Method and arrangement for providing security through network address translations using tunneling and compensations

A method for conditionally setting up a secure communication connection between a first computer device and a second computer device through a packet-switched data transmission network including intermediate computer devices, where at least one of said computer devices performs a network address translation or a protocol conversion or both a protocol conversion and a network address translation, the method comprising the steps of

• finding out, whether or not said second computer device supports a communication method where:
• it is determined what network address translations or and/or protocol conversions or both, if any, occur on packets transmitted between said first computer device and said second computer device,
• if it is found that network address translations or protocol conversions occur on packets transmitted between said first computer device and said second computer device, packets are taken that conform to a first protocol and encapsulated into packets that conform to a second protocol, which second protocol is capable of traversing network address translations and/or protocol conversions,
• said packets conforming to said second protocol are transmitted from said first computer device to said second computer device,
• and said transmitted packets conforming to said second protocol are decapsulated into packets conforming to said first protocol,
• as a response to a finding indicating that the second computer device supports said communication method, setting up a secure communication connection between said first computer device and said second computer device in which communication connection said communication method is employed and
• as a response to a finding indicating that said second computer device does not support said communication method, disabling use of said communication method between said first and said second computer devices.

A method for tunnelling packets between a first computer device and a second computer device through a packet-switched data transmission network comprising intermediate computer devices, where at least one of said computer devices performs a network address translation and/or a protocol conversion, the method comprising the steps of

• establishing a bidirectional tunnelling mode between said first computer device and said second computer device by exchanging packets conforming to a secure communication protocol,
• determining if one or more network address translations and/or protocol conversions occur on packets travelling from said first computer to said second computer, and if so, taking packets conforming to a first protocol and encapsulating them at said first computer device into packets conforming to a second protocol, which second protocol is capable of traversing network address translations,
• transmitting said packets conforming to said second protocol from said first computer device to said second computer device,
• decapsulating said transmitted packets conforming to said second protocol into packets conforming to said first protocol at the second computer device,
• obtaining information about the address translations occurred on packets transmitted between said first computer device and said second computer device and
• using said obtained information to modify the established bidirectional tunneling mode between said first computer device and said second computer device.

A method for securely communicating packets between a first computer device and a second computer device through a packet-switched data transmission network including intermediate computer devices, where at least one of said computer devices performs a network address translation and/or a protocol conversion and where a security protocol exists comprising a key management connection, the method comprising the steps of

• a method for determining what network address translations, if any, occur on packets transmitted between said first computer device and said second computer device:
• establishing a key management connection according to said security protocol between said first computer device and said second computer device,
• composing an indicator packet with a header part and a payload part of which both comprise the network addresses of said first computer device and said second computer device as seen by the node composing said packet,
• transmitting and receiving said indicator packet within said key management connection;
• and comparing in the received indicator packet the addresses contained in said header part and said payload part, and
• using the information concerning the determined occurrences of network address translations for securely communicating packets between the said first computer device and said second computer device.

A method for conditionally setting up a secure communication connection and communicating data between a first computer device and a second computer device through a packet-switched data transmission network including intermediate computer devices, where at least one of said computer devices performs a network address translation or a protocol conversion or both a protocol conversion and a network address translation, the method comprising the steps of:

• carrying out a negotiation between said first and second computer devices to determine if said second computer device supports a secure communication protocol which is incompatible with network address translations or protocol conversions or both;
• as a response to a finding indicating that the second computer device supports said secure communication protocol, setting up a secure communication connection between said first computer device and said second computer device in which communication connection said secure communication protocol is employed;
• as a response to a finding indicating that said second computer device does not support said secure communication protocol, disabling use of said secure communication protocol between said first and said second computer devices,
• if it is found that said second computer device supports said secure communication protocol, determining what network address translations or protocol conversions or both, if any, occur on packets transmitted between said first computer device and said second computer device,
• if it is found that network address translations or protocol conversions occur on packets transmitted between said first computer device and said second computer device, taking packets that conform to said secure communication protocol and encapsulating them into packets that conform to a second protocol, which second protocol is capable of traversing network address translations or protocol conversions, or both without violating said second protocol,
• if it is found that network address translations or protocol conversions occur on packets transmitted between said first computer device and said second computer device, periodically transmitting keepalive packets from said first computer device to said second computer device with the interval between said keepalive packets being set to insure that mappings of said NAT or protocol conversions or both stay the same;
• transmitting said packets conforming to said second protocol from said first computer device to said second computer device.