Method and mobile node for packet transmission in mobile internet protocol network

• US 8,015,603 B2
• Filed: 09/14/2007
• Issued: 09/06/2011
• Est. Priority Date: 03/15/2005
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Zhang, Hongke, Ren, Yan, Su, Wei, Wang, Jianglin, Zheng, Zuzhou, Qin, Yajuan, Gao, Shuai, Zhang, Sidong, Yang, Shen, Liu, Ying, Miao, Fuyou
• Primary Examiner(s): Flynn; Nathan
• Assistant Examiner(s): KOSOWSKI, CAROLYN M
• Application Number:
  US11/855,696
• Publication Number:
  US 20080069009A1
• Time in Patent Office: 1,453 Days
• Field of Search: 726/11, 726 13- 14, 709/238, 713153-154, 713/151
• US Class Current: 726/14
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 80/045 involving different protocol versions, e.g. MIPv4 and MIPv6
• CPC Class Codes: H04W 80/06 Transport layer protocols, e.g. TCP [Transport Control Protocol] over wireless transmission control protocol/Internet protocol [TCP/IP] or user datagram protocol [UDP] H04L69/16

Abstract

A method for packet transmission in an MIP network is disclosed. A mobile node sends to a Home Agent (HA) a first Firewall Detection (FD) packet encapsulated with IP security (IPsec) protocol and a second FD packet encapsulated with the IPsec protocol and User Datagram Payload (UDP) protocol. The mobile node determines whether there is a firewall blocking an IPsec packet between the mobile node and the HA according to a Firewall Detection Reply (FDR) packet from the HA. If there is a firewall, packets are encapsulated with the UDP protocol and binding update and packet exchange are performed; otherwise, binding update and packet exchange are performed. A mobile node for packet transmission is also provided. Embodiments of the present invention enables the mobile node to exchange a packet with a correspondent node when there is a firewall not supporting the IPsec protocol between the mobile node and the HA.

Claims

1. A method for packet transmission in a Mobile Internet Protocol (MIP) network, comprising:

sending, by a mobile terminal apparatus to a Home Agent (HA), a first Firewall Detection (FD) packet encapsulated with IP security (IPsec) protocol and a second FD packet encapsulated with IPsec protocol and User Datagram Payload (UDP) protocol;

determining whether there is a firewall blocking an IPsec packet between the mobile terminal apparatus and the HA by way of determining whether a Firewall Detection Reply (FDR) packet received from the HA corresponds to the first FD packet encapsulated with the IPsec protocol or the second FD packet encapsulated with the IPsec protocol and the UDP protocol, wherein said determining whether there is a firewall blocking the IPsec packet comprises;

determining that there is no firewall blocking the IPsec packet when the FDR packet received corresponds to the first FD packet; and

determining that there is the firewall blocking the IPsec packet when the FDR packet received corresponds to the second FD packet;

encapsulating packets with the UDP protocol and performing binding update and packet exchange if there is the firewall blocking the IPsec packet; and

performing binding update and packet exchange if there is no firewall blocking the IPsec packet.

2. The method of claim 1, wherein the FDR packet sent to the mobile terminal apparatus contains a cookie which is identical with a cookie contained in the first FD packet or in the second FD packet.

3. The method of claim 2, further comprising:

parsing the FDR packet and extracting the cookie contained in the FDR packet;

wherein

the FDR packet corresponds to the first FD packet when the cookie contained in the FDR packet is identical with the cookie contained in the first FD packet; and

the FDR packet corresponds to the second FD packet when the cookie contained in the FDR packet is identical with the cookie contained in the second FD packet.

4. The method of claim 1, further comprising:

when receiving no FDR packet, terminating the packet transmission when the number of re-transmission times for the first FD packet and the second FD packet exceeds a maximum number of re-transmission times; and

adding 1 to the number of re-transmission times and sending the first FD packet and the second FD packet once more when the number of re-transmission times does not exceed the maximum number of re-transmission times.

5. The method of claim 1, wherein the second FD packet comprises:

a UDP field for containing a UDP port number of the second FD packet;

the FDR packet corresponding to the second FD packet comprises;

a UDP field for containing a UDP port number of the FDR packet corresponding to the second FD packet.

6. The method of claim 5, wherein said encapsulating packets with the UDP protocol comprises:

storing information into the UDP field, and adding the UDP field into the second FD packet, wherein the information is in a Transfer Control Protocol (TCP)/User Datagram Payload (UDP) protocol field in the second FD packet and is not encrypted.

7. A mobile terminal apparatus for packet transmission, comprising:

a first module configured to send a first Firewall Detection (FD) packet encapsulated with IP security (IPsec) protocol and a second FD packet encapsulated with IPsec protocol and User Datagram Payload (UDP) protocol to a Home Agent (HA);

a second module configured to determine whether there is a firewall blocking an IPsec packet by way of determining whether a Firewall Detection Reply (FDR) packet received from the HA corresponds to the first FD packet encapsulated with the IPsec protocol or the second FD packet encapsulated with the IPsec protocol and the UDP protocol,

wherein the second module comprises;

a sub-module configured to determine that there is no firewall blocking the IPsec packet when determining that the FDR packet received corresponds to the first FD packet; and

a sub-module configured to determine that there is the firewall blocking the IPsec packet when determining that the FDR packet received corresponds to the second FD packet;

a third module configured to encapsulate packets with the UDP protocol and perform binding update and packet exchange when the second module determines that there is the firewall blocking the IPsec packet; and

a fourth module configured to perform binding update and packet exchange when the second module determines that there is no firewall blocking the IPsec packet.

8. The mobile terminal apparatus of claim 7, further comprising:

a fifth module configured to determine whether the number of re-transmission times for the first FD packet and the second FD packet exceeds a maximum number of re-transmission times;

a sixth module configured to terminate the packet transmission when the fifth module determines that the number of re-transmission times exceeds the maximum number of re-transmission times; and

a seventh module configured to add 1 to the number of re-transmission times and notify the first module to send the first FD packet and the second FD packet once more when the fifth module determines that the number of re-transmission times does not exceed the maximum number of re-transmission times.

9. A Mobile Internet Protocol (MIP) system, the system comprising at least one mobile terminal apparatus configured to:

send a first Firewall Detection (FD) packet encapsulated with IP security (IPsec) protocol and a second FD packet encapsulated with IPsec protocol and User Datagram Payload (UDP) protocol to a Home Agent (HA);

determine whether there is a firewall blocking an IPsec packet by way of determining whether a Firewall Detection Reply (FDR) packet received from the HA corresponds to the first FD packet encapsulated with the IPsec protocol or the second FD packet encapsulated with the IPsec protocol and the UDP protocol; and

determining that there is no firewall blocking the IPsec packet when the FDR packet received corresponds to the first FD packet; and

determining that there is the firewall blocking the IPsec packet when the FDR packet received corresponds to the second FD packet;

encapsulate packets with the UDP protocol and performing binding update and packet exchange when there is the firewall blocking the IPsec packet; and

perform binding update and packet exchange when there is no firewall blocking the IPsec packet.

10. The MIP system of claim 9, wherein the at least one mobile terminal apparatus is further configured to:

determine whether the number of re-transmission times for the first FD packet and the second FD packet exceeds a maximum number of re-transmission times;

terminate the packet transmission when the number of re-transmission times exceeds the maximum number of re-transmission times; and

add 1 to the number of re-transmission times and send the first FD packet and the second FD packet once more when the number of re-transmission times does not exceed the maximum number of re-transmission times.