Method and apparatus for communication control of mobile computers in communication network systems using private IP addresses

• US 20020161927A1
• Filed: 06/27/2002
• Published: 10/31/2002
• Est. Priority Date: 01/17/1996
• Status: Active Grant

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Ishiyama, Masahiro, Shimbo, Atsushi, Inoue, Atsushi, Moriya, Osamu, Okamoto, Toshio
• Granted Patent: US 6,965,946 B2
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: H04L 61/5084 Providing for device mobility network addressing or numbering for mobility support in wireless networks H04W8/26; mobile IP H04W80/04
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 88/005 Data network PoA devices

Abstract

A communication control in a communication network system using a mobile computer, capable of realizing flexible address control and management for the mobile computer. When the mobile computer is located within a home network, a communication with the mobile computer is carried out by transferring data using a home address specific to the mobile computer which is a private address. When the mobile computer is located within an external own organization network, a communication with the mobile computer is carried out by routing data to the external own organization network using a care-of address indicating a current visited location of the mobile computer in the system which is a global address, and addressing the mobile computer within the external own organization network using the home address. When the mobile computer is located within an external other organization network, a communication with the mobile computer is carried out by routing data to the external other organization network using the care-of address, and addressing the mobile computer within the external other organization network using a mobile address assigned to the mobile computer at a time of moving outside the own organization networks which is a global address.

Claims

1. A method for controlling communications in a communication network system formed by a plurality of computers for communicating data with each other through a plurality of interconnected networks, said plurality of computers including at least one mobile computer for communicating data while changing a location in the communication network system, the method comprising the steps of:

(a) when the mobile computer is located within a home network of the mobile computer, carrying out a communication with the mobile computer by transferring communication data using a first location identifier specific to the mobile computer which is uniquely defined within own organization networks of the mobile computer;

(b) when the mobile computer is located within an external own organization network, carrying out a communication with the mobile computer by routing communication data to the external own organization network using a third location identifier indicating a current visited location of the mobile computer in the communication network system which is uniquely defined over all the networks, and addressing the mobile computer within the external own organization network using the first location identifier; and

(c) when the mobile computer is located within an external other organization network, carrying out a communication with the mobile computer by routing communication data to the external other organization network using the third location identifier, and addressing the mobile computer within the external other organization network using a second location identifier assigned to the mobile computer at a time of moving outside the own organization networks which is uniquely defined over all the networks.

2. The method of claim 1, further comprising the step of:

managing an address information for the mobile computer within the own organization networks of the mobile computer, the address information containing a corresponding set of the first location identifier, the second location identifier and the third location identifier.

3. The method of claim 2, further comprising the steps of:

transmitting the communication data with the first location identifier of the mobile computer attached thereto from a correspondent computer, when the correspondent computer is located within the own organization networks of the mobile computer; and

obtaining the third location identifier corresponding to the first location identifier attached to the communication data according to the address information at a relay device provided in the home network of the mobile computer, and transferring the communication data by attaching the obtained third location identifier from the relay device to the current visited location of the mobile computer, when the mobile computer is located within the external own organization network or the external other organization network.

4. The method of claim 2, further comprising the steps of:

transmitting the communication data with the second location identifier of the mobile computer attached thereto from a correspondent computer, when the correspondent computer is located outside the own organization networks of the mobile computer; and

obtaining the third location identifier corresponding to the second location identifier attached to the communication data according to the address information at a data packet processing device provided in the home network of the mobile computer, and transferring the communication data by attaching the obtained third location identifier from the data packet processing device to the current visited location of the mobile computer, when the mobile computer is located within the external own organization network or the external other organization network.

5. The method of claim 2, wherein the managing step manages the address information in a relay device provided in the home network of the mobile computer.

6. The method of claim 2, wherein the managing step manages the address information in a data packet processing device provided in the home network of the mobile computer.

7. The method of claim 2, wherein the managing step manages the address information in an external relay device provided outside the home network of the mobile computer, by updating the address information at a time of a location registration processing for the mobile computer at the external relay device.

8. The method of claim 2, wherein the managing step manages the address information in a database provided within the own organization networks, which stores the address information for computers belonging to the own organization networks and returns a requested address information in response to a request.

9. The method of claim 2, wherein the managing step updates the address information when the mobile computer obtains the second location identifier at a time of moving outside the own organization networks.

10. The method of claim 2, wherein the managing step manages the address information in correspondence to a version number, and updates the version number when the address information is updated as a result of moving of the mobile computer.

11. The method of claim 2, wherein the managing step manages the address information in correspondence to a valid period of the address information, and invalidates the address information when the valid period elapsed.

12. The method of claim 11, wherein the managing step initializes the valid period of the address information when a message requesting a re-registration of the mobile computer is received from the mobile computer.

13. The method of claim 2, wherein the managing step rewrites the third location identifier of the address information, when a message requesting a registration of a new third location identifier is received from the mobile computer which moved to a new visited location and the mobile computer is successfully authenticated according to a signature information contained in the message.

14. The method of claim 2, wherein the managing step invalidates the address information when a message requesting a deregistration of the mobile computer is received from the mobile computer, and notifies an invalidation of the address information to the mobile computer.

15. The method of claim 1, wherein the third location identifier is a location identifier obtained by the mobile computer at a visited network, which is uniquely defined over all the networks.

16. The method of claim 1, wherein the third location identifier is a location identifier indicating an external relay device for directly managing the mobile computer moved outside the home network and relaying the communication data between the mobile computer and a correspondent computer, which is uniquely defined over all the networks.

17. The method of claim 16, wherein the external relay device receives the communication data transferred according to the third location identifier attached thereto from the correspondent computer, and sends the received communication data to the mobile computer according to the first location identifier or the second location identifier attached to the communication data.

18. The method of claim 1, wherein the second location identifier is assigned to the mobile computer at a time of moving out to the external other organization network from a plurality of location identifiers reserved by a relay device provided in the home network of the mobile computer.

19. The method of claim 1, wherein the second location identifier is assigned to the mobile computer at a time of moving out to the external other organization network from a plurality of location identifiers reserved by a data packet processing device provided in the home network of the mobile computer.

20. The method of claim 1, wherein the second location identifier is assigned to the mobile computer when the mobile computer moved outside the own organization networks from a plurality of location identifiers reserved by an external relay device provided outside the home network of the mobile computer.

21. The method of claim 1, wherein at the step (b), when the communication data has a destination specified by the first location identifier, the communication data including the first location identifier is encapsulated using the third location identifier corresponding to the first location identifier and then transferred to the external own organization network.

22. The method of claim 21, wherein the communication data is encapsulated by an encapsulation without encryption.

23. The method of claim 1, wherein at the steps (b) and (c), when the communication data has a destination specified by the second location identifier, the communication data including the second location identifier is encapsulated using the third location identifier corresponding to the second location identifier and then transferred to the external own organization network or the external other organization network.

24. The method of claim 23, wherein the communication data is encapsulated by an encapsulation without encryption.

25. The method of claim 1, wherein at the step (c), when the communication data has a destination specified by the first location identifier, a relay device provided in the home network of the mobile computer encapsulates the communication data using the third location identifier corresponding to the first location identifier and then transmits the communication data, and a data packet processing device provided in the home network of the mobile computer receives the communication data transmitted from the relay device, then decapsulates the communication data using the third location identifier, then encapsulates the communication data using the second location identifier corresponding to the third location identifier, then encapsulates the communication data using the third location identifier, and then transmits the communication data to the external other organization network.

26. The method of claim 25, wherein at the step (c), an external relay device provided outside the home network of the mobile computer receives the communication data, then decapsulates the communication data using the third location identifier, and then transfers the communication data to the mobile computer using the second location identifier contained in the communication data.

27. The method of claim 1, wherein at the step (c), when the communication data has a destination specified by the first location identifier, a relay device provided in the home network of the mobile computer replaces the first location identifier contained in the communication data by the second location identifier corresponding to the first location identifier, then encapsulates the communication data using the third location identifier corresponding to the first location identifier, and then transmits the communication data to the external other organization network.

28. The method of claim 27, wherein at the step (c), an external relay device provided outside the home network of the mobile computer receives the communication data, then decapsulates the communication data using the third location identifier, and then transfers the communication data to the mobile computer using the second location identifier contained in the communication data.

29. The method of claim 1, further comprising the steps of:

transmitting the communication data with the first location identifier of the mobile computer attached thereto from a correspondent computer, when the correspondent computer is located within the own organization networks of the mobile computer; and

transmitting the communication data with the second location identifier of the mobile computer attached thereto from the correspondent computer, when the correspondent computer is located outside the own organization networks of the mobile computer.

30. The method of claim 1, further comprising the steps of:

transmitting the communication data with the first location identifier of the mobile computer as a source address from the mobile computer, when the mobile computer is located within the own organization networks of the mobile computer; and

transmitting the communication data with the second location identifier of the mobile computer as a source address from the mobile computer, when the mobile computer is located outside the own organization networks of the mobile computer.

31. The method of claim 1, further comprising the steps of:

transmitting the communication data with the first location identifier of the mobile computer as a source address from the mobile computer, when a correspondent computer is located outside the own organization networks of the mobile computer while the mobile computer is located within the own organization networks of the mobile computer; and

receiving the communication data transmitted from the mobile computer at a data packet processing device provided in the home network of the mobile computer, then changing the source address of the communication data by replacing the first location identifier by the second location identifier corresponding to the first location identifier at the data packet processing device, and then transmitting the communication data from the data packet processing device to the correspondent computer.

32. The method of claim 1, further comprising the steps of:

creating the communication data with the first location identifier as the source address at the mobile computer, encapsulating the communication data using the second location identifier corresponding to the first location identifier at the mobile computer, and then transmitting the communication data from the mobile computer, when a correspondent computer is located within the own organization networks of the mobile computer while the mobile computer is located outside the own organization networks of the mobile computer; and

receiving the communication data transmitted from the mobile computer at a data packet processing device provided in the home network of the mobile computer, then decapsulating the communication data to remove the second location identifier at the data packet processing device, and then transmitting the communication data from the data packet processing device to the correspondent computer.

33. A relay device for relaying communication data in a communication network system formed by a plurality of computers for communicating data with each other through a plurality of interconnected networks, said plurality of computers including at least one mobile computer for communicating data while changing a location in the communication network system, the relay device being provided in a home network of the mobile computer and comprising:

management means for managing an address information for the mobile computer within own organization networks of the mobile computer, the address information containing a corresponding set of a first location identifier, a second location identifier and a third location identifier, the first location identifier being a location identifier specific to the mobile computer which is uniquely defined within the own organization networks, the second location identifier being a location identifier reserved for the mobile computer which is uniquely defined over all the networks, and the third location identifier being a location identifier indicating a current visited location of the mobile computer in the communication network system which is uniquely defined over all the networks; and

processing means for obtaining the third location identifier corresponding to the first location identifier or the second location identifier of a destination computer attached to communication data transmitted from a source computer according to the address information, and transferring the communication data by attaching the obtained third location identifier to the destination computer.

34. The relay device of claim 33, further comprising:

means for managing a plurality of location identifiers reserved for mobile computers belonging to the own organization networks, and assigning one of said plurality of location identifiers as the second location identifier to each mobile computer which is moving out to an external other organization network.

35. The relay device of claim 33, wherein when the mobile computer is located within an external own organization network and the communication data has a destination specified by the first location identifier, the processing means encapsulates the communication data including the first location identifier using the third location identifier corresponding to the first location identifier and then transfers the communication data to the external own organization network.

36. The relay device of claim 33, wherein when the mobile computer is located within an external other organization network and the communication data has a destination specified by the first location identifier, the processing means encapsulates the communication data using the third location identifier corresponding to the first location identifier, and then transmits the communication data to a data packet processing device provided in a home network of the mobile computer.

37. The relay device of claim 33, wherein when the mobile computer is located within an external other organization network and the communication data has a destination specified by the first location identifier, the processing means replaces the first location identifier contained in the communication data by the second location identifier corresponding to the first location identifier, then encapsulates the communication data using the third location identifier corresponding to the first location identifier, and then transmits the communication data to the external other organization network.

39. The data packet processing device of claim 38, wherein the processing means also carries out encryption/decryption processing on the communication data.

40. The data packet processing device of claim 38, further comprising:

means for managing a plurality of location identifiers reserved for mobile computers belonging to the own organization networks, and assigning one of said plurality of location identifiers as the second location identifier to each mobile computer which is moving out to an external other organization network.

41. The data packet processing device of claim 38, wherein when the mobile computer is located within an external own organization network or the external other organization network and the communication data has a destination specified by the second location identifier, the processing means encapsulates the communication data including the second location identifier using the third location identifier corresponding to the second location identifier and then transfers the communication data to the external own organization network or the external other organization network.

42. The data packet processing device of claim 38, wherein when a correspondent computer is located outside the own organization networks of the mobile computer while the mobile computer is located within the own organization networks of the mobile computer, the processing means receives the communication data with the first location identifier of the mobile computer as a source address which is transmitted from the mobile computer, then formats the communication data to set the second location identifier corresponding to the first location identifier as the source address, and then transmits the communication data to the correspondent computer.

43. The data packet processing device of claim 38, wherein when a correspondent computer is located within the own organization networks of the mobile computer while the mobile computer is located outside the own organization networks of the mobile computer, the processing means receives the communication data transmitted from the mobile computer, which was obtained by creating the communication data with the first location identifier as the source address and encapsulating the communication data using the second location identifier corresponding to the first location identifier at the mobile computer, then decapsulates the communication data to remove the second location identifier, and then transmits the communication data to the correspondent computer.

38. A data packet processing device for processing communication data in a communication network system formed by a plurality of computers for communicating data with each other through a plurality of interconnected networks, said plurality of computers including at least one mobile computer for communicating data while changing a location in the communication network system, the data packet processing device being provided in a home network of the mobile computer and comprising:

management means for managing an address information for the mobile computer within own organization networks of the mobile computer, the address information containing a corresponding set of a first location identifier, a second location identifier and a third location identifier, the first location identifier being a location identifier specific to the mobile computer which is uniquely defined within the own organization networks, the second location identifier being a location identifier reserved for the mobile computer which is uniquely defined over all the networks, and the third location identifier being a location identifier indicating a current visited location of the mobile computer in the communication network system which is uniquely defined over all the networks; and

processing means for receiving communication data transmitted from a relay device provided in the home network of the mobile computer which is encapsulated using the third location identifier corresponding to the first location identifier, then decapsulating the communication data using the third location identifier, then encapsulating the communication data using the second location identifier corresponding to the third location identifier, then encapsulating the communication data using the third location identifier, and then transmitting the communication data to an external other organization network, when the mobile computer is located within the external other organization network and the communication data has a destination specified by the first location identifier.