Identifier-Locator Separation for Mobile Network Service Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The current IP address-based namespace architecture in communication networks struggles with scalability and mobility due to its dual function as both an endpoint identifier and locator, particularly in scenarios involving multihoming and end node mobility, leading to inefficient network service delivery and increased computational load.
Innovation Solution
Implementing an identifier-locator separation network protocol (ILNP or LISP) and using network tokens tied to identifiers rather than locators, allowing end nodes to request and verify network services through cryptographic validation, independent of their location, thereby simplifying network state management and supporting mobility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If IP addresses are used for both endpoint identification and routing purposes, then the current namespace architecture can be maintained, but network scalability and mobility are limited
Solution Approach 1:
The patent segments the IP address functionality into two separate components: endpoint identifiers (EIDs) for identifying communication endpoints and locators (LIDs) for routing packets through the network. This separation allows endpoints to maintain constant identifiers while their network locations can change, thereby improving scalability and mobility without increasing overall namespace architecture complexity
Solution Approach 2:
The patent extracts the routing function from the endpoint identifier by introducing a separate locator component. The EID is taken out from the traditional IP address and used solely for identification, while the LID handles routing purposes. This extraction resolves the contradiction by enabling independent optimization of identification and routing functions
2Reliability
If network tokens are included in every packet, then network service authorization is ensured, but packet size increases and cryptographic processing overhead increases
Solution Approach 1:
The patent applies preliminary action by performing cryptographic verification of network tokens at the network gateway before packets are forwarded into the core network. This upfront verification ensures authorization reliability while preventing redundant cryptographic processing at each subsequent network node, thereby maintaining packet processing efficiency
Solution Approach 2:
The patent introduces a network gateway as an intermediary component that handles cryptographic verification of network tokens. This mediator separates the authorization function from the routing function, allowing tokens to be verified once at the gateway while subsequent nodes only perform lightweight routing based on locators, thus resolving the contradiction between authorization reliability and processing efficiency
3Measurement precision
If network tokens are tied to a 5-tuple of source IP address, destination IP address, source port number, destination port number, and protocol name, then packet identification is achieved, but computational load increases and mobility support is limited
Solution Approach 1:
The patent segments packet identification into two stages: first, use the EID-LID pair for broad packet classification and network service determination, then use the 5-tuple only when needed for fine-grained service differentiation. This segmentation reduces the computational load of 5-tuple processing while maintaining accurate packet identification, and supports mobility since EIDs remain constant during endpoint movement
Data Source
AI summary
An embodiment is a method by one or more network devices implementing a network token generator in a network. The method includes receiving a request from an end node to apply a network service to network traffic originated by the end node, wherein the end node implements an identifier-locator separation network protocol and is associated with an identifier and a locator in accordance with the identifier-locator separation network protocol, generating a network token based on the identifier associated with the end node but not based on the locator associated with the end node in response to receiving the request, associating the network token with the network service, and sending the network token to the end node.