System and method for assigning a mobile IP to a mobile node

Disclosed is a system providing a VPN service by connecting a VPN (virtual Private Network) to a mobile communication network. A home agent (HA) stores location information of a mobile node (MN) and information on whether the MN is registered in the VPN. A foreign agent (FA) transmits a location registration request message to the HA by receiving location registration information of the MN, and transmits data to an ISP (Internet Service Provider) router in the same subnet upon receiving a VPN service request. A server provides the VPN service and a router network connects the VPN to the FA. The router network includes a server for searching an edge IP router in the network using an address of the FA. The HA prevents an MN from accepting a call request received from a specific node in an IP network while the MN is performing a VPN service.

PRIORITY

This application claims priority to an application entitled “System and Method for Assigning Mobile IP to Mobile Node” filed in the Korean Industrial Property Office on Nov. 1, 2000 and assigned Ser. No. 2000-64643, the contents of which are hereby incorporated by reference.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to a system and method for assigning a mobile IP (Internet Protocol), and in particular, to a system and method for assigning a mobile IP to a mobile node.

2. Description of the Related Art

In general, a mobile node (MN) is used for a voice (circuit) call or a data service for its mobility. Further, due to its mobility, the mobile node is not limited to a single location. Therefore, a user of the mobile node can be provided with a data service, such as a mobile Internet service, even while moving from place to place.

Recently, active research has been carried out on a system and method for providing stable services. In order to provide a stable data service to the mobile node while securing the mobility, it is necessary to assign a mobile IP to the mobile node. To this end, a method for assigning a mobile IP to the mobile node is in development.

FIG. 1illustrates a network configuration for assigning a mobile IP to a mobile node. A network configuration and a location registration process for assigning a mobile IP to a mobile node will be described with reference toFIG. 1. A mobile node (MN)10transmits a location registration request signal to a foreign agent (FA)20, in an initialization process after power on or upon receipt of a location registration request signal. However, since the MN10has the mobility as stated above, the MN10, although it is registered in a Korea-based service provider, transmits the location registration request signal even in a non-registered country, for example, the United States. If a service agreement has been made between the mobile communication service providers, the location registration request is available. A detailed description of this will be given with reference toFIG. 1.

The MN10wirelessly sends a location registration request signal to the FA20. The FA20can detect an address of a home agent (HA)30included in the location registration request signal received from the MN10. Thus, the FA20performs location registration on the MN10in reply to the location registration request signal from the MN10. The FA20transmits a location registration request signal for the MN10to the HA30through a network25, along with an address of the FA20. The HA30then stores the address of the FA20where the MN10is located. That is, the HA30stores COA (Care-of-Address) of the FA20to which the MN10belongs. Thereafter, the HA30sends a location registration reply signal to the FA20in response to the location registration request signal received from the MN10through the FA20. Through this process, the location registration is performed on the MN10. The location of the MN10must be registered in the HA30, in order that the MN10might receive data from a correspondent node (CN)40. A description of the communication performed in the network will be made with reference toFIG. 2.

FIG. 2illustrates a network configuration for assigning a mobile IP to a mobile node. A description will be made of a process for exchanging data between the CN40and the MN10in the case when the location of the MN10has been registered in the HA30through the process ofFIG. 1. A network25abetween the FA20and the HA30, a network25bbetween the HA30and the CN40and a network25cbetween the FA20and the CN40can be identical to or different from one another. Herein, the networks will be assumed to be an IP network.

The CN40is a computer for transmitting data to an Internet server or the MN10. To transmit data to the MN10, the CN40sends the data to the HA30through the IP network25b. The HA30stores therein the address of the FA20where the MN10is located, then reads the address of the FA20and sends the data to the FA20through the IP network25a. The FA20then transmits the data to the MN10. The data transmitted to the MN10includes an address of the CN40. To transmit data to the CN40, the MN10sends data to the FA20. The FA20then transmits the data directly to the CN40without passing through the path of the FA20→the HA30→the CN40. This is because the MN10sends a data transmission request using a destination address. Therefore, the data transmission path is different from the data reception path.

Recently, as Internet service is used worldwide at a low service rate, communication networks tend to accommodate Internet service. Further, active research has been carried out on a private network capable of accommodating Internet service. Based upon this research, a study is being made on a virtual private network (VPN) in which service is not limited in location, and a method for assigning a mobile IP even in a non-registered area.

The private network can be divided into a dedicated WAN (Wide Area Network) and a dial network. The dedicated WAN connects one site to another site with a permanent line, while the dial network, such as a PSTN (Public Switched Telephone Network), connects a line through dialing when necessary.

A configuration of a network to which a VPN is connected through a router based on the IP, and a data exchanging process will be described with reference toFIG. 3. InFIG. 3, an IP backbone is connected to routers, and in particular, ISP (Internet Service Provider) routers120,130and140become edge routers to be connected to CPE (Customer Promise Equipment) routers150,160and170. IP tunnels are formed among the ISP routers120,130and140in the IP network100, to exchange data. In addition, stub links are formed between the ISP routers and the CPE routers. As occasion demands, a backup link is formed between CPE router160and the ISP router120, the routers existing in different locations, and a backdoor link is formed between the CPE routers150and170. Through the network configuration, the Internet service is provided and a voice call is performed.

However, since the network shown inFIG. 3is not interlinked with the network shown inFIG. 2, the MN10cannot be provided with the stable service. That is, when the MN10is registered in the VPN, it cannot be simultaneously applied to the VPN and the mobile communication network while maintaining its mobility. In other words, it is not easy to combine the network ofFIG. 2for performing the mobile service of the mobile communication network with a network ofFIG. 3for performing the IP service. In addition, although the networks are combined with each other, since the MN10has the mobility, it passes through different IP routers each time it moves. Therefore, the CPE routers must be modified, making it difficult to assign a mobile IP to the MN10. That is, although the MN10is simultaneously applied to the above-stated two networks, it is not possible to assign the mobile IP to the MN10to perform the Internet service.

SUMMARY OF THE INVENTION

It is, therefore, an object of the present invention to provide a system and method for assigning a mobile IP to an MN and exchanging data through an IP network.

It is another object of the present invention to provide a system and method for assigning a mobile IP to an MN while securing mobility, and stably exchanging data with an IP network through the assigned mobile IP.

It is further another object of the present invention to provide an apparatus and method for forming a virtual private network (VPN) through an IP network, and providing a service between an MN and the VPN.

To achieve the above and other objects, there is provided a system for providing a VPN service by connecting a VPN to a mobile communication network. A home agent (HA) stores location information of a mobile node (MN) and information on whether the MN is registered in the VPN. A foreign agent (FA) transmits a location registration request message to the HA by receiving location registration information of the MN, and transmits data to an ISP (Internet Service Provider) router in the same subnet upon receiving a VPN service request. A server provides the VPN service and a router network connects the VPN to the FA.

Preferably, the router network includes a server for searching an edge IP router in the network using an address of the FA.

Preferably, the HA prevents an MN from accepting a call request received from a specific node in an IP network while the MN is performing a VPN service.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

FIG. 4illustrates a network configuration for constructing a virtual private network (VPN) by assigning a mobile IP to a mobile node (MN) according to a preferred embodiment of the present invention. The network configuration and an operation of each node according to an embodiment of the present invention will be described with reference toFIG. 4.

Reference will first be made to an operation of a VPN service. The FA20recognizes presence of a first ISP router120located in the same subnet, and at the same time, the first ISP router120should also recognize the presence of the FA20. In this case, to receive the VPN service, the MN10sends a separate location registration request message for the VPN service to the HA30through the FA20. In the location registration process, the MN10specifically requests to be provided with the VPN service. Therefore, the invention defines a message format shown inFIG. 5to accommodate such data specified by the MN10.

FIG. 5illustrates a format of a location registration request message for the VPN service transmitted from the MN10according to an embodiment of the present invention. For the VPN location registration, the MN10should transmit an address of a VPN server50to the FA20. Upon receiving the address of the VPN server50, the FA20stores the received address therein, and at the same time, transmits a VPN service request message to the HA30, thus performing location registration.

In addition, upon receiving a location registration reply message from the HA30via the FA20, the MN10stores an ID of the VPN (VPN-ID) in its memory. Therefore, the MN10can transmit data using the VPN-ID. When the first ISP router120assigns a specific IP address for the VPN service, the MN10stores the assigned IP address instead of the mobile IP for future use.

Upon receiving the location registration request message for the VPN service ofFIG. 5from the MN10, the FA20detects a home address of the home agent from the received location registration request message and transmits the detected home address to the HA30. Further, upon receiving a location registration reply message from the HA30, the FA20stores the address temporarily assigned to the MN10and an address of the first ISP router120provided from the HA30. By doing so, it is possible to correctly deliver the data transmitted from/to the MN10. Further, the FA20separately transmits the data provided from the CN40connected to the Internet and the VPN service data to the MN10.

Upon receiving data from the MN10, the FA20determines whether the received data is VPN service data or data to be transmitted to another CN in the Internet. As the result of the determination, if the received data is data to be transmitted to another CN in the Internet, the FA20transmits the received data to the corresponding CN. Otherwise, if the received data is the VPN service data, the FA20transmits the received data to the first router120to perform the VPN service.

When the HA30initially receives information on the MN10, it registers the VPN service desired by the MN10. That is, the MN may request or not request the VPN service. If the MN10requests two different VPN services, the HA30stores the corresponding data. In addition, if the MN10desires the VPN service, it stores the data along with an address of an ISP router connected to a server processing the VPN service. This data is stored at a time when the user purchases the MN or when he or she is first provided with the VPN service. Shown in Table 1 is an example of a data format stored in the HA30according to the present invention, when the MN10is registered in one VPN service.

As shown in Table 1, the HA30must have an MIN (Mobile Identification Number) of the MN10, a mobile IP, a VPN address and an FA address where the registered location of the MN10is to be stored.

In addition, upon receiving a location registration request message from the MN10, the HA30transmits the received location registration request message to a second ISP router140performing the VPN service, using the VPN address of Table 1. Based on location information of the MN10, the second ISP router140can determine the ISP router in an area where the MN10is located. This process will be described in more detail when a description of the second ISP router140and an ISP server180is made.

Upon receiving the location registration request message for the VPN service from the MN10, the HA30sends a service availability inquiry message inquiring whether the service is available, to the second ISP router140. The second ISP router140sends the received message to the VPN server50(a server providing the VPN service) via the CPE router160. The VPN server50determines whether the VPN service is available, creates a message as illustrated inFIG. 6according to the determined results, and then transmits the created message to the HA30through the CPE router160and the second ISP router140.

FIG. 6illustrates a message format used by the VPN server50in informing the HA30whether the VPN service is available. As illustrated in FIG.6, the message is comprised of a VPN-ID for performing the VPN service, an address of the second ISP router140connected to the VPN server50, and a specific address to be used by the MN10during the VPN service. Upon receiving this message, the HA30creates a location registration reply message and transmits the created location registration reply message to the MN10via the FA20along with the received message.

Further, upon receiving a location registration request message from the MN10via the FA20, the HA30transmits a message ofFIG. 7to the second ISP router140, an edge ISP router of the VPN server50performing the VPN service.

FIG. 7illustrates a message format created by the HA30to transmit a received VPN service request to the VPN server50. Referring toFIG. 7, the message includes an authentication lifetime, a mobile node address of the MN10, and a care-of-address (COA) of the FA20where the MN10is located. The message further includes an identification (ID) for exchanging signaling with the second ISP router140intervening between the HA30and the VPN server50.

Further, upon receiving a VPN service reply signal ofFIG. 6from the second ISP router140, the HA30includes the received signal in the message ofFIG. 6and transmits the message to the FA20along with the location registration reply message. While the MN10is performing the VPN service after the location registration, the HA30cannot accommodate the Internet service.

A message for determining whether the VPN service is available can be added to the location registration reply message, as shown inFIG. 6. As illustrated inFIG. 6, the message includes a message type, a VPN-ID, an address for the VPN service, and an edge ISP router address. The edge ISP router corresponds to the second ISP router140ofFIG. 4.

If the VPN service is available, the HA30periodically transmits the message so that the routers may update the lifetime when the MN10maintains the same FA20. In this way, the routers continuously maintain information on the edge router where the MN10is located. If such a signal fails to arrive until an update time, the routers delete the data.

When the MN10is initially registered in the HA30to be provided with the VPN service, the VPN server50receives information on the MN10from the HA30and stores the received information along with the address of the HA30. Such information should be updated periodically. Therefore, the VPN server50authenticates whether the VPN service is available, using the IP address of the MN included in the message received from the HA30. If it is authenticated that the VPN service is available, the second ISP router140transmits a message for searching the first ISP router120to the ISP server180, based on the address of the FA20where the MN10is located, received from the HA30.

This message is shown inFIG. 8, and comprised of a message type, an authentication lifetime, a mobile node address of the MN10(or an address of the FA20), a COA associated with the mobile node address, and an address of the second ISP router140. InFIG. 8, an identification field is used to determine whether a reply is received from the ISP server180.

If there is no reply from the routers in the IP network within the authentication lifetime, the ISP server180transmits a message ofFIG. 9to the HA30to inform that there is no ISP router in the corresponding area. Even when informed of the absence of the ISP router by the ISP server180, the HA30transmits the message ofFIG. 9in the same manner. Unlike this, even when an authentication message is received, the ISP server180transmits the message ofFIG. 9to the HA30. In this case, however, code information is changed. That is, when all of the code bits ofFIG. 9are set to ‘0’, it means that there is no ISP server. However, when the code has a specific value, it indicates an IP router having the specific value. In addition, a VPN lifetime field ofFIG. 9indicates that information on the MN10is maintained only for the lifetime. Therefore, the ISP routers should update the lifetime by periods. To this end, the HA30periodically transmits the message to the ISP routers, as stated above.

In addition, the specific address for the VPN service indicates an address to be used when performing the VPN service. This field is filled with corresponding data when the second ISP router140is required. That is, it is optional whether to fill this field with data.

The ISP server180has information on every ISP router. That is, when ISP routers operated by different service is provided in a specific area, the ISP server180should manage information on all of these ISP routers. This is because there is a case where the MN10belongs to the ISP router providing the VPN service when a specific VPN is used. In addition, since the ISP router does not recognize an ISP router of another service provider, the ISP server180should previously recognize all of the ISP routers operated by other service providers. Therefore, although the MN10moves to a certain area, the ISP server180connects with the ISP router in the area for the VPN service.

That is, the ISP server180analyzes the COA of the message received from the second ISP router140, and provides the analyzed results to the ISP router in the corresponding area. The ISP server180transmits the analyzed results along with information indicating that the MN10having the address of the HA30desires the VPN service. In this way, the ISP server180transmits the message received from the second ISP router140to the first ISP router120. In addition, when the MN10is not registered in the ISP server180, the ISP server180should assemble a message ofFIG. 10and transmit the message to the ISP router. The message shown inFIG. 10is comprised of the above-stated fields, so the detailed description will not be provided.

The first ISP router120registers the MN10using the received message, to perform the normal service upon receipt of the VPN data. After registering the MN10, the first ISP router120sends an authentication reply message to the second ISP router140. The authentication reply message is assembled as illustrated inFIG. 11. In the message ofFIG. 11, a code field indicates the contents of a normal or abnormal operation. Upon receiving this message, the first ISP router120also maintains information on the MN10only for the VPN lifetime. If the VPN lifetime value is ‘0’, it means that the MN10has moved to another area. Therefore, like the second ISP router140, the first ISP router120should update the VPN lifetime periodically while performing the VPN service.

When the signaling between the first ISP router120and the second ISP router140is normally completed, an IP tunnel is formed, for exchanging data between the two ISP routers.

FIG. 12illustrates a signal flow at each node upon receipt of a VPN service request from the MN10according to a preferred embodiment of the present invention. Referring toFIG. 12, in step200, the MN10transmits a location registration request message for the VPN service to the FA20. The location registration request message is transmitted along with an address of the VPN server50and an address of the HA30. The FA20then detects the address of the HA30from the received location registration request message, and sends a location registration request for the VPN service to the HA30in step202. The HA30then detects a location of the MN10. That is, the HA30stores the address of the FA20where the MN10is located. Thereafter, in step204, the HA30reads the data previously stored as illustrated in Table 1, and transmits a service availability inquiry signal to the second ISP router140corresponding to the address of the VPN server50. Upon receiving the service availability inquiry signal, the second ISP router140transmits the service availability inquiry signal to the CPE router160connected through the stub link in step206. The CPE router160then transmits the service availability inquiry signal to the VPN server50in step208. Upon receiving the service availability inquiry signal, the VPN server50determines whether the VPN service is available, and then transmits a service availability confirm signal to the CPE router160according to the determined results in step210. Thereafter, the CPE router160transmits the service availability confirm signal to the second ISP router140in step212, and the second ISP router140transmits again the service availability confirm signal to the HA30in step214. In this way, the HA30can determine whether the VPN service is available. Therefore, the HA30registers a state of the MN10as a VPN service state upon receipt of the location registration request signal. In this case, the service from the CN40is unavailable. That is, the Internet service is unavailable. In addition, upon failure to receive a reply within the authentication lifetime, the HA30determines that the VPN service is unavailable. Otherwise, upon receipt of a reply within the authentication lifetime, the HA30analyzes the received signal to determine whether VPN service is available. If it is not possible to perform the normal VPN service, the HA30informs the MN10of unavailability of the VPN service.

If the VPN service is available, the HA30transmits a location registration reply signal to the FA20in step216, and at this time, the location registration request message can be transmitted along with the address of the VPN server50, the address of the second ISP router140, and the temporary VPN-ID for the case where the MN10is provided with the VPN service. Upon receiving the location registration reply signal, the FA20transmits the location registration reply message to the MN10in step218, completing the location registration process in which the MN10performs the VPN service.

FIG. 13illustrates a location registration request process for the VPN service performed by the MN10according to an embodiment of the present invention. Referring toFIG. 13, if a specific key is input (pressed) in a suspended state of step300, the MN10determines in step302whether the key input signal is a location registration request signal for the VPN service. If the key input signal is the location registration request signal for the VPN service, the MN10proceeds to step306. Otherwise, the MN10proceeds to step304where it performs a function corresponding to the key input signal. The MN10creates a location registration request message for the VPN service in step306, and then transmits the created location registration request message for the VPN service to the FA20in step308. At the same time, the MN10creates an address of the HA30and an address of the VPN server50, and transmits the created addresses along with the location registration request message for the VPN service. The MN10awaits a location registration reply signal in step310, and determines in step312whether the location registration reply signal is received. Upon receiving the location registration reply signal in step312, the MN10detects a VPN-ID from the received location registration reply message and stores the VPN-ID in step314. When the location registration reply signal includes an address of the ISP router, the MN10stores the VPN-ID along with the address of the ISP router. That is, the MN10stores an address of the second ISP router140shown inFIG. 4along with the VPN-ID, which is to be used temporarily. In step316, the MN10enters a VPN service mode.

FIG. 14illustrates a process for receiving the location registration request signal for the VPN service from the MN10at the FA20according to an embodiment of the present invention. Referring toFIG. 14, the FA20maintains the suspended state in step320, and determines in step322whether the location registration request signal for the VPN service is received from the MN10. Upon receiving the location registration request signal for the VPN service, the FA20detects the address of the HA30from the received location registration request signal, creates a location registration request message for the VPN service, and transmits the crated location registration request message for the VPN service to the detected address of the HA30, in step324. If the location registration request signal received from the MN10includes the address of the VPN server50, the FA20transmits the location registration request message for the VPN service along with the address of the VPN server50. Further, the FA20transmits its address information to the HA30along with the location registration request message for the VPN service. The FA20awaits arrival of a location registration reply signal for the VPN service from the HA30in step326, and determines in step328whether the location registration reply signal for the VPN service is receive from the HA30. Upon receiving the location registration reply signal for the VPN service, the FA20stores the address of the second ISP router140connected to the VPN server50and activates a timer set to a specific time, in step330. The timer is used to limit a time period for which the MN10is registered in the FA20. In step332, the FA20transmits VPN access data and the location registration reply signal to the MN10. The VPN access data transmitted to the MN10includes the whole data received from the HA30. In step334, the FA20enters the VPN service mode for the MN10.

FIG. 15illustrates a process for receiving the location registration request signal for the VPN service from the MN10at the HA30according to an embodiment of the present invention. Referring toFIG. 15, the HA30maintains the suspended state in step340, and determines in step342whether the location registration request signal for the VPN service is received from the FA20. Upon receiving the location registration request signal for the VPN service, the HA30stores the address of the FA20where the MN10is located, in step344. That is, the HA30stores the address of the FA20included in the message transmitted from the FA20in step324ofFIG. 14. In step346, the HA30creates a service availability inquiry message for inquiring whether a service to the second ISP router140connected to the VPN server50is available, and transmits the created service availability inquiry message to the second ISP router140. The created service availability inquiry message includes the address of the FA20and the data from the MN10.

After transmitting the service availability inquiry message, the HA30awaits a service availability confirm signal in step348, and determines in step350whether the service availability confirm signal is received from the VPN server50. Upon receiving the service availability confirm signal from the VPN server50, the HA30analyzes the received service availability confirm signal in step352, and then determines in step354whether the VPN service is available. As the result of the message analysis, if the VPN service is available, the HA30proceeds to step356. Otherwise, if the VPN service is unavailable, the HA30transmits a VPN service unavailability message to the FA20in step355. When transmitting the VPN service unavailability message, the HA30does not register the VPN service. In step356, the HA30creates a VPN service availability message and transmits the created VPN service availability message to the FA20. The VPN service availability message is transmitted along with the address of the second ISP router140. In step358, the HA30activates a timer and enters the VPN service mode. In the VPN service mode, the HA30blocks the data received from the CN40, which is another Internet terminal or a server. Activating the timer is to set a time period for which the MN10is located in the FA20. It is optional whether to activate the timer. That is, it is also possible not to activate the timer.

FIG. 16illustrates an operation of the VPN server50performed in reply to the VPN service request from the MN10according to an embodiment of the present invention. Referring toFIG. 16, the VPN server50maintains the suspended state in step360, and determines in step362whether the VPN service availability confirm signal is received. Upon receiving the VPN service availability confirm signal, the VPN server50analyzes the received VPN service availability confirm signal in step364, and then determines in step366whether the MN10is a registered MN and the current system can accommodate the VPN service. That is, the VPN server50determines whether the MN10can perform the VPN service. As the result of the analysis, if the VPN service is available, the VPN server50detects an FA address from the received VPN service availability confirm signal, stores the detected FA address, and activates a timer for limiting a time period required for storing the FA address, in step368. Optionally, the timer can be included or not included in the VPN server50. In step370, the VPN server50creates a VPN service availability confirm message and transmits the created VPN service availability confirm message. In step372, the VPN server50transitions to a VPN service state where it can perform the VPN service on the MN10. However, if the VPN service is unavailable in step366, the VPN server50jumps to step370. In an alternative embodiment, however, if the VPN service is unavailable, the VPN server50may avoid transmitting the VPN service availability confirm message. In this case, upon failure to receive a reply signal within a predetermined time, the HA30can consider that the VPN service is unavailable.

FIG. 17illustrates a signal flow at each mode in the case where the MN10requests the VPN service. Referring toFIG. 17, if the MN10sends a call origination request to the FA20in step220, the FA20determines whether the call origination request is a VPN service request. As the result of the determination, if the call origination request is the VPN service request, the FA20transmits an access request signal to the HA30through the first ISP router120, in step222. At the same time, the FA20transmits the call origination signal to the first ISP router120along with an address of the second ISP router140as well as a VPN-ID of the MN10and an address of the VPN server50. The first ISP router120then transmits an access request signal to the VPN server50through the second ISP router140, using the address of the second ISP router140. Upon receiving the access request signal to the VPN server50from the HA30in step224, the second ISP router140transmits the access request signal to the CPE router160in step226. The CPE router160then transmits the access request signal to the VPN server50in step228. Through this process, the access request signal is transmitted to the VPN server50.

The VPN server50then determines whether the service is accessible. If the service is accessible, the VPN server50transmits an access reply signal to the CPE router160in step230. The CPE router160transmits the access reply signal to the second ISP router140in step232. Since the second ISP router140has received data from the first ISP router120, it forms an IP tunnel and transmits the access reply signal through the IP tunnel in step234. The first ISP router120then transmits the access reply signal to the FA20in response to the received access reply signal, in step236. Upon receiving the access reply signal in this process, the FA20establishes a channel to the MN10in step238. When the channel is established, the VPN access state is maintained in step240.

FIG. 18illustrates an operation of the MN10in the VPN service mode after VPN location registration according to an embodiment of the present invention. Referring toFIG. 18, the MN10maintains the suspended state in step400, and determines in step402whether a call origination request for the VPN service is received. Upon receiving the call origination request for the VPN service, the MN10transmits a call origination request signal using the VPN-ID received in the location registration process, in step404. At this moment, the MN10creates data of the second ISP router140and information on the VPN server50, and transmits the created data along with the call origination request signal. The MN10determines in step406whether a channel is established. As the result of the determination, if the channel is established, the MN10exchanges data using the VPN-ID, in step410. That is, the MN10performs the VPN service. However, if the channel is not established, the MN10performs a call failure process in step408. In an alternative embodiment, if the channel is established after an authentication signal is received, the MN10establishes the channel after the authentication process.

However, upon failure to receive the call origination request in step402, the MN10determines in step412whether a termination call is received. Upon receiving a termination call, the MN10performs a call termination mode in step414, since the current state is registered in the VPN service. However, upon failure to receive the termination call in step412, the MN10determines in step416whether a VPN service end request is received. Upon receiving the VPN service end request, the MN10performs a VPN service end process in step418. The VPN service end process can be implemented by creating a general location registration message to re-perform the location registration or defining a VPN withdraw message. As a result, the HA30can enter an Internet service mode by releasing the VPN service mode.

FIG. 19illustrates a process for receiving the call origination request for the VPN service from the MN10at the FA20in the VPN service mode according to an embodiment of the present invention. Referring toFIG. 19, the FA20maintains the suspended state in step420, and determines in step422whether a call origination request signal is received from the MN10. Upon receiving the call origination request signal, the FA20analyzes the received call origination request signal in step424. In this state, if the MN10is registered in the VPN service, the FA20proceeds to step426. However, if the MN10is not registered in the VPN service, the FA20analyzes the type of the requested service and sends the results to the HA30, performing the process beginning at the service request step. In the following description, it will be assumed that the MN10is registered in the VPN service. If the received service request is a VPN service request, the FA20processes to step430. Otherwise, the FA20proceeds to step428where it performs a VPN service failure process. In step430, the FA20transmits the service request signal to the first ISP router120. At this moment, the FA20transmits an address of the VPN server50and an address of the second ISP router140, stored during the VPN location registration, along with the service request signal.

After transmitting the service request signal, the FA20awaits arrival of a reply signal from the VPN server50in step432. Though not illustrated inFIG. 19, upon failure to receive the reply signal within a predetermined time, the FA20can perform a failure process. The FA20determines in step434whether the reply signal is received. Upon receiving the reply signal, the FA20determines in step436whether the VPN service is available. That is, the FA20analyzes the received message and determines whether the message is received in a serviceable state. As the result of the analysis, if the received message is serviceable, the FA20proceeds to step440, and otherwise, proceeds to step438. In step438, the FA20informs the MN10of a service failure.

In step440, the FA20establishes a channel, i.e., connects a channel for the VPN service, thus forming a channel for data exchange between the FA20and the MN10. In step442, the FA20enters the VPN access mode in which the FA20transmits the data received from the MN10to the VPN server50and transmits the data received from the VPN server50to the MN10.

FIG. 20illustrates a signal flow at each node in the case where a call access request is transmitted from the VPN server50to the MN10after the VPN location registration, according to an embodiment of the present invention. Referring toFIG. 20, the VPN server50sends an access (or connection) request signal to the CPE router160in order to send a location registration request to the MN10, which has performed the VPN location registration. Thus, the VPN server50recognizes an address of the FA20. Therefore, the access request signal includes a temporarily assigned VPN-ID of the MN10, an MIN of the MN10and the address of the FA20. Upon receiving the access request signal, the CPE router160transmits the received access request signal to the second ISP router140, an edge ISP router in the same network, in order to transmit data to the IP network.

Upon receiving the access request signal, the second ISP router140sends a router check request to the ISP server180in step254, in order to search an ISP router of the IP network where the FA20is located. In this case, the address transmitted from the second ISP router140to the ISP server180becomes the address of the FA20. The ISP server180then checks an address of the first ISP router120using the address of the FA20, and sends the checked address of the first ISP router120to the second ISP router140in step256. The second ISP router140transmits an access request signal to the first ISP router120using the received checked address, in step258.

The transmitted access request signal can include such data as an address of the FA20, a VPN-ID of the MN10and an MIN of the MN10. The first ISP router120transmits a call termination request signal to the FA20using the address of the FA20among the received data, in step260. The FA20then sends a call termination signal to the MN10in step262. If a user of the MN10inputs a specific key in response to the call termination signal, i.e., answers the termination call, then the MN10sends a reply signal to the FA20in step264. The FA20then transmits an access confirm signal to the first ISP router120in step266. The first ISP router120then transmits an access confirm signal to the second ISP router140in step268. Through this process, an IP tunnel is formed between the first ISP router120and the second ISP router140. In step270, the second ISP router140sends the received access confirm signal to the CPE router160. In step272, the CPE router160sends the access confirm signal to the VPN server50. Through this process, a channel for data exchange between the VPN server50and the MN10is formed. When the channel is established, the VPN access state is maintained in step274.

As described above, the present invention performs the VPN service by assigning a mobile IP to a mobile node (MN). In addition, it is also possible for the VPN network to accommodate the MN.