Techniques for hiding network element names and addresses

• US 8,127,016 B2
• Filed: 10/10/2001
• Issued: 02/28/2012
• Est. Priority Date: 10/10/2000
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Westman, Ilkka, Faccin, Stefano, Kauppinen, Risto
• Primary Examiner(s): NGUYEN, THU HA T
• Application Number:
  US10/398,867
• Publication Number:
  US 20060155871A1
• Time in Patent Office: 3,793 Days
• Field of Search: 709/236, 709/200, 709/203, 709/227, 709/228, 709/229, 370/469, 370/349, 370/352, 370/355, 370/356
• US Class Current: 709/227
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/301 Name conversion
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

A technique for hiding network element names and addresses in communications between first and second networks includes providing a message generated by a network entity in the first network to be delivered to a target network entity in the second network, the messaging including first and second parts. The message generated by the network entity in the first network is routed to a contact point disposed between the first and second networks in accordance with the first part of the message and the message generated by the network entity in the first network is routed from the contact point to the target network entity in the second network in accordance with the second part of the message.

Claims

1. A method, comprising:

hiding at least one of network element names and addresses in communications between first and second networks, the hiding comprising

providing a message generated by a network entity in the first network to be delivered to a target network entity in the second network, the message comprising first and second parts, wherein at least one of a network address and a name of said second network is hidden with respect to the first network but is identifiable by a contact point associated with the second network, wherein the second network is configured to receive and route the message via the contact point, wherein the first part of the message comprises a first name usable for routing external to the second network and wherein the second part of the message comprises a second name usable for routing only within the second network;

routing the message generated by the network entity in the first network to a contact point disposed between the first and second networks in accordance with the first part of the message; and

routing the message generated by the network entity in the first network from the contact point to the target network entity in the second network in accordance with the second part of the message.

2. The method of claim 1, wherein the first part of the message comprises a name resolvable external to the second network to a first address of the contact point and wherein the second part of the message comprises the name resolvable only within the second network to a second address of the target network entity.

3. The method of claim 2, further comprising:

providing a domain name system for resolving a name to an address.

4. The method of claim 2, further comprising:

providing a public domain name system infrastructure for resolving a name to an address of the contact point.

5. The method of claim 2, further comprising:

providing one of a dedicated or an internal domain name system infrastructure for resolving a name to an address of a network entity in the second network.

6. The method of claim 1, wherein the first part of the message comprises a name that is encrypted and resolvable external to the second network to a first address of the contact point and wherein the second part of the message comprises the encrypted name resolvable only within the second network to a second address of the target network entity.

7. The method of claim 6, wherein the name is decoded before usage in the second network.

8. The method of claim 1, wherein the contact point comprises one of an interrogating call state control function or proxy-call state control function or a breakout gateway control function.

9. The method of any of claim 1-5 and 6-8, wherein the name comprises a logical name and the address comprises an internet protocol address.

10. The method of claim 1, wherein the name comprises a hostname and/or fully qualified domain name.

11. The method of claim 1, further comprising:

providing internet protocol multimedia core network subsystem networks as the first and second networks.

12. The method of claim 1, where the second name is encrypted by the contact point of the second network with respect to an outgoing message.

13. The method of claim 1, where the second name is decrypted by the contact point of the second network before use.

14. The method of claim 1, where the second name is encrypted, and where the encrypted name is not utilized outside the second network, nor is it utilized within the second network.

15. The method of claim 1, where the first network is configured to provide the message using at least one of a contact point name and contact point address of the contact point associated with the second network.

16. The method of claim 15, wherein the second name is encrypted.

17. A system comprising:

a first network including a network entity disposed therein;

a second network including a target network entity disposed therein; and

a contact point disposed between said first and second networks, wherein at least one of a network address and a name of said second network is hidden with respect to the first network but is identifiable by a contact point associated with the second network, wherein the second network is configured to receive and route the message via the contact point;

wherein, upon said network entity generating a message comprising first and second parts to be delivered to said target network entity, said message is routed to said contact point in accordance with said first part of said message and then routed from said contact point to said target network entity in accordance with said second part of said message,

wherein the first part of the message comprises a first name usable for routing external to the second network and wherein the second part of the message comprises a second name usable for routing only within the second network, wherein said first name comprises a name resolvable external to the second network to an address of said contact point and wherein said second name comprises said name resolvable only within said second network to an address of said target network entity, wherein said second name is encrypted.

18. The system of claim 17, wherein the second name is encrypted.

19. An apparatus, comprising:

receiving means for receiving a message generated by a network entity in a first network of a system including the first network having the network entity disposed therein and a second network including a target network entity disposed therein, wherein at least one of a network address and a name of said second network is hidden with respect to the first network but is identifiable by a contact point associated with the second network, wherein the second network is configured to receive and route the message via the contact point, the apparatus being disposed between said first and second networks; and

routing means for routing the message generated by the network entity in the first network to the target network entity in the second network in accordance with the second part of the message,

wherein, the network entity in the first network is configured to generate a message having first and second parts to the target network entity in the second network, the message being routed to the contact point in accordance with the first part of the message, the first part of the message comprises a first name usable for routing external to the second network and wherein the second part of the message comprises a second name usable for routing only within the second network.

20. The apparatus of claim 19, wherein the apparatus comprises one of an interrogating call state control function or proxy-call state control function or a breakout gateway control function.

21. The apparatus of claim 19, wherein the apparatus is configured to resolve a name to address by contacting a domain name system.

22. The apparatus of claim 19, wherein the apparatus is configured to resolve a name to address by contacting one of a dedicated or internal domain name system infrastructure.

23. The apparatus of claim 19, wherein the second name is encrypted.

24. An apparatus, comprising:

a receiver configured to receive a message generated by a network entity in a first network of a system having the first network having the network entity disposed therein and a second network including a target network entity disposed therein, the apparatus being disposed between said first and second networks, the message having first and second parts and being routed to the apparatus in accordance with the first part of the message, wherein at least one of a network address and a name of said second network is hidden with respect to the first network but is identifiable by the apparatus, wherein the second network is configured to receive and route the message via the apparatus, wherein the first part of the message comprises a first name usable for routing external to the second network and wherein the second part of the message comprises a second name usable for routing only within the second network; and

a router configured to route the message generated by the network entity in the first network to the target network entity in the second network in accordance with the second part of the message.

25. The apparatus of claim 24, wherein the first part of the message comprises a name usable for routing unmodified external to the second network and wherein the second part of the message comprises a modified version of the name usable for routing only within the second network.

26. The apparatus of claim 24, wherein the first part of the message comprises a name that is encrypted and resolvable external to the second network to a first address of the contact point and wherein the second part of the message comprises the encrypted name resolvable only within the second network to a second address of the target network entity.

27. The apparatus of claim 24, wherein the first and second networks comprise interne protocol multimedia core network subsystem networks.

28. The apparatus of claim 24, wherein the second name is encrypted.