System and method for supporting inter-NAT-domain handoff in a VPN by associating L2TP and mobile IP

[0001] 1. Field of the Invention

[0002] The present invention relates to a system and method for supporting inter-NAT-domain (inter network address translation domain) handoff in a VPN (virtual private network) by associating L2TP (layer 2 tunneling protocol) and mobile IP (internet protocol), which can support connective handoff over NAT gateway in a VPN.

[0003] 2. Description of Related Art

[0004] In recent years, mobile communication systems tend to apply mobile IP for integrating various accessing media, such as wireless LAN, GPRS, WCDMA/cdma2000 and the like. However, for further securing various accessing media used by the users, it needs a security mechanism to protect the right of accessing a network. VPN applications also tend to access a home network, namely, Intranet sources, via a multi-tier network structure at anytime. For this requirement, it is desired to associate mobile IP and VPN to provide a user with secure and connective handoff.

[0005] The object of the present invention is to provide a system and method for supporting inter-NAT-domain handoff in a VPN by associating L2TP and mobile IP, which can package mobile IP into L2TP to thus integrate mobile IP and VPN, thereby providing session mobility and security. Also, the system and method provides a user with secure and connective handoff service.

[0006] In accordance with one aspect of the invention, a system for supporting inter-NAT-domain handoff in a VPN by associating L2TP and Mobile IP is provided. The system includes at least one mobile node, an Intranet and a foreign network. The mobile node can roam from an Intranet to a foreign network, and achieve a VPN by L2TP. The Intranet has a VPN gateway and a home agent corresponding to the mobile node. The foreign network has a NAT gateway. An L2TP (PPP) tunnel passing the NAT gateway is established between the mobile node in the foreign network and the VPN gateway. The VPN is formed by connecting the mobile node, NAT gateway and VPN gateway in series via the L2TP (PPP) tunnel. The L2TP (PPP) tunnel has a first terminal on the VPN gateway, with an address set to the home agent's IP address, and a second terminal close to the mobile node, with an address set to the mobile node's CoA.

[0007] In accordance with another aspect of the present invention, a method for supporting inter-NAT-domain handoff in a VPN by associating L2TP and Mobile IP is provided. The method includes: using a mobile node in a foreign network to add an MIP header to an original packet to be delivered to an Intranet, such that an MIP packet is generated to trigger the L2TP when it enters into the L2TP (PPP) tunnel; using the mobile node to add an L2TP header to the MIP packet for generating an L2TP packet and next sending it out of the mobile node, wherein the L2TP header has a source port limited to port ‘1701’; using the NAT gateway to translate the L2TP packet; using the VPN gateway to un-package the L2TP header of the L2TP packet translated for generating the MIP packet, record a source port in the MIP packet and forward the MIP packet to a home agent after being recorded; and using the home agent to un-package the MIP header of the MIP packet for generating the original packet and next forward the original packet to a correspondent node according to a destination address of the original packet.

[0008] Other objects, advantages, and novel features of the invention will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings.

[0009] FIG. 1 is a functional block diagram of a system achitecture according to the invention;

[0010] FIG. 2 shows a packet flow from a mobile node to a correspondent node according to the invention;

[0011] FIG. 3A shows the problem occurred when an L2TP (PPP) is applied and a packet is passed through a NAT gateway;

[0012] FIG. 3B shows solution for FIG. 3A according to the invention; and

[0013] FIG. 4 shows a packet flow from a correspondent node to a mobile node.

[0014] FIG. 1 is a system configuration in accordance with the inventive system and method for supporting inter-NAT-domain handoff in a VPN by associating L2TP and mobile IP. As shown in FIG. 1, a mobile node 13 roams from a home address of an Intranet 11 to a foreign network 12. Upon Mobile IP standard, the mobile node 13 in the Intranet 11 corresponds to a home agent 14 and also, upon L2TP standard, a VPN gateway 15 in the Intranet 11 is regarded as an L2TP network server (LNS) while the mobile node 13 in the foreign network 12 is regarded as an L2TP access concentrator (LAC). An L2TP (or Point-to-Point Protocol, abbreviated as PPP) tunnel 19 passing a NAT gateway 16 in the foreign network 12 is established between the mobile node (LAC) 13 and the VPN gateway (LNS) 15. The VPN 18 is formed by connecting the mobile node, NAT gateway and VPN gateway in series via the L2TP (PPP) tunnel 19. The L2TP (PPP) tunnel 19 has a first terminal on the VPN gateway (LNS) 15, with an address A1 set to IP address of the home agent 14, and a second terminal on the mobile node (LAC) 13, with an address A2 set to the care of address (CoA) of the mobile node.

[0015] FIG. 2 shows a packet flow from the mobile node 13 to a correspondent node 17. Referring to FIG. 1 and FIG. 2, when the mobile node 13 in the foreign network 12 desires to deliver a packet 21 to a correspondent node (CN) 17 in the Intranet 11, the packet 21 to be delivered from the mobile node 13 to the CN 17 (i.e., source: MN home address and destination: CN) is packaged firstly by MIP in the mobile node 13 to thus add an MIP header (with source: NM's CoA, and destination: home agent). Since the L2TP (PPP) tunnel 19 established sets an endpoint address A1 on the VPN gateway (LNS) 15 to an IP address of the home agent 14, a packet with the MIP header (MIP packet) sent by the mobile node 13 to the home agent 14 is delivered into the L2TP (PPP) tunnel 19 for starting L2TP. Thus, L2TP in the mobile node 13 packages the packet by adding an L2TP header (with source: LAC and destination: LNS), so as to generate a packet with the L2TP header (L2TP packet) to output from the mobile node 13.

[0016] Upon L2TP standard, LNS and LAC will listen and receive packets at UDP port ‘1701’, so that the destination of leading UDP header is limited to port ‘1701’ when LNS and LAC send packets. However, this can cause problem when the NAT gateway 16 performs an address translation, as shown in FIG. 3A. Namely, when a packet is sent from LAC to LNS (i.e., source: LAC private address at port ‘x’, and destination: LNS at port ‘1701’) is translated by NAT into a packet (with source: LAC public address at port ‘y’, and destination: LNS at port ‘1701’), NAT records only a relation of ports ‘x’ and ‘y’. However, when the packet is sent from LNS to LAC (i.e., source: LNS at port ‘z’, and destination: LAC public address at port ‘1701’), it accordingly has only the relation of ports ‘x’ and ‘y’, without recording port 1701 so that the packet cannot be accepted by the NAT gateway 16. To overcome this, the invention limits the source port of L2TP header of the packet sent by LAC to port ‘1701’. As shown in FIG. 3B, the packet sent from LAC to LNS (i.e., source: LAC private address at port ‘1701’ and destination: LNS at port ‘1701’) is processed by NAT to generate translated packet (with source: LAC public address at port ‘y’ and destination: LNS at port ‘1701’), wherein NAT records the relation of port ‘1701’ and ‘ y’. In addition, LNS records the source port (translated by NAT, i.e., port ‘y’) sent by LAC, thereby sending the packet to the source port ‘y’, instead of port ‘1701’. Therefore, when LNS sends the packet to LAC (source: LNS at port ‘z’ and destination: LAC public address at port ‘y’), since NAT records the relation of ports ‘1701’ and ‘y’, NAT can receive the packet and send it to port ‘1701’, thereby properly sending back the packet.

[0017] Referring again to FIGS. 1 and 2, the packet is sent by the mobile node 13 to the VPN gateway 15 through the L2TP (PPP) tunnel 19 and the NAT. The VPN gateway 15 un-packages the L2TP header of the packet to obtain the MIP packet and then sends the MIP packet to the home agent 14. The home agent 14 finds that the CoA of the mobile node 13 is located at the far-end of the L2TP (PPP) tunnel 19 and thus sends the packet 21 to the correspondent node 17 according to the destination address of the packet 21 obtained after un-packaging the MIP header.

[0018] FIG. 4 shows a packet flow from the correspondent node 17 to the mobile node 13. Firstly, MIP in the home agent 14 adds an MIP header (with source: home agent, and destination: NM's CoA) to the packet 21 sent by correspondent node (CN) 17 to the mobile node 13 (i.e., source: CN, and destination: MN home address). Since the L2TP (PPP) tunnel 19 established sets CoA of the mobile node 13 to another endpoint address A2 close to the mobile node, a packet with the MIP header (MIP packet) sent by the correspondent node 17 to the home agent 14 is delivered into the L2TP (PPP) tunnel 19 for starting L2TP. Thus, L2TP in the VPN gateway 15 packages the MIP packet by adding an L2TP header (with source: LNS and destination: LAC public address), so as to generate a packet with the L2TP header (L2TP packet) to next output to the mobile node 13 through the L2TP (PPP) tunnel 19 and the cited NAT. The mobile node 13 un-packages the two headers (i.e., L2TP header (with source: LNS and destination: LAC private address) and MIP header (with source: home agent and destination: MN's CoA) to thus obtain the original packet 21.

[0019] In view of the foregoing, it is appreciated that the invention associates mobile IP and VPN by packaging the mobile IP into L2TP, thereby providing both transmission mobility and security.

[0020] Although the present invention has been explained in relation to its preferred embodiment, it is to be understood that many other possible modifications and variations can be made without departing from the spirit and scope of the invention as hereinafter claimed.