Nortel Networks Corporation

Microsoft Technology Licensing, LLC

Raja P Narayanan

Haseeb Akhtar

Emad A Qaddoura

Mohamed Khalil

Akram M Hosain

Lakshminarasimhan Aravamudhan

Basavaraj B Patil

Provided is a method of providing secure communication between an initiator and a responder in a communication network. The method includes providing an encryption key for securing communications between an initiator and a responder in a communications network that includes the initiator generating an initiator Diffie-Hellman computed value, the initiator transmitting the initiator Diffie-Hellman computed value to the responder, the responder generating the encryption key and a responder Diffie-Hellman computed value, the responder transmitting the responder Diffie-Hellman computed value to the initiator, and the initiator generating the encryption key.

Key exchange for a network architecture

Provided is a method of providing secure communication between an initiator and a responder in a communication network. The method includes presenting a registration request with one or more proposals for dynamically establishing a security association between the initiator and the responder, and receiving a registration response indicating whether any of the one or more proposals have been accepted for the security association.

A key exchange for a network architecture. A mobile node that roams over a foreign domain transmits a registration request to a home domain using the foreign domain. The identity of the mobile node within the registration request is encrypted. The home domain receives the registration request and decrypts the mobile node identity. The home domain generates a registration reply that includes encryption keys for encrypting information to be transmitted between and among the home domain, the foreign domain, and the mobile node.

A method and apparatus for allowing a plurality of mobile nodes to access a network with one or more Network Access Identifiers (NAIs), This allows a user to access a network with multiple mobile nodes using a single NAI. The method and apparatus is achieved by the addition of a Session/Device Extension, a Host Identification Extension, a Host Identification NAI Extension, and/or a Lease Time Extension.

Method and apparatus for managing a plurality of mobile nodes in a network

In an IP-based mobile communications system, the Mobile Node changes its point of attachment to the network while maintaining network connectivity. Security concerns arise in the mobile system because authorized users are subject to the following forms of attack: (1) session stealing where a hostile node hijacks session from mobile node by redirecting packets, (2) spoofing where the identity of an authorized user is utilized in an unauthorized manner to obtain access to the network, and (3) eavesdropping and stealing of data during session with authorized user. No separate secure network exists in the IP-based mobility communications system, and therefore, it is necessary to protect information transmitted in the mobile system from the above-identified security attacks. The present invention improves the security of communications in a IP mobile communications system by creating variable-based Security Associations between various nodes on the system, a Virtual Private Network supported by an Service Level Agreement between various foreign networks and a home network, and an SLA Broker to promote large-scale roaming among different SLAs supported by the SLA Broker or agreements with other SLA Brokers.

Security framework for an IP mobility system using variable-based security associations and broker redirection

An improved wireless mobile IP system including an apparatus and method for managing transmission of information. Agent advertisements are used to detect movement of the mobile node and derive care-of addressing information for the Home Agent. Foreign Agents and Home Agents currently periodically broadcast an agent advertisement on the data channel. The claimed system reduces the need for agent advertisements by detecting movement of a mobile user into a new network using either the mobile node or a routine on a low-level protocol layer. After detection of movement, an agent solicitation message is transmitted from the mobile node or from the cell-site transmitter. The mobility agent then transmits a single agent advertisement in response. Derived care-of addressing information will then be registered with the Home Agent to support 'tunneling' of communications to the mobile node through the foreign network. Transmission of agent advertisements and associated non-data traffic on the data channels will be reduced.

Unicast agent advertisement based on layer 2 and layer 3 motion detection

A new extensions structure for mobile IP control message extensions is employed to conserve the type field. Certain types of extensions, such as network access identifiers, are initially aggregated and subtypes are employed to identify the precise content of the extension (e.g., mobile node network access identifier, home agent network access identifier, foreign agent network access identifier, etc.). Long and short formats for the new extension structure are defined, with the long format applicable to nonskippable extensions carrying more than 256 bytes and the short format backwards compatible with currently defined skippable extensions with less than 256 bytes of data. This will greatly reduce usage of the type field.

Mobile IP extensions rationalization (MIER)

A method and apparatus in a communications system for processing control messages for a session in a packet-based network within the communications system. A first indicator is set in a control message for handling a session within the communications system through the packet-based network. The control message is sent to a destination within the packet-based network. The control message is provided priority processing within the packet-based network based on the presence of the first indicator. A second indicator is set in a header of a packet used to transport the control message, such that nodes within the packet based network, which do not examine the control message, provide priority processing of the packet in sending the packet through the packet-based network to the destination.

Growing community of inventors

Irving, TX, United States of America

Raja P Narayanan