METHOD AND ARRANGEMENT FOR PROVIDING SECURITY THROUGH NETWORK ADDRESS TRANSLATIONS USING TUNNELING AND COMPENSATIONS
1 Assignment
0 Petitions
Accused Products
Abstract
This invention provides a method for providing network security services, such as those provided by the IPSEC protocol, through network address translation (NAT). The method is based on determining the transformations that occur on a packet and compensating for the transformations. Because only TCP and UDP protocols work through NATs, the IPSEC AH/ESP packets are encapsulated into UDP packets for transport. Special operations are performed to allow reliable communications in such environments.
54 Citations
32 Claims
-
1-23. -23. (canceled)
-
24. A method comprising:
-
receiving, by a computer device, a packet comprising an encoding of an address from which the packet was sent in a payload of the packet; and determining based on the encoding of the address in the payload of the packet and an address in the header of the packet that a network address translation occurred on the packet. - View Dependent Claims (25, 26)
-
-
27. An apparatus comprising at least one processor, and at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus to
determine from a received packet comprising an encoding in a payload of the packet of an address from which the packet was sent whether the address in the encoding is different from an address in the header of the packet; - and
determine that a network address translation occurred on the packet in response to determination that the address in the encoding in the payload of the packet is different from the address in the header of the packet. - View Dependent Claims (28, 29)
- and
-
30. A non-transitory computer readable media for revealing occurrence of network address translations, comprising program code for causing a processor to perform instructions for
receiving a packet comprising an encoding of an address from which the packet was sent in a payload of the packet; - and
determining based on the encoding of the address in the payload of the packet and an address in the header of the packet that a network address translation occurred on the packet. - View Dependent Claims (31, 32)
- and
Specification