Methods and apparatus for aggregating MIP and AAA messages

Aggregated signaling methods and apparatus which can be used to support the aggregation of Mobile IP binding registration information corresponding to multiple forwarding tunnels are described. Aggregated binding update message are used to enable multiple home addresses from one or more home agents to be installed, refreshed and deleted using a single MIP signaling phase. The single MIP signaling phase may correspond to a single MIP binding update message. Aggregated message techniques can also be used to retrieve multiple home address specific policy profiles via AAA signaling thereby reducing the number of AAA messages required to retrieve AAA information, e.g., profiles, corresponding to multiple home addresses.

FIELD OF THE INVENTION

The present invention is directed to methods and apparatus for supporting mobile communications and, more specifically, to methods and apparatus for using aggregated binding update messages and aggregated authentication, authorization and/or accounting messages to reduce message signaling in a mobile communications system.

BACKGROUND

Mobile IP (IETF RFC2002) enables a moving Internet host to connect to a Foreign Agent (FA) access router in a foreign network, yet still be contactable on its persistent Host Home Address (HoA) that it uses on its home network and is likely included in the DNS (Domain Name Server) system. This is possible because the FA gives the host a temporary local address that is either unique to the host e.g., a Co-located Care of Address (CCoA), or is unique to the FA, e.g., a Care of Address (CoA). In an exemplary scenario, the FA registers its CoA into the Home Agent (HA) for the HoA address of its attached Mobile Node (MN) which corresponds to a user, e.g., a Caller. The HA then tunnels packets addressed to HoA of Caller to the Care of Address (CoA) of the FA. The FA forwards packets received from the MN HoA out to the Internet as normal. The Caller needs a Security Association (SA) with the HA and the FA, whilst the FA has a Security Association with the HA, to allow the signaling to be authenticated and potentially encrypted.

During a hand-off, the new FA changes the binding in the HA for the HoA to now map to the new CoA of the new FA. Complexity and problems arise when multiple network regions are involved in a hand-off, e.g., because an end node is outside its home network region requiring signals to be communicated from one region to another so that a mobile node's Home Agent can be informed of the information, e.g., address information, needed to reach the mobile node in the foreign network region. For policy and other reasons local and remote network access may be handled differently particularly when a mobile node is in a foreign region. The need, in many cases, to treat local and remote packet forwarding operations differently further complicates matters in regard to updating of forwarding information included in various network nodes.

FIG. 1shows prior art MIP signaling between a first node140and a second node150. A MIP Registration Request/Binding Update (RREQ/BU) message180is sent between the first node140and the second node150to install a binding in the second node that contains a mapping between the home address of an end node and the Care of Address of that end node. The home address is allocated to the end node out of an address prefix assigned to a home agent of the end node. The registration enables the second node150/first node140to redirect packets addressed to the home address of the end node, between the second node150/first node140and the first node140/second node150as indicated by bi-directional IP packet flows for HoA1182. The registration request message180has a MIP Registration Response/Binding Update Acknowledgement (RREP/BUack) message181which confirms that the binding has been installed and reports the nature of any errors. Messages180and181are specific to the Home address 1 (HoA1) of the end node from the home agent 1 (HA1) to be mapped to the CoA of the end node. Therefore, a different RREQ/BU message184and a different RREP/BUack message185are required to install the binding for home address 2 (HoA2) of the end node from home agent 1 (HA1) to be mapped to the CoA of the end node, so creating bi-directional IP packet flows for HoA2186between first node140and second node150. Similarly, a RREQ/BU messages187and a RREP/BUack message188are required to install the binding for home address 3 (HoA3) of the end node from home agent 2 (HA2) to be mapped to the CoA of the end node, so creating bi-directional IP packet flows for HoA3189between first node140and second node150. The first node140may be any of an end node, an access node containing a MIP agent such as a foreign agent or attendant, whilst the second node150can be an access node containing a MIP agent such as a foreign agent or attendant, or it may be a MIP home agent. It may be seen fromFIG. 1that when the end node has multiple home addresses that a significant amount of signaling is required to install and manage the bindings for an end node, especially during hand-off between access nodes.

FIG. 3shows detailed contents380of a prior art MIP registration message380, such as, for example message180or message181ofFIG. 1. Message380includes a home agent address (HA1)381, a single home address 1 (HoA1)382with a first prefix382athat is allocated to and routable through the home agent using address381. The message further includes a CoA of the end node383which is mapped with the home address382in a MIP binding. Finally, the prior art message includes MIP signaling fields384that contains additional signaling information such as flags, sequence numbers, security and prior art MIP extension fields etc used for correct operation of the signaling instance and to describe the type of processing and forwarding to be established for the binding between the home address382and the CoA383in a MIP mobility agent such as a home or foreign agent. Note that during an initial registration phase, the home address and home agent addresses may be undefined to indicate that the AAA system should dynamically allocate a home agent to the end node, and the AAA system or home agent should allocate a home address to the end node from a prefix at that home agent. Known MIP registration message do not include more than a single HoA.

For the purposes of the description, an address is associated with an address prefix of N bit length if that N Most Significant Bits of the prefix and that address are the same. In addition, whilst a single MIP signaling instance is already able to manage the allocation of multiple home addresses from a single Home Agent, this is only possible if those addresses are defined as a single subprefix of length M bits out of an N bit prefix managed by the Home Agent (where N<=M). Non-congruent addresses cannot be supported and specifically a single MIP signaling instance cannot manage home addresses from different Home Agent prefixes, nor in fact from different prefixes at different Home Agents.

Therefore, existing Mobile IP (MIP) does not provide efficient support for multiple Home addresses, to support say both remote and local models concurrently via the use of two different Home addresses so that, e.g., a user can roam the Internet through the use of local access while in a foreign network region and also get corporate/home access at the same time via the use of remote access to the user's home network region. The need for this kind of duality has been seen previously, for example, on DSL Digital Subscriber Line access networks, so the requirement is not new. For example, a user might wish for either component to be started or dropped at any time and with full policy control by both the foreign and home operators as to what is allowed. The MN could then use an address (HoA) associated with the particular mobile which corresponds to the mobile's Home Agent node, an address (RoA) associated with the particular mobile that corresponds to the mobile's Regional Agent (RA) node in combination with packet source address information to select on a flow by flow basis to route packets and hence control connectivity features (location visibility, identity visibility and routing policy) for each users IP ‘session’ independently.

In order to support different routing and treatment for different IP sessions or applications, e.g., corresponding to remote and local access, running on a mobile node, it may be necessary to run multiple instances of MIP on the mobie resulting in multiple HoA's being assigned to the same mobile and, using existing signaling, requiring at least one MIP registration message for each HoA corresponding to a mobile. This has the unfortunate effect of resulting in multiple MIP registration update messages having to be sent by a mobile, e.g., one per HoA or RoA being used, when a hand-off occurs. Multiple MIP registration messages can have the unfortunate consequence of consuming bandwidth and signaling resources that might otherwise be used.

FIG. 5shows a prior art binding table580in a mobility agent. A separate MIP signaling instance, e.g., MIP registration request message and reply, is used to update or create a single entry in the binding table580. The table580has entries for a multitude of end nodes such as Mobile Node X581and Mobile Node Y582. In the case of MN X which has three home addresses HoA1587, HoA2591and HoA 3595, the prior art signaling creates a binding entry for each MIP signaling instance and hence for each HA/HoA address pair. Entry583contains HA1586, HoA1587, MN X CoA588and MIP signaling state589associated with that signaling instance. Entry584contains HA1590, HoA2591, MN X CoA592and MIP signaling state593associated with that signaling instance. Thus, for each HA, HoA pair, there is a separate entry583,584,585resulting in similar information being stored multiple times in the memory used to implement the binding table. Entry585contains HA2594, HoA3595, MN X CoA596and MIP signaling state597associated with that signaling instance. It is clear that CoAs588,592and596have the same value, that being the CoA of the MN X, and HAs586and590contains the same HA address. Further, if the forwarding and security requirements, of the MN X, is the same for each binding entry, then the signaling state589,593and597is highly correlated and can be exactly the same through appropriate use of common lifetimes, security associations and sequence numbers. Therefore there is the potential for large amounts of redundancy in the stored state that implies inefficient storage and associated messaging.

FIG. 7shows prior art AAA signaling between an access node740and a AAA server750that is triggered by the arrival of a connect message such as a MIP Registration message at the access node740. The AAA signaling is used to authenticate an end node for connection to the access node740, and to authorize a set of communications services for the end node at that access node740, and potentially a plurality of additional access nodes, as defined by an end node profile associated with the home address of an end node. The end node profile is stored in the access node740and used to configure and policy communication facilities at that access node740. A AAA request message760is sent from access node740to AAA server750and contains the end node identity such as a MN X Network Access Identifier (NAI)761which also used to route the AAA request to the home AAA server of the end node. The message760will also contain MIP AAA request state used to request dynamic allocation of HA, HoA and security associations for the MIP service. The AAA request message760may also contain HA1 address763and HoA1 address764if the MN X has multiple profiles, each associated with a specific HA/HoA pair. HA1 address763and HoA1 address764can alternatively contain requirements on the AAA server for the dynamic allocation of a HA1 and/or a HoA1, such as address types and location to ensure the appropriate connectivity and communications facilities become available to the MN X. A AAA response message770will then contain the MN X identity NAI761to ensure that the returned state is installed for the correct MN X. Dynamically assigned HA1 address772and HoA1 address773will also be returned but may, especially in the case of statically allocated HA and HoA addresses, be returned in the MN X profile for HoA1775, along with the configuration and other policy state. Finally, the message770will typically include other MIP AAA response state774such as dynamically allocated security associations. Now when MN X has multiple HoAs 1, 2 and even 3, then the address are from different address prefixes (same or different Home agents) and therefore represent different connectivity and hence reachability for communciations services, which is essentially the motivation for a MN X having such multiple Home addresses. HoA1 might be from a public Internet service provider whilst HoA 2 might be from a corporate network connected to the same network operator, and hence potentially reachable via a common Home agent HA1. HoA3 in contrast might be from a third party content provider that is not part of the common network operator for HoA1/2 and hence is reachable via a second Home agent HA2. In these cases, it is clear that different reachability is likely to be associated with different MN X profiles for each HoA. Therefore, the prior art AAA signaling will require additional AAA Request message780and AAA Response message781to fetch the dynamic configuration and MN X profile for HoA2 , and a third set of messages782and783to fetch the state for HoA3. Clearly, if the AAA server is common for all three AAA signaling instances, and part of the MN X profile state is common to more than a single HoA, then this approach is inefficient in storage and signaling bandwidth.

In light of the above discussion, it is clear that a better and more efficient method with supporting apparatus is needed to provide efficient support for multiple Home Addresses in MIP signaling.

SUMMARY OF THE INVENTION

In accordance with the invention, mobile node functionality is enhanced by supporting multiple parallel instances of MIP in a single mobile node. This allows local and remote access to be treated differently allowing for greater flexibility in network system policy, accounting, security and other issues that arise when a mobile node operates in a visited network region, e.g., foreign domain. While in a visited region, e.g., a foreign domain, local access refers to access within the visited region or domain. This may involve sending packets to, or receiving packets from, another end node located in the visited network region. Remote access may involve a mobile node in a visited network region accessing or exchanging packets with one or more nodes in the mobile node's home network region. In accordance with the present invention, this can be accomplished by running a separate instance of MIP in the mobile to deal with remote access separately from local access.

Thus, in accordance with the invention a mobile node may run parallel instances of MIP, one for each Home address. One instance used for local access may use a local HA (Home Agent) and HoA (Home Address), e.g., HA1 and HoA1. Remote Access may be supported via another, e.g., remote HA and a remote HoA, e.g., HA2 and HoA2. This gives the mobile node independent control of each MIP instance and its particular standard MIP features such as reverse tunneling, broadcasting etc, and can select between the two instances on a per IP session basis using source address selection. The distinct connectivity planes are both exposed to the local operator who can now manage and account both services. Either plane can be dropped and added as desired although a degree of persistence in the local configuration is desirable to avoid thrashing the AAA system and MIP signalling plane.

However, without various signaling improvements to MIP which are taught in the present application, the problems with this model can be severe in terms of the amount of MIP signaling which may occur, particularly as the number of parallel instances of MIP on individual mobile devices increases.

Absent various features of the invention, ultiple, e.g., independent, parallel MIP instances in the mobile naturally implies at least double the signaling, hand-off processing, security associations and management load due to two or more independent MIP instances, particularly where there is no or only partial integration of the AAA (Authentication, Authorization and Accounting) data for each instance. The more HoAs a MN has then the worse the hand-off overhead and complexity becomes.
Using separate MIP signals as opposed to aggregated signals, each HoA specific hand-off may complete at significantly different times (out of phase) with each other and the local HA hand-off due to the different hand-off paths resulting in complex FA and MN state management. Normally local hand-off signaling can be completed before remote region hand-off signaling completes due to shorter path lengths relative to the mobile node and the network nodes which are updated. This can result in slow hand-off and chained FAs out of step with the local hand-off. A regional mobility agent can be deployed locally, e.g., in the visited region, in accordance with one feature or the invention provide the necessary localization for the remote access MIP hand-off.
Some ways of addressing some of the problems discussed above associated with multiple Home Addresses in MIP signaling, in accordance with various features of the invention, include:a) A single phase of AAA exchanges through the foreign and home AAA servers that is used to configure both local and remote service options in parallel by returning a composite service profile covering both local and remote access, along with any dynamic IP addresses and security associations for HA, RN, HoA and RoA, where the HoA is an address associated with the specific MN at the HA and the RoA is an address associated with the specific mobile at the RN. For purpose of explaining the invention, a Regional Node (RN) is a node which operates as a regional mobility agent in a visited region. An RN may be implemented as an HA in a visited region but is described herein as an RA to distinguish from a node's HA in its home domain. A Gateway Foreign Agent is an example of a known RN. Notably, the RoA and HoA correspond to the same mobile node and are not shared with other mobile nodes allowing the RoA and HoA addresses to be mapped to a specific mobile node and serve as a mobile node identifier.b) A single phase of MIP hand-off signalling can be used in accordance with the invention between the MN and FA, and between the new and old FAs to hand-off traffic to the newFA. This would signal the new CoA for multiple, e.g., all the HoAs of a MN and install standard inter-FA forwarding. This would enable the MN and the FAs to share the same Security Associations (SAs) for all the HoAs of a MN. Each oldFA (oFA) would store the last MIP reg sent to each HA and would CT (Context Transfer) these to the newFA (nFA) on hand-off. The newFA would then be responsible for issuing the proxy parallel MIP registrations to multiple, e.g, all, the HAs, secured by the nFA-HA and oFA-HA SA. Each such registration may and normally does include the old CoA and newCoA info and the present binding information at the HA to be updated to the newCoA. The nFA may, and often is, also responsible for clearing up if the MN hands-off again before the remote access MIP registration, for the HA/HoA, is completed towards that newFA.

In accordance with the invention various novel aggregated messages are used to manage Mobile IP bindings for multiple home addresses of an end node. This reduces signaling requirements as compared to using multiple conventional MIP messages to perform the same or similar functions. Aggregated messages of the present invention, in contrast to convention MIP messages, carry multiple home addresses from the same home agent. These aggregated messages can be used between the end node and the home agent, between the end node and the foreign agent, between the foreign agent and the home agent and between two foreign agents during a hand-off. The invention is further directed to aggregated messages that enable bindings to be updated in a foreign agent for multiple home addresses that originate from different home agents. Novel aggregated AAA messages are also supported.

The invention is also directed to methods and apparatus for using and processing the novel messages of the present invention. The novel methods include a message de-aggregation, e.g., fan-out process, that may be implemented in the foreign agent that enables different messages to be generated and sent to multiple home agents as a result of a single aggregated message from an end node received at the foreign agent. The received aggregated message will normally include home addresses from, e.g., corresponding to, multiple different home agents which provide a mobility service to the mobile with which the aggregated message is associated. In support of the invention, and to reduce binding table requirements in various nodes, a novel aggregated binding table structure is also supported. In addition to reducing memory requirements, the aggregated binding table structure of the present invention is well suited for being updated by the aggregated MIP registration messages of the present invention.

The invention further provides aggregated messages between the foreign agent and the AAA server that can be triggered by an aggregated message from an end node to be used to fetch multiple home address specific end node profiles from the AAA server. Thus, novel aggregated authentication, authorization and/or accounting messages are also supported. Novel aggregated AAA messages normally included multiple HoAs corresponding to the same mobile node. The aggregated accounting messages reduce signaling overhead while enabling the end node to rapidly configure policy and connectivity for multiple home addresses in parallel. Use of a single aggregated message also operates to ensure that the AAA system receives requests and/or information corresponding to a hand-off together thereby avoiding problems from receiving information associated with a hand-off in different messages, some of which may be delayed or lost resulting in the potential for incomplete or inconsistent processing relating to a hand-off by the AAA system. The novel aggregated AAA message can also be used between foreign agents, as part of a hand-off, to transfer policy state between the old and new foreign agents for the multitude of home addresses employed by an end node.

Various other features of the present invention are directed to a HoA list extension that is used to indicate the additional HoAs that are associated with a master HA/HoA pair included in an aggregated signaling message. Further, a HA/HoA list extension is defined and supported. The HA/HoA list extension is used to indicate one or more additional HoAs at one or more alternative HAs which differ from the master HA of a signaling message. Both extensions may use INCLUDE/EXCLUDE flags to indicate whether the HA/HoA identified in the extension entry is to be installed (refreshed) or not refreshed (deleted). Thus, updates to a binding table may be applied selectively to HA/HoA information listed in the binding table. Thus, use of an aggregated registration message of the present invention does not necessarily result in updating of all binding entries corresponding to HA and/or HoA addresses included in the aggregated message of the invention.

Various additional features and benefits of the present invention will be apparent in view of the detailed description which follows.

DETAILED DESCRIPTION

FIG. 2shows the passing of aggregated messages between first and second nodes240,250in accordance with the invention. Node240includes memory241which is part of an interface used to buffer incoming and outgoing messages and data. Similarly, node250includes memory242which is part of an interface which buffers messages received by or transmitted from node250.FIG. 4illustrates an exemplary message which may be communicated between nodes240,250whileFIGS. 9 and 11illustrate various exemplary nodes which may be used as the first and second nodes240,250. The first node240may be an end node, such as end node910, or an access node such as access node930ofFIG. 11. The second node240may be, e.g., a home agent930or an access node such as access node920. The registration signaling corresponds to an aggregated MIP signaling instance, e.g., registration message and corresponding reply message, in accordance with the present invention that is used to efficiently manage multiple bindings for a first end node240. A single aggregated MIP registration request or binding update message280is sent from a first node240(similar to first node140ofFIG. 1) to a second node250(similar to second node150ofFIG. 1), carrying sufficient information to install multiple bindings in the second node250for multiple home addresses associated potentially with multiple home agents, which map to the same CoA of the end node. An aggregated MIP Registration Response or Binding Update Acknowledgement message281then reports the result of the binding installation for each of the home addresses of the end node back to the first node240. The use of a single signaling instance to update registration information corresponding to multiple HoAs, made possible by the use of aggregated messages, enables the amount of signaling bandwidth and signaling state to be reduced as compared to using conventional MIP messages. Three bidirectional IP packets flows, represented as dashed line282, are routed based on information included in the aggregated signals280,281which are used to install bindings into the second node250for the three home addresses HoA1, HoA2 and HoA3 of the first end node240.

FIG. 4shows detailed contents480of an exemplary aggregated registration message, such as, for example, message280or281ofFIG. 2, in accordance with the present invention. Aggregated message contents480includes a home agent address (HA1)481which identifies a node930(seeFIG. 11), a home address 1 (HoA1)482with a first prefix482aassigned to the identified node930, a CoA483associated with the second address482and MIP signaling fields484. In addition, the message contents480includes a second home address (HoA2)485with a second prefix485a, said second prefix485abeing different from said first prefix482and being from the first home agent identified by address481. Alternatively or additionally, the message contents480includes a third home address (HoA3)487with a third prefix487awhere said third prefix487ais from the second home agent address (HoA2)486. The aggregated message may include any number N of HoAs where N is equal to at least 2. The contents480of the message are arranged so that the receiving node can uniquely determine the pair comprising the Home agent address and the home address at that home agent that is mapped to the common CoA483. Therefore, the aggregated message480can describe multiple home addresses from a single home agent, multiple home addresses from different home agents as well as additional combinations of home and home agent addresses. In an exemplary embodiment, the aggregate message would use the pair HA1481+HoA1482as the master binding, whilst a MIP extension is used to describe an INCLUDE/EXCLUDE list of additional HoAs at the master HA, followed by a additional HA+HoA pairs not at the master HA. The include/exclude list structure indicates that the included address pairs should be included or excluded (as indicated by flags) from the binding table entries associated with this end node CoA as indicated by the include/exclude list. The include/exclude structure provides additional aggregation advantages as compared to a message without such a list especially as the number of address pairs grows large. The MIP signaling fields484in the aggregated message maybe unchanged from that of the prior art message only when all address pairs use the same signaling fields. When address pairs have different forwarding requirements then additional address pair specific signaling state488is appended to the signaling state for the individual address pairs. Thus, different signaling state488may be included for the first address pair HA1/HoA1, second address pair HA1/HoA2 and third address pair HA2/HoA3. MIP flags which are the same for all pairs included in the message480may occur only once in the message, e.g., as part of the set of common MIP signaling fields484.

In response to receiving an aggregated binding message, e.g., message250, the receiving node will update its binding table entries, e.g., a single aggregated binding table entry will be updated in response to receiving an aggregated update message250. As shown inFIG. 6, the single binding table entry may include multiple HAs and HoAs. As part of the receiving and updating process, the aggregated message250may and often is, temporarily stored in memory included in the receiving node.

FIG. 6shows an aggregated binding table structure680in accordance with the present invention, showing entries681and682for MN X and MN Y. MN X has three home addresses HoA1482from HA 1481, HoA2486also from HA1481and HoA3487from HA2486. A binding table of the type illustrated inFIG. 6may be used in each of the nodes920,930,950-shown inFIG. 9and may be implemented in memory included in the node920,930,950in which the table is located. These three address pairs share the same CoA483and MIP signal state689entries as a single aggregated message used to manage these bindings, in accordance with the invention, using the address pair HoA1 at HA1 as the master binding. Note that HoA2485is listed below HoA1482and has no HA field defined because it inherits the value from the master binding shown in the first row of entry683. In alternative embodiments, the binding table can be split so that the address pairs can be searched in the binding table and the CoA and MIP sig state (which is in a separate table) is indexed by a pointer associated with the matching address pair. Where differences exist between the MIP sig state for each address pair, these can be further indexed out of the binding table by an additional index to a third table. Essentially though, all embodiments, in accordance with the present invention, share the property of removing redundant information and facilitating the use of aggregated signaling messages.

FIG. 8extends the aggregated signaling and storage concept of the present invention to a AAA Request message860and a AAA Response message870which are passed between an access node840and AAA server850, with AAA server850including aggregated policy state855for the HoAs corresponding to the MN X Network Access Identifier (NAI) 1. The aggregated policy state includes Profile875for a statically allocated HA1/HoA1 address pair for the MN X. Profile876is for a second statically allocated HoA2 at the same HA1 as profile875. Profile877is for a dynamically allocated HoA3 address as a statically allocated HA3 address, the AAA server is responsible for the address allocation in this example but this is for purposes of the example and is not intended to indicate a loss of generality. The profile878is associated with an NAI 2 (Network Access Identifier 2) that is different from the MN X NAI 1 associated with profiles875,876,877. Profile878is for a dynamically allocated HA and HoA from the domain identified in that NAI 2. Messages860,870are stored, at least temporarily in memory included in each of the receiving and transmitting nodes, e.g., as part of the transmitting and receiving process.

FIG. 9is a detailed example of an exemplary request message, an AAA message860, which can be used as an authentication, authorization and/or accounting message. The message860comprises a MN identifier861, a state request field862, a first aggregated HA/HoA address grouping869including HA1863and statically allocated HoA1864, and a dynamically allocated address HoA3865whose value is not known at the time of the sending of the request message860. Both HoA1 and HoA3 correspond to the first HA address HA1863. Therefore elements863,864,865represent two HA, HoA pairs880,882. The message860further includes a request for a third HA/HoA address pair884, which includes HA4866and HoA4867, associated with an NAI 2 which is associated with MN X, said NAI 2 is different from said NAI 1. Note that normally neither HA4 nor HoA4 are known in advance of sending the aggregated request message860as they will be dynamically allocated, said dynamic allocation being guided or controlled by the NAI 2 HA4 and HoA4 requests866,867, and the associated profile state878. HA/HoA address pairs and request form the first part of what can be called an included/exclude list. An include flag871is used to indicate that the profiles in the AAA server associated with address pairs880,882and884should be returned to the access node840, these profiles being profiles875,877and878. The fact that the address pair HA1/HoA2 associated with profile876is missing from a request with the include flag set indicates that the access node840does not need the profile876to be returned for the MN X. A particular exemplary request message is shown inFIG. 12where the exemplary aggregated request message860again includes the MN X NAI 1 identity861and MIP AAA request state862. This is followed by an address pair881comprising HA1 address868and HoA2 address869associated with MN X NAI 1861and profile876. The exclude flag870is then added to the message. This informs the AAA server850that the AAA request is for all profiles and associated allocations that are associated with MN X that are not mentioned in the AAA request message, these being the same profiles described inFIG. 9. An include flag is therefore generally preferable in a request message when the number of included entries is less than the number of excluded entries. Note however that the dynamic allocation of HoA3, HA4 and HoA4 cannot now be guided by parameters in the missing request messages865,866and867ofFIG. 12compared toFIG. 9, and must instead be fully guided by the Profile state877and878. Therefore, a composite of include and exclude entries may be combined in a single message to provide control for dynamic allocation requests with maximum message efficiency. The include flag871and/or exclude flag870may be implemented as part of a MIP extension that also implements the list of HA/HoA address pairs, or could be an MIP header flag, or a specific AAA Attribute Value Pair (AVP) for example.

Contents of an exemplary AAA response message870are shown inFIG. 10when using either the request message ofFIG. 9orFIG. 12. The MN X NAI 1861and MIP AAA response state874are returned to the access Node840along with address pairs890,892and894. Address pair890includes HA1 address863and HoA1 address864along with the associated profile875. Address pair892includes HA1 address863and dynamically allocated HoA3 address895, and is followed by the associated profile876. Address pair894comprises dynamically allocated HA4 address896and HoA4 address897followed by the associated profile877, addresses896,897being allocated from the domain identified by MN X NAI 2.

In addition to providing message savings, any process at the AAA server, such as MN authentication, that may typically comprise multiple steps of messaging and processing that are not shown inFIG. 8, that is normally conducted for each AAA request message, may, and often is, conducted once for the aggregated message, providing additional benefits of the invention.

During a hand-off the MN X profile and associated configuration state is handed-off between access nodes. This can be performed using AAA in accordance with the invention. Therefore, an aggregated MIP hand-off message for multiple HoAs of a MN X can trigger an aggregated message to transfer the MN X profile for each HoA to the new access node, from the old access node, the old access node effectively becoming the AAA server850ofFIG. 8.

The invention is summarized in an exemplary communications system ofFIG. 11for the case of an end node910which for example is a Mobile Node (MN910), coupled to a first and a second access node920,940, respectively, which for example contain MIP v4 Foreign Agents or MIPv6 Attendents. Access Nodes920,940may alternately be referred to as Foreign Agents (FAs)920,940, respectively, since they include FA modules which allow them to operate as FAs. FAs920,940are both coupled to first and second MIP Home Agents or Regional Agents930,950(HAs930,950). The FA920also has a coupling with an Authorization and Authentication system905which enables the FA920to authenticate the MN910and to obtain an Authorization Profile called the MN Profile which is installed into the FA920and used to policy the communications activity of the MN910. All nodes905,910,920,930,940,950have a communications routine907,911,921,931,941,951, respectively, used to send MIP and policy signaling for initial registration and for hand-off of the MN910between FAs920,940, as well as to forward packets between nodes. The nodes910,920,930,940,950have an Aggregated MIP Routine912,922,932,942,952, respectively, which enable a single MIP signal, e.g., aggregated message, to affect binding state for more that one HoA at a single HA at a time. In addition, nodes910,920,940have an extended routines912,922,942, respectively, which also enable them to use a single MIP message to affect state associated with multiple HAs. Routines912,922,932,942and952support and implement aggregation of MIP signaling such that a single MIP message can be used to manipulate various, e.g., all, MIP state for a MN910, thereby eliminating the need for a multitude of MIP messages in order to manipulate the state, e.g., one message for each single HA/HoA pair as is normally done with conventional MIP signals. This enables a binding table933,953,923,943,913and other MIP state in the HA930, HA950, FA920, FA940, MN910, respectively to store state as if a separate MIP signaling phase was being used for each distinct HoA thereby allowing an aggregated message to be used with a conventional type of binding table. In an alternative embodiment, aggregated binding table state such as the binding table680ofFIG. 6of the invention can be employed where a single instance of MIP signaling state associated with a single MN910(including MIP flags, security, lifetime, sequences numbers, challenges, tunnel types and other extensions) can be generated for a main Home Agent, Home Address and CoA triplet. Routines922,942further manage the fan-out, e.g., de-aggregation, of MIP registration signaling to multiple HAs and the fan-in, e.g., aggregation, from the multiple associated MIP Replies.

When MN910connects to the first FA920it sends an aggregated MIP Registration Request (MIPv4) or Binding Update (MIPv6) message970ato the FA920including its identity such as at least one Network Access Identifier. The FA920then sends a message906a, such as a RADIUS access_request to the AAA system905to authenticate the MN910and fetch the Policy state908for mobility management of Home addresses HoA1, HoA2 and HoA3 at the first and second HAs930,950. The HoAs and HAs may be predefined or dynamically allocated but an essential inventive step is to enable a multitude of Policy state to be returned to the FA920in the Access_Accept message906b, triggered by a single MIP registration message970a. If the multiple HoAs are to be allocated by the HA930,950then they will not be in the returned policy state although the policy state for each yet to allocated address may be. The message970acan include a HA/HoA list extension and associated address type information which can be used by the FA920to indicate to the AAA system which subset of all available policy state is needed for this MN910at this time. The HA/HoA list can either name each HA domain and the address types in each domain, or it can actually include specific statically allocated HA and HoA identifiers. The named elements can be designated as an indication of which policy should, or should not be returned the FA920, hence operating as either an INCLUDE or EXCLUDE list. The policy state also should include MIP security associations for securing communications between the FA920and the HAs930,950, between the MN910and the FAs920,940, and between the FAs920,940themselves.

The policy state is stored in the FA920as part of the context state for the MN910and will normally include at least the address of each HA930,950and a place holder for the requested address types from that HA. Such address types can be IPv4 public addresses, IPv4 private addresses, various IPv6 address types (link, site and global scope, with and without EUI64s) as well as addresses from specific address prefixes (address ranges) that correspond to different commercial entities. Providing multiple addresses from a common address prefix to a MN910is useful if that MN910is acting as a Mobile Router and can onward allocate those addresses. Allocating multiple home addresses to a MN910from different address prefixes at a HA, e.g., addresses which are not from a contiguous block of addresses, is useful because each address can be owned by different commercial operators with connectivity to that HA, such that each address provides different communications capabilities with associated policy constraints to the MN910. For example, the same HA can allocate an address from the public ISP of the MN910as well as an address from the corporate network of the MN910.

Message970afor triple HA1 HoA1 CoA, including HA/HoA list extension for, HA1 HoA2 and HA2 HoA3, is converted by routine922into a partially aggregated message970bincluding HoA list extension with HoA2 directed to the first HA1930. The fan-out (deaggregation) process in the FA920also sends, in response to receiving an aggregated message970, a deaggregated message970cto the second HA950for HA2 HoA3 CoA. These messages are used to obtain any dynamically allocated HoAs from those HAs which are returned to the FA920and the MN910in the MIP reply messages. Note that the FA920aggregates reply codes and other information from reply messages received in separate reply messages from the two HAs for each of the HoAs 1, 2, 3 to enable a single aggregated Reply message to be returned by the FA920to the MN910. These replies can also include per HA/HoA success failure information which is returned to the MN910intact so that it is fully aware of its evolving connectivity and can then attempt to repair any defects with aggregated or unaggregated signals. T he completion of the MIP registration/binding update signaling results in a single aggregated binding table entry, e.g., aggregated binding table entry683, being installed in the FA920and the HA930for the HoA 1 and HoA2 which is mapped to the MN910and the Care of Address of the MN910. Packet flow960afrom HA930to FA920then includes packets from peer nodes destined for either the HoA 1 or HoA 2 of the MN910, packet flow960cfrom HA950to FA920then includes packets from peer nodes destined to the HoA3 of the MN910, addresses HoA1,2,3 being assigned to interfaces on the MN910. If the End Node CoA is assigned to another interface on the MN910then it is a Colocated CoA (CCoA) and packets from the peer nodes will be directed from HAs930,950to the CCoA using redirection mechanisms such as tunneling or routing headers. If the end node CoA is the FA CoA of FA920, then the HAs930,950instead redirect packets to the FA CoA which then forwards them to the MN910using the binding information in table680. Therefore packet flow960bfrom FA920to MN910includes packets from both packet flows960aand960c.

As is well known in MIP, the bindings in the HA930,950and FA920should be refreshed in advance of the binding lifetime expiring. Accordingly, to achieve a high level of aggregation the lifetimes and the CoAs for the bindings for the MN910should all be the same. MIP also includes a number of other parameters such as tunnel types, challenge and security mechanisms. The more the parameters are common for each of the HoAs at each of the HAs, then the greater is the aggregation benefit of the invention. Without loss of generality, this invention enables any MIP parameters to be common between the HoAs and the HAs other than of the course both the HA and HoA addresses themselves. If the MN910wishes to add or drop a specific HoA/HA from the aggregate, then the INCLUDE/EXCLUDE list extension (e.g., include or exclude flag) is used to communicate the change to the FA920and HAs930,950so that the associated policy and MIP state can be amended.

Further aggregation benefits accrue during hand-off when the MN910moves to a new FA940. The case for a reactive hand-off, whereby MIP signaling is sent via the new FA940will be described and is shown inFIG. 9, but an aggregated proactive hand-off whereby the MIP signaling is sent via the old FA920and triggers an MIP signal from the old FA920to the new FA940is also possible, in accordance with the present invention. The reactive hand-off requires the MN910to send an aggregated MIP registration request or Binding Update message975ato the new FA940, including the HA/HoA list to indicate which packets to redirect to the new FA940and which to deprecate. The HA/HoA routine942will then issue an aggregated Binding Update (BU) message975dto the old FA920to update the binding information in the binding table923in the old FA920with the CoA from the prefix of the new FA940. This newCoA again may be a FA CoA or a CCoA but the modifications will only be applied to the bindings as indicated by the HA/HoA list in the BU975d. Packets destined for the oldCoA in affected bindings are then redirected to newCoA by the FA920to create packet flow960dfrom old Fa920to new FA940which is onward forwarded to the MN910as packet flow960e. Unaffected bindings will continue to forward packets to the MN910as flow960bwhich will terminate when the HAs930,950stop directing packets towards the oldCoA or when the MN910decouples from the FA920. The BU message975dtriggers a message975efrom the FA920to the FA940which transfers the policy state for the HoAs indicated by message975dto enable policy state and MIP configuration, including security state to be transferred to the new FA940. Undertaking the hand-off in parallel for all HoAs avoids the cost of multiple independent MIP hand-off signals which comsumes excessive bandwidth and which independently could fail or become desynchronized leading to significant complexity. Message975aalso triggers messages975band975cto HA930,950, respectively, which are aggregated MIP signals for multiple HoAs at the same HA. These update the bindings933,953in the HAs to replace the oldCoA with the newCoA. Packets are then no longer directed towards the MN910via FA920and instead go via FA940.

In summary, significant aggregation benefits can be obtained when a MN has multiple HoAs from a single HA, if the MN has a single HoA from multiple HAs, and as described inFIG. 9, multiple HoAs from multiple HAs which is the general case. The single MIP signaling phase from MN910back to MN910via FA and HA can be MIP v4 or MIPv6 based, but can reference a multitude of address types associated with HoAs and HAs. Note that a shared CCoA can be used for any combination of IPv4 and IPv6 addresses whilst a CoA can only be used for IPv4 addresses of different types.

The aggregated hand-off signaling can be used after non-aggregated signaling is initially used to install bindings for each HoA into each HA, FA. During this initial deaggregated phase, the MN910can attempt to negotiate maximally uniform parameters across the MIP state for each HoA so that maximum aggregation benefit is obtained during hand-off.

The provisional applications incorporated by reference into the present application include various exemplary embodiments which are not intended to limit the scope of the present application. Any mandatory language such as must, only, necessary, etc, found in the provisional applications is intended to be interpreted as applying to the exemplary embodiments described in the provisional applications and not to limiting the invention, claims or embodiments described in the present application in any way.

In various embodiments nodes described herein are implemented using one or more modules to perform the steps corresponding to one or more methods of the present invention, for example, signal processing, message generation and/or transmission steps. Thus, in some embodiments various features of the present invention are implemented using modules. Such modules may be implemented using software, hardware or a combination of software and hardware. Many of the above described methods or method steps can be implemented using machine executable instructions, such as software, included in a machine readable medium such as a memory device, e.g., RAM, floppy disk, etc. to control a machine, e.g., general purpose computer with or without additional hardware, to implement all or portions of the above described methods, e.g., in one or more nodes. Accordingly, among other things, the present invention is directed to machine-readable medium including machine executable instructions for causing a machine, e.g., processor and associated hardware, to perform one or more of the steps of the above-described method(s).

Numerous additional variations on the methods and apparatus of the present invention described above will be apparent to those skilled in the art in view of the above description of the invention. Such variations are to be considered within the scope of the invention. The methods and apparatus of the present invention may be, and in various embodiments are, used with CDMA, orthogonal frequency division multiplexing (OFDM), and/or various other types of communications techniques which may be used to provide wireless communications links between access nodes and mobile nodes. In some embodiments the access nodes are implemented as base stations which establish communications links with mobile nodes using OFDM and/or CDMA. In various embodiments the mobile nodes are implemented as notebook computers, personal data assistants (PDAs), or other portable devices including receiver/transmitter circuits and logic and/or routines, for implementing the methods of the present invention.