KR100737140B1 - Internet protocol virtual private network service processing apparatus and method in mobile communication - Google Patents

Abstract

 The present invention relates to an apparatus and method for processing an Internet protocol virtual private network service in a mobile communication. The present invention relates to an Internet security protocol that provides authentication, reliability, and integrity for a packet by encrypting transmission data for a temporary private network service in a mobile communication. protocol, IPSec) and mobile Internet protocol to support mobility of mobile terminal, and tunneling is performed by multi protocol label switching (MPLS) exchange instead of network tunneling between home agent and external agent. By doing so, high-speed packet routing can be achieved.

IPSec protocol, mobile IP, intranet, base station, mobile terminal, virtual private network, multiprotocol label switching (MPLS)

Description

Internet protocol virtual private network service processing apparatus and method in mobile communication {THE PROCESSING APPARATUS AND METHOD FOR PROVIDING INTERNET PROTOCOL VIRTUAL PRIVATE NETWORK SERVICE ON MOBILE COMMUNICATION}             

1 is a block diagram showing the configuration of an apparatus for processing an internet protocol virtual private network service in a mobile communication of the present invention.

2 is a flowchart illustrating a mobile IP registration and tunnel formation process for processing a virtual private network service according to the present invention.

3 is an exemplary view illustrating a flow of mobile IP registration and tunnel setup according to the present invention;

4 is an exemplary view showing an intranet connection flow according to the present invention.

5 is a flowchart illustrating a datagram transmission process according to the present invention.

6 is a flowchart illustrating a datagram transmission process during FA movement according to the present invention.

7 is a flowchart illustrating a datagram transmission process when a GFA moves according to the present invention.

********** Symbol description of the main parts of the drawing **********

11: mobile terminal 12: base station (or AP, Access Point)

13: Service virtual private network support node / external agent (SVSN / FA)                 

14: Gateway Virtual Private Network Support Node / Gateway External Agent (GVSN / GFA)

15: Gateway virtual private network support node / home agent (GVSN / HA)

16: Intranet server 17: Correspond Node

The present invention relates to an apparatus and method for processing an internet protocol virtual private network service in a mobile communication, and more particularly, to an Internet security protocol (IP) that provides authentication, reliability, and integrity of a packet by encrypting transmission data for a virtual private network service in a mobile communication. Mobile Internet protocol is used to support mobile terminal mobility along with security protocol (IPSec), and tunneling is performed by multi-protocol label switching (MPLS) exchange instead of network tunneling between home agent and external agent. An apparatus and a method for enabling high speed packet routing by performing the same.

In general, in the conventional mobile communication, the virtual private network service processing method is provided with IPSec in the mobile terminal, which provides a service, which performs end-to-end authentication along with a network address translation (NAT) that changes a private address into a public address. In case of use, there is a disadvantage that data authentication cannot be performed due to violation of data integrity provided by Authentication Header (AH) protocol, and it does not support mobility of mobile terminal properly. There was a problem in providing a virtual private network service using a bay.

Accordingly, the present invention has been made to solve the problems of the prior art, the Internet security protocol (IP security protocol, which provides authentication, reliability and integrity for packets by encrypting the transmission data for the provisional private network service in mobile communication) IPSec), using the mobile Internet protocol to support mobility of mobile terminals, and performing tunneling by multi-protocol label switching (MPLS) exchange instead of network-to-network tunneling between home agent and external agent. It is an object of the present invention to provide an apparatus and method for enabling high-speed packet routing.

In order to achieve the above object, the present invention provides a virtual private network service processing apparatus that provides mobile subscribers with authentication, reliability, integrity, and mobility of a mobile terminal, and provides an enterprise in a wireless network (CDMA, GSM, WLAN, etc.). A mobile terminal equipped with an Internet Security Protocol (IPSec) client software for accessing an intranet server to provide a virtual private network service; It performs routing information management, authentication and access control functions of the mobile terminal for packet data processing, assigns a care-of address to the mobile terminal in the visited network, and originally belongs to the mobile terminal to communicate in another subnet. A service virtual private network support node / external agent (SVSN / FA) that allows access to its own subnet; It is a virtual private network gateway that takes charge of the logical interface with the external packet switching network, performs a network address translation (NAT) function to change the private address to the public address, routing information for the mobile terminal and IPSec tunneling, and the mobile terminal and the external agent ( A gateway virtual private network support node / gateway foreign agent (GVSN / GFA) that manages a temporary address list allocated by the FA); It is a VPN gateway, which handles logical interface with external packet switching network, and manages routing information for multi-protocol label switching (MPLS) tunneling with GVSN / GFA, and manages mobile terminal and temporary address list assigned by GFA. A gateway virtual private network support node / home agent (GVSN / HA) that maintains mobility binding (Mobility Binding), which is an address of a mobile terminal and a GFA address pair, is configured.

In the method of the present invention, when a new mobile terminal arrives at the wireless network, the wireless information of the mobile terminal is broadcasted, and when the mobile terminal moves to the visited network, mobile IP registration is performed to the home agent HA. And establishing an SA after establishing security association (SA) negotiation and key exchange between the mobile terminal and the GVSN / GFA to form a virtual private network, and establishing an MPLS tunnel between the GVSN / GFA and the GVSN / HA; In the mobile IP registration process, when the mobile station moves to the external agent (FA) from the same visited network, the mobile IP internal registration is performed to the GVSN / GFA, and SA negotiation and key exchange between the mobile terminal and the GVSN / GFA are performed. Setting up; The mobile terminal accessing the intranet through an Internet Security Protocol (IPSec), an MPLS virtual private network; Providing a packet data service between an IPSec virtual private network between the requesting mobile terminal and the GVSN / GFA and an MPLS virtual private network between the GVSN / GFA and the GVSN / HA between the requesting mobile terminal and the GVSN / GFA; A first routing optimization step of optimizing routing through IPSec and MPLS virtual private networks when the mobile station moves from the same visited network to another FA; When the mobile terminal moves to another GFA, it characterized in that the second routing optimization step for optimizing the routing through the IPSec and MPLS virtual private network.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the configuration of the Internet protocol virtual private network service processing apparatus in the mobile communication of the present invention, as shown in the figure so that the wireless network (CDMA, GSM, WLAN, etc.) can be connected to the intranet server in the enterprise A mobile terminal (11, 17) for providing a virtual private network service with an Internet security protocol (IPSec) client software; A base station (Access Point, 12) fixed to a ground and opened in a land for communication with the mobile terminals (11, 17) or with a relay of a mobile relay station; Routing information management, authentication, and access control functions of a mobile terminal for packet data processing, assigning a care-of address to the mobile terminal in a visited network, and communicating with other subnets (11, 17) A service virtual private network support node / external agent (SVSN / FA, 13), which provides access to its own subnet to which it belongs; It is a virtual private network gateway that takes charge of the logical interface with the external packet switching network, performs a network address translation (NAT) function to change the private address to the public address, routing information and movement for the mobile station (11, 17) and IPSec tunneling A gateway virtual private network support node / gateway external agent (GVSN / GFA 14) managing a temporary address list allocated by the terminal and the external agent (FA); Function to manage logical interface with external packet switching network as VPN gateway, and manage routing information for multi-protocol label switching (MPLS) tunneling and temporary address list assigned by mobile stations (11, 17) and GFA with GVSN / GFA. And a gateway virtual private network support node / home agent (GVSN / HA) that maintains Mobility Binding, which is an address and GFA address pair of mobile terminals 11 and 17 to support mobility of mobile terminals 11 and 17. )Wow; An intranet server 16 for an intra-company communication network that provides services such as a homepage, an e-mail system, an electronic bulletin board, etc. by applying Internet technology is configured.

In addition, the 'mobile IP registration request' and 'mobile IP registration response' messages used in the present invention comply with the specifications of the Internet Engineering Task Force (IETF) Request for Comments (RFC) 2002 document, The 'Request Label' and 'Label Response' messages follow the specifications of the IETF RFC 3036 document, and the 'Agent Notification' message format, which determines the location of the mobile terminal is currently attached through Tables 1 to 5, and Mobile IP registration request 'message format,' Mobile IP registration response 'message format, and' label request 'and' label response 'message formats to form a tunnel are described.                     

First, as shown in [Table 1], the 'agent notification' message format is composed of type, length, sequence number, life time, flags, and temporary address. A field allowed for mobile terminals to distinguish the various extensions used for Internet Control Message Protocol (ICMP) router notifications, meaning that the FA or HA is using them in ICMP router notifications (usually in the form of mobile agent notification extensions). Is '3'), the length field depends on how many temporary addresses are reported (6 bits + 4 * N, N is the number of temporary addresses notified), and the lifetime field is the number of seconds to accept the registration request. The sequence number field is the number of 'agent notification' messages sent by the agent after initialization, and the flag field is used to inform the mobile station about the characteristics of the notification. In the 'RBHFMGVL', 'R' means Registration Required, 'B' means external agent busy (busy: will not accept registration from additional mobile terminal), and 'H' means HA service. 'F' means agent will provide FA service, 'M' means minimal encapsulation implementation (RFC 2004: tunneled datagram with minimal encapsulation), G 'means GRE encapsulation implementation (RFC 1701: Tunneled datagrams are implemented with GRE encapsulation),' V 'means van jacobson header compression implementation (RFC 1144), and' L ' 'Means local tunnel management (allow internal registration). Here, 'F' and 'H' are not mutually exclusive, 'B' bit is not set if 'F' bit is not set, and 'Agent' notification is not available even if FA is too busy to service new mobile terminal. Message is sent to the mobile station, and the FA temporary address notified in the temporary address field is provided by the FA, and if the 'F' bit is set, there must be at least one temporary address.

The 'Mobile IP Registration Request' message consists of a form, flag, lifetime, home address, home agent, temporary address, identification and extensions as shown in [Table 2]. The form field indicates a registration request. (Value is '1'), flag field is 'SBDMGV (rsv)', and 'S' is simultaneous coupling (simultaneous bindings: previous mobility coupling of mobile terminal to HA if S bit is set to '1') 'B' means broadcast datagrams (the B bit is used by the mobile station to request the broadcast datagram to the HA), and 'D' means De-capsulation by mobile node (used to decapsulate a datagram sent by a mobile station to a temporary address), and the remaining 'M' to 'V' are the same as described in Table 1 above . The lifetime field is the number of seconds before the registration expires, the home address field is the mobile station's IP address, the home agent field is the HA mobile station's IP address, and the temporary address field is the end of the tunnel. It is an IP address, and the confirmation field is a 64-bit number generated by the mobile station. It is used for registration request and registration response, that is, for replay protection. The extension field indicates that there is one or more extensions. All registration requests must include a mobile home authentication extension.

The 'Mobile IP Registration Response' message format consists of the form, code, lifetime, home address, home agent, acknowledgment and extension as shown in Table 3. The dual form field is request response (value is '3' ), The code field indicates the result of the registration request and indicates the values according to the result.

In other words, '0' means registration accepted. When registration is rejected by the FA, '66' means insufficient resources, and '69' means limited notification. advertised limited, '70' means a poorly formed request, '71' means a poorly formed reply, '88' means a home agent's inability to reach For example, when registration is rejected by HA, '130' means insufficient resources, '131' means mobile node failed authentication, and '133' means registration verification mismatch. identification mismatch, '134' means a poorly formed request, and '136' means a home agent address (unknown home agent address).

The lifetime field also indicates the number of seconds before registration expires if registration has been accepted. If '0', this indicates that the mobile station has been deregistered. Ignored The home address field is the IP address of the mobile station, the home agent field is the IP address of the mobile station HA, and the hump field is used for replay prevention security.

The 'label request' message format includes the message type, message length, message ID, forwarding equivalence classes (FEC) type length value (TLV), and optional parameters (see Table 4). The dual message type field indicates 'label request' message, the message length field indicates the length of the message, the message ID field indicates an identifier for identifying the message, and the label Combined with FEC and FEC TVL encodes the FEC item, and any parameter field includes hop count TLV, path TLV.

Finally, the 'label response' message type consists of message type, message length, message ID, FEC TLV, optional parameter and label TLV as shown in [Table 5]. If the dual message type field is '0x0400', Indicates that this is a 'label response' message, the label TLV field specifies the label component of the FEC label mapping.

Referring to the operation of the embodiment according to the present invention configured as described above are as follows.

2 is a flowchart illustrating a mobile IP registration and tunnel formation process for processing a virtual private network service according to the present invention. As shown in FIG. 2, when a mobile station 11 arrives at a new wireless network, the mobile station 11 receives a broadcast from a base station 12. Afterwards, the mobile terminal 11 transmits a 'PDP context request activation' message including an 'Access Point Name (APN)', a 'Packet Data Protocol (PDP) address' parameter, and the like to SVSN / FA. Transfer to (13).

The SVSN / FA 13 sends a 'PDP context request creation' message to the corresponding GVSN / GFA 14 with the 'APN' transmitted by the mobile terminal 11, and the 'PDP' indicates that the PDP context was successfully created. Send context response 'message to the SVSN / FA (13).

Accordingly, the SVSN / FA 13 transmits a 'PDP context acceptance activation' response message to the mobile terminal 11 that the requested PDP context has been approved, and periodically broadcasts an 'agent notification' message.

Then, when the mobile terminal 11 first moves to the registration visit network, it sends a 'mobile IP registration request' message to the SVSN / FA 13 and then forwards a 'mobile IP registration request' message to the GVSN / GFA 14. (forwarding)

If the temporary address obtained from the FA is a non-routable address, the GVSN / GFA 14 loses connectivity with the home network. Therefore, the GVSN / GFA 14 converts the address into a routable address through the NAT, and requests the mobile IP registration to the HA in the home network. 'Register the HA with the IP address of the mobile terminal 11 and the address of the GFA by sending a message. The HA then forwards a 'mobile IP registration response' message to the GVSN / GFA 14 that the mobile IP registration has been successfully performed, and the SVSN / FA 13 receiving the 'mobile IP registration response' message transmits to the mobile terminal 11. Forwards the mobile IP registration procedure.

Subsequently, the mobile station 11 performs SA setup and SA exchange to form an IPSec tunnel between the GVSN / GFA 14 using the IPSec and MPLS protocols to form a virtual private network. And the key exchange process, when the mobile terminal 11 transmits a random number, its identifier, and a Diffie-Hellman public value to the GVSN / GFA 14 together with the SA, the mobile terminal 11 transmits the GVSN / GFA 14 to the mobile terminal. Authenticated with the identifier of (11), and the mobile terminal 11 transmits the signed value and the Diffie-Hellman public value signed by the SA selected from the SA and the mobile terminal 11 selected from the SA, and the mobile terminal 11 The identity of this GVSN / GFA 14 is verified. After the SA setup process, if the mobile station 11 transmits a random number together with the hash and the suggestions to the GVSN / GFA 14, the GVSN / GFA 14 checks the random number transmitted by the mobile station 11 for confirmation. When the hash is obtained and its own random number is generated and transmitted, the mobile terminal 11 transmits the hash values of the two random numbers to the GVSN / GFA 14 to know the mobile terminal 11 and both random values, and the two random numbers. SA is a hash of the combined values of the protocols sent by the Security Parameter Index (SPI) and the mobile terminal included in the Internet Security Association & Key Management Protocol (ISAKMP) header for the communication parties to authenticate each other and exchange cryptographic keys. Negotiate and regenerate the key for the IPSec virtual private network using the derived key obtained during the negotiation and key exchange process. (The SA is a security negotiation between the sender and the receiver before providing the virtual private network in IP. Is a set of parameters that define the delirium and mechanism).

Then, the GVSN / HA 15 transmits a 'label request' message to the GVSN / GFA 14 to form a tunnel, and the GVSN / GFA 14 receives a 'label request' message and assigns a label. Thereafter, the GVSN / HA 15 transmits a 'label response' message.

3 is an exemplary view illustrating a flow of internal IP registration and tunnel setup according to the present invention. As shown in FIG. 3, when the mobile terminal 11 arrives at a new wireless network, the mobile station 11 receives the radio information from the base station 12. When the 'PDP context request activation' message including the 'APN', 'PDP address request' parameter, etc. is transmitted to the SVSN / FA 13, the SVSN / FA 13 transmits the 'APN' transmitted by the mobile terminal 11. And sends a 'PDP Context Request' message to the corresponding GVSN / GFA (14).

Subsequently, when the 'PDP context response creation' message indicating that the PDP creation was successfully generated from the GVSN / GFA 14 is transmitted to the SVSN / FA 13, the SVSN / FA 13 requests the mobile terminal 11 to create the PDP. It sends a 'Activate PDP Authorization' response message that it has been approved, and periodically broadcasts an 'Agent Notification' message.

When the mobile station 11 moves between FAs in the same visited network, the GVSN / GFA 14 transmits a 'mobile IP internal registration request' message to the SVSN / FA 13 and, accordingly, the SVSN / FA 13 Forwards the GVSN / GFA 14 to register the IP address of the mobile station 11 and the FA address with the GFA. Thereafter, the GVSN / GFA 14 transmits a 'mobile IP internal registration response' message to the SVSN / FA 13 indicating that the mobile IP internal registration has been successfully performed. Accordingly, the SVSN / FA 13 transmits the mobile terminal 11 to the mobile terminal 11. ) By forwarding the message 'Mobile IP internal registration response' to the mobile IP internal registration process.

If the temporary address obtained from the FA is a non-routable address, the connection with the home network is lost. Therefore, the IPSec is converted to a routable address through 'NAT' to perform an internal IP registration process, and then to form a virtual private network. Using the protocol, the mobile station 11 performs the SA setup process after SA negotiation and key exchange to form an IPSec tunnel between the GVSN / GFA 14. In this SA negotiation and key exchange process, when the mobile station 11 transmits a random number, its identifier, and a Diffie-Hellman public value to the GVSN / GFA 14 together with the SA, the GVSN / GFA 14 uses the identifier of the mobile terminal. The mobile terminal 11 verifies the identity of the GVSN / GFA 14 by transmitting the signed value and the Diffie-Hellman public value signed by the selected SA and the random number transmitted by the mobile terminal among those presented by the SA. Do it.

In addition, the SA setup process sends a random number to the GVSN / GFA 14 along with the hash and suggestions, and the GVSN / GFA 14 obtains a hash of the random number transmitted by the mobile terminal for confirmation. When the random number is generated and transmitted, the mobile terminal 11 transmits the hash values of the two random numbers to the GVSN / GFA 14 so that the mobile terminal 11 and the GVSN / GFA 14 both know the random numbers. Security Parameter Index (SPI) and the mobile terminal derive a hash of the combined values of protocols sent from the communication protocol (ISAKMP) header for communication parties to authenticate and exchange cryptographic keys. Negotiate and regenerate the key for the IPSec virtual private network.                     

The format of the 'mobile IP internal registration request' message and the 'mobile IP internal registration response' message are shown in [Table 6] and [Table 7], respectively. As shown, the form, length, GFA IP address and extension, the form field is a mobile IP internal registration request, the length field is determined according to the GFA address, the GFA IP field indicates the IP address of the GFA, The extension field means that there is one or more extensions.

In addition, the 'mobile IP internal registration response' message format includes a form, a length, an anti-security security style and an initial identifier as shown in [Table 7]. The anti-security security style field includes a response desired by the mobile terminal 11. A number indicating the type of protection, and the initial identifier field is a timer-stamp or random number used for initial synchronization for the response process.

4 is an exemplary diagram illustrating an intranet access flow according to the present invention. As shown in FIG. 4, when the mobile terminal 11 accesses a virtual private network with the GVSN / GFA 14 through a preconfigured IPSec tunnel through SA negotiation, the GVSN / The GFA 14 determines whether the mobile terminal 11 is connected from the home network or from an external network. If the mobile terminal is connected from the home network as a result of the determination, the GFA 14 immediately attempts to connect to the intranet. In this case, an MPLS virtual private network connection is made through a pre-formed MPLS tunnel between the GVSN / GFA 14 and the GVSN / HA 15, and then an intranet is attempted.

5 is a flowchart illustrating a datagram transmission process according to the present invention. As shown therein, an IPSec between a mobile terminal 11, an SVSN / FA 13, a GVSN / GFA 14, and a GVSN / HA 14 is illustrated. In order to transmit the datagram to the mobile station 11 while the tunnel is formed through the MPLS protocol, the IPSec tunneled datagram is first transmitted to determine the current position of the mobile station 11 and the GVSN is performed. After detuning the IPSec tunneled datagram, / HA (15) retrieves the mobility association consisting of the GFA temporary address and the mobile station (11) IP address and MPLS tunneled to the currently located GVSN / GFA (14) Send the datagram. After receiving the MPLS tunneled datagram, the GVSN / GFA 14 detunates the MPLS tunneled datagram, and then searches for a mobile combination composed of the FA temporary address and the IP address of the mobile terminal 11 and then the mobile terminal 11. The IPSec tunneled datagram is transmitted to the SVSN / FA 13 which is located, and the SVSN / FA 13 locates the current mobile terminal 11 through paging and moves the IPSec tunneled datagram. Send to the terminal (11).

FIG. 6 is a flowchart illustrating a datagram transmission process during FA movement according to the present invention. As shown therein, a mobile terminal 11, an SVSN / FA 13, a GVSN / GFA 14, and a GVSN / HA 15 are illustrated in FIG. When the mobile station 17 transmits the datagram to the mobile station 11 while the tunnel is formed through the IPSec and MPLS protocols, the IPSec tunneled datagram is first transmitted to the GVSN / HA 15. 15, after detuning the IPSec tunneled datagram, the MPLS tunneled datagram is transmitted to the GVSN / GFA 14, and the GVSN / GFA 14 detunates the MPLS tunneled datagram to IPSec tunneled. The datagram is sent to the SVSN / FA 13. At this time, the previous SVSN / FA which detects that the mobile terminal 11 has moved to another SVSN / FA in the same visited network forwards the IPSec tunneled datagram to the moved SVSN / FA, and the previous SVSN / FA is GVSN / GFA. It transmits a 'binding update' message, which is a message that the mobility coupling has been changed, to the 14, and transmits an IPSec tunneled datagram to the mobile terminal 11.

Receiving the 'Binding Update' message, the GVSN / GFA 14 updates the mobility association consisting of the FA temporary address and the address of the mobile terminal 11, and the IPSec tunnel between the mobile terminal 11 and the GVSN / GFA 14. After SA negotiation and key exchange are performed to form the SA, a process of establishing an SA is performed to newly form a tunnel between the mobile station 11 and the GVSN / GFA 14. Thereafter, when the mobile station 17 transmits the IPSec tunneled datagram to the GVSN / HA 15, the GVSN / HA 15 detunels the IPSec tunneled datagram and then sends an MPLS tunnel to the GVSN / GFA 14. GVSN / GFA 14 detunnels the MPLS tunneled datagram, retrieves the mobility association, and sends the IPSec tunneled datagram to the moved SVSN / FA. 13) forwards the IPSec tunneled datagram to the mobile station (11).

In the above, the 'binding update' message follows the standard of the IETF RFC 3031 document, and the message format is as shown in [Table 8].

That is, it consists of form, flag, lifetime, home address, temporary address, identifier, and extension. The form field means binding update (value is' 18 '), and the frag field is composed of' AIMG 'and double' A 'bit is set by the node sending a' bind update 'message to request binding confirmation,' I 'bit is set by the node sending a' bind update 'message if present in the identifier field,' M 'bit If set, means implementation with minimal encapsulation. If the 'G' bit is set, implementation means implementation with GRE encapsulation. The lifetime field indicates the time remaining in seconds before the binding cache entry expires. If the value is '0', it means that it is not in the binding cache list for the mobile terminal 11, and the home address field is The IP address of the mobile terminal associated with the binding update, the temporary address field is the current temporary address of the mobile terminal, and the identifier field is used for replay security.                     

7 is a flowchart illustrating a datagram transmission process when a GFA moves according to the present invention. As shown in FIG. 7, a mobile terminal 11, an SVSN / FA 13, a GVSN / GFA 14, and a GVSN / HA 15 are illustrated. When the mobile station 17 transmits the datagram to the mobile station 11 while the tunnel is formed through the IPSec and MPLS protocols, the IPSec tunneled datagram is first transmitted to the GVSN / HA 15. (15) transmits the MPLS tunneled datagram to the GVSN / GFA 14 after detuning the IPSec tunneled datagram, where the mobile terminal 11 detects that the mobile terminal 11 has moved to another GVSN / GFA. The GVSN / GFA forwards the MPLS tunneled datagram to the moved GVSN / GFA, the previous GVSN / GFA sends a 'bind update' message to the GVSN / HA (15) that the mobility binding has changed, and the moved GVSN / GFA Search for the appropriate SVSN / FA (13) to detunnel the MPLS tunneled datagram, and then The emitter sends a gram. Receiving the IPSec tunneled datagram, the SVSN / FA 13 forwards the IPSec tunneled datagram to the mobile station 11, while the former GVSN / GFA is composed of the GFA temporary address and the mobile station 11's address. Receiving a 'bind update' message to update the binding, the GVSN / HA 15 updates the mobility binding composed of the GFA temporary address and the mobile station's address, sends a 'Request Label' message to the moved GVSN / GFA, The GVSN / GFA assigns a label and transmits a 'label response' message, thereby forming a new MPLS tunnel between the GVSN / GFA 14 and the GVSN / HA 15. Afterwards, when the mobile station 17 transmits the IPSec tunneled datagram to the GVSN / HA 15, the GVSN / HA 15 receiving the IPSec tunneled datagram detunates the IPSec tunneled datagram, and newly formed. After retrieving the mobility association through the MPLS tunnel, the MPLS tunneled datagram is transmitted to the moved GVSN / GFA 14. The GVSN / GFA 14 de-tunels the MPLS tunneled data structure, and then transmits an IPSec tunneled datagram to the SVSN / FA 13, and the SVSN / FA 13 transmits an IPSec tunnel to the mobile terminal 11. Forward the datagram.

Although the invention has been particularly shown and described with reference to the preferred embodiments, those skilled in the art will appreciate that various modifications are possible without departing from the spirit and scope of the invention. Accordingly, the invention is limited only by the claims.

As described above, the apparatus and method for processing an Internet protocol virtual private network service in a mobile communication according to the present invention supports mobility of a mobile terminal using an IPSec protocol and a mobile IP, and network network tunneling between a home agent and an external agent in a mobile IP. Instead of the method, it is possible to perform fast packet routing by tunneling using MPLS label exchange.

Claims (7)

A virtual private network service processor for providing mobile subscribers with authentication, reliability, and integrity of packets and mobility of a mobile terminal, A mobile terminal equipped with an Internet Security Protocol (IPSec) client software for accessing an intranet server in an enterprise in a wireless network (CDMA, GSM, WLAN, etc.) to provide a virtual private network service; It performs routing information management, authentication and access control functions of the mobile terminal for packet data processing, assigns a care-of address to the mobile terminal in the visited network, and originally belongs to the mobile terminal to communicate in another subnet. A service virtual private network support node / external agent (SVSN / FA) that allows access to its own subnet; It is a virtual private network gateway that takes charge of the logical interface with the external packet switching network, performs a network address translation (NAT) function to change the private address to the public address, routing information for the mobile terminal and IPSec tunneling, and the mobile terminal and the external agent ( A gateway virtual private network external agent (GVSN / GFA) for managing a temporary address list allocated by the FA); It is a VPN gateway, which handles logical interface with external packet switching network, and manages routing information for multi-protocol label switching (MPLS) tunneling with GVSN / GFA, and manages mobile terminal and temporary address list assigned by GFA. Internet protocol virtual private network service in a mobile communication, comprising a gateway virtual private network support node / home agent (GVSN / HA) that maintains a mobility binding, which is an address of a mobile terminal and a GFA address pair, to support the Processing unit. A virtual private network service method for providing a mobile subscriber with authentication, reliability and integrity of a packet and mobility of a mobile terminal, When a new mobile station arrives on the wireless network, it broadcasts the wireless information of the mobile terminal, and when the mobile terminal moves to the visited network, performs mobile IP registration with the home agent (HA) and moves to form a virtual private network. Establishing a SA after negotiating a security association (SA) and key exchange between the UE and the GVSN / GFA, and establishing an MPLS tunnel between the GVSN / GFA and the GVSN / HA; When the mobile station moves a foreign agent (FA) in the same visited network during mobile IP registration process, it performs internal IP registration with the GVSN / GFA, performs SA negotiation and key exchange between the mobile station and GVSN / GFA, and then executes the SA. Setting up; The mobile terminal accessing the intranet through an Internet Security Protocol (IPSec), an MPLS virtual private network; Providing a packet data service between an IPSec virtual private network between the requesting mobile terminal and the GVSN / GFA and an MPLS virtual private network between the GVSN / GFA and the GVSN / HA between the requesting mobile terminal and the GVSN / GFA; A first routing optimization step of optimizing routing through IPSec and MPLS virtual private networks when the mobile station moves from the same visited network to another FA; And a second routing optimization step of optimizing routing through IPSec and MPLS virtual private networks when the mobile terminal moves to another GFA. The method of claim 2, wherein the mobile IP registration and tunnel setup process comprises: A first step of sending a 'mobile IP registration request' message to the HA in the home network through SVSN / FA and GVSN / GFA when the mobile station first moves to the registration visit network; Registering the IP address of the mobile station and the address of the GFA with the HA; A third step of sending a 'mobile IP registration response' message to the mobile terminal that mobile IP registration has been successfully performed from the HA through GVSN / GFA and SVSN / FA; A fourth step of performing a 'SA negotiation and key exchange' procedure to authenticate the identity between the mobile terminal and the GVSN / GFA after performing the mobile IP registration procedure; A fifth step of establishing an IPSec tunnel by setting an SA for which security protocol is to be used for data security between the mobile terminal and the GVSN / GFA; And a sixth step of performing an MPLS label exchange procedure through a 'label request' and a 'label response' message between the GVSN / GFA and the GVSN / HA to form an MPLS tunnel. How to handle virtual private network service. The method of claim 2, wherein the mobile IP internal registration and tunnel setup process comprises: A first step of sending a 'mobile IP internal registration request' message to the GVSN / GFA through the SVSN / FA when the mobile station moves between FAs in the same visited network; Registering the mobile station's IP address and a temporary address assigned by the FA to a GFA; The GVSN / GFA sends a 'mobile IP internal registration response' message to the mobile terminal via SVSN / FA indicating that mobile IP internal registration has been successfully performed; A fourth step of performing SA negotiation and key exchange procedure to authenticate the identity between the mobile terminal and the GVSN / GFA after the operation of the third step is completed; Internet protocol virtual private network in a mobile communication further comprising a fifth step of establishing an IPSec tunnel by setting an SA for which security protocol to use to secure data between the mobile terminal and the GVSN / GFA. How to handle the service. The method of claim 2, wherein the intranet connection step A first step of the mobile terminal accessing a previously formed IPSec virtual private network through SA negotiation; A second step of determining whether the mobile terminal is connected from the home network or the external network in the GVSN / GFA; A third step of immediately attempting to connect to the intranet when the second step is determined in the home network; As a result of the determination of the second step, when the mobile terminal accesses the external network, the fourth step of accessing the intranet MPLS through the pre-formed MPLS tunnel between the GVSN / GFA and the GVSN / HA and attempting to access the intranet. Internet protocol virtual private network service processing method in a mobile communication, characterized in that further comprises. The method of claim 2, wherein the first routing optimization step is A first step of the mobile terminal transmitting a 'binding update' message, which is a message that mobility coupling has been changed from SVSN / FA to GVSN / GFA for datagram transfer when another FA moves in the same visited network; Updating, by the GVSN / GFA receiving the 'binding update' message, a mobility association consisting of an FA temporary address and an address of a mobile terminal; Performing a SA setup procedure after performing SA negotiation and key exchange to form an IPSec tunnel between the mobile terminal and the GVSN / GFA; Transmitting a datagram between the counterpart mobile station and the GVSN / HA, GVSN / GFA and GVSN / FA, SVSN / FA and the mobile station by using an IPSec tunnel; And a fifth step of transmitting the datagram between the GVSN / HA and the GVSN / GFA using an MPLS tunnel. The method of claim 2, wherein the second routing optimization step is A first step of transmitting a 'bind update' message to update a mobile coupling composed of a GFA temporary address and a mobile terminal address from a previous GVSN / GFA to a GVSN / HA; A second step of updating a mobility association consisting of a GFA temporary address and an address of a mobile terminal in GVSN / HA according to the message; A third step of completing an execution of the second step and transmitting and receiving a 'label request' message and a 'label response' message to form a tunnel between the moved GVSN / HA and GVSN / GFA; Transmitting a datagram between the counterpart mobile terminal and GVSN / HA, GVSN / GFA and SVSN / FA, SVSN / FA, and the mobile terminal to a mobile terminal moved to another GFA through an IPSec tunnel; In the fourth step, when the datagram is transmitted, the GVSN / HA and the GVSN / GFA include a fifth step of transmitting the datagram using the MPLS tunnel formed in the third step. Internet protocol virtual private network service processing method.

Images