Addressing mechanisms in mobile IP

• US 20030084293A1
• Filed: 10/23/2002
• Published: 05/01/2003
• Est. Priority Date: 10/26/2001
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Arkko, Jari, Ylitalo, Jukka, Nikander, Pekka
• Granted Patent: US 7,401,216 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A method of delegating responsibility for an IP address owned by a first IP network node to a second IP network node, at least a part of the IP address being derivable from a public key of a public/private key pair belonging to the first node. The method comprises notifying the first node of a public key of a public/private key pair belonging to the second node, at the first node, signing the public key of the second node with the private key of the first node to provide an authorisation certificate, and sending the authorisation certificate from the first node to the second node, wherein the authorisation certificate is subsequently included with messages relating to said IP address and signed with the private key of the second node, sent from the second node to receiving nodes, and is used by the receiving nodes to verify the second node'"'"'s claim on the IP address.

Claims

1. A method of delegating responsibility for an IP address owned by a first IP network node to a second IP network node, at least a part of the IP address being derivable from a public key of a public/private key pair belonging to the first node, the method comprising:

notifying the first node of a public key of a public/private key pair belonging to the second node;

at the first node, signing the public key of the second node with the private key of the first node to provide an authorisation certificate; and

sending the authorisation certificate from the first node to the second node,

wherein the authorisation certificate is subsequently included with messages relating to said IP address and signed with the private key of the second node, sent from the second node to receiving nodes, and is used by the receiving nodes to verify the second node'"'"'s claim on the IP address.

2. A method according to claim 1, wherein said first IP network node is a DHCP server, and said second IP network node is a client node

3. A method according to claim 1, wherein said first IP network node is a client node and said second IP network node is a mobile router.

4. A method according to claim 1, wherein an Interface Identifier part of said IP address is derivable from the public key of the public/private key pair belonging to the first node.

5. A method according to claim 1, wherein said messages are binding update messages according to the Mobile IP protocol and include the authorisation certificate, said IP address, and a new care-of-address.

6. A method according to claim 1, wherein said certificate is derived by signing, with the private key of the first node, a combination of the public key of the second node and a time stamp, the time stamp being the time at which the authorisation for using the IP address expires.

7. A method of authenticating a message received at a receiving node of an IP network from an originating node, the message relating to an IP address and comprising

said IP address,

a public key of a public/private key pair belonging to the node owning the IP address, and

a certificate issued to the originating node by the owning node and derived by signing the public key of a public/private key pair belonging to the originating node with the private key of the owning node,

the message being signed with the private key of the originating node, the method comprising:

confirming that at least a part of said IP address is derivable from the public key of the owning node;

confirming that said certificate is signed with the private key of the owning node; and

confirming that the message is signed with the private key of the originating node.

8. A method according to claim 7, where said certificate is derived by signing both the public key of the public/private key pair belonging to the originating node and a time-stamp, and the receiving node confirms that the time-stamp has not expired prior to acting upon the message.

9. An IP client terminal arranged in use to lease an IP address from another IP network node, at least a part of the IP address being derivable from a public key of a public/private key pair belonging to the owning node, the client terminal comprising:

means for notifying the owning node of a public key of a public/private key pair belonging to the client terminal;

means for receiving from the owning node, an authorisation certificate including the public key of the client terminal signed with the private key of the owning node;

wherein the authorisation certificate is subsequently included with messages relating to said IP address and signed with the private key of the client terminal, sent from the client terminal to receiving nodes, and is used by the receiving nodes to verify the client terminal'"'"'s claim on the IP address.

10. An IP client terminal arranged in use to authorise a delegated IP network node to use an IP address owned by the client terminal, at least a part of the IP address being derivable from a public key of a public/private key pair belonging to the client terminal, the client terminal comprising:

means for receiving from said delegated node a public key of a public/private key pair belonging to the delegated node;

means for generating an authorisation certificate including the public key of the delegated node signed with the private key of the client terminal, and for sending the certificate to the delegated node;

wherein the authorisation certificate is subsequently included with messages relating to said IP address and signed with the private key of the delegated node, sent from the delegated node to receiving nodes, and is used by the receiving nodes to verify the delegated node'"'"'s claim on the IP address.

11. An IP server arranged in use to authorise a client IP node to use an IP address owned by the server, at least a part of the IP address being derivable from a public key of a public/private key pair belonging to the server, the server comprising:

means for receiving from said client terminal a public key of a public/private key pair belonging to the client terminal;

means for generating an authorisation certificate including the public key of the client terminal signed with the private key of the server, and for sending the certificate to the client terminal;

wherein the authorisation certificate is subsequently included with messages relating to said IP address and signed with the private key of the client terminal, sent from the client terminal to receiving nodes, and is used by the receiving nodes to authenticate the messages.

12. An IP server arranged in use to assume responsibility for an IP address owned by a client terminal, at least a part of the IP address being derivable from a public key of a public/private key pair belonging to the client terminal, the server comprising:

means for sending to said client terminal a public key of a public/private key pair belonging to the server;

means for receiving from the client terminal, an authorisation certificate including the public key of the server signed with the private key of the client terminal;

wherein the authorisation certificate is subsequently included with messages relating to said IP address and signed with the private key of the server, sent from the server to receiving nodes, and is used by the receiving nodes to verify the server'"'"'s claim on the IP address.