Mobile computing scheme using encryption and authentication processing based on mobile computer location and network operating policy

• US 6,167,513 A
• Filed: 10/31/1997
• Issued: 12/26/2000
• Est. Priority Date: 11/01/1996
• Status: Expired due to Fees

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Ishiyama, Masahiro, Shimbo, Atsushi, Inoue, Atsushi, Fukumoto, Atsushi, Okamoto, Toshio, Tsuda, Yoshiyuki
• Primary Examiner(s): Swann, Tod R.
• Assistant Examiner(s): Callahan, Paul E.
• Application Number:
  US08/962,332
• Time in Patent Office: 1,152 Days
• Field of Search: 380/23, 380/25, 380/49, 380/287, 380/255, 709/200, 709/218, 709/223, 709/230, 709/232, 713/150, 713/153, 713/168, 713/169
• US Class Current: 713/150
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

A mobile computing scheme capable of carrying out a proper packet transfer according to a current location of the mobile computer by accounting for the network operating policy. A mobile computer carries out a prescribed communication processing according to recognition results as to whether the mobile computer is located inside or outside the home network at which a mobile computer management device of the mobile computer is provided, and whether or not there exists a packet processing device which has a packet transmitted by at least one of the mobile computer and a correspondent computer as an encryption and authentication processing target. Also, a packet processing device carries out a prescribed transfer processing according to recognition results as to whether at least one of a source computer and a destination computer of a packet to be transferred is a moving mobile computer which is moving outside its home network, and whether or not there exists a packet processing device which has a packet transmitted by at least one of the source computer and the destination computer as an encryption and authentication processing target.

Claims

1. A mobile computer for carrying out communications while moving within a communication system in which a plurality of networks are inter-connected, said plurality of networks including one network at which a packet processing device is provided, said packet processing device having a function for applying an encryption and authentication processing to a packet transmitted by a computer inside said one network toward another computer outside said one network, the mobile computer comprising:

a first recognition unit for recognizing whether said mobile computer is located inside a home network or outside the home network, the home network being one of said plurality of networks at which a mobile computer management device is provided, the mobile computer management device having a function for managing a mobile location information of said mobile computer and transferring a packet destined to said mobile computer to a current location of said mobile computer;

a second recognition unit for recognizing whether or not there exists a packet processing device which has a packet transmitted by at least one of said mobile computer and a correspondent computer of said mobile computer as an encryption and authentication processing target; and

a communication unit for carrying out a prescribed communication processing including an encryption and authentication processing of a packet to be transmitted from said mobile computer, according to recognition results obtained by the first recognition unit and the second recognition unit.

2. The mobile computer of claim 1, wherein the prescribed communication processing includes a processing for transmitting a packet without encryption, a processing for transmitting a packet by encrypting a prescribed communication data and attaching an end-to-end authentication data for an authentication to be carried out between end nodes involved in a cipher communication, and a processing for transmitting a packet by encrypting the prescribed communication data and attaching the end-to-end authentication data and a link authentication data for an authentication to be carried out between said mobile computer and a next hop packet processing device.

3. The mobile computer of claim 1, wherein the prescribed communication processing includes a processing for transmitting a packet in an IP format, a processing for transmitting a packet in an encryption/end-to-end authentication format, and a processing for transmitting a packet in an encryption/link authentication format, according to a mobile IP scheme.

4. The mobile computer of claim 1, wherein when a received packet is encrypted and attached with an end-to-end authentication data for an authentication to be carried out between end nodes involved in a cipher communication,

the communication unit inspects the end-to-end authentication data, and if an authenticity of the end-to-end authentication data is checked, the communication unit obtains an actual transfer data by decrypting a prescribed communication content of the received packet while removing the end-to-end authentication data.

5. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located outside the home network, the communication unit transmits a registration message including a current location information of said mobile computer after applying the encryption and authentication processing, toward said mobile computer management device, and

when a passing refuse response is returned from one packet processing device on a packet transfer route in response to the registration message, the communication unit acquires an information on an authentication key of said one packet processing device and re-transmits the registration message by attaching an authentication code using said authentication key.

6. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located inside the home network,

the communication unit transmits a registration message containing a current location information of said mobile computer without applying the encryption and authentication processing, toward said mobile computer management device in the home network.

7. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located inside the home network,

the communication unit transmits a packet without applying the encryption and authentication processing, toward the correspondent computer.

8. The mobile computer of claim 1, wherein when the second recognition unit recognizes that there exists a packet processing device which has a packet transmitted by said mobile computer as well as a packet transmitted by the correspondent computer as the encryption and authentication processing target,

the communication unit transmits a packet without applying the encryption and authentication processing, toward the correspondent computer.

9. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located outside the home network and the second recognition unit recognizes that there exists one packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target and there exists another packet processing device which has a packet transmitted by the correspondent computer as the encryption and authentication processing target, while it is ascertained that said one packet processing device allows to pass a packet transmitted by said mobile computer to outside without applying an authentication processing,

the communication unit transmits a packet in which a prescribed communication content is encrypted and to which an end-to-end authentication data is attached, toward the correspondent computer.

10. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located outside the home network and the second recognition unit recognizes that there exists one packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target and there exists another packet processing device which has a packet transmitted by the correspondent computer as the encryption and authentication processing target, while it is ascertained that said one packet processing device does not allow to pass a packet transmitted by said mobile computer to outside without applying an authentication processing,

the communication unit transmits a packet in which a prescribed communication content is encrypted and to which an end-to-end authentication data and a link authentication data are attached, toward the correspondent computer.

11. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located outside the home network and the second recognition unit recognizes that there is no packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target,

the communication unit transmits a packet in which a prescribed communication content is encrypted and to which an end-to-end authentication data is attached, toward the correspondent computer.

12. The mobile computer of claim 1, wherein when the second recognition unit recognizes that there exists a packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target and there is no packet processing device which has a packet transmitted by the correspondent computer as the encryption and authentication processing target,

the communication unit transmits a packet without applying the encryption and authentication processing, toward the correspondent computer.

13. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located inside the home network and the second recognition unit recognizes that there is no packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target,

the communication unit carries out a direct plaintext communication with the correspondent computer.

14. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located outside the home network and the second recognition unit recognizes that there exists a packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target and there is no packet processing device which has a packet transmitted by the correspondent computer as the encryption and authentication processing target,

the communication unit carries out a plaintext communication in which a packet destined to said mobile computer is routed by said mobile computer management device.

15. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located outside the home network and the second recognition unit recognizes that there exists a packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target and there is no packet processing device which has a packet transmitted by the correspondent computer as the encryption and authentication processing target,

the communication unit carries out a direct plaintext communication using an address acquired at a visited site of said mobile computer.

16. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located outside the home network and the second recognition unit recognizes that there is no packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target and there is no packet processing device which has a packet transmitted by the correspondent computer as the encryption and authentication processing target,

the communication unit transmits a packet in which a prescribed communication content is encrypted to the home network, so that a packet transfer device in the home network applies an address conversion and transfers said packet to the correspondent computer, and another packet transmitted from the correspondent computer is applied with the address conversion by said packet transfer device and routed by said mobile computer management device so as to be transferred to said mobile computer by encrypting a communication content of said another packet.

17. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located inside the home network and the second recognition unit recognizes that there exists one packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target and there exists another packet processing device which has a packet transmitted by the correspondent computer as the encryption and authentication processing target,

the communication carries out a cipher communication with the correspondent computer by transmitting a packet to said one packet processing device, while the correspondent computer directly transmits an encrypted packet destined to said mobile computer.

18. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located outside the home network and the second recognition unit recognizes that there exists a packet processing device which has a packet transmitted by said mobile computer as well as a packet transmitted by the correspondent computer as the encryption and authentication processing target,

the communication unit transmits a packet without applying the encryption and authentication processing, directly to the correspondent computer.

19. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located outside the home network and the second recognition unit recognizes that there is no packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target and there exists a packet processing device which has a packet transmitted by the correspondent computer as the encryption and authentication processing target,

the communication unit transmits an encrypted packet with an authentication data attached thereto, to the correspondent computer.

20. The mobile computer of claim 1, wherein when the first recognition unit recognizes that said mobile computer is located outside the home network and the second recognition unit recognizes that there exists one packet processing device which has a packet transmitted by said mobile computer as the encryption and authentication processing target and there exists another packet processing device which has a packet transmitted by the correspondent computer as the encryption and authentication processing target,

the communication unit transmits a packet in which a communication content is encrypted and to which an end-to-end authentication data for authentication between end nodes and a link authentication data for authentication between said mobile computer and a packet processing device in a visited network of said mobile computer are attached, to the correspondent computer.

21. A packet processing device to be provided in one network of a communication system in which a plurality of networks are inter-connected, said plurality of networks including a home network at which a mobile computer management device of a mobile computer for carrying out communications while moving within the communication system is provided, the mobile computer management device having a function for managing a mobile location information of said mobile computer and transferring a packet destined to said mobile computer to a current location of said mobile computer, said packet processing device having a function for applying an encryption and authentication processing to a packet transmitted by a computer inside said one network toward another computer outside said one network and comprising:

a first recognition unit for recognizing whether at least one of a source computer and a destination computer of a packet to be transferred is a moving mobile computer which is moving outside its home network;

a second recognition unit for recognizing whether or not there exists a packet processing device which has a packet transmitted by at least one of said source computer and said destination computer as an encryption and authentication processing target; and

a transfer unit for carrying out a prescribed transfer processing including an encryption and authentication processing of a packet to be transferred between said source computer and said destination computer, according to recognition results obtained by the first recognition unit and the second recognition unit.

22. The packet processing device of claim 21, wherein the prescribed transfer processing includes a processing for receiving an input packet and transmitting an output packet in an identical packet format as the input packet or an output packet obtained by converting a packet format of the input packet into another packet format,

the input packet being any one of a non-encrypted packet, a non-encrypted packet which is routed by said mobile computer management device, a packet in which a prescribed communication data is encrypted and to which an end-to-end authentication data for an authentication to be carried out between end nodes involved in a cipher communication is attached, and a packet in which the prescribed communication data is encrypted and the end-to-end authentication data and a link authentication data for an authentication to be carried out between said source computer and a next hop packet processing device are attached.

23. The packet processing device of claim 21, wherein the prescribed transfer processing includes a processing for transferring an input packet in an IP format, an input packet in a mobile IP format, an input packet in an encryption/end-to-end authentication format, or an input packet in an encryption/link authentication format, according to a mobile IP scheme.

24. The packet processing device of claim 21, wherein the transfer unit judges whether a route optimization is possible or not according to the recognition results, and

when it is judged that said packet processing device contributes to the route optimization, the transfer unit carries out a control for the route optimization according to the recognition results.

25. The packet processing device of claim 21, wherein when the first recognition unit recognizes that at least one of said source computer and said destination computer is the moving mobile computer, and the second recognition unit recognizes that said packet processing device has a packet transmitted by said moving mobile computer as an encryption and authentication processing target,

if a first type packet with no link authentication data destined to said packet processing device attached thereto is received from said moving mobile computer, the transfer unit returns a passing refuse message to said moving mobile computer;

if a second type packet with a first type link authentication data destined to said packet processing device attached thereto is received from said moving mobile computer, the transfer unit inspects said first type link authentication data, and if an authenticity of said first type link authentication data is checked, the transfer unit converts said first type link authentication data into a second type link authentication data for a next hop and transfers said second type packet with said second type link authentication data;

if a response message destined to said moving mobile computer is received, the transfer unit inspects the first type link authentication data destined to said packet processing device, and if an authenticity of said first type link authentication data is checked, the transfer unit transfers said response message to said moving mobile computer by removing said first type link authentication data; and

when said packet processing device is located in the home network and if said response message is received from said mobile computer management device, the transfer unit transfers said response message toward said moving mobile computer by encrypting a prescribed communication content and attaching an end-to-end authentication data and said second type link authentication data.

26. The packet processing device of claim 21, wherein when the first recognition unit recognizes that neither one of said source computer and said destination computer is the moving mobile computer, and the second recognition unit recognizes that there exists one packet processing device which has a packet transmitted by said source computer as an encryption and authentication processing target and there exists another packet processing device which has a packet transmitted by said destination computer as an encryption and authentication processing target,

if a non-encrypted packet arrives, the transfer unit transfers said non-encrypted packet by encrypting a prescribed communication content and attaching an end-to-end authentication data;

and

if a packet in which the prescribed communication content is encrypted and to which the end-to-end authentication data is attached arrives, the transfer unit inspects the end-to-end authentication data, and if an authenticity of the end-to-end authentication data is checked, the transfer unit transfers said packet by removing the end-to-end authentication data and decrypting the prescribed communication content.

27. The packet processing device of claim 21, wherein when the first recognition unit recognizes that one computer of said source computer and said destination computer is the moving mobile computer, and the second recognition unit recognizes that there exists a packet processing device which has a packet transmitted by said one computer as an encryption and authentication processing target, and the first recognition unit and the second recognition unit recognize that another computer of said source computer and said destination computer is not simultaneously a computer which is not a moving mobile computer and a computer for which there is no packet processing device which has a packet transmitted by said computer as an encryption and authentication processing target,

the transfer unit carries out said prescribed transfer processing at least according to a packet format of an input packet to be transferred.

28. The packet processing device of claim 27, wherein:

when a non-encrypted packet arrives, the transfer unit transfers said non-encrypted packet by encrypting a prescribed communication content and attaching an end-to-end authentication data; and

when a packet in which the prescribed communication content is encrypted and to which the end-to-end authentication data is attached arrives, the transfer unit inspects the end-to-end authentication data, and if an authenticity of the end-to-end authentication data is checked, the transfer unit transfers said packet by removing the end-to-end authentication data and decrypting the prescribed communication content.

29. The packet processing device of claim 27, wherein:

when a first type packet which has said moving mobile computer as a source, which is the encryption and authentication processing target of said packet processing device, in which a prescribed communication content is encrypted and to which an end-to-end authentication data is attached arrives, the transfer unit transfers said first type packet by attaching a first type link authentication data for a next hop; and

when a second type packet which has said moving mobile computer as a source, in which the prescribed communication content is encrypted and to which the end-to-end authentication data and a second type link authentication data for said packet processing device are attached arrives, the transfer unit inspects said second type link authentication data, and if an authenticity of said second type link authentication data is checked, the transfer unit transfers said second type packet by replacing said second type link authentication data with said first type link authentication data.

30. The packet processing device of claim 27, wherein:

when a packet which has said moving mobile computer as a destination, which is the encryption and authentication processing target of said packet processing device, in which a prescribed communication content is encrypted and to which an end-to-end authentication data and a link authentication data for said packet processing device are attached arrives, the transfer unit inspects said link authentication data, and if an authenticity of said link authentication data is checked, the transfer unit transfers said packet by removing said link authentication data.

31. The packet processing device of claim 27, wherein:

when a packet which has a computer which is not said moving mobile computer as a destination, which is the encryption and authentication processing target of said packet processing device, in which a prescribed communication content is encrypted and to which an end-to-end authentication data for said packet processing device and a link authentication data for said packet processing device are attached arrives, the transfer unit inspects each of said end-to-end authentication data and said link authentication data, and if an authenticity of said end-to-end authentication data and an authenticity of said link authentication data are checked, the transfer unit transfers said packet by removing said end-to-end authentication data and said link authentication data and decrypting the prescribed communication content.

32. The packet processing device of claim 27, wherein when a packet which has said another computer as a destination and said one computer as a source and which is indicated as having been relayed by said mobile computer management device, and the first recognition unit recognizes that said another computer is a moving mobile computer,

if the second recognition unit recognizes that there exists a packet processing device which has a packet transmitted by said another computer as an encryption and authentication processing target, the transfer unit transfers said packet by encrypting a prescribed communication content and attaching an end-to-end authentication data for said another computer and a link authentication data for a next hop node;

and

if the second recognition unit recognizes that there is no packet processing device which has a packet transmitted by said another computer as an encryption and authentication processing target, the transfer unit transfers said packet by encrypting the prescribed communication content and attaching the end-to-end authentication data for said another computer.

33. The packet processing device of claim 21, wherein when a route optimization is requested and it is judged that said packet processing device contributes to the route optimization according to the recognition results, the transfer unit carries out a control for the route optimization according to the recognition results.

34. The packet processing device of claim 21, wherein when the first recognition unit and the second recognition unit recognize that said mobile computer is located outside the home network and a correspondent stationary node of said mobile computer is located inside the home network, and that there exists a packet processing device which has a packet transmitted by said mobile computer as an encryption and authentication processing target and there exists a packet processing device which has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target,

if a first type packet transmitted by said mobile computer at a previous hop in which a prescribed content is encrypted and to which an end-to-end authentication data and a first type link authentication data for the previous hop and said packet processing device are attached arrives, the transfer unit inspects said first type link authentication data, and if an authenticity of said first type link authentication data is checked, the transfer unit transfers said first type packet by replacing said first type link authentication data with a second type link authentication data for a next hop;

if a second type packet for which said mobile computer is a next hop, in which the prescribed communication content is encrypted and to which the end-to-end authentication data and a third type link authentication data are attached arrives, the transfer unit inspects said third type link authentication data, and if an authenticity of said third type link authentication data is checked, the transfer unit transfers said second type packet by removing said third type link authentication data;

if a third type packet other than the second type packet in which the prescribed communication content is encrypted and to which the end-to-end authentication data and the third type link authentication data are attached arrives, the transfer unit inspects each of the end-to-end authentication data and the third type link authentication data, and if an authenticity of the end-to-end authentication data and an authenticity of the third type link authentication data are checked, the transfer unit transfers said third type packet by removing the end-to-end authentication data and the third type link authentication data and decrypting the prescribed communication content; and

if a fourth type packet which is not encrypted and routed by said mobile computer management device arrives, the transfer unit transfers said fourth type packet by encrypting the prescribed communication content and attaching the end-to-end authentication data and the second type link authentication data.

35. The packet processing device of claim 21, wherein when the first recognition unit and the second recognition unit recognize that said mobile computer is located outside the home network and a correspondent stationary node of said mobile computer is located in an identical network as said mobile computer, and that there exists a packet processing device which has a packet transmitted by said mobile computer as an encryption and authentication processing target and there exists a packet processing device which has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target,

if a first type packet which is not encrypted arrives, the transfer unit transfers said first type packet by encrypting a prescribed communication content and attaching an end-to-end authentication data;

if a second type packet in which the prescribed communication content is encrypted and to which the end-to-end authentication data is attached arrives, the transfer unit inspects the end-to-end authentication data, and if an authenticity of the end-to-end authentication data is checked, the transfer unit transfers said second type packet by removing the end-to-end authentication data and decrypting the prescribed communication content;

if a third type packet which is not encrypted and routed by said mobile computer management device arrives, the transfer unit transfers the third type packet by encrypting the prescribed communication content and attaching the end-to-end authentication data and a first type link authentication data for a next hop; and

if a fourth type packet for which said mobile computer is a next hop, in which the prescribed communication content is encrypted and to which the end-to-end authentication data and a second type link authentication data are attached arrives, the transfer unit inspects said second type link authentication data, and if an authenticity of said second type link authentication data is checked, the transfer unit transfers said fourth type packet by removing said second type link authentication data.

36. The packet processing device of claim 21, wherein when the first recognition unit and the second recognition unit recognize that said mobile computer is located outside the home network and a correspondent stationary node of said mobile computer is located in an identical network as said mobile computer, and that there exists a packet processing device which has a packet transmitted by said mobile computer as an encryption and authentication processing target and there exists a packet processing device which has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target, and also an optimization of a data transfer route for said mobile computer is requested and the second recognition unit recognizes that said packet processing device has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target,

if a non-encrypted packet from the correspondent stationary node arrives, the transfer unit converts said non-encrypted packet into a converted packet in an identical format as a packet which is routed by said mobile computer management device, and transfers the converted packet to said mobile computer.

37. The packet processing device of claim 21, wherein when the first recognition unit and the second recognition unit recognize that said mobile computer is located outside the home network and a correspondent stationary node of said mobile computer is located in another network which is neither the home network nor a network at which said mobile computer is located, and that there exists a packet processing device which has a packet transmitted by said mobile computer as an encryption and authentication processing target and there exists a packet processing device which has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target,

if a first type packet which is not encrypted arrives, the transfer unit transfers said first type packet by encrypting a prescribed communication content and attaching an end-to-end authentication data;

if a second type packet in which the prescribed communication content is encrypted and to which the end-to-end authentication data is attached arrives, the transfer unit inspects the end-to-end authentication data, and if an authenticity of the end-to-end authentication data is checked, the transfer unit transfers said second type packet by removing the end-to-end authentication data and decrypting the prescribed communication content;

if a third type packet transmitted by said mobile computer at a previous hop in which the prescribed content is encrypted and to which the end-to-end authentication data and a first type link authentication data for the previous hop and said packet processing device are attached arrives, the transfer unit inspects said first type link authentication data, and if an authenticity of said first type link authentication data is checked, the transfer unit transfers said third type packet by replacing said first type link authentication data with a second type link authentication data for a next hop;

if a fourth type packet for which said mobile computer is a next hop, in which the prescribed communication content is encrypted and to which the end-to-end authentication data and a third type link authentication data are attached arrives, the transfer unit inspects said third type link authentication data, and if an authenticity of said third type link authentication data is checked, the transfer unit transfers said fourth type packet by removing said third type link authentication data;

if a fifth type packet other than the fourth type packet in which the prescribed communication content is encrypted and to which the end-to-end authentication data and the third type link authentication data are attached arrives, the transfer unit inspects each of the end-to-end authentication data and the third type link authentication data, and if an authenticity of the end-to-end authentication data and an authenticity of the third type link authentication data are checked, the transfer unit transfers said fifth type packet by removing the end-to-end authentication data and the third type link authentication data and decrypting the prescribed communication content; and

if a sixth type packet which is not encrypted and routed by said mobile computer management device arrives, the transfer unit transfers said sixth type packet by encrypting the prescribed communication content and attaching the end-to-end authentication data and the second type link authentication data.

38. The packet processing device of claim 21, wherein when the first recognition unit and the second recognition unit recognize that said mobile computer is located outside the home network and a correspondent stationary node of said mobile computer is located in another network which is neither the home network nor a network at which said mobile computer is located, and that there exists a packet processing device which has a packet transmitted by said mobile computer as an encryption and authentication processing target and there exists a packet processing device which has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target, and also an optimization of a data transfer route for said mobile computer is requested and the second recognition unit recognizes that said packet processing device has a packet transmitted by said mobile computer as an encryption and authentication processing target,

if a first type packet transmitted by said mobile computer at a previous hop in which a prescribed content is encrypted and to which an end-to-end authentication data and a first type link authentication data for the previous hop and said packet processing device are attached arrives, the transfer unit inspects said first type link authentication data, and if an authenticity of said first type link authentication data is checked, the transfer unit transfers said third type packet by replacing said first type link authentication data with a second type link authentication data for a next hop;

if a second type packet for which said mobile computer is a next hop, in which the prescribed communication content is encrypted and to which the end-to-end authentication data and a third type link authentication data are attached arrives, the transfer unit inspects said third type link authentication data, and if an authenticity of said third type link authentication data is checked, the transfer unit transfers said fourth type packet by removing said third type link authentication data;

if the second recognition unit recognizes that said packet processing device has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target, and a third type packet for which said correspondent stationary node is a next hop, in which the prescribed communication content is encrypted and to which the end-to-end authentication data and the third type link authentication data are attached arrives, the transfer unit inspects each of the end-to-end authentication data and the third type link authentication data, and if an authenticity of the end-to-end authentication data and an authenticity of the third type link authentication data are checked, the transfer unit transfers said third type packet by removing the end-to-end authentication data and the third type link authentication data and decrypting the prescribed communication content; and

if a fourth type packet transmitted by said correspondent stationary node at a previous hop which is not encrypted arrives, the transfer unit transfers said fourth type packet to said mobile computer by encrypting the prescribed communication content and attaching the end-to-end authentication data and the third type link authentication data.

39. The packet processing device of claim 21, wherein when the first recognition unit and the second recognition unit recognize that said mobile computer is located outside the home network and a correspondent stationary node of said mobile computer is located in an identical network as said mobile computer, and that there is no packet processing device which has a packet transmitted by said mobile computer as an encryption and authentication processing target and there exists a packet processing device which has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target,

if a first type packet in which a prescribed communication content is encrypted and to which an end-to-end authentication data is attached arrives, the transfer unit inspects the end-to-end authentication data, and if an authenticity of the end-to-end authentication data is checked, the transfer unit transfers said first type packet by removing the end-to-end authentication data and decrypting the prescribed communication content;

and

if a second type packet which is not encrypted and routed by said mobile computer management device arrives, the transfer unit transfers said second type packet by encrypting the prescribed communication content and attaching the end-to-end authentication data.

40. The packet processing device of claim 21, wherein when the first recognition unit and the second recognition unit recognize that said mobile computer is located outside the home network and a correspondent stationary node of said mobile computer is located outside the home network, and that there is no packet processing device which has a packet transmitted by said mobile computer as an encryption and authentication processing target and there exists a packet processing device which has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target,

if a first type packet which is not encrypted arrives, the transfer unit transfers said first type packet by encrypting a prescribed communication content and attaching an end-to-end authentication data;

if a second type packet in which the prescribed communication content is encrypted and to which the end-to-end authentication data is attached arrives, the transfer unit inspects the end-to-end authentication data, and if an authenticity of the end-to-end authentication data is checked, the transfer unit transfers said second type packet by removing the end-to-end authentication data and decrypting the prescribed communication content; and

if a third type packet which is not encrypted and routed by said mobile computer management device arrives, the transfer unit transfers said third type packet by encrypting the prescribed communication content and attaching the end-to-end authentication data.

41. The packet processing device of claim 21, wherein when the first recognition unit and the second recognition unit recognize that said mobile computer is located outside the home network and a correspondent stationary node of said mobile computer is located outside the home network, and that there is no packet processing device which has a packet transmitted by said mobile computer as an encryption and authentication processing target and there exists a packet processing device which has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target, and also an optimization of a data transfer route for said mobile computer is requested and the second recognition unit recognizes that said packet processing device has a packet transmitted by said correspondent stationary node as an encryption and authentication processing target,

if a first type packet which is not encrypted arrives, the transfer unit transfers said first type packet by encrypting a prescribed communication content and attaching an end-to-end authentication data;

if a second type packet transmitted by said correspondent stationary node at a previous hop, in which the prescribed communication content is encrypted and to which the end-to-end authentication data is attached arrives, the transfer unit inspects the end-to-end authentication data, and if an authenticity of the end-to-end authentication data is checked, the transfer unit transfers said second type packet to said mobile computer by removing the end-to-end authentication data and decrypting the prescribed communication content.

42. A communication control method at a mobile computer for carrying out communications while moving within a communication system in which a plurality of networks are inter-connected, said plurality of networks including one network at which a packet processing device is provided, said packet processing device having a function for applying an encryption and authentication processing to a packet transmitted by a computer inside said one network toward another computer outside said one network, the method comprising the steps of:

(a) recognizing whether said mobile computer is located inside a home network or outside the home network, the home network being one of said plurality of networks at which a mobile computer management device is provided, the mobile computer management device having a function for managing a mobile location information of said mobile computer and transferring a packet destined to said mobile computer to a current location of said mobile computer;

(b) recognizing whether or not there exists a packet processing device which has a packet transmitted by at least one of said mobile computer and a correspondent computer of said mobile computer as an encryption and authentication processing target; and

(c) carrying out a prescribed communication processing including an encryption and authentication processing of a packet to be transmitted from said mobile computer, according to recognition results obtained by the step (a) and the step (b).

43. A communication control method at a packet processing device to be provided in one network of a communication system in which a plurality of networks are inter-connected, said plurality of networks including a home network at which a mobile computer management device of a mobile computer for carrying out communications while moving within the communication system is provided, the mobile computer management device having a function for managing a mobile location information of said mobile computer and transferring a packet destined to said mobile computer to a current location of said mobile computer, said packet processing device having a function for applying an encryption and authentication processing to a packet transmitted by a computer inside said one network toward another computer outside said one network, the method comprising comprising the steps of:

(a) recognizing whether at least one of a source computer and a destination computer of a packet to be transferred is a moving mobile computer which is moving outside its home network;

(b) recognizing whether or not there exists a packet processing device which has a packet transmitted by at least one of said source computer and said destination computer as an encryption and authentication processing target; and

(c) carrying out a prescribed transfer processing including an encryption and authentication processing of a packet to be transferred between said source computer and said destination computer, according to recognition results obtained by the step (a) and the step (b).

44. An article of manufacture, comprising:

a computer usable medium having computer readable program code means embodied therein for causing a computer to function as a mobile computer for carrying out communications while moving within a communication system in which a plurality of networks are inter-connected, said plurality of networks including one network at which a packet processing device is provided, said packet processing device having a function for applying an encryption and authentication processing to a packet transmitted by a computer inside said one network toward another computer outside said one network, the computer readable program code means including;

first computer readable program code means for causing said computer to recognize whether said mobile computer is located inside a home network or outside the home network, the home network being one of said plurality of networks at which a mobile computer management device is provided, the mobile computer management device having a function for managing a mobile location information of said mobile computer and transferring a packet destined to said mobile computer to a current location of said mobile computer;

second computer readable program code means for causing said computer to recognize whether or not there exists a packet processing device which has a packet transmitted by at least one of said mobile computer and a correspondent computer of said mobile computer as an encryption and authentication processing target; and

third computer readable program code means for causing said computer to carry out a prescribed communication processing including an encryption and authentication processing of a packet to be transmitted from said mobile computer, according to recognition results obtained by the first computer readable program code means and the second computer readable program code means.

45. An article of manufacture, comprising:

a computer usable medium having computer readable program code means embodied therein for causing a computer to function as a packet processing device to be provided in one network of a communication system in which a plurality of networks are inter-connected, said plurality of networks including a home network at which a mobile computer management device of a mobile computer for carrying out communications while moving within the communication system is provided, the mobile computer management device having a function for managing a mobile location information of said mobile computer and transferring a packet destined to said mobile computer to a current location of said mobile computer, said packet processing device having a function for applying an encryption and authentication processing to a packet transmitted by a computer inside said one network toward another computer outside said one network, the computer readable program code means including;

first computer readable program code means for causing said computer to recognize whether at least one of a source computer and a destination computer of a packet to be transferred is a moving mobile computer which is moving outside its home network;

second computer readable program code means for causing said computer to recognize whether or not there exists a packet processing device which has a packet transmitted by at least one of said source computer and said destination computer as an encryption and authentication processing target; and

third computer readable program code means for causing said computer to carry out a prescribed transfer processing including an encryption and authentication processing of a packet to be transferred between said source computer and said destination computer, according to recognition results obtained by the first computer readable program code means and the second computer readable program code means.