Method and apparatus for providing mobile IP service through a network address translation gateway

Method and apparatus for providing Mobile internet protocol (IP) service through a network address translation gateway. In one example, a gateway between a local area network (LAN) and a wide area network (WAN) is provided. A foreign agent (FA) module is configured to advertise a care-of address (CoA) on the LAN and process registration and mobile IP communication traffic on the LAN and the WAN side of the gateway. A control module is configured to identify the registration and the mobile IP communication traffic on the LAN and the WAN. The control module sends mobile IP traffic to the FA and other traffic to a network address translation (NAT) module. In this manner, network address translation of mobile IP traffic is advantageously omitted. This allows the IP-in-IP tunnels used by mobile IP to pass through the gateway.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to packet network communication and routing and, more particularly, to a method and apparatus for providing Mobile internet protocol (IP) service through a network address translation gateway.

2. Description of the Background Art

Mobile internet protocol (IP) is an Internet Engineering Task Force (IETF) standard communications protocol that is designed to allow mobile device users to move from one network to another while maintaining the same IP address. Mobile IP is described in IETF RFC 3344, published August 2002 and incorporated by reference herein. Mobile IP provides an efficient, scalable mechanism for node mobility within the Internet. Using Mobile IP, nodes may change their point-of-attachment to the Internet without changing their IP address, which allows them to maintain transport and higher-layer connections while moving. As such, Mobile IP is a core technology that the cellular community plans on utilizing to allow mobile devices, such as, cell phones, personal digital assistants and wireless lap tops, to move seamlessly from one IP network to another.

Mobile IP utilizes home agents (HAs) and foreign agents (FAs), or HAs and a mobile node with Collocated Care of Address (CCOA) element. An HA is a router on a mobile node's home network which tunnels datagrams for delivery to the mobile node when it is away from home, and maintains current location information for the mobile node. A FA is a router on a mobile node's visited network which provides routing services to the mobile node while registered. The FA detunnels and delivers datagrams to the mobile node that were tunneled by the mobile node's home agent. For datagrams sent by a mobile node, the FA may serve as a default router for registered mobile nodes. A mobile node's CCOA provides the same function as an FA, but resides within the mobile node. Either FA or mobile node CCOA are used along with a HA.

When a mobile node detects that it has moved to a foreign network, it obtains a care-of address (COA) on the foreign network. The care-of address can be determined from FA or CCOA, depending in on which is being used. The mobile node operating away from home then registers its new care-of address with its HA through exchange of a Registration Request and Registration Reply message with it, possibly via a FA (if used). Datagrams sent to the mobile node's home address are intercepted by its HA, tunneled by the HA to the mobile node's COA, received at the tunnel endpoint (either at a FA or mobile node's CCOA), and finally delivered to the mobile node.

A basic assumption that Mobile IP makes is that FA or CCOA are uniquely identifiable by a globally routable IP address. This assumption breaks down when a mobile device attempts to communicate from behind a network address translation (NAT) gateway. Typically most home routers, wireless or otherwise, employ NATs (gateway router). IP devices which communicate from behind a NAT are reachable only through the NAT's public address or addresses. Mobile IP relies on sending traffic via IP-in-IP tunneling; however, IP-in-IP tunneling does not generally contain enough information to permit unique translation from common public addresses to particular care-of addresses (CoA) of an FA or CCOA which resides behind the NAT. In particular there are no transmission control protocol (TCP) or user datagram protocol (UDP) port numbers available for a NAT to work with. Therefore, IP-in-IP tunnels used by mobile IP generally cannot pass through a NAT.

Therefore, a need exists for a cost-effective method and apparatus for providing mobile IP service through a NAT gateway.

SUMMARY OF THE INVENTION

Method and apparatus for providing Mobile internet protocol (IP) service through a network address translation gateway. In one embodiment, a gateway between a local area network (LAN) and a wide area network (WAN) is provided. The gateway includes a foreign agent (FA) module, a control module, and a network address translation (NAT) module. The FA module is configured to advertise a care-of address (CoA) on the LAN and process registration and post-registration mobile IP traffic on the LAN and the WAN side of the gateway. The control module is configured to identify the registration and the post-registration mobile IP traffic on the LAN and the WAN to omit network address translation of this traffic during the processing thereof by the FA module.

Another aspect of the invention relates to a method of providing a gateway between a local area network and a wide area network. The gateway includes a foreign agent module and a network address translation module. Packets received from the wide area network and the local area network are inspected to identify whether each of the packets is registration mobile internet protocol (IP) traffic, mobile IP communication traffic, or other traffic. The registration mobile IP traffic and the mobile IP communication traffic are processed via the foreign agent module. The other traffic is processed via the network address translation module. In this manner, network address translation of mobile IP traffic is advantageously omitted. This allows the IP-in-IP tunnels used by mobile IP to pass through the gateway.

Another aspect of the invention relates to a computer readable medium having processor-executable instructions for performing a method of providing a gateway between a local area network and a wide area network. The gateway includes a foreign agent module and a network address translation module. Packets received from the wide area network and the local area network are inspected to identify whether each of the packets is registration mobile internet protocol (IP) traffic, mobile IP communication traffic, or other traffic. The registration mobile IP traffic and the mobile IP communication traffic are processed via the foreign agent module. The other traffic is processed via the network address translation module. In this manner, network address translation of mobile IP traffic is advantageously omitted. This allows the IP-in-IP tunnels used by mobile IP to pass through the gateway.

Accordingly, packets received by the gateway are inspected to identify whether each packet is mobile IP traffic or other traffic. Mobile IP traffic is processed by an FA module, and other traffic is processed by a NAT module. In this manner, network address translation of mobile IP traffic is advantageously omitted. This allows the IP-in-IP tunnels used by mobile IP to pass through the gateway.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1is a block diagram depicting an exemplary embodiment of a communication system100. The system100includes a mobile device102, a local area network (LAN)104, a gateway106, a wide area network (WAN)108(e.g., the Internet), and a home agent (HA)110. The mobile device102may comprise a mobile telephone, personal digital assistant (PDA), laptop computer, or the like. In one embodiment, the LAN104comprises a wireless LAN (WLAN), such as an IEEE 802.11 type network or the like, and the mobile device102communicates with the LAN104using a wireless link. Alternatively, the LAN104may be a wired network, such as an Ethernet network or the like, and the mobile device102communicates with the LAN104using a wired link.

The gateway106is configured to provide an interface between the LAN104and the WAN108. The gateway106may comprise a home router with or without wireless access point, or like type device. The gateway106includes a LAN interface (I/F)112configured for communication with the LAN104, and a WAN I/F118configured for communication with the WAN108. The gateway106facilitates communication between devices on the LAN104, such as the mobile device102, and devices on the WAN108, such as the HA110. The HA110may be further coupled to a LAN111(e.g., a wireless or wired LAN). The HA110may comprise a router or like type device.

FIG. 2is a block diagram depicting an exemplary embodiment of the gateway106in accordance with one or more aspects of the invention. The gateway106includes a processor block250various support circuits204, and an I/O interface202. The processor block250includes one or more processors201, a memory203, a network address translation (NAT) module210, a control module211, and an foreign agent (FA) module212. The processor(s)201may be any type of microprocessor(s) known in the art. The support circuits204for the processor block250include conventional cache, power supplies, clock circuits, data registers, I/O interfaces, and the like. The I/O interface202is coupled to the processor block250and includes the LAN I/F112and the WAN I/F118.

The memory203may store processor-executable instructions and/or data for execution by and/or use by the processor(s)201as described further below. These processor-executable instructions may comprise hardware, firmware, software, and the like, or some combination thereof, and may implement the NAT module210, the control module211, and the FA module212. The program instructions are configured to be executed by the processor201to cause the processor201to implement the functionalities of the modules210,211, and212. The memory203may include one or more of the following random access memory, read only memory, magneto-resistive read/write memory, optical read/write memory, cache memory, magnetic read/write memory, and the like, as well as signal-bearing media as described below. Although one or more aspects of the invention are disclosed as being implemented as a processor executing a software program, those skilled in the art will appreciate that the invention may be implemented in hardware, software, or a combination of hardware and software. Such implementations may include a number of processors independently executing various programs and dedicated hardware, such as ASICs. In some embodiments, one or more of the functional modules210,211, and212are configured in the processor(s), rather than being stored in the memory203as program instructions.

FIG. 3is a flow diagram depicting an exemplary embodiment of a method300for processing traffic in the gateway106in accordance with one or more aspects of the invention. With reference toFIGS. 1,2, and3, the mobile device102and the HA110are configured to implement the Mobile IP protocol as described above. That is, the mobile device102is identifiable by a home IP address provided by the HA110, regardless of its current point of attachment. For example, the mobile device102uses the same home IP address if attached to its home network (i.e., the LAN111) or a foreign network (e.g., the LAN104). While situated away from the home network, the mobile device102is configured to obtain a care-of address (CoA) from the foreign network. The mobile device102is configured to monitor for agent advertisement messages to obtain a CoA within a foreign network and may optionally solicit such an agent advertisement message using an agent solicitation message. The mobile device102is configured to register its new CoA with the HA110through an exchange of registration request and registration reply messages. The HA110is configured to receive IP datagrams destined for the home IP address of the mobile device102. The HA110is configured to tunnel the received IP datagrams to the CoA address of the mobile device102using an IP-in-IP encapsulation. In the reverse direction, the mobile device102may be configured to send IP datagrams to their destination using standard IP routing mechanisms. Alternatively, the mobile device102may be configured to employ reverse tunneling with the HA110(between FA module212and HA110). In general, the mobile device102and the HA110are configured to operate as a mobile node and a home agent, respectively, defined in IETF RFC 3344.

The NAT module210is configured to provide network address translation for the gateway106. As is well known in the art, NAT involves re-writing the source and/or destination addresses of IP packets as they pass through the gateway106. The term “NAT” as used herein is meant to encompass both IP address translation and IP address translation combined with port translation (also referred to as NAPT). The NAT module210is further adapted to implement aspects of Mobile IP service, as described below.

The FA module212provides a foreign agent. Notably, the FA module212is configured to advertise its presence on the LAN104through the LAN I/F112using agent advertisement messages. The agent advertisement messages include a CoA address for use by mobile devices connected to the LAN104. The FA module212uses a WAN-side IP address as the CoA address. In one embodiment, the COA address for the FA module212is the same address as the WAN address of the gateway106. Alternatively, the CoA address of the FA module212may be a different IP address to provide an added level of traffic separation between traffic destined for the FA module212and standard WAN-side traffic for the gateway106. If a unique WAN-side address is desired, the FA module212may obtain a WAN-side IP address using a WAN-side dynamic host configuration protocol (DHCP) or PPPoE (point-to-point protocol over Ethernet) client. Alternatively, a WAN-side IP address could be statically assigned as the CoA address.

The control module211is configured to classify traffic received via the LAN interface112and the WAN interface118for processing by either the FA module212or the NAT module210. Steps performed by the control module211are shown inFIG. 3. At step302, the control module211inspects a packet received from the LAN104and the WAN108. The control module211identifies whether the packet is mobile IP traffic or other traffic. As described below, the Mobile IP traffic may include registration traffic or communication traffic. For Mobile IP traffic, the control module211classifies the traffic for processing by only the FA module212. Processing of Mobile IP traffic by the NAT module210is omitted. For the other traffic, the control module211classifies the traffic for processing by the NAT module210. Thus, at step304, a determination is made whether the packet is mobile IP traffic. If so, the method300proceeds to step306, where the packet is processed by the FA module212. Otherwise, the method300proceeds to step308, where the packet is processed by the NAT module210. From steps306and308, the method300proceeds to step310, where the packet is sent via the WAN108or the LAN104. The method300is repeated for each packet.

In this manner, network address translation for Mobile IP traffic is omitted. The control module211may be a separate module implemented by the gateway106, as shown inFIG. 2. In one embodiment, the control module211comprises a filter module for filtering out Mobile IP traffic for processing by the FA module212and preventing processing by the NAT module210. In another embodiment, rather than through a separate module, the function of the control module211is part of the NAT module210or the FA module212.

The FA module212is further configured to support Mobile IP registration traffic between the mobile device102and the HA110. The control module211is configured to pass the Mobile IP registration traffic to the FA module212while omitting processing by the NAT module212. For registration request messages received at the LAN I/F112, the FA module212receives the messages from the mobile device102and alters the source IP address and port of the received messages to correspond to the WAN interface for the FA module212(the WAN IP address being the CoA of the FA module212). The FA module212records the original source IP address and port of the intercepted messages (i.e., the LAN interface of the mobile device102). The FA module212then forwards the messages to the HA110out of the WAN I/F118without involving the function of the NAT210module.

In one embodiment, the control module211classifies LAN-side Mobile IP registration traffic based on destination port. In the Mobile IP protocol, the destination port for a registration request message is user datagram protocol (UDP) port number434. The control module211forwards traffic having a UDP destination port number434to the FA module212to the exclusion of the NAT module210.

For registration reply messages received at the WAN I/F118, the control module211is configured to pass the Mobile IP registration traffic to the FA module212while omitting processing by the NAT module212. The FA module212receives the messages from the HA110, alters the destination IP address and port of the received messages to the LAN interface of the mobile device102, which was received and recorded from the corresponding registration request message (the LAN IP address being the mobile device's home address). The FA module212then forwards the messages to the mobile device102out of the LAN I/F112without involving the function of the NAT210module.

In one embodiment, the control module211classifies WAN-side Mobile IP registration traffic (to be forwarded to the mobile device) based on destination port corresponding to the source port sent in the registration request from the FA module212. The control module211forwards to the FA module212traffic received at the WAN I/F118with destination port corresponding to the source port sent in the registration request from the FA212to the exclusion of the NAT module210and the

The FA module212is further configured to support Mobile IP communication traffic (bearer traffic) between the mobile device102and the HA110. Again, the control module211is configured to pass the Mobile IP communication traffic to the FA module212while omitting processing by the NAT module212. For Mobile IP communication traffic received at the LAN I/F112, the FA module212encapsulates the traffic from the mobile device102with IP header containing CoA address for IP-to-IP tunneling to the HA110out of the WAN I/F118without involving the NAT module210.

In one embodiment, the control module211classifies LAN-side Mobile IP communication traffic based on the home address of the mobile device102. The home address of the mobile device102is learned during registration by the FA module212from the home address field in registration request and reply messages. The control module211is configured to forward to the FA module212traffic received at the LAN I/F112having the home address of the mobile device102as the source address. Processing of such traffic by the NAT module210is omitted.

For Mobile IP traffic received at the WAN I/F118, the control module211is configured to pass the Mobile IP registration traffic to the FA module212while omitting processing by the NAT module212. The FA module212decapsulates the traffic from the HA110(stripping off the outer IP header) and forward it to the mobile device102on the LAN104without involving the NAT module210.

In one embodiment, the control module211classifies WAN-side Mobile IP registration traffic with outer source IP address of the HA110as learned from home agent field in registration request and reply messages. The control module211is configured to forward to the FA module212traffic received at the WAN I/F118having the HA110address for the outer-header source IP address. Processing of such traffic by the NAT module210is omitted.

In one embodiment, the FA module212also includes a WAN-side filter to prevent traffic from any WAN source other that the HA110from reaching the mobile device102. Notably, the FA module212prevents any WAN traffic from reaching the mobile device102until the FA module212receives a Mobile IP registration request from the mobile device102. Upon receipt of the registration request from the mobile device102on the LAN-side, the FA module212establishes a WAN-side filter that only allows traffic to be received from the source IP address of the HA110in the registration request. If Mobile IP registration is successful, the FA module212will keep the filter open. The filter can remain open for the length of the Mobile IP session with the HA110.

FIG. 4is flow diagram depicting an exemplary embodiment of the flow of messages between the mobile device102, the gateway106, and the HA110during the registration process in accordance with one or more aspects of the invention. An advertisement message of the CoA address of the FA module212is sent from the gateway106to the mobile device102in step402. Then a registration request is transmitted from the mobile device102to the HA110via the gateway106in step404. Subsequently, the HA110transmits a registration reply to the mobile device102via the gateway106in step406. Notably, the circles inFIG. 4represent FA processing only (no NAT function processing).

It should be noted that the approach of the invention requires an additional global address assignment at the gateway106only if a unique CoA address is desired. This is by no means required as noted previously. A key advantage of this invention is that no modification of the mobile device102or the HA110is needed. This is in contrast to other techniques, such as the tunnel protocol described in IETF RFC 3519, where mobile device, foreign agent (if used), and home agent must be modified to support the protocol.

An aspect of the invention is implemented as a program product for use with a computer system. Program(s) of the program product defines functions of embodiments and can be contained on a variety of signal-bearing media (computer readable media), which include, but are not limited to: (i) information permanently stored on non-writable storage media (e.g., read-only memory devices within a computer such as CD-ROM or DVD-ROM disks readable by a CD-ROM drive or a DVD drive); (ii) alterable information stored on writable storage media (e.g., floppy disks within a diskette drive or hard-disk drive or read/writable CD or read/writable DVD); or (iii) information stored on a storage medium as a result of having been conveyed to a computer by a communications medium, such as through a computer or telephone network, including wireless communications. The latter embodiment specifically includes information downloaded from the Internet and other networks. Such signal-bearing media, when carrying computer-readable instructions that direct functions of the invention, represent embodiments of the invention.

Method and apparatus for providing Mobile internet protocol (IP) service through a network address translation gateway has been described. Packets received by the gateway are inspected to identify whether each packet is mobile IP traffic or other traffic. Mobile IP traffic is processed by an FA module, and other traffic is processed by a NAT module. In this manner, network address translation of mobile IP traffic is advantageously omitted. This allows the IP-in-IP tunnels used by mobile IP to pass through the gateway.

While various embodiments have been described above, it should be understood that they are presented by way of example only, and not limiting. For example, although the invention disclosed herein was discussed in connection with mobile IP services in the exemplary embodiments, one skilled in the art would recognize that the method and system disclosed herein can also be used in connection with other forms of wireless communication. Thus, the breadth and scope of a preferred embodiment should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.