RE-ESTABLISHMENT OF A SECURITY ASSOCIATION

• US 20110035585A1
• Filed: 03/12/2008
• Published: 02/10/2011
• Est. Priority Date: 03/12/2008
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Haddad, Wassim
• Granted Patent: US 8,918,522 B2
• Time in Patent Office: Days
• US Class Current: 713/162
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/0471 Key exchange
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 36/0011 for data sessions of end-to-end connection
• CPC Class Codes: H04W 36/0019 adapted for mobile IP [MIP]
• CPC Class Codes: H04W 76/22 Manipulation of transport tunnels
• CPC Class Codes: H04W 8/082 for traffic bypassing of mobility servers, e.g. location registers, home PLMNs or home agents
• CPC Class Codes: H04W 8/16 selectively restricting mobility data tracking
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

According to a first aspect of the present invention there is provided a method of re-establishing a session between first and second IP hosts attached to respective first and second IP access routers, the session previously having been conducted via a previous access router to which said first host was attached, and where a security association comprising a shared secret has been established between the hosts. The method comprises sending a connection request from said first host to said first access router, said request containing an IP address claimed by said second host, a new care-of-address for the first host, and a session identifier. Upon receipt of said connection request at said first access router, the router obtains a verified IP address for said second access router and sends an on link presence request to the second access router, the request containing at least an Interface Identifier part of the second host'"'"'s claimed IP address, said care-of-address, and said session identifier. Said second access router confirms that said second host is attached to the second access router using the claimed Interface Identifier, sending to the second host said care-of-address and said session identifier. The second access router then reports the presence status to said first access router. Said second host uses said session identifier to identify said security association, and updates the binding cache entry for said first host with the new care-of-address.

Claims

1. A method of re-establishing a session between first and second IP hosts attached to respective first and second IP access routers, the session previously having been conducted via a previous access router to which said first host was attached, and where a security association comprising a shared secret has been established between the hosts, the method comprising:

sending a connection request from said first host to said first access router, said request containing an IP address claimed by said second host, a new care-of-address for the first host, and a session identifier;

at said first access router, upon receipt of said connection request, obtaining a verified IP address for said second access router and sending an on link presence request to the second access router, the request containing at least an Interface Identifier part of the second host'"'"'s claimed IP address, said care-of-address, and said session identifier;

at said second access router, confirming that said second host is attached to the second access router using the claimed Interface Identifier including sending to the second host said care-of-address and said session identifier, and reporting the presence status to said first access router;

at said second host, using said session identifier to identify said security association, and updating the binding cache entry for said first host with the new care-of-address.

2. A method according to claim 1 and comprising, at said first router, obtaining together with said verified IP address, a public key of said second access router, and authenticating the presence status report sent by the second access router using said public key.

3. A method according to claim 1, wherein verified IP address for said second access router is retrieved by the first access router from a trusted network server.

4. A method according to claim 1 and comprising, following receipt of said on link presence request at said second access router, obtaining a public key of said first access router, and authenticating the request with that key.

5. A method according to claim 4, wherein said public key of the first access router is retrieved by the second access router from a trusted network server.

6. A method according to claim 1, said connection request being carried in a router solicitation message.

7. A method according to claim 1, wherein said care-of-address and said session identifier are sent from the second access router to the second host in a Neighbour Discovery message.

8. A method according to claim 7 and comprising including in said connection request a secret key shared between the first and second hosts and associated with said security association, said secret key also being included in a Neighbour Discovery response sent from said second host to said second access router, the secret key being used by the access routers to authenticate the presence status report.

9. A method according to claim 1, wherein said care-of-address is a cryptographically generated IPv6 address and said connection request is signed with the first host'"'"'s private key and verified at the first access router using the corresponding public key.

10. A method according to claim 8, wherein said IP address claimed by the second host is a cryptographically generated IPv6 address and said Neighbour Discovery response is signed with the second host'"'"'s private key and verified at the second access router using the corresponding public key.

11. A method according to claim 1, wherein said first and second access routers share a pair of group keys that are subsequently used by the routers to generate anonymised Interface Identifiers for use in the source and destination IPv6 addresses of the first and second hosts.

12. A method according to claim 11, wherein, in the event that said group keys are not shared by the access routers prior to receipt by the first access router of said connection request, the keys are generated at respective hosts and exchanged by the hosts.

13. A method according to claim 12, wherein a first group key SGKn is generated by said first access router upon receipt of the connection request from the first host and is included in the on link presence request sent to the second access router, and a second group key DGKn is generated by the second access router upon confirmation that the second host is attached to the second access router at its claimed IP address and is included in the presence status report sent to the first access router.

14. An access router for use in an IP communication network and comprising:

an input for receiving from a mobile node an attachment request, the request containing a care-of-address acquired by the mobile node, an IPv6 address claimed by a correspondent node of the mobile node, and a session identifier;

first processing means for obtaining a validated IP address for a peer access router behind which the correspondent node should be located;

output means for forwarding an on link presence request to said peer access router using said validated IP address and containing said care-of-address, the claimed IPv6 address, and said session identifier.

15. An access router for use in an IP communication network and comprising:

an input for receiving from a peer access router an on link presence request containing a care-of-address acquired by a mobile node located behind said peer access router, an IPv6 address claimed by a correspondent node and containing an Interface Identifier part belonging to the access router, and a session identifier;

processing means for confirming that said correspondent node is present on the local link including means for sending said care-of-address and said session identifier to said correspondent node; and

output means for reporting a link status to said peer access router.

16. A mobile node for use in an IP communication network and comprising:

processing means for establishing a session with a correspondent node, said session comprising one or more security associations and a session identifier identifying the session;

attachment means for detaching from a previous access router and for attaching to a new access router and arranged to send an attachment request to the new access router, the attachment request containing an IPv6 address of said correspondent node, a care-of-address claimed by said correspondent node, said session identifier, and a prefix reachability request in respect of the Interface Identifier part of the correspondent node'"'"'s claimed IP address;

input means for receiving reachability confirmation in respect of said claimed IP address from said access router; and

packet processing means for exchanging packets with said correspondent node following receipt of said confirmation.