Mobility access gateway

• US 7,562,393 B2
• Filed: 10/20/2003
• Issued: 07/14/2009
• Est. Priority Date: 10/21/2002
• Status: Expired due to Fees

• Current Assignee: Piece Future Pte., Ltd.
• Original Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Inventors: Buddhikot, Milind M., Miller, Scott C., Salgarelli, Luca, Han, Seung-Jae, Lee, Yui-Wah, Chandranmenon, Girish P.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Wyszynski; Aubrey H
• Application Number:
  US10/689,363
• Publication Number:
  US 20050102529A1
• Time in Patent Office: 2,094 Days
• Field of Search: 726/13, 713/153
• US Class Current: 726/26
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

A gateway for mobile access includes a foreign agent that receives user profile data and session state data from a home authentication, authorization and accounting (AAA) system of a mobile node, and a dynamic packet filter that performs multi-layer filtering based on the user profile data. The foreign agent transfers a session from a first network to a second network without session interruption, using the session state data, when the mobile node moves from the first network to the second network. The packet filter permits Internet access by the mobile node without passing Internet data requested by the mobile node through the first network.

Claims

1. A gateway for mobile access, comprising;

a foreign agent that receives user profile data and session state data from a home authentication, authorization and accounting (AAA) system of a mobile node;

at least one dynamic packet filter that performs multi-layer filtering based on the user profile data;

wherein the foreign agent transfers a session from a first network to a second network without session interruption, using the session state data, when the mobile node moves from the first network to the second network, and

the foreign agent uses the dynamic packet filter to permit Internet access by the mobile node without passing Internet data requested by the mobile node through a network in which the home AAA system is located.

2. The gateway of claim 1, further comprising a MAC-address-based filter which blocks packets except for authentication packets that are used to authenticate mobile nodes.

3. The gateway of claim 1, wherein the dynamic packet filter performs network layer filtering and one of the group consisting of transport layer filtering and application layer filtering.

4. The gateway of claim 1, further comprising a non-volatile storage device in which the user profile data are stored.

5. The gateway of claim 1, wherein the non-volatile storage device has a database that stores state information for each active user session.

6. The gateway of claim 1, wherein the gateway is coupled to at least one access point, and the gateway transmits from a AAA server in the gateway to the access point an identification of whether a mobile node in communication with the access point is successfully authenticated by the AAA server.

7. The gateway of claim 1, wherein the gateway exchanges AAA data with the home AAA system of the mobile node by way of the Internet, and the gateway provides Internet access to the mobile node without passing Internet data requested by the mobile node through the network of the home AAA system.

8. The gateway of claim 7, wherein the gateway relays remote authentication dial-in user service packets to the home AAA system.

9. The gateway of claim 1, wherein the foreign agent communicates with the home AAA system of the mobile node, and the foreign agent is capable of operating in a relay mode, in which the foreign agent forwards packets to the home AAA system of the mobile IP node for authentication, or in a standalone mode, in which authentication computations for the simple IP mobile node are performed in the gateway.

10. The gateway of claim 1, wherein the user profile data include per-user policies dynamically obtained from the home AAA system of the mobile node and the dynamic packet filter is included in a firewall that uses packet filtering rules that depend on the per-user policies.

11. The gateway of claim 10, wherein the firewall includes rules that check a media access control address associated with each received packet.

12. The gateway of claim 1, further comprising an 802.11 access point contained within or attached to a housing of the gateway.

13. The gateway of claim 1, further comprising a wireless modem contained within or attached to a housing of the gateway.

14. The gateway of claim 1, further comprising:

an 802.11 access point contained within or attached to a housing of the gateway; and

a wireless modem contained within or attached to a housing of the gateway.

15. A gateway for mobile access, comprising:

a foreign agent that receives user profile data from a home authentication, authorization and accounting (AAA) system of a client, when the client establishes a session with the gateway;

a dynamic packet filter that performs multi-layer filtering based on the user profile data;

an access point contained within or attached to a housing of the gateway, for communication between the gateway and the client; and

a wireless modem contained within or attached to a housing of the gateway, wherein the gateway is mobile, and the modem permits wireless communication between the gateway and a wireless network.

16. The gateway of claim 15, wherein the gateway provides Internet access to the client without passing Internet data requested by the client through a network containing the home AAA system of the client.

17. The gateway of claim 15, wherein the foreign agent is capable of obtaining a new IP address when the gateway moves from a first network to a second network.

18. The gateway of claim 16, wherein, the foreign agent is capable of advertising the new IP address to the client.

19. The gateway of claim 15, wherein the dynamic packet filter performs network layer filtering and one of the group consisting of transport layer filtering and application layer filtering.

20. The gateway of claim 15, further comprising a non-volatile storage device that stores the session state data, and means for transmitting the stored session state data to the client if the client loses a connection with the gateway and resumes the connection with the gateway.

21. A computer readable medium encoded with computer program code, wherein, when the code is executed by a processor, the processor performs a method for controlling mobile access, comprising the steps of:

filtering incoming packets based on a media access control address of each packet;

obtaining user profile data of a mobile IP node from a home authentication, authorization and accounting (AAA) server of a mobile IP node, to determine whether the mobile IP node is registered to access a network by way of a gateway;

performing multi-layer filtering based on the user profile data;

transferring a session from a first network to a second network in which the mobile IP node is located without session interruption when the mobile node moves to the second network; and

providing Internet access to the mobile IP node without passing Internet data requested by the mobile IP node through a network in which the home AAA server is located.