INFRASTRUCTURE-LESS BOOTSTRAPPING: TRUSTLESS BOOTSTRAPPING TO ENABLE MOBILITY FOR MOBILE DEVICES

• US 20090144809A1
• Filed: 02/09/2009
• Published: 06/04/2009
• Est. Priority Date: 11/17/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Patel, Alpesh, Dommety, Gopal
• Granted Patent: US 8,584,207 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

Methods and apparatus for supporting a session in Mobile IP are disclosed. A Mobile Node sends a first Mobile IP message identifying the Mobile Node to a Home Agent, wherein the first Mobile IP message indicates to the Home Agent that the Mobile Node is requesting dynamic configuration of a Mobile-Home authentication key to be shared between the Mobile Node and the Home Agent during the session. A Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node is obtained or generated by the Mobile Node and the Home Agent, where the Mobile-Home authentication key is not valid after the session has ended or during another session. The Home Agent sends a second Mobile IP message to the Mobile Node, the second Mobile IP message including a lifetime associated with the session, wherein the lifetime indicates a lifetime of the key, thereby enabling the Mobile Node to register with the Home Agent using the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session.

Claims

1. In a Home Agent, a method of supporting a session in Mobile IP, comprising:

receiving a first Mobile IP message identifying a Mobile Node from the Mobile Node, wherein the first Mobile IP message indicates to the Home Agent that the Mobile Node is requesting dynamic configuration of a Mobile-Home authentication key to be shared between the Mobile Node and the Home Agent during the session;

obtaining a Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session from the first Mobile IP message or generating the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session, wherein the Mobile-Home authentication key is not valid after the session has ended or during another session; and

sending a second Mobile IP message identifying the Home Agent to the Mobile Node, the second Mobile IP message including a lifetime associated with the session, wherein the lifetime indicates a lifetime of the Mobile-Home authentication key, thereby enabling the Mobile Node to register with the Home Agent using a home address and the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session.

2. The method as recited in claim 1, further comprising:

associating the Mobile-Home authentication key with the Mobile Node and the lifetime.

3. The method as recited in claim 1, wherein the Mobile-Home authentication key is generated using information obtained from the first Mobile IP message.

4. The method as recited in claim 1, wherein the session is initiated when the Mobile Node boots up.

5. The method as recited in claim 1, wherein the session ends when the Mobile Node reboots.

6. The method as recited in claim 1, further comprising:

receiving a third Mobile IP message including the home address, the third Mobile IP message being a registration request or a binding update; and

sending a fourth Mobile IP message including the home address, the fourth Mobile IP message being a registration reply or a binding acknowledgement, wherein both the third and fourth Mobile IP message are protected by the Mobile-Home authentication key.

7. The method as recited in claim 6, wherein the third Mobile IP message requests an extension of the lifetime.

8. The method as recited in claim 1, wherein the first Mobile IP message is a registration request or a Binding Update, and the second Mobile IP message is a registration reply or a Binding Acknowledgement.

9. The method as recited in claim 1, wherein the session is identified by a session identifier in the first, second, third, and fourth Mobile IP message.

10. The method as recited in claim 1, wherein at least a portion of the first Mobile IP message and the second Mobile IP message are encrypted, wherein the at least a portion of the first Mobile IP message is encrypted using the Home Agent'"'"'s public key, the method further comprising:

decrypting the at least a portion of the first Mobile IP message using a private key of the Home Agent.

11. The method as recited in claim 10, wherein the portion of the first Mobile IP message includes a token generated by the Mobile Node to be used by the Home Agent to generate the Mobile-Home authentication key.

12. The method as recited in claim 10, the portion of the first Mobile IP message includes the Mobile-Home authentication key, wherein only the Mobile-Home authentication key is encrypted.

13. The method as recited in claim 10, wherein the second Mobile IP message is encrypted using the Mobile Node'"'"'s public key, the method further comprising:

encrypting the second Mobile IP message using the Mobile Node'"'"'s public key.

14. The method as recited in claim 13, wherein the Mobile Node'"'"'s public key is provided in the first Mobile IP message, the method further comprising:

obtaining the Mobile Node'"'"'s public key from the first Mobile IP message.

15. The method as recited in claim 1, wherein the first Mobile IP message includes the Mobile-Home authentication key, wherein only the Mobile-Home authentication key is encrypted.

16. The method as recited in claim 15, wherein the Mobile-Home authentication key is encrypted with the Home Agent'"'"'s public key.

17. The method as recited in claim 1, wherein the sending step is performed without authenticating the Mobile Node in Mobile IP.

18. The method as recited in claim 17, wherein the Mobile Node is not authenticated using a shared security association.

19. The method as recited in claim 17, wherein the Mobile Node is authenticated during layer 2 or layer 3 authentication prior to the receiving step.

20. The method as recited in claim 17, wherein the first Mobile IP message includes a Mobile Node identifier identifying the Mobile Node, wherein the Mobile Node identifier is not authenticated by the Home Agent.

21. The method as recited in claim 1, wherein the first Mobile IP message includes a suggested lifetime and wherein the lifetime provided in the second Mobile IP message is less than or equal to the suggested lifetime.

22. The method as recited in claim 1, wherein a body of the first Mobile IP message includes a source address provided in a header of the first Mobile IP message, the method further comprising:

determining whether the source address provided in the header of the first Mobile IP message is equal to the source address in the body of the first Mobile IP message.

23. The method as recited in claim 1, wherein the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node is provided in the first Mobile IP message and wherein obtaining the Mobile-Home authentication key comprises:

obtaining the Mobile-Home authentication key from the first Mobile IP message.

24. The method as recited in claim 1, wherein a token generated by the Mobile Node is provided in the first Mobile IP message and wherein obtaining the Mobile-Home authentication key comprises:

obtaining the token generated by the Mobile Node from the first Mobile IP message; and

generating the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node from the token.

25. The method as recited in claim 1, wherein the second Mobile IP message includes a token to be used by the Mobile Node for generating the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node.

26. In a Mobile Node, a method, comprising:

sending a first Mobile IP message identifying the Mobile Node to a Home Agent, wherein the first Mobile IP message indicates to the Home Agent that the Mobile Node is initiating dynamic configuration of a Mobile-Home authentication key to be shared between the Mobile Node and the Home Agent during a session;

receiving a second Mobile IP message identifying the Mobile Node from the Home Agent, the second Mobile IP message including a lifetime associated with the session, wherein the lifetime indicates a lifetime of the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node, thereby enabling the Mobile Node to register with the Home Agent using the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node, wherein the Mobile-Home authentication key is not valid after the session has ended or during another session; and

obtaining the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session from the second Mobile IP message or generating the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session.

27. The method as recited in claim 26, further comprising:

sending a third Mobile IP message including an IP address of the Home Agent, the third Mobile IP message being a registration request or a binding update and being secured by the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node; and

receiving a fourth Mobile IP message from the Home Agent, the fourth Mobile IP message being a registration reply or a binding acknowledgement, wherein the fourth Mobile IP message is protected by the Mobile-Home authentication key.

28. The method as recited in claim 26, further comprising:

generating the Mobile-Home authentication key using information obtained from the second Mobile IP message.

29. The method as recited in claim 26, wherein the session is initiated when the Mobile Node boots up.

30. The method as recited in claim 26, wherein the session ends when the Mobile Node reboots.

31. The method as recited in claim 27, wherein sending the third Mobile IP message is performed to extend the lifetime associated with the session and the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session.

32. The method as recited in claim 26, wherein the first Mobile IP message is a registration request or a Binding Update, and the second Mobile IP message is a registration reply or a Binding Acknowledgement.

33. The method as recited in claim 26, wherein at least a portion of the first Mobile IP message and the second Mobile IP message are encrypted, wherein the at least a portion of the first Mobile IP message is encrypted using the Home Agent'"'"'s public key, the method further comprising:

encrypting the at least a portion of the first Mobile IP message using the Home Agent'"'"'s public key.

34. The method as recited in claim 33, wherein the portion of the first Mobile IP message includes a token generated by the Mobile Node for use by the Home Agent in generating the Mobile-Home authentication key.

35. The method as recited in claim 33, the portion of the first Mobile IP message includes the Mobile-Home authentication key, wherein only the Mobile-Home authentication key is encrypted.

36. The method as recited in claim 33, wherein the second Mobile IP message is encrypted using the Mobile Node'"'"'s public key, the method further comprising:

decrypting the second Mobile IP message using the Mobile Node'"'"'s private key.

37. The method as recited in claim 36, wherein the Mobile Node'"'"'s public key is provided in the first Mobile IP message, the method further comprising:

providing the Mobile Node'"'"'s public key in the first Mobile IP message.

38. The method as recited in claim 26, wherein the first Mobile IP message includes the Mobile-Home authentication key, wherein only the Mobile-Home authentication key is encrypted.

39. The method as recited in claim 38, wherein the Mobile-Home authentication key is encrypted with the Home Agent'"'"'s public key.

40. The method as recited in claim 26, wherein the Mobile Node is not authenticated in Mobile IP.

41. The method as recited in claim 26, wherein the Mobile Node is not authenticated via a shared security association prior to obtaining the Mobile-Home authentication key.

42. The method as recited in claim 40, wherein the Mobile Node is authenticated during layer 2 or layer 3 authentication.

43. The method as recited in claim 26, wherein the first Mobile IP message includes a suggested lifetime and wherein the lifetime provided in the second Mobile IP message is less than or equal to the suggested lifetime.

44. The method as recited in claim 26, wherein the second Mobile IP message includes a token to be used by the Mobile Node for generating the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node, the method further comprising:

obtaining the token from the second Mobile IP message; and

generating the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node from the token.

45. A computer-readable medium storing thereon computer-readable instructions for supporting a session in Mobile IP in a Home Agent, comprising:

instructions for receiving a first Mobile IP message identifying a Mobile Node from the Mobile Node, wherein the first Mobile IP message indicates to the Home Agent that the Mobile Node is requesting dynamic configuration of a Mobile-Home authentication key to be shared between the Mobile Node and the Home Agent during the session;

instructions for obtaining a Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session from the first Mobile IP message or generating the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session, wherein the Mobile-Home authentication key is not valid after the session has ended or during another session;

instructions for sending a second Mobile IP message identifying the Home Agent to the Mobile Node, the second Mobile IP message including a lifetime associated with the session, wherein the lifetime indicates a lifetime of the Mobile-Home authentication key, thereby enabling the Mobile Node to register with the Home Agent using the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session.

46. A Home Agent adapted for supporting a session in Mobile IP, comprising:

means for receiving a first Mobile IP message identifying a Mobile Node from the Mobile Node, wherein the first Mobile IP message indicates to the Home Agent that the Mobile Node is requesting dynamic configuration of a Mobile-Home authentication key to be shared between the Mobile Node and the Home Agent during the session;

means for obtaining a Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session from the first Mobile IP message or generating the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session, wherein the Mobile-Home authentication key is not valid after the session has ended or during another session;

means for sending a second Mobile IP message identifying the Home Agent to the Mobile Node, the second Mobile IP message including a lifetime associated with the session, wherein the lifetime indicates a lifetime of the Mobile-Home authentication key, thereby enabling the Mobile Node to register with the Home Agent using the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session.

47. A Home Agent adapted for supporting a session in Mobile IP, comprising:

a processor; and

a memory, at least one of the processor and the memory being adapted for;

receiving a first Mobile IP message identifying a Mobile Node from the Mobile Node, wherein the first Mobile IP message indicates to the Home Agent that the Mobile Node is requesting dynamic configuration of a Mobile-Home authentication key to be shared between the Mobile Node and the Home Agent during the session;

obtaining a Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session from the first Mobile IP message or generating the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session, wherein the Mobile-Home authentication key is not valid after the session has ended or during another session;

sending a second Mobile IP message identifying the Home Agent to the Mobile Node, the second Mobile IP message including a lifetime associated with the session, wherein the lifetime indicates a lifetime of the Mobile-Home authentication key, thereby enabling the Mobile Node to register with the Home Agent using the Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node during the session.