Secure network connection for devices on a private network

• US 20030191843A1
• Filed: 04/04/2002
• Published: 10/09/2003
• Est. Priority Date: 04/04/2002
• Status: Abandoned Application

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Le Pennec, Jean-Francois, Balissat, Joel, Sommerlatt, Jean-Marie, Galand, Claude
• Application Number:
  US10/115,408
• Publication Number:
  US 20030191843A1
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A method and system for providing secure network connections are provided. When a device resides on a private network such that its address is not commonly available to other devices via a public network, a gateway, firewall or similar device can be used to preserve the address of the private network device in confidence while still allowing a secure, end-to-end connection between the public and private network devices. The gateway or similar device may negotiate separate secure connections, such as Security Associations, with each of the public and private network devices. In this way, encryption parameters of those two devices can be exchanged even though neither need be knowledgeable of the other'"'"'s actual address. Moreover, the gateway or similar device can perform this function without itself gaining access to the content being transmitted between the public and private network devices. Additionally, the gateway or similar device can also be used to forward data between the public and private network devices once a secure tunnel has been established therebetween.

Claims

1. A method for implementing secure network communications between a first device and a second device, at least one of the devices communicating with a public network via a separate computer, the method comprising:

receiving a request for a first secure connection from the first device;

masking an address of the first device with respect to the second device; and

initiating a second secure connection between the separate computer and the second device,

wherein the first and second secure connections enable the secure network communications between the first and second devices.

2. The method of claim 1, wherein the first secure connection is a security association negotiated using a device address of the first device and a first device address of the separate computer.

3. The method of claim 2, wherein the second secure connection is a security association negotiated using a second device address of the separate computer and a device address of the second device.

4. The method of claim 3, further comprising:

relaying the secure communications between the first and second devices,

wherein communications from the first and second devices are received at the first and second device address, respectively, of the separate computer.

5. The method of claim 3, further comprising:

maintaining a table relating the device addresses of the two devices and the device addresses of the separate computer; and

forwarding the secure communications between the first and second devices based on the table.

6. The method of claim 1, further comprising:

communicating the device addresses of the first and second device between the two, via the first and second secure connections; and

forwarding the secure communications using the respective device addresses of the first and second devices.

7. The method of claim 1, wherein said first and second secure connections are separate security associations, and further comprising:

forwarding encryption parameters of the two devices between the two devices in order to establish the security associations.

8. The method of claim 1, further comprising:

swapping a source and destination address contained within a packet received from the first device such that the packet is forwarded to the second device.

9. A virtual peer device for implementing a secure network connection between a first and second device, at least one of the devices being a private network device communicating with a public network via the virtual peer device, the virtual peer device comprising:

means for receiving a request for a first connection from the first device;

means for requesting a second connection with the second device;

means for forwarding encryption parameters between the two devices, to thereby establish the first and second connections; and

means for establishing the secure connection based on the first and second connections.

10. The virtual peer device of claim 9, further comprising:

means for relaying data between the two devices via the secure network connection.

11. The virtual peer device of claim 10, further comprising:

a device address to which the first and second devices direct communications when requesting and establishing the first and second connections.

12. The virtual peer device of claim 11, further comprising:

a public key for authenticating packets forwarded by the virtual peer device.

13. The virtual peer device of claim 9, wherein the first and second connections are security associations negotiated as part of an IPsec session.

14. An article of manufacture, which comprises a computer readable medium having stored therein a computer program carrying out a method for implementing a secure connection between two devices, the computer program comprising:

a first code segment for establishing a device address associated with the article of manufacture;

a second code segment for establishing a first link between a first device and the device address;

a third code segment for establishing a second link between a second device and the device address;

a fourth code segment for exchanging encryption parameters associated with each of the first and second device via the first and second link; and

a fifth code segment for establishing the secure connection based on the encryption parameters.

15. The article of manufacture of claim 14, wherein at least one of the devices is located on a private network, and further wherein the article of manufacture is a gateway device on the edge of the private network.

16. The article of manufacture of claim 14, further comprising:

a sixth code segment for relaying communications between the two devices over the secure connection, via a virtual link having the two devices as endpoints.

17. The article of manufacture of claim 14, further comprising:

a sixth code segment for associating the device address associated with the article of manufacture as a device address of the second device.

18. The article of manufacture of claim 14, wherein the first and second links have the same encryption parameters.

19. A method of transmitting data, comprising:

negotiating a first security association between a first device and a second device;

negotiating a second security association between a second device and a third device that is independent of the first security association; and

transmitting data inaccessible to said second device between the first and third devices via the second device.

20. The method of claim 19, further comprising:

constructing an encryption secret key shared only by the first and third devices that enables the first and third devices to encrypt and decrypt the data transmitted therebetween.

21. The method of claim 20, wherein the data comprises data packets, and further wherein a first portion of the data packets is encrypted using the encryption secret key and a second portion of the data packets is authenticated using a digital signature.

22. The method of claim 21, wherein the second device redirects the data packets by exchanging, in a header portion of each data packet, a device address of a one of the first and third devices that is to receive the data for its own device address.

23. The method of claim 19, wherein said transmitting further comprises:

receiving data from the first device at the second device;

authenticating the data as having been transmitted from the second device; and

transmitting the data to the third device.

24. The method of claim 23, wherein said receiving data from the first device at the second device further comprises:

authenticating the data as having been transmitted from the first device; and

exchanging, in a header portion of a packet containing the data, an address of the second device for an address of the third device.