Framework of media-independent pre-authentication support for PANA

1. A method for proactively establishing a security association between a mobile node in a visiting network and an authentication agent in another network to which the mobile node can move, comprising:

negotiating pre-authentication using a flag in a message header that indicates whether the communication is for establishing a pre-authentication security association; and

said mobile node initiating pre-authentication by transmitting a message with the flag set in its message header, and said authentication agent responding with the flag set in its message header only if it supports the pre-authentication;

whereby establishing a pre-authentication security association before said mobile node moves from said visiting network to said another network;

further including performing said pre-authentication using a link-layer agnostic network access authentication protocol between said mobile node and said authentication agent at a server on the another network; and

wherein said visiting network is for a first-media and said another network is for a different-media, wherein either said first-media is cellular and said different-media is wireless local area network (LAN) or said first-media is wireless local area network (LAN) and said different-media is cellular.

2. The method of claim 1 , further including once said mobile node and said authentication agree to perform said pre-authentication using said flag in said message header, said flag is also included in subsequent pre-authentication messages between them.

3. The method of claim 2 , further employing protocol for carrying authentication for network access (PANA) as said network access authentication protocol.

4. The method of claim 3 , further including having said flag include a P-flag in the PANA header.

5. The method of claim 3 , further including having said mobile node transmit a PANA-PAA-Discover message with a P-flag set to initiate pre-authentication.

6. The method of claim 3 , further including having said mobile node operate as a PANA client (PaC) and said authentication agent operate as a PANA authentication agent (PAA).

7. The method of claim 1 , further including performing said pre-authentication across multiple administrative domains.

8. The method of claim 1 , further including performing said pre-authentication in the framework of media-independent pre-authentication.

9. The method of claim 1 , further including having said authentication agent respond with an error message if it does not support the pre-authentication.

10. The method of claim 1 , further including having pre-authorization and post-authorization for the mobile node involve different authorization policies.

11. A method for proactively establishing a security association between a mobile node in a visiting network and an authentication agent in another network to which the mobile node can move, comprising:

negotiating pre-authentication using a flag in a message header that indicates whether the communication is for establishing a pre-authentication security association;

said mobile node initiating pre-authentication by transmitting a message with the flag set in its message header, and said authentication agent responding with the flag set in its message header only if it supports the pre-authentication;

whereby establishing a pre-authentication security association before said mobile node moves from said visiting network to said another network;

further including performing said pre-authentication using a link-layer agnostic network access authentication protocol between said mobile node and said authentication agent at a server on the another network;

further employing protocol for carrying authentication for network access (PANA) as said network access authentication protocol;

further including having said mobile node operate as a PANA client (PaC) and said authentication agent operate as a PANA authentication agent (PAA);

further including that once the PaC and the PAA have agreed on performing pre-authentication, subsequent PANA messages exchanged between them have the P-flag set.

12. The method of claim 6 , further including that when a preparing PAA becomes an active PAA due to movement of the PaC, the PaC performs an IP address update procedure using a PANA-Update exchange in order to update the preparing PAA of the PaC's new address obtained from a remote network where the PAA resides.

13. A method for proactively establishing a security association between a mobile node in a visiting network and an authentication agent in another network to which the mobile node can move, comprising:

negotiating pre-authentication using a flag in a message header that indicates whether the communication is for establishing a pre-authentication security association;

one of said mobile node and said authentication agent initiating pre-authentication by transmitting a message with the flag set in its message header, and the other of said mobile node and said authentication agent responding with the flag set in its message header only if it supports the pre-authentication;

whereby establishing a pre-authentication security association before said mobile node moves from said visiting network to said another network;

further including performing said pre-authentication using a link-layer agnostic network access authentication protocol between said mobile node and said authentication agent at a server on the another network;

further employing protocol for carrying authentication for network access (PANA) as said network access authentication protocol;

further including having said mobile node operate as a PANA client (PaC) and said authentication agent operate as a PANA authentication agent (PAA);

further including that when a preparing PAA becomes an active PAA due to movement of the PaC, the PaC performs an IP address update procedure using a PANA-Update exchange in order to update the preparing PAA of the PaC's new address obtained from a remote network where the PAA resides; and

wherein a p-flag is not set in the PANA-Update messages and in subsequent PANA messages.

14. A method for proactively establishing a security association between a mobile node in a visiting network and an authentication agent in another network to which the mobile node can move, comprising:

negotiating pre-authentication using a flag in a message header that indicates whether the communication is for establishing a pre-authentication security association; and

one of said mobile node and said authentication agent initiating pre-authentication by transmitting a message with the flag set in its message header, and the other of said mobile node and said authentication agent responding with the flag set in its message header only if it supports the pre-authentication;

whereby establishing a pre-authentication security association before said mobile node moves from said visiting network to said another network;

further including performing said pre-authentication using a link-lager agnostic network access authentication protocol between said mobile node and said authentication agent at a server on the another network;

wherein said visiting network is for a first-media and said another network is for a different-media, wherein either said first-media is cellular and said different-media is wireless local area network (LAN) or said first-media is wireless local area network (LAN) and said different-media is cellular;

further including once said mobile node and said authentication agree to perform said pre-authentication using said flag in said message header, said flag is also included in

subsequent pre-authentication messages between them;

further employing protocol for carrying authentication for network access (PANA) as said network access authentication protocol;

further including having said mobile node operate as a PANA client (PaC) and said authentication agent operate as a PANA authentication agent (PAA);

further including that when the PaC has an active Security Association (SA) with an active PAA and a pre-authentication SA with a preparing PAA changes its active PAA without changing a preparing PAA, the PaC performs an IP address update procedure using PANA-Update exchange in order to update the preparing PAA of the PaC's new address obtained from the remote network where the new active PAA resides.

15. The method of claim 14 , further including that the completion of the PANA-Update procedure will not change the pre-authentication SA to the active SA.

16. The method of claim 15 , further including that a p-flag is set in the PANA-Update messages and in the subsequent PANA messages.

17. A mobile node configured to proactively establish a security association from a visiting network with an authentication agent in another network to which the mobile node can move, comprising:

said mobile node being configured to negotiate pre-authentication using a flag in a

message header that indicates whether the communication is for establishing a pre-authentication security association; and

said mobile node being configured to initiate pre-authentication by transmitting a message with the flag set in its message header, and to receive a response from said authentication agent with the flag set in its message header only if it supports the pre-authentication;

whereby a pre-authentication security association is established before said mobile

node moves from said visiting network to said another network;

said mobile node being configured such that said pre-authentication is performed using a link-layer agnostic network access authentication protocol between said mobile node and said authentication agent at a server on the another network; and

wherein said visiting network is for a first-media and said another network is for a different-media, wherein either said first-media is cellular and said different-media is wireless local area network (LAN) or said first-media is wireless local area network (LAN) and said different-media is cellular.

18. An authentication agent configured to proactively establish a security association with a mobile node from a visiting network while the authentication agent is in another network to which the mobile node can move, comprising:

said authentication agent node being configured to negotiate pre-authentication using a flag in a message header that indicates whether the communication is for establishing a pre-authentication security association; and

said authentication agent being configured such that when said mobile initiates pre-authentication by transmitting a message with the flag set in its message header that is

received by said authentication agent, and said authentication agent responds with the flag

set in its message header only if it supports the pre-authentication;

whereby a pre-authentication security association is established before said mobile

node moves from said visiting network to said another network;

said mobile authentication agent being configured such that said pre-authentication is performed using a link-layer agnostic network access authentication protocol between said mobile node and said authentication agent at a server on the another network; and

wherein said visiting network is for a first-media and said another network is for a different-media, wherein either said first-media is cellular and said different-media is wireless local area network (LAN) or said first-media is wireless local area network (LAN) and said different-media is cellular.