Method and apparatus for end-to-end secure data communication

• US 20020042875A1
• Filed: 07/23/2001
• Published: 04/11/2002
• Est. Priority Date: 10/11/2000
• Status: Abandoned Application

• Current Assignee: Jayant Shukla
• Original Assignee: Jayant Shukla
• Inventors: Shukla, Jayant
• Application Number:
  US09/910,667
• Publication Number:
  US 20020042875A1
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2564 for a higher-layer protocol, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 61/2578 without involvement of the NAT server
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

The disclosed invention is a new method and apparatus to achieve end-to-end secure communication over public and private networks. The method can provide security to all networked applications without any modifications to the applications. The method is compatible with other networking protocols, such as, network address translation (NAT), Internet control message protocol (ICMP), and all quality of service (QoS) protocols that operate up to the transport layer. Secure communication system based on other protocols such as IPSec cannot achieve end-to-end security, while remaining compatible with networking protocols such as NAT and ICMP.

Claims

1. A method for duplicating information in an IP packet with the sole intention of using it to partially or completely reverse the effect of intermediate NATs, comprising the steps of:

Identifying parts of an IP packet that can be potentially modified by NATs;

Copying that information in its current form or copying it into a different format;

Inserting this information into an IP packet in a manner that keeps it protected from intermediate NATs.

2. The method of claim 1 wherein complete IP header and the transport layer header is inserted into the IP packet. Such a packet will have duplicate IP and transport layer headers or a duplicate IP or transport layer header.

3. The method of claim 1, wherein the duplicate information is inserted into the IP packets of the same connection in a manner that keeps it protected from intermediate NATs.

4. The method of claim 1, wherein the duplicate information is inserted into the IP packets of a different connection. In addition, there are identifiers inserted into the IP packets of both connections to correlate them.

5. A method for studying the effect of intermediate NATs with the sole purpose of using it to partially or completely reverse the effect of intermediate NATs, comprising the steps of:

Identifying parts of an IP packet that can be potentially modified by intermediate NATs;

Identifying parts of an IP packet from same or different connections that contain information before intermediate NATs modified it;

Generating a look-up table that signifies the effect of intermediate NATs on the IP packets of that connection.

6. A method for reversing partially or fully the effect of intermediate NATs based on a look-up table that signifies the effect of NATs on the IP packets of that connections.

7. The method of claim 6 wherein only the effect of NAT on the transport layer header is reversed.

8. The method of claim 6 wherein only the effect of NAT on the IP header is reversed.

9. The method of claim 6 wherein the effect of NAT on the transport layer data is reversed.

10. A method for correcting the information in outgoing IP packets so that they arrive in a state expected by the NATs.

11. The method of claim 10 where the IP header and/or the transport header of the outgoing packet is modified.

12. The method of claim 10 where the body of the outgoing packet is modified.