Method and arrangement for providing security through network address translations using tunneling and compensations

• US 8,544,079 B2
• Filed: 08/24/2010
• Issued: 09/24/2013
• Est. Priority Date: 06/15/1999
• Status: Expired due to Fees

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: Tectia Oyj
• Inventors: Kivinen, Tero, Ylonen, Tatu
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US12/862,305
• Publication Number:
  US 20100318682A1
• Time in Patent Office: 1,127 Days
• Field of Search: 726/14, 713/153, 713/160
• US Class Current: 726/14
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 45/026 Details of "hello" or keep-alive messages
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2553 Binding renewal aspects, e.g. using keep-alive messages
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2564 for a higher-layer protocol, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 61/2578 without involvement of the NAT server
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/165 : Combined use of TCP and UDP protocols; selection criteria therefor

Abstract

This invention provides a method for providing network security services, such as those provided by the IPSEC protocol, through network address translation (NAT). The method is based on determining the transformations that occur on a packet and compensating for the transformations. Because only TCP and UDP protocols work through NATs, the IPSEC AH/ESP packets are encapsulated into UDP packets for transport. Special operations are performed to allow reliable communications in such environments.

Claims

1. A method of maintaining communication of datagrams comprising:

communicating the datagrams, in accordance with the User Datagram Protocol, from and/or to a device via a network address translator device that performs network address translation; and

maintaining mapping for the network address translation by sending from the device at least one keepalive packet to the network address translator device before a time out of the mapping for the network address translation.

2. The method according to claim 1, wherein the at least one keepalive packet comprises a header with address information that equals address information in the headers of the datagrams.

3. The method according to claim 1, wherein the at least one keepalive packet comprises an indicator that identifies it as a keepalive packet.

4. The method according to claim 1, comprising generating the at least one keepalive packet by generating a packet without any meaningful payload.

5. The method according to claim 1, comprising determining a shortest period for the time out of the mapping for the network address translation, and based on the determination, sending the at least one keepalive packet frequently enough to maintain the mapping for the network address translation in the network address translator device.

6. The method according to claim 1, comprising taking the possibility of packet loss into account in determining a frequency of sending the at least one keepalive packet.

7. The method according to claim 1, comprising maintaining the mapping for the network address translations by a plurality of network address translator devices by sending the at least one keepalive packet via the plurality of network address translator devices.

8. A method of providing address translations, comprising:

performing network address translation by a network address translator device for communication of datagrams, in accordance with the User Datagram Protocol, between a first device and a second device;

sending at least one keepalive packet from at least one of the first device and the second device to the network address translator device before time out of mapping for the address translation for the communication of the datagrams to maintain the mapping for the network address translation; and

in response to receiving the at least one keepalive packet, maintaining the mapping for the network address translation for the communication of the datagrams between the first device and the second device.

9. The method according to claim 8, comprising maintaining the mapping for the network address translation in response to receiving at least one keepalive packet comprising a header with address information that equals address information in the headers of the datagrams.

10. The method according to claim 8, comprising determining that the at least one keepalive packet contains an indicator that identifies it as a keepalive packet.

11. The method according to claim 8, comprising detecting reception of the at least one keepalive packet based on receipt of a packet without any meaningful payload.

12. An apparatus comprising:

at least one memory storing computer program code; and

at least one processor,

wherein the at least one memory, the computer program code, and the at least one processor are configured to cause the apparatus at least to;

control communication of datagrams, in accordance with the User Datagram Protocol, from and/or to a device via a network address translator device that performs network address translation, and

maintain mapping for the network address translation by causing sending of at least one keepalive packet from the device to the network address translator device before a time out of the mapping for the network address translation.

13. The apparatus according to claim 12, wherein the at least one keepalive packet comprises a header with address information that equals address information in the headers of the datagrams.

14. The apparatus according to claim 12, wherein the at least one keepalive packet contains an indicator that identifies it as a keepalive packet.

15. The apparatus according to claim 12, configured to cause sending of the at least one keepalive packet frequently enough to maintain the mapping for the address translation.

16. The apparatus according to claim 12, configured to take the possibility of packet loss into account in determining a frequency of sending the at least one keepalive packet.

17. The apparatus according to claim 12, configured to discard received keepalive packets.

18. An apparatus for maintaining network address translations, comprising:

a first communication device; and

a network address translator device configured to perform a network address translation for communication of datagrams, in accordance with the User Datagram Protocol, between the first communication device and a second communication device, wherein

the first communication device is configured to send at least one keepalive packet to the network address translator device before time out of mapping for the network address translations to maintain the mapping for the network address translation, and

the network address translator device is configured to maintain the mapping for network address translation for the communication of datagrams between the first communication device and the second communication device in response to reception of at least one keepalive packet from the first communication device before the time out of the mapping for the address translation for the communication of the datagrams.

19. The apparatus according to claim 18, wherein the at least one keepalive packet comprises a header with address information that equals address information in the headers of the the datagrams.

20. The apparatus according to claim 18, configured to detect that the at least one keepalive packet contains an indicator that identifies it as a keepalive packet.

21. The apparatus according to claim 18, configured to interpret a packet as a keepalive packet if the packet does not contain any meaningful payload.

22. The apparatus according to claim 18, comprising at least one additional network address translator device configured to perform a further network address translation for the communication of the datagrams, wherein the additional network address translation device is configured to maintain mapping for the further network address translation for the communication of datagrams in response to reception of the at least one keepalive packet from the network address translator device before time out of the mapping for the additional address translation.

23. A non-transitory computer readable media for maintaining communication of datagrams, comprising program code for causing a processor to perform instructions for:

communicating datagrams, in accordance with the User Datagram Protocol, from and/or to a device via a network address translator device that performs network address translation, and

maintaining mapping for the network address translation by sending at least one keepalive packet to the network address translator device before a time out of the mapping for network address translation.

24. The non-transitory computer readable media according to claim 23, wherein the program code is configured to cause sending at least one keepalive packet comprising a header with address information that equals address information in the headers of the datagrams.

25. An apparatus comprising:

at least one memory storing computer program code; and

at least one processor,

wherein the at least one memory, the computer program code, and the at least one processor are configured to cause the apparatus at least to;

control communication of datagrams in accordance with User Datagram Protocol between a first device and a second device via a network address translator device that performs network address translation, and

maintain the network address translation by causing sending of at least one keepalive datagram to the network address translator device before a time out of the mapping for the network address translation.

26. The apparatus according to claim 25, wherein the at least one keepalive datagram comprises a header with address information that equals address information in the headers of the datagrams.

27. The apparatus according to claim 25, wherein the at least one keepalive datagram contains an indicator that identifies it as a keepalive datagram.

28. The apparatus according to claim 25, wherein the at least one keepalive datagram comprises a datagram without any meaningful payload.

29. A communication device configured at least to:

communicate datagrams in accordance with User Datagram Protocol to and/or from a second device via a network address translator device that performs network address translation, and

maintain mapping for the network address translation by sending of at least one keepalive datagram to the network address translator device before a time out of the mapping for the network address translation.

30. The communication according to claim 29, wherein the at least one keepalive datagram comprises a header with address information that equals address information in the headers of the datagrams.

31. A method of maintaining communication of data packets, comprising:

communicating datagrams in accordance with User datagram Protocol from and/or to a device via a network address translator device that performs network address translation; and

maintaining mapping for the network address translation by sending at least one keepalive datagram comprising a header with address information that equals address information in the headers of the datagrams through the network address translator device before a time out of the mapping for the network address translation.

32. The method according to claim 31, comprising maintaining mapping for the network address translations by a plurality of network address translator devices by sending the at least one keepalive datagram via the plurality of network address translator devices.