Secure and seamless wan-lan roaming

Abstract

Systems and methods are described for secure and seamless roaming between internal and external networks. Double and triple tunnels may be used to connect a mobile node to a correspondent host. A mobile node may include the ability to connect to two networks simultaneously to enable seamless roaming between networks.

We claim: 
     
         1 . A system for preventing a denial of service attack comprising: a mobile node communicating with an internal home agent that only transmits internal mobile IP registration requests through an IPsec tunnel. 
     
     
         2 . The system according to  claim 1 , wherein said IPsec tunnel is established by key exchange. 
     
     
         3 . A system for preventing leakage of information comprising: a mobile node communicating with an internal home agent, wherein an internal mobile IP registration reply is not encrypted and wherein at least some other signaling and data packets are encrypted. 
     
     
         4 . The system according to  claim 3 , wherein said encryption comprises an IPsec tunnel. 
     
     
         5 . A system for preventing false incoming calls comprising: a mobile node communicating with an internal home agent, said mobile node include a firewall, said firewall preventing packets from being accepted as trigger packets, where said accepted trigger packets permit said mobile node to establish an IPsec tunnel with said internal home agent. 
     
     
         6 . A method for preventing a denial of service attack comprising the steps of: communicating with an internal home agent wherein said communications transmit internal mobile IP registration requests only through an IPsec tunnel. 
     
     
         7 . The method according to  claim 6 , further comprising the step of: establishing said IPsec tunnel by key exchange. 
     
     
         8 . A method for preventing leakage of information comprising the steps of: communicating with an internal home agent; not encrypting an internal mobile IP registration reply; and encrypting at least some other signaling and data packets. 
     
     
         9 . The method according to  claim 8 , further comprising the step of: encrypting said other signaling and data packets by sending them through an IPsec tunnel. 
     
     
         10 . A method for preventing false incoming calls from a mobile node comprising: communicating with an internal home agent; and preventing packets from being accepted as trigger packets, where said accepted trigger packets permit said mobile node to establish an IPsec tunnel with said internal home agent.