Secure in-band signaling method for mobility management crossing firewalls
An in-band signaling method that enables secure updates of a care-of-IP address for a mobile host that roams between access networks. In the illustrative embodiment described herein, a mobile host includes an intelligent interface that handles IP networking functions and tunnels IP packets between the mobile host and the mobile host's home agent/remote access server (HA/RAS) transparently, as if the mobile host established a connection to a communicating or destination host (DST) from the home network (where the HA/RAS resides). In accordance with an aspect of the invention, there is provided an in-band signaling method that employs encrypted three-way handshake signaling messages that are embedded in encapsulated IP packets to enable care-of IP address updates. This method can effectively protect mobile hosts from denial-of-service attacks and is transparent to NAT/NAPT firewalls. The signaling messages are communicated between the home agent and the mobile host, in a manner transparent to any NAT/NAPT firewall in the network.
1. A method of updating a care-of IP address for a mobile host to the mobile host's home agent, where the mobile host departs from a first access network and has been granted access to a second access network, comprising the steps of:
sending a care-of address request message containing a sequence number to the home agent in an embedded IP-in-IP packet containing a destination address of a communicating host;
receiving an embedded IP-in-IP packet containing a care-of address acknowledgement message from the second access network;
checking whether a sequence number in the care-of address acknowledgment message is greater than or equal to the sequence number in the care-of address request message and if so, sending a care-of address confirmation message in outbound IP packets to the home agent after receiving the care-of address acknowledgment message, the care-of address confirmation message containing the same sequence number as the sequence number in the care-of address acknowledgement message.
2. The method recited in claim 1 , wherein the care-of address request message is sent to the home agent in subsequent packets until the care-of address acknowledgment message is received.
3. The method recited in claim 1 , wherein the care-of address request message is sent to the home agent in subsequent packets until a timer expires.
4. The method recited in claim 1 , wherein the care-of address request message is sent to the home agent in subsequent packets until the first of either the care-of address acknowledgment message is received, or a timer expires.
5. The method recited in claim 1 , wherein the care-of address confirmation message is sent to the home agent in subsequent packets until receiving the care-of address acknowledgment message or until a timer expires.
6. A method of updating a care-of IP address for a mobile host to the mobile host's home agent, where the mobile host departs from a first access network and has been granted access to a second access network, comprising the steps of:
sending a care-of address request message containing a sequence number to the home agent in an embedded IP-in-IP packet containing a destination address of a communicating host;
receiving an embedded IP-in-IP packet containing a care-of address acknowledgement message from the second access network; and
checking whether a sequence number in the care-of address acknowledgment message is greater than or equal to the sequence number in the care-of address request message and if so,
sending a care-of address confirmation message in outbound IP packets to the home agent after receiving the care-of address acknowledgment message, the care-of address confirmation message containing the same sequence number as the sequence number in the care-of address acknowledgement message,
wherein the care-of address request message is sent to the home agent in subsequent packets until the first of either the care-of address acknowledgment message is received, or a timer expires, and further wherein the care-of address confirmation message is sent to the home agent in subsequent packets after until receiving the care-of address acknowledgment message or until a timer expires.
7. A method of updating a care-of IP address for a mobile host to the mobile host's home agent, where the mobile host departs from a first access network and has been granted access to a second access network, the first and second access networks each having firewalls whereby the mobile host has an inside and outside care-of IP address on each network, comprising the steps of:
receiving a care-of address request message from a mobile host containing a sequence number in an embedded IP-in-IP packet containing a destination address of a communicating host, the IP-in-IP packet further containing an outside IP address assigned to the mobile host by the second access network that corresponds to a care-of IP address assigned to the mobile host by the second access network,
checking whether the sequence number contained in the care-of address request message is less than or equal to a sequence number of the most recently received care-of address request message, and if so;
saving the outside IP address for the mobile host on the second access network in a CANDIDATE_CARE-OF_ADDRESS register;
bicasting packets to the mobile host at the outside care-of IP address for the mobile host on the second access network, and an outside care-of IP address for the mobile host on the first access network;
sending a care-of address acknowledgment message in an embedded IP-in-IP packet having the sequence number in the most recently received care-of address request message;
saving the sequence number from the most recently received care-of address request message;
upon receiving a care-of address status message from the mobile host containing the same sequence number as the one in the most recently received care-of address request message, saving the outside IP address for the mobile host on the second access network in a CURRENT_CARE-OF_ADDRESS register and recognizing this outside IP address as the new care-of IP address for the mobile host; and
terminating the bicasting of packets to the first and second access networks.
8. The method recited in claim 7 , wherein the step of terminating the bicasting of packets to the first and second access networks terminates after a BI_CASTING timer expires.