MOBILITY ACCESS GATEWAY

• US 20110007705A1
• Filed: 06/22/2009
• Published: 01/13/2011
• Est. Priority Date: 10/21/2002
• Status: Active Grant

• Current Assignee: Piece Future Pte., Ltd.
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Buddhikot, Milind M., Miller, Scott C., Salgarelli, Luca, Han, Seung-Jae, Lee, Yui-Wah, Chandranmenon, Girish P.
• Granted Patent: US 8,332,914 B2
• Time in Patent Office: Days
• US Class Current: 370/331
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

A gateway for mobile access includes a foreign agent that receives user profile data and session state data from a home authentication, authorization and accounting (AAA) system of a mobile node, and a dynamic packet filter that performs multi-layer filtering based on the user profile data. The foreign agent transfers a session from a first network to a second network without session interruption, using the session state data, when the mobile node moves from the first network to the second network. The packet filter permits Internet access by the mobile node without passing Internet data requested by the mobile node through the first network.

Claims

1. A mobility access gateway, the gateway comprising:

a foreign agent for receiving a user profile data and a session state data associated with a session of a mobile node; and

a dynamic packet filter for performing multi-layer filtering based on the user profile data, wherein

the foreign agent is configured to transfer, using the session state data, the session from a first network to a second network without interrupting the session when the mobile node moves from the first network to the second network.

2. The gateway of claim 1, wherein the foreign agent is further configured to use the dynamic packet filter to direct data requested by the mobile node toward the mobile node without passing the requested data through a network in which a home authentication, authorization, and accounting (AAA) system of the mobile node is located.

3. The gateway of claim 1, wherein the foreign agent is further configured to receive the user profile data and the session state data from a home authentication, authorization, and accounting (AAA) system of the mobile node.

4. The gateway of claim 1, wherein the dynamic packet filter comprises a MAC-address-based filter for blocking all packets except for authentication packets configured to authenticate nodes.

5. The gateway of claim 1, wherein the dynamic packet filter is configured to perform one or more of:

network layer filtering,

transport layer filtering, and

application layer filtering.

6. The gateway of claim 1, further comprising an AAA server for authenticating the mobile node.

7. The gateway of claim 6, wherein the gateway is coupled to at least one access point and wherein the gateway is configured to transmit from the AAA server toward the access point an indication of whether the mobile node has been successfully authenticated by the AAA server of the gateway.

8. The gateway of claim 6, wherein the AAA server is configured to enable roaming agreements between a third generation (3G) wireless internet service provider (WISP) and a 802.11 WISP such that the foreign agent is further configured to transfer the session between a 3G network and a 802.11 network without interrupting the session when the mobile node moves between the 3G network and the 802.11 network.

9. The gateway of claim 1, further comprising:

a firewall comprising the packet filter, wherein the user profile data comprises per-user policies dynamically obtained from the home AAA system of the mobile node and the firewall is configured to apply packet filtering rules based on the dynamically obtained per-user policies.

10. The gateway of claim 1, wherein the dynamic packet filter is adapted to be updated upon a successful authentication of the mobile node.

11. A method for providing network access via a mobility access gateway, the method comprising:

receiving, at the mobility access gateway, a user profile data and a session state data associated with a session of a mobile node;

performing multi-layer filtering based on the user profile data;

using the session state data to transfer the session of the mobile node from a first network to a second network without interrupting the session when the mobile node moves from the first network to the second network.

12. The method of claim 11, further comprising:

providing Internet access for the mobile node without passing data requested by the mobile node through a network in which a home authentication, authorization and accounting (AAA) system of the mobile node is located.

13. The method of claim 11, further comprising:

determining whether the mobile node is registered to access a network via a gateway.

14. The method of claim 11, wherein the performing of multi-layer filtering comprises:

applying packet filtering rules to the session, wherein the packet filtering rules are based on per-user policies dynamically obtained from a home authentication, authorization and accounting (AAA) system of the mobile node.

15. The method of claim 14, further comprising:

updating the packet filtering rules upon a successful authentication of the mobile node.

16. The method of claim 11, wherein the performing of multi-layer filtering comprises one or more of:

network layer filtering,

transport layer filtering, and

application layer filtering.

17. The method of claim 11, wherein the first and second networks are different type networks.

18. A mobility access gateway, the gateway comprising:

means for receiving a user profile data and a session state data associated with a session of a mobile node proximate to the gateway;

means for determining, based on the user profile data, a set of one or more user-specific firewall policies associated with the mobile node;

a firewall configured to implement and apply the set of one or more user-specific firewall policies associated with the mobile node; and

means transferring the session of the mobile node from a first network to a second network, based on the session state data, without interrupting the session when the mobile node moves from the first network to the second network.

19. The gateway of claim 18, further comprising:

means for interrogating a home authentication, authorization, and accounting (AAA) system of the mobile node to determine to which network resources the mobile node is permitted to access.

20. The gateway of claim 18, wherein the user-specific firewall policies are updated upon interrogating a home authentication, authorization, and accounting (AAA) system of the mobile node.