Secure proxy mobile apparatus, systems, and methods

• US 20070016774A1
• Filed: 07/15/2005
• Published: 01/18/2007
• Est. Priority Date: 07/15/2005
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Bakshi, Sanjay
• Granted Patent: US 7,313,394 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2463/081 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

Secure proxy mobile apparatus, systems, methods, and articles are described generally herein. Other embodiments may be described and claimed.

Claims

1. A method, including:

securely and dynamically registering a mobile node with a home network using a proxy mobile node to perform the registration while the mobile node roams in a visited network, wherein a first security domain associated with the home network is separate from a second security domain associated with the visited network.

2. The method of claim 1, wherein the mobile node comprises a mobile-Internet protocol (mobile-IP) node and the proxy mobile node comprises a client node on the visited access network, the client node to perform mobile-IP functions on behalf of the mobile node.

3. The method of claim 1, wherein a prefix within a home address configured on the mobile node corresponds to a network address associated with the home network.

4. The method of claim 1, further including:

authenticating the mobile node to a security server, wherein the security server comprises a node on the home network.

5. The method of claim 4, wherein the security server comprises a mobile-IP authentication, authorization, and accounting (AAA) server.

6. The method of claim 4, further including:

generating a first cryptographic key at the mobile node and at the security server.

7. The method of claim 6, wherein the first cryptographic key comprises a master session key (MSK).

8. The method of claim 6, further including:

sending the first cryptographic key to an authenticator from the security server, wherein the authenticator comprises a node on the visited network.

9. The method of claim 8, further including:

deriving a second cryptographic key from the first cryptographic key at the security server and at the authenticator.

10. The method of claim 9, wherein the second cryptographic key comprises a proxy mobile node authentication, authorization, and accounting (PMN-AAA) key.

11. The method of claim 10, further including:

sending the second cryptographic key to the proxy mobile node.

12. The method of claim 11, further including performing the following sequence using the proxy mobile node:

calculating a first authenticator field using the PMN-AAA key;

formulating a proxy mobile node authentication, authorization, and accounting (PMN-AAA) authentication extension using the first authenticator field;

formulating a proxy mobile node to home agent (PMN-HA) key generation nonce request extension using the second cryptographic key;

formulating a registration request containing the PMN-AAA authentication extension and the PMN-HA key generation nonce request; and

sending the registration request to a foreign agent, wherein the foreign agent comprises a node on the visited access network.

13. The method of claim 12, further including:

forwarding the registration request to a home agent via the foreign agent, wherein the home agent comprises a node on the home network.

14. The method of claim 13, further including performing the following sequence using the home agent:

placing the PMN-HA key generation nonce request into an AAA message; and

sending the AAA message to the security server.

15. The method of claim 14, further including performing the following sequence at the security server:

authenticating the mobile node;

generating the PMN-HA key generation nonce;

generating a PMN-HA key using the PMN-HA key generation nonce; and

sending the PMN-HA key generation nonce and the PMN-HA key to the home agent.

16. The method of claim 15, performed according to procedures documented in Internet Engineering Task Force Request for Comments 3957 (March 2005).

17. The method of claim 15, further including performing the following sequence at the home agent:

storing the PMN-HA key in a mobility security association on the home agent;

calculating a second authenticator field;

formulating a PMN-HA authentication extension using the second authenticator field;

formulating a registration reply incorporating the PMN-HA authentication extension and the PMN-HA key generation nonce, the PMN-HA key generation nonce embedded in a PMN-HA key generation nonce reply extension;

sending the registration reply to the foreign agent; and

establishing a forwarding tunnel from the home agent to the foreign agent to forward traffic to the mobile node.

18. The method of claim 17, further including:

establishing a forwarding path between the foreign agent and the mobile node.

19. The method of claim 17, further including performing the following using the proxy mobile node:

extracting the PMN-HA key generation nonce from the registration reply;

deriving the PMN-HA key using the PMN-HA key generation nonce; and

authenticating the registration reply using the PMN-HA key.

20. An article including a machine-accessible medium having associated information, wherein the information, when accessed, results in a machine performing:

securely and dynamically registering a mobile node with a home network using a proxy mobile node to perform the registration while the mobile node roams in a visited network, wherein a first security domain associated with the home network is separate from a second security domain associated with the visited network.

21. The article of claim 20, wherein the information, when accessed, results in a machine performing:

authenticating the mobile node to a security server, wherein the security server comprises a node on the home network.

22. The article of claim 21, wherein the information, when accessed, results in a machine performing:

receiving at least one cryptographic key from the security server to be used by the mobile node to encrypt messages to be sent from the mobile node and to de-encrypt messages received at the mobile node.

23. An apparatus, including:

a device to securely and dynamically register a mobile node with a home network using a proxy mobile node to perform the registration while the mobile node roams in a visited network, wherein a first security domain associated with the home network is separate from a second security domain associated with the visited network.

24. The apparatus of claim 23, further including:

a foreign agent coupled to the proxy mobile node comprising a receiving end of an Internet protocol tunnel established to securely forward traffic from the home network to the mobile node.

25. The apparatus of claim 24, further including:

a home agent to communicatively couple to the foreign agent to forward the traffic.

26. The apparatus of claim 23, further including:

a security server coupled to the home network to authenticate the mobile node and to generate cryptographic keys for use in secure communications with the mobile node.

27. The apparatus of claim 23, further including:

an authenticator coupled to the visited network to authenticate the mobile node to the home network.

28. A system, including:

a device to securely and dynamically register a mobile node with a home network using a proxy mobile node to perform the registration while the mobile node roams in a visited network, wherein a first security domain associated with the home network is separate from a second security domain associated with the visited network.

29. The system of claim 28, wherein a public data network (PDN) coupled to the home network to serves as a conduit for data traffic tunneled from the home network to the visited network.

30. The system of claim 29, wherein a correspondent node coupled to the PDN is capable of communicating with the mobile node following the registration.