KR100546765B1 - Method for providing NAT in mobile IPv6 network - Google Patents

Abstract

In the method for providing network address translation in Mobile IPv6 according to the present invention, when a mobile node moves to a new network, it is determined whether the network address translation is performed and a binding update message is determined based on the home agent. Transmitting to; Receiving, by the home agent, the binding update message, a binding akcnowledgement messae corresponding to the mobile node; And sending, by the mobile node receiving the binding response message, an additional response message in which the temporary address in the new network is protected by IPsec (internet protocol security) to the home agent. By detecting whether the node and the home agent translate the network address in advance and responding appropriately, the network address mismatch problem for the mobile node that may occur during the home registration process can be solved.

Description

How to provide network address translation in IPv6 {Method for providing NAT in mobile IPv6 network}

1 is a conceptual diagram of address flow according to network address translation in Mobile IPv6.

2 is a diagram illustrating a message flow with network elements associated with a mobile node for detecting network address translation.

3 is a diagram illustrating a format of a binding message for network address translation.

4 is a flowchart illustrating a home registration process according to network address translation.

The present invention relates to a method for ensuring mobility of a mobile node in Mobile IPv6. More particularly, the present invention relates to a network between a mobile node and a home agent by using binding messages when a home node enters a network performing network address translation and then registers a home. The present invention relates to a method for correctly delivering data by recognizing address translation.

In the Mobile IPv6 protocol, a mobile node is provided with continuous network service through a proper combination of a home address and a care-of address (COA) regardless of its current location. That is, the IP header of the transmitted packet uses a temporary address temporarily assigned by the mobile node to which the mobile node newly moves and enters, but the home layer is used by the application layer including the transport layer. It also provides transparency about the mobility of nodes. These mobile nodes can be identified and distinguished only by IP addresses that can be routed in the public network.

However, if you go inside a link that uses Network Address Translation (NAT) and get a private address and use it as the primary care-of address, serious problems can occur. This is because all home agents and correspondent nodes can perform a process for authentication / authorization services for mobile nodes based on the mobile node's home address and the temporary address available on the public network.

Of course, the IP header source address of the message sent by the mobile node is translated into a public care-of address that can be used on the Internet while traversing the NAT. However, security mechanisms such as Internet Protocol Security (IPsec) and Return Routability Procedures operate based on the assumption that the same address can be used at both ends, which can lead to serious conflicts with address translation mechanisms such as NAT.

In summary, the Mobile IPv6 protocol simultaneously uses the binding procedure function to allow the use of a new address by the mobile node and the IPsec security protocol to ensure safety. Perform the Routability Procedure.

In addition, both these binding procedures and IPsec operate based on IP addresses, and mobile nodes can transparently use temporary addresses assigned from new networks to applications. However, since the mobile node moves to the inside of the network using the network address translation function and the allocated temporary address is a private address of the local area that is not valid in the external network, the proper binding procedure function cannot be processed.

Looking at the method for mobility support in the conventional IPv4 network, the mobile node uses an external agent for the mobile network, and all connections to handle the binding process to the home agent use a tunneling technique between the home agent and the external agent. . The process for supporting mobility in an IPv4 network is as follows.

1) The mobile node receives a new temporary address from an external agent and requests a new binding update from the home agent.

2) This binding procedure uses tunneling technique between home agent and external agent, and IP-in-IP or IPsec tunneling can be selectively used.

3) In the communication between the counterpart node and the mobile node, a function of directly communicating without passing through a home agent is optionally provided.

4) Because external agent and home agent use tunneling technique, it is not affected by network address translation.

However, the above method is applicable to IPv4 and has a problem that it is difficult to apply in IPv6.

The discussion thus far is summarized with reference to FIG. 1. 1 is a conceptual diagram of an address flow according to network address translation in Mobile IPv6, and illustrates a network environment which is an opportunity of the present invention. It shows the problem that can occur when performing network address translation such as NAT on Mobile IPv6 protocol. Since the mobile node 110 moves into the network where the network address translation function is provided by the network address translator 120, and the newly issued temporary address is valid only in the internal network, the mobile node 110 is provided to the home agent 130. It is recognized as a translated public network address. However, the home registration process or IPsec security mechanism defined in the Mobile IPv6 protocol operates based on the network address, making it difficult to provide valid mobility.

An object of the present invention is to provide a method for adapting network address translation by adding a flag to a mobility message when the mobile node enters a network that performs network address translation.

In order to achieve the above technical problem, in the method of providing network address translation in Mobile IPv6 according to the present invention, when the mobile node moves to a new network, it is determined whether the network address translation is performed and the binding update message is based on the determination. sending a binding update message to a home agent; Receiving, by the home agent, the binding update message, a binding akcnowledgement messae corresponding to the mobile node; And transmitting, by the mobile node receiving the binding response message, an additional response message in which the temporary address in the new network is protected by IPsec (internet protocol security) to the home agent.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram illustrating a message flow with network elements associated with a mobile node for detecting network address translation; and FIG. 3 is a diagram illustrating a format of a binding message for network address translation. 4 is a flowchart illustrating a home registration process according to network address translation.

Referring to FIG. 2, when the mobile node 210 detects network address translation by the network address translator 220 by moving to an external network, a 1-bit flag indicating this in the binding update message 215 for home registration is performed. Set. This flag is an unused field in the binding update message 215. The home agent 230 that has received this message also sends a binding response message 235 with a 1-bit flag set. The mobile node 230 ensures the integrity of the binding update message 215 received by the home agent 230. 210 sends an additional response message 245.

3 shows the format of a binding update message 215 and a binding response message 235 for home registration following network address translation. Both messages use only 1 bit of the unused field (310 for binding update message and 320 for binding response message). If this flag is set, network address translation occurs in communication between them. I mean. In addition, these messages are protected by pre-configured IPsec from both ends to ensure data integrity.

This is because, according to the Mobile IPv6 standard, a pair of binding update message 215 and binding response message 235 is sufficient for a home registration process for establishing a new binding for the home agent 130 or 230. These messages are protected using the IPsec ESP transport mode, and even if the source address of the external IP header is changed by NAT, IPsec inbound packet processing is not affected.

Finally, a more detailed flow will be described with reference to FIG. 4. First, when the mobile node moves to a new network (400), when the mobile node receives a router advertisement message from a router of the new network, the mobile node receives a new network through network renumbering and mobile configuration. Set up the environment. If network address translation is being performed, this fact should be informed to the mobile node so that it can respond appropriately. That is, it should be determined whether the network is performing network address translation (401). For example, a 1-bit N flag is added to a reserved field of an existing router advertisement message to the mobile node. It can be used to determine whether to perform NAT function of a foreign router.

As a result of the determination of the mobile node, if the newly entered network does not perform network address translation, the existing binding update message is sent to the home agent (403). If the network address translation is performed, the flag is set in the binding update message as described above. 402) and transmit to the home agent.

The home agent receiving the binding update message (404) performs IPsec verification on the message (405), discards the received message if the verification fails (406), and determines whether to use the network address translation function if successful. (407). If the determination result is used, the flag described above is set in the binding response message (408) and transmitted (409). If not, the existing binding response message is transmitted (409).

The mobile node that has received the binding response message (410) searches for the received binding response message (411) and sends an additional response message back to the home agent (413) if it is recognized to use network address translation. This completes the home registration process (412). Meanwhile, the home agent receiving the additional response message (414) completes the home registration process (415).

In summary, if a newly entered network does not provide network address translation, it can perform the home registration process defined in the Mobile IPv6 protocol, and if so, set a flag to indicate this in the binding update message. Send to home agent. The home agent that receives the flagged binding update message must find the temporary address of the mobile node. In the existing protocol, the home agent needs to check the temporary address stored in the Alternate Care-of Address option field inside the message whose integrity is guaranteed by IPsec. Used. However, since this temporary address is a private network address that is valid only inside the external network, it uses the address translated by the network address translator in the IP header.

In addition, to ensure the integrity of this temporary address, if the mobile node receiving the binding response message sends an additional response message to the home agent, it is proved that it can be routed to the mobile node through this temporary address, thus ensuring the safe delivery of data. This becomes possible.

The method for providing network address translation in mobile IPv6 according to the present invention may also be embodied as computer readable codes on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, hard disk, floppy disk, flash memory, optical data storage device, and also carrier wave (e.g. transmission over the Internet). It is also included to be implemented in the form of. The computer readable recording medium can also be distributed over computer systems connected over a computer network so that the computer readable code is stored and executed in a distributed fashion. Also, the font ROM data structure according to the present invention can be read by a computer on a recording medium such as a computer readable ROM, RAM, CD-ROM, magnetic tape, hard disk, floppy disk, flash memory, optical data storage device, and the like. It can be implemented as code.

Electromagnetic field analysis attack prevention apparatus and method according to the present invention described above is not limited to the description of the above-described configuration and the accompanying drawings, various substitutions, modifications and changes within the scope of the technical spirit of the present invention It will be apparent that changes are possible.

As described above, according to the method for providing network address translation in Mobile IPv6 according to the present invention, a mobile node and a home agent detect a network address translation in advance and respond appropriately to a mobile node that may occur in a home registration process. You can solve the network address mismatch problem.

In addition, since no overhead is required for the message of the existing Mobile IPv6 protocol and only one bit is not currently used, an efficient response to network address translation can be provided.

In addition, by providing additional IPsec message transmission at the end of the basic home registration process, it is possible to perform a binding update that is safe from possible attack.

Finally, by providing appropriate countermeasures for network address translation, Mobile IPv6 can be interoperated and spread relatively easily with existing networks.

Claims (6)

(a) determining whether to perform network address translation when the mobile node moves to a new network, and transmitting a binding update message to the home agent based on the determination; (b) the home agent receiving the binding update message, sending a corresponding binding acknowledgment messae to the mobile node; And (c) the mobile node receiving the binding response message, transmitting an additional response message to the home agent, which protects the temporary address in the new network with IPsec (internet protocol security); How to provide network address translation in Mobile IPv6. The method of claim 1, wherein step (a) And setting and sending a flag indicating that the network is performing network address translation in the binding update message. The method of claim 2, wherein the flag setting is  The method of providing network address translation in Mobile IPv6, wherein the N flag is set among the reserved fields in the binding update message. The method of claim 1, wherein step (b) (b1) the home agent performing IPsec verification on the binding update message; And (b2) if the verification result is negative, discarding the binding update message, and if it is positive, setting a flag in the binding response message and transmitting the same to the mobile node; network address translation in Mobile IPv6, comprising: How to Provide. The method of claim 4, wherein the flag setting is The method of providing network address translation in Mobile IPv6, characterized by setting N flags among reserved fields in the binding response message. (a) determining whether to perform network address translation of the network when the mobile node moves to a new network, and transmitting a binding update message to the home agent based on the determination; (b) the home agent receiving the binding update message, transmitting a corresponding binding response message to the mobile node; And (c) transmitting, by the mobile node receiving the binding response message, an additional response message in which the temporary address in the new network is protected by IPsec (internet protocol security) to the home agent. A computer-readable recording medium that records a program that can execute a network address translation method on a computer.

Images