Mobile IP Policy Enforcement via Nine-Tuple Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in enforcing service level policies and mobility policies within IP networks, particularly in mobile environments, where Mobile IP is introduced, leading to complexities in packet filtering and routing optimization, especially when dealing with Mobile IPv6 encapsulation and route optimization.
Innovation Solution
A method and node architecture are introduced to generate and apply policy rules that account for Mobile IP addressing formats, allowing for efficient policing and filtering of packet flows by determining source and destination addressing information and applying service and mobility policies, using a nine-tuple rule format to manage routing variability and mobility policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If Mobile IP route optimization is implemented to allow direct communication between Mobile Node and Correspondent Node, then communication efficiency is improved, but security risks increase due to potential address spoofing
Solution Approach 1:
The system performs preliminary security verification by checking binding cache entries before allowing direct routed communication. The Correspondent Node verifies that the Mobile Node's Care-of Address is legitimately bound to its Home Address by checking the binding cache, preventing address spoofing attacks while enabling efficient direct communication for legitimate nodes
Solution Approach 2:
The binding cache acts as an intermediary verification mechanism between the Mobile Node and Correspondent Node. It stores and provides binding information that allows the Correspondent Node to verify the legitimacy of route optimization requests without directly trusting the Mobile Node's address claims
2Reliability
If policy rules are enforced at multiple network nodes to control Mobile IP traffic, then security and service quality are improved, but system complexity increases
Solution Approach 1:
The policy rule structure is designed to be universal and applicable across multiple network nodes (Home Agent, Correspondent Node, intermediate routers). The same nine-tuple rule format and evaluation logic can be implemented at any node that needs to enforce Mobile IP policies, reducing the need for node-specific complex logic while maintaining comprehensive policy enforcement
Solution Approach 2:
The policy enforcement system is segmented into independent modular components: policy rule generation, policy rule distribution, and policy rule evaluation. Each node can independently generate, receive, and evaluate policy rules without requiring complex inter-node coordination, simplifying the overall system architecture while enabling distributed policy enforcement
3Device complexity
If conventional five-tuple filtering is used for packet filtering, then simplicity is maintained, but it becomes inadequate for Mobile IPv6 encapsulation and route optimization scenarios
Solution Approach 1:
The filtering system transitions from conventional five-tuple filtering to nine-tuple filtering by adding four additional dimensions: Mobile Node Home Address, Mobile Node Care-of Address, Correspondent Node Home Address, and Correspondent Node Care-of Address. This dimensional expansion enables the filtering system to handle Mobile IPv6 encapsulation and route optimization scenarios while maintaining a systematic and organized approach to packet identification
Data Source
AI summary
A method and network node for generating and applying policy rules in an IP network. A Policy Enforcement Function (PEF) is implemented in a node such as a Gateway GPRS Service Node (GGSN) routing packet flows to and from network users. An Application Function (AF) determines source and destination addressing information for a packet flow and sends the information to a Policy and Charging Decision Function in a Policy and Charging Control Function (PCRF) having access to service and mobility policies for network users. The PCRF generates policy rules based on the addressing information and the appropriate service and mobility policies. The PCRF sends the policies rules to the PEF for application to the traffic flow.