METHOD AND ARRANGEMENT FOR PROVIDING SECURITY THROUGH NETWORK ADDRESS TRANSLATIONS USING TUNNELING AND COMPENSATIONS

• US 20100318682A1
• Filed: 08/24/2010
• Published: 12/16/2010
• Est. Priority Date: 06/15/1999
• Status: Active Grant

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: Tectia Oyj
• Inventors: Ylonen, Tatu, Kivinen, Tero
• Granted Patent: US 8,544,079 B2
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 45/026 Details of "hello" or keep-alive messages
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2553 Binding renewal aspects, e.g. using keep-alive messages
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2564 for a higher-layer protocol, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 61/2578 without involvement of the NAT server
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/165 : Combined use of TCP and UDP protocols; selection criteria therefor

Abstract

This invention provides a method for providing network security services, such as those provided by the IPSEC protocol, through network address translation (NAT). The method is based on determining the transformations that occur on a packet and compensating for the transformations. Because only TCP and UDP protocols work through NATs, the IPSEC AH/ESP packets are encapsulated into UDP packets for transport. Special operations are performed to allow reliable communications in such environments.

Claims

1-23. -23. (canceled)

24. A method of maintaining communication of data packets, comprising:

communicating data packets from and/or to a device, wherein the communication involves a determined network address translation; and

maintaining the determined network address translation by sending from the device at least one keepalive packet before a time out of the determined network address translation.

25. The method according to claim 24, comprising sending at least one keepalive packet comprising a header that equals with the headers of the data packets.

26. The method according to claim 24, comprising including in the at least one keepalive packet an indicator that identifies it as a keepalive packet.

27. The method according to claim 24, comprising generating the at least one keepalive packet by generating a packet without any meaningful payload.

28. The method according to claim 24, comprising determining a shortest period for the time out, and based on the determination, sending the at least one keepalive packet frequently enough to maintain the determined address translation in the network address translator.

29. The method according to claim 24, comprising taking the possibility of packet loss into account in determining the frequency of sending the at least one keepalive packet.

30. A method of providing address translations, comprising

determining an address translation for communication of data packets between a first device and a second device;

receiving at least one keepalive packet from at least one of the first device and the second device before time out of the determined address translation for the communication of data packets; and

in response to receiving the at least one keepalive packet, maintaining the determined network address translation for the communication of data packets between the first device and the second device.

31. The method according to claim 30, comprising maintaining the determined network address translation in response to receiving at least one keepalive packet comprising a header that equals with the headers of the data packets.

32. The method according to claim 30, comprising determining that the at least one keepalive packet contains an indicator that identifies it as a keepalive packet.

33. The method according to claim 30, comprising detecting reception of the at least one keepalive packet based on receipt of a packet without any meaningful payload.

34. An apparatus comprising:

at least one memory including computer program code; and

at least one processor,

wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to

control communication of data packets, wherein the communication involves a determined network address translation, and

maintain the determined network address translation by causing sending of at least one keepalive packet before a time out of the determined network address translation.

35. The apparatus according to claim 34, wherein the at least one keepalive packet comprises a header that equals with the headers of the data packets.

36. The apparatus according to claim 34, wherein the at least one keepalive packet contains an indicator that identifies it as a keepalive packet.

37. The apparatus according to claim 34, configured to cause sending of the at least one keepalive packet frequently enough to maintain the determined address translation.

38. The apparatus according to claim 34, configured to take the possibility of packet loss into account in determining the frequency of sending.

39. The apparatus according to claim 34, configured to discard received keepalive packets.

40. An apparatus for network address translations, comprising at least one memory including computer program code;

and

at least one processor,

wherein the at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus at least to

determine an address translation for communication of data packets between a first device and a second device; and

maintain the determined network address translation for the communication of data packets between the first device and the second device in response to reception of at least one keepalive packet from at least one of the first device and the second device before time out of the determined address translation for the communication of data packets.

41. The apparatus according to claim 40, wherein the at least one keepalive packet comprises a header that equals with the headers of the data packets.

42. The apparatus according to claim 40, configured to detect that the at least one keepalive packet contains an indicator that identifies it as a keepalive packet.

43. The apparatus according to claim 40, configured to interpret a packet as a keepalive packet if the packet does not contain any meaningful payload.