Method and system for controlling attacks on distributed network address translation enabled networks
First Claim
1. A method for distributed network address translation with security, comprising the following steps:
- providing a first network device and a second network device on a first network;
negotiating and establishing a security association between the first network device and a third network device on a second network external to the first network, the second network device being positioned between the first network device and the third network device;
specifying an external address of the third network device for the security association;
storing the external address in a table on the second network device; and
mapping at least one of an internal address and a security value to the external address in the table.
6 Assignments
0 Petitions
Accused Products
Abstract
A method and system for distributed network address translation with security for controlling and limiting the disruption caused by denial of service attacks. The method and system have a first network device and a second network device on a first network, and a third network device on a second network external to the first network, with an established security association between the first network device and the third network device. The first network device specifies an external address of the third network device for the security association to the second network device, which stores the external address in a table. The second network device then maps at least one of an internal address and a security value to the external address in the table. Any packets sent from the third network device to the first network device are intercepted by the second network device, which determines the external address and security value of the packet. If the security value of the packet has been allocated to the first network device, and the external address of the packet has been specified by the first network device as being valid, the packet is sent from the second network device to the first network device using distributed network address translation with security. Otherwise, the packet is discarded by the second network device.
-
Citations
20 Claims
-
1. A method for distributed network address translation with security, comprising the following steps:
-
providing a first network device and a second network device on a first network; negotiating and establishing a security association between the first network device and a third network device on a second network external to the first network, the second network device being positioned between the first network device and the third network device; specifying an external address of the third network device for the security association; storing the external address in a table on the second network device; and mapping at least one of an internal address and a security value to the external address in the table. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A method for distributed network address translation with security, comprising the following steps:
-
providing a first network device and a second network device on a first network, and a third network device on a second network external to the first network, the second network device being positioned between the first network device and the third network device; sending a packet having an external address and a security value from the third network device to the first network device; intercepting the packet with the second network device; determining whether the security value of the packet has been allocated to the first network device; determining whether the external address of the packet has been specified by the first network device as being valid; and sending the packet from the second network device to the first network device if the security value has been allocated to the first network device and the external address of the packet has been specified by the first network device as valid, thereby confirming that a security association has been negotiated and established between the first network device and the third network device. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. A system for distributed network address translation with security comprising:
-
a routing network device using distributed network address translation with security to provide routing services for a plurality of internal and external network devices, the routing network device being positioned between an internal network device and an external network device; and an established security association table associated with the routing network device for storing external addresses of external network devices that have negotiated and established security associations with internal network devices, and mapping external addresses that have been specified as valid by the internal network devices to one of internal network addresses and security values for established security associations.
-
Specification