Mobility architecture using pre-authentication, pre-configuration and/or virtual soft-handoff
View Patent ↗In some illustrative embodiments, a novel system and method is provided that can, for example, extend concepts of pre-authentication (such as, e.g., IEEE 802.11i pre-authentication) so as to operate across networks or subnetworks (such as, e.g., IP subnets). In preferred embodiments, a novel architecture includes one or both of two new mechanisms that substantially improve, e.g., higher-layer handoff performance. A first mechanism is referred to as “pre-configuration,” which allows a mobile to pre-configure higher-layer information effective in candidate IP subnets to handoff. A second mechanism is referred to as “virtual soft-handoff,” which allows a mobile to send or receive packets through the candidate IP subnets even before it is actually perform a handoff to any of the candidate IP subnets.
1. A method, comprising:
resolving an IP address of an access point in a new subnetwork when a mobile station is in a current subnetwork;
obtaining pre-authentication for the mobile station to work over the current and new subnetworks using said IP address;
wherein said access point in the new subnetwork does not support higher-layer pro-authentication and communicates with the mobile station via a proxy agent and said IP address is of said proxy agent.
2. The method of claim 1 , wherein the proxy agent uses the MAC address of the mobile station.
3. The method of claim 1 , wherein said access point in the new subnetwork communicates IEEE 802.1X frames to the mobile station via the proxy agent.
4. The method of claim 1 , wherein the mobile station's MAC address is carded in a payload of higher-layer packets.
5. A method, comprising:
resolving an IP address of an access point in a new subnetwork when a mobile station is in a current subnetwork; and
obtaining pre-authentication for the mobile station to work over the current and new subnetworks using said IP address;
wherein said access point in the new subnetwork supports higher-layer pre-authentication and communicates with the mobile station;
wherein the said access point in the new subnetwork communicates with the mobile remote station by using a higher-layer protocol that carries 802.1X frames; and
further including using a newly defined protocol to carry 802.1x frames over a reliable transport.
6. The method of claim 5 , wherein the reliable transport uses TCP.
7. A method comprising,
reducing handoff delay of a mobile station by pre-establishing higher-layer contexts prior to handoff based on higher-layer pre-authentication, and
further including using a single higher-layer authentication protocol for pre-establishing a plurality of the higher-layer contexts.
8. The method of claim 7 , further including using IKE or IKEv2 for pre-establishing a plurality of the higher-layer contexts.
9. The method of claim 7 , further including using PANA and IKE or IKEv2 for pre-establishing a plurality of the higher-layer contexts.
10. A method comprising,
reducing handoff delay of a mobile station by pre-establishing higher-layer contexts prior to handoff based on higher-layer pre-authentication, and
further including establishing an IPsec tunnel between the mobile station and an access point in a new subnetwork for redirecting traffic for a pro-configured IP address of the mobile station to a currently attached subnetwork.
11. A method for performing a handoff of a mobile station between access points in different access networks with minimal interruption and with maintained security, comprising:
pre-establishing higher-layer contexts for the mobile station prior to handoff and securely redirecting traffic originated from or destined for a pre-established IP address to a new access network, and
further including establishing an IPsec tunnel between the mobile station and an access router in the new access network, where an IPsec tunnel inner address is bound to the pre-established IP address.
12. A method for performing a handoff of a mobile station between access points in different access networks with minimal interruption and with maintained security, comprising:
pre-establishing higher-layer contexts for the mobile station prior to handoff and securely redirecting traffic originated from or destined for a pre-established IP address to a new access network, and
wherein an access router in the new access network is used as a temporal home agent with which a client device registers its pre-established IP address as a home address and the IP address assigned in a physically attached network as the care-of address.
13. A method comprising:
performing a virtual soft handoff of a mobile device between access points in proximate networks or subnetworks to minimize communication interruption by allowing the mobile device to send and receive packets from a new one of said access points prior to handoff, and
further including controlling a layer-2 handoff timing by a higher layer so that pre-authentication and pre-configuration can be completed prior to starting layer-2 handoff.
14. A method comprising:
performing a virtual soft handoff of a mobile device between access points in proximate networks or subnetworks to minimize communication interruption by allowing the mobile device to send and receive packets from a new one at said access points prior to handoff, and
further including using an IPsec tunnel for traffic redirection during a virtual soft-handoff, with outer and inner IP addresses of a device for the IPsec tunnel being a care-of address in the current subnet and the care-of address in a new subnet, respectively.
15. The method of claim 14 , further including deleting the established IPsec tunnel prior to performing a layer-2 handoff.
16. A method comprising:
performing a virtual soft handoff of a mobile device between access points in proximate networks or subnetworks to minimize communication interruption by allowing the mobile device to send and receive packets from a new one of said access points prior to handoff, and
further including using an IPsec tunnel for all traffic.
17. The method of claim 16 further including deleting an established IPsec tunnel prior to performing a layer-2 handoff.