Method for sending messages over secure mobile communication links

• US 20050216725A1
• Filed: 01/21/2003
• Published: 09/29/2005
• Est. Priority Date: 01/22/2002
• Status: Active Grant

• Current Assignee: MPH Technologies Oy
• Original Assignee: MPH Technologies Oy
• Inventors: Nuopponen, Antti, Vaarala, Sami
• Granted Patent: US 7,346,926 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 61/2532 Clique of NAT servers
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

The method is for sending messages over secure communication links in networks with a mobile terminal and at least one other terminal. A secure communication link is established between a given initial network address of the mobile terminal and the address of the other terminal. The secure communication link defines at least the addresses of the two terminals. The secure communication link supports an encapsulation method to overcome network address translations and/or other translations. When the mobile terminal moves from an initial network address to a new network address, a request message is sent from the mobile terminal to the other terminal to change the secure connection to be between the new address of the mobile terminal and the other terminal. The request is sent using said method to overcome network translations. The other terminal responds to the mobile terminal with a reply message with a description about the overcoming methods supported by the other terminal. All messages are thereafter sent from the mobile terminal to the other terminal by using the information sent with said reply.

Claims

1. A method for sending messages over secure communication links in networks comprising at least a first terminal being able to change its method of network access and at least one other terminal with one or more possible intermediate computers between the first terminal and the other terminal performing network address and/or other translations, a secure communication link being established between an initial network address of the first terminal and the address of the other terminal, the link defining at least the addresses of the two terminals, and performing encapsulation in said secure communication link to overcome network address and/or other translations made by said intermediate computers on the route, comprising:

a) the first terminal moving from said initial network address to a new network address,

b) spending a request message using encapsulation from the first terminal to the other terminal to change said secure connection to be between the new address of the first terminal and the other terminal, the request also containing a description of the encapsulation method performed by the first terminal on the basis of which description the other terminal detects translations performed by said intermediate computers,

c) the other terminal responding to the first terminal with a reply message with a description about translations made by said possible intermediate computers between the new address of the first terminal and the other terminal and/or encapsulation methods supported by the other terminal, and

d) thereafter sending the message from the first terminal to the other terminal by using the information sent with said reply.

2. The method of claim 1 wherein the description of the message include source and/or destination addresses on the basis of which the receiving terminal detects address translations performed by intermediate computers.

3. The method of claim 1 wherein the description of the message includes information about encapsulation protocols, as well as source and destination TCP or UDP ports.

4. The method of claim 3 wherein the NAT traversal is performed by UDP encapsulation, TCP encapsulation and/or by another encapsulation.

5. The method of claim 1 wherein after receiving of the request message by said other terminal sent in step c), the other terminal determines by examining the request, which translations and/or encapsulations are required in the traffic between the first terminal and the other terminal.

6. The method of claim 5 wherein the reply message of step c) contains information about the communication link to be used between the new address of the first terminal and said other terminal.

7. The method of claim 6 wherein the information about the communication link includes information about whether NAT traversal and/or other encapsulation should be used.

8. The method of claim 1 wherein in step c) the first terminal compares the descriptions of the request respective reply messages and sends all subsequent messages from this new network address on the basis of the comparison telling what encapsulations, protocols and rules should be used in the further communication.

9. The method of claim 1 wherein the secure communication link is formed by using the IPSec protocol.

10. The method of claim 9 wherein the message in step d) is sent by using IPSec and NAT traversal updated to the new network address of the first terminal.

11. The method of claim 1 wherein the message in step d) is sent without NAT traversal in the communication link when the descriptions correspond to each other.

12. The method of claim 1 wherein the secure connection is an IPSec SA.

13. The method of claim 12 wherein a key exchange mechanism that passes through NAT is used when forming the IPSec SA.

14. The method of claim 12 wherein the key exchange protocol is IKE when the NAT device supports the UDP protocol.

15. The method of claim 14 wherein a key exchange mechanism is used when forming the IPSec SA and wherein several traversal mechanisms are used simultaneously to increase the chance that at least one of them pass through the NAT device.

16. The method of claim 12 wherein a key exchange mechanism is performed when forming the IPSec SA in which a negotiation process is used to agree on protocols to be used in the further communication.

17. The method of claim 12 wherein an encapsulation protocol is used in the key exchange mechanism when forming the IPSec SA.

18. The method of claim 1 wherein the address of the other terminal is the end destination address of messages sent from the first terminal, in which case transport or tunnel mode is used in the IPSec communication.

19. The method of claim 1 wherein the destination address of the message is the address of a host which is not the other terminal, in which case tunnel mode or transport mode together with a tunneling protocol is used in the IPSec communication.

20. The method of claim 1 wherein several request messages of step b) are sent, each processed using a different traversal mechanism, where after the other terminal indicates in the reply which methods is to be used in the further-communication.