US 2003/0212907 A1 · Secure IPsec tunnels with a background system accessible via a gateway implementing NAT

Abstract

A method and system for enabling secure IPsec tunnels within NAT without compromising security. A local network is configured with a gateway machine connected to the Internet and having an IPsec ID for interfacing with the Internet and a local IP/interface address for interfacing with the local network. Client machines are connected to the gateway machine and communicate with the Internet via the gateway and network address translation (NAT) techniques. Each client machine is configured with a local IP/interface address. The client machines are also provided with an alias of the IPsec ID for the gateway machine. When an IPsec request is received by the gateway machine to establish a tunnel (secure communication) with one of the clients, the gateway machine forwards the packet to the particular client using NAT. The client machine receives the request and since it has an alias of the gateway's IPsec ID, the client machine will confirm that it has one of the IPsec IDs in the packet. The client machine sends the reply packet back to the gateway machine, which then forwards it to the requesting machine over the Internet. The requesting machine receives the packet and a confirmation that it has reached its intended recipient and opens the secure IKE tunnel with the particular client via the gateway machine. In this manner authentication of the IKE tunnel and establishment of a secure IPsec session is completed with a client machine that is accessible only via a gateway implementing NAT.

Claims26

Dependent claims

A system for providing IPsec authentication of a machine accessible via a gateway implementing network address translations (NAT), said system comprising:

means for establishing an interface address of said machine corresponding to an IPsec identification (ID) utilized to route an IPsec packet to said gateway;
means for receiving an IPsec packet at said gateway;
means for routing said IPsec packet from said gateway to said machine;
and
means for completing said IPsec authentication of said machine utilizing said interface address, wherein an IKE tunnel is established between a sender of said packet and said machine via said gateway.

2 more elements

A local network comprising:

a plurality of client systems each having a corresponding network address, wherein one of said client systems comprises IPsec capabilities;
a gateway system by which said local network is coupled to an external network and that provides a communication path to said external network for said one client systems, wherein said gateway system enables addressing to and from said one client systems from/to said external network via network address translation (NAT);
wherein further said gateway system has an IP address by which it communicates with said external network and a local address for completing said NAT;
wherein said one client system comprises a local address for communicating within said local network and a mask of said IP address of said gateway;
and
means for establishing a secure IKE tunnel between said one client system and a source on said external network via IPsec protocol utilizing said gateway system to bridge said IKE tunnel by NAT.

3 more elements

Dependencies are inferred from the claim text.

Secure IPsec tunnels with a background system accessible via a gateway implementing NAT

Life of this patent

Secure IPsec tunnels with a background system accessible via a gateway implementing NAT

Life of this patent

Abstract

Claims26