Apparatus and method for authorizing gateway

• US 20050002341A1
• Filed: 05/14/2004
• Published: 01/06/2005
• Est. Priority Date: 05/14/2003
• Status: Abandoned Application

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Lee, Kang-suk, Lim, Yong-jun, Lee, Hak-goo
• Application Number:
  US10/845,618
• Publication Number:
  US 20050002341A1
• Time in Patent Office: Days
• US Class Current: 370/254
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

An apparatus and method for authorizing a gateway are provided. The apparatus includes a gateway function determiner, which determines whether a gateway on a predetermined network performs a particular function for a predetermined node based on a network database including information on each node managed by the gateway and information indicating a function performed by the gateway for the node; and a gateway authorizer, which authorizes the gateway to perform the particular function for the predetermined node when the gateway function determiner determines that the gateway performs the particular function for the predetermined node.

Claims

1. An apparatus for authorizing a gateway, comprising:

a gateway function determiner, which determines whether a gateway on a predetermined network performs a particular function for a predetermined node based on a network database comprising information on each node managed by the gateway and information indicating a function performed by the gateway for the node; and

a gateway authorizer, which authorizes the gateway to perform the particular function for the predetermined node when the gateway function determiner determines that the gateway performs the particular function for the predetermined node.

2. The apparatus of claim 1, wherein the function is one selected from the group comprising a home agent function of managing a mobile node, a domain name server function of converting a node'"'"'s domain name into an Internet protocol address, a nickname server function of converting a node'"'"'s nickname into an Internet protocol address, a node security function, and a partial node function or comprises the home agent function, the domain name server function, the nickname server function, the node security function, and the partial node function.

3. The apparatus of claim 1, wherein when the gateway function determiner determines that the gateway does not perform the particular function for the predetermined node, the gateway authorizer authorizes an Internet service provider terminal to perform the particular function for the predetermined node.

4. The apparatus of claim 3, further comprising a node accounting unit, which charges the predetermined node a rate lower than a normal rate when the gateway authorizer authorizes the gateway to perform the particular function for the predetermined node.

5. The apparatus of claim 4, wherein the node accounting unit charges the predetermined node the normal rate when the gateway authorizer authorizes the Internet service provider terminal to perform the particular function for the predetermined node.

6. The apparatus of claim 3, further comprising:

a gateway information providing message receiver, which receives a gateway information providing message from the gateway, the gateway information providing message comprising the information on each node managed by the gateway and the information indicating a function performed by the gateway for the node;

a gateway information acknowledgement message transmitter, which transmits a gateway information acknowledgement message to the gateway when the gateway information providing message receiver receives the gateway information providing message, the gateway information acknowledgement message comprising information indicating that the gateway information providing message has been received;

a network database constructor, which constructs a network database comprising the information on each node managed by the gateway and the information indicating a function performed by the gateway for the node that are comprised in the gateway information providing message;

an authentication/authorization/accounting request message receiver, which receives an authentication/authorization/accounting request message comprising information on the predetermined node from the predetermined node;

a node information searcher, which when the authentication/authorization/accounting request message receiver receives the authentication/authorization/accounting request message, searches the network database for the information on the predetermined node comprised in the authentication/authorization/accounting request message; and

a node authenticator, which when the node information searcher has found the information on the predetermined node, authenticates the predetermined node having transmitted the authentication/authorization/accounting request message.

7. The apparatus of claim 6, further comprising a gateway function determiner which determines whether the gateway performs the particular function for the predetermined node authenticated by the node authenticator based on the network database constructed by the network database constructor, and

a gateway authorizer which authorizes the gateway to perform the particular function for the predetermined node authenticated by the node authenticator when the gateway function determiner determines that the gateway performs the particular function for the predetermined node.

8. The apparatus of claim 7, wherein the gateway authorizer authorizes the Internet service provider terminal to perform the particular function for the predetermined node authenticated by the node authenticator when the gateway function determiner determines that the gateway does not perform the particular function for the predetermined node.

9. An apparatus for performing a function for a node in a gateway, comprising:

a gateway information providing message transmitter, which transmits a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating a function performed by the gateway for the node;

a gateway information acknowledgement message receiver, which receives a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating a function performed by the gateway for the node has been confirmed; and

a function performing unit, which performs the function for a predetermined node when the gateway information acknowledgement message receiver receives the gateway information acknowledgement message.

10. The apparatus of claim 9, wherein the function is one selected from the group comprising a home agent function of managing a mobile node, a domain name server function of converting a node'"'"'s domain name into an Internet protocol address, a nickname server function of converting a node'"'"'s nickname into an Internet protocol address, a node security function, and a partial node function or comprises the home agent function, the domain name server function, the nickname server function, the node security function, and the partial node function.

11. An apparatus for performing a home agent function for a node in a gateway, comprising:

a gateway information providing message transmitter, which transmits a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each mobile node managed by the gateway on a predetermined network and information indicating whether the home agent function is performed by the gateway for the mobile node;

a gateway information acknowledgement message receiver, which receives a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each mobile node managed by the gateway and the information indicating whether the home agent function is performed by the gateway for the mobile node has been confirmed; and

a home agent function performing unit, which performs the home agent function for a predetermined mobile node when the gateway information acknowledgement message receiver receives the gateway information acknowledgement message.

12. The apparatus of claim 11, wherein the home agent function performing unit comprises:

a binding update message receiver, which receives a binding update message from the predetermined mobile node, the binding update message comprising a temporary Internet protocol address of the mobile node on an external network;

a binding acknowledgement message transmitter, which transmits a binding acknowledgement message to the predetermined mobile node when the binding update message receiver receives the binding update message, the binding acknowledgement message indicating that the temporary Internet protocol address of the predetermined mobile node has been confirmed; and

a data packet tunneling section, which intercepts a data packet having the Internet protocol address of the predetermined mobile node on the predetermined network as a destination Internet protocol address and tunnels the intercepted data packet to the temporary Internet protocol address of the predetermined mobile node.

13. An apparatus for performing a domain name server function for a node in a gateway, comprising:

a gateway information providing message transmitter, which transmits a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating whether the domain name server function is performed by the gateway for the node;

a gateway information acknowledgement message receiver, which receives a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating whether the domain name server function is performed by the gateway for the node has been confirmed; and

a domain name server function performing unit, which performs the domain name server function for a predetermined node when the gateway information acknowledgement message receiver receives the gateway information acknowledgement message.

14. The apparatus of claim 13, wherein the domain name server function performing unit comprises:

a domain name searcher, which searches an Internet protocol address database within the gateway or an external domain name server for a domain name of the predetermined node; and

an Internet protocol address converter, which converts the domain name found by the domain name searcher into an Internet protocol address based on the Internet protocol address database within the gateway or the external domain name server.

15. An apparatus for performing a nickname server function for a node in a gateway, comprising:

a gateway information providing message transmitter, which transmits a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating whether a nickname server function is performed by the gateway for the node;

a gateway information acknowledgement message receiver, which receives a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating whether the nickname server function is performed by the gateway for the node has been confirmed; and

a nickname server function performing unit, which performs the nickname server function for a predetermined node when the gateway information acknowledgement message receiver receives the gateway information acknowledgement message.

16. The apparatus of claim 15, wherein the nickname server function performing unit comprises:

an Internet protocol address/nickname mapping table generator, which generates an Internet protocol address/nickname mapping table by allocating a nickname to an Internet protocol address of each node managed by the gateway in one-to-one correspondence;

an Internet protocol address/nickname mapping table transmitter, which transmits the Internet protocol address/nickname mapping table to each node managed by the gateway; and

a data packet transceiver, which receives or transmits a data packet from or to a node having received the Internet protocol address/nickname mapping table using the nickname as a source index or a destination index.

17. The apparatus of claim 16, wherein the nickname server function performing unit further comprises:

a changed Internet protocol address receiver, which when an Internet protocol address of a node having received the Internet protocol address/nickname mapping table is changed, receiving the changed Internet protocol address from the node;

a changed Internet protocol address request message receiver, which receives a changed Internet protocol address request message comprising a nickname of the node having the changed Internet protocol address from a predetermined node managed by the gateway except the node having the changed Internet protocol address; and

a changed Internet protocol address request message transmitter, which transmits a changed Internet protocol address response message comprising the changed Internet protocol address to the predetermined node when the changed Internet protocol address request message receiver receives the changed Internet protocol address request message.

18. An apparatus for performing a partial node function for a node in a gateway, comprising:

a gateway information providing message transmitter, which transmits a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating whether the partial node function is performed by the gateway for the node;

a gateway information acknowledgement message receiver, which receives a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating whether the partial node function is performed by the gateway for the node has been confirmed; and

a partial node function performing unit, which performs the partial node function for a predetermined node when the gateway information acknowledgement message receiver receives the gateway information acknowledgement message.

19. The apparatus of claim 18, wherein the partial node function performing unit comprises:

a partial node function performance request message receiver, which receives a partial node function performance request message from the predetermined node, the partial node function performance request message requesting the gateway to perform a partial node function requiring more resources than other functions of the predetermined node;

a partial node function result extractor, which when the partial node function performance request message receiver receives the partial node function performance request message from the predetermined node, performs the partial node function and extracts a result of performing the partial node function; and

a partial node function performance response message transmitter, which transmits a partial node function performance response message comprising the result of performing the partial node function to the predetermined node.

20. A method of authorizing a gateway, comprising:

determining whether a gateway on a predetermined network performs a particular function for a predetermined node based on a network database comprising information on each node managed by the gateway and information indicating a function performed by the gateway for the node; and

authorizing the gateway to perform the particular function for the predetermined node when it is determined that the gateway performs the particular function for the predetermined node.

21. The method of claim 20, wherein the function is one selected from the group comprising a home agent function of managing a mobile node, a domain name server function of converting a node'"'"'s domain name into an Internet protocol address, a nickname server function of converting a node'"'"'s nickname into an Internet protocol address, a node security function, and a partial node function or comprises the home agent function, the domain name server function, the nickname server function, the node security function, and the partial node function.

22. The method of claim 21, wherein authorizing the gateway to perform the particular function for the predetermined node, comprises authorizing an Internet service provider terminal to perform the particular function for the predetermined node when it is determined that the gateway does not perform the particular function for the predetermined node.

23. The method of claim 22, further comprising charging the predetermined node a rate lower than a normal rate when the gateway is authorized to perform the particular function for the predetermined node.

24. The method of claim 23, wherein charging the predetermined node comprises charging the predetermined node the normal rate when the Internet service provider terminal is authorized to perform the particular function for the predetermined node.

25. The method of claim 24, further comprising:

receiving a gateway information providing message from the gateway, the gateway information providing message comprising the information on each node managed by the gateway and the information indicating a function performed by the gateway for the node;

transmitting a gateway information acknowledgement message to the gateway when the gateway information providing message is received, the gateway information acknowledgement message comprising information indicating that the gateway information providing message has been received;

constructing a network database comprising the information on each node managed by the gateway and the information indicating a function performed by the gateway for the node that are comprised in the gateway information providing message;

receiving an authentication/authorization/accounting request message comprising information on the predetermined node from the predetermined node;

searching the network database for the information on the predetermined node comprised in the authentication/authorization/accounting request message when the authentication/authorization/accounting request message is received; and

authenticating the predetermined node having transmitted the authentication/authorization/accounting request message when the information on the predetermined node has been found.

26. The method of claim 25, wherein determining whether a gateway on the predetermined network performs the particular function for the predetermined node based on a network database comprises determining whether the gateway performs the particular function for the authenticated predetermined node based on the network database, and

authorizing the gateway to perform the particular function for the predetermined node comprises authorizing the gateway to perform the particular function for the authenticated predetermined node when it is determined that the gateway performs the particular function for the authenticated predetermined node.

27. The method of claim 26, wherein authorizing the gateway to perform the particular function for the predetermined node comprises authorizing the Internet service provider terminal to perform the particular function for the authenticated predetermined node when it is determined that the gateway does not perform the particular function for the authenticated predetermined node.

28. A method of performing a function for a node in a gateway, comprising:

transmitting a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating a function performed by the gateway for the node;

receiving a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating a function performed by the gateway for the node has been confirmed; and

performing the function for a predetermined node when the gateway information acknowledgement message is received.

29. The method of claim 28, wherein the function is one selected from the group comprising a home agent function of managing a mobile node, a domain name server function of converting a node'"'"'s domain name into an Internet protocol address, a nickname server function of converting a node'"'"'s nickname into an Internet protocol address, a node security function, and a partial node function or comprises the home agent function, the domain name server function, the nickname server function, the node security function, and the partial node function.

30. A method of performing a home agent function for a node in a gateway, comprising:

transmitting a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each mobile node managed by the gateway on a predetermined network and information indicating whether the home agent function is performed by the gateway for the mobile node;

receiving a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each mobile node managed by the gateway and the information indicating whether the home agent function is performed by the gateway for the mobile node has been confirmed; and

performing the home agent function for a predetermined mobile node when the gateway information acknowledgement message is received.

31. The method of claim 30, wherein performing the home agent function for the predetermined mobile node when the gateway information acknoweldgement message is received comprises:

receiving a binding update message from the predetermined mobile node, the binding update message comprising a temporary Internet protocol address of the predetermined mobile node on an external network;

transmitting a binding acknowledgement message to the predetermined mobile node when the binding update message is received, the binding acknowledgement message indicating that the temporary Internet protocol address of the predetermined mobile node has been confirmed; and

intercepting a data packet having the an Internet protocol address of the predetermined mobile node on the predetermined network as a destination Internet protocol address and tunneling the intercepted data packet to the temporary Internet protocol address of the predetermined mobile node.

32. A method of performing a domain name server function for a node in a gateway, comprising:

transmitting a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating whether the domain name server function is performed by the gateway for the node;

receiving a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating whether the domain name server function is performed by the gateway for the node has been confirmed; and

performing the domain name server function for a predetermined node when the gateway information acknowledgement message is received.

33. The method of claim 32, wherein performing the domain name server function for a predetermined node when the gateway information acknowledgement message is received comprises:

searching an Internet protocol address database within the gateway or an external domain name server for a domain name of the predetermined node; and

converting the domain name into an Internet protocol address based on the Internet protocol address database within the gateway or the external domain name server when the domain name is found.

34. A method of performing a nickname server function for a node in a gateway, comprising:

transmitting a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating whether the nickname server function is performed by the gateway for the node;

receiving a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating whether the nickname server function is performed by the gateway for the node has been confirmed; and

performing the nickname server function for a predetermined node when the gateway information acknowledgement message is received.

35. The method of claim 34, wherein performing the nickname server function for the predetermined node when the gateway information acknowledgement message is received comprises:

generating an Internet protocol address/nickname mapping table by allocating a nickname to an Internet protocol address of each node managed by the gateway in one-to-one correspondence;

transmitting the Internet protocol address/nickname mapping table to each node managed by the gateway; and

receiving or transmitting a data packet from or to a node having received the Internet protocol address/nickname mapping table using the nickname as a source index or a destination index.

36. The method of claim 35, wherein performing the nickname server function for the predetermined node when the gateway information acknowledgement message is received further comprises:

receiving the changed Internet protocol address from the node when an Internet protocol address of a node having received the Internet protocol address/nickname mapping table is changed;

receiving a changed Internet protocol address request message comprising a nickname of the node having the changed Internet protocol address from a predetermined node managed by the gateway except the node having the changed Internet protocol address; and

transmitting a changed Internet protocol address response message comprising the changed Internet protocol address to the predetermined node when the changed Internet protocol address request message is received.

37. A method of performing a partial node function for a node in a gateway, comprising:

transmitting a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating whether the partial node function is performed by the gateway for the node;

receiving a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating whether the partial node function is performed by the gateway for the node has been confirmed; and

performing the partial node function for a predetermined node when the gateway information acknowledgement message is received.

38. The method of claim 37, wherein performing the partial node function for the predetermined node when the gateway information acknowledgement message is received comprises:

receiving a partial node function performance request message from the predetermined node, the partial node function performance request message requesting the gateway to perform a partial node function requiring more resources than other functions of the predetermined node;

performing the partial node function and extracting the result of performing the partial node function when the partial node function performance request message is received from the predetermined node; and

transmitting a partial node function performance response message comprising the result of performing the partial node function to the predetermined node.

39. A computer readable medium for storing a program for performing a method of authorizing a gateway, the method comprising:

determining whether a gateway on a predetermined network performs a particular function for a predetermined node based on a network database comprising information on each node managed by the gateway and information indicating a function performed by the gateway for the node; and

authorizing the gateway to perform the particular function for the predetermined node when it is determines that the gateway performs the particular function for the predetermined node.

40. A computer readable recording medium for storing a program for performing a method of performing a function for a node in a gateway, the method comprising:

transmitting a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating a function performed by the gateway for the node;

receiving a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating a function performed by the gateway for the node has been confirmed; and

performing the function for a predetermined node when the gateway information acknowledgement message is received.

41. A computer readable recording medium for storing a program for performing a method of performing a home agent function for a node in a gateway, the method comprising:

transmitting a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each mobile node managed by the gateway on a predetermined network and information indicating whether the home agent function is performed by the gateway for the mobile node;

receiving a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each mobile node managed by the gateway and the information indicating whether the home agent function is performed by the gateway for the mobile node has been confirmed; and

performing the home agent function for a predetermined mobile node when the gateway information acknowledgement message is received.

42. A computer readable recording medium for storing a program for performing a method of performing a domain name server function for a node in a gateway, the method comprising:

transmitting a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating whether the domain name server function is performed by the gateway for the node;

receiving a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating whether the domain name server function is performed by the gateway for the node has been confirmed; and

performing the domain name server function for a predetermined node when the gateway information acknowledgement message is received.

43. A computer readable recording medium for storing a program for performing a method of performing a nickname server function for a node in a gateway, the method comprising:

transmitting a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating whether the nickname server function is performed by the gateway for the node;

receiving a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating whether the nickname server function is performed by the gateway for the node has been confirmed; and

performing the nickname server function for a predetermined node when the gateway information acknowledgement message is received.

44. A computer readable recording medium for storing a program for performing a method of performing a partial node function for a node in a gateway, the method comprising:

transmitting a gateway information providing message to an authentication/authorization/accounting server, the gateway information providing message comprising information on each node managed by the gateway on a predetermined network and information indicating whether the partial node function is performed by the gateway for the node;

receiving a gateway information acknowledgement message from the authentication/authorization/accounting server, the gateway information acknowledgement message indicating that the information on each node managed by the gateway and the information indicating whether the partial node function is performed by the gateway for the node has been confirmed; and

performing the partial node function for a predetermined node when the gateway information acknowledgement message is received.