Method and apparatus for fragmenting and reassembling internet key exchange data packets

• US 20030142823A1
• Filed: 01/25/2002
• Published: 07/31/2003
• Est. Priority Date: 01/25/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Huitema, Christian, Swander, Brian
• Granted Patent: US 7,500,102 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/164 Adaptation or special uses of UDP protocol
• CPC Class Codes: H04L 69/166 IP fragmentation; TCP segmentation

Abstract

A method and apparatus for fragmenting and reassembling IKE protocol data packets that exceed a Maximum Transmission Unit is provided. A transmitting node determines whether to fragment IKE data depending on whether the receiving node has the capability to receive and reassemble fragmented data packets. The transmitting node detects whether fragmentation is appropriate and then intercepts and fragments appropriate IKE payloads for transmission over a network. The invention further includes a method and apparatus for reassembling fragmented IKE payloads. The receiving node discards certain packets according to a set of predetermined rules that are designed to prevent denial of service attacks and other similar attacks. No modification is required to the existing IKE protocol or to other lower level networking protocols.

Claims

1. A method for transmitting Internet Key Exchange (IKE) data packets across a network comprising the steps of:

generating and transmitting an IKE packet over a network;

determining whether a response to the IKE packet was received;

fragmenting the IKE packet into a plurality of smaller packets when a response is not received, wherein each of the smaller packets includes a header formatted according to the IKE protocol; and

transmitting each of the plurality of smaller packets over a network.

2. The method of claim 1 wherein each header includes an identifier that may be used to associate the smaller packet with a corresponding IKE packet.

3. A network node that communicates with other network nodes according to the Internet Key Exchange (IKE) protocol comprising:

a User Datagram Protocol (UDP) stack that is capable of generating UDP data packets for transmission over a network;

an IKE protocol stack that generates IKE data packets that are subsequently processed by the UDP protocol stack; and

a fragmenter module that intercepts IKE data packets prior to being processed by to the UDP protocol stack and splits the IKE data packets into a plurality of smaller data packets that may be subsequently formatted by the UDP protocol stack.

4. A method for fragmenting a data packet comprising the steps of:

generating an IKE data packet;

intercepting the IKE data packet before it is passed to a subsequent network protocol stack;

determining a maximum size for fragments of an IKE data packet;

dividing the IKE data packet into at least two smaller packets; and

prepending a header to each smaller packet, wherein each header for each smaller packet includes an identifier that associates the smaller packet with its corresponding IKE data packet.

5. The method of claim 4 wherein the dividing step is performed such that the combined size of each smaller packet and prepended header will not exceed the maximum size.

6. A method for receiving fragmented Internet Key Exchange (IKE) data packets comprising the steps of:

receiving a plurality of fragments of an IKE data packet from a transmitting node, wherein each fragment includes an identifier that associates each fragment with an IKE data packet; and

discarding all fragments that contain a first identifier if a predetermined number of fragments are received that contain a second identifier.

7. The method according to claim 6 wherein the step of discarding all fragments that contain a first identifier is performed when at least one fragment is received that contains a second identifier.

8. The method according to claim 6 further comprising the steps of:

determining whether all fragments that are associated with an IKE data packet have been received; and

sending a no acknowledgment (NAK) message to the transmitting node when at least one fragment has not been received.

9. The method according to claim 6 further comprising the step of determining the total size of all fragments that contain the same identifier and discarding said fragments when the total size exceeds a predetermined limit.

10. The method according to claim 9 wherein the predetermined limit is 64 kilobytes.

11. A system for transmitting Internet Key Exchange (IKE) protocol data packets across a network comprising:

means for generating an IKE packet;

means for detecting whether the IKE packet was successfully received at the intended receiver node; and

means for fragmenting the IKE packets into smaller packets when the IKE packet was not successfully received at the receiver node, wherein each of the smaller packets includes information that permits a receiver node to identify the IKE packet associated with each smaller packet and the position of each smaller packet within the IKE packet.

12. The system of claim 11 further comprising means for determining the capability of the receiver node for receiving fragmented packets.