Location privacy through IP address space scrambling

• US 7,246,231 B2
• Filed: 10/31/2002
• Issued: 07/17/2007
• Est. Priority Date: 10/31/2002
• Status: Active Grant

• Current Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Original Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Inventors: Jain, Ravi, Kempf, James, Kawahara, Toshiro, Gentry, Craig B., Tariq, Muhammad Mukarram Bin
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): KIM, JUNG W
• Application Number:
  US10/284,739
• Publication Number:
  US 20040088544A1
• Time in Patent Office: 1,720 Days
• Field of Search: 713/160, 713/162, 713/190
• US Class Current: 713/162
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

In a network, a router uses some secret information combined with a cryptographic process in determination of a subnet'"'"'s routing prefix. Several methods are disclosed, including using an IP suffix for prefix generation and for decryption, maintaining a pool of pseudo prefixes at the router, using public key encryption and symmetric key encryption,

Claims

1. A network address assignment method, the method comprising:

at a router of a communication network, establishing a set of pseudo routing prefixes;

selecting a subset of the set of pseudo routing prefixes; and

communicating the subset of pseudo routing prefixes, along with a common routing prefix shared between all routers in the communication network, to hosts of the network,

the hosts using one of the subset of the set of pseudo routing prefixes and the common routing prefix shared between the routers in the network to configure the host network address.

2. The network address assignment method of claim 1 further comprising:

associating a lifetime with each pseudo routing prefix.

3. The network address assignment method of claim 1 further comprising:

removing expired pseudo routing prefixes from the communicated subset of pseudo routing prefixes.

4. The network address assignment method of claim 3 further comprising:

replacing the expired pseudo routing prefixes with other pseudo routing prefixes of the set of pseudo routing prefixes.

5. The network address assignment method of claim 2 wherein communicating the subset of pseudo routing prefixes to hosts comprises communicating information about the lifetime of each pseudo routing prefix.

6. The network address assignment method of claim 1 wherein establishing a set of pseudo routing prefixes at a router comprises:

each pseudo routing prefix in the set is a result of encrypting the router'"'"'s actual routing prefix and a pseudo prefix index number.

7. The network address assignment method of claim 6 wherein a shared key between the routers in the communication network is used for encrypting an actual routing prefix and a pseudo routing prefix index number.

8. The network address assignment method of claim 6 wherein not all the pseudo routing prefixes in the set are pre-computed, but are generated by the router on a per need basis.

9. An apparatus adapted to perform the method of claim 2.

10. An apparatus adapted to perform the method of claim 3.

11. An apparatus adapted to perform the method of claim 4.

12. An apparatus adapted to perform the method of claim 1.

13. An apparatus adapted to perform the method of claim 5.

14. An apparatus adapted to perform the method of claim 6.

15. An apparatus adapted to perform the method of claim 7.

16. An apparatus adapted to perform the method of claim 8.

17. A network address assignment method, the method comprising:

at a router of a communication network, maintaining a public key and a private key;

computing a first stage pseudo routing prefix which is a function of an actual routing prefix of the router; and

advertising the first stage pseudo routing prefix and the common routing prefix shared between all routers on the network,

hosts of the network being configured to encrypt the first stage pseudo routing prefix using the public key of the router and a self-configurable suffix to obtain a pseudo prefix,

the host using the common routing prefix and the pseudo prefix to configure a network address of the host.

19. An apparatus adapted to perform the method of claim 17.

18. A network address assignment method, the method comprising:

at a router of a communication network, maintaining a master key, hosts in network have individual private keys for generating pseudo prefixes, the master key being shared between routers and being configured to decrypt any information encrypted in the communication network using any individual private key of the hosts in the communication network;

at the router, computing a first stage pseudo routing prefix which is a function of an actual routing prefix of the router;

advertising the first stage pseudo routing prefix and a network routing prefix shared by all routers in the communication network,

each host of the network being configured to encrypt the first stage pseudo routing prefix using the private key of the host and a self-configurable suffix of the host to obtain a pseudo prefix,

each host using the common routing prefix and the pseudo routing prefix to configure its network address.

20. An apparatus adapted to perform the method of claim 18.