Methods and apparatus for securing proxy mobile IP

• US 8,259,676 B2
• Filed: 02/09/2009
• Issued: 09/04/2012
• Est. Priority Date: 04/28/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Leung, Kent K., Dommety, Gopal
• Primary Examiner(s): Pham, Chi H.
• Assistant Examiner(s): HOM, SHICK C
• Application Number:
  US12/368,159
• Publication Number:
  US 20090141688A1
• Time in Patent Office: 1,303 Days
• Field of Search: None
• US Class Current: 370/331
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 61/5084 Providing for device mobility network addressing or numbering for mobility support in wireless networks H04W8/26; mobile IP H04W80/04
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 88/08 Access point devices
• CPC Class Codes: H04W 88/182 Network node acting on behalf of an other network entity, e.g. proxy

Abstract

Various security mechanisms may be used independently, or in combination with one another, to authenticate the identity of a node during the Mobile IP registration process. First, an Access Point receiving a packet from a node verifies that the source MAC address identified in the packet is in the Access Point'"'"'s client association table. In addition, as a second mechanism, the Access Point ensures that a one-to-one mapping exists for the source MAC address and source IP address identified in the packet in a mapping table maintained by the Access Point. As a third mechanism, a binding is not modified in the mobility binding table maintained by the Home Agent unless there is a one-to-one mapping in the mobility binding table between the source MAC address and the source IP address. Similarly, the Foreign Agent may also maintain a mapping between the source IP address and the source MAC address in its visitor table to ensure a one-to-one mapping between a source IP address and the associated MAC address.

Claims

1. In an Access Point, a method of authenticating a node prior to performing proxy registration on behalf of the node, comprising:

receiving a packet from the node, the packet including a source MAC address and a source IP address;

ascertaining whether a one-to-one mapping between the source MAC address and the source IP address exists in a mapping table; and

composing a registration request including a home address field including the source IP address and sending the registration request, thereby performing proxy registration on behalf of the node, wherein composing and sending the registration request are performed according to whether it is ascertained that the one-to-one mapping between the source MAC address and the source IP address exists in the mapping table.

2. The method as recited in claim 1, wherein composing the registration request comprises appending a MAC address extension to the registration request, the MAC address extension including the source MAC address.

3. An Access Point adapted for performing a method of authenticating a node prior to performing proxy registration on behalf of the node, comprising:

a processor; and

a memory, at least one of the processor and the memory being adapted for;

receiving a packet from the node, the packet including a source MAC address and a source IP address;

ascertaining whether a mapping between the source MAC address and the source IP address exists in a mapping table; and

composing a registration request including a home address field including the source IP address and sending the registration request, thereby performing proxy registration on behalf of the node, wherein composing and sending the registration request are performed according to whether it is ascertained that the mapping between the source MAC address and the source IP address exists in the mapping table.

4. In a Foreign Agent, a method of processing a registration request, comprising:

receiving a registration request having a home address field including a source IP address, a Home Agent field including a Home Agent address, and a MAC address extension including a source MAC address;

determining whether an entry including the source IP address and the source MAC address is in a visitor table maintained by the Foreign Agent; and

forwarding the registration request according to whether an entry in the visitor table maintained by the Foreign Agent includes the source IP address and the source MAC address.

5. The method as recited in claim 4, wherein determining whether the entry including the source IP address and the source MAC address is in the visitor table maintained by the Foreign Agent includes determining whether a one-to-one mapping exists between the source IP address and the source MAC address.

6. The method as recited in claim 5, wherein when the one-to-one mapping between the source IP address and the source MAC address does not exist in the visitor table, dropping the registration request without forwarding the registration request.

7. In a Home Agent, a method of processing a registration request, comprising:

receiving a registration request having a home address field including a source IP address, a care-of address field including a care-of address, and having a MAC address extension including a source MAC address; and

determining whether a one-to-one mapping between the source MAC address and the source IP address exists in a mobility binding table;

wherein registering the source IP address with the Home Agent, composing a registration reply and sending the registration reply to the care-of address are performed according to whether it is determined that a one-to-one mapping between the source MAC address and the source IP address exists in the mobility binding table.

8. The method as recited in claim 7, wherein composing a registration reply comprises:

composing a registration reply including a home address field including the source IP address, a care-of address field including the care-of address, and having a MAC address extension including the source MAC address.

9. In a Home Agent, a method of processing a registration request, comprising:

receiving a registration request having a home address field including a source IP address, a care-of address field including a care-of address, and having a MAC address extension including a source MAC address;

determining whether a mapping between the source MAC address and the source IP address exists in a mobility binding table;

updating the mobility binding table according to whether the mapping between the source MAC address and the source IP address exists in the mobility binding table;

composing a registration reply including a home address field including the source IP address, a care-of address field including the care-of address, and having a MAC address extension including the source MAC address; and

sending the registration reply to the care-of address.

10. The method as recited in claim 9, further comprising:

updating the mobility binding table with the mapping between the source MAC address and the source IP address such that the mapping is associated with the care-of address.

11. The method as recited in claim 10,

wherein composing and sending the registration reply to the care-of address are performed when it is determined that the mapping between the source MAC address and the source IP address exists in the mobility binding table.

12. The method as recited in claim 9, further comprising:

wherein composing and sending the registration reply to the care-of address are performed when it is determined that the mapping between the source MAC address and the source IP address exists in the mobility binding table.

13. The method as recited in claim 9, further comprising:

determining whether the source IP address matches a binding in the mobility binding table;

when the source IP address matches a binding in the mobility binding table, determining whether the binding maps the source MAC address to the source IP address; and

wherein composing and sending the registration reply to the care-of address is performed when it is determined that the binding maps the source MAC address to the source IP address.

14. The method as recited in claim 13, further comprising:

when the source IP address does not match the binding in the mobility binding table, updating the mobility binding table with a mapping between the source MAC address and the source IP address such that the mapping is associated with the care-of address.

15. In a Foreign Agent, a method of processing a registration request, comprising:

receiving a registration request having a home address field including a source IP address, a Home Agent field including a Home Agent address, and a MAC address extension including a source MAC address;

determining whether an entry including the source IP address and the source MAC address is in a visitor table maintained by the Foreign Agent; and

forwarding the registration request to the Home Agent address according to whether an entry including the source IP address and the source MAC address is determined to be in the visitor table maintained by the Foreign Agent.

16. The method as recited in claim 15, further comprising:

updating a visitor table such that the visitor table includes an entry that associates the source IP address and the source MAC address with the Home Agent address.

17. The method as recited in claim 16, wherein updating the visitor table is performed when the registration reply is received.

18. The method as recited in claim 15, further comprising:

determining whether an entry including the source IP address is in the visitor table;

when an entry including the source IP address is in the visitor table, determining whether the entry includes the source MAC address; and

when the entry is determined to include the source MAC address and the source IP address, forwarding the registration request to the Home Agent address.

19. The method as recited in claim 15, further comprising:

receiving a registration reply having a home address field including the source IP address, a Home Agent field including the Home Agent address, and a MAC address extension including the source MAC address; and

forwarding the registration reply to the source IP address.

20. The method as recited in claim 15, further comprising:

dropping the registration request when an entry including the source MAC address and the source IP address is determined not to be in the visitor table maintained by the Foreign Agent.

21. A Foreign Agent, comprising:

a processor; and

a memory, at least one of the processor and the memory being adapted for;

receiving a registration request having a home address field including a source IP address, a Home Agent field including a Home Agent address, and a MAC address extension including a source MAC address;

determining whether an entry including the source IP address and the source MAC address is in a visitor table maintained by the Foreign Agent; and

forwarding the registration request according to whether an entry in the visitor table maintained by the Foreign Agent includes the source IP address and the source MAC address.

22. A Home Agent, comprising:

a processor; and

a memory, at least one of the processor and the memory being adapted for;

receiving a registration request having a home address field including a source IP address, a care-of address field including a care-of address, and having a MAC address extension including a source MAC address; and

determining whether a one-to-one mapping between the source MAC address and the source IP address exists in a mobility binding table;

wherein registering the source IP address with the Home Agent, composing a registration reply and sending the registration reply to the care-of address are performed according to whether it is determined that a one-to-one mapping between the source MAC address and the source IP address exists in the mobility binding table.

23. The Home Agent as recited in claim 22, wherein composing a registration reply comprises:

composing a registration reply including a home address field including the source IP address, a care-of address field including the care-of address, and having a MAC address extension including the source MAC address.

24. A Home Agent, comprising:

a processor; and

a memory, at least one of the processor and the memory being adapted for;

receiving a registration request having a home address field including a source IP address, a care-of address field including a care-of address, and having a MAC address extension including a source MAC address;

determining whether a mapping between the source MAC address and the source IP address exists in a mobility binding table;

updating the mobility binding table according to whether the mapping between the source MAC address and the source IP address exists in the mobility binding table;

composing a registration reply including a home address field including the source IP address, a care-of address field including the care-of address, and having a MAC address extension including the source MAC address; and

sending the registration reply to the care-of address.