Private mobile IP connection in a shared-pool environment
View Patent ↗Systems, methods, and computer-readable media for providing a private mobile IP connection in a shared-pool environment are provided. Embodiments include authenticating a mobile subscriber at a common router or home agent and establishing a communication protocol which is configured to link the authenticated subscriber to a private network such that only communications originating from the private network or passing through the private network are communicated to the subscriber. Utilizing embodiments hereof, mobile subscribers can access a private network through a common router or home agent knowing that stateless attacks will be blocked while still benefiting from the efficiencies of utilizing a shared-pool environment.
1. A method in a computerized environment for providing a private, mobile Internet Protocol connection in a shared-pool environment, the method comprising:
authenticating a subscriber at a router,
(a) wherein the router includes an access control list that matches an IP address of the subscriber to a first private network that the subscriber has authority to access, and
(b) wherein the access control list also matches the IP address of the subscriber to a first VLAN from which communications, which are to be forwarded to the subscriber, enter the router;
receiving from a server, which is associated with a second private network, a communication that is to be forwarded to the subscriber, wherein the communication is received through a second VLAN;
responsive to receiving the communication from the server, referencing the access control list to determine that the second VLAN is not matched with the IP address of the subscriber; and
based on the IP address of the subscriber not being matched with the second VLAN through which the communication from the server was received, preventing the communication from being forwarded to the subscriber.
2. The method of claim 1 , wherein the router is a home agent.
3. The method of claim 1 , wherein the subscriber is a mobile node.
4. The method of claim 1 , wherein authenticating a subscriber at the router comprises:
accessing an authentication server associated with the router; and
receiving from the authentication server associated with the router connection attributes associated with the subscriber, wherein establishing the communication protocol comprises establishing the communication protocol using the connection attributes.
5. The method of claim 4 , wherein the connection attributes include an identity of at least one private network the subscriber is authorized to access and an Internet Protocol address associated with the subscriber.
6. The method of claim 4 , further comprising accessing one or more of the connection attributes communicated to the authentication server associated with the router from an authentication server associated with a private network the subscriber has attempted to access.
7. One or more non-transitory computer-storage media having computer-useable instructions embodied thereon for performing a method for pairing a subscriber with at least one private network from which the subscriber may receive a communication, the method comprising: authenticating the subscriber at a router,
wherein the router includes an access control list that matches an IP address of the subscriber to a first private network that the subscriber has authority to access, and
wherein the access control list matches the IP address of the subscriber to a first VLAN from which communications, which are to be forwarded to the subscriber, enter the router;
receiving from a server a communication that is to be forwarded to the subscriber, wherein the communication is received by a home agent through a second VLAN;
responsive to receiving the communication from the server, determining that the second VLAN is not associated on the access control list with the subscriber; and
as a result of the subscriber not being associated with the second VLAN through which the communication from the server was received, preventing the communication from being forwarded to the subscriber.
8. A system for pairing a mobile subscriber with one or more private networks from which the mobile subscriber is authorized to receive communications, the system comprising:
a first private network having associated therewith a first mobile subscriber, a first logical interface, and a first server that submits communications to be forwarded;
a second private network having associated therewith a second mobile subscriber, a second logical interface, and a second server that submits communications to forwarded; and
a home agent in communication with both the first private network and the second private network, the home agent including an access control list that indexes an association between the first mobile subscriber and a first VLAN the first private network and between the second mobile subscriber and a second VLAN the second private network, wherein the home agent authenticates the first subscriber by matching in the access control list an IP address of the first subscriber to the first private network,
wherein the home agent receives from a server a communication that is to be forwarded to the first subscriber, wherein the communication is received through the second VLAN;
wherein, responsive to receiving the communication from the server, the home agent determines that the second VLAN is not associated in the access control list with the first subscriber; and
wherein, as a result of the first subscriber not being associated with the second VLAN through which the communication from the server was received, preventing the communication from being forwarded to the first subscriber.