MAINTAINING SECRECY OF ASSIGNED UNIQUE LOCAL ADDRESSES FOR IPV6 NODES WITHIN A PRESCRIBED SITE DURING ACCESS OF A WIDE AREA NETWORK

• US 20090285216A1
• Filed: 05/19/2009
• Published: 11/19/2009
• Est. Priority Date: 11/02/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: LEVY-ABEGNOLI, ERIC M., THUBERT, PASCAL
• Granted Patent: US 7,940,769 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 2101/659 Internet protocol version 6 [IPv6] addresses
• CPC Class Codes: H04L 61/2528 Translation at a proxy
• CPC Class Codes: H04L 61/2539 Hiding addresses; Keeping addresses anonymous
• CPC Class Codes: H04L 61/2546 Arrangements for avoiding unnecessary translation
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/169 Special adaptations of TCP, UDP or IP for interworking of IP based networks with other networks protocols for interworking, protocol conversion H04L69/08

Abstract

A network includes network nodes and a gateway. Each network node has a corresponding unique in-site IPv6 address for communication within a prescribed site, each in-site IPv6 address having a first IPv6 address prefix that is not advertised outside of the prescribed site. Network nodes can obtain from within the prescribed site a unique extra-site IPv6 address for mobile or extra-site communications. The extra-site IPv6 address has a second IPv6 address prefix, distinct from the first IPv6 address prefix, advertised by the gateway to the prescribed site and the wide area network. The gateway establishes a secure connection (e.g., tunnel) with each corresponding IPv6 node using its corresponding extra-site IPv6 address, and creates a corresponding binding cache entry specifying the corresponding extra-site IPv6 address and in-site IPv6 address. Hence, the gateway provides wide area network access while maintaining secrecy of the in-site IPv6 addresses.

Claims

1. An IPv6 node comprising:

an in-site address acquisition resource configured for acquiring a unique in-site IPv6 address for communication with at least an IPv6 gateway node within a prescribed site, the unique in-site IPv6 address being reachable only by nodes within the prescribed site, the unique in-site IPv6 address having a first address prefix that is not advertised outside of the prescribed site;

an extra-site address acquisition resource configured for obtaining from within the prescribed site a unique extra-site IPv6 address having a second address prefix that is distinct from the first address prefix, wherein the second address prefix is advertised inside and outside the prescribed site; and

a packet transmit/receive resource configured for sending a first packet to a correspondent node outside of the prescribed site based on;

(1) first generating the first packet, the first packet having a first header with a destination address field specifying an address of the correspondent node and a source address field specifying the extra-site IPv6 address, and

(2) second generating a second packet including the first packet and a second header for reception and removal by the IPv6 gateway node, the second header having a destination address field specifying an IPv6 address of the IPv6 gateway node and a source address field specifying the in-site IPv6 address,

(3) the packet transmit/receive resource including a secure tunnel interface configured for outputting the second packet, having the first and second headers, to the IPv6 gateway node via a secure connection established between the IPv6 node and the IPv6 gateway node, for transfer of the first packet by the IPv6 gateway node outside of the prescribed site for delivery to the correspondent node.

69. The IPv6 node of claim 1, wherein the secure tunnel interface is configured for establishing the secure connection as a secure tunnel between the IPv6 node and the IPv6 gateway node.

70. The IPv6 node of claim 1, further comprising a local Internet Protocol connection interface configured for receiving a third packet, having been generated by a second correspondent node inside the prescribed site, the third packet including a corresponding source address field specifying a corresponding second in-site IPv6 address of the second correspondent node that includes the first address prefix, the third packet further including a corresponding destination address field specifying the in-site IPv6 address of the IPv6 node.

71. The IPv6 node of claim 70, wherein the third packet is received via a path independent of the secure connection, the IPv6 node being a fixed node.

72. The IPv6 node of claim 70, wherein the packet transmit/receive resource is configured for sending via the local Internet Protocol connection interface a fourth packet to the second correspondent node via a path independent of the secure connection based on the second correspondent node using the second in-site IPv6 address, the fourth packet having a corresponding source address field specifying the in-site IPv6 address of the IPv6 node and a corresponding destination address field specifying the second in-site IPv6 address.

73. The IPv6 node of claim 1, wherein:

the packet transmit/receive resource is configured for receiving a third packet via the secure connection, the third packet including a third header including a corresponding source address field specifying the IPv6 address of the IPv6 gateway node, the third header further including a corresponding destination address field specifying the in-site IPv6 address of the IPv6 node;

the packet transmit/receive resource configured for recovering from within the third packet a fourth packet having a fourth header including a corresponding destination address field specifying the extra-site IPv6 address of the IPv6 node.

74. The IPv6 node of claim 73, wherein the fourth header includes a corresponding source address field specifying the IPv6 address of the correspondent node outside of the prescribed site.

75. The IPv6 node of claim 73, wherein the fourth header includes a corresponding source address field specifying a second in-site IPv6 address of a second correspondent node inside the prescribed site.

76. The IPv6 node of claim 75, wherein the packet transmit/receive resource includes a path selection resource configured for selecting the extra-site IPv6 address as a source address for a fourth packet to be sent to the second in-site IPv6 address via the secure connection, following encapsulating in a fifth packet specifying the in-site IPv6 address of the IPv6 node as the corresponding source address, based on the IPv6 node being a mobile node.

77. The IPv6 node of claim 1, wherein the IPv6 node is configured for updating a first Dynamic Name Server with the extra-site IPv6 address and a corresponding host name assigned to the IPv6 node, the Dynamic Name Server configured for providing the extra-site IPv6 address, outside of the prescribed site, in response to a query from outside of the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

78. The IPv6 node of claim 77, wherein the in-site address acquisition resource is configured for updating a second Dynamic Name Server with the in-site IPv6 address and the corresponding host name, the second Dynamic Name Server configured for providing the in-site IPv6 address, only within the prescribed site, in response to a second query from inside the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

79. The IPv6 node of claim 1, wherein the in-site address acquisition resource is configured for updating a Dynamic Name Server with the in-site IPv6 address and a corresponding host name assigned to the IPv6 node, the Dynamic Name Server configured for providing the in-site IPv6 address, only within the prescribed site, in response to a query from inside the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

2-68. -68. (canceled)

80. An IPv6 gateway configured for providing connectivity between a prescribed site and a wide area network, the IPv6 gateway comprising:

an advertising resource configured for advertising only within the prescribed site that a first IPv6 address prefix is reachable via the IPv6 gateway, the first IPv6 address prefix not advertised outside of the prescribed site, and advertising to the prescribed site and the wide area network that a second IPv6 address prefix is reachable via the IPv6 gateway;

a secure tunnel generation resource configured for establishing a secure connection with a first IPv6 node within the prescribed site, based on the first IPv6 node having a unique in-site IPv6 address that includes the first IPv6 address prefix;

an ingress interface configured for receiving from the first IPv6 node, via the secure connection, a first packet having a source address field specifying the in-site IPv6 address, a destination address field specifying an IPv6 address of the IPv6 gateway, and a second packet;

a packet forwarding resource configured for forwarding the second packet to a destination node in response to the destination address field of the first packet specifying the IPv6 address of the IPv6 gateway and based on recovering the second packet from the first packet, the second packet having a source address field specifying a unique extra-site IPv6 address having the second IPv6 address prefix and a destination address field specifying an IPv6 address of the destination node, the second packet output by the IPv6 gateway without the in-site IPv6 address of the first IPv6 node; and

a binding cache resource configured for creating a binding cache entry specifying that the extra-site IPv6 address of the first IPv6 node is reachable via the in-site IPv6 address of the first IPv6 node.

81. The IPv6 gateway of claim 80, wherein the packet forwarding resource is configured for determining that the IPv6 address of the destination node includes one of the first IPv6 address prefix or the second IPv6 address prefix, and performing route optimization within the prescribed site between the first IPv6 node and the destination node based on the IPv6 address of the destination node including the one IPv6 address prefix.

82. The IPv6 gateway of claim 80, wherein the packet forwarding resource is configured for determining that the IPv6 address of the destination node includes a third IPv6 address prefix distinct from any one of the first IPv6 address prefix or the second IPv6 address prefix, and preventing any route optimization between the first IPv6 node and the destination node based on the third IPv6 address prefix being distinct from the first IPv6 address prefix.

83. The IPv6 gateway of claim 80, further comprising an address assignment resource configured for assigning the extra-site IPv6 address to the first IPv6 node in response to a request thereof, the binding cache entry created by the binding cache resource in response to the assigning of the extra-site IPv6 address.

84. The IPv6 gateway of claim 83, wherein the IPv6 gateway is configured for updating a Dynamic Name Server with the extra-site IPv6 address and a corresponding host name having been assigned to the first IPv6 node, the Dynamic Name Server configured for providing the extra-site IPv6 address, to a node in the wide area network, in response to a corresponding query that requests a reachable address for the host name assigned to the first IPv6 node.

85. The IPv6 gateway of claim 80, wherein the secure connection is established as a secure tunnel between the IPv6 gateway and the first IPv6 node.

86. The IPv6 gateway of claim 80, wherein the second packet is output to at least one of:

into the prescribed site via a prescribed route based on the IPv6 address of the destination node specifying the first IPv6 address prefix;

or

into the prescribed site via a second secure connection, established between the IPv6 gateway and the destination node, based on the IPv6 address of the destination node specifying the second IPv6 address prefix.

87. The IPv6 gateway of claim 86, further comprising an egress interface configured for outputting the second packet onto the wide area network based on the packet forwarding resource determining the IPv6 address of the destination node specifies an address prefix distinct from any one of the first IPv6 address prefix or the second IPv6 address prefix.