Methods and systems for secure mobile-IP traffic traversing network address translation

A mobile node comprising:

• a communication interface;
• a processor;
• and
• data storage having stored therein program instructions executable by the processor to:
• establish a virtual-private-network (VPN) tunnel extending between the mobile node and a Mobile IP home agent, wherein establishing the VPN tunnel comprises communicating with the home agent at a public address of the home agent via a private network, a network-address-translation (NAT) device, and a public network, wherein the home agent comprises a VPN function co-located at the home agent's public address, and wherein establishing the VPN tunnel further comprises the home agent assigning the mobile node a first public address for the mobile node to use in communicating with the home agent via the VPN tunnel;
• register with the home agent, wherein registering with the home agent comprises communicating via the VPN tunnel with the home agent at the public address of the home agent, and wherein registering with the home agent further comprises establishing the first public address as a Mobile IP home address for the mobile node;
• and
• exchange packets with the home agent inside the VPN tunnel, wherein the packets are encrypted according to the VPN tunnel and encapsulated with a transport header and an outer header, wherein the encrypted packets are not modifiable by the NAT device, wherein the transport header and the outer header are modifiable by the NAT device, and wherein the encrypted packets do not include separate IP headers for (i) the VPN tunnel and (ii) Mobile IP communication.

A Mobile IP home agent comprising:

• a VPN function co-located at a public address of the home agent;
• a communication interface associated with the public address of the home agent;
• a processor;
• and
• data storage having stored therein program instructions executable by the processor to:
• establish a virtual-private-network (VPN) tunnel extending between a mobile node and the home agent, wherein establishing the VPN tunnel comprises communicating with the mobile node via a public network, a network-address-translation (NAT) device, and a private network, and wherein establishing the VPN tunnel further comprises assigning the mobile node a first public address for the mobile node to use in communicating with the home agent via the VPN tunnel;
• register the mobile node with the home agent, wherein registering the mobile node comprises communicating via the VPN tunnel with the mobile node, and wherein registering the mobile node further comprises establishing the first public address as a Mobile IP home address for the mobile node;
• and
• exchange packets with the mobile node inside the VPN tunnel, wherein the packets are encrypted according to the VPN tunnel and encapsulated with a transport header and an outer header, wherein the encrypted packets are not modifiable by the NAT device, wherein the transport header and the outer header are modifiable by the NAT device, and wherein the encrypted packets do not include separate IP headers for (i) the VPN tunnel and (ii) Mobile IP communication.