Method and system for maintaining a secure tunnel in a packet-based communication system

An apparatus, comprising:

• tunnel establishment means for establishing a secure tunnel to a security gateway through a packet network;
• wherein the security gateway is configured to connect a first network to a second network, the first network being a public packet network and the second network being a private packet network, the security gateway is in the second network and the mobile terminal has a first address that depends on its current location in the first network and a second address that identifies the mobile terminal in the second network;
• and
• address update means for sending an update message through said secure tunnel to the security gateway when the first address changes, wherein the update message includes a new address value of the first address, and wherein the update message also includes data to be transmitted to the security gateway;
• wherein said address update means comprises means for creating an update messages including a network address translation discovery payload configured to detect a network address translation device between the mobile terminal and the security gateway.

An apparatus, comprising:

• tunnel establishment means for establishing a secure tunnel to a mobile terminal located at a first address in a first network, wherein the security gateway is in a second network and configured to connect the first network to a second network, the first network being a public packet network and the second network being a private packet network, and the mobile terminal has a second address that identifies the mobile terminal in the second network;
• identification means for identifying the secure tunnel based on the second address in a packet originated from the second network and destined for the mobile terminal;
• and
• address update means for updating the first address associated with the secure tunnel, the address update means being responsive to a message received from the mobile terminal, the message including a new value of the first address;
• wherein said address update means comprises means for creating an update messages including a network address translation discovery payload configured to detect a network address translation device between the mobile terminal and the security gateway.

A system, comprising:

• tunnel establishment means for establishing a secure tunnel between a security gateway in a second network and a mobile terminal located at a first address in a first network, wherein the first network is a public packet network and the second network is a private packet network, the security gateway is configured to connect the first network to a second network, and the mobile terminal has a second address that identifies the mobile terminal in the second network;
• detection means for detecting a change in the first address;
• first address update means, responsive to the detection means, for sending an update message to the security gateway, wherein the update message includes a new address value of the first address, and wherein the update message also includes data to be transmitted to the security gateway;
• in the security gateway, second address update means for updating the first address associated with the secure tunnel in response to the update message;
• and
• in the security gateway, identification means for identifying the secure tunnel based on the second address in a packet originated from the second network and destined for the mobile terminal;
• and
• update messages creating means for including a network address translation discovery payload configured to detect a network address translation device between the mobile terminal and the security gateway.

A computer useable storage medium having computer readable program code embodied therein to enable a mobile terminal to communicate with a security gateway in a packet-based communication system, the computer readable program code comprising:

• computer readable program code configured to cause the mobile terminal to establish a secure tunnel to a security gateway through a packet network;
• wherein the security gateway is configured to connect a first network to a second network, the first network being a public packet network and the second network being a private packet network, the security gateway is in the second network and the mobile terminal has a first address that depends on its current location in the first network and a second address that identifies the mobile terminal in the second network;
• and
• computer readable program code configured to cause the mobile terminal to send an update message through said secure tunnel to the security gateway when the first address changes, wherein the update message includes a new address value of the address, and wherein the update message also includes data to be transmitted to the security gateway;
• further comprising creating an update message including a network address translation discovery payload configured to detect a network address translation device between the mobile terminal and the security gateway.

A method, comprising:

• establishing a secure tunnel from a first network to a security gateway in a second network through a packet network;
• wherein the security gateway is configured to connect a first network to a second network, the first network is a public packet network and the second network is a private packet network, and the mobile terminal has a first address that depends on its current location in the first network and a second address that identifies the mobile terminal in the second network;
• and
• sending an update message through said secure tunnel to the security gateway when the first address changes, wherein the update message includes a new address value of the first address, and wherein the update message also includes data to be transmitted to the security gateway;
• wherein sending comprising creating an update message including a network address translation discovery payload configured to detect a network address translation device between the mobile terminal and the security gateway.

A method, comprising:

• establishing a secure tunnel from a second network to a mobile terminal located at a first address in a first network, wherein the security gateway is configured to connect the first network to a second network, the first network is a public packet network and the second network is a private packet network, and the mobile terminal has a second address that identifies the mobile terminal in the second network;
• identifying the secure tunnel based on the second address in a packet originated from the second network and destined for the mobile terminal;
• and
• updating the first address associated with the secure tunnel, in response to a message received from the mobile terminal, the message including a new value of the first address;
• further comprising creating an update message including a network address translation discovery payload configured to detect a network address translation device between the mobile terminal and the security gateway.

An apparatus, comprising:

• a control unit, configured to a memory unit including computer program code, the memory unit and the computer program code configured to, with the control unit, cause the apparatus at least to,
• establish a secure tunnel from a first network to a security gateway in a second network through a packet network, wherein the security gateway is configured to connect a first network to a second network, the first network is a public packet network and the second network is a private packet network, and the mobile terminal has a first address that depends on its current location in the first network and a second address that identifies the mobile terminal in the second network,
• identify the secure tunnel based on the second address in a packet originated from the second network and destined for the mobile terminal, and
• update the first address associated with the secure tunnel, being responsive to a message received from the mobile terminal, the message including a new value of the first address;
• and creating an update messages including a NAT-D payload configured to detect a network address translation device between the mobile terminal and the security gateway.