Device to facilitate the deployment of mobile virtual private networks for medium/large corporate networks

• US 20070008924A1
• Filed: 01/17/2005
• Published: 01/11/2007
• Est. Priority Date: 01/15/2004
• Status: Abandoned Application

• Current Assignee: Radio IP Software Inc.
• Original Assignee: Radio IP Software Inc.
• Inventors: Moran, Padraig
• Application Number:
  US10/597,134
• Publication Number:
  US 20070008924A1
• Time in Patent Office: Days
• US Class Current: 370/331
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 8/065 involving selection of the user mobility server
• CPC Class Codes: H04W 8/12 between location registers or mobility servers
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

A mobile agent device in a Mobile Virtual Private Network, said device comprising: termination of Mobile IP tunnel (6) from a remotely connecting Mobile Node (1); termination of an IPSec VPN tunnel (7) from the remotely connecting Mobile Node; dynamic Selection of Internal Mobile IP Home Agent based on user Authentication; tunneling of traffic to and/or from the assigned Internal Mobile Home Agent for this Mobile Node; and, provision of extended authentication, after Mobile IP connection establishment, and during the VPN negotiation phase, based on extra user credentials, one-time-password mechanism or similar.

Claims

1. A mobile agent device in a Mobile Virtual Private Network, said device comprising:

a. termination of Mobile IP tunnel from a remotely connecting Mobile Node;

b. termination of an IPSec VPN tunnel from the remotely connecting Mobile Node;

c. dynamic Selection of Internal Mobile IP Home Agent based on user Authentication;

d. tunneling of traffic to and/or from the assigned Internal Mobile Home Agent for this Mobile Node; and

e. provision of extended authentication, after Mobile IP connection establishment, and during the VPN negotiation phase, based on extra user credentials, one-time-password mechanism or similar.

2. The device of claim 1, wherein the mobile agent device appears as a Mobile IP Foreign Agent towards the Internal Home Agent.

3. The device of claim 1, wherein the mobile agent device appears as a Mobile IP Home Agent towards the remotely connecting Mobile Node.

4. The device of claim 1, wherein the mobile agent device provides a dynamically assigned Mobile IP address to the Mobile Node, if requested to do so by the Mobile Node.

5. The device of claim 1, wherein the mobile agent device provides a termination point for IKE &

IPSec VPN connections from a remotely connecting Mobile Node.

6. The device of claim 1, wherein IP encapsulated tunneling is used for transfer of traffic between the mobile agent device and the Internal Home Agent.

7. The device recited in claim 1, wherein UDP encapsulated tunneling is used for transfer of traffic between the mobile agent device and the Internal Home Agent.

8. The device of claim 1, wherein traffic can be routed directly from the mobile agent device towards its destination, on receipt from the mobile node.

9. The device of claim 1, wherein IP encapsulated tunneling is used for transfer of traffic between the mobile node and the mobile agent device.

10. The device claim 1, wherein UDP encapsulated tunneling is used for transfer of traffic between the mobile node and the mobile agent device.

11. The device claim 9, wherein IPSec tunneling is used for protection of the transfer of traffic between the mobile node and the mobile agent device, within said encapsulation.

12. The device of claim 1, further comprising restriction of user access to the internal home agent or internal network, until extended user authentication is carried out.

13. The device of claim 1, further comprising time and volume based accounting is carried out a per Mobile Node basis.

15. The device of claim 10, wherein IPSec tunneling is used for protection of the transfer of traffic between the mobile node and the mobile agent device, within said encapsulation.

14. (canceled)