NETWORK DEVICE, IPSEC SYSTEM AND METHOD FOR ESTABLISHING IPSEC TUNNEL USING THE SAME

• US 20140351590A1
• Filed: 03/25/2014
• Published: 11/27/2014
• Est. Priority Date: 05/23/2013
• Status: Active Grant

• Current Assignee: SerComm Corporation
• Original Assignee: SerComm Corporation
• Inventors: Lien, Chia-Hao
• Granted Patent: US 9,602,470 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2592 using tunnelling or encapsulation
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A network device is provided. The network device is connected to a number of slave network devices. Each slave network device communicates with the network device by using an Internet protocol (IP) address. The network device includes an Internet protocol security (IPsec) module and a network address translation (NAT) module. The IPsec module establishes an IPsec tunnel to a network gateway in the Internet and retrieves an IPsec IP address corresponding to the IPsec tunnel. The NAT module converts the IP addresses of the slave network devices to the IPsec IP address, such that the slave network devices use the IPsec IP address to communicate with the network gateway through the IPsec tunnel.

Claims

1. A network device for connecting a plurality of slave network devices, each of the slave network devices communicating with the network device by using an Internet protocol (IP) address, the network device comprising:

an Internet protocol security (IPsec) module for establishing an IPsec tunnel to a network gateway in the Internet and retrieving an IPsec IP address corresponding to the IPsec tunnel; and

a network address translation (NAT) module for converting the IP addresses of the slave network devices to the IPsec IP address, such that the slave network devices use the IPsec IP address to communicate with the network gateway through the IPsec tunnel.

2. The network device according to claim 1, wherein the network device is a cellular base station, a router, or a wireless access point (AP), each of the slave network devices is a cellular base station, a router, a wireless AP, or a mobile device, and the network gateway is a security gateway.

3. The network device according to claim 1, wherein the IPsec module comprises an encryption unit and a decryption unit, the encryption unit encrypts a packet transmitted by the IPsec module to the network gateway, the decryption unit decrypts an encrypted packet received from the network gateway.

4. The network device according to claim 1, wherein the slave network devices communicate with the network device by using different private IP addresses, the NAT module converts the private IP addresses of the slave network devices to the IPsec address, and the NAT module records the relationship between the private IP addresses of the slave network devices and ports of the network device in a NAT lookup table.

5. The network device according to claim 1, wherein the slave network devices communicate with the network device by using different private IP addresses, the NAT module converts the IPsec address to the private IP addresses of the slave network devices, and the NAT module records the relationship between the private IP addresses of the slave network devices and ports of the network device in a NAT lookup table.

6. The network device according to claim 1, wherein the IPsec module is configured in IPsec tunnel mode to establish the IPsec tunnel to the network gateway in the Internet.

7. An IPsec system, comprising:

a network gateway for connecting an intranet, the intranet being connected to the Internet via the network gateway; and

a network device for connecting a plurality of slave network devices, each of the slave network devices communicating with the network device by using an IP address, the network device comprising;

an IPsec module for establishing an IPsec tunnel to the network gateway in the Internet and retrieving an IPsec IP address corresponding to the IPsec tunnel; and

a NAT module for converting the IP addresses of the slave network devices to the IPsec IP address, such that the slave network devices use the IPsec IP address to communicate with the network gateway through the IPsec tunnel.

8. The IPsec system according to claim 7, wherein the network device is a cellular base station, a router, or a wireless AP, each of the slave network devices is a cellular base station, a router, a wireless AP, or a mobile device, and the network gateway is a security gateway.

9. The IPsec system according to claim 7, wherein the IPsec module comprises an encryption unit and a decryption unit, the encryption unit encrypts a packet transmitted by the IPsec module to the network gateway, the decryption unit decrypts an encrypted packet received from the network gateway.

10. The IPsec system according to claim 7, wherein the slave network devices communicate with the network device by using different private IP addresses, the NAT module converts the private IP addresses of the slave network devices to the IPsec address, and the NAT module records the relationship between the private IP addresses of the slave network devices and ports of the network device in a NAT lookup table.

11. The IPsec system according to claim 7, wherein the slave network devices communicate with the network device by using different private IP addresses, the NAT module converts the IPsec address to the private IP addresses of the slave network devices, and the NAT module records the relationship between the private IP addresses of the slave network devices and ports of the network device in a NAT lookup table.

12. The IPsec system according to claim 7, wherein the network gateway comprises an encryption unit and a decryption unit, the encryption unit encrypts a packet transmitted by the network gateway to the network device, the decryption unit decrypts an encrypted packet received from the network device.

13. The IPsec system according to claim 7, wherein the IPsec module is configured in IPsec tunnel mode to establish the IPsec tunnel to the network gateway in the Internet.

14. A method for establishing IPsec tunnel, comprising:

establishing an IPsec tunnel from a network device to a network gateway and retrieving an IPsec IP address corresponding to the IPsec tunnel, the network device connecting a plurality of slave network devices, each of the slave network devices communicating with the network device by using an IP address; and

converting the IP addresses of the slave network devices to the IPsec IP address, such that the slave network devices use the IPsec IP address to communicate with the network gateway through the IPsec tunnel.

15. The method according to claim 14, wherein the step of establishing the IPsec tunnel from the network device to the network gateway is configured in IPsec tunnel mode.

16. The method according to claim 14, wherein the step of converting the IP addresses of the slave network devices to the IPsec IP address is performed by a NAT method.

17. The method according to claim 16, wherein the NAT method converts different private IP addresses of the slave network devices to the IPsec address and records the relationship between the private IP addresses of the slave network devices and ports of the network device in a NAT lookup table.