Method and arrangement for providing security through network address translations using tunneling and compensations
AssigneeSsh Communications Security Corp.
InventorsTero Kivinen, Tatu Ylonen
Life of this patent
Estimating the term…
Abstract
This invention provides a method for providing network security services, such as those provided by the IPSEC protocol, through network address translation (NAT). The method is based on determining the transformations that occur on a packet and compensating for the transformations. Because only TCP and UDP protocols work through NATs, the IPSEC AH/ESP packets are encapsulated into UDP packets for transport. Special operations are performed to allow reliable communications in such environments.
Claims48
(canceled)
-18. (canceled)
A method for establishing secure communications across a network where network address translations on data packets can be provided and a sending network node secures at least some data packets by applying a cryptographic method and obtains cryptographic keys for said cryptographic method using a key management protocol, the method comprising:
- inserting, by the sending network node, at least one identifier of at least one address in payload of at least one key management message for passing the at least one identifier of the at least one address to a receiving network node for the purposes of revealing occurrence of network address translations, wherein the at least one address is in the form as seen by the sending network node;
- and
- sending said at least one key management message in accordance with the key management protocol across the network.
A method for establishing secure communications across a network where network address translations on data packets can be provided and a receiving network node secures at least some data packets by applying a cryptographic method and obtains cryptographic keys for said cryptographic method using a key management protocol, the method comprising:
- receiving at the receiving network node a key management message comprising at least one identifier of at least one address in payload thereof, the payload being configured for passing the at least one identifier of the at least one address for the purposes of revealing network address translations, and
- comparing, by said receiving network node, said at least one identifier with address information in at least one packet header to determine if at least one address was translated in the network.
A network device for sending data packet via a network enabling network address translations on data packets, the network device being configured to secure at least some data packets by applying a cryptographic method and to obtain cryptographic keys for said cryptographic method using a key management protocol, the device comprising:
- a key management block configured to insert at least one identifier of at leas one address in payload of at least one key management message for passing the at least one identifier of the at least one address to a receiving network device for the purposes of revealing occurrence of network address translations, wherein the at least one address is in the form as seen by the network device;
- and
- a network interface configured to send said at least one key management message in accordance with the key management protocol across the network to the receiving network device.
A network device for receiving data packet via a network enabling network address translations on data packets, the network device being configured to secure at least some data packets by applying a cryptographic method and to obtain cryptographic keys for said cryptographic method using a key management protocol, the device comprising:
- an interface configured to receive from a sending network device at least one key management message comprising at least one identifier of at least one address in payload thereof, the payload being configured for passing the at least one identifier of the at least one address for the purposes of revealing network address translations, and
- a key management block configured to compare said at least one identifier with address information in at least one packet header to determine if at least one address was translated in the network.
A system for establishing secure communications between a first network device and a second network device across a network where network address translations on data packets can be provided, the first and second network devices being configured to secure at least some data packets by applying a cryptographic method and to obtain cryptographic keys for said cryptographic method using a key management protocol, wherein:
- the first network device is configured to insert at least one identifier of at leas one address in payload of at least one key management message for passing the at least one identifier of the at least one address to the second network device for the purposes of revealing occurrence of network address translations, wherein the at least one address is in the form as seen by the first network device, and to send said at least one key management message in accordance with the key management protocol across the network to the second network device;
- and
- the second network device is configured to receive from the first network device the at least one key management message and to compare said at least one identifier with address information in at least one packet header to determine if at least one address was translated in the network.
A method for establishing secure communications between a first network device and a second network device across a network where network address translations on data packets can be provided, wherein at least some data packets are secured by applying a cryptographic method and by obtaining cryptographic keys for said cryptographic method using a key management protocol, the method comprising:
- establishing, by at least one of said first and second network devices, a security association using said key management protocol;
- and
- tunneling, by at least one of said first and second network devices, at least one data packet secured using said security association using said cryptographic method at packet level, wherein said tunneling
- uses an UDP connection used for said key management protocol to communicate the at least one data packet;
- and
- distinguishes data packets from real key management packets by the value of the first four bytes thereof.
A network device for a network where network address translations on data packets can be provided, said network device being configured to secure at least some data packets by applying a cryptographic method and to obtain cryptographic keys for said cryptographic method using a key management protocol, the network device comprising:
- a key management block configured to establish a security association, including at least one secret key, using said key management protocol;
- an encryption/decryption block configured to secure data packets using the at least one secret key;
- and
- a packet assembly/disassembly block configured to tunnel at least one data packet encrypted or decrypted by the encryption/decryption block using an UDP connection used by the key management block to establish the security association and to distinguish the data packets from real key management packets by the value of the first four bytes thereof.
Dependencies are inferred from the claim text.