Method and apparatus for extending network address translation for unsupported protocols

• US 6,886,103 B1
• Filed: 10/27/2000
• Issued: 04/26/2005
• Est. Priority Date: 10/28/1999
• Status: Expired due to Fees

• Current Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Brustoloni, Jose C., Garay, Juan Alberto
• Primary Examiner(s): Morse, Gregory
• Assistant Examiner(s): TRAN, ELLEN C
• Application Number:
  US09/698,973
• Time in Patent Office: 1,642 Days
• Field of Search: 370/352, 370/392, 370/401, 709/217, 709/219, 709/229, 709/226, 713/160, 713/201
• US Class Current: 726/15
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2517 using port numbers
• CPC Class Codes: H04L 61/255 Maintenance or indexing of mapping tables
• CPC Class Codes: H04L 61/2564 for a higher-layer protocol, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 61/2585 through application level gateway [ALG]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

Clients that are connected on a private network and which are assigned a private IP address that is not routable on the Internet can connect to the Internet through a router/server that includes a network address translator (NAT). For outgoing packets, the NAT translates the client'"'"'s private source IP address and generalized port number (GPN) to the NAT'"'"'s global IP address and GPN. For incoming packets sent to the NAT'"'"'s global IP address and GPN, the NAT translates the global destination IP address and GPN to the client'"'"'s private IP address and GPN. For protocols which cannot be directly supported by the NAT, such as those in the IPSec security protocol suite, the NAT is extended by creating in the NAT'"'"'s translation table an entry that associates, for a specific unsupported protocol, a client'"'"'s private IP address and GPN, the NAT'"'"'s global IP address and GPN, and a foreign address on the Internet, that is valid until a specified or default expiration time. Outgoing packets from the client to that foreign address and incoming packets from that foreign address to the NAT'"'"'s global IP address and GPN are translated according to the entry until the entry expires. In associations with these translations to outgoing and incoming packets, the client implements any Application Layer Gateway (ALG) that would otherwise be implemented at the NAT. Further, at the client, outgoing packets are modified before being transmitted so as to pre-compensate for the effects of the translations. Incoming packets at the client from the NAT are similarly modified so as to post-compensate for the effects of the translations. For the IPSec protocol, these modification include adjusting the checksum in the TCP or UDP header to account for IP address and TCP or UDP port number translations.

Claims

1. A method comprising:

receiving a request from a client at a network address translator (NAT) that defines for a protocol not directly supported by the NAT a generalized port number (GPN) associated with that unsupported protocol and its location in each packet, the location comprising an indication of a bit position within a packet of where the GPN begins and a length of the GPN;

creating an entry in a translation table of the NAT that defines for that protocol an association between a client'"'"'s private IP address and GPN, a NAT'"'"'s assigned global IP address and GPN, and a foreign IP address, said entry being used for translating in outgoing packets received by the NAT from the client using that protocol and having the foreign IP address as their destination, the client'"'"'s private source IP address and GPN to the NAT'"'"'s global IP address and GPN, respectively, and for translating in incoming packets sent from the foreign IP address using that protocol to the NAT'"'"'s global destination IP address and GPN, the NAT'"'"'s global destination IP address and GPN to the client'"'"'s private destination IP address and GPN, respectively.

4. The method of claim 1, 2 or 3 wherein the entry further defines an expiration time until which the entry is valid for translating packets.

5. The method of claim 1, 2 or 3 wherein the unsupported protocol is a protocol in the IP Security (IPSec) security protocol suite.

6. The method of claim 5 wherein the unsupported protocol in the IPSec security suite is the Internet Security Association and Key Management Protocol (ISAKMP) and the GPN is an initiator cookie leased from the NAT to be unique to the client.

7. The method of claim 6 wherein the leased initiator cookie is chosen by the NAT to be used as both the client'"'"'s GPN and the NAT'"'"'s GPN.

8. The method of claim 5 wherein the unsupported protocol in the IPSec security suite is the AH or ESP protocol in either the tunnel or transport modes, and the GPN is an incoming Security Parameter Index (SPI) leased from the NAT to be unique to the client.

9. The method of claim 8 wherein the leased SPI is chosen by the NAT to be used as both the client'"'"'s GPN and the NAT'"'"'s GPN.

2. A method comprising:

receiving a request from a client at a network address translator (NAT) that defines for a protocol not directly supported by the NAT a generalized port number (GPN) associated with that unsupported protocol and its location in each packet, the location comprising an indication of a bit position within a packet of where the GPN begins and a length of the GPN;

creating an entry in a translation table of the NAT that defines for that protocol an association between a client'"'"'s private IP address and GPN, NAT'"'"'s assigned global IP address and GPN, and a foreign IP address; and

in outgoing packets received by the NAT from the client using that protocol and having the foreign IP address as their destination, translating in accordance with the entry, the client'"'"'s private source IP address and GPN to the NAT'"'"'s global IP address and GPN, respectively.

3. A method comprising:

receiving a request from a client at a network address translator (NAT) that defines for a protocol not directly supported by the NAT a generalized port number (GPN) associated with that unsupported protocol and its location in each packet, the location comprising an indication of a bit position within a packet of where the GPN begins and a length of the GPN;

creating an entry in a translation table of the NAT that defines for that protocol an association between a client'"'"'s private IP address and GPN, a NAT'"'"'s assigned global IP address and GPN, and a foreign IP address; and

in incoming packets received by the NAT and sent from the foreign IP address using that protocol to the NAT'"'"'s global destination IP address and GPN, translating in accordance with the entry, the NAT'"'"'s global destination IP address and GPN to the client'"'"'s private destination IP address and GPN, respectively.

10. A network address translator (NAT) comprising:

means for receiving a request from a client that defines for a protocol not directly supported by the NAT a generalized port number (GPN) associated with that unsupported protocol and its location in each packet, the location comprising an indication of a bit position within a packet of where the GPN begins and a length of the GPN;

memory means for storing a translation table;

means for creating an entry in the translation table that defines for that protocol an association between a client'"'"'s private IP address and GPN, a NAT'"'"'s assigned global IP address and GPN, and a foreign IP address, said entry being used for translating in outgoing packets received by the NAT from the client using that protocol and having the foreign IP address as their destination, the client'"'"'s private source IP address and GPN to the NAT'"'"'s global IP address and GPN, respectively, and for translating in incoming packets sent from the foreign IP address using that protocol to the NAT'"'"'s global destination IP address and GPN, the NAT'"'"'s global destination IP address and GPN to the client'"'"'s private destination IP address and GPN, respectively.

13. The NAT of claim 10, 11 or 12 wherein the entry further defines an expiration time until which the entry is valid for translating packets.

14. The NAT of claim 10, 11 or 12 wherein the unsupported protocol is a protocol in the IP Security (IPSec) security protocol suite.

15. The NAT of claim 14 wherein the unsupported protocol in the IPSec security suite is the Internet Security Association and Key Management Protocol (ISAKMP) and the GPN is an initiator cookie leased from the NAT to be unique to the client.

16. The NAT of claim 15 wherein the leased initiator cookie is chosen by the NAT to be used as both the client'"'"'s GPN and the NAT'"'"'s GPN.

17. The NAT of claim 14 wherein the unsupported protocol in the IPSec security suite is the AH or ESP protocols in tunnel or transport modes, and the GPN is an incoming Security Parameter Index (SPI) leased from the NAT to be unique to the client.

18. The NAT of claim 17 wherein the leased SPI is chosen by the NAT to be used as both the client'"'"'s GPN and the NAT'"'"'s GPN.

11. A network address translator (NAT) comprising:

means for receiving a request from a client at a network address translator (NAT) that defines for a protocol not directly supported by the NAT a generalized port number (GPN) associated with that unsupported protocol and its location in each received packet, the location comprising an indication of a bit position within a packet of where the GPN begins and a length of the GPN;

memory means for storing a translation table;

means for creating an entry in the translation table that defines for that protocol an association between a client'"'"'s private IP address and GPN, NAT'"'"'s assigned global IP address and GPN, and a foreign IP address; and

means for, in outgoing packets received by the NAT from the client using that protocol and having the foreign IP address as their destination, translating in accordance with the entry, the client'"'"'s private source IP address and GPN to the NAT'"'"'s global IP address and GPN, respectively.

12. A network address translator (NAT) comprising:

means for receiving a request from a client that defines for a protocol not directly supported by the NAT a generalized port number (GPN) associated with that unsupported protocol and its location in each packet, the location comprising an indication of a bit position within a packet of where the GPN begins and a length of the GPN;

memory means for storing a translation table;

means for creating an entry in the translation table that defines for that protocol an association between a client'"'"'s private IP address and GPN, a NAT'"'"'s assigned global IP address and GPN, and a foreign IP address; and

means for, in incoming packets received by the NAT and sent from the foreign IP address using that protocol to the NAT'"'"'s global destination IP address and GPN, translating in accordance with the entry, the NAT'"'"'s global destination IP address and GPN to the client'"'"'s private destination IP address and GPN, respectively.

19. A computer readable media tangibly embodying a program of instructions executable by a computer to perform a method at a network address translator (NAT), the method comprising:

receiving a request from a client that defines for a protocol not directly supported by the NAT a generalized port number (GPN) associated with that unsupported protocol and its location in each packet, the location comprising an indication of a bit position within a packet of where the GPN begins and a length of the GPN;

creating an entry in a translation table of the NAT that defines for that protocol an association between a client'"'"'s private IP address and GPN, a NAT'"'"'s assigned global IP address and GPN, and a foreign IP address, said entry being used for translating in outgoing packets received by the NAT from the client using that protocol and having the foreign IP address as their destination, the client'"'"'s private source IP address and GPN to the NAT'"'"'s global IP address and GPN, respectively, and for translating in incoming packets sent from the foreign IP address using that protocol to the NAT'"'"'s global destination IP address and GPN, the NAT'"'"'s global destination IP address and GPN to the client'"'"'s private destination IP address and GPN, respectively.

22. The media of claim 19, 20 or 21 where in the method the entry further defines an expiration time until which the entry is valid for translating packets.

23. The media of claim 19, 20 or 21 where in the method the unsupported protocol is a protocol in the IP Security (IPSec) security protocol suite.

24. The media of claim 23 wherein the unsupported protocol in the IPSec security suite is the Internet Security Association and Key Management Protocol (ISAKMP) and the GPN is an initiator cookie leased from the NAT to be unique to the client.

25. The media of claim 24 wherein the leased initiator cookie is chosen by the NAT to be used as both the client'"'"'s GPN and the NAT'"'"'s GPN.

26. The media of claim 23 wherein the unsupported protocol in the IPSec security suite is the AH or ESP protocol in either the tunnel or transport modes, and the GPN is an incoming Security Parameter Index (SPI) leased from the NAT to be unique to the client.

27. The method of claim 26 wherein the leased SPI is chosen by the NAT to be used as both the client'"'"'s GPN and the NAT'"'"'s GPN.

20. A computer readable media tangibly embodying a program of instructions executable by a computer to perform a method at a network address translator (NAT), the method comprising:

receiving a request from a client that defines for a protocol not directly supported by the NAT a generalized port number (GPN) associated with that unsupported protocol and its location in each packet, the location comprising an indication of a bit position within a packet of where the GPN begins and a length of the GPN;

creating an entry in a translation table of the NAT that defines for that protocol an association between a client'"'"'s private IP address and GPN, NAT'"'"'s assigned global IP address and GPN, and a foreign IP address; and

in outgoing packets received by the NAT from the client using that protocol and having the foreign IP address as their destination, translating in accordance with the entry, the client'"'"'s private source IP address and GPN to the NAT'"'"'s global IP address and GPN, respectively.

21. A computer readable media tangibly embodying a program of instructions executable by a computer to perform a method at a network address translator (NAT), the method comprising:

receiving a request from a client that defines for a protocol not directly supported by the NAT a generalized port number (GPN) associated with that unsupported protocol and its location in each packet, the location comprising an offset of the GPN within each packet and a length of the GPN;

creating an entry in a translation table of the NAT that defines for that protocol an association between a client'"'"'s private IP address and GPN, a NAT'"'"'s assigned global IP address and GPN, and a foreign IP address; and

in incoming packets received by the NAT and sent from the foreign IP address using that protocol to the NAT'"'"'s global destination IP address and GPN, translating in accordance with the entry, the NAT'"'"'s global destination IP address and GPN to the client'"'"'s private destination IP address and GPN, respectively.