Mobile ethernet

• US 7,849,217 B2
• Filed: 04/30/2003
• Issued: 12/07/2010
• Est. Priority Date: 04/30/2003
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Meier, Robert C.
• Primary Examiner(s): Nguyen; Quang N.
• Application Number:
  US10/426,429
• Publication Number:
  US 20040221042A1
• Time in Patent Office: 2,778 Days
• Field of Search: 709/204, 709/228, 709/238, 709/245, 709/224, 370/329, 370/389, 370/239
• US Class Current: 709/245
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/4645 Details on frame tagging routing of packets H04L45/00; support for virtual LAN H04L49/354
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 88/182 Network node acting on behalf of an other network entity, e.g. proxy

Abstract

A Mobile Ethernet Protocol that is used to logically extend a “home VLAN”, through an Ethernet/IP “campus network”, to mobile nodes on “foreign subnets”. The network architecture used for Mobile Ethernet is hierarchical and includes a Subnet Context Manager per subnet and a central Campus Context Manager. The protocol is generally based on the standard Mobile IPv4 protocol, but includes significant extensions to standard Mobile IP including using an 802 address as the permanent MN identifier, rather than an IP address, encapsulating and sending Ethernet frames through IP tunnels, and configuring a single Mobile Ethernet HA to provide access to multiple home VLANs wherein Home VLAN bindings for MNs are dynamically established. A MN does not need to be configured with a permanent IP address.

Claims

1. A method for inter subnet mobility on a campus network comprising a plurality of Ethernet subnets inter-connected by Internet Protocol routers, comprising:

logically binding mobile nodes, each having an 802 Media Access Control Address, to a single home subnet by associating the 802 Media Access Control address of each of the mobile nodes with the single home subnet as home subnet bindings;

storing the home subnet bindings in a central context manager wherein the home subnet bindings are accessible throughout the campus network by a home agent and a foreign agent;

maintaining mobility bindings for a first mobile node by the home agent on the home subnet wherein the mobility bindings include an 802 Media Access Control Address of the first mobile node;

dynamically establishing a dynamic shared secret key between the foreign agent and the home agent when the first mobile node first roams to the foreign subnet;

sending a registration message when the first mobile node first roams to the foreign subnet wherein the registration message includes the 802 Media Access Control address of the first mobile node;

sending an Internet Protocol address of a tunnel endpoint on the foreign subnet to the home agent for the home subnet of the first mobile node;

receiving an Ethernet frame for the first mobile node;

determining from the mobility bindings that the first mobile node is on a foreign subnet;

encapsulating the Ethernet frame with an Internet Protocol header addressed to the Internet Protocol address of the tunnel endpoint on the foreign subnet; and

securely sending the encapsulated Ethernet frame using the dynamic shared secret key;

wherein dynamically establishing the dynamic shared secret key further comprises;

authenticating the foreign agent and the home agent with a common context manager;

establishing a separate secret key between the foreign agent and the home agent and the common context manager;

issuing security credentials for a mobile node'"'"'s foreign agent and home agent by the common context manager; and

establishing the dynamic shared secret key between the foreign agent and the home agent via the common context manager, wherein the dynamic shared secret key is used to authenticate messages exchanged by the home agent and the foreign agent.

2. The method of claim 1 wherein the storing step further comprising indexing by 802 Media Access Control addresses.

3. The method of claim 1 wherein the maintaining mobility bindings for a mobile node step further comprises identifying mobility bindings by 802 Media Access Control address, the mobility bindings comprising an Internet Protocol Address of a tunnel endpoint on a foreign subnet where the mobile node is currently located.

4. The method of claim 1 further comprising maintaining mobility bindings for a visiting mobile node by a foreign agent on a foreign subnet, wherein the mobility bindings for a visiting node comprises an Internet Protocol address of the home agent on the mobile node'"'"'s home Access Point (AP) subnet.

5. The method of claim 1 further comprising

intercepting 802 frames transmitted by at least one of the group consisting of a correspondent host and a router on a home subnet by the home agent wherein the destination 802 address is enabled on the mobile node on the foreign subnet;

and

encapsulating the intercepted frames with an Internet Protocol encapsulation header having an Internet Protocol destination address by the home agent;

wherein the Internet Protocol destination address is set to the tunnel endpoint on the foreign subnet via normal Internet Protocol routing.

6. The method of claim 1 further comprising redirecting 802 frames transmitted on the home subnet using standard bridge source learning by the home agent, wherein a unicast 802 address identifies the mobile node on the foreign subnet to the home agent on the mobile node'"'"'s home subnet.

7. The method of claim 1 further comprising

intercepting at least one frame that is a non-Internet Protocol frame transmitted by the mobile node visiting the foreign subnet by the foreign agent;

locating the mobility bindings for the mobile node using the source 802 address of the frame;

encapsulating the non-Internet Protocol frame with an Internet Protocol encapsulation header having a header with a destination address, the destination address being set to the home agent on the mobile node'"'"'s home subnet; and

forwarding the frame using normal Internet Protocol routing.

8. The method of claim 7 wherein the frame is selected from the group consisting of a unicast 802 frame and a multicast 802 frame.

9. The method of claim 1 wherein

the campus network comprises a plurality of Access Points, each Access Point is configured with at least one 802.11 service set identifier, the mobile node is configured with an 802.11 service set identifier that matches at least one the Access Point service set identifier;

each Access Point service set identifier is bound to one of the group consisting of a default home subnet and a home Virtual Local Area Network;

at least one service set identifier has Mobile Ethernet enabled; and

the method further comprising sending at least one message by the mobile node with its service set identifier to a selected parent Access Point.

10. The method of claim 9 further comprising:

receiving a message from the mobile node by an Access Point;

examining the message'"'"'s service set identifier; and

initiating Mobile Ethernet services.

11. The method of claim 9 further comprising binding the mobile node to the home subnet bound to the mobile node'"'"'s Service Set Identifier in the mobile node'"'"'s initial parent Access Point when the mobile node first enters the network.

12. The method of claim 11 further comprising dynamically obtaining an Internet Protocol address for the mobile node that is in the mobile node'"'"'s home subnet using a Dynamic Host Configuration Protocol.

13. The method of claim 12 further comprising binding the mobile node to a local home subnet, wherein layer 2 dynamic host configuration protocol request and reply frames are bridged between the local home subnet and the mobile node by the mobile node'"'"'s parent Access Point.

14. The method of claim 12 further comprising:

binding the mobile node to a remote home subnet;

encapsulating Dynamic Host Configuration Protocol request and reply frames with an Internet Protocol encapsulation header; and

forwarding the Dynamic Host Configuration Protocol request and reply frames between the mobile node and the remote home subnet on an Internet Protocol tunnel that exists between the home agent on the remote home subnet and the tunnel endpoint on the mobile node'"'"'s local foreign subnet.

15. The method of claim 14 further comprising:

examining by the home agent an 802 Media Access Control Address in the body of a broadcast Dynamic Host Control Protocol reply message to determine if the message is destined to the mobile node on the foreign subnet;

locating mobility bindings for the mobile node;

encapsulating the Dynamic Host Control Protocol message with an Internet Protocol encapsulation header; and

forwarding the Dynamic Host Control Protocol message to the tunnel endpoint identified by the Internet Protocol address in the mobile node'"'"'s mobility bindings.

16. The method of claim 9 further comprising a method wherein the default home subnet bound to a single Service Set Identifier varies by location so that home subnets can be localized and so that mobile nodes can be bound to the closest home subnet.

17. The method of claim 16 further comprising discarding the home subnet bindings of the mobile node after a predetermined period of inactivity.

18. The method of claim 17 further comprising roaming to a new subnet by the mobile node and binding the mobile node to a new home subnet.

19. The method of claim 1 wherein the home subnet is a Virtual Local Area Network identified by an integer Virtual Local Area Network Identifier, the home subnet bindings for the mobile node further comprising the Virtual Local Area Network Identifier.

20. The method of claim 19 wherein the home agent provides access to a plurality of home subnet bindings for a mobile node visiting a foreign subnet.

21. The method of claim 1 further comprising:

examining the source Internet Protocol address in a packet selected from the group consisting of an Internet Protocol and Address Resolution Protocol transmitted by the mobile node; and

binding the mobile node to a home subnet that corresponds to the mobile node'"'"'s Internet Protocol address.

22. The method of claim 1 further comprising explicitly assigning the mobile node to the home subnet.

23. The method of claim 1 further comprising:

sending a context request message to the context manager to obtain the home subnet bindings for a mobile node when the mobile node first associates with a parent Access Point; and

returning to the parent Access Point a current home subnet bindings and Mobile Ethernet registration state information for a mobile node in a context response message.

24. The method of claim 23 wherein the context request message comprises default home subnet bindings for the mobile node and the default bindings are established as the current home subnet bindings for the mobile node if the context manager does not have any previous home subnet bindings for the mobile node.

25. The method of claim 1 further comprising:

intercepting a broadcast Address Resolution Protocol message having a target Internet Protocol address by the home agent on the home subnet where the target Internet Protocol address in the Address Resolution Protocol message identifies a mobile node on a foreign subnet;

encapsulating the broadcast Address Resolution Protocol message with an Internet Protocol encapsulation header; and

forwarding the encapsulated Address Resolution Protocol message to an Internet Protocol tunnel endpoint on the foreign subnet.

26. The method of claim 1 further comprising grouping mobile nodes visiting a foreign subnet into at least one isolated broadcast domain wherein layer 2 multicast frames that originate on the home subnet are not received by local stations on a foreign subnet.

27. The method of claim 1 further comprising grouping mobile nodes visiting a foreign subnet into at least one isolated broadcast domain wherein the mobile nodes visiting the foreign subnet do not receive level 2 multicast frames that originate on the foreign subnet.

28. The method of claim 27 further comprising;

encapsulating a multicast frame that originates on the home subnet with a layer 2 encapsulation header containing a broadcast domain identifier; and

forwarding the encapsulated frame on the foreign subnet.

29. The method of claim 1 further comprising:

relaying an Internet Group Management Protocol message sent by the mobile node on the foreign subnet onto a local foreign subnet for the purpose of extending domain of an Internet Protocol multicast group to the local foreign subnet.

30. The method of claim 29 further comprising:

examining the Internet Group Management Protocol message sent by the mobile node to determine a set of Internet Protocol multicast packets to be forwarded to visiting mobile nodes; and

forwarding Internet Protocol multicast packets transmitted on the foreign subnet to mobile nodes visiting the foreign subnet.

31. The method of claim 1 wherein Mobile Ethernet foreign agent logic and Internet Protocol tunnel endpoints are contained in a Mobile Ethernet aware mobile node.

32. The method of claim 31 further comprising isolating the Mobile Ethernet foreign agent logic in a low-level Mobile Ethernet driver module so that Mobile Ethernet is transparent to higher-layer protocol modules.

33. The method of claim 1 wherein the network further comprises a network address translator that enables the mobile node to communicate with external Internet Protocol nodes, the method further comprising:

assigning the mobile node with a non-routable private Internet Protocol address;

encapsulating all Internet Protocol frames transmitted by the mobile node on the foreign subnet; and

forwarding the encapsulated frames to the mobile nodes home subnet;

wherein any frames destined to the mobile node are routed through the network address translator.

34. The method of claim 33 further comprising assigning the same private Internet Protocol address to at least two mobile nodes wherein Mobile Ethernet agents use the 802 Media Access Control address to uniquely identify the mobile nodes.

35. The method of claim 1 wherein the home subnet is a Virtual Local Area Network identified by an integer Virtual Local Area Network Identifier, the home subnet bindings for the mobile node further comprising the Virtual Local Area Network Identifier, the method further comprising relaying frames between the mobile node and the mobile node'"'"'s home Virtual Local Area Network by layer 2 bridging when the mobile node'"'"'s home Virtual Local Area Network is enabled on a Virtual Local Area Network trunk linked to the mobile node'"'"'s parent Access Point;

and relaying frames using Internet Protocol tunneling between the mobile node and the mobile node'"'"'s home Virtual Local Area Network when the mobile node'"'"'s home Virtual Local Area Network is not enabled on a Virtual Local Area Network trunk linked to the mobile node'"'"'s parent Access Point.

36. The method of claim 35 wherein layer 2 bridging is automatically used to access the mobile node'"'"'s home Virtual Local Area Network if the Virtual Local Area Network Identification contained in the mobile node'"'"'s current home subnet bindings matches a Virtual Local Area Network Identification enabled on the trunk link to the mobile node'"'"'s parent Access Point.

37. The method of claim 1 further comprising automatically establishing the home agent for each home subnet via an election protocol and a new home agent is elected if the home agent is lost.

38. The method of claim 37 further comprising registering each home agent for each home subnet with a central context manager.

39. The method of claim 38 further comprising notifying Mobile Ethernet agents on foreign subnets by the central context manager when a new home agent is elected for a home subnet so that foreign agents re-register mobile nodes with the new home agent.

40. A method for inter subnet mobility on a campus network comprising a plurality of Ethernet subnets inter-connected by Internet Protocol routers, the method comprising:

logically binding a mobile node with an 802 Media Access Control Address to a single home subnet by the mobile node'"'"'s 802 Media Access Control address;

storing home subnet bindings in a central context manager wherein the home subnet bindings are accessible throughout the network and indexing by 802 Media Access Control addresses by a home agent and a foreign agent;

maintaining mobility bindings for a mobile node by a home agent on a home subnet wherein the mobility bindings comprise a mobile node'"'"'s 802 Media Access Control address and an Internet Protocol Address of a tunnel endpoint on a foreign subnet where the mobile node is currently located;

dynamically establishing a dynamic shared secret key between the foreign agent and the home agent when the mobile node first roams to the foreign subnet;

sending a registration message when the mobile node first roams to the foreign subnet;

wherein the registration message comprises the 802 Media Access Control address of the mobile node and an Internet Protocol address of a tunnel endpoint on the foreign subnet is sent to the home agent for the mobile node'"'"'s home subnet;

maintaining mobility bindings for a visiting mobile node by a foreign agent on a foreign subnet, wherein the mobility bindings for a visiting node comprises an Internet Protocol address of the home agent on the mobile node'"'"'s home subnet;

intercepting 802 frames transmitted by at least one of the group consisting of a correspondent host and a router on a home subnet by the home agent;

determining from the destination 802 address that the mobile node is on the foreign subnet;

encapsulating the intercepted frames with an Internet Protocol encapsulation header having an Internet Protocol destination address by the home agent, wherein the Internet Protocol destination address is set to the tunnel endpoint on the foreign subnet via normal Internet Protocol routing;

redirecting 802 frames transmitted on the home subnet using standard bridge source learning by the home agent, wherein a unicast 802 address identifies the mobile node on the foreign subnet to the home agent on the mobile node'"'"'s home subnet;

intercepting at least one frame that is selected from the group consisting of a unicast Internet Protocol Frame, a multicast Internet Protocol frame, and a non-Internet Protocol frame transmitted by the mobile node visiting the foreign subnet by the foreign agent;

locating the mobility bindings for the mobile node using the source 802 address of the frame;

encapsulating the non-Internet Protocol frame with an Internet Protocol encapsulation header having a header with a destination address, the destination address being set to the home agent on the mobile node'"'"'s home subnet; and

securely forwarding the frame using the dynamic shared secret key and normal Internet Protocol routing, wherein the frame is selected from the group consisting of a unicast 802 frame and a multicast 802 frame;

wherein dynamically establishing the dynamic shared secret key further comprises;

authenticating the foreign agent and the home agent with a common context manager;

establishing a separate secret key between the foreign agent and the home agent and the common context manager;

issuing security credentials for a mobile node'"'"'s foreign agent and home agent by the common context manager; and

establishing the dynamic shared secret key between the foreign agent and the home agent via the common context manager, wherein the dynamic shared secret key is used to authenticate messages exchanged by the home agent and the foreign agent.

41. A method for a home agent to extend a virtual local area network to a mobile node on a foreign subnet, the steps comprising:

storing mobility bindings for the mobile node on the foreign subnet wherein the mobility bindings comprise a mobile node'"'"'s 802 Media Access Control Address, the mobility bindings identifying a foreign agent on the foreign subnet;

dynamically establishing a dynamic shared secret key between the foreign agent and a home agent when the mobile node first roams to the foreign subnet;

receiving an Ethernet unicast frame from a co-located home agent bridge port;

determining the foreign agent for the mobile node by matching the 802 Media Access Control address of the Ethernet unicast frame with the mobility bindings;

encapsulating the Ethernet unicast frame with internet protocol encapsulation header that is addressed to the foreign agent, whereby an encapsulated frame is formed; and

securely forwarding the encapsulated frame to the foreign agent using the dynamic shared secret key;

wherein dynamically establishing the dynamic shared secret key further comprises;

authenticating the foreign agent and the home agent with a common context manager;

establishing a separate secret key between the foreign agent and the home agent and the common context manager;

issuing security credentials for a mobile node'"'"'s foreign agent and home agent by the common context manager; and

establishing the dynamic shared secret key between the foreign agent and the home agent via the common context manager, wherein the dynamic shared secret key is used to authenticate messages exchanged by the home agent and the foreign agent.

42. The method of claim 41 further comprising indexing the mobility bindings by 802 Media Access Control address.

43. The method of claim 41 wherein the storing step further comprises maintaining a forwarding table with an entry for each mobile node on a foreign subnet that is bound to a local home virtual local area network.

44. The method of claim 43 wherein each forwarding table entry comprises the mobile node'"'"'s 802 Media access control address, the mobile node'"'"'s internet protocol address, and the mobile node'"'"'s home virtual local area network identification.

45. The method of claim 43 wherein the internet protocol encapsulation header comprises a source address, a destination address, at least one protocol port identifiers, and a mapping entity.

46. The method of claim 45 wherein the source address is the home agent address, the destination address is the foreign agent address, the protocol port identifies Mobile Ethernet as the protocol software access point, and the mapping entity is the mobile node virtual local area network identification.

47. The method of claim 46 wherein the virtual local area network identification equals zero for a unicast frame.

48. A home agent, comprising:

a data storage device adapted to store mobility bindings for the mobile node on a foreign subnet wherein the mobility bindings comprise a mobile node'"'"'s 802 Media Access Control Address, the mobility bindings identifying a foreign agent on the foreign subnet;

means for dynamically establishing a dynamic shared secret key between the foreign agent and a home agent when the mobile node first roams to the foreign subnet;

means for receiving an Ethernet unicast frame from a co-located home agent bridge port;

means for determining the foreign agent for the mobile node by matching the 802 Media Access Control address of the Ethernet unicast frame with the mobility bindings;

means for encapsulating the Ethernet unicast frame with internet protocol encapsulation header addressed to the foreign agent, whereby an encapsulated frame is formed; and

means for securely forwarding the encapsulated frame to the foreign agent using the dynamic shared secret key;

wherein dynamically establishing the dynamic shared secret key further comprises;

authenticating the foreign agent and the home agent with a common context manager;

establishing a separate secret key between the foreign agent and the home agent and the common context manager;

issuing security credentials for a mobile node'"'"'s foreign agent and home agent by the common context manager; and

establishing the dynamic shared secret key between the foreign agent and the home agent via the common context manager, wherein the dynamic shared secret key is used to authenticate messages exchanged by the home agent and the foreign agent.

49. The home agent of claim 48, the further comprising means for indexing the mobility bindings by 802 Media Access Control address.

50. The home agent of claim 48 wherein the data storage device further comprising means for maintaining a forwarding table with an entry for each mobile node on a foreign subnet that is bound to a local home virtual local area network.

51. The home agent of claim 50 wherein each forwarding table entry comprises the mobile node'"'"'s 802 Media access control address, the mobile node'"'"'s internet protocol address, and the mobile node'"'"'s home virtual local area network identification.

52. The home agent of claim 50 wherein the internet protocol encapsulation header comprises a source address, a destination address, at least one protocol port identifiers, and a mapping entity.

53. The home agent of claim 52 wherein the source address is the home agent address, the destination address is the foreign agent address, the protocol port identifies Mobile Ethernet as the software access point, and the mapping entity is the mobile node virtual local area network identification.

54. The home agent of claim 53 wherein the virtual local area network identification equals zero for a unicast frame.

55. A method for a foreign agent to extend a virtual local area network, the steps comprising:

automatically receiving a dynamic shared secret key between the foreign agent and a home agent dynamically generated when a mobile node first roams to a foreign subnet;

receiving an encapsulated frame for the mobile node, the encapsulated frame comprising an internet protocol encapsulation header and a unicast frame;

removing the internet protocol encapsulation header;

adding a mobile Ethernet data-link encapsulation header having a destination Ethernet address forming an encapsulated unicast Ethernet frame; and

securely forwarding the encapsulated unicast Ethernet frame to a parent access point for the mobile node using the dynamic shared secret key;

wherein the destination Ethernet address is the Ethernet address of the mobile node'"'"'s parent Access Point;

wherein dynamically generating the dynamic shared secret key further comprises;

authenticating the foreign agent and the home agent with a common context manager;

establishing a separate secret key between the foreign agent and the home agent and the common context manager;

issuing security credentials for a mobile node'"'"'s foreign agent and home agent by the common context manager; and

establishing the dynamic shared secret key between the foreign agent and the home agent via the common context manager, wherein the dynamic shared secret key is used to authenticate messages exchanged by the home agent and the foreign agent.

56. A foreign agent component, comprising:

means for establishing mobility bindings for a mobile node with the Foreign Agent and the mobile node'"'"'s parent Access Point, wherein Access Point mobility bindings include the Internet Protocol address of the mobile node'"'"'s Home Agent and the mobile node'"'"'s 802 Media Access Control Address;

a data storage device adapted to store the mobility bindings;

means for automatically receiving a dynamic shared secret key between the foreign agent and a home agent dynamically generated when the mobile node first roams to a foreign subnet;

means for receiving a non-Internet Protocol frame from a foreign mobile node;

means for determining the Internet Protocol address of the mobile node'"'"'s Home Agent for the foreign mobile node based on the 802 Media Access Control address of the mobile node from the means for establishing the mobility bindings;

means for adding an Internet Protocol encapsulation header having a destination address to the non-Internet Protocol frame; and

means for securely forwarding the encapsulated packet to the mobile node'"'"'s Home Agent using the dynamic shared secret key;

wherein the destination address is Internet Protocol address of Home Agent;

wherein dynamically generating the dynamic shared secret key further comprises;

authenticating the foreign agent and the home agent with a common context manager;

establishing a separate secret key between the foreign agent and the home agent and the common context manager;

issuing security credentials for a mobile node'"'"'s foreign agent and home agent by the common context manager; and

establishing the dynamic shared secret key between the foreign agent and the home agent via the common context manager, wherein the dynamic shared secret key is used to authenticate messages exchanged by the home agent and the foreign agent.

57. A method for a home agent to route a frame from a mobile node on a foreign agent to a home virtual local area network, comprising:

dynamically establishing a dynamic shared secret key between the foreign agent and a home agent when the mobile node first roams to a foreign subnet;

receiving an encapsulated packet, the packet comprising an Internet Protocol header and a non-Internet Protocol frame;

authenticating the encapsulated packet using the dynamic shared secret key;

removing the Internet Protocol encapsulation header;

forwarding the frame to a co-located Home Agent Bridge Port;

determining a home Virtual Local Area Network for the source Ethernet address of the Mobile Node from its mobility bindings by the Home Agent Bridge Port;

adding a Virtual Local Area Network tag by the Home Agent Bridge Port; and

securely forwarding the frame onto the mobile node'"'"'s home Virtual Local Area Network using the dynamic shared secret key;

wherein dynamically generating the dynamic shared secret key further comprises;

authenticating the foreign agent and the home agent with a common context manager;

establishing a separate secret key between the foreign agent and the home agent and the common context manager;

issuing security credentials for a mobile node'"'"'s foreign agent and home agent by the common context manager; and

establishing the dynamic shared secret key between the foreign agent and the home agent via the common context manager, wherein the dynamic shared secret key is used to authenticate messages exchanged by the home agent and the foreign agent.