Method and apparatus for processing data traffic across a data communication network

A method is presented for processing data traffic between a correspondent node and a mobile node on the data communication network. Traffic from the correspondent node to the mobile node is intercepted and the mobile node home address is replaced as destination with the mobile node attachment address. Traffic from the mobile node to the correspondent node is intercepted and the attachment address is replaced as source with the home address.

FIELD OF THE INVENTION

The present invention generally relates to a method and apparatus for processing data traffic. The invention relates more specifically to a method and apparatus for processing data traffic across a data communication network.

BACKGROUND OF THE INVENTION

In computer networks such as the Internet, packets of data are sent from a source to a destination via a network of links (communication paths such as telephone or optical lines) and nodes (usually routers directing the packet along one or more of a plurality of links connected to it according to one of various routing protocols).

Referring toFIG. 1which shows a block diagram illustrating an overview of a data communication network, the network is designated generally10and includes a network of nodes and links shown by “cloud”12with routers14,16,18. The routers14,16,18are connected to routers, servers or clients (only one is shown for each router inFIG. 1but multiple routers, servers or clients can of course be supported) providing access to the Internet. Referring toFIG. 1a local access router20connected to the router14comprises a Home Agent (HA), a foreign access router (FA)22is connected to router16and a server24is connected to the router18and comprises a Correspondent Node (CN). Communication between the routers20,22and server24is possible across the Internet. In this description the local access router20is also termed a Home Agent20and the server24is also termed a Correspondent Node24.

One issue of increasing importance as regards data communications networks relates to processing data traffic involving a mobile node. For example referring toFIG. 1a Mobile Node26(MN) comprising a laptop computer is connected to the home agent20. When it is desired to communicate between the mobile node26and the correspondent node24this is straightforward while the mobile node is connected to its home agent. The manner in which communication is carried out is dependent upon the communication protocol adopted but prevalent protocols are Internet Protocol version 4 (IPv4) and version 6 (IPv6) which are described at the time of this writing in the files “rfc791.txt” and “rfc2460.txt” respectively in directory “rfc” of the domain “ietf.org” on the World Wide Web. In particular a mobile node has a home address (at its home agent) such that while it is connected to its home agent it uses its home address as source address and the correspondent node can reply simply by using the mobile node's home address as the destination address allowing straightforward communication according to the protocol. However if the mobile node26moves to a position as shown in dotted lines inFIG. 1and connects to foreign access router22then evidently the mobile node's home address will not be sufficient for communication with the correspondent node24to be continued.

One existing solution to deal with this is to assign the mobile node26an attachment address or “care of address” when it attaches to a foreign access router22. The mobile node establishes whether it is connected to the home agent20or to a foreign access router22by receiving and processing a “Router Advertisement” from the entity to which it is connected which will include information about the subnet that it is connected to, in order for the MN to build a care of address. If the MN is at home then the agent address is also included within this information. When the mobile node26detects that it is at a foreign access router22then to find its Home Agent it sends a Dynamic Home Agent Address Discovery (DHAAD) request packet and awaits a DHAAD reply. It then sends a “binding update” (BU) message to the home agent20via the foreign access router22using its new care of address as the source address, and including a home address option as discussed in more detail below. The home agent20uses the binding update message to update its “binding cache” of addresses with the care of address. The binding cache is a table maintained by the home agent20of all mobile nodes26which are away from home at a foreign access router. The table maps the mobile node's home address to the care of address that it is currently using. If there is not an entry in the table for the given home address, then it is assumed that the mobile node is on the home network. In practice additional authentication steps may take place which are facilitated because the mobile node26and its home agent20are in a common security regime.

The procedure when a correspondent node24corresponds with a mobile node26which is not connected to the home agent20is shown inFIG. 2which depicts a network diagram illustrating one known solution to communication between a mobile node and a correspondent node. Because the correspondent node and mobile node are not in the same security domain they cannot simply authenticate each other. Accordingly the correspondent node24sends a packet to the mobile node's home address, i.e. the home agent20along a link25joining the two. The home agent20establishes from its binding cache the current care of address of the mobile node26and forwards the packet along a link27to the mobile node26via the foreign access router22to which the mobile node26is currently attached. If the mobile node26replies then the message is once again channeled via the home agent20. For the purposes of security or transparency the home agent20tunnels the packets between the correspondent node24and mobile node26, i.e. encapsulates data packets received from one party in a larger packet destined for the other party, with or without encrypting the original data packets. There is no direct communication, therefore, between the mobile node26and the correspondent node24which can introduce delays in communication. This approach, known as “dogleg routing” provides a level of transparency for the correspondent node upper layer protocols (i.e. at the level of determining source and destination values for packets).

Improved solutions are disclosed in internet protocol versions4and6in relation to mobility support (mobile IPv4/IPv6) as set out at the time of this writing in the file “rfc3220.txt” in directory “rfc” and in the file “draft-ietf-mobileip-ipv6-19.txt” in directory “internet drafts” respectively of the domain “ietf.org” on the World Wide Web. In particular “Mobility Support in IPv6” uses the technique of “return routability”. Referring toFIG. 3, which shows a network diagram illustrating a further known solution to communication between a mobile node and a correspondent node, as with the previous solution, the mobile node26sends a binding update to the home agent20along the link27such that the home agent20maintains an updated binding cache. On initiation or maintenance of a communication path or link between a mobile node26and a correspondent node24, the mobile node26simultaneously sends two different authentication packets to the correspondent node24.

The first packet is sent using its home address as source, such that the packet must travel via the home agent20. Therefore the mobile node encrypts and reverse tunnels the packet to the home agent20along link27. The home agent decrypts and decapsulates the packet, and forwards it along link25to the correspondent node24. The encrypted tunnel ensures that the packet can only be seen along link25.

The second packet is sent using its-care-of-address as the source, thus the packet can be sent directly to the correspondent node24via link28.

On receiving each packet the correspondent node24sends a response back to the mobile node26, using the source address of the first packet as the destination address. Thus the first packet is destined for the home address, and travels along link25until the home agent20intercepts, encrypts and tunnels it via link27to the mobile node26.

The correspondent node also sends a response packet destined for the care of address, which travels direct via link28.

Using these two packets, the mobile node26can build a common secret which only it and the correspondent node24shares, providing return routability. As a result route optimisation can be performed. Thus the mobile node can now send an authenticated BU to the CN, and the mobile node26and correspondent node24can communicate directly along the link28. Each time the mobile node26moves, once the link28has been set up direct communication can continue.

However a disadvantage of this approach is that the correspondent node, as it now deals directly with the mobile node's care of address, has to maintain a binding cache and also carry out route optimisation including return routability authentication steps. This is a significant burden both on the correspondent node memory and processing capabilities which can divert resources from its core server functionality. This can render a server particularly vulnerable to a denial of service attack wherein the multiple route optimisation operations are instigated by a malicious third party.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

1.0 General Overview

2.0 Structural and Functional Overview

3.0 Method of Processing Data Traffic Across a Data Communication Network

5.0 Extensions and Alternatives

1.0 General Overview

The needs identified in the foregoing Background, and other needs and objects that will become apparent for the following description, are achieved in the present invention, which comprises, in one aspect, a method for processing data traffic across a data communications network. The traffic is between a correspondent node and a mobile node. The mobile node is attachable to a plurality of points on the network and has a home address and an attachment address. Traffic from the correspondent node to the mobile node is intercepted, and the home address, which appears as the destination address in such traffic, is replaced with the attachment address. The method also comprises the step of intercepting traffic from the mobile node to the correspondent node and replacing the attachment address as source address with the home address.

As a result the packets that are then sent to the correspondent node appear as though they have come from the mobile node's home address, and the correspondent node can return packets to the home address as destination address. At the point of interception, the destination address is replaced with the attachment address. Accordingly the mobile node point of attachment is transparent to the correspondent node as all of the mobility options are dealt with at the point of interception such that the correspondent node can operate under its normal protocol without the processing and memory burden introduced by mobility options.

In other aspects, the invention encompasses a computer apparatus and a computer-readable medium configured to carry out the foregoing steps.

2.0 Structural and Functional Overview

In the implementation discussed herein as an example, the method is described in conjunction with mobile IPv6 but it will be appreciated that the method extends to any appropriate protocol supporting mobility options. In order to understand implementation of the method it is helpful first to review some aspects of mobile IPv6. The skilled person will be well aware of the operation of IPv6 and so only an overview is required here.

Referring once again to the basic structure shown inFIG. 2andFIG. 3which illustrate known solutions to communication between a mobile node and a correspondent node, when a mobile node26wants to initiate communication with a correspondent node24the mobile node issues a home test initiation (“init”) (HoTI) message of the form generally shown inFIG. 4which shows a HoTI packet initiating correspondence between a mobile node and a correspondent node. The packet41comprises a packet header40A having a source field44A and a destination field46A and a message data field42A. The HoTI packet41includes the mobile node's home address as source address in the source field44A and the correspondent address as destination address in the destination field46A as well as a first authentication token48A as part of the message data42A. The HoTI packet41is sent via an encrypted reversed tunnel to the home agent20. At the same time the mobile node26sends a care-of test init (CoTI) message directly to the correspondent node24having the mobile node's care-of address as source address and the correspondent node's address as destination address.FIG. 5shows a CoTI message58initiating correspondence between a mobile node and a correspondent node. CoTI message58comprises a header40B having the mobile node's care-of address in source field44B and the correspondent node's address in destination address field46B. The message data42B includes a second authentication token48B.

The HoTI packet41is decapsulated by the home agent20and forwarded to the correspondent node24which then sends a home test (HoT) message to the mobile node.FIG. 6shows a HoT message60comprising a correspondent node response to correspondence initiation. In header40C of HoT message60, the source address field44C is set to the correspondent address and the destination address field46C is set to the home address of the mobile node and the message returns the first authentication token48A as well as a third authentication token48C in message data42C. The home agent20intercepts the HoT message60, encrypts it, and tunnels it to the mobile node26.

On receiving the CoTI message58, the correspondent node24sends a care-of test (CoT) message direct to the mobile node26.FIG. 7shows a CoT message70comprising a correspondent node response to correspondence initiation. CoT message70includes the address of the correspondent node24in source address field44D and the care-of address of the mobile node26in destination address field46D. Message data42D returns the first authentication token48B as well as a fourth authentication token48D.

The mobile node26now has enough information to construct an authenticator which it sends with a binding update to the correspondent node24with the source address set to the care-of address of the mobile node and the destination address set to the correspondent nodes' address. The correspondent node sends a binding acknowledgement message and updates its binding cache with the relevant information.

It will be noted that mobile IPv6 supports additional fields, in particular a home address option which is included within the binding update, which the correspondent node24uses as the index to the binding cache. Where this option is exercised in a packet sent from the mobile node26with a source address as its care-of address, the home address option field carries the mobile node's home address. As a result a correspondent node24receiving the packet can substitute the mobile node's home address for the care-of address when processing the packet, making the mobility of the mobile node26transparent to the correspondent node24. In the above identified exchange this option is not exercised during the return routability exchange.

It will further be seen that there are three possible changes of state which need to be embraced within the route optimisation option. The first of these is where a mobile node26at a foreign access router22initiates correspondence with a correspondent node24in which case the steps set out above are followed. If a correspondent node24wishes to initiate correspondence then it will first communicate with the home agent20which will forward packets to the mobile node26based on its binding cache. In this case the mobile node26can detect that return routability could be initiated with the correspondent node24and can initiate the procedure described above. The third option is that the mobile node26, which is already in correspondence with the correspondent node24moves its attachment point in which case, once again it will carry out route optimisation to establish a new return route following the steps described above.

The method described herein adopts many features of the route optimisation procedure described above but in particular shifts the burden from the correspondent node24to a node intermediate to the correspondent node24and the mobile node26, in the example described, the next hop router18to the correspondent node24, which can be viewed as a pseudo correspondent node.

FIG. 8shows such an arrangement, depicting a network diagram showing a pseudo correspondent node communicating with a correspondent node. The pseudo correspondent node50(PCN) is shown as a last hop router to the correspondent node24. The pseudo correspondent node50intercepts traffic between the mobile node26and the correspondent node24and strips the mobile options (for example the home address option) when transferring packets to the correspondent node24and inserts them when transferring packets from the correspondent node24. The pseudo correspondent node50further maintains the binding cache on behalf of the correspondent node24(and indeed any other correspondent nodes24for which it is acting as a pseudo correspondent node).

As discussed in more detail below the interception step is carried out by identifying traffic to the correspondent node24and examining it for mobility options, and also identifying traffic from a correspondent node24which has an entry on the binding cache (implying that it is in correspondence with a mobile node26). The pseudo correspondent node50alters either the source or destination addresses, or both, based on the binding cache entries such that the mobility of the mobile node26is transparent to the correspondent node24. The pseudo correspondent node50also carries out the steps of route optimisation on behalf of the correspondent node24. As a result the correspondent node24believes that it is communicating effectively directly with the mobile node via its Home Agent20irrespective of the mobile node's actual location, as designated by virtual communication paths52aand52binFIG. 8. The burden of dealing with the authentication steps and other requirements of route optimisation and of constructing and maintaining a binding cache is transferred from the correspondent node server to the pseudo correspondent node router50where the required memory and packet processing capability are better suited to these tasks, rendering a denial of service attack less viable.

FIG. 10is a flow diagram illustrating a high level view of a method of processing data traffic. In block140the pseudo correspondent node50identifies traffic that is to or from the correspondent node. In block142the pseudo correspondent node50intercepts at traffic. The following steps are then dependent on the traffic type.

At block144the pseudo correspondent node50identifies traffic from the correspondent node. At block146pseudo correspondent node50identifies a mobile node as destination and in block148the pseudo correspondent node replaces the home address of the mobile node with the care of address as destination.

At block150the pseudo correspondent node50identifies traffic destined for the correspondent node. In block152the pseudo correspondent node50identifies any traffic originating from a mobile node and at block154the pseudo correspondent node50replaces the mobile node care of address with its home address as source address.

3.0 Method of Processing Data Traffic Across a Data Communication Network

FIG. 11is a flow diagram illustrating in more detail a method for processing data traffic. As discussed above, there are three possible options for instigation of a direct path between a correspondent node24and a mobile node26, but in all cases the mobile node26effectively initiates return routability, i.e. authenticating the direct path. Accordingly as shown in blocks160and162ofFIG. 11, the pseudo correspondent node50inFIG. 8first of all monitors all data traffic with destination address as any correspondent node24for which it acts as pseudo correspondent node. When the pseudo correspondent node50detects such a packet, the pseudo correspondent node then establishes whether it originates from a mobile node26. For a mobile node initiating correspondence, this step is achieved by establishing whether a packet is a HoTI or a CoTI packet in block164. During the initiation exchange (HoTI, CoTI) the pseudo correspondent node50acts in block166exactly as the correspondent node24would have in sending return HoT and CoT messages, updating its binding cache and sending a binding acknowledgement as discussed above. As a result all of the encryption and authentication steps are carried out at the pseudo correspondent node50. Once return routability (RR) has been set up in block166then the mobile node26may send a binding update to the correspondent node24, which will be intercepted by the pseudo-correspondent node50and inserted into the binding cache in block168, and so the source address of a packet from a mobile node to a pseudo-correspondent node can be compared against the binding cache and if found this indicates communication with a mobile node.

Likewise the destination address of a packet from a correspondent node24in block170can be compared against the binding cache in block172, and if found this indicates communication with a mobile node.

Once correspondence with a mobile node26has been established and the binding cache updated the pseudo correspondent node50can then forward further traffic from the mobile node26to the correspondent node24by identifying relevant traffic from the binding cache in block174and intercepting the traffic at block176. By replacing the care-of address with the home address of the mobile node26in the source field, in block178the mobility option is effectively stripped out and the message is forwarded to the correspondent node24at block180which can deal with communications under normal protocols.

When the correspondent node24returns a packet in block170this will, therefore, have the home address of the mobile node26as destination address which is monitored by the pseudo correspondent node50at block172. Accordingly it is also necessary for the pseudo correspondent node50to intercept such traffic from the correspondent node24in block181in order to ensure that the mobility options are re-inserted, in particular by replacing the mobile node home address with the mobile node care-of address in the destination field in block182, relying on the binding cache to obtain the correct values. It will be noted that the pseudo correspondent node50only needs to monitor traffic from correspondent nodes for which a binding cache entry already exists which can be indexed by the destination address of the correspondent node originating packet. It will be recognized that correspondence between non-mobile node hosts and the correspondent node24, or indeed mobile nodes26, not participating in route optimisation in block184, can correspond with the correspondent node24as normal, as the pseudo correspondent node50will regard such traffic as normal traffic and route it accordingly in block186.

Once route optimisation has been implemented in block166, packets from the mobile node26will include a home address option as discussed above, comprising the mobile nodes' home address. As a result the pseudo correspondent node50can identify, process and forward such packets very easily. In particular once the home address option is validated at the pseudo correspondent node50it can simply swap the source address and the home address option and forward the packet with the home address as source address to the correspondent node. The home address option is removed from the packet or set as padding in block188as otherwise the correspondent node24may recognize the packet as including mobility options.

Similarly, when the pseudo correspondent node50processes a packet from the correspondent node24to the mobile node26, the address replacement is easily processed. In particular, in block190the pseudo correspondent node50inserts a Type 2 routing header into the packet. This header type is a mobile option supported in mobile IPv6 restricted, for security reasons, to carrying only one address. The destination of the packet forwarded by the correspondent node is set to the care-of address and the home address is contained in the routing header. As a result when the mobile node26receives it, it can process the routing header and deal with the packet appropriately. In the example discussed here, if a mobile node26sends a packet to the correspondent node24using its home address and without a home address option then the pseudo correspondent node50will forward this as normal traffic to the correspondent node24. However on reply the pseudo correspondent node50will still recognize the return packet as one destined for a mobile node26for which there is an entry in the binding cache and inserts a Type 2 routing header into the packet so that the packet is sent directly to the mobile node26in block192rather than via the home agent20. If the mobile node26wishes to suspend route optimisation it must instruct the pseudo correspondent node50to de-register the binding cache entry.

The pseudo correspondent node may act for one or more correspondent nodes. In the latter case it must be notified of which correspondent nodes it acts as pseudo correspondent node for, by maintaining a list of correspondent node addresses. On the basis of this it can ensure interception of all relevant packets from supported correspondent nodes. The last hop router can act as a pseudo correspondent node50and carry out all of the steps that would otherwise be carried out directly by the correspondent node24, however the processing and memory burdens are shifted as discussed above. Upper check layer check sums do not need to be updated when the home address option or routing header are processed since the check sum is always calculated on a real address, not on the care-of address.

It will be appreciated that the steps above can be implemented in any appropriate manner by the skilled person for example by installing appropriate code into the router code as discussed in more detail below.

FIG. 9is a block diagram that illustrates a computer system80upon which an embodiment may be implemented. The embodiment is implemented using one or more computer programs running on a network element such as a router device. Thus, in this embodiment, the computer system80is a router.

Computer system80includes a bus82or other communication mechanism for communicating information, and a processor84coupled with bus82for processing information. Computer system80also includes a main memory86, such as a random access memory (RAM), flash memory, or other dynamic storage device, coupled to bus82for storing information and instructions to be executed by processor84. Main memory86also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor84. Computer system80further includes a read only memory (ROM)88or other static storage device coupled to bus82for storing static information and instructions for processor84. A storage device90, such as a magnetic disk, flash memory or optical disk, is provided and coupled to bus82for storing information and instructions.

A communication interface98may be coupled to bus82for communicating information and command selections to processor84. Interface98is a conventional serial interface such as an RS-232 or RS-422 interface. An external terminal92or other computer system connects to the computer system80and provides commands to it using the interface98. Firmware or software running in the computer system80provides a terminal interface or character-based command interface so that external commands can be given to the computer system.

A switching system96is coupled to bus82and has an input interface and a respective output interface (commonly designated99) to external network elements. The external network elements may include a plurality of additional routers120or a local network coupled to one or more hosts or routers, or a global network such as the Internet having one or more servers. The switching system96switches information traffic arriving on the input interface to output interface99according to pre-determined protocols and conventions that are well known. For example, switching system96, in cooperation with processor84, can determine a destination of a packet of data arriving on the input interface and send it to the correct destination using the output interface. The destinations may include a host, server, other end stations, or other routing and switching devices in a local network or Internet.

The computer system80implements as a router acting as a pseudo correspondent node the above described method of processing data traffic. The implementation in the present example is provided by computer system80in response to processor84executing one or more sequences of one or more instructions contained in main memory86. Such instructions may be read into main memory86from another computer-readable medium, such as storage device90. Execution of the sequences of instructions contained in main memory86causes processor84to perform the process steps described herein. One or more processors in a multi-processing arrangement may also be employed to execute the sequences of instructions contained in main memory86. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions to implement the method. Thus, the method is not limited to any specific combination of hardware circuitry and software.

The term “computer-readable medium” as used herein refers to any medium that participates in providing instructions to processor84for execution. Such a medium may take many forms, including but not limited to storage media (for example non-volatile media, volatile media), and transmission media. Non-volatile media includes, for example, optical or magnetic disks, such as storage device90. Volatile media includes dynamic memory, such as main memory86. Transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise bus82. Transmission media can also take the form of wireless links such as acoustic or electromagnetic waves, such as those generated during radio wave and infrared data communications.

Various forms of computer readable media may be involved in carrying one or more sequences of one or more instructions to processor84for execution. For example, the instructions may initially be carried on a magnetic disk of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system80can receive the data on the telephone line and use an infrared transmitter to convert the data to an infrared signal. An infrared detector coupled to bus82can receive the data carried in the infrared signal and place the data on bus82. Bus82carries the data to main memory86, from which processor84retrieves and executes the instructions. The instructions received by main memory86may optionally be stored on storage device90either before or after execution by processor84.

Interface99also provides a two-way data communication coupling to a network link that is connected to a local network. For example, the interface99may be an integrated services digital network (ISDN) card or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, the interface99may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, the interface99sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.

The network link typically provides data communication through one or more networks to other data devices. For example, the network link may provide a connection through a local network to a host computer or to data equipment operated by an Internet Service Provider (ISP). The ISP in turn provides data communication services through the world wide packet data communication network now commonly referred to as the “Internet”. The local network and the Internet both use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals on the network link and through interface99, which carry the digital data to and from computer system80, are exemplary forms of carrier waves transporting the information.

Computer system80can send messages and receive data, including program code, through the network(s), network link and interface99. In the Internet example, a server might transmit a requested code for an application program through the Internet, ISP, local network and communication interface98. One such downloaded application provides for the method as described herein.

The received code may be executed by processor84as it is received, and/or stored in storage device90, or other non-volatile storage for later execution. In this manner, computer system80may obtain application code in the form of a carrier wave.

5.0 Extensions and Alternatives

The method steps set out can be carried out in any appropriate order and aspects from the examples and embodiments described juxtaposed or interchanged as appropriate. It will be appreciated that a router can act as a pseudo correspondent node, intercepting packets for a number of correspondent nodes and compressing common data in the binding cache so as to economize on memory space. Although the specific discussion above is directed to mobile IPv6 any appropriate protocol supporting mobility options can equally form the basis of the method. Although the pseudo correspondent node is presented as the last hop router it will be appreciated that, dependent on the routing protocol, it can be another router although this could require tunneling or source routing from the correspondent node to the pseudo correspondent node to ensure that all relevant data traffic is intercepted.