Network device, IPsec system and method for establishing IPsec tunnel using the same

• US 9,602,470 B2
• Filed: 03/25/2014
• Issued: 03/21/2017
• Est. Priority Date: 05/23/2013
• Status: Active Grant

• Current Assignee: SerComm Corporation
• Original Assignee: SerComm Corporation
• Inventors: Lien, Chia-Hao
• Primary Examiner(s): NGUYEN, THU HA T
• Application Number:
  US14/224,096
• Publication Number:
  US 20140351590A1
• Time in Patent Office: 1,092 Days
• Field of Search: 709/229, 709/205, 709/227, 709/238, 713/168, 713/153, 713/167, 370/392, 726/14, 726/1, 726/12, 726/15
• US Class Current: 1/1
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2592 using tunnelling or encapsulation
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

A network device is provided. The network device is connected to a number of slave network devices. Each slave network device communicates with the network device by using an Internet protocol (IP) address. The network device includes an Internet protocol security (IPsec) module and a network address translation (NAT) module. The IPsec module establishes an IPsec tunnel to a network gateway in the Internet and retrieves an IPsec IP address corresponding to the IPsec tunnel. The NAT module converts the IP addresses of the slave network devices to the IPsec IP address, such that the slave network devices use the IPsec IP address to communicate with the network gateway through the IPsec tunnel.

Claims

1. A network device for connecting a plurality of slave network devices, each of the slave network devices communicating with the network device by using a different Internet protocol (IP) address, the network device comprising:

an Internet protocol security (IPsec) module for establishing an IPsec tunnel to a network gateway in the Internet and retrieving an IPsec IP address corresponding to the IPsec tunnel; and

a network address translation (NAT) module for converting the different IP addresses of the slave network devices to the same IPsec IP address, such that the slave network devices share the IPsec tunnel and use the same IPsec IP address to communicate with the network gateway through the IPsec tunnel;

wherein at least one of the IPsec module and the NAT module is implemented by a processor;

wherein the IPsec tunnel ends at the network device and the network gateway without extending to any of the slave network devices.

2. The network device according to claim 1, wherein the network device is a cellular base station, a router, or a wireless access point (AP), each of the slave network devices is a cellular base station, a router, a wireless AP, or a mobile device, and the network gateway is a security gateway.

3. The network device according to claim 1, wherein the IPsec module comprises an encryption unit and a decryption unit, the encryption unit encrypts packets that are initiated from the slave network devices and not protected by IPsec encryption into packets that are protected by IPsec encryption, and the decryption unit decrypts packets that are destined for the slave network devices and protected by IPsec encryption into packets that are not protected by IPsec encryption, and the slave network devices share the services provided by the encryption unit and the decryption unit of the IPsec module of the network device.

4. The network device according to claim 1, wherein the slave network devices communicate with the network device by using different private IP addresses, the NAT module converts the different private IP addresses of the slave network devices to the same IPsec address, and the NAT module records the relationship between the different private IP addresses of the slave network devices and ports of the network device in a NAT lookup table.

5. The network device according to claim 1, wherein the slave network devices communicate with the network device by using different private IP addresses, the NAT module converts the same IPsec address to the different private IP addresses of the slave network devices, and the NAT module records the relationship between the different private IP addresses of the slave network devices and ports of the network device in a NAT lookup table.

6. The network device according to claim 1, wherein the IPsec module is configured in IPsec tunnel mode to establish the IPsec tunnel to the network gateway in the Internet, and to establish the IPsec tunnel for the slave network devices to share, the network device receives only one certificate for authentication from the network gateway.

7. The network device according to claim 1, wherein the slave network devices do not have IPsec functionality and are not capable of performing IPsec encryption and decryption.

8. An IPsec system, comprising:

a network gateway for connecting an intranet, the intranet being connected to the Internet via the network gateway; and

a network device for connecting a plurality of slave network devices, each of the slave network devices communicating with the network device by using a different IP address, the network device comprising;

an IPsec module for establishing an IPsec tunnel to the network gateway in the Internet and retrieving an IPsec IP address corresponding to the IPsec tunnel; and

a NAT module for converting the different IP addresses of the slave network devices to the same IPsec IP address, such that the slave network devices share the IPsec tunnel and use the same IPsec IP address to communicate with the network gateway through the IPsec tunnel;

wherein the IPsec tunnel ends at the network device and the network gateway without extending to any of the slave network devices.

9. The IPsec system according to claim 8, wherein the network device is a cellular base station, a router, or a wireless AP, each of the slave network devices is a cellular base station, a router, a wireless AP, or a mobile device, and the network gateway is a security gateway.

10. The IPsec system according to claim 8, wherein the IPsec module comprises an encryption unit and a decryption unit, the encryption unit encrypts packets that are initiated from the slave network devices and not protected by IPsec encryption into packets that are protected by IPsec encryption, and the decryption unit decrypts packets that are destined for the slave network devices and protected by IPsec encryption into packets that are not protected by IPsec encryption, and the slave network devices share the services provided by the encryption unit and the decryption unit of the IPsec module of the network device.

11. The IPsec system according to claim 8, wherein the slave network devices communicate with the network device by using different private IP addresses, the NAT module converts the different private IP addresses of the slave network devices to the same IPsec address, and the NAT module records the relationship between the different private IP addresses of the slave network devices and ports of the network device in a NAT lookup table.

12. The IPsec system according to claim 8, wherein the slave network devices communicate with the network device by using different private IP addresses, the NAT module converts the same IPsec address to the different private IP addresses of the slave network devices, and the NAT module records the relationship between the different private IP addresses of the slave network devices and ports of the network device in a NAT lookup table.

13. The IPsec system according to claim 8, wherein the network gateway comprises an encryption unit and a decryption unit, the encryption unit encrypts a packet transmitted by the network gateway to the network device, the decryption unit decrypts an encrypted packet received from the network device.

14. The IPsec system according to claim 8, wherein the IPsec module is configured in IPsec tunnel mode to establish the IPsec tunnel to the network gateway in the Internet, and to establish the IPsec tunnel for the slave network devices to share, the network device receives only one certificate for authentication from the network gateway.

15. The IPsec system according to claim 8, wherein the slave network devices do not have IPsec functionality and are not capable of performing IPsec encryption and decryption.

16. A method for establishing IPsec tunnel, comprising:

establishing an IPsec tunnel from a network device to a network gateway and retrieving an IPsec IP address corresponding to the IPsec tunnel, the network device connecting a plurality of slave network devices, each of the slave network devices communicating with the network device by using a different IP address; and

converting the different IP addresses of the slave network devices to the same IPsec IP address, such that the slave network devices share the IPsec tunnel and use the same IPsec IP address to communicate with the network gateway through the IPsec tunnel;

wherein the IPsec tunnel ends at the network device and the network gateway without extending to any of the slave network devices.

17. The method according to claim 16, wherein the step of establishing the IPsec tunnel from the network device to the network gateway is configured in IPsec tunnel mode, and the network device receives only one certificate for authentication from the network gateway.

18. The method according to claim 16, wherein the step of converting the different IP addresses of the slave network devices to the same IPsec IP address is performed by a NAT method.

19. The method according to claim 18, wherein the NAT method converts different private IP addresses of the slave network devices to the same IPsec address and records the relationship between the different private IP addresses of the slave network devices and ports of the network device in a NAT lookup table.

20. The method according to claim 16, wherein the slave network devices do not have IPsec functionality and are not capable of performing IPsec encryption and decryption.