Security system for network address translation systems

• US 6,510,154 B1
• Filed: 08/10/1998
• Issued: 01/21/2003
• Est. Priority Date: 11/03/1995
• Status: Expired due to Term

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Coile, Brantley W., Mayes, John C.
• Primary Examiner(s): Olms, Douglas
• Assistant Examiner(s): HOM, SHICK C
• Application Number:
  US09/131,812
• Time in Patent Office: 1,625 Days
• Field of Search: 370/389, 370/392, 370/395, 370/401, 370/402, 370/466, 370/252, 370/349, 370/400, 370/465, 370/522, 370/352, 370/338, 370/397, 370/395.52, 371/37.01, 395/186, 395/187.01, 395/188.01, 380/49, 713/201, 713/200, 709/245, 709/249, 709/250
• US Class Current: 370/389
• CPC Class Codes: H01R 2201/04 for network, e.g. LAN connectors
• CPC Class Codes: H01R 31/005 Intermediate parts for distributing signals
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2564 for a higher-layer protocol, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 69/40 for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method are provided for translating local IP addresses to globally unique IP addresses. This allows local hosts in an enterprise network to share global IP addresses from a limited pool of such addresses available to the enterprise. The translation is accomplished by replacing the source address in headers on packets destined for the Internet and by replacing destination address in headers on packets entering the local enterprise network from the Internet. Packets arriving from the Internet are screened by an adaptive security algorithm. According to this algorithm, packets are dropped and logged unless they are deemed nonthreatening. DNS packets and certain types of ICMP packets are allowed to enter local network. In addition, FTP data packets are allowed to enter the local network, but only after it has been established that their destination on the local network initiated an FTP session.

Claims

1. A method of passing a packet between a local network and nodes outside of the local network, the method comprising:

receiving the packet;

identifying a first network layer address on the packet that matches a second network layer address in an address translation list specifying combinations of IP addresses of hosts on the local network with globally unique IP addresses from a pool of globally unique IP addresses available for use by the hosts on the local network;

translating the matching first network layer address on the packet to a corresponding third network layer address specified in the translation list wherein a non-globally unique IP address of the host is translated to one of said globally unique IP addresses available from the pool when the packet is sent from the local network and one of said globally unique IP addresses identified as one from the pool is translated to said non-globally unique IP address of the host when the packet is directed to the local network; and

matching the packet against at least one security criterion.

2. The method of claim 1, wherein the packet is received at an interface of the local network.

3. The method of claim 2, wherein the interface is located between the local network and the Internet.

4. The method of claim 1, wherein a network layer address translation system translates the network layer address on the packet.

5. The method of claim 1, wherein the network layer address is a destination network layer address on the packet when the packet is directed to the local network or a source network layer address on the packet when the packet is sent from the local network.

6. The method of claim 1, wherein the network layer address is a globally unique destination network layer address on the packet and the packet is directed to the local network, and wherein the globally unique destination network layer address is translated to a network layer address of a host on the local network.

7. The method of claim 1, wherein the network layer address is a source network layer address on the packet and the packet is sent from the local network, and wherein the source network layer address is translated to a globally unique network layer address.

8. The method of claim 1, wherein the at least one security criterion includes:

(a) determining that the packet indicates that a data connection is to be opened, and

(b) determining whether a control connection exists for the data connection.

9. The method of claim 1, further comprising forwarding the packet to a destination if it meets the at least one security criterion.

10. The method of claim 2, further comprising blocking transmission of the packet to its destination if it does not meet the at least one security criterion.

11. An apparatus configured to provide network connections between nodes on a local network and nodes outside the local network, the apparatus comprising:

a processor;

a memory in communication with the processor;

a collection of global IP addresses available to the nodes on the local network;

an address translation list including at least one translation, each specifying a local network layer address of a local node and an associated global unique network layer address; and

a firewall specifying at least one security criterion and configured to protect the local network from packets that pose a security risk,

wherein at least one of the processor and the memory is configured to match IP addresses in packets against IP addresses of entries in the address translation list,

wherein non-globally unique IP address of the local node is matched to a globally unique IP address available from the collection when the packet is sent from the local network and a globally unique IP address identified as one from the collection is matched to a non-globally unique IP address of the local node when the packet is directed to the local network.

12. The apparatus of claim 11, wherein at least one entry of the address translation list includes information defining a connection between said local node of the local network and a foreign host outside the local network.

13. The apparatus of claims 11, further comprising an outside interface connected to an external network and an inside interface connected to the local network.

14. The apparatus of claim 11, wherein the apparatus is a network device including a plurality of ports for communication with at least one network medium, and associated logic controlling communications through the ports.

15. The apparatus of claim 11, wherein the at least one security criterion includes, when a packet indicates that a data connection is to be opened, determining whether a control connection exists for the data connection.

16. A machine readable medium on which is stored instructions for passing a packet between a local network and nodes outside of the local network, the instructions specifying a method comprising:

receiving the packet;

identifying a first network layer address on the packet that matches a second network layer address in an address translation list specifying combinations of IP addresses of hosts on the local network with globally unique IP addresses from a pool of globally unique IP addresses available for use by the hosts on the local network;

translating the matching first network layer address on the packet to a corresponding third network layer address specified in the translation list, wherein a non-globally unique IF address of the host is translated to one of said globally unique IP addresses available from the pool when the packet is sent from the local network and one of said globally unique IP addresses identified as one from the pool is translated to said non-globally unique IP address of the host when the packet is directed to the local network, and

matching the packet against at least one security criterion.

17. The machine readable medium of claim 16, further comprising instructions for forwarding the packet to a destination if it meets the one or more security criteria.

18. The machine readable medium of claim 16, further comprising instructions for blocking transmission of the packet to its destination if it does not meet the at least one security criterion.

19. The machine readable medium of claim 16, wherein the medium is a memory for use in a network layer address translation system.

20. The machine readable medium of claim 16, wherein the network layer address is a destination network layer address on the packet when the packet is directed to the local network or a source network layer address on the packet when the packet is sent from the local network.

21. The machine readable medium of claim 16, wherein the network layer address is a globally unique destination network layer address on the packet and the packet is directed to the local network, and wherein the globally unique destination network layer address is translated to a network layer address of a host on the local network.

22. The machine readable medium of claim 16, wherein the network layer address is a source network layer address on the packet and the packet is sent from the local network, and wherein the source network layer address is translated to a globally unique layer address.