Detecting Network Topology when Negotiating IPsec Security Associations that Involve Network Address Translation
AssigneeInternational Business Machines Corporation
InventorsWuchieh Jong, Linwood Overby, Joyce Porter, David Wierbowski
Life of this patent
Estimating the term…
Abstract
The invention determines if a security association (SA) extends end-to-end between a source node originating a connection and a destination node. In such a case, there will be no ambiguities in routing due to network address translation, and the SA is allowed. In the preferred embodiment, both end nodes of a security connection test themselves and the remote node for gateway status to determine if any ambiguities might exist in network routing due to the presence of a network address translator.
Claims18
A method of negotiating IPsec security associations, comprising
- at a node negotiating a security association (SA):
- determining if the SA extends end-to-end between a source node originating a connection and a destination node, and
- allowing the SA if the SA extends end-to-end between the source node the destination node.
A method of negotiating IPsec security associations, comprising
- at a node initiating a security association (SA) negotiation:
- determining if the initiating node is a gateway to other source or destination nodes, and
- denying the SA if the initiating node is a gateway.
A method of negotiating IPsec security associations, comprising
- at a node responding to a security association (SA) negotiation:
- determining if the node initiating the SA is a gateway to source or destination nodes and if so, marking the associated network connection as not having an end-to-end SA.
Dependencies are inferred from the claim text.