of mobile networks is generally more limited than that of fixed networks. Also, a permanent connection between a mobile network and the devices therein is not usually maintained in the interests of preserving power reserves. There are also location dependent interruptions in the connection of a mobile device in transit and the mobile network as the device roams from one region of network coverage to another. It will be appreciated therefore that maintaining an up to date record of address resolution information in a mobile device is very difficult indeed.

[0009] A conventional solution to this problem is to defer address resolution to a network gateway through which mobile devices connect to the mobile network. The network gateway performs address resolution from a symbolic address to a network layer address. An example of this approach can be found in WAP networks. Typically, a mobile device connects to a WAP network via a pull proxy server usually known as a WAP gateway. The WAP gateway performs the address resolution. The mobile device has an application layer protocol for effecting data communications between the resident applications and the WAP gateway. However, a symbolic destination address is sent from the mobile device to the WAP gateway in the form of a Universal Resource Locator (URL) because the mobile device does not perform address resolution. A session layer protocol known as the Wireless Session Protocol (WSP) effects communication of the URL from the mobile device to the gateway. The URL is then resolved by an Hypertext Transfer Protocol/Transmission Control Protocol/Internet Protocol (HTTP/FCP/IP) stack at the gateway. Specifically, the HTTP element performs the IP address resolution. Further details of WSP can be found in WAP Forum: Wireless Application Protocol: Wireless Session Protocol Specification, May 2000.

[0010] It would be desirable to employ such a mobile network to communicate encrypted information where session layer and/or lower layer data payloads are encrypted according to a security protocol such as the Wireless Transport Layer End to End Security (WTLS) protocol specified by the WAP Forum. Further details of the WTLS protocol can be found in WAP Forum: Wireless Application Protocol: Wireless Transport Layer End to End Security Specification, July 2000. However, such security protocols typically involve encryption of the symbolic destination address. The encrypted address is then decrypted before address resolution can be performed at the gateway. The decryption breaks end to end security. Thus, the secure communications channel, known as a WTLS session in a WAP network, extends from the mobile device as far as the gateway only and not beyond. For security sensitive applications such as finance or medical applications, this is undesirable.

[0011] A conventional solution to the problem of providing end to end security in a mobile data communications network involves redirection of session layer traffic to a secondary pull proxy server resident in a secure domain established by the communications service provider. Provisioning information in the form of a navigation document is then supplied to the mobile device by the secondary server to allow the mobile device to redirect communications at the session layer. Another conventional solution is to perform destination address resolution at the mobile device with subsequent tunneling at the transport layer by the gateway. The transport layer tunnel is established by a peer-proxy protocol compliant with either UDP or the Wireless Datagram Protocol, a WAP communication protocol analogous to UDP. This approach however incurs additional processing.

[0012] In accordance with the present invention, there is now provided a computing device comprising: a processor; a memory connected to the processor; an application program stored in the memory and executable by the processor for generating data for communication to a remote computer system via a network based on a symbolic control information, a communications protocol stack stored in the memory and executable by the processor for effecting communication of the data from the mobile device to the remote system, the protocol stack having an application layer for receiving the data from the application program and locating the data received in an application layer protocol data unit, and a network layer for receiving the application layer protocol data unit from the application layer, locating the application layer protocol data unit in a network layer protocol data unit, locating the symbolic control information in the network layer protocol data unit separately from the application layer protocol data unit, and forwarding the network layer protocol data unit to the network for transmission to the remote system.

[0013] Preferably, the control information comprises a network address of the remote system. The control information may be located by the network layer in an options field of the network layer protocol data unit. In a preferred embodiment of the present invention, an unused option code is assigned to the control information. In another preferred embodiment of the present invention, the control information is written into an existing option code. Alternatively, the control information is located in the network layer protocol data unit by network tunneling. The present invention also extends to a mobile telephone comprising a computing device as hereinbefore described. Similarly, the present invention extends to a server computer system comprising a computing device as hereinbefore described.

[0014] Viewing the present invention from another aspect, there is now provided a method for communicating data between a computer device and a remote computer, the method comprising: generating the data by an application program in the computing device for communication to the remote system via a network based on a symbolic control information; receiving the data by an application layer of a communications protocol stack in the computing device; locating, by the application layer, the data in an application layer protocol data unit; forwarding by the application layer the application layer protocol data unit to a network layer of the protocol stack; receiving at the network layer the application layer protocol data unit from the application layer; locating by the network layer the application layer protocol data unit in a network layer protocol data unit; locating by the network layer the symbolic control information in the network layer protocol data unit separately from the application layer protocol data unit; and forwarding by the network layer the network layer protocol data unit to the network for transmission to the remote system. The present invention also extends to a computer program element comprising computer program code means which, when loaded in a processor of a computer system configures the processor to perform a method as hereinbefore described.

[0015] In a preferred embodiment of the present invention, symbolic address information is embedded into network layer datagrams separately from the data payloads. Data communications are then effected via the gateway. The network layer at the gateway detects the symbolic address and resolves it into a network layer address. Embedding is performed so that the payload of the network layer protocol data unit remains unaffected. The address resolution is transparent to protocol layers higher up the stack. No decryption of payload data is needed. Thus, end to end network security can be maintained. The present invention is equally applicable to types of embedded control information other than address data.

[0016] Embodiments of the present invention are superior to the aforementioned conventional solutions because they avoid the introduction of additional traffic between the server, the gateway, and the mobile device otherwise brought about by the supply of a navigation document to the mobile device, and because they avoid session redirection and/or execution of a peer proxy protocol. The conventional solutions hereinbefore described also incur other overheads such as reconfiguration of the mobile device and management of the navigation documents both in the mobile device and in the network infrastructure are likewise avoided by embodiments of the present invention. Redirection of communications via a navigation document involves the establishment of two connection for every destination server beyond the gateway. The connection set up time is thus incurred twice. This adds to the response time perceived by the end user. In preferred embodiments of the present invention, only a single connection set up need be established. The same connection can then be used for communications with multiple different destination servers.

[0017] Preferred embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0018]
FIG. 1 is a block diagram of an example of a data processing system;

[0019]
FIG. 2 is a block diagram of an example of a mobile data communications environment;

[0020]
FIG. 3 is a simplified block diagram of a datagram for communication within the environment;

[0021]
FIG. 4 is a block diagram of a communications path from a source node to a destination via a network;

[0022]
FIG. 5 is another block diagram of the communications path;

[0023]
FIG. 6 is another block diagram of a datagram from communication within the environment;

[0024]
FIG. 7 is yet another block diagram of a datagram from communication within the environment; and,

[0025]
FIG. 8 is a block diagram of a tunneling datagram.

[0026] Referring first to FIG. 1, an example of a data processing system 80 comprises: a central processing unit (CPU) 10; a memory subsystem 20; a user input subsystem 30; a user output subsystem 40, and network interface 50 all interconnected by bus subsystem 60. In operation, the central processing unit 10 executes computer program instruction codes stored in the memory subsystem 20. The computer program codes include operating system software and application program software for execution in conjunction with operating system software.

[0027] The application program software operates on data stored in the memory subsystem 20. The user can control execution of the application software via the user input subsystem 30. Application software and data can be communicated between the memory subsystem 20 and an external data network 70 via the network interface 50.

[0028] Referring now to FIG. 2, an example of a mobile data communications environment comprises a mobile data processing device 100 connected to a mobile data communications network 110. The mobile network 110 is connected to a fixed data communications network 130 via a gateway 120. An origin server 140 is connected to the gateway 120 via the fixed network 130. The mobile device 100, the gateway 120, and the origin server 140 each comprise the data processing system 80 hereinbefore described with reference to FIG. 1. The mobile device 100 may be a mobile telephone, persona digital assistant or the like, or an embedded system, e.g. a mobile sensor.

[0029] Data communications between mobile device 100, the gateway 120, and the origin server 140 is effected via the fixed network 130 and the mobile network 110 through execution of computer program code by the central processing units 10 of mobile device 100, the gateway 120, and the server 140. With reference to FIG. 3, as mentioned earlier, data traffic is communicated from a source node to a destination in discrete packets or protocol data units (PDUs) 200. Each PDU 200 comprises a header portion 220 and a payload portion 210. The payload portion 210 carries data to be communicated. The header portion 220 carries control information for effecting communication of the PDU 200 to the destination.

[0030] Referring now to FIG. 4, data is communicated from a source application program 300 in the mobile device 100 to a destination application program 310 in the server 140 in accordance with the International Standards Organization (ISO) reference model. The ISO reference model defines a stack of logical data processing protocol layers between the source and destination application programs 300 and 310 and the network infrastructure intervening between the mobile device 100 and the server 140. Such a protocol stack 330 is resident in the mobile device 100. A similar protocol stack 320 is resident in the server 140. Data to be communicated from the source application program 300 to the designation application program 310 are passed in PDUs 200 from the source application program 300 to the network infrastructure via the protocol stack 330 in the mobile device 100. On receipt, the PDUs 200 are passed from the network infrastructure to the destination application program 310 via the protocol stack 320 in the server 140.

[0031] The protocol stacks 320 and 330 each comprise an application layer 340, a presentation layer 350, a session layer 360, a transport layer 370, a network layer 380, a link layer 390, and a physical layer 400. The application layer 340 provides a user interface to a range of network-wide distributed services such as file transfer access and management as well as general message interchange services such as electronic mail. The application layer 340 is disposed between the application program 300 and the presentation layer 350. The presentation layer 350 negotiates and selects appropriate transfer syntaxes to be used during a transaction so that the syntax of messages being exchanged between two application entities is maintained. The presentation layer 350 is disposed between the application layer 340 and session layer 360. The session layer 360 allows two application layer protocol entities to manage data exchanges by, for example, establishing and clearing communication channels between the entities. The session layer 360 is disposed between the presentation layer 350 and the transport layer 370. The transport layer 370 acts as an interface between higher application oriented layers and lower network oriented layers by providing the session layer 360 with a message transfer facility that is independent of the underlying network type. The transport layer 370 is disposed between the session layer 360 and the network layer 380. By providing the session layer 360 with a predefined set of message transfer facilities, the transport layer 370 hides the detailed operation of the underlying network from the session layer 360. The network layer 380 is responsible for establishing and clearing a network connection between to transport layer protocol entities and includes such functionality as network routing. The network layer 380 is disposed between the transport layer 370 and the link layer 390. The link layer 390 builds on a physical connection provided by the network to provide the network layer 380 with information transfer facilities such as error correction and retransmission of messages in the event of a transmission error. The link layer 390 is disposed between the network layer 380 and the physical layer 400. The physical layer 400 provides the physical and electrical interfaces between the node and the network.

[0032] Referring now to FIG. 5, at each layer of the source protocol stack 330, a PDU containing data and control information from the previous layer is augmented by control information from the current layer. Data 500 from the source application program 300 is augmented by a header portion 510 containing application layer protocol control information at the application layer 340 to form an application layer PDU (APDU) 570. The APDU 570 is augmented by a header portion 520 containing presentation layer protocol control information at the presentation layer 350 to form a presentation layer PDU (PPDU) 580. The PPDU 580 is augmented by a header portion 530 containing session layer protocol control information at the session layer 360 to form a session layer PDU (SPDU) 590. The SPDU 590 is augmented by a header portion 540 containing transport layer protocol control information at the transport layer 370 to form a transport layer PDU (TPDU) 600. The TPDU 600 is augmented by a header portion 550 contain network layer protocol control information at the network layer 380 to form a network layer PDU (NPDU) 610. The NPDU 610 is augmented by a header portion 560 containing link layer protocol control information at the link layer 390 to form a physical layer PDU for communication to the server 140 via the physical network. The PDU transmitted on the network is sometimes referred to as a datagram. At the server 140, the received PDU is progressively reduced as it passes through the layers of the stack 320 until the data 500 is recovered and provided to the destination application program 310.

[0033] With reference to FIGS. 2, 4, and 5 in combination, the gateway 120 also comprises a protocol stack similar to that of the mobile device and the server 140. However, the gateway stack had been omitted from FIGS. 4 and 5 in the interests of simplicity of explanation.

[0034] Referring back to FIGS. 2 and 3, the address of both the source mobile device 100 and the destination server 140 are embedded in each PDU to be sent from the mobile device 100 to the server 140. At the application program 300 in the mobile device 100, the address of the server 140 is symbolic in form. Specifically, the address of the server 140 is presented at the application program 300 in the mobile device 100 as the name of the server 140, e.g.: www.server.com. To effect communication of the PDU from the mobile device 100 to the server 140, the symbolic network address is translated into a binary network layer address by an address resolution function. End to end security in the communications environment is maintained by embedding protocol control information such as symbolic address information into datagrams at the network layer 380 of the protocol stack 300.

[0035] Referring now to FIG. 6, the header portion 550 of the NPDU 610 comprises a variable length options field 551. The options field 551 is employed for placing additional parameter data in the header portion 550 of the NPDU 610. With reference to FIG. 7, in a preferred embodiment of the present invention, control information 552 such as symbolic addresses are embedded into the options field 551 in the header portion 550 of each NPDU 610. The control information can be embedded in the option field 551 in a number of different ways.

[0036] For example, in a particularly preferred embodiment of the present invention, a new option code is defined for carrying the control information 552 within the option field 551. The control information is then copied into the new option code at the source network layer 380 when the header portion 550 of the NPDU 610 is generated. Intermediate routers unfamiliar with the new option code pass datagrams containing the new option code from the source towards the destination unchanged. This has the advantage that the control information 240 can be passed across multiple routing hops to eventually reach a point along the route where the option code is detected and address resolution is performed.

[0037] Referring back to FIG. 2, the network layer 380 on the gateway 120 is enabled to intercept and extract any symbolic address information 552 contained in the options field 551 of NPDUs 610 received from the mobile device 100, and to act as an agent for performing address resolution. The original and possibly encrypted payload 600 remains unaffected as it passes from the mobile device 100 to the final destination server 140, which may only be identified once address resolution is performed. Thus, end to end security is achieved. In another particularly preferred embodiment of the present invention, the control information 552 is copied at the source network layer 380 into an existing option code within the options field 551. The existing option code is selected and configured such that intervening routers do not intercept the control information 552 before the intended destination is reached. With reference to FIG. 2, the network layer 380 on the gateway 120 is again enabled to intercept and extract any symbolic address information 552 contained in the option field 551 of NPDUs 610 received from the mobile device 100, and to act as an agent for performing address resolution. The original payload 600 remains unaffected as it passes from the mobile device 100 to the final destination server 140. End to end security is thus again achieved. An example of a PDU having an option field is a TCP/IP PDU. As indicated earlier, in a TCP/IP environment, the network layer protocol is IP. The IP header 610 of the NPDU 610 comprises an options field 551. Pre-assigned option codes for inclusion in the IP options field include Source routing option codes such as “loose source and record route” (LSRR) and “strict source and record route” (SSRR) option codes. LSRR and SSRR are both suitable for redefinition to include control information such as symbolic address data. When the SSRR option is employed, it is set to indicate that there can be only a single hop between the origin of the datagram and the point where address resolution takes place. Otherwise, intermediate routers implementing source routing would incorrectly interpret and potentially modify the symbolic address information in the SSRR option field. A single hop is not a limitation in most practical arrangements because the mobile device 100 and the fixed network 130 are typically separated by a single access hop at the gateway 120. For example, referring back to FIG. 2, the mobile device 100 is removed from the gateway 120 by one access hop through the mobile network 110.

[0038] Referring to FIG. 8, in another particularly preferred embodiment of the present invention, control information 552 such as symbolic address data is embedded in datagrams via network layer tunneling. Tunneling is a technique for encapsulating a PDU of one protocol layer together with optional additional information into another, tunneling PDU 700 of the same or another layer of the stack. The tunneling PDU 700 has a header 720 and a payload 710 similar to those of the original PDU 610. The control information 552 is placed together with the original PDU 610 in the payload 710 of the tunneling PDU 700. The tunneling PDU 700 allows forwarding of the control information 552 along with the NPDU 610 along the route otherwise followed by the NPDU 610 via an application level implementation. This has the advantage that it obviates any modification of the protocol stack. Referring back to FIG. 2, the network layer 380 on the gateway 120 is enabled to intercept and extract the control information 240 carried in a tunneling PDU 700 from the mobile device 100 and to act as an agent for performing address resolution. The original PDU 610 remains unaffected as it passes from the mobile device 100 to the final destination server 140. Thus, once again, end to end security is achieved.

Packet-oriented data communications between mobile and fixed data networks

Information

Publication Number

Date Filed

Date Published

Inventors

CPC

US Classifications

International Classifications

Abstract

Description

Claims

Priority Claims (1)

PCT Information