WO2008025270A1 - Procédé pour une mise à jour de liaison dans le système mobile ipv6 et système de communication mobile ipv6 - Google Patents

Procédé pour une mise à jour de liaison dans le système mobile ipv6 et système de communication mobile ipv6 Download PDF

Info

Publication number
WO2008025270A1
WO2008025270A1 PCT/CN2007/070361 CN2007070361W WO2008025270A1 WO 2008025270 A1 WO2008025270 A1 WO 2008025270A1 CN 2007070361 W CN2007070361 W CN 2007070361W WO 2008025270 A1 WO2008025270 A1 WO 2008025270A1
Authority
WO
WIPO (PCT)
Prior art keywords
home
home address
address
message
binding
Prior art date
Application number
PCT/CN2007/070361
Other languages
English (en)
French (fr)
Inventor
Chunqiang Li
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to PL07764283T priority Critical patent/PL2056520T3/pl
Priority to ES07764283T priority patent/ES2374317T3/es
Priority to AT07764283T priority patent/ATE533252T1/de
Priority to EP07764283A priority patent/EP2056520B9/en
Publication of WO2008025270A1 publication Critical patent/WO2008025270A1/zh
Priority to US12/395,178 priority patent/US20090213797A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H04L63/0414—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0019—Control or signalling for completing the hand-off for data sessions of end-to-end connection adapted for mobile IP [MIP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/04—Network layer protocols, e.g. mobile IP [Internet Protocol]
    • H04W80/045—Network layer protocols, e.g. mobile IP [Internet Protocol] involving different protocol versions, e.g. MIPv4 and MIPv6
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/75—Temporary identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/04—Registration at HLR or HSS [Home Subscriber Server]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/26—Network addressing or numbering for mobility support
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/04—Network layer protocols, e.g. mobile IP [Internet Protocol]

Definitions

  • Binding update method in mobile IPv6 and mobile IPv6 communication system The application is submitted to the Chinese Patent Office on August 31, 2006, the application number is 200610111876.9, and the invention name is "binding update method in mobile IPv6 and mobile IPv6 communication system. The priority of the Chinese Patent Application, the entire contents of which is incorporated herein by reference.
  • the present invention relates to the field of network communication technologies, and in particular, to a binding update method in a Mobile Internet Protocol version 6 (IPv6: Internet Protocol version 6) and a mobile IPv6 communication system.
  • IPv6 Internet Protocol version 6
  • the Mobile Internet Protocol version 6 is a solution for mobility at the network layer.
  • Mobile IPv6 Mobile Node
  • CN Communication Node
  • a mobile node can be uniquely identified by the home address (HoA: Home Address).
  • HoA Home Address
  • the care-of address is generated in a certain way (CoA: Care of
  • Mobile IPv6 defines two different modes to address mobility issues: Bidirectional tunnel mode and route optimization mode:
  • the mobile node updates the care-of address through the binding (BU: Binding
  • Update message informs the home agent.
  • the home agent intercepts the message sent to the mobile node's home network to communicate with the mobile node, and then forwards the message to the mobile node through the tunnel mode.
  • the mobile node sends the message to the communication node, the message needs to be sent to the home agent through the tunnel mode.
  • the home agent decapsulates the tunnel message and forwards it to the communication node;
  • RRP Return Routability Procedure
  • CoTI and CoT are exchanged directly between the mobile node and the communication node.
  • the mobile node can update the binding of the care-of address and the home address to the binding of the communication node through the BU message.
  • the cache table In the cache table, and directly communicate with the communication node in the subsequent communication process, without forwarding through the home agent.
  • the privacy of the location is very important. Without hiding, the user's sensitive data may be collected and analyzed, and the user's activity may be detected and tracked, which may cause serious problems for mobile users. Security threats.
  • the inner header of the packet sent by the tunnel with the home agent carries its home address; when it communicates with the communication node through the route optimization mode, the mobile node sends the message to the communication node.
  • the home address option in the message contains the home address of the mobile node, and the second type of routing header in the message sent by the communication node to the mobile node also contains the home address of the mobile node.
  • the main method currently used is to use the substitute address of the home address instead of the real home address.
  • the implementation of this method depends on the binding update of the mobile node's home address and the care-of address in addition to the binding update process, and also the binding update of the used substitute character and the home address.
  • One implementation method is to draw 16 bits from the 128-bit IPv6 address space as a temporary mobile identifier (TMI) prefix.
  • TMI temporary mobile identifier
  • the address using this prefix is regarded as TMI, and the TMI is specified as unroutable.
  • Each mobile node is assigned a 128-bit TMI, and the TMI is periodically changed by some algorithm.
  • the TMI is placed in the home address option, and the real home address is placed in the newly defined binding update sub-option.
  • the communication node binds the TMI, home address, and care-of address together.
  • the mobile node and the communication node use the TMI instead of the home address option and the current home address in the second type of routing header.
  • the inventor has found that the above method has at least the following defects: 1.
  • the home address in the RRP process is not protected, and the home address is still needed to be directly carried in the binding update message; A fixed occupation of the IPv6 address space; 3. If the periodic change of the TMI is not synchronized with the change of the care-of address, it will bring additional RRP execution and consume network resources; 4. If the mobile node has multiple home addresses bound to the same The care-of address will be confused.
  • serial number contained in the BU message may also leak the trail of the mobile user during the process of performing the binding update by the mobile node. If the serial number increment of the binding update message is fixed, or is easily changed, the eavesdropper can still guess the motion of the mobile node by detecting a series of binding update messages. Summary of the invention
  • the object of the present invention is to provide a binding update method in mobile IPv6 and a corresponding mobile IPv6 communication system, which can enhance the security of the home address in the binding update process.
  • a binding update method in mobile IPv6 comprising: the mobile node sends a binding update message to the communication node by using the home address replacement character, and carries the binding update message in the binding update message.
  • a home address encrypted with a binding management key the binding management key is generated by a key token received from the communication node in a return route reachable process; the communication node performs home address replacement according to the binding update message Binding of the character, home address, and care-of address.
  • the present invention also provides a mobile IPv6 communication system, including a mobile node, a communication node, and a home agent; the mobile node, configured to send a handover test initial message to the communication node; send a home test initial message to the home agent; and receive the communication node to return a handover test message containing the handover key token; receiving a home test message containing the home key token forwarded by the home agent; generating a binding management key according to the home key token and the handover key token; Adding an encrypted home address option in the update message, carrying the home address encrypted with the binding management key, and then transmitting a binding update message by replacing the home address with the home address replacement character; the home agent for using the hometown
  • the test initial message is forwarded to the communication node, and the destination message extension header is carried in the sending message, the destination option extension header includes a home address replacement character option, and the home address replacement character is carried; the home test message sent by the communication node is received, according to the report
  • the embodiment of the present invention provides a mobile node in an IPv6 communication system, including: a first return route reachable unit, configured to perform a return route reachability process, including obtaining a key token from a communication node; binding a management key a unit, configured to generate a binding management key by the key token calculation; the first binding update unit is configured to send a binding update message to the communication node by using a home address replacement character, and carry the binding update message in the binding update message Bind the home address of the management key encryption.
  • An embodiment of the present invention provides a communication node in an IPv6 communication system, including: a route reachable unit, configured to perform a return route reachability process, including returning a key token to the mobile node during a return route reachability process; binding a management key unit, configured to be tied by the key token calculation a second binding update unit, configured to obtain a home address encrypted by the binding management key in a binding update message of the mobile node, and perform the home address replacement character, the home address, and The binding of the care-of address.
  • the method of the present invention uses the home address replacement instead of the home address to perform the return route reachability process.
  • the home address in the BU message is sent in the form of an encryption option, so that the binding update process is performed.
  • the home address appears only once in encrypted form, which enhances the security of the home address in the binding update process.
  • FIG. 1 is a schematic flowchart of a method for binding update in mobile IPv6 according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a method for binding update in mobile IPv6 according to Embodiment 2 of the present invention
  • FIG. 3 is a schematic diagram of mobile IPv6 in the third embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a mobile IPv6 transmission system according to Embodiment 4 of the present invention.
  • FIG. 5 is a schematic diagram showing the internal structure of a mobile node, a communication node, and a home agent in a mobile IPv6 transmission system according to Embodiment 4 of the present invention.
  • the home address replacement function is used to replace the home address to perform the return route reachability process, and after obtaining the binding management key, the home address in the BU message is in the form of an encryption option. send.
  • the home address index can also be bound together during the binding update.
  • the preferred home address replacement and BU message sequence number calculation methods are provided in the present invention.
  • the present invention also provides a corresponding mobile IPv6 transmission system. The method and system of the present invention are described in detail below.
  • Embodiment 1 A method for binding update in mobile IPv6, the process shown in FIG. 1 includes the following steps:
  • RRP is a process mainly used to ensure the security of communication between a MN and a CN.
  • the principle is to authenticate the registration between the MN and the CN by encrypting the signaling exchanged between the MN and the CN.
  • the CN knows whether it is possible to access the MN using the optimized routing and triangular routing mode; if the RRP test fails, the CN will neither receive the binding update of the MN nor directly send the packet to the care-of address of the MN.
  • the test process mainly includes the transmission of two message pairs: HoTI and HoT, CoTI and CoT.
  • CoTI and CoT are directly sent to the other party by the MN and CN, and HoTI and HoT are forwarded by the HA between the MN and the CN.
  • the transmission of HoTI and CoTI can be simultaneous.
  • the transmission of the CoT can also be simultaneous.
  • the CoA and the CoT exchange message do not involve the MN's HoA, it can be performed according to the existing process in the present invention; the interaction between the HoTI and the HoT is divided into a part between the MN and the HA and a part between the HA and the CN; Since the message transmission between the MN and the HA is in the tunnel mode, the inner layer packet is protected by the tunnel mode ESP (Encapsulating Security Payload) header, and the security is high. Therefore, the present invention mainly considers the part of the interaction between HA and CN in the R P process.
  • ESP Encapsulating Security Payload
  • Alll and MN send CoTI to the CN.
  • the source address in the IPv6 header is CoA
  • the destination address is CN
  • the mobile header is a CoTI message.
  • the CN After receiving the CoTI message, the CN generates a Care-of Keygen Token according to the CoA calculation, and then sends the CoT including the handover key token to the MN, where the source address in the IPv6 header of the packet is CN. , the destination address is CoA, and the mobile header is a CoT message;
  • A12, HoTI and HoT interact, including:
  • the MN sends the HoTI to the HA in the tunnel mode.
  • the source address in the outer IPv6 header of the packet is CoA, and the destination address is HA.
  • ESP tunnel mode security encapsulation payload
  • the destination address is CN, and the mobile header is a HoTI message.
  • A122 After receiving the HoTI packet sent by the MN in the tunnel mode, the HA performs the IP protocol security (IPSec) process to obtain the inner IPv6 packet; the source address in the inner packet is replaced by the HA, and the IPv64 header is used. Add the destination option extension header between the mobile headers to forward the HoTI message to the CN. Generally, in the destination option extension header, the home address option needs to be placed to carry the HoA. In the present invention, to hide the HoA of the MN, the HA is replaced by the corresponding SHoA, and a new option, that is, the hometown, is selected in the destination option extension header. Address substitution option to carry SHoA;
  • IPSec IP protocol security
  • SHoA First (128, PRF (Kmh, Message 1) )
  • Kmh is the shared key between the MN and the HA
  • Message1 is composed of information that can be shared by the MN and the HA, including CoA, HoA, CN address, HA address, etc.
  • Messagel (CoA
  • the addition of the CoA in the SHoA-based expression can change the SHoA with the change of the CoA.
  • Adding the HoA can make the SHoA generated by different HoAs bound to the same CoA different.
  • Joining the CN can make the SHoA used by different CN communication different.
  • the PRF is a pseudo-random function, which means that the message Messagel is processed under the action of Kmh to generate a pseudo-random output.
  • the hash message authentication code algorithm function such as HMAC, can be used. – SHA1, etc.;
  • First is a truncation function, indicating that the first few bits of the PRF output hash are intercepted. Since SHoA is used instead of HoA, its length needs to be consistent with HoA, so 128 bits are used. After the HA calculates the SHoA, it saves the association between SHoA and HoA.
  • the A123 and the CN can learn that the SHoA is used according to the option type in the destination option extension header, so the ShoA is used for calculating the Home Keygen Token; then the hometown is included.
  • the sending of the HoT message of the key token usually, the second type of routing header is required to carry the HoA of the MN in the sending message.
  • the CN is replaced by the corresponding SHoA; in the IPv6 header of the sent packet
  • the source address is CN
  • the destination address is HA
  • the second type of routing header carries SHoA
  • the mobile header is a HoT message.
  • the HA receives the HoT message sent by the CN, and needs to perform the forwarding to the MN through the tunnel mode.
  • the corresponding HoA is searched according to the SHoA in the second type of routing header, and then the destination address in the IPv6 header of the HoT packet is replaced with HoA, tunnel encapsulation and transmission;
  • the source address in the outer IPv6 header of the packet is HA, and the destination address is CoA;
  • the source address in the inner IPv6 header under the tunnel mode ESP header protection is CN, destination address For HoA, the mobile header is a HoT message;
  • Kbm binding management Key
  • Kbm HMAC SHAl (Home Keygen Token
  • the MN sends a BU message to the CN to perform binding update.
  • the message of the BU message needs to carry the destination option extension header, which includes the home address option, and is used to carry the ⁇ .
  • the MN is hidden.
  • the SHoA is placed in the home address option instead of the HoA, and in order to send the association between the HoA and the SHoA to the CN, the MN uses the encrypted home address option in the BU message, and places the HoA encrypted with the Kbm in the encrypted home address option;
  • the source address in the IPv6 header of the BU packet is CoA, and the destination address is CN.
  • the destination option extension header carries the home address option, and the SHOA is placed.
  • the mobile header is a BU message.
  • the options include the serial number, the encrypted home address option, and the temporary random address of the home. Number index, transfer temporary random number index, message authorization code, etc., wherein the encrypted home address option is a new option in the invention;
  • the CN After receiving the BU message of the MN, the CN recovers the HoA from the encrypted home address option through the Kbm, and then updates the SHoA, HoA, and CoA bindings to the binding cache entry; usually, the CN also returns a binding to the MN.
  • the message (BA: Binding Acknowledge) indicates that the binding update process is completed. After that, the MN and the CN can directly transmit the message through route optimization.
  • the content carried by the home address option in the header is extended by the SHoA as the destination option;
  • SHoA is used as the content carried by the second type of routing header, so that the eavesdropper cannot obtain the HoA of the mobile user through packet interception.
  • the second embodiment is a binding update method in the mobile IPv6, and the process is as shown in FIG. 2, and the steps are the same as those in the first embodiment. The difference is that the random number of the BU message sequence is generated in this embodiment.
  • the method, the specific steps include:
  • the SHOA is used instead of the HoA to perform the RRP process between the HA and the CN;
  • the specific method can refer to the step A1 in the first embodiment;
  • the RRP process ends, and the MN generates Kbm according to the home key token and the handover key token returned by the CN;
  • the MN sends a BU message to the CN to perform binding update.
  • the MN places the corresponding SHoA in the home address option of the destination option extension header instead of HoA;
  • Seq_increment First (8, PRF (Kbm, Message2) )
  • Message2 is a message including the previous serial number (Seq#) or the previous serial number increment (seq_increment#), which can be expressed as
  • the Expression may be combined with information related to and shared by the MN and the CN, such as the address of the MN's CoA, Ho A, CN, etc., of course, the Expression may also be empty; in this embodiment, the pseudo-random function PRF adopts HMAC-SHA1, First truncation function. Take the first 8 digits;
  • the re-acquisition sequence number increment is:
  • XOR is an exclusive OR function, indicating an exclusive OR operation of Kbm and HoA
  • B34 Sending a BU message; the source address in the IPv6 header of the BU message is CoA, and the destination address is CN; the destination option extension header carries the home address option, the SHOA is placed, and the mobile header is a BU message, and the option includes the serial number and encryption. Home address options, etc.;
  • the CN After receiving the BU message of the MN, the CN recovers the HoA from the encrypted home address option through the Kbm, and then updates the SHoA, HoA, and CoA bindings to the binding cache entry.
  • the third embodiment is a binding update method in the mobile IPv6, and the process is as shown in FIG. 3, and the procedure is the same as that in the first embodiment.
  • the difference is that, in this embodiment, when the MN sends a BU message to perform binding update, And carrying the HoA Index corresponding to the HoA, and implementing the binding of the HoA, CoA, SoA, and HoAIndex, and the specific steps include:
  • the SHOA is used instead of the HoA to perform the RRP process between the HA and the CN;
  • the specific method can refer to the step A1 in the first embodiment;
  • the MN After the C2 and the MN receive the CoT message directly sent by the CN and the HoT message forwarded by the HA, the RRP After the process ends, the MN generates Kbm according to the home key token and the handover key token returned by the CN; C3, the MN sends a BU message to the CN, and performs binding update;
  • the MN replaces the HoA with the corresponding SHoA in the home address option
  • the home address index is the value provided by the MN corresponding to its HoA.
  • a MN has one or more home addresses
  • a list of its home addresses is stored in its cache, which can be stored in an array, linked list, or other manner.
  • the number set of 1-1 (or 1 ⁇ ! 1 ) establishes a single mapping relationship, such as 0 ⁇ ! 1-1 ( l ⁇ n ) can be an array subscript of a home address list stored in an array, or a storage location tag of a home address. Therefore, the array subscript of MN's home address list can be used as the home address index, and the home address of the MN can be directly obtained through the home address index.
  • C34 Sending a BU message; the source address in the IPv6 header of the BU message is CoA, and the destination address is CN; the destination option extension header carries the home address option, and the SHOA is placed, and the mobile header is a BU message, and the option includes the serial number and encryption. Home address options, home address index, etc.;
  • the CB After receiving the BU message of the MN, the CB recovers the HoA from the encrypted home address option through the Kbm, and then updates the SHoA, HoA, CoA, and home address index bindings to the binding cache entry;
  • a new "binding index extension header" carrying the home address index may be used instead of the home address option or the second type of routing header. Since the home address index is only a short pointer value, and the home address option or the second type of routing header carries a length of 128 bits regardless of whether the HoA or the SHoA is carried, this not only greatly reduces the header length, but also The parameter corresponding to the HoA in the message only shows the home address index, which further improves the security. Of course, you can also use the "bind index extension header" instead of the mobile header. Add “Binding Index Options" to carry the home address index.
  • a mobile IPv6 communication system as shown in FIG. 4, includes a mobile node 100, a communication node 200, and a home agent 300;
  • the mobile node 100 is configured to send a handover test initial message to the communication node 200; send a home test initial message to the home agent 300; receive the handover test message including the care-of key token returned by the communication node 200; and receive the forwarded by the home agent 300
  • the home test message of the home key token; the binding management key is generated according to the home key token and the transfer key token; the encrypted home address option is placed in the binding update message, and the binding management key is carried The home address of the key encryption, and then the home address replacement letter to send the binding update message to the communication node 200;
  • the home agent 300 is configured to forward the home test initial message to the communication node 200, and carry a destination option extension header in the sending message, where the destination option extension header includes a home address replacement option, and carries a home address replacement character; Receiving the home test message sent by the communication node 200, searching for the corresponding home address according to the home address replacement character in the second type of routing header in the message, and forwarding the home test message to the mobile node 1 through the tunnel mode;
  • the communication node 200 is configured to receive a home test initial message forwarded by the home agent 300, generate a home key token by replacing the home address with a home address replacement character, and return a home test message including the home key token to the home agent 300, and
  • the sending packet carries a second type of routing header, and the second type of routing header carries the home address replacement character; and the binding of the home address replacement character, the home address, and the care-of address is performed according to the binding update message.
  • the binding update method described in Embodiments 1 to 3 can be applied to the system of this embodiment.
  • the internal structure of the mobile node 100, the communication node 200, and the home agent 300 in the mobile IPv6 communication system of the fourth embodiment can be as shown in FIG.
  • the mobile node 100 includes a first return route reachable unit 110, a first binding update unit 120, and a binding management key unit 140, and may also include a home address replacement unit 130 and a first serial number unit 150.
  • the home address replacement unit 130 calculates a generated home address substitute based on the shared key with the home agent 300 and a message including the care-of address, the home address, the address of the communication node 200, and/or the address of the home agent 300, and provides The first return route reachable unit 110 and the first binding update unit 120 are used.
  • the first return route reachable unit 110 is responsible for performing a return route reachability process, including obtaining a key token from the second return route reachable unit 220 of the communication node 200, including obtained from the handover test message and the home test message, respectively.
  • the key token and the home key token are forwarded and the key token is output to the binding management key unit 140.
  • the binding management key unit 140 generates a binding management key based on the key token calculation and supplies it to the first return route reachable unit 110 and the first binding update unit 120 for use.
  • the first binding update unit 120 sends a binding update message to the second binding update unit 220 of the communication node 200 with the home address replacement instead of the home address, and carries the home address encrypted with the binding management key in the binding update message. So that the communication node 200 can update the binding of the home address substitute, the home address, and the care-of address accordingly.
  • the first binding update unit 120 may carry a home address index having a corresponding relationship with the home address in the binding update message, so that the communication node 200 may bind the home address index, the home address substitute, the home address, and the care-of address together. set.
  • the binding update message typically carries a sequence number, which may be provided by the first sequence number unit 150.
  • the first serial number unit 150 adds the sum of the previous serial number and the current serial number increment to obtain the current serial number, wherein the serial number increment is based on the binding management key and the previous serial number or the previous sequence. The number is calculated incrementally. For specific algorithms, refer to the foregoing method embodiments, which are not repeated here.
  • the communication node 200 includes a second return route reachable unit 210, a second binding update unit 220, and a binding management key unit 240, and may further include a second serial number unit 250.
  • the second return route reachable unit 210 is responsible for performing a return route reachability process, including performing a return route reachability process between the home return address and the third return route reachable unit 310 of the home agent 300 by replacing the home address with the home address substitute, and
  • the first return route reachable unit 110 of the mobile node 100 returns a key token.
  • the key token includes a home key token and a care-of key token, wherein the handover key token is generated by the second return route reachable unit 210 according to the care-of address of the mobile node 100, and the handover test in the return route reachability process
  • the message is sent to the mobile node 100; the home key token is generated by the second return route reachable unit 210 according to the home address substitute, and sent to the mobile node 100 in the home test message returning the route reachable process.
  • the second return route reachable unit 210 outputs the generated key token to the binding management key unit 240.
  • the binding management key unit 240 generates a binding management key from the key token calculation, and supplies the binding management key to the second binding update unit 220.
  • the second binding update unit 220 receives the binding update message sent by the first binding update unit 120 in the mobile node 100, and according to the binding management key provided by the binding management key unit 240, the home address in the binding update message. Decryption is performed, and the home address replacement character, home address, and care-of address of the mobile node 100 are bound. If the home address index is included in the binding update message, the second binding unit 220 may add an address indexing module to bind the home address index value, the home address replacement character, the home address, and the care-of address.
  • the communication node 200 also correspondingly includes the second serial number unit 250.
  • the second sequence number unit 150 calculates the current sequence number in the same manner as the first sequence number unit 150 to correctly receive the binding update message from the mobile node 100.
  • the home agent 300 includes a third return route reachable unit 310 and a second binding update unit 220 and a home address substitute unit 130.
  • the home address replacement unit 130 calculates a generated home address substitute based on the shared key with the mobile node 100 and a message including the care-of address, the home address, the address of the communication node 200, and/or the address of the home agent 300, and provides The third return route reachable unit 310 is used.
  • the third return route reachable unit 310 is responsible for performing the return route reachability process, including performing the return route reachability process with the second return route reachable unit 210 of the communication node 200 by replacing the home address with the home address substitute.
  • the embodiment of the present invention adopts the home address replacement instead of the home address to perform the return route reachability process.
  • the home address in the BU message is sent in the form of an encryption option, so that the binding update process is performed.
  • the home address appears only once in an encrypted form, which enhances the security of the home address in the binding update process.
  • the calculation of the home address replacement character can be generated. In the formula, the home address is added to the home address, and the home address is not the same, so as to avoid confusion. Further, the embodiment of the present invention binds the home address index with the home address, the care-of address, and the like.
  • a new extension header including the home address index can be further used instead of the home address option or the second type of routing header originally carrying the home address, which not only greatly saves the header space, but also makes the mobile Users have better security, and if the mobile node has multiple hometowns
  • the method of calculating the serial number of the BU message is also provided in the embodiment of the present invention, so that the serial number has a random increment that can be shared by the mobile node and the communication node, and avoids Tracking of the serial number of the BU message.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Description

移动 IPv6中的绑定更新方法及移动 IPv6通讯系统 本申请要求于 2006 年 8 月 31 日提交中国专利局、 申请号为 200610111876.9、发明名称为"移动 IPv6中的绑定更新方法及移动 IPv6通讯系 统"的中国专利申请的优先权， 其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络通讯技术领域， 尤其涉及移动互联网协议第 6版（IPv6: Internet Protocol version 6 ) 中的绑定更新方法及移动 IPv6通讯系统。
背景技术
移动互联网协议第 6版是一种在网络层解决移动性的方案。 移动 IPv6中 有三种基本的网络实体： 移动节点 （MN: Mobile Node )、 通信节点 （ CN:
Correspondent Node ) 以及家乡代理 ( HA: Home Agent )。
一个移动节点可以通过家乡地址（ HoA: Home Address )唯一的识别出， 移动节点漫游到外地网络时， 会通过一定方式生成转交地址（CoA: Care of
Address )。 移动 IPv6规范要求， 移动节点从一条链路移动到另一链路的过程 中， 不中断使用家乡地址正在进行的通信， 节点的移动性对传输层和其它高层 协议都是透明的。 移动 IPv6定义了两种不同的模式来解决移动性问题： 双向 隧道模式与路由优化模式：
在双向隧道模式下， 移动节点将转交地址通过绑定更新 （BU: Binding
Update )消息通知家乡代理。 家乡代理会截获发送到移动节点家乡网络与移动 节点通信的报文，再通过隧道模式转发给移动节点； 当移动节点向通信节点发 送报文时， 需要将报文通过隧道模式发送到家乡代理， 家乡代理对隧道报文进 行解封装后转发给通信节点；
在路由优化模式下，移动节点需要向通信节点进行注册， 首先是执行一个 返回路由可达过程 ( RRP: Return Routability Procedure ), 该过程包括在移动 节点和通信节点之间交换两对消息：家乡测试初始消息（ HoTI: Home Test Init ) 和家乡测试消息（HoT: Home Test ), 转交测试初始消息（ CoTI: Care-ofTest
Init )和转交测试消息（ CoT: Care-ofTest )。 HoTI和 HoT通过家乡代理转发，
CoTI和 CoT直接在移动节点和通信节点之间交换。在成功执行 RRP后，移动 节点就能够通过 BU 消息将转交地址和家乡地址绑定更新到通信节点的绑定 緩存表中， 并在后续的通讯过程中直接与通信节点进行报文传递， 而无须通过 家乡代理转发。
在使用移动 IPv6通信时， 位置的隐私性非常重要， 在没有隐藏的情况下， 用户的敏感数据可能会被收集和分析， 用户的活动可能被检测和跟踪， 因而可 能会对移动用户产生严重的安全威胁。 当移动节点位于外地链路时，其与家乡 代理之间通过隧道发送的报文的内层报头会携带其家乡地址；其通过路由优化 模式与通信节点进行通讯时，由移动节点发往通信节点的报文中的家乡地址选 项包含有移动节点的家乡地址 ,由通信节点发往移动节点的报文中的第二类路 由头中也包含有移动节点的家乡地址。
为避免将位于外地链路的移动节点的家乡地址暴露给窃听者，目前主要采 用的方法是使用家乡地址的替代符来代替真实的家乡地址。此种方法的实现有 赖于在绑定更新过程中除了完成移动节点家乡地址与转交地址的绑定更新外， 还要同时进行所使用替代符与家乡地址的绑定更新。
一种执行方法是：从 128位的 IPv6地址空间中划出 16位作为临时移动标 识符（ TMI )的前缀， 使用此前缀的地址都看成是 TMI, TMI被规定为不可路 由。 每个移动节点分配一个 128位的 TMI, TMI以某种算法作周期性改变。 在进行到通信节点的绑定更新过程中， 将 TMI放置在家乡地址选项里， 真正 的家乡地址则放置在新定义的绑定更新子选项中。通信节点将 TMI、家乡地址 和转交地址绑定在一起。 然后在后续的通讯过程中，移动节点和通信节点使用 TMI来代替家乡地址选项和第二类路由头中的当前家乡地址。
在实现本发明的过程中， 发明人发现上述方法至少存在如下的缺陷： 1、 没有对 RRP过程中的家乡地址进行保护， 在绑定更新报文中仍然需要直接携 带家乡地址； 2、 产生对 IPv6地址空间的固定占用； 3、 若 TMI的周期性变化 与转交地址的改变不同步则会带来额外的 RRP执行， 消耗网络资源； 4、 如果 移动节点有多个家乡地址绑定到同一个转交地址会出现混淆。
此外， 移动节点在执行绑定更新的过程中， BU报文所包含的序列号也可 能泄露移动用户的踪迹。如果绑定更新报文的序列号增量是固定的，或是容易 被获得变化规律的 ,窃听者仍然可以通过检测一系列绑定更新消息而猜测出移 动节点的运动。 发明内容
本发明的目的在于提供一种移动 IPv6 中的绑定更新方法及相应的移动 IPv6通讯系统， 能够增强家乡地址在绑定更新过程中的安全性。
为达到本发明的目的， 所采取的技术方案是： 一种移动 IPv6中的绑定更 新方法， 包括： 移动节点以家乡地址替代符向通信节点发送绑定更新消息， 在 绑定更新消息中携带以绑定管理密钥加密的家乡地址；所述绑定管理密钥由在 返回路由可达过程中从通信节点接收的密钥令牌生成；通信节点按照所述绑定 更新消息进行家乡地址替代符、 家乡地址和转交地址的绑定。
本发明还提供一种移动 IPv6通讯系统， 包括移动节点、 通信节点和家乡 代理； 所述移动节点， 用于向通信节点发送转交测试初始消息； 向家乡代理发 送家乡测试初始消息； 接收通信节点返回的包含转交密钥令牌的转交测试消 息；接收家乡代理转发的包含家乡密钥令牌的家乡测试消息；根据家乡密钥令 牌和转交密钥令牌生成绑定管理密钥；在绑定更新消息中置入加密家乡地址选 项，携带以所述绑定管理密钥加密的家乡地址，再以家乡地址替代符代替家乡 地址发送绑定更新消息； 所述家乡代理， 用于将所述家乡测试初始消息转发给 通信节点， 并在发送报文中携带目的选项扩展头， 所述目的选项扩展头包括家 乡地址替代符选项，携带家乡地址替代符；接收通信节点发送的家乡测试消息， 根据报文中第二类路由头中的家乡地址替代符查找对应的家乡地址 ,通过隧道 模式将所述家乡测试消息转发给移动节点； 所述通信节点， 用于接收家乡代理 转发的家乡测试初始消息， 以家乡地址替代符代替家乡地址生成家乡密钥令 牌； 向家乡代理返回包含家乡密钥令牌的家乡测试消息， 并在发送报文中携带 第二类路由头， 所述第二类路由头携带所述家乡地址替代符； 按照所述绑定更 新消息进行家乡地址替代符、 家乡地址和转交地址的绑定。
本发明实施例提供了一种 IPv6通讯系统中的移动节点， 包括： 第一返回 路由可达单元， 用来进行返回路由可达过程， 包括从通信节点获得密钥令牌； 绑定管理密钥单元， 用来由所述密钥令牌计算生成绑定管理密钥； 第一绑定更 新单元， 用来以家乡地址替代符向通信节点发送绑定更新消息，在绑定更新消 息中携带以绑定管理密钥加密的家乡地址。
本发明实施例提供了一种 IPv6通讯系统中的通信节点， 包括： 第二返回 路由可达单元， 用来进行返回路由可达过程， 包括在返回路由可达过程中向移 动节点返回密钥令牌； 绑定管理密钥单元， 用来由所述密钥令牌计算生成绑定 管理密钥； 第二绑定更新单元， 用来获得移动节点的绑定更新消息中以所述绑 定管理密钥加密的家乡地址， 并进行所述家乡地址替代符、所述家乡地址和转 交地址的绑定。
本发明采用利用家乡地址替代符代替家乡地址执行返回路由可达过程的 方法， 在获得绑定管理密钥后将 BU报文中的家乡地址以加密选项的形式发 送，使得在执行绑定更新过程时传送到通信节点的报文中， 家乡地址仅以加密 形式出现一次， 增强了家乡地址在绑定更新过程中的安全性。
附图说明
图 1是本发明实施例一移动 IPv6中的绑定更新方法流程示意图； 图 2是本发明实施例二移动 IPv6中的绑定更新方法流程示意图； 图 3是本发明实施例三移动 IPv6中的绑定更新方法流程示意图； 图 4是本发明实施例四移动 IPv6传输系统结构示意图；
图 5是本发明实施例四移动 IPv6传输系统中移动节点、 通信节点和家乡 代理的内部结构示意图。
具体实施方式
在本发明提供移动 IPv6中的绑定更新方法中， 利用家乡地址替代符代替 家乡地址执行返回路由可达过程，在获得绑定管理密钥后将 BU报文中的家乡 地址以加密选项的形式发送。在执行绑定更新的过程中，还可将家乡地址索引 一同进行绑定。本发明中提供优选的家乡地址替代符以及 BU报文序列号的计 算方法。 本发明并提供相应的移动 IPv6传输系统。 以下分别对本发明方法和 系统进行详细说明。
实施例一、 一种移动 IPv6中的绑定更新方法， 流程如图 1所示， 包括步 骤：
Al、 以家乡地址替代符（SHoA: Substitute of Home Address )代替家乡地 址执行家乡代理与通信节点间的 RRP过程；
RRP是主要用来保证 MN与 CN通信时的安全的过程， 其原理是通过对 MN与 CN之间交换的信令进行加密来对它们之间的登记进行认证。通过 RRP, CN知道是否能够使用优化路由和三角路由模式访问 MN;如果 RRP测试失败， CN将既不能接收 MN的绑定更新， 也不能直接发送分组到 MN的转交地址。 其测试过程主要包括两个消息对的传送： HoTI和 HoT, CoTI和 CoT。 其中 CoTI和 CoT分别由 MN和 CN直接发送给对方 , HoTI和 HoT则由 HA在 MN 和 CN之间转发， 对于 MN而言， HoTI和 CoTI的发送可以是同时的， 对于 CN而言， HoT和 CoT的发送也可以是同时的。
由于 CoTI和 CoT交互的报文中不涉及 MN的 HoA, 因此在本发明中可 按照现有过程执行； HoTI和 HoT的交互分为 MN与 HA之间的部分和 HA与 CN之间的部分； 由于 MN与 HA的报文传送采用隧道模式， 内层报文受隧道 模式 ESP ( Encapsulating Security Payload, 安全封装净荷）头保护， 安全性较 高。 因此本发明主要考虑的是 R P过程中， 在 HA与 CN之间交互的部分。
本实施例中的 RRP具体过程包括：
All、 CoTI和 CoT交互， 包括：
Alll、 MN向 CN发送 CoTI, 报文 IPv6报头中的源地址为 CoA, 目的地 址为 CN, 移动头为 CoTI消息；
A112、 CN收到 CoTI消息后， 根据 CoA计算生成转交密钥令牌（Care-of Keygen Token )， 然后将包含转交密钥令牌的 CoT发送给 MN, 报文 IPv6报头 中的源地址为 CN, 目的地址为 CoA, 移动头为 CoT消息；
A12、 HoTI和 HoT交互， 包括：
A121、 MN通过隧道模式向 HA发送 HoTI, 报文外层 IPv6报头中的源地 址为 CoA, 目的地址为 HA, 隧道模式安全封装净荷（ESP ) 头保护下的内层 IPv6报头中的源地址为 HoA, 目的地址为 CN, 移动头为 HoTI消息；
A122、 HA收到 MN以隧道模式发送的 HoTI报文后， 执行 IP协议安全 ( IPSec )处理， 得到内层 IPv6报文； 将内层报文中的源地址以 HA代替， 在 IPv64艮头和移动头之间添加目的选项扩展头，以进行 HoTI消息到 CN的转发。 通常， 在目的选项扩展头中需要放置家乡地址选项以携带 HoA, 本发明中， 为隐藏 MN的 HoA, HA以相应的 SHoA来代替，在目的选项扩展头中以一种 新的选项 , 即家乡地址替代符选项来携带 SHoA;
为保证 SHoA的隐私性， 并且能够由 HA和 MN各自通过计算得到，本实 施例中采用的 SHoA的计算方式如下：
SHoA = First (128, PRF (Kmh, Message 1) )
其中 Kmh为 MN和 HA之间的共享密钥； Messagel由可为 MN和 HA共享的 信息构成， 包括 CoA、 HoA、 CN地址、 HA地址等， 本例中采用 Messagel = (CoA|HoA|CN), 即， 由 CoA、 HoA和 CN连接而成， 在生成 SHoA的运算式 中加入 CoA可以使 SHoA随 CoA的改变而变化 , 加入 HoA可以使绑定到同 一 CoA的不同 HoA生成的 SHoA不相同， 加入 CN可以使和不同 CN通信所 使用的 SHoA是不同的； PRF为伪随机函数， 表示在 Kmh的作用下对消息 Messagel 进行处理生成伪随机输出， 可以采用哈希消息鉴别码算法函数， 例 如 HMAC— SHA1等； First为截断函数， 表示截取 PRF输出散列的前若干位， 由于 SHoA是用来代替 HoA的，其长度需要与 HoA—致，因此式中取 128位。 HA计算出 SHoA后， 保存 SHoA与 HoA的关联。
A123、 CN收到 HoTI消息后， 根据目的选项扩展头中的选项类型即可获 知所使用的是 SHoA, 因此在计算家乡密钥令牌 ( Home Keygen Token ) 时使 用 SHoA进行计算； 然后进行包含家乡密钥令牌的 HoT消息的发送， 通常， 在发送报文中需要设置第二类路由头来携带 MN的 HoA, 本发明中， CN以相 应的 SHoA来代替；所发送报文 IPv6报头中的源地址为 CN, 目的地址为 HA, 第二类路由头携带 SHoA, 移动头为 HoT消息；
A124、 HA收到 CN发来的 HoT消息， 需要通过隧道模式进行到 MN的 转发；先根据第二类路由头中的 SHoA查找对应的 HoA,然后将 HoT报文 IPv6 报头中的目的地址替换为 HoA, 再进行隧道封装和发送； 发送报文外层 IPv6 艮头中的源地址为 HA, 目的地址为 CoA;隧道模式 ESP头保护下的内层 IPv6 艮头中的源地址为 CN, 目的地址为 HoA, 移动头为 HoT消息；
上述过程 All和 A12可并行执行；
A2、 MN收到 CN直接发送的 CoT消息和 HA转发的 HoT消息后 , R P 过程结束， MN根据 CN返回的家乡密钥令牌和转交密钥令牌生成绑定管理密 钥 （Kbm: binding management Key ); Kbm可采用通常的计算方式：
Kbm = HMAC SHAl (Home Keygen Token| Care-of Keygen Token) 即对由家乡密钥令牌和转交密钥令牌组成的序列进行哈希算法 HMAC— SHA1 计算获得 Kbm;
A3、 MN向 CN发送 BU消息， 进行绑定更新； 通常 BU消息的报文中需 要携带目的选项扩展头， 其中包括家乡地址选项， 用于携带 ΗοΑ; 本发明中， 为隐藏 ΗοΑ, MN以相应的 SHoA放置在家乡地址选项中代替 HoA, 同时为 了把 HoA与 SHoA的关联关系发送到 CN, MN在 BU消息中使用加密家乡地 址选项 , 将用 Kbm加密后的 HoA放置在加密家乡地址选项中； BU报文 IPv6 报头中的源地址为 CoA, 目的地址为 CN; 目的选项扩展头携带家乡地址选项， 放置 SHoA, 移动头为 BU消息， 其选项中包括序列号、 加密家乡地址选项、 家乡临时随机数索引、 转交临时随机数索引、 消息授权码等， 其中加密家乡地 址选项为本发明中新增的选项；
A4、 CN收到 MN的 BU消息后 , 通过 Kbm从加密家乡地址选项中恢复 出 HoA, 然后将 SHoA、 HoA、 CoA绑定更新到绑定緩存表项中； 通常 CN还 会向 MN返回一个绑定确认（BA: Binding Acknowledge ) 消息， 表示绑定更 新过程完成，此后， MN与 CN即可通过路由优化的方式直接进行报文的传输。
为了在后续报文传输过程中， 避免 MN的 HoA被窃听者获取， 在 MN发 送到 CN的报文中 ,以 SHoA作为目的选项扩展头中家乡地址选项携带的内容； 在 CN发送到 MN的报文中， 以 SHoA作为第二类路由头携带的内容，这样窃 听者就无法通过报文拦截来获取移动用户的 HoA。
实施例二、 一种移动 IPv6中的绑定更新方法， 流程如图 2所示， 步骤与 实施例一基本相同， 区别之处在于， 本实施例中使用具有随机性的 BU报文序 列号生成方法， 具体步骤包括：
B1、 以 SHoA代替 HoA执行 HA与 CN间的 RRP过程； 具体方法可参考 实施例一中步骤 A1;
B2、 MN收到 CN直接发送的 CoT消息和 HA转发的 HoT消息后 , RRP 过程结束， MN根据 CN返回的家乡密钥令牌和转交密钥令牌生成 Kbm;
B3、 MN向 CN发送 BU消息， 进行绑定更新； 包括：
B31、 在发送 BU的报文中， MN以相应的 SHoA放置在目的选项扩展头 的家乡地址选项中代替 HoA;
B32、 在 BU消息中使用加密家乡地址选项， 将用 Kbm加密后的 HoA放 置在加密家乡地址选项中；
B33、 计算随机的序列号增量（seq_increment )， 将获得的序列号增量与上 一序列号相加得到 BU消息的序列号， 放置在 BU消息的选项中； 本实施例中 所采用的序列号增量计算式为：
seq_increment = First (8, PRF (Kbm, Message2) )
其中 Message2为包括上一序列号（ Seq# )或上一序列号增量（ seq_increment# ) 的消息， 可表示为
Message2 = (Seq#|Expression), 或
Message2 = (seq_increment# |Expression);
Expression可由与 MN和 CN相关且共享的信息组合成， 比如 MN的 CoA、 Ho A, CN的地址等， 当然 Expression也可为空； 本实施例中伪随机函数 PRF 采用 HMAC— SHA1 , First截断函数取前 8位；
特别的， 为增强序列号的不可跟踪性， 若采用上述方法计算得到的序列号 增量为 0, 则重新取序列号增量为：
seq_increment = First (8， Kbm XOR Ho A)
其中 XOR为异或函数， 表示对 Kbm和 HoA进行异或运算；
上述步骤 B31〜： B33可并行执行；
B34、 发送 BU报文； BU报文 IPv6报头中的源地址为 CoA, 目的地址为 CN; 目的选项扩展头携带家乡地址选项， 放置 SHoA, 移动头为 BU消息， 其 选项中包括序列号、 加密家乡地址选项等；
B4、 CN收到 MN的 BU消息后 , 通过 Kbm从加密家乡地址选项中恢复 出 HoA, 然后将 SHoA、 HoA、 CoA绑定更新到绑定緩存表项中。
实施例三、 一种移动 IPv6中的绑定更新方法， 流程如图 3所示， 步骤与 实施例一基本相同， 区别之处在于，本实施例中 MN在发送 BU报文执行绑定 更新时， 还携带与 HoA——对应的家乡地址索引 （HoA Index ), 实现 HoA、 CoA、 SoA、 HoAIndex的绑定， 具体步骤包括：
C1、 以 SHoA代替 HoA执行 HA与 CN间的 RRP过程； 具体方法可参考 实施例一中步骤 A1;
C2、 MN收到 CN直接发送的 CoT消息和 HA转发的 HoT消息后， RRP 过程结束， MN根据 CN返回的家乡密钥令牌和转交密钥令牌生成 Kbm; C3、 MN向 CN发送 BU消息， 进行绑定更新； 包括：
C31、 在发送 BU的报文中， MN以相应的 SHoA放置在家乡地址选项中 代替 HoA;
C32、 在 BU消息中使用加密家乡地址选项 , 将用 Kbm加密后的 HoA放 置在加密家乡地址选项中；
C33、 在 BU消息中携带家乡地址索引；
家乡地址索引是 MN提供的与其 HoA——对应的值。 当一个 MN具有一 个或一个以上家乡地址时，在其緩存中存储着其家乡地址的列表，该列表可以 以数组、 链表或其它方式进行存放。 MN的 η(η>=1)个家乡地址， 每个都可以 和 0〜！ 1-1 (或 1〜！ 1 ) 的数集合建立单一映射关系， 例如 0〜！ 1-1 ( l〜n )可以是以 数组方式存储的家乡地址列表的数组下标，或家乡地址的存储位置标记。所以 MN的家乡地址列表的数组下标便可以作为家乡地址索引，通过家乡地址索引 便可直接对应获得 MN的家乡地址。
上述步骤 C31〜C33可并行执行；
C34、 发送 BU报文； BU报文 IPv6报头中的源地址为 CoA, 目的地址为 CN; 目的选项扩展头携带家乡地址选项， 放置 SHoA, 移动头为 BU消息， 其 选项中包括序列号、 加密家乡地址选项、 家乡地址索引等；
C4、 CN收到 MN的 BU消息后 , 通过 Kbm从加密家乡地址选项中恢复 出 HoA, 然后将 SHoA、 HoA、 CoA和家乡地址索引绑定更新到绑定緩存表项 中；
当然， 由于需要存储家乡地址索引， 因此在 HA或 CN的绑定緩存条目 ( Binding Cache Entry ) 中都需要增加一个存储家乡地址索引的字段。
完成本实施例绑定更新后，在后续的报文发送过程中， 即可用一个新的携 带家乡地址索引的"绑定索引扩展头"来代替家乡地址选项或第二类路由头。由 于家乡地址索引仅仅是一个很短的指针值，而家乡地址选项或第二类路由头中 无论携带的是 HoA还是 SHoA均为 128位的长度， 因此这样不仅可以大大减 小报头长度， 而且由于报文中与 HoA对应的参数仅出现家乡地址索引， 进一 步提高了安全性。 当然也可以不使用"绑定索引扩展头"， 而采用在移动头中增 加"绑定索引选项 "来携带家乡地址索引的方式。
实施例四、 一种移动 IPv6通讯系统， 如图 4所示， 包括移动节点 100、 通信节点 200和家乡代理 300;
移动节点 100， 用于向通信节点 200发送转交测试初始消息； 向家乡代理 300发送家乡测试初始消息； 接收通信节点 200返回的包含转交密钥令牌的转 交测试消息；接收家乡代理 300转发的包含家乡密钥令牌的家乡测试消息；根 据家乡密钥令牌和转交密钥令牌生成绑定管理密钥；在绑定更新消息中置入加 密家乡地址选项，携带以所述绑定管理密钥加密的家乡地址，再以家乡地址替 代符代替家乡地址发送绑定更新消息给通信节点 200;
家乡代理 300， 用于将所述家乡测试初始消息转发给通信节点 200, 并在 发送报文中携带目的选项扩展头 ,所述目的选项扩展头包括家乡地址替代符选 项， 携带家乡地址替代符； 接收通信节点 200发送的家乡测试消息， 根据报文 中第二类路由头中的家乡地址替代符查找对应的家乡地址 ,通过隧道模式将所 述家乡测试消息转发给移动节点 1 ;
通信节点 200， 用于接收家乡代理 300转发的家乡测试初始消息， 以家乡 地址替代符代替家乡地址生成家乡密钥令牌；向家乡代理 300返回包含家乡密 钥令牌的家乡测试消息， 并在发送报文中携带第二类路由头， 所述第二类路由 头携带所述家乡地址替代符； 按照所述绑定更新消息进行家乡地址替代符、 家 乡地址和转交地址的绑定。
本实施例系统可应用实施例一〜三中所描述的绑定更新方法。
实施例四的移动 IPv6通讯系统中移动节点 100、 通信节点 200和家乡代 理 300的内部结构可以如图 5所示。
移动节点 100包括第一返回路由可达单元 110、 第一绑定更新单元 120和 绑定管理密钥单元 140， 还可以包括家乡地址替代符单元 130和第一序列号单 元 150。
家乡地址替代符单元 130根据与家乡代理 300之间的共享密钥，以及包括 转交地址、 家乡地址、 通信节点 200的地址和 /或家乡代理 300的地址的消息 计算生成家乡地址替代符，提供给第一返回路由可达单元 110和第一绑定更新 单元 120使用。 第一返回路由可达单元 110负责进行返回路由可达过程，其中包括从通信 节点 200的第二返回路由可达单元 220获得密钥令牌，包括分别从转交测试消 息和家乡测试消息中获得的转交密钥令牌和家乡密钥令牌，并将密钥令牌输出 至绑定管理密钥单元 140。
绑定管理密钥单元 140根据该密钥令牌计算生成绑定管理密钥 ,并将其提 供给第一返回路由可达单元 110和第一绑定更新单元 120使用。
第一绑定更新单元 120 以家乡地址替代符代替家乡地址向通信节点 200 的第二绑定更新单元 220发送绑定更新消息，在绑定更新消息中携带以绑定管 理密钥加密的家乡地址，使得通信节点 200可以据此更新家乡地址替代符、 家 乡地址和转交地址的绑定。第一绑定更新单元 120可以在绑定更新消息中携带 与家乡地址具有——对应关系的家乡地址索引 ,这样通信节点 200可以将家乡 地址索引、 家乡地址替代符、 家乡地址和转交地址一起绑定。
绑定更新消息中通常携带序列号， 该序列号可以由第一序列号单元 150 提供。第一序列号单元 150将上一序列号与本次序列号增量之和相加得到本次 序列号，其中本次序列号增量根据绑定管理密钥以及上一序列号或上一序列号 增量计算得出。 具体算法参见前述方法实施例， 此处不再重复。
通信节点 200包括第二返回路由可达单元 210、 第二绑定更新单元 220和 绑定管理密钥单元 240， 还可以包括第二序列号单元 250。
第二返回路由可达单元 210负责进行返回路由可达过程，其中包括以家乡 地址替代符代替家乡地址执行与家乡代理 300 的第三返回路由可达单元 310 间的返回路由可达过程，以及向移动节点 100的第一返回路由可达单元 110返 回密钥令牌。 密钥令牌包括家乡密钥令牌和转交密钥令牌，其中转交密钥令牌 由第二返回路由可达单元 210根据移动节点 100的转交地址生成，在返回路由 可达过程的转交测试消息中发送给移动节点 100; 家乡密钥令牌由第二返回路 由可达单元 210根据家乡地址替代符生成，在返回路由可达过程的家乡测试消 息中发送给移动节点 100。
第二返回路由可达单元 210 将生成的密钥令牌输出至绑定管理密钥单元 240。 绑定管理密钥单元 240由密钥令牌计算生成绑定管理密钥， 并将绑定管 理密钥提供给第二绑定更新单元 220。 第二绑定更新单元 220接收移动节点 100中第一绑定更新单元 120发送的 绑定更新消息，按照绑定管理密钥单元 240提供的绑定管理密钥对绑定更新消 息中的家乡地址进行解密， 并绑定移动节点 100的家乡地址替代符、 家乡地址 和转交地址。 如果绑定更新消息中包括家乡地址索引， 则第二绑定单元 220 可以增加地址索引模块， 将家乡地址索引值、 家乡地址替代符、 家乡地址和转 交地址一并绑定。
如果移动节点 100包括第一序列号单元 150， 则通信节点 200也对应地包 括第二序列号单元 250。 第二序列号单元 150采用与第一序列号单元 150同样 的方法计算本次序列号， 以便正确接收来自移动节点 100的绑定更新消息。
家乡代理 300 包括第三返回路由可达单元 310和第二绑定更新单元 220 和家乡地址替代符单元 130。 家乡地址替代符单元 130根据与移动节点 100之 间的共享密钥， 以及包括转交地址、 家乡地址、 通信节点 200的地址和 /或家 乡代理 300的地址的消息计算生成家乡地址替代符，提供给第三返回路由可达 单元 310使用。 第三返回路由可达单元 310负责进行返回路由可达过程， 包括 以家乡地址替代符代替家乡地址执行与通信节点 200 的第二返回路由可达单 元 210间的返回路由可达过程。
本发明实施例采用利用家乡地址替代符代替家乡地址执行返回路由可达 过程， 在获得绑定管理密钥后将 BU报文中的家乡地址以加密选项的形式发 送，使得在执行绑定更新过程时传送到通信节点的报文中， 家乡地址仅以加密 形式出现一次， 增强了家乡地址在绑定更新过程中的安全性； 进一步地， 本发 明实施例中可以在生成家乡地址替代符的计算式中加入家乡地址，使得有多个 绑定到同一转交地址的家乡地址替代符互不相同 , 避免产生混淆； 进一步地， 本发明实施例将家乡地址索引同家乡地址、转交地址等一同进行绑定，使得在 后续报文的发送过程中可进一步使用包含家乡地址索引的新扩展头来代替原 本携带家乡地址的家乡地址选项或第二类路由头， 不仅大大节省了报头空间， 同时也使得移动用户具有更好的安全性，并且若移动节点有多个家乡地址绑定 到同一转交地址也不会产生混淆； 另外， 本发明实施例还提供 BU报文序列号 的计算方法， 使得序列号具有可为移动节点和通信节点共同获知的随机增量， 避免对 BU报文序列号的追踪。 以上对本发明所提供的移动 IPv6中的绑定更新方法及移动 IPv6通讯系统 述， 以上实施例的说明只是用于帮助理解本发明的方法及其核心思想； 同时， 对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围 上均会有改变之处， 综上所述， 本说明书内容不应理解为对本发明的限制。

Claims

权 利 要 求
1、 一种移动 IPv6中的绑定更新方法， 其特征在于， 包括：
移动节点以家乡地址替代符向通信节点发送绑定更新消息，在绑定更新消 息中携带以绑定管理密钥加密的家乡地址；所述绑定管理密钥由在返回路由可 达过程中从通信节点接收的密钥令牌生成；
通信节点按照所述绑定更新消息进行家乡地址替代符、家乡地址和转交地 址的绑定。
2、 根据权利要求 1所述的移动 IPv6中的绑定更新方法， 其特征在于， 所 述从通信节点接收的密钥令牌包括家乡密钥令牌；
所述返回路由可达过程包括：
家乡代理将来自移动节点的家乡测试初始消息转发给通信节点，并在发送 报文的目的选项扩展头中携带家乡地址替代符；
通信节点根据所述家乡地址替代符计算家乡密钥令牌，向家乡代理返回包 含家乡密钥令牌的家乡测试消息，并在发送报文的第二类路由头中携带所述家 乡地址替代符；
家乡代理根据所述第二类路由头中的家乡地址替代符查找对应的家乡地 址， 通过隧道模式将所述家乡测试消息转发给移动节点。
3、 根据权利要求 2所述的移动 IPv6中的绑定更新方法， 其特征在于， 所 述从通信节点接收的密钥令牌还包括转交密钥令牌；
所述返回路由可达过程还包括：移动节点向通信节点发送转交测试初始消 息， 获得通信节点返回的包含转交密钥令牌的转交测试消息。
4、 根据权利要求 1所述的移动 IPv6中的绑定更新方法， 其特征在于： 在 发送绑定更新消息时， 所述绑定更新消息中还包括家乡地址索引， 所述移动节 点的家乡地址与家乡地址索弓 )值——对应；
通信节点按照所述绑定更新消息进行绑定更新时，将家乡地址替代符、 家 乡地址、 家乡地址索引和转交地址绑定。
5、 根据权利要求 4所述的移动 IPv6中的绑定更新方法， 其特征在于： 所 述家乡地址索引值为移动节点存储的家乡地址列表中各个家乡地址的位置标 记或数组下标。
6. 如权利要求 1所述的移动 IPv6中的绑定更新方法， 其特征在于， 所述 家乡地址替代符根据移动节点与家乡代理之间的共享密钥， 以及包括转交地 址、 家乡地址、 通信节点地址和 /或家乡代理地址的消息计算得出。
7、根据权利要求 6所述的移动 IPv6中的绑定更新方法， 其特征在于， 所 述家乡地址替代符由下式获得：
SHoA = First (M, PRF (Kmh, Message 1) )
其中 SHoA为家乡地址替代符； Kmh为移动节点和家乡代理之间的共享密钥； Messagel为包括转交地址、 家乡地址、 通信节点地址或家乡代理地址的消息； PRF为伪随机函数； First为截断函数； M为不大于 128的自然数。
8、根据权利要求 1〜7任意一项所述的移动 IPv6中的绑定更新方法， 其特 征在于： 所述绑定更新消息中还包括序列号， 所述序列号为上一序列号与序列 号增量之和，所述序列号增量根据所述绑定管理密钥以及上一序列号或上一序 列号增量计算得出。
9、 根据权利要求 8所述的移动 IPv6中的绑定更新方法， 其特征在于： 所 述序列号增量由下式获得：
seq_increment = First (N， PRF (Kbm, Message2) )
其中 seqjncrement为序列号增量； Kbm为所述绑定管理密钥； Message2为包 括上一序列号或上一序列号增量， 以及移动节点的家乡地址、 转交地址、 和 / 或通信节点地址的消息； PRF为伪随机函数； First为截断函数； N为自然数。
10、 根据权利要求 9所述的移动 IPv6中的绑定更新方法， 其特征在于， 若所述序列号增量为 0, 则取所述序列号增量为：
seq_increment = First (N, Kbm XOR HoA)
其中 HoA为家乡地址； XOR为异或函数。
11、 一种移动 IPv6通讯系统， 其特征在于： 包括移动节点、 通信节点和 家乡代理；
所述移动节点， 用于向通信节点发送转交测试初始消息； 向家乡代理发送 家乡测试初始消息； 接收通信节点返回的包含转交密钥令牌的转交测试消息； 接收家乡代理转发的包含家乡密钥令牌的家乡测试消息；根据家乡密钥令牌和 转交密钥令牌生成绑定管理密钥； 在绑定更新消息中置入加密家乡地址选项， 携带以所述绑定管理密钥加密的家乡地址，再以家乡地址替代符代替家乡地址 发送绑定更新消息；
所述家乡代理， 用于将所述家乡测试初始消息转发给通信节点， 并在发送 报文中携带目的选项扩展头， 所述目的选项扩展头包括家乡地址替代符选项， 携带家乡地址替代符；接收通信节点发送的家乡测试消息，根据报文中第二类 路由头中的家乡地址替代符查找对应的家乡地址，通过隧道模式将所述家乡测 试消息转发给移动节点；
所述通信节点， 用于接收家乡代理转发的家乡测试初始消息， 以家乡地址 替代符代替家乡地址生成家乡密钥令牌；向家乡代理返回包含家乡密钥令牌的 家乡测试消息， 并在发送报文中携带第二类路由头， 所述第二类路由头携带所 述家乡地址替代符； 按照所述绑定更新消息进行家乡地址替代符、 家乡地址和 转交地址的绑定。
12、 一种 IPv6通讯系统中的移动节点， 其特征在于， 包括：
第一返回路由可达单元， 用来进行返回路由可达过程， 包括从通信节点获 得密钥令牌；
绑定管理密钥单元， 用来由所述密钥令牌计算生成绑定管理密钥； 第一绑定更新单元， 用来以家乡地址替代符向通信节点发送绑定更新消 息 , 在绑定更新消息中携带以绑定管理密钥加密的家乡地址。
13、 根据权利要求 12所述的 IPv6通讯系统中的移动节点， 其特征在于： 所述移动节点还包括家乡地址替代符单元，用来根据与家乡代理之间的共享密 钥， 以及包括转交地址、 家乡地址、 通信节点地址和 /或家乡代理地址的消息 计算生成家乡地址替代符。
14、根据权利要求 12所述的的 IPv6通讯系统中的移动节点，其特征在于： 所述绑定更新消息中还包括家乡地址索引 ,所述移动节点的家乡地址与家乡地 址索引值——对应。
15、 根据权利要求 12至 14任意一项所述的的 IPv6通讯系统中的移动节 点， 其特征在于： 所述绑定更新消息中还包括序列号；
所述移动节点还包括第一序列号单元，用来将上一序列号与本次序列号增 量之和相加得到本次序列号，其中本次序列号增量根据所述绑定管理密钥以及 上一序列号或上一序列号增量计算得出。
16、 一种 IPv6通讯系统中的通信节点， 其特征在于， 包括：
第二返回路由可达单元， 用来进行返回路由可达过程， 包括在返回路由可 达过程中向移动节点返回密钥令牌；
绑定管理密钥单元， 用来由所述密钥令牌计算生成绑定管理密钥； 第二绑定更新单元，用来获得移动节点的绑定更新消息中以所述绑定管理 密钥加密的家乡地址， 并进行所述家乡地址替代符、所述家乡地址和转交地址 的绑定。
17、 根据权利要求 16所述的 IPv6通讯系统中的通信节点， 其特征在于： 所述密钥令牌包括家乡密钥令牌和转交密钥令牌，其中转交密钥令牌由第二返 回路由可达单元根据所述转交地址生成，在返回路由可达过程的转交测试消息 中发送给移动节点；家乡密钥令牌由第二返回路由可达单元根据所述家乡地址 替代符生成， 在返回路由可达过程的家乡测试消息中发送给移动节点。
18、 根据权利要求 16所述的 IPv6通讯系统中的通信节点， 其特征在于： 所述绑定更新消息中还包括家乡地址索引；
所述第二绑定单元包括地址索引模块， 用来绑定所述家乡地址索引值、 家 乡地址替代符、 家乡地址和转交地址。
19、根据权利要求 16至 18任意一项所述的 IPv6通讯系统中的通信节点， 其特征在于： 所述绑定更新消息中还包括序列号；
所述通信节点还包括第二序列号单元，用来将上一序列号与本次序列号增 量之和相加得到本次序列号，其中本次序列号增量根据所述绑定管理密钥以及 上一序列号或上一序列号增量计算得出。
PCT/CN2007/070361 2006-08-31 2007-07-26 Procédé pour une mise à jour de liaison dans le système mobile ipv6 et système de communication mobile ipv6 WO2008025270A1 (fr)

Priority Applications (5)

Application Number Priority Date Filing Date Title
PL07764283T PL2056520T3 (pl) 2006-08-31 2007-07-26 Sposób aktualizacji wiązania w ruchomym IPV6 i system telekomunikacji ruchomej IPV6
ES07764283T ES2374317T3 (es) 2006-08-31 2007-07-26 MÉTODO PARA UNA ACTUALIZACIÓN DE ENLACE EN EL SISTEMA MÓVIL IPv6 Y SISTEMA DE COMUNICACIÓN MÓVIL IPv6.
AT07764283T ATE533252T1 (de) 2006-08-31 2007-07-26 Verfahren zur verbindungsaktualisierung in einem mobilsystem nach ipv6 und mobilkommunikationssystem nach ipv6
EP07764283A EP2056520B9 (en) 2006-08-31 2007-07-26 A method for binding update in the mobile ipv6 and a mobile ipv6 communication system
US12/395,178 US20090213797A1 (en) 2006-08-31 2009-02-27 Method for binding update in mobile ipv6 and mobile ipv6 communication system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200610111876.9 2006-08-31
CN2006101118769A CN101136905B (zh) 2006-08-31 2006-08-31 移动IPv6中的绑定更新方法及移动IPv6通讯系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/395,178 Continuation US20090213797A1 (en) 2006-08-31 2009-02-27 Method for binding update in mobile ipv6 and mobile ipv6 communication system

Publications (1)

Publication Number Publication Date
WO2008025270A1 true WO2008025270A1 (fr) 2008-03-06

Family

ID=39135503

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2007/070361 WO2008025270A1 (fr) 2006-08-31 2007-07-26 Procédé pour une mise à jour de liaison dans le système mobile ipv6 et système de communication mobile ipv6

Country Status (7)

Country Link
US (1) US20090213797A1 (zh)
EP (1) EP2056520B9 (zh)
CN (1) CN101136905B (zh)
AT (1) ATE533252T1 (zh)
ES (1) ES2374317T3 (zh)
PL (1) PL2056520T3 (zh)
WO (1) WO2008025270A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8514777B1 (en) * 2008-10-28 2013-08-20 Marvell International Ltd. Method and apparatus for protecting location privacy of a mobile device in a wireless communications network
US8385332B2 (en) * 2009-01-12 2013-02-26 Juniper Networks, Inc. Network-based macro mobility in cellular networks using an extended routing protocol
US8411691B2 (en) * 2009-01-12 2013-04-02 Juniper Networks, Inc. Transfer of mobile subscriber context in cellular networks using extended routing protocol
US8699433B2 (en) * 2010-07-21 2014-04-15 Telefonaktiebolaget L M Ericsson (Publ) System and method for providing mobility with a split home agent architecture
US8428024B2 (en) 2010-07-21 2013-04-23 Telefonaktiebolaget L M Ericsson (Publ) System and method for mobility with a split home agent architecture using MPTCP
EP2824661A1 (en) * 2013-07-11 2015-01-14 Thomson Licensing Method and Apparatus for generating from a coefficient domain representation of HOA signals a mixed spatial/coefficient domain representation of said HOA signals
CN103701825A (zh) * 2013-12-31 2014-04-02 工业和信息化部电子第五研究所 面向移动智能终端IPv6协议及其应用的安全测试系统
CN105207978B (zh) * 2014-06-24 2018-12-07 华为技术有限公司 一种消息鉴别方法及电子设备
CN105681364B (zh) * 2016-04-11 2019-02-05 清华大学 一种基于增强绑定的IPv6移动终端抗攻击方法
US11336683B2 (en) * 2019-10-16 2022-05-17 Citrix Systems, Inc. Systems and methods for preventing replay attacks

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030211842A1 (en) * 2002-02-19 2003-11-13 James Kempf Securing binding update using address based keys
CN1697548A (zh) * 2004-05-14 2005-11-16 华为技术有限公司 一种移动IPv6节点远程动态配置家乡地址的方法
CN101001261A (zh) * 2006-01-09 2007-07-18 华为技术有限公司 一种MIPv6移动节点的通信方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1158742A1 (en) * 2000-05-24 2001-11-28 Motorola, Inc. Communication system and method therefor
US7552234B2 (en) * 2003-02-11 2009-06-23 Cisco Technology, Inc. Arrangement for establishing a bidirectional tunnel between a mobile router and a correspondent node
US7793098B2 (en) * 2003-05-20 2010-09-07 Nokia Corporation Providing privacy to nodes using mobile IPv6 with route optimization
KR100918440B1 (ko) * 2004-11-12 2009-09-24 삼성전자주식회사 가상 사설망에서 게이트웨이의 ip 주소를 이용한 이동 단말의 통신 방법 및 장치

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030211842A1 (en) * 2002-02-19 2003-11-13 James Kempf Securing binding update using address based keys
CN1697548A (zh) * 2004-05-14 2005-11-16 华为技术有限公司 一种移动IPv6节点远程动态配置家乡地址的方法
CN101001261A (zh) * 2006-01-09 2007-07-18 华为技术有限公司 一种MIPv6移动节点的通信方法

Also Published As

Publication number Publication date
EP2056520A4 (en) 2010-06-02
ATE533252T1 (de) 2011-11-15
PL2056520T3 (pl) 2012-03-30
ES2374317T3 (es) 2012-02-15
EP2056520A1 (en) 2009-05-06
US20090213797A1 (en) 2009-08-27
EP2056520B9 (en) 2012-03-21
CN101136905B (zh) 2010-09-08
CN101136905A (zh) 2008-03-05
EP2056520B1 (en) 2011-11-09

Similar Documents

Publication Publication Date Title
WO2008025270A1 (fr) Procédé pour une mise à jour de liaison dans le système mobile ipv6 et système de communication mobile ipv6
US8437345B2 (en) Terminal and communication system
WO2007079628A1 (fr) Procédé de communication pour les noeuds mobiles mipv6
JP4917596B2 (ja) 対応ノードとセッション中にある移動ノードへの匿名性の提供
JP5102372B2 (ja) 通信ネットワークにおいて使用する方法および装置
US8432924B2 (en) Routing optimization method and message transmission system based on proxy mobile agent
CN101965722A (zh) 安全性关联的重新建立
JP2009528735A (ja) ロケーションプライバシをサポートする経路最適化
WO2008025269A1 (fr) Procédé, système, nœud mobile, nœud de communication et agent d'origine pour une communication dans des réseaux mobiles ipv6
US8514777B1 (en) Method and apparatus for protecting location privacy of a mobile device in a wireless communications network
KR100522600B1 (ko) 모바일 노드와의 접속을 제공하는 라우터 및 그 라우팅 방법
CN102474712B (zh) 用于移动ip路由优化的方法和系统
US8750303B2 (en) Mobility signaling delegation
US20100303233A1 (en) Packet transmitting and receiving apparatus and packet transmitting and receiving method
EP2210434B1 (en) Method and apparatuses for generating an ip address for use by the mobile host in a proxy mobile ip communications network
CN102484659A (zh) 用于生成移动ip网络中密码生成地址的方法和网络节点
Chen et al. An efficient MIPv6 return routability scheme based on geometric computing
CN101208931B (zh) 给与通信节点会话的移动节点提供匿名性
Maekawa et al. An enhanced location privacy framework with mobility using host identity protocol
JP5193797B2 (ja) 移動通信ネットワークシステム、ホームエージェント、アクセスゲートウェイ及び相手ノード
Baek et al. FI-Based Local Group Key Generation/Distribution for Mobile Multicast in a Hierarchical Mobile IPv6Network
Nguyen et al. State of the art of mobility protocols

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 07764283

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2007764283

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: RU