Abstract: Methods and apparatus for providing a centralized source of session keys to be shared by a Home Agent and a Mobile Node are disclosed. In accordance with one aspect of the invention, a Mobile Node registers with a Home Agent supporting Mobile IP by sending a registration request to the Home Agent. The Home Agent sends a request message (e.g., access-request message) to a AAA server, the request message identifying the Mobile Node. The AAA server then derives key information from a key or password associated with the Mobile Node. The AAA server then sends a reply message (e.g., access-reply message) to the Home Agent, the reply message including the key information associated with the Mobile Node, thereby enabling the Home Agent to derive a shared key to be shared between the Mobile Node and the Home Agent from the key information. The Home Agent derives a key from the key information, the key being a shared key between the Mobile Node and the Home Agent. A registration reply is then sent to the Mobile Node.

Abstract: Methods and apparatus for implementing proxy Mobile IP in a system implementing multiple VLANs are disclosed. Specifically, a network device such as an Access Point or Foreign Agent supports multiple VLANs on a plurality of interfaces. In addition, the network device implements proxy Mobile IP on at least one interface. The network device ascertains a subnet map of a node, where the subnet map corresponds to a VLAN. It then identifies a Home Agent associated with the subnet map or VLAN via which to register the node. The network device then composes a registration request on behalf of the node, where the registration request identifies the node (e.g., IP address) and includes a Home Agent address associated with the Home Agent. The registration request also directly or indirectly indicates the interface corresponding to the VLAN via which data packets are to be routed. The registration request is then sent on behalf of the node.

Abstract: Methods and apparatus for establishing an optimized route between a Mobile Node and a Correspondent Node are disclosed. In particular, a Correspondent Node is notified of the location of a Mobile Node, thereby enabling the Correspondent Node to communicate directly with the Mobile Node. This is accomplished by sending a HOTi message protected in IPSec transport mode from the Mobile Node to a Home Agent associated with the Mobile Node for modification and transmission of a modified HOTi message to the Correspondent Node. The Mobile Node then receives a HOT message protected in IPSec transport mode from the Home Agent associated with the Mobile Node, the HOT message being received from the Home Agent associated with the Mobile Node after modification has been performed by the Home Agent on an initial HOT message received by the Home Agent from the Correspondent Node.

Abstract: Methods and apparatus for performing optimizations for a mobile network device such as a Mobile Node or Mobile Router supporting multiple links to a Home Agent (or Correspondent Node in a Mobile IPv6 environment) are disclosed. During the registration process, link characteristics are transmitted in the registration request. From the link characteristics, it is possible to determine whether the mobile network device has roamed from a high to a low bandwidth link, or vice versa. A first set of optimizations may be performed when the mobile network device has roamed from a high to a low bandwidth link, while a second set of optimizations may be performed when the mobile network device has roamed from a low to a high bandwidth link. Some optimizations may be performed during the establishment of a TCP session, while others may be performed during or upon completion of the Mobile IP registration process.

Abstract: Methods and apparatus for optimizing Mobile VPN communications are disclosed. When a data packet is transmitted between a Mobile Node that is a member of a VPN and a Correspondent Node, the data packet is transmitted between the Mobile Node and a Home Agent via a Mobile IP tunnel without transmitting the data packet via a VPN tunnel. However, the data packet is transmitted between the Home Agent and a VPN headend via a VPN tunnel.

Abstract: Methods and apparatus for establishing an optimized route between a Mobile Node and a Correspondent Node are disclosed. In particular, a Correspondent Node is notified of the location of a Mobile Node, thereby enabling the Correspondent Node to communicate directly with the Mobile Node. This is accomplished by sending a HOTi message protected in IPSec transport mode from the Mobile Node to a Home Agent associated with the Mobile Node for modification and transmission of a modified HOTi message to the Correspondent Node. The Mobile Node then receives a HOT message protected in IPSec transport mode from the Home Agent associated with the Mobile Node, the HOT message being received from the Home Agent associated with the Mobile Node after modification has been performed by the Home Agent on an initial HOT message received by the Home Agent from the Correspondent Node.

Abstract: Methods and apparatus for performing registration on behalf of a session associated with a mobile node are disclosed. The mobile node composes a registration request including a NAI identifying a userID and a sub-NAI that uniquely identifies a session associated with the NAI. The mobile node then sends the registration request. When the Home Agent authenticates the mobile node, the Home Agent returns an IP address associated with the session. The NAI and sub-NAI may then be mapped to this IP address in a mobility binding table associated with the Home Agent as well as a visitor table associated with the Foreign Agent to which the mobile node has roamed.

Abstract: A data communication system 10 is provided that allow for the efficient management of data communication sessions requested from a plurality of packet data servicing nodes (22-28) which are organized in a cluster 32, each member of the cluster 32 manages a cluster session table which contains data identifying mobile units 12 and packet data servicing nodes (22-28) which are servicing data sessions with the mobile unit 12. As a mobile unit 12 moves from one portion of the system 10 to another, a network element such as a base station controller 40 will request a data session from a packet data servicing node 28, the packet data servicing node 28 is then able to access the cluster session table to determine if the data session is already being served by another member of the cluster 32. If the data session is already in existence, the base station controller 40 will be directed to request a data session from the packet data servicing node 32 which is already servicing that session.

Abstract: Methods and apparatus for supporting a session in Mobile IP are disclosed. A Mobile Node sends a first Mobile IP message identifying the Mobile Node to a Home Agent, wherein the first Mobile IP message indicates to the Home Agent that the Mobile Node is requesting dynamic configuration of a Mobile-Home authentication key to be shared between the Mobile Node and the Home Agent during the session. A Mobile-Home authentication key to be shared between the Home Agent and the Mobile Node is obtained or generated by the Mobile Node and the Home Agent, where the Mobile-Home authentication key is not valid after the session has ended or during another session. The Home Agent allocates a home address to the Mobile Node for the session.

Abstract: Methods and apparatus for enabling a Mobile Node supporting mobile IP to roam without an assigned IP address and receive lookups indicating that a Corresponding Node wants to send information to the Mobile Node are disclosed. A name lookup may be sent from a Corresponding Node to a Home Agent that has previously registered the Mobile Node. The name lookup may be sent through an intermediate device, including a Domain Name Server, such that the intermediate device contacts the Home Agent. During the name lookup process, an IP address is allocated to the Mobile Node and a data path is established between the Home Agent and the Mobile Node via a Foreign Agent. When the lookup is completed successfully, the Home Agent sends the IP address allocated to the Mobile Node in the name lookup process to the device requesting the lookup. The IP address of the Mobile Node may then be used by the Corresponding Node to “push” information to the Mobile Node.

Abstract: Methods and apparatus for performing proxy registration on behalf of a node with a Home Agent supporting Mobile IP are disclosed. A first registration request is composed on behalf of the node and transmitted to the Home Agent via a first Local Mobility Anchor, wherein the first Local Mobility Anchor is a regional controller via which registration is performed when the node moves within a region associated with the first Local Mobility Anchor. When the node moves within a region or between regions, the node is re-registered. Specifically, a second registration request is composed and transmitted to the first Local Mobility Anchor when the node moves within the region associated with the first Local Mobility Anchor.

Abstract: Methods and apparatus for providing a centralized source of session keys to be shared by a Home Agent and a Mobile Node are disclosed. In accordance with one aspect of the invention, a Mobile Node registers with a Home Agent supporting Mobile IP by sending a registration request to the Home Agent. The Home Agent sends a request message (e.g., access-request message) to a AAA server, the request message identifying the Mobile Node. The AAA server then derives key information from a key or password associated with the Mobile Node. The AAA server then sends a reply message (e.g., access-reply message) to the Home Agent, the reply message including the key information associated with the Mobile Node, thereby enabling the Home Agent to derive a shared key to be shared between the Mobile Node and the Home Agent from the key information. The Home Agent derives a key from the key information, the key being a shared key between the Mobile Node and the Home Agent. A registration reply is then sent to the Mobile Node.

Abstract: An invention is disclosed that enables proxy Mobile IP registration to be performed in a secure manner. Various security mechanisms may be used independently, or in combination with one another, to authenticate the identity of a node during the registration process. First, an Access Point receiving a packet from a node verifies that the source MAC address identified in the packet is in the Access Point's client association table. In addition, as a second mechanism, the Access Point ensures that a one-to-one mapping exists for the source MAC address and source IP address identified in the packet in a mapping table maintained by the Access Point. As a third mechanism, a binding is not modified in the mobility binding table maintained by the Home Agent unless there is a one-to-one mapping in the mobility binding table between the source MAC address and the source IP address.

Abstract: Disclosed is a location management method for a communication network. In a first embodiment, a procedure for finding an optimal path between a calling switch and a visiting switch node is integrated in the call set up procedure. The connection set up procedure starts by setting up a connection path between the calling switch and the home switch. Then, an “optimal crossover node” is determined along the connection path and then the connection path is cranked back starting from the home switch and moving towards the optimal crossover node. Once the optimal crossover node is reached, the a connection set-up proceeds to set up a connection between the optimal crossover node and the visiting switch. In an alternative embodiment, first a connection is set up between the calling switch and the home switch. Then the connection is extended to the visiting switch either by the call-forwarding or by two-phase crankback method. This results in a quickly routed, but sub-optimal connection.

Abstract: A facility is provided in which an ATM switch may operate as a switch in the provision of connection oriented services and operates as a router in the provision of connectionless services. In the router mode, the ATM switch may determine "on the fly" a route which may be used to forward received data cells to an intended destination and then forwards each of the data cells in sequence over the determined route. In the switch mode, the ATM switch operates conventionally and forwards a received data cell over a previously defined switched virtual path. In certain cases, the ATM switch may operate as a router only.