Patent Publication Number: US-2006007879-A1

Title: Home agent

Description:
BACKGROUND OF THE INVENTION  
      1. Field of the Invention  
      The present invention relates to a home agent. More particularly, the present invention relates to a home agent that stores binding information of a care of address (CoA) and a home address (HoA) of a mobile terminal, and that intercepts a packet sent from a communication partner terminal and transfers the packet to the care of address.  
      2. Description of the Related Art  
      In an IP (Internet Protocol) network, the mobile IPv4 (mobile Internet Protocol version 4) has been standardized by IETF (Internet Engineering Task Force) as a protocol that enables a terminal to continue communications even though the terminal moves between network areas. In addition, in recent years, a problem in that IP addresses may run out is getting worse due to a rapid increase of a number of terminals. Against this backdrop, efforts for shifting networks from IPv4 to IPv6 (Internet Protocol version 6) are taking off in recent years, in which IPv6 is a protocol that provides larger number of IP addresses. Thus, in addition to the mobile IP protocol based on IPv4, a mobile IP protocol based on IPv6 is being standardized as a protocol that supports mobility of terminals on an IPv6 network. IPv6 is subjected to deliberation in IETF to make RFCs for the IPv6.  
      In the mobile IPv6, a mobile terminal (to be referred to as MN: Mobile Node hereinafter) is associated with a home agent (HA) that manages movement of the mobile node. The home agent (HA) registers a care of address (CoA) of the mobile node. The care of address is an address assigned to the mobile node at a moved position that is out of a home link. After the care of address is registered in the home agent, when the mobile node further moves to another area, the mobile node sends a new care of address to the home agent, so that the home agent updates the care of address corresponding to the mobile node. The home agent relays a packet for the mobile node.  
      In the mobile IPv6, it is indispensable to use IPsec (IP Security Protocol) encryption. Generally, the process load for the IPsec encryption is larger than that of packet transferring or encapsulate/decapsulate processing, and generally, the higher the security level is, the heavier the load for the IPsec encryption is.  
       FIG. 1  is a block diagram showing an example of a conventional mobile IP system. In the figure, the mobile node  10  has a predetermined home address (HoA), and the mobile node  10  is usually connected to a home link  11  that is an intranet LAN and the like. A home agent (HA)  12  that is a router is connected to the home link  11 . In addition, the home agent  12  is connected to a network  13  such as the Internet.  
      When the mobile node  10  moves to a foreign link  14 , the home agent  12  obtains a binding cache (BC) that includes a pair of the care of address and the home address of the mobile node  10 . In addition, the home agent  12  has an IP-in-IP encapsulating function for encapsulating an IP packet transferred from a communication partner terminal (to be referred to as CN: Correspondent Node hereinafter) to the home address of the mobile node and transferring the encapsulated IP packet to the care of address of the mobile node, so that the packet transferred from the correspondent node  15  can be relayed to the mobile node  10 .  
      In Japanese Laid-Open Patent Application No. 10-126405, a mobile computer is disclosed, in which the mobile computer obtains and compares security policies of encryption gateways located in a home link and a foreign link so as to determine whether the encryption gateway of the foreign link can be used as an end point of an encrypted tunnel. If the encryption gateway of the foreign link cannot be used as the end point, the encryption gateway of the foreign link is set such that it passes through an encrypted tunnel flow, so that the mobile computer itself terminates the tunnel.  
      From now on, as mobile communications become widespread, it becomes necessary to insure different levels of security according to move destination areas or correspondent nodes requesting a communication. For example, in a case when a user travels on business to a group company and the user receives a VoIP (Voice over IP) call from the user&#39;s section at the group company via a network of the group company, it is necessary to encrypts the VoIP communication to prevent leakage of information.  
      Also, there is another method for processing data of communications other than the above-mentioned packet-by-packet encryption processing according to move destination areas or the like. For example, there is “reading right processing” for preventing a user from printing out (or copying) an electric document received by FTP (File Transfer Protocol) in a customer&#39;s company.  
      Other than the security service, it may be required to provide different services according to move destination areas or correspondent nodes requesting communications. Although a conventional home agent includes an encryption processing function, the conventional home agent does not include a function to change encryption levels according to a combination of a move destination area and a correspondent node for each mobile node.  
      In addition, the heavy load for encryption processing is a bottleneck in realizing scalability such as providing a large capacity home agent. This causes a problem for realizing the function to change encryption levels according to a combination of a move destination area and a correspondent node for each mobile node. That is, the heavy load for encryption processing causes a problem for applying an encryption algorithm of a strength suitable for insuring a necessary security level to perform encryption.  
      To provide a function of packet-by-packet encryption without using the home agent and to provide value added services, it can be considered to provide a specific server that has the function of packet-by-packet encryption and the function to provide the value added services. That is, an encryption gateway server or a reading right processing server is provided to encrypt communication information or to prevent leakage of electronic documents. In mobile communications using the mobile IP, by providing the encryption gateway server or the reading right processing server for relaying packets at a position indicated by a dotted line  16  in  FIG. 1  between the home agent  12  and the foreign link  14 , it is possible to provide the desired security level or the additional services.  
      However, each of the encryption gateway server and the reading right processing server requires an after-mentioned special processing overhead. Further, there is a problem in that transmission speed is decreased since all communication data are passed through the servers.  
      In a case where mobile communications based on mobile IP are performed, the home agent  12  intercepts a packet sent from the correspondent node  15  to the mobile node  10 . The home agent  12  encapsulates the packet and transfers the encapsulated packet to the care of address of the mobile node  10  such that the correspondent node  15  does not need to know movement of the mobile node  10 . A source address of the packet sent from the home agent  12  to the mobile node  10  is an address of the home agent  12 . Thus, in the case when the encryption gateway server or the reading right processing server indicated by the dotted line  16  is provided between the home agent  12  and the mobile node  10  for performing processes according to move destination areas or correspondent nodes, it is necessary for each of the servers to read a destination address and a source address of a packet that is included in the encapsulated packet. Since the care of address is an address that is dynamically obtained in a move destination, the care of address cannot be used as a key for determining a proper security policy.  
      The above-mentioned process is an additional process for the encryption gateway server or the reading right processing server, and causes a process overhead so that transferring performance may degrade. In addition, there may be a case in which the processing in the server is not necessary according to a move destination area or a correspondent node. Even when the processing of the servers is unnecessary, since all packets are passed through and the processing is performed, the servers may become a bottleneck of communications.  
     SUMMARY OF THE INVENTION  
      An object of the present invention is to provide a home agent that can switch services according to a combination of a move destination area and a corresponding node for each mobile node to prevent degradation of a data transfer rate.  
      The object is achieved by a home agent that holds binding information of a care of address and a home address of a mobile node, and that transfers, to the care of address, an IP packet sent to the home address, the home agent including: 
          a service switching part for switching services on the basis of a combination of a move destination of the mobile node and a correspondent node for the mobile node.        

      According to the present invention, services can be switched according to a combination of a move destination and a correspondent node so as to prevent degradation of data transfer rate.  
      The service switching part may include: 
          a transferring part for transferring an object packet of a specific service to an external apparatus; and     a receiving part for receiving the object packet on which a process relating to the specific service has been performed in the external apparatus. Accordingly, only the object packet of the specific service can be transferred to the external apparatus so that degradation of the data transfer rate can be avoided.       

    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
      Other objects, features and advantages of the present invention will become more apparent from the following detailed description when read in conjunction with the accompanying drawings, in which:  
       FIG. 1  is a block diagram showing an example of a conventional mobile IP system;  
       FIG. 2  is a block diagram of an embodiment of a mobile IP system according to the present invention;  
       FIG. 3  is a block diagram of a home agent according to a fist embodiment of the present invention;  
       FIG. 4  is a block diagram showing a home agent modified from one shown in  FIG. 3 ;  
       FIGS. 5A-5D  show configurations of tables in the home agent;  
       FIGS. 6A-6F  show configurations of tables in a service management part;  
       FIG. 7  shows a sequence chart for generating an entry of encryption information;  
       FIG. 8  shows a sequence chart for switching external apparatuses;  
       FIG. 9  shows a sequence chart for providing an additional service;  
       FIG. 10  is a block diagram of the home agent according to a second embodiment of the present invention. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
      In the following, embodiments of the present invention are described with reference to figures.  
       FIG. 2  is a block diagram of an embodiment of a mobile IP system according to the present invention. In the figure, the same reference numerals used in  FIG. 1  are used to identify corresponding features in  FIG. 2 . In  FIG. 2 , the mobile node  10  has a predetermined home address (HoA), and the mobile node  10  is usually connected to a home link such as a LAN and the like in a head office. A home agent  22  that is a router is connected to the home link  11 . In addition, the home agent  22  is connected to a network  13  such as the Internet.  
      The home agent  22  holds a biding cache (BC) that is a pair of the care of address and the home address of the mobile node  10  when the mobile node  10  moves to an foreign link  14  such a LAN in a branch office. In addition, the home agent  22  includes an IP-in-IP encapsulating function for encapsulating an IP packet transferred to the home address of the mobile node and transferring the encapsulating IP packet to the care of address, so that the packet is transferred from a correspondent node (CN)  15  to the mobile node  10 .  
      In the present invention, a security policy is realized or a service is provided according to a foreign link and a correspondent node for the mobile node  10 . For this purpose, functions in the encryption gateway server or the reading right processing server are not modified. Instead of that, a security policy database, for example, in the home agent  22  is extended so that only communications that require processing by the external apparatuses  24 ,  25 ,  26  such as the encryption gateway sever or the reading right processing server are transferred to the external apparatuses  24 ,  25 ,  26  based on policies in the security policy database. The external apparatuses are connected to the home link  11 . Alternatively, the external apparatuses  24 ,  25  and  26  may be directly connected to the home agent  22  without passing through the home link  11 . In addition, the number of the external apparatuses can be 1, 2, or more than 3.  
      A packet processed in an external apparatus returns to the home agent  22 , and the home agent  22  performs regular mobile IP transferring processes. Accordingly, the external apparatus does not require adding additional functions such as a function for reading information in an encapsulated packet. In addition, any traffic that is not a process target does not pass through the external apparatus. Therefore, the bottleneck problem can be avoided. Further, since a general computer can be used as the external apparatus, a system can be constructed with low cost and services can be provided flexibly.  
       FIG. 3  is a block diagram of a home agent according to a fist embodiment of the present invention.  FIG. 4  is a block diagram showing a home agent modified from one shown in  FIG. 3 . In  FIGS. 3 and 4 , an arrow with a solid line indicates a flow of packet data and an arrow with a dotted line indicates a flow of control data.  
      First, packet processing that does not require special security processing or additional service processing is described.  
      In  FIG. 3 , a packet received from the network  13  is provided to a packet identifying part  31  first, so that a next process is determined according to header information in the packet.  
      (1) In a case where the home agent  22  receives a position registration message (Binding Update message) from the mobile node  10   
      The packet identifying part  31  determines that the position registration message is received by identifying that the packet includes an address of the home agent  22  as a destination IP address and an optional header including information of the position registration message. After that, since the packet of the position registration message includes authentication data and is encrypted, a SAD part  32   a  extracts a SPI (Security Parameter Index) that is an identifier of SA (Security Association) that is a logical connection, searches a SAD (Security Association Database) in the SAD part  32   a  by using the SPI as a key, so as to obtain information necessary for decryption.  
      The SAD part  32   a  passes the information and the packet to a decryption part  33   a  to decrypt the packet. The decrypted packet is provided to a position information management part  34 . The position information management part  34  extracts information necessary for position management, generates and updates management information. For example, if the mobile node  10  moves to a new area so that the mobile node  10  sends a care of address to the home agent  22 , the home agent  22  holds a binding of the home address (HoA) and the care of address (CoA) of the mobile node  10 . Further, to relay the packet from a correspondent node to the mobile node  10 , a B.C. process part  38  stores the binding in a binding cache (B.C.) table in the B.C. process part  38 .  
      After the position information management part  34  receives the position registration message and performs the above-mentioned necessary processes, the position information management part  34  generates a registration acknowledgement message (Binding Acknowledge:BA message) to the mobile node  10  that is the source of the message. The packet of the acknowledgement message is passed to an encryption part  35   a  with encryption execution information specified by the position information management part  34  so that the packet is encrypted. After the encryption, the packet is passed to a routing process part  37 , and is transmitted from a network interface indicated by a forwarding table in the routing process part  37 .  
      (2) In a case where the home agent  22  receives a packet sent to the home address (HoA) of the mobile node  10  from a correspondent node  
      The packet identifying part  31  determines that the packet is one sent to the home address of the mobile node  10  since the packet is not the packet of the position registration message and is not the IP-in-IP encapsulated packet. Then, the packet is passed to the B.C. process part  38 . Then, the B.C. process part  38  extracts the destination address of the packet and searches the B.C. table by using the destination address as a key.  
      If there is no corresponding entry in the B.C. table, the B.C. process part  38  passes the packet to the routing process part  37  so that the packet is transmitted from a network interface indicated by information in the forwarding table. The fact that the destination address is HoA and that there is no entry in the B.C. table means that the mobile node  11  is not moved from the home link  11 , so that the result of routing is a network interface connected to the home link  11 .  
      If an entry exists in the B.C. table, since the mobile node  10  exists in a foreign link  14  and has a care of address, the B.C. process part  38  passes the packet to the encapsulating part  39  with the care of address obtained from the B.C. table. The encapsulating part  39  encapsulates the packet to generate an IP-in-IP encapsulated packet in which the destination address is the care of address and the address of the home agent is a source address. Then, the encapsulating part  39  passes the encapsulated packet to a SPD part  40 .  
      The SPD part  40  extracts header information from the packet, and searches a SPD (Security Policy Database) by using the header information as a key. If there is no corresponding entry in the SPD, the SPD part  40  passes the packet to the routing process part  37  so that the packet is transmitted from a network interface indicated by information in the forwarding table.  
      If there is a corresponding entry in the SPD, the SPD part  40  passes the entry information to the SAD part  32   c  with the packet. The SAD part  32   c  selects a SA based on the entry information. Then, the SAD part  32   c  passes the packet to the encryption part  35   c . After the encryption part  35   b  encrypts the packet, the encryption part  35   b  passes the packet to the routing process part  37 , so that the packet is transmitted from a network interface indicated by information in the forwarding table. The destination address of the encrypted packet is the care of address, so that the packet is transferred to the mobile node  10  as a result of routing.  
      In the example shown in  FIG. 4 , when there is the entry in the B.C. table, the B.C. process part  38  passes the packet to the SPD part  40  with the care of address obtained from the B.C. table. The SPD part  40  extracts header information from the packet so as to search the SPD. If there is no entry in the SPD, the encapsulating part  39  encapsulates the packet to generate an IP-in-IP encapsulated packet and passes the packet to the routing process part  37 . If there is an entry in the SPD, the packet with the entry information is passed to the encapsulating part  39  to generate an IP-in-IP encapsulated packet. Then, the packet and the entry information is passed to the SAD part  32   c.    
      (3) In a case where the home agent  22  receives a packet sent to a correspondent node from the mobile node  10  having the care of address that resides in the foreign link  14   
      The packet identifying part  31  determines that the packet is sent for the correspondent node since the destination IP address is the address of the home agent  22 , and the packet is an IP-in-IP encapsulated packet or an encrypted packet without an option header including information of the position registration message.  
      When the packet to the correspondent node is an IP-in-IP encapsulated packet, the packet is passed to the decapsulation part  36  to decapsulate the packet. Then, the packet is passed to the routing process part  37 , and the packet is transmitted from a network interface indicated by the forwarding table in the routing process part  37 .  
      When the packet identifying part  31  determines that the packet is an encrypted packet, the packet identifying part  31  passes the packet to the SAD part  32   b . The SAD part  32   b  extracts a SPI in the packet, searches a SAD (Security Association Database) by using the SPI as a key so as to obtain information necessary for decoding. Then, the packet and the information are passed to the decoding part  33   b  to decoding the packet. The decoded packet is decapsulated in the decapsulation part  36 . Then, the packet is transmitted from a network interface indicated by the forwarding table in the routing process part  37 .  
      (4) In a case where the home agent  22  receives a packet from the home link  11   
      The received packet is passed to the routing process part  37 , and the packet is transmitted from a network interface indicated by the forwarding table in the routing process part  37 .  
      A conventional home agent also performs he above-mentioned operations that do not require any special security processes or additional service processes.  
      In the present invention, the home agent is configured such that services can be switched according to a combination of a move destination and a correspondent node for each mobile node. For realizing this feature, a filter (FLT) part  41  is added between the home link  11  and the routing process part  37 . In addition, a route from the filter part  41  to the decapsulation part  36 , a route from the SAD part  32   b  to an interface of the home link  11  and a route from the SPD part  40  to the interface of the home link  11  are provided. In addition, in the configuration shown in  FIG. 4 , a route from the filter part  41  to the B.C. process part  38  and a route from the encapsulation part  39  to the interface of the home link  11  are provided.  
      Further, the home agent  22  has distribution logic for distributing a packet to the routes so that the home agent  22  determines a service to be provided according to a combination of a move destination and a correspondent node for each mobile node, and requests an external apparatus to perform necessary processes according to the service. The service management part  42  is provided for performing management of the distribution logic and generation of distribution information. The service management part  42  provides the filter part  41 , the SAD part  32   b  and the SPD part  40  with necessary instructions, and makes settings for the parts.  
       FIG. 5A  shows a configuration of a database included in the SPD part  40 . As shown in  FIG. 5A , the database includes key items of “source IP address”, “destination IP address” and “protocol”, “source port”, and items of “destination port”, “CoA prefix value” (indicating a network in which a mobile node resides), “IPsec applied or not”, “SAD pointer”, “encapsulation instruction”, “external transfer instruction flag”, and “external transfer destination INF”.  
       FIG. 5B  shows a configuration of a database included in the SAD part  32   b . The database includes a key item of “SPI”, and items of “IPsec application protocol”, “IPsec encapsulation mode”, “encryption algorithm”, “authentication algorithm”, “external transfer instruction flag”, and “external transfer destination INF”.  FIG. 5C  shows a configuration of a database included in each of the SAD parts  32   a  and  32   c . The database includes a key item of “SAD pointer” that is SPD entry information. In addition, the database includes “IPsec application protocol”, “IPsec encapsulation mode”, and “encryption algorithm”, and “authentication algorithm”.  
       FIG. 5D  shows a configuration of a FLT table in the filter part  41 . The database includes key items of “receive NW interface” and “protocol”. In addition, the database includes “transfer block” that is associated with the key items.  
      FIGS.  6 A-F show configurations of tables in the service management part  42 . As shown in  FIG. 6A , “index of application policy” is set for each “home address” of mobile nodes. As shown in  FIG. 6B , for “index of application policy”, “list of correspondent nodes” is set, and “protocol”, “CN application level” and “application service” are set for each correspondent node.  
      As shown in  FIG. 6C , “CoA application level” is set for each care of address or prefix of care of address. In addition, as shown in  FIG. 6D , “combination application level” is set for each pair of “CN application level” and “CoA application level”. As shown in  FIG. 6E , “combination application level” is associated with “external apparatus ID” and “external transfer destination INF”. In addition, as shown in  FIG. 6F , “application service” is associated with “external apparatus ID” and “external transfer destination interface”.  
      Instead of setting “application service” for each correspondent node corresponding to “index of the application policy” as shown in  FIG. 6B , “application service” may be set with the “combination application level” for the “CN application level” and the “CoA application level”. In this case, application services can be switched according to a mobile node and a correspondent node.  
      In the following, operations for switching encryption levels according to a combination of a move destination and a correspondent node for each mobile node are described. The home agent  22  performs selection of an encryption level and performs encryption. For selecting the encryption level, each of the SAD part  32   b  and the SPD part  40  includes entries of encryption information (security policy) corresponding to each combination of a move destination and a correspondent node for each mobile node.  
       FIG. 7  shows a sequence chart for generating the entry of the encryption information. New registration or registration update of position information of the mobile node  10  in the foreign link  14  triggers the entry generation process. The mobile node  10  obtains its care of address in the foreign link  14 , and sends the care of address to the home agent  22  by using the position registration message.  
      The service management part  42  in the home agent  22  has an information database including CN application levels for each correspondent node for each mobile node ( FIGS. 6A and 6B ) and including CoA application levels each corresponding to a prefix of a care of address ( FIG. 6C ). The CN application level is a security assuring level for a correspondent node corresponding to a mobile node. The CoA application level is a security assuring level of a foreign link corresponding to a prefix of a care of address.  
      When the home agent  22  receives a position registration message in step S 10 , the position registration message is sent to the position information registration management part  34  according to a procedure the same as conventional one. In addition to performing conventional processes including generation or update of B.C. table by using the notified care of address, the position information registration management part  34  sends information of the mobile node  10  and the care of address to the service management part  42  if the extracted care of address is new for the mobile node  10 .  
      In response to receiving the information, the service management part  42  determines a combination application level as a security policy that should be applied to the combination of the correspondent node and the care of address by using the information database of the security assuring level. The determined combination application level is set in the SAD part  32   a  and the SPD part  40 . That is, a security policy for a combination of a correspondent node and a care of address is determined from a security assuring level corresponding to the correspondent node and a security assuring level corresponding to the prefix of the care of address.  
      When the home agent  22  receives a packet sent from a correspondent node  15  to the mobile node  10  or a packet sent from the mobile node  10  to the correspondent node  15 , the home agent  22  refers to the entry so as to select an encryption level that is the combination application level. Then, an instruction is sent to the encryption part  35   b  or the decoding part  33   b  according to the level.  
      If the selected combination application level is a predetermined level, the processing object packet is transferred to an external apparatus  24 , for example, that is an external encryption process apparatus, so that the external apparatus  24  performs encryption processes. The above-mentioned procedure is a mechanism for causing the external apparatus  24  to perform a specific encryption process having heavy process load.  
      As shown in  FIG. 6E , the service management part  42  has an external apparatus ID and an external transfer destination interface as information on apparatuses for performing the specific encryption process. The service management part  42  determines an application security policy corresponding to a combination of a correspondent node  15  and a care of address, and determines an apparatus (the home agent  22  itself or the external apparatus  24 ) that realizes the security policy. Then, the service management part  42  makes a setting for the SAD  32   a  and the SPD part  40 .  
      Each of the SAD part  32   a  and the SPD part  40  refers to the setting information when receiving a packet. If there is a setting indicating that the packet should be transferred to the external apparatus  24 , the packet is transferred to a designated external transfer destination interface.  
      When the home agent  22  receives a processed packet from the external apparatus  24 , the home agent  22  performs a relay process for relaying the packet to the correspondent node  15  or the mobile node  10 . For realizing this process, the filter part  41  determines whether the packet is for the correspondent node  15  or the mobile node  10  by identifying a receive interface by using the filter table shown in  FIG. 5D , so that the filter part  41  distributes the packet to a proper process block.  
      For example, a packet received by a network interface to which the external apparatus  24  is not connected is passed to the routing process part  37  so that the packet is forwarded in the conventional way. When the packet is received by a receive network interface to which the external apparatus  24  is connected, if the packet is an IP-in-IP encapsulated packet, the home agent  22  determines that the packet is sent from the mobile node  10  to the correspondent node  15 , so that the packet is passed to the decapsulating part  36 . If the packet is an encrypted packet that is not encapsulated, the home agent  22  determines that the packet is a packet sent from the correspondent node  15  to the mobile node  10 , so that the packet is passed to the routing process part  37  that forwards the packet based on information of the packet header.  
      An IPsec encryption mode performed in the external apparatus  24  is a transparent mode in which information other than the packet header in the packet is encrypted. As shown in  FIG. 3 , a packet sent from the correspondent node  15  to the mobile node  10  is encapsulated in the encapsulating part  39 . After that, the packet is transferred to the external apparatus  24 . The destination address in a packet header in the packet encrypted in the transparent mode by the external apparatus  24  is the care of address of the mobile node  10  that can be referred to by the routing process part  37 . Thus, the routing process part  37  can forward the packet.  
      In the following, an embodiment is described in which external apparatuses are changed according to encryption levels. In this embodiment, a plurality of external apparatuses (external apparatuses  24  and  25 , for example) that perform different encryption algorithms are used. The home agent  22  distributes a packet to a suitable external apparatus according to a required encryption process. This feature can be realized by increasing a number of entries of a table, in the service management part  42 , storing correspondences of external apparatuses and connection interfaces. Accordingly, scalability can be realized for the encryption processes.  
       FIG. 8  shows a sequence of the process for switching external apparatuses. In the figure, when the home agent  22  receives a packet from the correspondent node  15  in step S 20 , the packet is encapsulated according to information of the B.C. table of the B.C. process part  38 . After that, if there is a transfer instruction for transferring the packet to an external apparatus in the SPD of the SPD part  40 , the packet is transferred to an external transfer destination interface to which the external apparatus is connected. In step S 21 , the external apparatus encrypts the packet according to SPD information in the external apparatus itself. After that, the external apparatus transfers the packet to a connection network interface connected to the home agent  22 . In step S 22 , the home agent  22  receives the packet via a receive network interface, and recognizes that the packet is an encrypted packet. Then, the packet is passed to the routing process part  37 , so that the home agent  22  forwards the packet to the mobile node  10  on the basis of information in the packet header.  
      In step S 23 , when the home agent  22  receives a packet from the mobile node  10 , if there is a transfer instruction, in the SPD in the SPD  32   b , to transfer the packet to an external apparatus, the home agent  22  transfers the packet to an external transfer destination interface to which the external apparatus is connected. In step S 24 , the external apparatus decodes the packet according to information in a SPD in the external apparatus. After that, the external apparatus transfers the packet to a connection network interface connected to the home agent  22 . In step S 25 , the home agent  22  receives the packet via a receive network interface and identifies that the packet is not an encrypted packet. Then, the decapsulating part  36  decapsulates the packet, and the packet is passed to the routing process part  37  that forwards the packet to a correspondent node  15  according to information in the packet header.  
      The connection network interface may correspond to a physical interface or a logical interface which is one of multiplexed logical interfaces in a physical interface by using VLAN. By using the logical interface, a number of physical interfaces can be decreased in the home agent  22 . Thus, the method of using the logical interface is effective when the home agent  22  needs to connect to a plurality of encryption process apparatuses.  
      Next, an embodiment is described in which the home agent  22  determines an additional service other than encryption so as to transfer a processing object packet to an external apparatus that performs the service. An example of the additional service is “reading restriction service” to prevent an electronic document received by using FTP in a customer&#39;s company from being printed out.  
      In this embodiment, the configuration of the home agent  22  is one shown in  FIG. 4 . Transfer routes from the SPD part  40  to the external apparatus  26  and from the encapsulating part  39  to the external apparatus  26  are provided. In addition, a transfer route is provided for transferring a packet received from the external apparatus  26  from the filter part  41  to the B.C. process part  38 . The transfer routes are used for transferring a packet before encapsulation to the external apparatus  26 , and for encapsulating the returned processed packet according to a service.  
       FIG. 9  shows a sequence chart for providing the additional service. As shown in the figure, in step S 30 , the home agent  22  receives a packet from the correspondent node  15 . If there is a transfer instruction, in the SPD in the SPD part  40 , for transferring the packet to the external apparatus  26 , the home agent  22  transfers the packet to an external transfer destination interface to which the external apparatus  26  is connected without encapsulating the packet. In step S 31 , after the external apparatus  26  performs a predetermined process, the external apparatus  26  transfers the packet to a connection network interface of the home agent  22 .  
      In step S 32 , the home agent  22  receives the packet via a receive network interface to which the external apparatus  26  is connected. The home agent  22  passes the packet to the B.C. process part  38  with the receive network interface information. The B.C. process part  38  performs a regular process and passes the packet and the receive network interface information to the SPD part  40 . In the SPD part  40 , if a network interface to which the SPD instructs to transfer the packet is the same as the receive network interface, the transfer instruction by the SPD is neglected, and the home agent  22  performs a regular process. That is, the encapsulating part  39  encapsulates the packet. Then, the packet is passed through the SAD part  32   c  and the encryption part  35   b  so that the packet is forwarded by the routing process part  37  based on information in the packet header to the mobile node  10 . There may be a case where the packet does not pass through the SAD part  32   c  and the encryption part  35   b  according to the type of the packet.  
      A plurality of external apparatuses that provide additional services can be connected to the home agent  22  so that flexible combinations and configurations of the services can be provided.  
      Next, an embodiment is described in which the external apparatuses communicate with the mobile node  10  so as to dynamically exchange service performing information when encryption and additional services are provided.  
      In this embodiment, the home agent intercepts information exchanged between the external apparatuses and the mobile node  10  so as to obtain necessary information so that the information is shared by the home anent  22  and the external apparatuses.  
       FIG. 10  is a block diagram of the home agent according to a second embodiment. In the figure, the same reference numerals have been used in  FIG. 10  to identify corresponding features in  FIG. 4 . A different point between  FIG. 10  and  FIG. 4  is that a service control protocol process part  43  is provided in  FIG. 10 .  
      The home agent shown in  FIG. 10  is configured such that an encrypted logical connection can be dynamically established between an external apparatus and the mobile node  10 . The home agent  22  relays protocol data used for negotiation to an external apparatus. In the relaying process, the packet identifying part  31  intercepts information of encrypted logical connection and provides the information to the service control protocol process part  43 , in which the information of encrypted logical connection are necessary for the SAD parts  32   a ,  32   b  and  32   c  and the information includes an IPsec application protocol, an IPsec encapsulating mode, an encryption algorithm and an authentication algorithm. Then, the service control protocol process part  43  holds the information and updates the IPsec application protocol, the IPsec encapsulating mode, the encryption algorithm and the authentication algorithm in the database in the SAD parts shown in  FIGS. 5B and 5C .  
      The present invention is not limited to the specifically disclosed embodiments, and variations and modifications may be made without departing from the scope of the present invention.  
      The present application contains subject matter related to Japanese patent application No. 2004-203677, filed in the JPO on Jul. 9, 2004, the entire contents of which are incorporated herein by reference.