System and method for secure network mobility

• US 20020066036A1
• Filed: 11/13/2001
• Published: 05/30/2002
• Est. Priority Date: 11/13/2000
• Status: Active Grant

• Current Assignee: Jurgen Manchot, Smith Micro Software Incorporated
• Original Assignee: Ecutel Systems, Inc. (Smith Micro Software Incorporated)
• Inventors: Zhang, Qiang, Nagarajan, Ravi, Gadi, Hari, Tran, Dzung, Makineni, Gowri
• Granted Patent: US 7,213,263 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 88/182 Network node acting on behalf of an other network entity, e.g. proxy

Abstract

A system and method are provided for use in maintaining secure communications between a home network and a mobile client when the client roams outside of the home network to a new location. One method of the present invention includes the steps of: establishing a new IP address for the new client location; sending a registration message identifying the new IP address location; authenticating the registration message; encapsulating and transmitting the registration message to the home server; registering the new IP address as a care-of-address for the client at the home server; confirming the registration of the new IP address with the client; establishing a security association between the home server and the relay server on behalf of the client; performing network address translation between the client'"'"'s permanent IP address client and the client'"'"'s new IP address; tunneling packets addressed for the client between the home server based and the relay server based on the established security association and the address translation for the client; and decapsulating the packets at the relay server and forwarding the packets to the client.

Claims

1. In a computer network arrangement comprising a home network having at least one home network server and a firewall for protecting said home network server, a relay server outside of said home network, and a client having a permanent IP address within said home network, a method for maintaining secure communications between the home network server and the client when said client roams outside of said home network to a new location, said method comprising:

establishing a new IP address for the new client location;

sending a registration message to said relay server identifying said new IP address location;

authenticating said registration message;

encapsulating and transmitting said registration message to said home server;

registering said new IP address as a care-of-address for said client at said home server;

confirming the registration of said new IP address with said client;

establishing a security association between said home server and said relay server on behalf of said client;

performing network address translation between the client'"'"'s permanent IP address and the client'"'"'s new IP address;

tunneling packets addressed for said client between said home server and said relay server based on the established security association and said address translation for said client; and

decapsulating said packets at said relay server and forwarding said packets to said client.

2. The method of claim 1, wherein said home network further comprises a multiplexer subsystem.

3. The method of claim 1, wherein at least a portion of the communications from said client to said home server are in HTTP Request-format.

4. The method of claim 3, wherein at least a portion of the communications from said home server to said client are in HTTP Response-format.

5. The method of claim 4, wherein at least a portion of the communications from said client to said home server are encapsulated in UDP packets.

6. The method of claim 5, wherein at least a portion of the communications from said home server to said client are encapsulated in UDP packets.

7. The method of claim 1, wherein said method further comprises the step of:

providing a network gateway, wherein said network gateway operates to tunnel packets through said firewall to said home server.

8. The method of claim 7, wherein said network gateway is a Virtual Private Network gateway.

19. The method of claim 1, wherein, said method further comprises the steps of:

generating a first message in HTTP Request-format,

transmitting said first message in HTTP Request-format through said firewall;

processing said first message, wherein said first message is encapsulated in UDP packets and forwarded to its intended recipient;

generating a second message in response to said first message, wherein said second message is encapsulated in UDP packets;

translating said second message into HTTP Response-Format; and

transmitting said second message to its intended recipient

9. In a computer network arrangement comprising a home network having at least one home network server and a firewall for protecting said home network server, a relay server outside of said home network, and a client having a permanent IP address within said home network, a method for maintaining secure communications between the home network server and the client when said client roams outside of said home network to a new location, said method comprising:

establishing a new IP address for the new client location;

sending a registration message to said home server identifying said new IP address location;

encapsulating and transmitting said registration message to said home server;

registering said new IP address as a care-of-address for said client at said home server;

confirming the registration of said new IP address with said client;

establishing a security association between said home server and said client;

performing network address translation between the client'"'"'s permanent IP address and the client'"'"'s new IP address; and

tunneling packets addressed for said client between said home server and said client based on the established security association and said address translation for said client.

10. The method of claim 9, wherein said home network further comprises a multiplexer subsystem.

11. The method of claim 9, wherein at least a portion of the communications from said client to said home server are in HTTP Request-format.

12. The method of claim 11, wherein at least a portion of the communications from said home server to said client are in HTTP Response-format.

13. The method of claim 12, wherein at least a portion of the communications from said client to said home server are encapsulated in UDP packets by said multiplexer subsystem.

14. The method of claim 13, wherein at least a portion of the communications from said home server to said client are encapsulated in UDP packets by said multiplexer subsystem.

15. The method of claim 9, wherein said method further comprises the step of:

providing a network gateway, wherein said network gateway operates to tunnel packets through said firewall to said home server.

16. The method of claim 15, wherein said network gateway is a Virtual Private Network gateway.

20. The method of claim 9, wherein, said method further comprises the steps of:

generating a first message in HTTP Request-format,

transmitting said first message in HTTP Request-format through said firewall;

processing said first message, wherein said first message is encapsulated in UDP packets and forwarded to its intended recipient;

generating a second message in response to said first message, wherein said second message is encapsulated in UDP packets;

translating said second message into HTTP Response-Format; and

transmitting said second message to its intended recipient

17. A system for maintaining secure communications for a client having a permanent IP address within a home network system and a temporary, care-of IP address when roaming outside of said home network system, said system comprising:

a home network server, wherein said home network server authenticates messages received from clients roaming outside of said home network system and performs network address translation between the client'"'"'s permanent IP address client and the client'"'"'s registered care-of IP address, further wherein said home network server encapsulates and retransmits messages addressed to said client'"'"'s permanent IP address to the client'"'"'s registered care-of IP address;

a relay server, said relay server located outside of said home network, wherein said relay server tunnels messages between said home network server and said client; and

a multiplexer subsystem, wherein said multiplexer subsystem is comprised of a HTTP server, and a multiplexer module.

18. A method for communicating between a roaming client and a home server wherein at least one of either the client or the home server is protected by a firewall, said method comprising:

generating a first message in HTTP Request-format,

transmitting said first message in HTTP Request-format through said firewall;

processing said first message, wherein said first message is encapsulated in UDP packets and forwarded to its intended recipient;

generating a second message in response to said first message, wherein said second message is encapsulated in UDP packets;

translating said second message into HTTP Response-Format;

transmitting said second message to its intended recipient.