A seamless solution transparently addresses the characteristics of nomadic systems, and enables existing network applications to run reliably in mobile environments. The solution extends the enterprise network, letting network managers provide mobile users with easy access to the same applications as stationary users without sacrificing reliability or centralized management. The solution combines advantages of existing wire-line network standards with emerging mobile standards to create a solution that works with existing network applications. A Mobility Management Server coupled to the mobile network maintains the state of each of any number of Mobile End Systems and handles the complex session management required to maintain persistent connections to the network and to other peer processes. If a Mobile End System becomes unreachable, suspends, or changes network address (e.g., due to roaming from one network interconnect to another), the Mobility Management Server maintains the connection to the associated peer task—allowing the Mobile End System to maintain a continuous connection even though it may temporarily lose contact with its network medium. In one example, Mobility Management Server communicates with Mobile End Systems using Remote Procedure Call and Internet Mobility Protocols.

Method and apparatus for providing mobile and other intermittent connectivity in a computing environment

The present invention provides a firewall that achieves maximum network security and maximum user convenience. The firewall employs “envoys” that exhibit the security robustness of prior-art proxies and the transparency and ease-of-use of prior-art packet filters, combining the best of both worlds. No traffic can pass through the firewall unless the firewall has established an envoy for that traffic. Both connection-oriented (e.g., TCP) and connectionless (e.g., UDP-based) services may be handled using envoys. Establishment of an envoy may be subjected to a myriad of tests to “qualify” the user, the requested communication, or both. Therefore, a high level of security may be achieved. The usual added burden of prior-art proxy systems is avoided in such a way as to achieve fall transparency-the user can use standard applications and need not even know of the existence of the firewall. To achieve full transparency, the firewall is configured as two or more sets of virtual hosts. The firewall is, therefore, “multi-homed,” each home being independently configurable. One set of hosts responds to addresses on a first network interface of the firewall. Another set of hosts responds to addresses on a second network interface of the firewall. In one aspect, programmable transparency is achieved by establishing DNS mappings between remote hosts to be accessed through one of the network interfaces and respective virtual hosts on that interface. In another aspect, automatic transparency may be achieved using code for dynamically mapping remote hosts to virtual hosts in accordance with a technique referred to herein as dynamic DNS, or DDNS.

Firewall providing enhanced network security and user transparency

Location sharing and tracking using mobile phones or other wireless devices

The present invention can be used to facilitate the integration of wireless capability provided by wireless access points into an enterprise computer network. A gateway server is interposed between wireless access points and protected networks to provide security and integration functions, for example, authentication, access control, link privacy, link integrity, and bandwidth metering in various embodiments. Use of such a gateway server allows substantial control to be gained over network access even with the use of relatively simple access points. In general, such a gateway server receives a request to access the protected network. An authentication subsystem of the gateway server authenticates the user, preferably by accessing an external authentication server and returns a role to the authenticated user. An access controller in the gateway server provides differential access to the protected network based on the user's assigned role. A multiple gateway servers can be connected together to form a mesh network architecture.

Method and system for managing data traffic in wireless networks

A packet-centric wireless system includes: a wireless base station communicating via a transmission control protocol/internet protocol (TCP/IP) to a first data network; one or more host workstations communicating via TCP/IP to the first data network; one or more subscriber customer premise equipment (CPE) stations coupled with the wireless base station over a shared bandwidth via TCP/IP over a wireless medium; and one or more subscriber workstations coupled via TCP/IP to each of the subscriber CPE stations over a second network. The system can allocate shared bandwidth among the subscriber CPE stations to optimize end-user quality of service (QoS). The first data network includes at least one of: a wireline network; a wireless network; a local area network (LAN); and a wide area network (WAN). The second network includes at least one of: a wireline network; a wireless network; a local area network (LAN); and a wide area network (WAN).

Transmission control protocol/internet protocol (tcp/ip) packet-centric wireless point to multi-point (ptmp) transmission system architecture

A network-based mobile workgroup system has considerably wider appeal and application than normal virtual private networks in that it provides seamless mobility across a number of access technologies at the same time as it offers a granular security separation down to workgroup level. The mobile workgroup system is an access management system for mobile users with VPN and firewall functionality inbuilt. The mobile user can access the mobile workgroup system over a set of access technologies and select server resources and correspondent nodes to access pending their workgroup membership approvals. All workgroup policy rules are defined in a mobile service manager and pushed down to one or more mobile service routers for policy enforcement. The mobile service router closest to the mobile client, and being part of the mobile virtual private network, performs regular authentication checks of the mobile client during service execution. At the same time it performs traffic filtering based on the mobile user's workgroup memberships. Together, these two components constitute an unprecedented security lock, effectively isolating a distributed workgroup into a mobile virtual private network.

Network-based mobile workgroup system

The present invention describes a network-based mobile workgroup system allowing a selected set of users from two or more mobile virtual private networks to form an extranet workgroup in a secure manner. The invention is based on the limited private address scenario, which entitles mobile nodes having private, possibly overlapping, addresses as defined in RFC 1918, while home and foreign agents have public IP addresses. Each home agent is dedicated to one mobile virtual private network (M-VPN), while a foreign agent may be shared by multiple M-VPNs. The system also entails a mobile service manager that has a public IP address and a set of mobile nodes that all have a UFQDN (user fully qualified domain name) within the overall mobile workgroup system. The main benefits, compared to existing solution for extranet workgroup creation, are that extranets can be created despite overlapping address realms. Even fine-granular workgroups within the extranet can be created with any set of users from any set of M-VPNs. The mobility aspect of the M-VPN fits well for supporting peer-to-peer applications, such as voice over IP, between mobile clients. Although the mobile clients may belong to different M-VPNs, with different address realms, per packet authentication and filtering is always possible to perform by the ingress M-VPN security gateway using a realm-indexed filtering technique. Finally, the responsibility for allocating resources, to be reached by an extranet workgroup, is completely delegated to each M-VPN.

Extranet workgroup formation across multiple mobile virtual private networks

In a mobile communications system (10), a mobile host (12) communicates packet data with an external network (56) by way of a packet gateway node (54). The mobile host establishes a packet session during which plural application flows are communicated with an external network entity. Each application flow includes a corresponding stream of packets. In addition, a corresponding quality of service parameter is defined and reserved for each of the plural application flows. In this way, different quality of service parameters may be defined and reserved for different ones of the application flows. Packets corresponding to each of the application flows are then delivered, for example, from the external network entity all the way to the mobile host in accordance with the quality of service reserved for that application flow. Different qualities of service may have different allocated bandwidths, delays, and/or reliabilities.

Dynamic quality of service reservation in a mobile communications network

Applications running on a mobile station or an external network entity such as an Internet service provider may specify on an individual application flow basis a requested quality of service. From that requested quality of service, an optimal type of bearer to transfer the application flow through the mobile communications network is determined. For example, a circuit-switched bearer may be allocated if the request is for a real-time service, and a packet-switched bearer may be allocated if the request is for a non-real time type of service. Various other decision making criteria may be employed. A mobile station and a mobile network gateway node each include a mapper for mapping an individual application flow to one of a circuit-switched network and a packet-switched network bearer depending on the quality of service requested for the individual application flow. The network layer quality of service parameters corresponding to an individual application flow are mapped to circuit-switched bearer parameters if the application flow is mapped to the circuit-switched network and to packet-switched bearer parameters if the application flow is mapped to the packet-switched network. The gateway node includes a common access server which permits a mobile station initially establishing a communications session with an external network entity to perform only a single, common access procedure for subsequent communications using one of the circuit-switched and packet-switched networks. After that common access procedure is completed, subsequent application flows between the mobile station and the external network entity are established using abbreviated procedures without having to access the external network entity.

Common access between a mobile communications network and an external network with selectable packet-switched and circuit-switched and circuit-switched services

A public mobile access data network provides a mobile node data access to the Internet and data access to the mobile node from the Internet even when a point of attachment of the mobile node to the public mobile access data network changes. A public mobility management service is provided to locate mobile nodes so that the Internet is aware of the mobile node's current point of attachment. Advantageously, this public mobility management service is provided independently of mobility services offered by radio access, technology-specific networks. The public mobile access service is implemented using a home agent/foreign agent model where the home and foreign agents transfer data packets over the public mobile access network via a data tunnel. In a preferred, example embodiment, mobile Internet protocol (IP) is used at the network protocol layer to provide the public mobility service. The mobile IP packets are carried using multi-protocol label path switching (MPLS) label switched paths (LSPs) which provide a number of benefits such as tunneling flexibility, configurability, and efficiency.

Jan Forslow

Papers

Network-based mobile workgroup system

Extranet workgroup formation across multiple mobile virtual private networks

Dynamic quality of service reservation in a mobile communications network

Common access between a mobile communications network and an external network with selectable packet-switched and circuit-switched and circuit-switched services

Public mobile data communications network