Wireless network security mechanism including reverse network address translation

• US 7,516,174 B1
• Filed: 11/02/2004
• Issued: 04/07/2009
• Est. Priority Date: 11/02/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Systems, Inc.
• Inventors: Wang, Jing, Vakil, Sumit, Tashjian, Robert W.
• Primary Examiner(s): Meky; Moustafa M
• Assistant Examiner(s): SALL, EL HADJI MALICK
• Application Number:
  US10/979,409
• Time in Patent Office: 1,617 Days
• Field of Search: 709/229, 709/249, 709/203, 709/219, 709/224, 709/245, 455/403, 455/410, 455/411, 455/424, 726/15
• US Class Current: 709/200
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 61/2539 Hiding addresses; Keeping addresses anonymous
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Methods, apparatuses and systems directed to preventing unauthorized access to internal network addresses transmitted across wireless networks. According to the invention, mobile stations are assigned virtual client network addresses that are used as the outer network addresses in a Virtual Private Network (VPN) infrastructure, as well as unique internal network addresses used as the inner network addresses. In one implementation, the virtual client network addresses have little to no relation to the internal network addressing scheme implemented on the network domain. In one implementation, all clients or mobile stations are assigned the same virtual client network address. A translation layer, in one implementation, intermediates the VPN session between the mobile stations and a VPN server to translate the virtual client network addresses to the internal network addresses based on the medium access control (MAC) address corresponding to the mobile stations. In this manner, the encryption inherent in the VPN infrastructure prevents access to the internal network addresses assigned to the mobile stations.

Claims

1. In a wireless network system comprising an access point providing wireless service to a mobile station and a Virtual Private Network (VPN) server operative to establish a VPN session with the mobile station, a method comprising

intercepting an address assignment message from a network address configuration server to the mobile station, wherein the mobile station has a unique link layer address, wherein the network address configuration server is operative to provide internal network addresses to requesting mobile stations, and wherein the address assignment message contains an internal network address for the mobile station;

associating, in a data structure, the unique link layer address of the mobile station with the internal network address provided by the network address configuration server in the address assignment message;

replacing the internal network address in the address assignment message with a virtual network address; and

forwarding the modified address assignment message to the mobile station;

intermediating a VPN session between the VPN server and the mobile station;

wherein the VPN session involves the exchange of encapsulated packets comprising an encapsulating VPN header including an outer network address corresponding to the mobile station, and wherein as to packets sourced from the mobile station, replacing the virtual network address used by the mobile station as the outer network address in the encapsulating VPN headers with the internal network address corresponding to the mobile station.

2. The method of claim 1 further comprising associating the unique link layer address of the mobile station with the internal network address provided by the network address configuration server.

3. The method of claim 1 further comprising

as to packets sourced from the VPN server to the mobile station, replacing the internal network address corresponding to the mobile station in the encapsulating VPN headers of the packets with the virtual network address corresponding to the mobile station.

4. The method of claim 1 wherein the virtual network address is a non-routable address.

5. The method of claim 1 wherein the virtual network address is an Internet Protocol (IP) address.

6. The method of claim 5 wherein the virtual client network address is a first host address corresponding to a subnet consisting of a network address, a broadcast address, the first host address, and a second host address.

7. The method of claim 6 wherein the VPN server is configured with the second host address.

8. The method of claim 1 wherein the virtual network address is uniform for all mobile stations.

9. The method of claim 1 wherein the network address configuration server is a Dynamic Host Configuration Protocol (DHCP) server.