TWI254546B - Assignment method and system of home agent in mobile VPN - Google Patents

Abstract

The present invention provides an assignment method and system of home agent in mobile VPN, wherein a virtual private network is established between at least an intranet and an external network, so that at least a mobile node can roam safely in the external network. In the present invention, an external home agent close to the mobile node and roaming in the external network can be dynamically assigned as the registration agent of the mobile node. Thus, when the mobile node roams in the same external network, it is only necessary to register in the external home agent, without the necessity to register IETF in the internal home agent of the intranet. Thereby the handoff delay among the agents and end-to-end delay during roaming can be reduced to minimum, and the IPsec security control of VPN can be completely associated.

Description

1254546_ V: Invention Description (l\ " [Technical Field of the Invention] The present invention is a mobile VPN (Mobile Virtual Private

Network)'s Home Agent assignment method and system, and in particular to a VPN over the Internet Protocol Security Protocol (IPsec) architecture, a method for dynamically assigning external agents to provide mobile node registration and system. [Prior Art] Virtual Private Network (VPN) is a network that can use a wide area network (such as the Internet) to establish a dedicated network between a remote user's computer and a local network server. Road channel, for data transmission 'and long: as safe as inside a closed private area network. In order to confirm security, VPN has the following basic requirements: 1 · User authentication · VPN must be able to verify the identity of the user and strictly control only registered users to log in. Wei 2 · Address Management · VPN must be able to assign users the address on the private network ' and ensure address security. 3 • Data Encryption: Data transmitted over the Internet must be encrypted to ensure that other unauthorized users on the Internet cannot read the data. 4. Key Management: The VPN must be able to generate and update the encryption key of the client computer and the server. 5. Support multiple protocols: VPN must be able to support the Internet

1254546 V. INSTRUCTIONS (2) Basic protocols used, including IP, IPX, PPTP (Peer-to-Peer Channel Protocol), L2TP (Layer 2 Channel Agreement) or IPsec (Internet Communication Security Protocol), etc. 1 Internet Protocol (IP) is a protocol used to transmit data over a computer network (such as the Internet). However, Ip does not define any security mechanisms. Therefore, the Internet Engineering Task Force (IETF) defines an IP sec protocol in the "Request for Comments (RFC)" 240 1 communication standard, which is a method of encrypting IP traffic. Protect network communications to prevent data modification, third party viewing, simulation, and standards for being picked up and replayed. However, due to the rapid development of wireless network technology, it has become a very important research topic for how to establish a mobile VPN for wireless transmission networks. The mobile VPN using wireless technology has also been defined in the IETF.

The Mobile IPv4 (IETF RFC 3344) protocol standard, but there are still some issues to be resolved in the M〇bile IPv4 standard. For example, when a mobile node (Mobile Node, hereinafter referred to as MN) (such as a mobile computer equipped with a wireless network device) roams on an internal network (Intranet), a local agent (H〇me Agent) , HA) assigns a Mobile IP (Mobile IP, hereinafter referred to as the old?) to the MN, and when the MN roams from the internal network to an external network (Internet), such as a branch at home or in the field, the MN A local foreign agent (F〇reign Agent, FA) enters a vpN gateway (vpN Gateway) based on ipsec to register with the local agent (HA) to make the vpN gateway

1254546

Establish an iPsec channel for the foreign agent (FA). The MN will get a new Care of Address (c〇A) in the roaming external network, and ask the vpN gateway to roam for a new one for the MN. Update the lpsec channel when the subnet. However, all data packet messages entering the VPN gateway will be encrypted by the 1^^^ security standard, and the foreign agent (FA) cannot decrypt the encrypted data packets, so the foreign agent (FA) ) The ιρ message cannot be transmitted. In order to solve the above problems, the IETF's Mobile IPv4 Working Group (WG) proposes a method to support VPN users for International Seamless Roaming (ISR) by using a fixed mechanism (Mechanism).

The method is to define a local agent (HA) in the internal network as an internal home agent (hereinafter referred to as HA), and an external device is built in the external network (External Network). An external home agent (x-HA), which is used as the roaming status of the MN for the internal network management (Mobility Management), and the x-HA is when the MN roams to The external network is used as a roaming condition for managing the MN. The extra X-HA can encapsulate the established IPsec tunnel under another M IP tunnel without changing to the established IPsec tunnel, so when the MN obtains a new one from the VPN gateway After C〇A, the IPsec channel established by the VPN gateway will not be destroyed, so the external agent (FA) can decrypt the X-Μ IP message, so this method can be repaired.

1254546 V. INSTRUCTIONS (4) Change the Mobi le IPv4 standard and the IPsec standard, and only change the transit address (C〇A) that some mobile nodes must have. As shown in the first figure, it is a schematic diagram of the mobile VPN standard architecture defined by the IETF. In the first figure, an MN 1 roams through an i-HA 11 in an internal network 10, and when the MN 1 is moved from the internal network 1 to an external network 20, the MN 1 must A χ-ΗΑ 21 is registered to obtain a new CoA, and the X-HA 21 requests a VPN gateway 22 to establish an ipsec channel connection to the x-HA 21. Finally, the VPN gateway 22 registers the VPN-TiA (VPN Tunnel Inner Address) of the MN 1 with the i-HA 11 to connect the established IPsec channel to the i-HA n to form an external network 2 0. And a virtual private network (y ρ Ν ) that can roam on the internal network. The second diagram is a schematic diagram of the message structure of the established channel of the mobile VPN, and the MN 1 roams from the internal network 10 to the external "way signal data packet 3. , comprising a layer of raw data J packet 2, an original packet 31, a channel message 32 (from the Ηηι to the inter-channel benefit 22) before the original data packet 31, and Internal transfer channel information _ _ _ channel message 33 (by the VPN gateway 22 to the ^ IPsec channel message 33 outside the frosted one;; in addition, stored in the w 〇 layer outside the mobile IP (x- MIP) channel 34 34 (from the X_HA 21 to the MN J's Han, but in a conventional method, stop

Where should the x-HA 21 be placed: the most important, the title, the -J X-HA is safe? ^Tian·Second can believe this because it is built in the external network in the traditional IETF method.

1254546 V. Description of the invention (5) A fixed (x-HA) 21, if the external network 2〇 contains a plurality of subnets (Subnet), how to arrange the location of the χ_ΗΑ 21, will It affects the Handoff time delay between the external agent (FA) and the χ_ΗΑ 21 between roaming subnets, and the end-to-end time delay between roaming subnets. And since the χ_ΗΑ 21 is in the external network 2 that the VPN gateway 22 cannot control, is it possible to believe that the χ-ΗΑ 21 really meets the security standard of ipsec? In order to solve the above-mentioned needs and problems of the mobile VPN, the inventor of this case has devoted himself to researching and using the application of theory to propose a dynamic proxy (X-HA) assignment method and system for mobile VPN. The mobile state assigns the local agent (HA) close to the MN as the χ_ΗΑ, so the Handoff delay and the End t〇' End delay between roaming networks are minimized. Fully integrated with safety control is an invention that is reasonable and can effectively improve the above-mentioned defects. SUMMARY OF THE INVENTION The device assignment method of the present invention and the device of the mobile node delays the transfer of the external local agent local agent to the end of the network to provide a mobile vpN dynamic proxy system. Dynamically assigning a roaming external network to approach the local agent as the registered proxy node of the mobile node roaming in the same external network (just register with the processor, and not have to The registration of the internal network - the IETF method is also possible, so that the Rotary Handoff delay and end-to-end (End t〇 is minimal, and can be fully integrated with security control.

1254546 V. Invention Description (6) In order to achieve the above object, the present invention mainly provides a dynamic proxy assignment method for a mobile VPN, which can establish a VPN between at least one external network and an internal network. The method first moves as a mobile device. When the node first roams in the external network, it sends a registration request message to one of the local external foreign agents; and the external foreign agent sends an authorization confirmation request message to a foreign AAA server to make the foreign field The AAA server fills the network access identifier of at least one external local agent into the authorization confirmation request message, and then forwards the message to a local AAA server. Then, after the local AAA server successfully authenticates the MN, the external local device is established. An agent, a secure connection between the external foreign agent and the mobile node, and a local agent request message sent to the external local agent; the external local agent assigns an external local address to the mobile node, And setting the external location address and its own address in a local agent response message, and sending the local AAa servo And then the local AAA server uses the external local address as the transit address of the mobile node to register with the internal local proxy, and after the registration is completed, the internal local proxy authorizes the local AAA server to issue a Authorizing the confirmation response message to the external foreign agent; finally, the % foreign agent obtains a registration reply message including the external local address and the local agent address from the authorization confirmation response message, and forwards the message to the mobile The node, after which the mobile node can use the external local address to the local agent book of the local agent address when roaming the external network. The present invention further provides a dynamic external proxy assignment system for a mobile VPN, which can establish a vpN between at least one external network and an internal network.

1254546 V. INSTRUCTIONS (7) 1. At least - the mobile node can safely roam in the external network, the system includes an internal local agent, at least one external local agent, a vpN, and an agent to the evening agent And the at least one external foreign agent, wherein the internal local agent (i~HA) is used to manage roaming registration of the mobile node in the network; and the external local agent (χ-ΗΑ) is Handling the roaming registration of the mobile node in the external network; the νρ 了 , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Between the .bvy states, the agent assigning device uses the dispatcher--the external local agent close to the mobile node to perform the node and the external foreign agent to make the mobile network Through the external field judgement, "reissue!" ☆ server and the internal local agent

The mobile node roams in the external network and only the C local agent registers. π 妾 之 外部 外部 【 【 【 【 【 【 【 【 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部 外部- In-depth and specific purposes, features and characteristics, test and description, not used to be too 2 ^ and the drawings only provide reference to the 1::: two limit shown in the third figure. Schematic diagram. The invention is mainly for inventing the mobile side system racking L to assign an external network which is closest to 1254546. 5. Inventive Note (8) " 'A mobile node (MN) 80 local agent (ha) as an external local agent (x-HA) 54 to allow the MN 8 to register with the χ ΗΑ 54 to complete the establishment of a mobile virtual private network (Mobi le VPN) IPsec tunnel. The present invention can utilize the DHCp server used in the field of external network, AAA (Authentication, Authori zation and

The Accounting server or DNS server, etc., can be used to dynamically assign the x-HA to select the local agent (HA) closest to the MN 8 in the external network to be assigned to the x-hA 54, And since the χ-ΗΑ 54 is closest to the MN 80 ', the delay between the x-HA 54 and the MN 80 can be minimized. The end-to-end transfer (Handof f) between the sub-networks in the external network will also become faster, and another local agent in the external network (or another local agent in the external network) HA) is used for load balancing. Nonetheless 'but the most important issue is the security mechanism of the X-HA 54'. Therefore, it is better to use the AAA server to assign the χ-ΗΑ. For example, we can use the Diameter Base on Protocol ( IETF RFC 3588) as the AAA server, not only can assign this χ-ΗΑ, but also can establish a security association (Security Association, hereinafter referred to as SA) between the multiple agents moving during roaming. The Key Distribution Center (KDC) shows an internal network (Intranet) 40 and at least one external network (Internet) 50 in the third figure. The internal network 40 is a protected private network. (Protected Private Network), the connection is provided with a DHCP server 41 and an internal router (Interior Router) 42, the internal

Page 12 1254546 V. Description of the invention (9) The router 42 is connected to a non-regulated area (DMZ) 60, which is a physical area behind the Internet, facing the firewall in the protection backend system and In front of the second layer firewall of the negative material, the non-regulated area (6 〇 is connected to a local AAA server (hereinafter referred to as AAAH) 61, a vpn gateway 62 and an external router 51, and the external router 51 is connected to the external network 5 (lnternet). In the internal network 40, a plurality of subnets 43 may be included, and each subnet 43 is connected to at least one wireless base station. (Wireless Access Point, WAP) 44, for wirelessly connecting at least one MN 80. In the internal network, there is further provided a "Ha 45" and an internal foreign agent (hereinafter referred to as i- FA) 46, as shown in FIG. 3, the i-HA 45 is connected to the first subnet (Subnet 1) and the i-FA 46 is connected to the second subnet (Subnet 2). The DHCP 4 server 41 is connected to the third subnet (Subnet 3). Please refer to the fourth. And the fifth figure is a schematic diagram of the registration flow chart of the .8 漫游 roaming on the internal network 40. When the 〇8〇 roams in the internal network 40, such as from the first subnet (Subnet n When roaming to the second subnet (Subnet 2), the i-FA 46 will continuously broadcast and ask (Advertisement & Challenge) 100 if any of the mn 80's ΜIP roams within the network (s2 0 0), At this time, the MN 80 sends a registration request (Registration Request, hereinafter referred to as Reg-Reci) message 1〇5 to the i_FA 46 (S20 5 ), since the i-FA 46 does not recognize the mn 80, so the i The -FA 46 will forward the Reg-Req message 1 to 5 to the i-jjA 45 for registration (S210).

Page 13 1254546 V. Invention Description (10) After the registration is completed, the iH A 45 will reply a Registration Reply (Reg-Reply) message 110 to the i-FA 46 (S215). The i-FA 46 can recognize the MN 80, and the i-FA 46 sends a Reg-Repiy message 115 to the MN 80 (S220) to complete the roaming registration procedure of the internal network. Referring to the third figure, the external network (Internet) 50 is an unprotected public network, which may include a plurality of external networks, as shown in the third figure. An external network and a second external network, and each external network may include a plurality of sub-networks, and may be respectively connected to a foreign AAA server (AAAF) 53 , an x - HA 54, an external foreign agent (Externai F〇reign Agent, hereinafter referred to as x-FA) 55, a DHCP server 56 and at least one wireless base station (WAP) 57. Please refer to the sixth figure and the seventh figure A and B together, which is a schematic diagram of the registration flow chart of the MN 80 roaming on the external network 50. When the MN 80 roams from the internal network 4 to the external network, the local χ-FA 55 will continuously broadcast and ask (Advertisement & Challenge) 300 whether there is any such 80 in the network. Roaming (S400), at this time the MN 80 will issue a Reg-Req message 3〇5 to the x-fa 55 (S40 5). The Reg-Req message 305 should include a Home Address (H〇A), a HA address, and a <also > 'and a ΜN authorized by the AAAH 61. Network access label (netw 〇rk A ccess

Identifier, NAI)...etc.

1254546 V. Inventive Note (π) and in the Reg-Req message 305 received by the x_FA 55, both the HoA and the HA address should be set to 0. (K 0· 0, indicating that the MN 80 is I want to obtain an external location address (EX terna 1 Η 〇me Address, hereinafter referred to as x-HoA) in the external network, and want to know the address of the local x-HA, so the X-FA 55 A feature vector (MIP-Feature-Vector) attribute value pair (AVP) is generated, in which a MN80 local address request (hereinafter referred to as HoIne-Address-Requested), and a local agent request ( The following is called Home-Agent-Requested) to the flag of the AVP. At this time, the x-FA 55 sets the MIP-Feature-Vector AVP to an authorization confirmation request (AA - Mobile-Node-Request, In the following AMR) message 3 1 0, the necessary information is obtained from the R eg - R eq message and added to the relevant AVP, and the AMR message 3 10 is sent to the local AAAF 53 (S410) 〇 due to local The AAAF 53 will trust the local x_FA 55 and will therefore authorize the AMR message 310, but the AAAF 53 The Home-Agent-Requested flag bit (Flag bit) in the MIP-Feature-Vector AVP is checked first. If π 1", the AAAF 53 will require the AAAH 61 to allow assignment. A χ-ΗΑ 54 in the roaming external network acts as the local agent (ΗΑ) of the ΜΝ 80, so the AAAF 53 sets a 内 in the AM IP-Feature-Vector AVP in the received AMR message 310. The local local agent is available (hereinafter referred to as the Foreign_Home_Agent-Available) flag, and is in a candidate local agent host (hereinafter referred to as MIP-Candidate-Home-Agent-

Page 15 1254546 V. Invention Description (12) ost) AVP is filled with at least one candidate χ-ΗΑ 54 Network Access Label (NAI) 'The AAAF 53 then transmits the AMR message 310 to the AAAH 61 ( S415). After the AAAH 61 receives the AMR message 310 sent by the AAAF 53, it is necessary to authorize the Reg-Req message 30 5 of the MN 80, so the AAAH 61 can pass one of the settings in the AMR message 310 (MN- AAA-SPI, Security Paremeters Index) to determine which security policy is used, such as encryption algorithms and long-term shared keys. If the AAAH 61 authorization is successful, it will check whether the Home-Agent-Requested flag bit in the MIP-Feature-Vector AVP of the AMR message 310 and the flag bit of the Foreign-Home-Agent-Available are equal to Γ If yes, it means that the MN requires dynamic assignment of a χ-ΗΑ 54 in the roaming external network area, and the AAAH 61 will also be in the X-HA, X-FA and MN in the roaming external network area. Establish a safety connection (SA) (S420), such as between χ-ΗΑ 54 and X-FA 55, between MN 80 and x-HA 54, or between MN 80 and x-FA 55. To this end, AAAH 61 will produce a Key Materials, which are at least 128-bit random numbers, are generally referred to as Nonces, and the Nonces can be used to calculate a Session Key to ensure the security of the Security Association (SA). The MIP-Feature-Vector AVP in the AMR message 310 sent by the X-HA 54 and the AAAF 53 also includes a plurality of Key-Requested requests, including between the MN 80 and the local agent (HA). Key request (hereinafter referred to as MN-HA-Key-Requested), MN 80 and foreign agent

Page 16 1254546 V. Invention Description (13) Key request between device (FA) (MN-FA-Key_Requested) and key request between foreign agent (FA) and local agent (HA) (FA-HA) - Key-Requested) The message key can be securely transmitted to these X-FA 55 or x-HA 54 via the Diameter Protocol AAA server. This is because the IPsec standard or transport layer security

The Transport Layer Security (TLS) standard (IETF RFC 2246) is mandatory for the protection of communication data between Diameter nodes (including servers, clients and agents). However, the communication key is not directly transmitted to the MN 80, because this will expose the communication key to the unprotected network protocol, and only to the MN 80. Elements (Nonces). Therefore, the AAAH 61 regenerates a local proxy request (H〇me-Agent-MIP-Request, hereinafter referred to as HAR) message 315, and encapsulates the session key and the Reg-Req message in the HAR message 315. The associated AVP is transmitted to the candidate x-ha 54 (S425) through the AAAF 53, which acts primarily as a proxy server. Therefore, the communication key (sessi〇n Key) in the HAR message 315 includes the communication key (MIP-HA-to-FA-Key) AVP between the x_HA 54 and the x-FA 55, and the MN 80 and The IP-FA 55 key element (mIP-MN-to-FA-Key) AVP, and the MN 80 and χ-HA 54 gold recording component (MIP -^〇-1:0-11 eight - 1^7) Eight ¥?, etc., will be attached to the 11 8.1 message 315. Therefore, the x_HA 54 can be divided from the relevant AVPs in the HAR message 315.

Page 17 1254546 V. Invention Description (14) Do not obtain the communication key between the X-HA 54 and the X-FA 55, the key element between the MN 80 and the x-FA 55 (Nonces) ), and the metal element (Nonces) between the MN 80 and the X-HA 54. And the x-HA 54 does not include the address of the MN 80 (hereinafter referred to as MIP_Mobi le-Node-Address) AVP ' in the received HAR message 315 and the Home-Agent in the MIP-Feature-Vector AVP When the flag bit of -Address-Requested is set to Π1Π, the X-HA 54 will automatically assign a χ-ΗοΑ to the MN 80. The 10卩-^〇1^16-Node-Address A VP is set. Medium, and the X-Η A 54 will automatically set its own address to the MIP-Home-Agent-Address AVP. Next, the X-HA 54 stores the communication key between the MN 80 and the x_HA 54 and copies the key element (Nonces) to a Reg-Reply. Then, the x-HA 54 generates a Home-Agent-MIP-Answer (HAA) message 320 to be transmitted to the AAAH 61 through the AAAF 53 (S430), and the HAA message 320 includes at least A registration reply (hereinafter referred to as MIP-Reg-Reply) AVP, a result code (AVP) AVP, and a MIP-Mobile-Node including the MN 80 X-HoA - address AVP, and a MIP-Home-Agent-Address AVP containing the x-HA 54 address, after the AAAH 61 receives the HAA message 320 sent by the AAAF 53, the AAAH 61 The x-HoA of the MN 80 is obtained from the MIP-Mobile-Node-Address AVP, and the address of the x-HA 54 is obtained from the MIP-Home-Agent-Address AVP.

Page 18 1254546 V. Invention Description (15) Then the AAAH 61 will create a new HAR message 325 and fill the X-HoA and χ-ΗΑ addresses into MIP-Mobi le-Node-Address and MIP_Home- respectively. The Agent-Address AVP, and then the AAAH 61 sends the HAR message 325 to register with the i-HA 45 (S43 5). After the i-HA 45 receives the HAR message 325, the i-HA 45 obtains the x-HoA from the AVP in the HAR message 325, and registers the obtained address of the x-HoA 54 as the MN 80. The public CoA causes the i-HA 45 to recognize the HAR message 325 and establish a new HAA message 330 to transmit to the AAAH 61 (S440). Then, after receiving the HAA message 330 sent by the i-HA 45, the AAAH 61 can display the authorized success by the Result-Code AVP. Therefore, the AAAH 61 will establish an authorization confirmation response (AA-Mobi le-Node-Answer, hereinafter referred to as ΑΜΑ) message 33 5 to be transmitted to the X-FA 55 through the AAAF 53 (S445), and include in the ΑΜΑ message 335 a DIAMETER successful result code (Result-Code), the MIP-Home-Agent-Address AVP, the MIP-Mobile-Node-Address AVP, and the MIP-Reg-Reply AVP, and the AVPs can be received from The HAA message 330 is copied. If there is a key element 335 between the MN 80 and the x-FA 55 (MIP-MN-to-FA-Key) AVP and the communication between the χ-ΗΑ 54 and the X-FA 55 The key (MIP-HA-to_FA-Key) AVP, the x-FA 55 will receive the communication between the MN 80 and the x-FA 55 (Nonces) and the communication between the x_FA 55 and the χ-ΗΑ 54 Key (Session Key). When the x-FA 55 receives the message sent by the AAAH 61

Page 19 1254546 V. Invention Description (16) After 335, if the authorized success is displayed from the Result-Code AVP, the X-FA 55 will receive MIP-Reg-Replay from the message 335. A Reg-Rep 1 ay message 340 is obtained in the AVP, and the Reg-Rep 1 ay message 340 is forwarded to the MN 80 (S450). Otherwise, the x-FA 55 will silently discard the A Μ A message 3 3 5 .

Once the MN 80 receives the Reg-Replay message 340, the MN 80 can obtain the new x-HoA, the x-HA address, and the Golden Element (Nonces), and then the MN 80 uses the received The key element (Nonces) and the hash algorithm and Longterm Shared Key that are the same as the AAAH 61 calculate the correct communication gold (&essi〇n Key). Therefore, when the MN 80 passes After the AAAH 61 is authorized, and after the χ_HA 54 and i-HA 45 are registered with the Mobile IPv4 security standard, the X-HoA can be used to connect with the VPN gateway to make the MN 80 and the VPN gateway. Establish IP sec channel 3 4 5 (S 4 5 5 ) 'Restore secure communication like the internal network. After completing the assignment of the x-HA 54, the security association (SA) between the local local agents (ΗA) in the roaming external network will also be completed. Thereafter, the MN 80 can directly use the MIPV4 standard to register and communicate with the local χ-ΗΑ 54 through the χ_FA 55, without the need to pass through the ΑΑΑ server, that is, when the ΜΝ 80 is on the external network Once you get a new transfer address (Co A ), you can just log in to the assigned x-HA 54 as if you are roaming inside the internal network, instead of ^^ 4 5 Sign up.

5. The invention description (17), and in the same external network does not need to be re-established. However, the session key has a longevity. If the life-end is completed, the Diameter still needs to be transmitted. The basic AAA server generates a new "Session Key", and if the MN 8 is moved to another external network, it must request a registration from a new local network. The entire process will be executed again, letting the 1 "re-assigned" and the IPsec channel will be re-established. </ RTI> The present invention can provide a technique for replacing a stationary X-HA with a mobile device by using the above-disclosed technology, so that the local agent (HA) transfer transfer (Hand〇ff) during roaming Both the delay and the end-to-end (End pseudo-End) delay will be significantly reduced, and the present invention is a secure association (SA) established between the transited local agents (HAs) of the IPv4 application. – HA is arbitrarily arbitrarily, and the registration actions for 乂-ha and 卜ha are completed at the same time. Therefore, the present invention realizes a mobile VPN system platform, which is different from the design of the prior art, can improve the positive use of the mussel value, and is not found in the publication or public use before the application, and has already met the requirements of the invention patent. , 提出 filed an invention patent application in accordance with the law. However, the drawings and descriptions disclosed above are merely examples of the present invention, and those skilled in the art can make various other modifications based on the above descriptions. These changes still belong to the inventive spirit of the present invention and the following. Within the scope of the defined patent.

Page 21 1254546 Simple description of the diagram [Simple description of the diagram] The first diagram is a schematic diagram of the mobile VPN standard architecture defined by the IETF; the second diagram is the message structure diagram of the established channel of the mobile VPN. The second figure is a schematic diagram of the system architecture of the mobile V p N according to the present invention. The fourth figure is the registration flow chart of the MN roaming on the internal network. The fifth picture shows the tense state of the MN roaming on the internal network. The sixth picture is the registration flow of the MN roaming on the external network. · Figure 7A, B is the g of the MN roaming on the external network; the tone is [the main component symbol description] 1 move Node (MN) 11 Internal Local Agent (i-HA) 10 Internal Network 20 External Network 21 External Local Agent (x-HA) 22 VPN Gateway 30 Channel Signal Packet 31 Raw Data Packet 32 Internal Mobile IP Channel Message 33 IP sec Channel Message 34 External Mobile IP Channel Message 80 Mobile Node (MN)

1254546 Simple description of the schema

Page 23 54 External Local Agent (X - Η A ) 40 Internal Network 41 DHCP Server 42 Internal Router 43 Subnet 44 Wireless Base Station 45 Internal Local Agent (i-HA) 46 Internal Foreign Agent (i -FA) 50 External network 51 External router 53 Foreign AAA server (AAAF) 54 External local agent (X - Η A) 55 External foreign agent (x-FA) 56 DHCP server 57 Wireless base station 60 Non Control Area 61 Local AAA Server (AAAH) 62 VPN Gateway

Claims (1)

1254546 VI. Patent Application Scope A dynamic proxy assignment method for mobile VPNs, #, can be at least one.虚拟 establishing a virtual private network between the network and an internal network, such as “rain k, VPN”, so that at least the mobile node (M〇bUe Node, MN) can securely roam in the external network. The method includes: when the mobile node roams in the external network for the first time, sends a request message 7 to an external foreign agent, where the registration request message includes an external local address request and a foreign agent Address request; the external foreign agent sends an authorization confirmation request message to a foreign AAA server, so that the foreign AAA server selects at least one candidate external network device (Network Access Identifier, MI) Filling in the authorization confirmation request message, and then forwarding it to a local AAA server 3S, the local AAA server establishes the external local agent, the security association between the external external geographical device and the mobile node, And generating a local proxy request message, which is sent to the external local proxy; the external local proxy assigns an external local address to the mobile node And setting the external local address and its own address in a local proxy reply message to the local AAA server; the local AAA server uses the external local address as the transit address of the mobile node Registering with the internal local agent, after the registration is completed, the internal local agent authorizes the local AAA server to send an authorization confirmation response message to the external foreign agent; Page 24 1254546 6. Patent application scope&quot; — The external foreign agent obtains a registration reply message including the external local address and the local agent address from the authorization confirmation response message, and forwards the message to the mobile node. Thereafter, when the mobile node roams on the external network, the external local address can be used to register with the local agent of the external local agent address. 2. The dynamic proxy assignment method of the mobile VPN according to claim 1, wherein the mobile node is a mobile computer equipped with a wireless network device. 3. The dynamic proxy assignment method of the mobile VpN as described in claim 1, wherein the mobile node first roams the external network before the step of the external network, the method further comprises: issuing, by the external foreign agent The Advertisement & Challenge message is sent to the external network to ask if there is any mobile node on the network roaming within the network. 4. The method for assigning a dynamic proxy of a mobile VPN as described in claim i, wherein the registration request message further includes authentication information and one of the mobile nodes to be authorized by the local AAA server. Road access indication (NAI). 5. The method of assigning a dynamic proxy of a mobile vpN as described in claim i, wherein the external request address of the registration request message and the external local proxy address request are included in the request · 〇· 〇. The external location of the 〇 and the external local agent address. 6. The method for assigning a dynamic proxy for a mobile SVPN as described in claim 1, wherein the mobile node roams the external network for the first time in step 1254546. 6. After the patent application scope further includes: the external field After receiving the registration request message, the proxy generates a MIP-Feature-Vector Attribute Value Pa ir, where the location address request flag of the mobile node and the local proxy request flag are set. And the dynamic proxy assignment method of the mobile VPN described in claim 1, wherein the external foreign agent issues an authorization confirmation. After the step of requesting the message, the method further includes: after receiving the authorization confirmation request sent by the foreign AAA server, the local AAA server may use one of the authorization confirmation requests (MN-AAA-Security Parameters Index) Confirm that the mobile node is using that security policy for authentication. 8. The dynamic proxy assignment method of the mobile VPN according to claim 1, wherein the step of establishing the secure connection by the local AAA server further comprises: the local AAA server generating a minimum of 128 bits. Key material, which can be used to calculate a session key to confirm the security of the secure connection; and set the communication key to the local agent request In the message. 9. The dynamic proxy assignment method of the mobile VPN according to claim 1, wherein the local AAA server establishes a secure connection, and the local proxy request message is transmitted through the foreign AAA server. 1254546 A _ 6. Applying for a patent scope to the external local agent. The dynamic proxy assignment method of the mobile VPN according to claim 1, wherein the local AAA server establishes a secure connection, the local proxy request message includes the external local proxy and The communication key between the external foreign agent, the key element between the mobile node and the external foreign agent, and the key element and communication gold between the mobile node and the external local agent. II. The dynamic proxy assignment method of the mobile VPN according to claim 1, wherein the external local proxy assigns an external local address to the mobile node, and the local proxy answers the message The foreign AAA server is transmitted to the local AAA server. 12. The dynamic proxy assignment method of the mobile VpN according to claim 1, wherein the external foreign agent forwards the registration reply message to the mobile node, and further includes: the mobile node uses the external The address is connected to a VPN gateway to establish an ipsec channel between the mobile node and the VPN gateway. A dynamic external proxy assignment system for a mobile VPN is configured to establish a virtual private network (Virtual Private Network, νρΝ) between at least one external network and an internal network, so that at least one mobile node (Mobile Node) , MN) can safely roam in the external network, the system includes: an internal home agent (Internal Home Agent, i_H ΐ network, as the management of the mobile node in the internal network 1254546 VI, the scope of patent application to ^ External Home Agent (χ-HA) ' is installed in the external network 'as a roaming registration to manage the mobile node in the external network; a VPN gateway' can establish a An Internet Protocol Security Protocol (=IPsec) channel between the internal network and the external local agent enables the mobile node to securely connect to the internal network while roaming the external network; at least one An agent assigning device for dynamically assigning an external local agent close to the mobile node to perform roaming registration of the mobile node; and moving the external foreign agent, Provided in the external network, when the roaming is in the external network, through the external foreign agent=the external local agent, the AAA server, and the internal local proxy, registration, to establish The 1Psec channel between the VPN interrogators Ur! Roaming in the external network only needs to register with the nearest foreign agent. % &lt;This 14 · If the patent application scope 13th generation, send the system , wherein the external network package = external, 5, as described in claim 13 of the scope of the mobile agent assignment system, wherein the internal network contains % complexes, externally, 16 · as applied The mobile device described in Item 13 of the patent scope:: The device is assigned to the system, wherein the mobile node can be a mobile computer that is not prepared for external use., ° has a ",, line network η. The mobile external (1) dynamic external 1254546 patent application scope assigning system described in claim 13 , wherein the VPN gateway and the agent dispatcher are disposed in a non-regulated area (DMZ), The non-regulated area (DMZ) 60 is the Internet The physical area behind the network, facing the firewall in front of the second layer firewall that protects the backend system and data. 18. The dynamic external proxy assignment system of the mobile vpN as described in claim 17 of the patent application, wherein the non-regulated The zone (DMZ) is connected to the internal network through an internal router and is connected to the external network through an external router. 1 9. The dynamic external agent of the mobile VPN as described in claim 3 of the patent application scope A system is assigned, wherein the agent assigner can use an AAA server, a DHCP server, or a DNS server. 20. The dynamic external proxy assignment system of the mobile VPN as described in claim 19, wherein the proxy assigner uses the Aaa server to not only assign the external proxy but also to the roaming area. Within a plurality of agents ^s (Agents) 'establish a security association (SA), and as a Key Distribution Center (KDC) ° 21. Mobile as described in claim 20 The dynamic external agent of the VPN is configured to use the AAA server of the Diameter Base on Protocol. The dynamic external agent assignment system of the mobile sVPN according to claim 13, wherein the method further comprises: at least one internal foreign agent (i-FA) connected to the internal network At least one subnet, so that Page 29 _ i 1254546 &gt;, the scope of patent application l^n, when the mobile node roams in the subnet, the σ卩 foreign agent performs roaming registration to the internal local agent. 2 3 · If the scope of application for patents is the first one of the mobile v ρ Ν dynamic external agent =, send the system, which also includes · · placed in the department (Wireless Access p〇int), system points. $卜网, used to wirelessly connect the mobile section Page 30