Method and system for distributed network address translation with network security features

• US 7,032,242 B1
• Filed: 03/17/1999
• Issued: 04/18/2006
• Est. Priority Date: 03/05/1998
• Status: Expired due to Term

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: 3Com Corporation (HP Inc.)
• Inventors: Grabelsky, David, Borella, Michael S., Nessett, Danny M., Sidhu, Ikhlaq
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): NOBAHAR, ABDULHAKIM
• Application Number:
  US09/270,967
• Time in Patent Office: 2,589 Days
• Field of Search: 713/201, 370/351, 370/356, 370/389
• US Class Current: 726/11
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2528 Translation at a proxy
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A method and system for distributed network address translation with security features. The method and system allow Internet Protocol security protocol (“IPsec”) to be used with distributed network address translation. The distributed network address translation is accomplished with IPsec by mapping a local Internet Protocol (“IP”) address of a given local network device and a IPsec Security Parameter Index (“SPI”) associated with an inbound IPsec Security Association (“SA”) that terminates at the local network device. A router allocates locally unique security values that are used as the IPsec SPIs. A router used for distributed network address translation is used as a local certificate authority that may vouch for identities of local network devices, allowing local network devices to bind a public key to a security name space that combines a global IP address for the router with a set of locally unique port numbers used for distributed network address translation. The router issues security certificates and may itself be authenticated by a higher certificate authority. Using a security certificate, a local network device may initiate and be a termination point of an IPsec security association to virtually any other network device on an IP network like the Internet or an intranet. The method and system may also allow distributed network address translation with security features to be used with Mobile IP or other protocols in the Internet Protocol suite.

Claims

1. A method for distributed network address translation with security, comprising the following steps:

at a first network device on a first computer network, requesting with a first protocol, one or more locally unique security values from a second network device on the first computer network, wherein the second network device has a publicly routable address, and wherein the second network device'"'"'s publicly routable address in combination with the one or more locally unique security values are used to uniquely identify the first network device during secure communications with a third network device on a second external network;

receiving the one or more locally unique security values on the first network device from the second network device with the first protocol; and

storing the one or more locally unique security values on the first network device, wherein the one or more locally unique security values are used to create a secure virtual connection for secure communications between the first network device and the third network device, wherein the secure communications include the one or more locally unique secure values, and wherein the second network device routes secure communication data from the third network device to the first network device in response to the one or more locally unique security values.

3. The method of claim 1 wherein the one or more locally unique security values are one or more security parameter indexes for an Internet Protocol security protocol.

4. The method of claim 3 wherein the Internet Protocol security protocol is any of an Authentication Header protocol, Encapsulated Security Payload protocol or an Internet Key Exchange protocol.

5. The method of claim 1 wherein the first protocol is a Port Allocation Protocol.

6. The method of claim 1 wherein the requesting step further includes requesting one or more locally unique ports used to uniquely identify the first network device on the first network, wherein prior to establishing a secure connection, the second network device'"'"'s publicly routable address in combination with the one or more locally unique ports are used to uniquely identify the first network device.

7. The method of claim 6 wherein the locally unique ports are Port Allocation Protocol ports.

2. A computer readable medium having stored therein instructions for causing a central processing unit to execute the steps of:

at a first network device on a first computer network, requesting with a first protocol, one or more locally unique security values from a second network device on the first computer network, wherein the second network device has a publicly routable address, and wherein the second network device'"'"'s publicly routable address in combination with the one or more locally unique security values are used to uniquely identify the first network device during secure communications with a third network device on a second external network;

receiving the one or more locally unique security values on the first network device from the second network device with the first protocol; and

storing the one or more locally unique security values on the first network device, wherein the one or more locally unique security values are used to create a secure virtual connection for secure communications between the first network device and the third network device, wherein the secure communications include the one or more locally unique secure values, and wherein the second network device routes secure communication data from the third network device to the first network device in response to the one or more locally unique security values.

8. A method for distributed network address translation with security, comprising the following steps:

receiving a request message with a first protocol on a second network device for one or more locally unique security values from a first network device;

allocating one of more locally unique security values on the second network device;

storing a locally unique network address for the first network device with the one or more locally unique security values in a table associated with the second network device, wherein the table is used to maintain a mapping between a network device and one or more locally unique security values for distributed network address translation; and

sending the one or more locally unique security values in a response message with the first protocol to the first network device, wherein the second network device has a publicly routable address, and wherein the second network device'"'"'s publicly routable address in combination with the one or more locally unique security values are used to uniquely identify the first network device during secure communications with a third network device on a second external network, and wherein the secure communications include the one or more locally unique secure values, and wherein the second network device routes secure communication data from the third network device to the first network device in response to the one or more locally unique security values.

9. A computer readable medium having stored therein instructions for causing a central processing unit to execute the method of claim 8.

10. The method of claim 8 wherein the one or more locally unique security values include one or more security parameter indexes for an Internet Protocol Security Protocol.

11. The method of claim 9 wherein the Internet Protocol security protocol is any of an Authentication Header protocol, Encapsulated Security Payload protocol or an Internet Key Exchange protocol.

12. A method for distributed network address translation using security, comprising the following steps:

receiving a first message in a second secure protocol on a first network device on a first network to establish a secure virtual connection to the first network device from a third network device on a second external network;

selecting a locally unique security value to use for the secure virtual connection from a list of locally unique security values, wherein the list of locally unique security values was received from a second network device on the first network with a first protocol; and

sending a second message with second secure protocol to establish a secure virtual connection to the first network device on the first network from the third network device on the second external network wherein the second message includes the selected locally unique security value and security certificate sent to the first network device by the second network device, wherein the second network device has a publicly routable address, and wherein the second network device'"'"'s publicly routable address in combination with the locally unique security value are used to uniquely identify the first network device during secure communications with the third network device on the second external network, and wherein the secure communications include the one or more locally unique secure values, and wherein the second network device routes secure communication data from the third network device to the first network device in response to the one or more locally unique security values.

13. A computer readable medium having stored therein instructions for causing a central processing unit to execute the method of claim 12.

14. The method of claim 12 wherein the list of one or more locally unique security values is a list of one or more security parameter indexes for Internet Protocol security protocol.

15. The method of claim 12 wherein the Internet Protocol security protocol is any of an Authentication Header protocol, Encapsulated Security Payload protocol, or an Internet Key Exchange Protocol.

16. The method of claim 12 wherein the first protocol is a Port Allocation Protocol and the second secure protocol is an Internet Protocol security protocol.

17. The method of claim 12 wherein the secure virtual connection is an Internet Protocol security protocol security association.

18. A method for distributed network address translation with security, comprising the following steps:

sending a request message in a second secure protocol from a first network device on a first network to a second network device on the first network, wherein the request message in the second secure protocol includes security information;

routing the request message from the second network device to a third network device on a second external network over a secure virtual connection between the first network device and the third network device;

receiving a reply message in the second secure protocol from the third network device on the second network device on the first network for the first network device, wherein the reply message in the second secure protocol includes security information from the request message allocated by the second network device, wherein the second network device has a publicly routable address, and wherein the second network device'"'"'s publicly routable address in combination with the security information are used to uniquely identify the first network device during secure communications with the third network device on the second external network; and

routing the reply message from the second network device to the first network device on the first network using one or more locally unique ports associated with the security information and used for distributed network address translation.

19. A computer readable medium having stored therein instructions for causing a central processing unit to execute the method of claim 18.

20. The method of claim 18 wherein the step of sending a request message in a second secure protocol includes:

constructing a virtual tunnel header for a local network address determined for the second network device;

prepending the virtual tunnel header to the request message, wherein the virtual tunnel header is used to create a virtual tunnel between the first network device and the second network device;

sending the request message to the second network device from the first network device over the virtual tunnel.

21. The method of claim 18 wherein the step of routing the reply from the second network device to the first network device on the first network using the locally unique port from the reply in the second secure protocol includes:

determining a local network address for the first network device using the locally unique port associated with the second network device;

constructing a virtual tunnel header for the determined local network address for the first network device;

prepending the virtual tunnel header to the reply message, wherein the virtual tunnel header is used to create a virtual tunnel between the second network device and the first network device;

forwarding the reply message to the first network device from the second network device over the virtual tunnel.

22. The method of claim 21 wherein the local network address is an Internet Protocol address and the virtual tunnel header is an Internet Protocol tunnel header.

23. The method of claim 18 wherein the second secure protocol is an Internet Protocol security protocol.

24. The method of claim 23 wherein the Internet Protocol security protocol is any of an Authentication Header protocol, Encapsulated Security Payload protocol, or an Internet Key Exchange protocol.

25. The method of claim 18 wherein the security information includes any of a locally unique security value or a security certificate.

26. A method for distributed network address translation with security, comprising the following steps:

requesting one or more locally unique ports with a first message from a first protocol on a first network device from a second network device, wherein the one or more locally unique ports are used for distributed network address translation;

requesting one or more locally unique security values with a first message from the first protocol from the second network device, wherein the one or more locally unique security values are used with a second secure protocol to establish a secure virtual connection between the first network device and a third network device on a second external computer network, wherein the second network device has a publicly routable address, and wherein the second network device'"'"'s publicly routable address in combination with the one or more locally unique security values are used to uniquely identify the first network device during secure communications with the third network, and wherein the secure communications include the one or more locally unique secure values, and wherein the second network device routes secure communication data from the third network device to the first network device in response to the one or more locally unique security values;

requesting a security certificate on the first network device from the second network device, wherein the security certificate includes a binding between a public encryption key and a combination of a network address for the first network device and the one or more locally unique ports.

27. A computer readable medium having stored therein instructions for causing a central processing unit to execute the method of claim 26.

28. The method of claim 26 wherein the one or more locally unique security values are security parameter indexes from an Internet Protocol security protocol.

29. The method of claim 26 wherein the second network device is a distributed network address translation router.

30. The method of claim 26 further comprising:

establishing a secure virtual connection between the first network device and the third network device on the second external network using the security certificate.

31. The method of claim 30, wherein the secure virtual connection is an Internet Protocol security protocol security association.

32. A method for distributed network address translation with security features comprising the following steps:

sending one or more locally unique ports allocated on a second network device on a first computer network to a first network device on the first computer network with a second message in a first protocol wherein the one or more locally unique ports are used for distributed network address translation;

sending one or more locally unique security values allocated on the second network device to the first network device with a second message from the first protocol wherein the one or more locally unique security values are used with a second secure protocol to establish a secure virtual connection between the first network device and a third network device on a second external computer network and are used for distributed network address translation with security, wherein the second network device has a publicly routable address, and wherein the second network device'"'"'s publicly routable address in combination with the one or more locally unique security values are used to uniquely identify the first network device during secure communications with the third network device on the second external network, and wherein the secure communications include the one or more locally unique secure values, and wherein the second network device routes secure communication data from the third network device to the first network device in response to the one or more locally unique security values;

sending a security certificate created on the second network device to the first network device, wherein the second network device provides local security certificate services on the first computer network and wherein the security certificate includes a binding for a public encryption key for the first network device and a combination of a network address for the first network device and the one or more locally unique ports allocated to the first network device to authenticate an identity for the first network device for a secure virtual connection between the first network device and a third network device on a second external computer network.

33. A computer readable medium having stored therein instructions for causing a central processing unit to execute the method of claim 32.