Cryptographically generated addresses using backward key chain for secure route optimization in mobile internet protocol
AssigneeTelefonaktiebolaget LM Ericsson (publ)
InventorAngelo Rossi
Life of this patent
Estimating the term…
Abstract
Enhanced cryptographically generated addresses (ECGA) for MIPv6 incorporate a built-in backward key chain. The backward key chain prevents time-memory attacks to discover a network address and helps prevent spoofing a network address of a mobile node. The backward key chain also provides a means to authenticate network addresses of a mobile node.
Claims14
A method implemented in a mobile node of generating a network address for communicating over an Internet Protocol (IP) network, the method comprising:
- generating a backward key chain containing a plurality of backward keys;
- generating a home address from a first backward key in said backward key chain;
- and
- generating a care-of address from a second backward key in said backward key chain preceding the first backward key to logically link said care-of address with said home address;
- and
- communicating with another network node over the communication network using the care-of address while the mobile node is in a visited network;
- and
- generating a second care-of address of the mobile node from a third backward key in said backward key chain preceding the second backward key to logically link said second care-of address with said home address;
- and
- discarding the first care-of address;
- and
- communicating with another network node over the communication network using the second care-of address while the mobile node is in a visited network;
- and
- wherein generating a backward key chain comprises recursively hashing a secret key to generate a series of backward keys.
A network node in a communication network for generating a network address for communicating over an Internet Protocol (IP) network, said network node comprising:
- a network interface for communicating with other nodes over the communication network;
- a processor circuit connected to the network interface and configured to:
- generate a backward key chain containing a plurality of backward keys;
- generate a home address from a first backward key in said backward key chain;
- and
- generate a care-of address from a second backward key in said backward key chain preceding the first backward key to logically link said care-of address with said home address;
- and
- communicate with another network node over the communication network using the care-of address while the network node is in a visited network;
- and
- generate a second care-of address of the mobile node from a third backward key in said backward key chain preceding the second backward key to logically link said second care-of address with said home address;
- and
- discard the first care-of address;
- and
- communicate with another network node over the communication network using the second care-of address while the mobile node is in a visited network;
- and
- wherein the processor circuit generates a backward key chain by recursively hashing a secret key to generate a series of backward keys.
A method implemented by a network node of authenticating network addresses of a mobile node, said method comprising:
- receiving a first network address generated from a first key in a backward key chain;
- receiving a second network address generated from a second key in the backward key chain preceding the first key;
- and
- authenticating the first and second network addresses by verifying that the first and second keys belong to the same backward key chain;
- and
- wherein the first network address comprises a home address for the mobile node and the second network address comprises a care-of address for the mobile node;
- and
- wherein generating a backward key chain comprises recursively hashing a secret key to generate a series of backward keys.
A network node in a communication network for authenticating network addresses of a mobile node used for communicating over the communication network, said network node comprising:
- a network interface for communicating with other nodes over the communication network;
- a processor circuit connected to the network interface and configured to:
- receive a first network address generated from a first key in a backward key chain;
- receive a second network address generated from a second key in the backward key chain preceding the first key;
- and
- authenticate the first and second network addresses by verifying that the first and second keys belong to the same backward key chain;
- and
- wherein the first network address comprises a home address for the mobile node and the second network address comprises a care-of address for the mobile node;
- and
- wherein the processor circuit generates a backward key chain by recursively hashing a secret key to generate a series of backward keys.
Dependencies are inferred from the claim text.