Maintaining secrecy of assigned unique local addresses for IPv6 nodes within a prescribed site during access of a wide area network

• US 20060092949A1
• Filed: 11/02/2004
• Published: 05/04/2006
• Est. Priority Date: 11/02/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Levy-Abegnoli, Eric M., Thubert, Pascal
• Granted Patent: US 7,539,202 B2
• Time in Patent Office: Days
• US Class Current: 370/395.52
• CPC Class Codes: H04L 2101/659 Internet protocol version 6 [IPv6] addresses
• CPC Class Codes: H04L 61/2528 Translation at a proxy
• CPC Class Codes: H04L 61/2539 Hiding addresses; Keeping addresses anonymous
• CPC Class Codes: H04L 61/2546 Arrangements for avoiding unnecessary translation
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/169 Special adaptations of TCP, UDP or IP for interworking of IP based networks with other networks protocols for interworking, protocol conversion H04L69/08

Abstract

A network includes network nodes and a gateway. Each network node has a corresponding unique in-site IPv6 address for communication within a prescribed site, each in-site IPv6 address having a first IPv6 address prefix that is not advertised outside of the prescribed site. Network nodes can obtain from within the prescribed site a unique extra-site IPv6 address for mobile or extra-site communications. The extra-site IPv6 address has a second IPv6 address prefix, distinct from the first IPv6 address prefix, advertised by the gateway to the prescribed site and the wide area network. The gateway establishes a secure connection (e.g., tunnel) with each corresponding IPv6 node using its corresponding extra-site IPv6 address, and creates a corresponding binding cache entry specifying the corresponding extra-site IPv6 address and in-site IPv6 address. Hence, the gateway provides wide area network access while maintaining secrecy of the in-site IPv6 addresses.

Claims

1. A method in an IPv6 node, the method including:

acquiring a unique in-site IPv6 address for communication with at least a second gateway node within a prescribed site, the unique in-site IPv6 address being reachable only by nodes within the prescribed site, the unique in-site IPv6 address having a first address prefix that is not advertised outside of the prescribed site;

obtaining from within the prescribed site a unique extra-site address having a second address prefix, distinct from the first address prefix, that is advertised inside and outside the prescribed site; and

sending a first packet to a correspondent node outside of the prescribed site based on;

(1) first generating the first packet, the first packet having a first header with a destination address field specifying an address of the correspondent node and a source address field specifying the extra-site address,

(2) second generating a second packet including the first packet and a second header for reception and removal by the second gateway node, the second header having a destination address field specifying an IPv6 address of the second IPv6 gateway node and a source address field specifying the in-site IPv6 address, and

(3) outputting the second packet, having the first and second headers, to the second IPv6 gateway node via a secure connection established between the IP-based node and the second IPv6 gateway node, for transfer of the first packet by the second IPv6 gateway node outside of the prescribed site for delivery to the correspondent node.

2. The method of claim 1, wherein the sending also includes establishing the secure connection as a secure tunnel between the IPv6 node and the second IPv6 gateway node.

3. The method of claim 1, the method further comprising receiving a third packet, having been generated by a second correspondent node inside the prescribed site, the third packet including a corresponding source address field specifying a corresponding second in-site IPv6 address of the second correspondent node that includes the first address prefix, the third packet further including a corresponding destination address field specifying the in-site IPv6 address of the IPv6 node.

4. The method of claim 3, wherein the third packet is received via a path independent of the secure connection, the IPv6 node being a fixed node.

5. The method of claim 3, further comprising sending a fourth packet to the second correspondent node via a path independent of the secure connection based on the second correspondent node using the second in-site IPv6 address, the fourth packet having a corresponding source address field specifying the in-site IPv6 address of the IPv6 node and a corresponding destination address field specifying the second in-site IPv6 address.

6. The method of claim 1, further comprising:

receiving a third packet via the secure connection, the third packet including a third header including a corresponding source address field specifying the IPv6 address of the second IPv6 gateway node, the third header further including a corresponding destination address field specifying the in-site IPv6 address of the IPv6 node;

recovering from within the third packet a fourth packet having a fourth header including a corresponding destination address field specifying the extra-site IPv6 address of the IPv6 node.

7. The method of claim 6, wherein the fourth header includes a corresponding source address field specifying the IPv6 address of the correspondent node outside of the prescribed site.

8. The method of claim 6, wherein the fourth header includes a corresponding source address field specifying a second in-site IPv6 address of a second correspondent node inside the prescribed site.

9. The method of claim 8, further including selecting the extra-site IPv6 address as a source address for a fourth packet to be sent to the second in-site IPv6 address via the secure connection, following encapsulating in a fifth packet specifying the in-site IPv6 address of the IPv6 node as the corresponding source address, based on the IPv6 node being a mobile node.

10. The method of claim 1, the obtaining including updating a first Dynamic Name Server with the extra-site IPv6 address and a corresponding host name assigned to the IPv6 node, the Dynamic Name Server configured for providing the extra-site IPv6 address, outside of the prescribed site, in response to a query from outside of the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

11. The method of claim 10, wherein the acquiring includes updating a second Dynamic Name Server with the in-site IPv6 address and the corresponding host name, the second Dynamic Name Server configured for providing the in-site IPv6 address, only within the prescribed site, in response to a second query from inside the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

12. The method of claim 1, the acquiring including updating a Dynamic Name Server with the in-site IPv6 address and a corresponding host name assigned to the IPv6 node, the Dynamic Name Server configured for providing the in-site IPv6 address, only within the prescribed site, in response to a query from inside the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

37. The medium of claim 8, further including instructions for selecting the extra-site IPv6 address as a source address for a fourth packet to be sent to the second in-site IPv6 address via the secure connection, following encapsulating in a fifth packet specifying the in-site IPv6 address of the IPv6 node as the corresponding source address, based on the IPv6 node being a mobile node.

13. A method in an IPv6 gateway configured for providing connectivity between a prescribed site and a wide area network, the method comprising:

advertising only within the prescribed site that a first IPv6 address prefix is reachable via the gateway, the first address prefix not advertised outside of the prescribed site;

advertising to the prescribed site and the wide area network that a second IPv6 address prefix is reachable via the gateway;

establishing a secure connection with a first IPv6 node within the prescribed site, based on the first IPv6 node having a unique in-site IPv6 address that includes the first IPv6 address prefix;

receiving from the first IPv6 node, via the secure connection, a first packet having a source address field specifying the in-site IPv6 address, a destination address field specifying an IPv6 address of the gateway, and a second packet;

forwarding the second packet to a destination node in response to the destination address field of the first packet specifying the IPv6 address of the gateway, including;

(1) recovering the second packet from the first packet, the second packet having a source address field specifying a unique extra-site IPv6 address having the second IPv6 address prefix and a destination address field specifying an IPv6 address of the destination node, and

(2) outputting the second packet, without the in-site IPv6 address of the IPv6 node; and

creating a binding cache entry specifying that the extra-site IPv6 address of the first IPv6 node is reachable via the in-site IPv6 address of the IPv6 node.

14. The method of claim 13, further comprising:

determining that the IPv6 address of the destination node includes one of the first IPv6 address prefix and the second IPv6 address prefix, and

performing route optimization within the prescribed site between the first IPv6 node and the destination node based on the IPv6 address of the destination node including the one IPv6 address prefix.

15. The method of claim 13, further comprising:

determining that the IPv6 address of the destination node includes a third IPv6 address prefix distinct from any one of the first IPv6 address prefix and the second IPv6 address prefix, and

preventing any route optimization between the first IPv6 node and the destination node based on the third IPv6 address prefix being distinct from the first address prefix.

16. The method of claim 13, further comprising assigning the extra-site IPv6 address to the first IPv6 node in response to a request thereof, the binding cache entry created in response to the assigning of the extra-site IPv6 address.

17. The method of claim 16, further comprising updating a Dynamic Name Server with the extra-site IPv6 address and a corresponding host name having been assigned to the IPv6 node, the Dynamic Name Server configured for providing the extra-site IPv6 address, to a node in the wide area network, in response to a corresponding query that requests a reachable address for the host name assigned to the IPv6 node.

18. The method of claim 13, wherein the secure connection is established as a secure tunnel between the gateway and the first IPv6 node.

19. The method of claim 13, wherein the outputting includes at least one of:

first outputting the second packet into the prescribed site via a prescribed route based on the IPv6 address of the destination node specifying the first IPv6 address prefix; and

second outputting the second packet into the prescribed site via a second secure connection, established between the gateway and the destination node, based on the IPv6 address of the destination node specifying the second IPv6 address prefix.

20. The method of claim 19, wherein the outputting further includes third outputting the second packet onto the wide area network based on the IPv6 address of the destination node specifying an address prefix distinct from any one of the first IPv6 address prefix and the second IPv6 address prefix.

21. A network configured for communications with a wide area network, the network comprising:

network nodes, each having a corresponding unique in-site IPv6 address for communication within a prescribed site, each of the in-site IPv6 addresses having a first IPv6 address prefix that is not advertised outside of the prescribed site, at least one of the network nodes configured for obtaining from within the prescribed site a unique extra-site IPv6 address having a second IPv6 address prefix that is distinct from the first IPv6 address prefix; and

a gateway configured for;

(1) advertising to the prescribed site and the wide area network that the second IPv6 address prefix is reachable via the gateway,

(2) advertising only within the prescribed site that the first IPv6 address prefix is reachable via the gateway, the first address prefix not advertised outside of the prescribed site,

(3) establishing a secure connection with each corresponding IPv6 node that uses a corresponding extra-site IPv6 address having the second IPv6 address prefix, the gateway configured for creating, for said each IPv6 node that uses a corresponding extra-site IPv6 address, a corresponding binding cache entry specifying the corresponding extra-site IPv6 address and in-site IPv6 address,

(4) decapasulating a first packet, received from one of the secure connections, having a source address field specifying the corresponding in-site IPv6 address and a second packet, the second packet having a source address field specifying the corresponding extra-site IPv6 address, and

(5) outputting the second packet for a specified destination node, without the corresponding in-site IPv6 address specified in the source address field of the first packet.

22. The network of claim 21, wherein each secure connection is a secure tunnel.

23. The network of claim 21, wherein the gateway further is configured for:

receiving a third packet having a destination address field specifying a destination address having the second IPv6 address prefix;

encapsulating the third packet into a fourth packet having a destination address field specifying a destination in-site IPv6 address having been identified based on the corresponding binding cache entry specifying the destination address; and

outputting the fourth packet onto the corresponding secure connection terminated by the network node having the destination in-site IPv6 address.

24. The network of claim 21, wherein each network node is configured for selecting the corresponding extra-site IPv6 address as a source address for a transmit packet, based on the destination of the transmit packet being reachable outside the prescribed site.

25. The network of claim 24, wherein:

each network node is configured as one of a fixed node and a mobile node,

each mobile node configured for selecting the corresponding extra-site IPv6 address as the corresponding source address independent of the destination, and

each fixed node configured for selecting the corresponding extra-site IPv6 address as a source address for a transmit packet based on the destination of the transmit packet being reachable outside the prescribed site, and selecting the corresponding in-site IPv6 address as the source address for the transmit packet based on the destination being reachable inside the prescribed site.

26. The network node of claim 24, wherein the gateway is configured for performing route optimization between first and second of the network nodes within the prescribed site and utilizing the respective secure connections.

27. The network of claim 21, further comprising a first Dynamic Name Server configured for supplying one of the extra-site IPv6 addresses in response to a query specifying a corresponding host name assigned to corresponding the IPv6 node, the Dynamic Name Server configured for providing the extra-site IPv6 address, independent of whether the query is received from inside the prescribed site.

28. The network of claim 27, further comprising a second Dynamic Name Server configured for supplying one of the in-site IPv6 addresses in response to a query specifying a corresponding host name assigned to corresponding the IPv6 node, the Dynamic Name Server configured for providing the in-site IPv6 address only inside the prescribed site and not outside the prescribed site.

29. A computer readable medium having stored thereon sequences of instructions for outputting an IPv6 packet by an IP-based node to a correspondent node, the sequences of instructions including instructions for:

acquiring a unique in-site IPv6 address for communication with at least a second IPv6 gateway node within a prescribed site, the unique in-site IPv6 address being reachable only by nodes within the prescribed site, the unique in-site IPv6 address having a first address prefix that is not advertised outside of the prescribed site;

obtaining from within the prescribed site a unique extra-site IPv6 address having a second address prefix, distinct from the first address prefix, that is advertised inside and outside the prescribed site; and

sending a first packet to a correspondent node outside of the prescribed site based on;

(1) first generating the first packet, the first packet having a first header with a destination address field specifying an IPv6 address of the correspondent node and a source address field specifying the extra-site IPv6 address,

(2) second generating a second packet including the first packet and a second header for reception and removal by the second IPv6 gateway node, the second header having a destination address field specifying an IPv6 address of the second IPv6 gateway node and a source address field specifying the in-site IPv6 address, and

(3) outputting the second packet, having the first and second headers, to the second IPv6 gateway node via a secure connection established between the IPv6 node and the second IPv6 gateway node, for transfer of the first packet by the second IPv6 gateway node outside of the prescribed site for delivery to the correspondent node.

30. The medium of claim 29, wherein the sending also includes establishing the secure connection as a secure tunnel between the IPv6 node and the second IPv6 gateway node.

31. The medium of claim 29, further comprising instructions for receiving a third packet, having been generated by a second correspondent node inside the prescribed site, the third packet including a corresponding source address field specifying a corresponding second in-site IPv6 address of the second correspondent node that includes the first address prefix, the third packet further including a corresponding destination address field specifying the in-site IPv6 address of the IPv6 node.

32. The medium of claim 31, wherein the third packet is received via a path independent of the secure connection, the IPv6 node being a fixed node.

33. The medium of claim 31, further comprising instructions for sending a fourth packet to the second correspondent node via a path independent of the secure connection based on the second correspondent node using the second in-site IPv6 address, the fourth packet having a corresponding source address field specifying the in-site IPv6 address of the IPv6 node and a corresponding destination address field specifying the second in-site IPv6 address.

34. The medium of claim 29, further comprising instructions for:

receiving a third packet via the secure connection, the third packet including a third header including a corresponding source address field specifying the IPv6 address of the second IPv6 gateway node, the third header further including a corresponding destination address field specifying the in-site IPv6 address of the IPv6 node;

recovering from within the third packet a fourth packet having a fourth header including a corresponding destination address field specifying the extra-site IPv6 address of the IPv6 node.

35. The medium of claim 34, wherein the fourth header includes a corresponding source address field specifying the IPv6 address of the correspondent node outside of the prescribed site.

36. The medium of claim 34, wherein the fourth header includes a corresponding source address field specifying a second in-site IPv6 address of a second correspondent node inside the prescribed site.

38. The medium of claim 29, wherein the obtaining includes updating a first Dynamic Name Server with the extra-site IPv6 address and a corresponding host name assigned to the IPv6 node, the Dynamic Name Server configured for providing the extra-site IPv6 address, outside of the prescribed site, in response to a query from outside of the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

39. The medium of claim 38, wherein the acquiring includes updating a second Dynamic Name Server with the in-site IPv6 address and the corresponding host name, the second Dynamic Name Server configured for providing the in-site IPv6 address, only within the prescribed site, in response to a second query from inside the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

40. The medium of claim 29, wherein the acquiring includes updating a Dynamic Name Server with the in-site IPv6 address and a corresponding host name assigned to the IPv6 node, the Dynamic Name Server configured for providing the in-site IPv6 address, only within the prescribed site, in response to a query from inside the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

41. A computer readable medium having stored thereon sequences of instructions for a gateway to provide connectivity between a prescribed site and a wide area network, the sequences of instructions including instructions for:

advertising only within the prescribed site that a first IPv6 address prefix is reachable via the gateway, the first address prefix not advertised outside of the prescribed site;

advertising to the prescribed site and the wide area network that a second IPv6 address prefix is reachable via the gateway;

establishing a secure connection with a first IPv6 node within the prescribed site, based on the first IPv6 node having a unique in-site IPv6 address that includes the first IPv6 address prefix;

receiving from the first IPv6 node, via the secure connection, a first packet having a source address field specifying the in-site IPv6 address, a destination address field specifying an IPv6 address of the gateway, and a second packet;

forwarding the second packet to a destination node in response to the destination address field of the first packet specifying the IPv6 address of the gateway, including;

(1) recovering the second packet from the first packet, the second packet having a source address field specifying a unique extra-site IPv6 address having the second IPv6 address prefix and a destination address field specifying an IPv6 address of the destination node, and

(2) outputting the second packet, without the in-site IPv6 address of the IPv6 node; and

creating a binding cache entry specifying that the extra-site IPv6 address of the first IPv6 node is reachable via the in-site IPv6 address of the IPv6 node.

42. The medium of claim 41, further comprising instructions for:

determining that the IPv6 address of the destination node includes one of the first IPv6 address prefix and the second IPv6 address prefix, and

performing route optimization within the prescribed site between the first IPv6 node and the destination node based on the IPv6 address of the destination node including the one IPv6 address prefix.

43. The medium of claim 41, further comprising instructions for:

determining that the IPv6 address of the destination node includes a third IPv6 address prefix distinct from any one of the first IPv6 address prefix and the second IPv6 address prefix, and

preventing any route optimization between the first IPv6 node and the destination node based on the third IPv6 address prefix being distinct from the first address prefix.

44. The medium of claim 41, further comprising instructions for assigning the extra-site IPv6 address to the first IPv6 node in response to a request thereof, the binding cache entry created in response to the assigning of the extra-site IPv6 address.

45. The medium of claim 44, further comprising instructions for updating a Dynamic Name Server with the extra-site IPv6 address and a corresponding host name having been assigned to the IPv6 node, the Dynamic Name Server configured for providing the extra-site IPv6 address, to a node in the wide area network, in response to a corresponding query that requests a reachable address for the host name assigned to the IPv6 node.

46. The medium of claim 41, wherein the secure connection is established as a secure tunnel between the gateway and the first IPv6 node.

47. The medium of claim 41, wherein the outputting includes at least one of:

first outputting the second packet into the prescribed site via a prescribed route based on the IPv6 address of the destination node specifying the first IPv6 address prefix; and

second outputting the second packet into the prescribed site via a second secure connection, established between the gateway and the destination node, based on the IPv6 address of the destination node specifying the second IPv6 address prefix.

48. The medium of claim 47, wherein the outputting further includes third outputting the second packet onto the wide area network based on the IPv6 address of the destination node specifying an address prefix distinct from any one of the first IPv6 address prefix and the second IPv6 address prefix.

49. An IP-based node comprising:

means for acquiring a unique in-site IPv6 address for communication with at least a second IPv6 gateway node within a prescribed site, the unique in-site IPv6 address being reachable only by nodes within the prescribed site, the unique in-site IPv6 address having a first address prefix that is not advertised outside of the prescribed site;

means for obtaining from within the prescribed site a unique extra-site IPv6 address having a second address prefix, distinct from the first address prefix, that is advertised inside and outside the prescribed site; and

means for sending a first packet to a correspondent node outside of the prescribed site based on;

(1) first generating the first packet, the first packet having a first header with a destination address field specifying an IPv6 address of the correspondent node and a source address field specifying the extra-site IPv6 address,

(2) second generating a second packet including the first packet and a second header for reception and removal by the second IPv6 gateway node, the second header having a destination address field specifying an IPv6 address of the second IPv6 gateway node and a source address field specifying the in-site IPv6 address, and

(3) outputting the second packet, having the first and second headers, to the second IPv6 gateway node via a secure connection established between the IPv6 node and the second IPv6 gateway node, for transfer of the first packet by the second IPv6 gateway node outside of the prescribed site for delivery to the correspondent node.

50. The IPv6 node of claim 49, wherein the means for sending is configured for establishing the secure connection as a secure tunnel between the IPv6 node and the second IPv6 gateway node.

51. The IPv6 node of claim 49, wherein the sending means is configured for receiving a third packet, having been generated by a second correspondent node inside the prescribed site, the third packet including a corresponding source address field specifying a corresponding second in-site IPv6 address of the second correspondent node that includes the first address prefix, the third packet further including a corresponding destination address field specifying the in-site IPv6 address of the IPv6 node.

52. The IPv6 node of claim 51, wherein the third packet is received via a path independent of the secure connection, the IPv6 node being a fixed node.

53. The IPv6 node of claim 51, wherein the means for sending is configured for sending a fourth packet to the second correspondent node via a path independent of the secure connection based on the second correspondent node using the second in-site IPv6 address, the fourth packet having a corresponding source address field specifying the in-site IPv6 address of the IPv6 node and a corresponding destination address field specifying the second in-site IPv6 address.

54. The IPv6 node of claim 49, wherein the means for sending is configured for:

receiving a third packet via the secure connection, the third packet including a third header including a corresponding source address field specifying the IPv6 address of the second IPv6 gateway node, the third header further including a corresponding destination address field specifying the in-site IPv6 address of the IPv6 node;

recovering from within the third packet a fourth packet having a fourth header including a corresponding destination address field specifying the extra-site IPv6 address of the IPv6 node.

55. The IPv6 node of claim 54, wherein the fourth header includes a corresponding source address field specifying the IPv6 address of the correspondent node outside of the prescribed site.

56. The IPv6 node of claim 54, wherein the fourth header includes a corresponding source address field specifying a second in-site IPv6 address of a second correspondent node inside the prescribed site.

57. The IPv6 node of claim 56, wherein the means for sending is configured for selecting the extra-site IPv6 address as a source address for a fourth packet to be sent to the second in-site IPv6 address via the secure connection, following encapsulating in a fifth packet specifying the in-site IPv6 address of the IPv6 node as the corresponding source address, based on the IPv6 node being a mobile node.

58. The IPv6 node of claim 49, wherein the means for obtaining is configured for updating a first Dynamic Name Server with the extra-site IPv6 address and a corresponding host name assigned to the IPv6 node, the Dynamic Name Server configured for providing the extra-site IPv6 address, outside of the prescribed site, in response to a query from outside of the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

59. The IPv6 node of claim 58, wherein the means for acquiring is configured for updating a second Dynamic Name Server with the in-site IPv6 address and the corresponding host name, the second Dynamic Name Server configured for providing the in-site IPv6 address, only within the prescribed site, in response to a second query from inside the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

60. The IPv6 node of claim 49, wherein the means for acquiring is configured for updating a Dynamic Name Server with the in-site IPv6 address and a corresponding host name assigned to the IPv6 node, the Dynamic Name Server configured for providing the in-site IPv6 address, only within the prescribed site, in response to a query from inside the prescribed site and that requests a reachable address for the host name assigned to the IPv6 node.

61. A gateway configured for providing connectivity between a prescribed site and a wide area network, the gateway comprising:

means for advertising only within the prescribed site that a first IPv6 address prefix is reachable via the gateway, the first address prefix not advertised outside of the prescribed site, the means for advertising configured for advertising to the prescribed site and the wide area network that a second IPv6 address prefix is reachable via the gateway;

means for establishing a secure connection with a first IPv6 node within the prescribed site, based on the first IPv6 node having a unique in-site IPv6 address that includes the first IPv6 address prefix, the means for establishing configured for receiving from the first IPv6 node, via the secure connection, a first packet having a source address field specifying the in-site IPv6 address, a destination address field specifying an IPv6 address of the gateway, and a second packet;

means for forwarding the second packet to a destination node in response to the destination address field of the first packet specifying the IPv6 address of the gateway, based on;

(1) recovering the second packet from the first packet, the second packet having a source address field specifying a unique extra-site IPv6 address having the second IPv6 address prefix and a destination address field specifying an IPv6 address of the destination node, and

(2) outputting the second packet, without the in-site IPv6 address of the IPv6 node; and

means for creating a binding cache entry specifying that the extra-site IPv6 address of the first IPv6 node is reachable via the in-site IPv6 address of the IPv6 node.

62. The gateway of claim 61, wherein the means for forwarding is configured for:

determining that the IPv6 address of the destination node includes one of the first IPv6 address prefix and the second IPv6 address prefix, and

performing route optimization within the prescribed site between the first IPv6 node and the destination node based on the IPv6 address of the destination node including the one IPv6 address prefix.

63. The gateway of claim 61, wherein the means for forwarding is configured for:

determining that the IPv6 address of the destination node includes a third IPv6 address prefix distinct from any one of the first IPv6 address prefix and the second IPv6 address prefix, and

preventing any route optimization between the first IPv6 node and the destination node based on the third IPv6 address prefix being distinct from the first address prefix.

64. The gateway of claim 61, further comprising means for assigning the extra-site IPv6 address to the first IPv6 node in response to a request thereof, the binding cache entry created by the means for creating in response to the assigning of the extra-site IPv6 address.

65. The gateway of claim 64, wherein the means for assigning is configured for updating a Dynamic Name Server with the extra-site IPv6 address and a corresponding host name having been assigned to the IPv6 node, the Dynamic Name Server configured for providing the extra-site IPv6 address, to a node in the wide area network, in response to a corresponding query that requests a reachable address for the host name assigned to the IPv6 node.

66. The gateway of claim 61, wherein the secure connection is established as a secure tunnel between the gateway and the first IPv6 node.

67. The gateway of claim 61, wherein the means for forwarding is configured for:

first outputting the second packet into the prescribed site via a prescribed route based on the IPv6 address of the destination node specifying the first IPv6 address prefix; and

second outputting the second packet into the prescribed site via a second secure connection, established between the gateway and the destination node, based on the IPv6 address of the destination node specifying the second IPv6 address prefix.

68. The gateway of claim 67, wherein the means for forwarding further is configured for third outputting the second packet onto the wide area network based on the IPv6 address of the destination node specifying an address prefix distinct from any one of the first IPv6 address prefix and the second IPv6 address prefix.