Auto-discovery of a non-advertised public network address

• US 9,059,841 B2
• Filed: 12/13/2006
• Issued: 06/16/2015
• Est. Priority Date: 02/03/2006
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Passarella, Rossano, Stevens, William M., Sukumaran, Jayesh, Wahlstrom, Donald P., Zhang, Yan
• Primary Examiner(s): Sarwar, Babar
• Application Number:
  US11/638,079
• Publication Number:
  US 20070183382A1
• Time in Patent Office: 3,107 Days
• Field of Search: 455410-411, 4554321-453, 455/509, 455/424, 370/331, 370/508, 709/225, 709227-229, 713/153, 713/155, 726 2- 6, 726/12, 726 27- 30, 380/247
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 88/08 Access point devices
• CPC Class Codes: H04W 88/12 Access point controller devices
• CPC Class Codes: H04W 92/12 between access points and access point controllers

Abstract

Providing a network address is disclosed. A communication indicating that a first node desires to communicate via a packet data network with a second node configured to provide access to a private resource is received. A non-publicly advertised packet data network address usable to communicate with the second node via the packet data network is provided to the first node.

Claims

1. A method of providing a network address, comprising:

receiving, at a registration server from a base transceiver station, a communication indicating that the base transceiver station desires to communicate, via a packet data network, with a gateway configured to provide access for the base transceiver station to a base station controller, wherein

the gateway is communicatively disposed between the packet data network and the base station controller,

the registration server and the gateway are communicatively coupled to the packet data network,

the registration server and the gateway are communicatively coupled to each other over a secure connection that is separate from the packet data network; and

sending, from the registration server to the base transceiver station, a non-publicly advertised packet data network address usable to communicate with the gateway via the packet data network.

2. The method according to claim 1, wherein the communication comprises a unique identifier of the base transceiver station and a random number.

3. The method according to claim 2, further comprising:

selecting a key at the registration server using the unique identifier; and

computing an answer using the key and the random number that is sent to the base transceiver station.

4. The method according to claim 3, further comprising:

sending the answer and a second random number from the registration server to the base transceiver station.

5. The method according to claim 4, further comprising:

computing a response that is sent to the registration server by the base transceiver station using a second key stored in a smart card installed in the base transceiver station and the second random number.

6. The method according to claim 5, further comprising:

generating session keys by the registration server;

sending the session keys to the base transceiver station over the packet data network and to the gateway over the secure connection that is separate from the packet data network, wherein the non-publicly advertised packet data network address is an IP address of the gateway; and

sending the IP address of the gateway by the registration server to the base transceiver station over the packet data network.

7. The method according to claim 6, further comprising:

securely communicating with the gateway by the base transceiver station using the session keys and the IP address of the gateway.

8. The method according to claim 7, further comprising:

securely communicating the base transceiver station and the gateway with the base station controller;

aggregating data at the gateway from a plurality of base transceiver stations;

communicating the aggregated data through a single physical port of the base station controller; and

presenting the plurality of base transceiver stations by the gateway as a single logical base transceiver station to the base station controller.

9. The method according to claim 7, wherein the session keys have a limited lifetime before the session keys expire.

10. The method according to claim 9, further comprising:

registering the plurality of base transceiver stations with the registration server to obtain new session keys.

11. The method according to claim 7, wherein the base transceiver station securely communicates voice data with the gateway using S-RTP via UDP over IP.

12. The method according to claim 11, further comprising:

securely communicating signaling or non-voice data between the base transceiver station and the gateway using SCTP over IP-SEC.

13. The method according to claim 6, further comprising:

sending the session keys by the registration server to the base transceiver station over the packet data network that is a public data network;

sending the session keys by the registration server to the gateway over a secure connection that is a private and direct connection between the registration server and the gateway;

communicatively disposing a firewall between the packet data network and the gateway;

communicatively disposing the firewall between the packet data network and the registration server; and

communicatively disposing the packet data network between the firewall and the plurality of base transceiver stations.

14. The method according to claim 1, wherein the packet data network comprises an IP network, and the non-publicly advertised packet data network address comprises an IP address of the gateway.

15. The method according to claim 1, further comprising:

receiving an indication that the non-publicly advertised packet data network address is no longer usable to access the gateway; and

auto-discovering a second non-publicly advertised packet data network address from the registration server.

16. The method according to claim 1, further comprising:

receiving an indication that the non-publicly advertised packet data network address is no longer usable to access the gateway;

receiving an indication that a second non-publicly advertised address is usable to access the base station controller; and

sending the second non-publicly advertised address to the base transceiver station.

17. The method according to claim 1, wherein the packet data network is the Internet, and further comprising:

communicating the base transceiver station with the base station controller through the Internet and the gateway; and

communicating the base transceiver station with the registration server without communicating with the gateway and without communicating with the base station controller.

18. The method according to claim 1, wherein an IP address of the registration server is publicly available via a DNS query, or wherein the base transceiver station is provisioned with a URL of the registration server upon an installation of a smart card on which the IP address resides, and wherein the smart card is configured to store a key that the registration server can look up using an identity of the base transceiver station.

19. The method according to claim 1, further comprising:

configuring the gateway to receive inbound mobile network data over the packet data network from a plurality of base transceiver stations, to aggregate the received inbound mobile network data, and to provide the aggregated inbound mobile network data to the base station controller using time division multiplexing over a single dedicated line; and

representing the aggregated inbound mobile network data as coming from a single logical base transceiver station.

20. The method according to claim 1, further comprising:

configuring the gateway to present a plurality of base transceiver stations to the base station controller as a single logical base transceiver station; and

configuring the gateway to interface with different types of base station controllers from different vendors.

21. The method according to claim 1, further comprising:

configuring the gateway to map first communications received from the base station controller to respective base transceiver stations and to map second communications received from a plurality of base transceiver stations to a single logical base transceiver station prior to forwarding the second communications to the base station controller.

22. The method according to claim 1, wherein the base transceiver station comprises a smart card device that stores a key and a unique identifier associated with the base transceiver station, and wherein the smart card performs cryptographic functions.

23. The method according to claim 1, further comprising:

installing a smart card in the base transceiver station;

provisioning the base transceiver station with a URL of the registration server and a key when a smart card is installed in the base transceiver station, wherein the smart card provisions the URL of the registration server and the key to the base transceiver station; and

looking up the key by the registration server based on an identity of the base transceiver station.

24. The method according to claim 23, further comprising:

upon initial installation of the smart card, requesting an IP address by the base station transceiver for itself;

using the URL of the registration server that is provisioned by the smart card to contact the registration server; and

the base transceiver station communicating with the registration server before being allowed to access the gateway and before being allowed to access the base station controller.

25. The method according to claim 1, wherein the gateway and the registration server have different IP addresses, the gateway and the registration server are in a same physical computing system, and the secure connection coupling the gateway and the registration server is a secure internal connection.