Method for sending messages over secure mobile communication links

• US 7,346,926 B2
• Filed: 01/21/2003
• Issued: 03/18/2008
• Est. Priority Date: 01/22/2002
• Status: Expired due to Term

• Current Assignee: MPH Technologies Oy
• Original Assignee: Netseal Mobility Technologies
• Inventors: Nuopponen, Antti, Vaarala, Sami
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Cervetti; David Garcia
• Application Number:
  US10/500,928
• Publication Number:
  US 20050216725A1
• Time in Patent Office: 1,883 Days
• Field of Search: 726/14, 713/151
• US Class Current: 726/14
• CPC Class Codes: H04L 61/2532 Clique of NAT servers
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

Messages are sent over secure communication links in networks with a mobile terminal and another terminal. A secure communication link is established between an initial network address of the mobile terminal and the address of the other terminal. When the mobile terminal moves from the initial network address to a new network address, a request message is sent from the mobile terminal to the other terminal to change the secure connection to be used between the new address and the other terminal. The other terminal responds with a reply message with a description about the overcoming methods supported by the other terminal.

Claims

1. A method for sending messages over secure communication links in networks, comprising:

providing at least a first terminal in communication with a second terminal,

establishing a first secure communication link between an initial network address of the first terminal and a network address of the second terminal,

the first terminal performing encapsulation of messages sent in the first secure communication link using a first encapsulation method,

the first terminal moving from the initial network address to a new network address,

the first terminal sending an encapsulated request message, using the first encapsulation method, to the second terminal to change communication between the first terminal and the second terminal from the first secure communication link to a second secure communication link extending between the new network address of the first terminal and the network address of the second terminal, the encapsulated request message containing a description of the first encapsulation method performed by the first terminal,

the second terminal receiving the encapsulated request message,

the second terminal using the description of the first encapsulation method to detect translations of the encapsulated request message performed by intermediate computers disposed en route between the first terminal and the second terminal,

the second terminal responding to the first terminal with a reply message, the reply message having a description about detected translations made by intermediate computers disposed between the new network address of the first terminal and the network address of the second terminal and/or encapsulation methods supported by the second terminal,

the first terminal receiving the reply message and the description about translation made by intermediate computers and encapsulation methods supported by the second terminal, the first terminal selecting an encapsulation method to encapsulate a message based on the description of the reply message, and

the first terminal sending the encapsulated message to the second terminal.

2. The method of claim 1 wherein the method further comprises the second terminal detecting address translations performed by the intermediate computers and including a description to translated source and/or destination addresses in the reply message.

3. The method of claim 1 wherein the description of the reply message has information about encapsulation protocols, as well as source and destination transmission control protocol (TCP) or user datagram protocol (UDP) ports.

4. The method of claim 3 wherein the method further comprises performing network address translation (NAT) traversal by UDP encapsulation or TCP encapsulation.

5. The method of claim 1 wherein the method further comprises the second terminal examining the encapsulated request message to determine which translations and/or encapsulations are required in traffic between the first terminal and the second terminal.

6. The method of claim 5 wherein the reply message contains information about the second secure communication link to be used between the new network address of the first terminal and the second terminal.

7. The method of claim 6 wherein the information about the second secure communication link includes information about whether network address translation (NAT) traversal is used.

8. The method of claim 1, wherein the method further comprises the first terminal comparing the description of the request message with the description of the reply message and sending subsequent messages from the new network address based on the comparison of the descriptions regarding which encapsulations, protocols and rules to use.

9. The method of claim 1 wherein the first secure communication link is formed by using an Internet security protocol IPSec.

10. The method of claim 9 wherein the reply message is sent by using IPSec and a network address translation (NAT) traversal that is updated to the new network address of the first terminal.

11. The method of claim 1 wherein the reply message is sent without a network address translation (NAT) traversal in the first secure communication link when the description of the reply message corresponds to the description of the request message.

12. The method of claim 1 wherein the method further comprises providing a the secure connection with an Internet security protocol (IPSec) security association (SA).

13. The method of claim 12 wherein the method further comprises using a key exchange mechanism that passes through a network address translation (NAT) when forming the IPSec SA.

14. The method of claim 12 wherein a key exchange mechanism is an Internet key exchange (IKE) when a network address translation (NAT) device supports a user datagram protocol (UDP).

15. The method of claim 14 wherein the key exchange mechanism is used when forming the IPSec SA and wherein several traversal mechanisms are used simultaneously to increase a chance that at least one of the traversal mechanisms passes through the NAT device.

16. The method of claim 12 wherein a key exchange mechanism is performed when forming the IPSec SA in which a negotiation process is used to agree on protocols to be used in the further communication.

17. The method of claim 12 wherein an encapsulation protocol is used in a key exchange mechanism when forming the IPSec SA.

18. The method of claim 1 wherein the network address of the second terminal is an end destination address of messages sent from the first terminal and using case transport or tunnel mode in the first and second secure communication links.

19. The method of claim 1 wherein a destination address of the message is a network address of a host which is not the second terminal and using tunnel mode or transport mode together with a tunneling protocol the first and second secure communication links.

20. The method of claim 1 wherein several request messages are sent, each request message being processed using a different traversal mechanism and the second terminal indicating in the reply message which encapsulation method is to be used.