IP address ownership verification mechanism

• US 7,155,500 B2
• Filed: 03/06/2002
• Issued: 12/26/2006
• Est. Priority Date: 03/16/2001
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Nikander, Pekka
• Primary Examiner(s): Prieto, Beatriz
• Application Number:
  US10/091,288
• Publication Number:
  US 20020133607A1
• Time in Patent Office: 1,756 Days
• Field of Search: 709/223, 370/395.32, 711/216, 379/142.05, 386/23, 386/229, 455/411, 706/67, 713/155, 713171-176, 726/26
• US Class Current: 709/223
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A method of verifying that a host coupled to an IP network is authorised to use an IP address which the host claims to own, the IP address comprising a routing prefix and an interface identifier part. The method comprises receiving from the host one or more components, applying a one-way coding function to the or each component and/or derivatives of the or each component, and comparing the result or a derivative of the result against the interface identifier part of the IP address. If the result or its derivative matches the interface identifier the host is assumed to be authorised to use the IP address and if the result or its derivative does not match the interface identifier the host is assumed not to be authorised to use the IP address.

Claims

1. A method of operating an IP network comprising:

receiving one or more components from a host coupled to the IP network, the host having an IP address, the IP address comprising a routing prefix and an interface identifier part;

applying a one-way coding function to the or each component and/or derivatives of the or each component;

comparing a result or a derivative of the result against the interface identifier part of the IP address; and

asserting that the host is authorized to use the IP address which the host claims to own.

2. A method according to claim 1, wherein said components comprise a hash value being one of a sequence of related hash values.

3. A method according to claim 2, wherein said components comprise a counter value which identifies the position of the received hash value in said sequence.

4. A method according to claim 2, wherein said series of hash values are derived at the host by applying a one-way coding function to a seed value and a public key or a digest of the public key.

5. A method according to claim 2, wherein said series of hash values are derived at the host by applying a one-way coding function to a seed and an initial interface identifier.

6. A method according to claim 2, wherein said series of hash values are derived at the host by applying a one-way coding function to a seed, a public key or a digest of the public key, and an initial interface identifier.

7. A method according to claim 2, and comprising deriving a hash value from the received hash value to provide a derivative to which the one-way coding function is applied, the derived hash value being the last hash value in the sequence.

8. A method according to claim 7, wherein in the event of a first IP address verification, the hash value received from the host is the hash value preceding the final hash value in the sequence and for each subsequent verification process, the next previous hash value must be received.

9. A method according to claim 1, wherein said components comprise a public key or a digest of a public key generated by said host or obtained by said host from another authorised party or a fixed bit sequence of the same length.

10. A method according to claim 1, wherein said components comprise an initial interface identifier which corresponds to or is derived from a link layer address of the host, or a fixed bit sequence of the same length.

11. A method according to claim 1, wherein said components comprise an initial interface identifier which corresponds to or is derived from a link layer address of the host, or a zero bit sequence of the same length.

12. A method of verifying that a host coupled to an IP network is authorised to use an IP address which the host claims to own, and that the host is able to receive data packets sent to that address, the method comprising:

carrying out the method of claim 1 to confirm that said host is authorised to use the IP address;

sending a challenge to the host using said IP address as the destination address for the challenge;

receiving a response from the host; and

verifying that the received response is a correct response to the challenge.

13. A method according to claim 12, wherein said challenge is a randomly generated number and the response comprises the challenge.

14. A method according to claim 12, wherein said challenge comprises said IP address concatenated with a randomly generated number, and the response comprises the IP address concatenated with the challenge.

15. A method according to claim 12, wherein said challenge is formed by applying a one-way coding function to said IP address concatenated with a randomly generated number, and the response is formed by applying a one-way coding function to the IP address concatenated with the challenge.