# US 8,544,079 B2 · Method and arrangement for providing security through network address translations using tunneling and compensations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,544,079 B2 - Document ID: US8544079B2 - Status: Granted - Kind: B2 - Application number: 12/862,305 - Filed: 2010-08-24 - Published: 2010-12-16 - Granted: 2013-09-24 - Earliest claimed: 1999-06-15 - Assignees: Tectia Oyj - Applicants: Tero Kivinen; Tatu Ylonen - Inventors: Tero Kivinen; Tatu Ylonen - Web page: https://patentgrep.com/patent/US8544079B2 ## CPC - H04L 61/256: NAT traversal - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 45/026: {Details of "hello" or keep-alive messages} - H04L 61/00: Network arrangements, protocols or services for addressing or naming - H04L 61/25: of the same type - H04L 61/2514: between local and global IP addresses - H04L 61/2553: Binding renewal aspects, e.g. using keep-alive messages - H04L 61/2564: {for a higher-layer protocol, e.g. for session initiation protocol [SIP]} - H04L 61/2575: using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN] - H04L 61/2578: without involvement of the NAT server - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/0272: {Virtual private networks} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/164: {at the network layer} - H04L 67/568: Storing data temporarily at an intermediate stage, e.g. caching - H04L 69/161: {Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields} - H04L 69/165: Combined use of TCP and UDP protocols; selection criteria therefor - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 2101/663: Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract This invention provides a method for providing network security services, such as those provided by the IPSEC protocol, through network address translation (NAT). The method is based on determining the transformations that occur on a packet and compensating for the transformations. Because only TCP and UDP protocols work through NATs, the IPSEC AH/ESP packets are encapsulated into UDP packets for transport. Special operations are performed to allow reliable communications in such environments. ## Claims ### Claim 1 A method of maintaining communication of datagrams comprising: communicating the datagrams, in accordance with the User Datagram Protocol, from and/or to a device via a network address translator device that performs network address translation; and maintaining mapping for the network address translation by sending from the device at least one keepalive packet to the network address translator device before a time out of the mapping for the network address translation. ### Claim 2 (depends on 1) The method according to claim 1, wherein the at least one keepalive packet comprises a header with address information that equals address information in the headers of the datagrams. ### Claim 3 (depends on 1) The method according to claim 1, wherein the at least one keepalive packet comprises an indicator that identifies it as a keepalive packet. ### Claim 4 (depends on 1) The method according to claim 1, comprising generating the at least one keepalive packet by generating a packet without any meaningful payload. ### Claim 5 (depends on 1) The method according to claim 1, comprising determining a shortest period for the time out of the mapping for the network address translation, and based on the determination, sending the at least one keepalive packet frequently enough to maintain the mapping for the network address translation in the network address translator device. ### Claim 6 (depends on 1) The method according to claim 1, comprising taking the possibility of packet loss into account in determining a frequency of sending the at least one keepalive packet. ### Claim 7 (depends on 1) The method according to claim 1, comprising maintaining the mapping for the network address translations by a plurality of network address translator devices by sending the at least one keepalive packet via the plurality of network address translator devices. ### Claim 8 A method of providing address translations, comprising: performing network address translation by a network address translator device for communication of datagrams, in accordance with the User Datagram Protocol, between a first device and a second device; sending at least one keepalive packet from at least one of the first device and the second device to the network address translator device before time out of mapping for the address translation for the communication of the datagrams to maintain the mapping for the network address translation; and in response to receiving the at least one keepalive packet, maintaining the mapping for the network address translation for the communication of the datagrams between the first device and the second device. ### Claim 9 (depends on 8) The method according to claim 8, comprising maintaining the mapping for the network address translation in response to receiving at least one keepalive packet comprising a header with address information that equals address information in the headers of the datagrams. ### Claim 10 (depends on 8) The method according to claim 8, comprising determining that the at least one keepalive packet contains an indicator that identifies it as a keepalive packet. ### Claim 11 (depends on 8) The method according to claim 8, comprising detecting reception of the at least one keepalive packet based on receipt of a packet without any meaningful payload. ### Claim 12 An apparatus comprising: at least one memory storing computer program code; and at least one processor, wherein the at least one memory, the computer program code, and the at least one processor are configured to cause the apparatus at least to: control communication of datagrams, in accordance with the User Datagram Protocol, from and/or to a device via a network address translator device that performs network address translation, and maintain mapping for the network address translation by causing sending of at least one keepalive packet from the device to the network address translator device before a time out of the mapping for the network address translation. ### Claim 13 (depends on 12) The apparatus according to claim 12, wherein the at least one keepalive packet comprises a header with address information that equals address information in the headers of the datagrams. ### Claim 14 (depends on 12) The apparatus according to claim 12, wherein the at least one keepalive packet contains an indicator that identifies it as a keepalive packet. ### Claim 15 (depends on 12) The apparatus according to claim 12, configured to cause sending of the at least one keepalive packet frequently enough to maintain the mapping for the address translation. ### Claim 16 (depends on 12) The apparatus according to claim 12, configured to take the possibility of packet loss into account in determining a frequency of sending the at least one keepalive packet. ### Claim 17 (depends on 12) The apparatus according to claim 12, configured to discard received keepalive packets. ### Claim 18 An apparatus for maintaining network address translations, comprising: a first communication device; and a network address translator device configured to perform a network address translation for communication of datagrams, in accordance with the User Datagram Protocol, between the first communication device and a second communication device, wherein the first communication device is configured to send at least one keepalive packet to the network address translator device before time out of mapping for the network address translations to maintain the mapping for the network address translation, and the network address translator device is configured to maintain the mapping for network address translation for the communication of datagrams between the first communication device and the second communication device in response to reception of at least one keepalive packet from the first communication device before the time out of the mapping for the address translation for the communication of the datagrams. ### Claim 19 (depends on 18) The apparatus according to claim 18, wherein the at least one keepalive packet comprises a header with address information that equals address information in the headers of the the datagrams. ### Claim 20 (depends on 18) The apparatus according to claim 18, configured to detect that the at least one keepalive packet contains an indicator that identifies it as a keepalive packet. ### Claim 21 (depends on 18) The apparatus according to claim 18, configured to interpret a packet as a keepalive packet if the packet does not contain any meaningful payload. ### Claim 22 (depends on 18) The apparatus according to claim 18, comprising at least one additional network address translator device configured to perform a further network address translation for the communication of the datagrams, wherein the additional network address translation device is configured to maintain mapping for the further network address translation for the communication of datagrams in response to reception of the at least one keepalive packet from the network address translator device before time out of the mapping for the additional address translation. ### Claim 23 A non-transitory computer readable media for maintaining communication of datagrams, comprising program code for causing a processor to perform instructions for: communicating datagrams, in accordance with the User Datagram Protocol, from and/or to a device via a network address translator device that performs network address translation, and maintaining mapping for the network address translation by sending at least one keepalive packet to the network address translator device before a time out of the mapping for network address translation. ### Claim 24 (depends on 23) The non-transitory computer readable media according to claim 23, wherein the program code is configured to cause sending at least one keepalive packet comprising a header with address information that equals address information in the headers of the datagrams. ### Claim 25 An apparatus comprising: at least one memory storing computer program code; and at least one processor, wherein the at least one memory, the computer program code, and the at least one processor are configured to cause the apparatus at least to: control communication of datagrams in accordance with User Datagram Protocol between a first device and a second device via a network address translator device that performs network address translation, and maintain the network address translation by causing sending of at least one keepalive datagram to the network address translator device before a time out of the mapping for the network address translation. ### Claim 26 (depends on 25) The apparatus according to claim 25, wherein the at least one keepalive datagram comprises a header with address information that equals address information in the headers of the datagrams. ### Claim 27 (depends on 25) The apparatus according to claim 25, wherein the at least one keepalive datagram contains an indicator that identifies it as a keepalive datagram. ### Claim 28 (depends on 25) The apparatus according to claim 25, wherein the at least one keepalive datagram comprises a datagram without any meaningful payload. ### Claim 29 A communication device configured at least to: communicate datagrams in accordance with User Datagram Protocol to and/or from a second device via a network address translator device that performs network address translation, and maintain mapping for the network address translation by sending of at least one keepalive datagram to the network address translator device before a time out of the mapping for the network address translation. ### Claim 30 (depends on 29) The communication according to claim 29, wherein the at least one keepalive datagram comprises a header with address information that equals address information in the headers of the datagrams. ### Claim 31 A method of maintaining communication of data packets, comprising: communicating datagrams in accordance with User datagram Protocol from and/or to a device via a network address translator device that performs network address translation; and maintaining mapping for the network address translation by sending at least one keepalive datagram comprising a header with address information that equals address information in the headers of the datagrams through the network address translator device before a time out of the mapping for the network address translation. ### Claim 32 (depends on 31) The method according to claim 31, comprising maintaining mapping for the network address translations by a plurality of network address translator devices by sending the at least one keepalive datagram via the plurality of network address translator devices.