Secure in-band signaling method for mobility management crossing firewalls
An in-band signaling method that enables secure updates of a care-of-IP address for a mobile host that roams between access networks. In the illustrative embodiment described herein, a mobile host includes an intelligent interface that handles IP networking functions and tunnels IP packets between the mobile host and the mobile host's home agent/remote access server (HA/RAS) transparently, as if the mobile host established a connection to a communicating or destination host (DST) from the home network (where the HA/RAS resides). In accordance with an aspect of the invention, there is provided an in-band signaling method that employs encrypted three-way handshake signaling messages that are embedded in encapsulated IP packets to enable care-of IP address updates. This method can effectively protect mobile hosts from denial-of-service attacks and is transparent to NAT/NAPT firewalls. The signaling messages are communicated between the home agent and the mobile host, in a manner transparent to any NAT/NAPT firewall in the network.
1. A method comprising:
responsive to a mobile host departing from a first access network and being granted access to a second access network, the first and second access networks each comprising firewalls and the mobile host assigned an inside and an outside care-of IP address on each of the first access network and the second access network, responsive to a receipt of a care-of address status message from the mobile host, the care-of address status message comprising a same sequence number as a sequence number in a most recently received care-of address request message, storing an outside IP address for the mobile host in a CURRENT_CARE-OF_ADDRESS register, the outside IP address recognized as a new care-of IP address for the mobile host, the sequence number of the most recently received care-of address request message identical to a sequence number of a sent care-of address acknowledgment message, the care-of address acknowledgment message sent in an embedded IP-in-IP packet, the outside IP address a care-of IP address for the mobile host.
2. The method of claim 1 , further comprising:
storing the sequence number from the most recently received care-of address request message.
3. The method of claim 1 , further comprising:
receiving a new care-of address request message from the mobile host, the new care-of address request message comprising a sequence number in an embedded IP-in-IP packet that comprises a destination address of a communicating host, the IP-in-IP packet further comprising the outside IP address assigned to the mobile host by the second access network that corresponds to the care-of IP address assigned to the mobile host by the second access network.
4. The method of claim 1 , further comprising:
checking whether a sequence number contained in a new care-of address request message is less than or equal to the sequence number of the most recently received care-of address request message.
5. The method of claim 1 , further comprising:
checking whether a sequence number contained in a new care-of address request message is less than or equal to the sequence number of the most recently received care-of address request message, and if so;
storing the outside IP address for the mobile host on the second access network in a CANDIDATE_CARE-OF_ADDRESS register.
6. The method of claim 1 , further comprising:
checking whether a sequence number contained in a new care-of address request message is less than or equal to the sequence number of the most recently received care-of address request message, and if so;
bicasting packets to the mobile host at the outside care-of IP address for the mobile host on the second access network, and the outside care-of IP address for the mobile host on the first access network.
7. The method of claim 1 , further comprising:
checking whether a sequence number contained in a new care-of address request message is less than or equal to the sequence number of the most recently received care-of address request message, and if so;
terminating a bicast of packets to the first and second access networks.
8. The method of claim 1 , further comprising:
checking whether a sequence number contained in a new care-of address request message is less than or equal to the sequence number of the most recently received care-of address request message, and if so;
storing the outside IP address for the mobile host on the second access network in a CANDIDATE_CARE-OF_ADDRESS register;
bicasting packets to the mobile host at the outside care-of IP address for the mobile host on the second access network, and the outside care-of IP address for the mobile host on the first access network; and
terminating the bicasting of packets to the first and second access networks.
9. The method of claim 1 , further comprising:
bicasting packets to the mobile host at the outside care-of IP address for the mobile host on the second access network, and the outside care-of IP address for the mobile host on the first access network;
terminating the bicasting of packets to the first and second access networks after a BI_CASTING timer expires.
10. A method comprising:
responsive to a mobile host departing from a first access network and being granted access to a second access network, receiving, at a home agent, an embedded IP-in-IP packet comprising a care-of address confirmation message, the embedded IP-in-IP packet received responsive to a care-of address acknowledgment message, the care-of address confirmation message comprising a same sequence number as a sequence number in the care-of address acknowledgment message, the care-of address acknowledgment message sent responsive to a determination that the sequence number in the care-of address request message is greater than or equal to a sequence number in a most recent care-of address request message register, the care-of address acknowledgment message adapted to acknowledge update of a care-of IP address for the mobile host to the home agent by the mobile host.
11. A method comprising:
responsive to a mobile host departing from a first access network and being granted access to a second access network, sending, to a home agent, a care-of address confirmation message in outbound IP packets to the home agent after a care-of address acknowledgment message is received, the care-of address confirmation message comprising a same sequence number as a sequence number in the care-of address acknowledgment message, the care-of address confirmation message sent responsive to a determination that the sequence number in the care-of address acknowledgment message is greater than or equal to a sequence number in a care-of address request message, the care-of address acknowledgment message adapted to acknowledge update of a care-of IP address for the mobile host by the home agent.
12. The method of claim 11 , further comprising:
sending the care-of address request message at the home agent in an embedded IP-in-IP packet containing a destination address of a communicating host.
13. The method of claim 11 , further comprising:
receiving an embedded IP-in-IP packet comprising the care-of address acknowledgment message from the second access network.
14. The method of claim 11 , further comprising:
checking whether the sequence number in the care-of address acknowledgment message is greater than or equal to the sequence number in the care-of address request message.
15. The method of claim 11 , wherein the care-of address request message is sent to the home agent in subsequent packets until the care-of address acknowledgment message is received.
16. The method of claim 11 , wherein the care-of address request message is sent to the home agent in subsequent packets until a timer expires.
17. The method of claim 11 , wherein the care-of address request message is sent to the home agent in subsequent packets until a first of either the care-of address acknowledgment message is received, or a timer expires.
18. The method of claim 11 , wherein the care-of address confirmation message is sent to the home agent in subsequent packets until the care-of address acknowledgment message is received or until a timer expires.
19. The method of claim 11 , wherein the care-of address confirmation message is sent to the home agent in subsequent packets after until the care-of address acknowledgment message is received or until a timer expires.