Back to results
US 8,544,079 B2Granted
Method and arrangement for providing security through network address translations using tunneling and compensations
AssigneeTectia Oyj
InventorsTero Kivinen, Tatu Ylonen
Life of this patent
Estimating the term…
Abstract
This invention provides a method for providing network security services, such as those provided by the IPSEC protocol, through network address translation (NAT). The method is based on determining the transformations that occur on a packet and compensating for the transformations. Because only TCP and UDP protocols work through NATs, the IPSEC AH/ESP packets are encapsulated into UDP packets for transport. Special operations are performed to allow reliable communications in such environments.
Claims32
A method of maintaining communication of datagrams comprising:
- communicating the datagrams, in accordance with the User Datagram Protocol, from and/or to a device via a network address translator device that performs network address translation;
- and
- maintaining mapping for the network address translation by sending from the device at least one keepalive packet to the network address translator device before a time out of the mapping for the network address translation.
A method of providing address translations, comprising:
- performing network address translation by a network address translator device for communication of datagrams, in accordance with the User Datagram Protocol, between a first device and a second device;
- sending at least one keepalive packet from at least one of the first device and the second device to the network address translator device before time out of mapping for the address translation for the communication of the datagrams to maintain the mapping for the network address translation;
- and
- in response to receiving the at least one keepalive packet, maintaining the mapping for the network address translation for the communication of the datagrams between the first device and the second device.
1 more element
An apparatus comprising:
- at least one memory storing computer program code;
- and
- at least one processor,
- wherein the at least one memory, the computer program code, and the at least one processor are configured to cause the apparatus at least to:
- control communication of datagrams, in accordance with the User Datagram Protocol, from and/or to a device via a network address translator device that performs network address translation, and
- maintain mapping for the network address translation by causing sending of at least one keepalive packet from the device to the network address translator device before a time out of the mapping for the network address translation.
3 more elements
An apparatus for maintaining network address translations, comprising:
- a first communication device;
- and
- a network address translator device configured to perform a network address translation for communication of datagrams, in accordance with the User Datagram Protocol, between the first communication device and a second communication device, wherein
- the first communication device is configured to send at least one keepalive packet to the network address translator device before time out of mapping for the network address translations to maintain the mapping for the network address translation, and
- the network address translator device is configured to maintain the mapping for network address translation for the communication of datagrams between the first communication device and the second communication device in response to reception of at least one keepalive packet from the first communication device before the time out of the mapping for the address translation for the communication of the datagrams.
2 more elements
A non-transitory computer readable media for maintaining communication of datagrams, comprising program code for causing a processor to perform instructions for:
- communicating datagrams, in accordance with the User Datagram Protocol, from and/or to a device via a network address translator device that performs network address translation, and
- maintaining mapping for the network address translation by sending at least one keepalive packet to the network address translator device before a time out of the mapping for network address translation.
An apparatus comprising:
- at least one memory storing computer program code;
- and
- at least one processor,
- wherein the at least one memory, the computer program code, and the at least one processor are configured to cause the apparatus at least to:
- control communication of datagrams in accordance with User Datagram Protocol between a first device and a second device via a network address translator device that performs network address translation, and
- maintain the network address translation by causing sending of at least one keepalive datagram to the network address translator device before a time out of the mapping for the network address translation.
3 more elements
A communication device configured at least to:
- communicate datagrams in accordance with User Datagram Protocol to and/or from a second device via a network address translator device that performs network address translation, and
- maintain mapping for the network address translation by sending of at least one keepalive datagram to the network address translator device before a time out of the mapping for the network address translation.
A method of maintaining communication of data packets, comprising:
- communicating datagrams in accordance with User datagram Protocol from and/or to a device via a network address translator device that performs network address translation;
- and
- maintaining mapping for the network address translation by sending at least one keepalive datagram comprising a header with address information that equals address information in the headers of the datagrams through the network address translator device before a time out of the mapping for the network address translation.
Dependencies are inferred from the claim text.