Method of reducing denial-of-service attacks and a system as well as an access router therefor

A method of validating information of a mobile node within a candidate access router discovery procedure in a mobile IP environment, said method comprising:

• generating a token by a first access router to which the mobile node was previously attached;
• sending the token from the first access router to the mobile node within a message comprising a list of candidate access routers;
• sending the token from the mobile node to a second access router as selected candidate after a handover procedure between the first and second access routers;
• sending the token within an exchange between the access routers specific to the discovery procedure from the second access router back to the first access router for verification.

A system for reducing denial-of-service attacks by malicious mobile nodes in a mobile IP environment, said system comprising:

• a plurality of access routers within the mobile IP environment, each router maintaining a cache of neighboring access routers as candidates and their associated access points;
• and
• a plurality of mobile nodes which are capable of populating the caches in response to actions initiated, wherein
• the cache is configured such that each cache entry is tagged with an identity of the action initiating mobile node having thus created the entry, and that a total number of entries that can be tagged and thus introduced into the cache by any given node is limited.

An access router for validating information of a mobile node in a mobile IP, comprising:

• generating means for generating a token;
• first sending means for sending the token to the mobile node within a message comprising a list of candidate access routers;
• second sending means for sending the token within an exchange with another access router specific to the discovery procedure to the other access router;
• and
• verification means for verifying the token.