Routing advertisement authentication in fast router discovery

• US 8,230,221 B2
• Filed: 07/28/2006
• Issued: 07/24/2012
• Est. Priority Date: 08/15/2005
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Haddad, Wassim, Krishnan, Suresh
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US11/494,547
• Publication Number:
  US 20070036119A1
• Time in Patent Office: 2,188 Days
• Field of Search: 713/170
• US Class Current: 713/170
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

A method and a Mobile Node are provided for authenticating an Advertisement message received from an Access Router through an Access Point. The Advertisement message comprises a Hashed Nonce Value and a Nonce Index corresponding to a Nonce Value held in the Access Router. Upon receiving the Advertisement message from the Access Point, the Mobile Node initiates a process for configuring an IP address, by use of information received in the Advertisement, for having a session with the Access Point and the Access Router. In parallel, either the Access Point or the Mobile Node sends the Nonce Index directly to the Access Router. The Access Router replies with the Nonce Value sent to the Mobile Node. The Mobile Node hashes the Nonce Value received from the Access Router and compares a Result of the hashing with the Hashed Nonce Value. If the Result matches the Hashed Nonce Value, the Advertisement is considered authenticated and the IP address configured according to the Advertisement is kept in the Mobile Node.

Claims

1. A method of authenticating in a Mobile Node a first Advertisement received from an Access Point, the method comprising the steps of:

receiving at the Mobile Node from the Access Point the first Advertisement comprising a first Network Prefix, a Nonce Index and a first Hashed Nonce Value;

configuring at the Mobile Node a first IP address by use of the first Network Prefix, and concurrently authenticating the first Advertisement by;

receiving at the Mobile Node from an Access Router a second Advertisement, the second Advertisement comprising a Nonce Value corresponding to the Nonce Index and a second Network Prefix;

hashing at the Mobile Node the Nonce Value to calculate a second Hashed Nonce Value; and

comparing at the Mobile Node the first Hashed Nonce Value and the second Hashed Nonce Value; and

keeping at the Mobile Node the first IP address if the first Hashed Nonce Value is equal to the second Hashed Nonce Value.

2. The method of claim 1, further comprising the steps of:

if the first Hashed Nonce Value is not equal to the second Hashed Nonce Value, dropping at the Mobile Node a content of the first Advertisement; and

configuring at the Mobile Node a second IP address by use of the second Network Prefix contained in the second Advertisement.

3. The method of claim 1, wherein:

at least one of the first and second Advertisement further comprises a Public Key of the Access Router.

4. The method of claim 3, further comprising the steps of:

verifying at the Mobile Node the second Advertisement by use of the Public Key of the Access Router; and

if the verification of the second Advertisement fails;

sending from the Mobile Node towards the Access Router a Solicitation; and

waiting at the Mobile Node for a Periodic Advertisement.

5. The method of claim 1, wherein:

the second Advertisement is Unicast.

6. The method of claim 1, further comprising the step of:

receiving at the Mobile Node Periodic Advertisements.

7. The method of claim 1, wherein:

authenticating the first Advertisement further comprises the step of, responsive to receiving at the Mobile Node the first Advertisement, sending from the Mobile Node towards the Access Router a Solicitation comprising the Nonce Index.

8. The method of claim 7, wherein:

the Solicitation is signed with a Private Key of the Mobile Node.

9. The method of claim 1, wherein:

the first Advertisement is sent in parallel to an Association Response sent by the Access Point.

10. The method of claim 9, wherein:

the Association Response is sent in response to an Association Request sent by the Mobile Node towards the Access Point.

11. The method of claim 1, further comprising the step of after the step of keeping at the Mobile Node the first IP address, starting at the Mobile Node Data Packet Exchange.

12. The method of claim 1, wherein:

configuring at the Mobile Node the first IP address by use of the first Network Prefix comprises a Duplicate Address Detection procedure.

13. A Mobile Node, comprising:

a Receiver for receiving a first and a second Advertisements;

a Temporary Memory for storing a Network Prefix, a Nonce Index and a Hashed Nonce Value received in the first Advertisement, for storing a Nonce Value received in the second Advertisement, and for storing a first IP address,

a Processor for configuring the first IP address based on the Network Prefix, the configuring being initiated concurrently with authenticating the first Advertisement, and for hashing the Nonce Value; and

a Decision Logic for authenticating the first Advertisement by comparing a Result of the hashing with the Hashed Nonce Value and for deciding to keep the first IP address based on an outcome of the comparison.

14. The Mobile Node of claim 13, wherein:

the Decision Logic is further for releasing the first IP address if the outcome of the comparison is negative;

the Processor is further for configuring a second IP address based on the second Advertisement if the Decision Logic releases the first IP address; and

the Temporary Memory is for further overwriting the first IP address with the second IP address.

15. The Mobile Node of claim 13, wherein:

the Temporary Memory is further for storing a Public Key of an Access Router received in one of the first or second Advertisements;

the Processor is further for verifying a signature of the second Advertisement by use of the Public Key of the Access Router; and

the Decision Logic is further for deciding to keep the first IP address based on an outcome of the verification.

16. The Mobile Node of claim 15, wherein:

the Decision Logic is further for releasing the first IP address if the outcome of the verification is negative; and

the Mobile Node further comprises a Transmitter for sending a Solicitation when the Decision Logic determines that the outcome of the verification is negative.

17. The Mobile Node of claim 13, further comprising:

a Permanent Memory for storing a Private Key of the Mobile Node.

18. The Mobile Node of claim 17, wherein:

the Processor is further for signing the Solicitation with the Private Key of the Mobile Node.

19. The Mobile Node of claim 13, further comprising:

a Transmitter for sending a Solicitation comprising the Nonce Index.

20. The Mobile Node of claim 19, further comprising:

a Packet data Handler for handling sending and receiving of packet data when the Decision Logic decides to keep the first IP address.

21. The Mobile Node of claim 20, wherein:

the Transmitter is further for sending packet data; and

the Receiver is further for receiving packet data.

22. The Mobile Node of claim 13, wherein:

the Processor is further for using a Duplicate Address Detection procedure as a part of configuring the first IP address.

23. The Mobile Node of claim 13, wherein:

the Receiver is further for receiving Unicast Advertisements and Periodic Advertisements; and

the second Advertisement is a Unicast Advertisement.