Patent ID: 7441043

Claim:
A method of routing packets between a first network access device connected to the Internet through a first access network, and a second network access device, the method being performed at a secure mobility gateway having at least one Internet interface and at least one intranet interface, comprising the steps of: receiving an encapsulated IP-in-UDP racket sent from the first network access device to the second network access device through the Internet interface, the IP packet being encrypted; locating a mobile status record for the first network access device, wherein the mobile status record is located using a Security Association Index number in the encrypted IP-in-UDP packet; verifying the IP-in-UDP packet based on a parameter contained in the IP-in-UDP packet and, if the parameter is valid, then updating the mobile status record by replacing a current care-of IP address in the mobile status record with an outer source IP address of the IP-in-UDP packet, replacing a current interface in the mobile status record with the Internet interface if the current interface is the intranet interface for the first network access device, and replacing a packet sequence number for the first network access device in the mobile status record with the packet sequence number of the IP-in-UDP packet for the first network access device, if the packet sequence number of the IP-in-UDP packet is greater than a current packet sequence number stored in the mobile status record; decapsulating the IP-in-UDP packet; decrypting the IP packet; sending the unencrypted IP packet to the second network access device through an Intranet interface, as if the first network access device is deployed on a subnet of an Intranet that is represented by the Intranet interface; receiving an IP packet sent from the second network access device to the first network access device at the Intranet interface; locating a mobile status record using the destination IP address as an index; encrypting the IP packet using the Security Association in the mobile status record; encapsulating the IP packet into an IP-in-UDP packet; and sending the encrypted IP-in-UDP packet to the first network access device through the Internet interface.