Encapsulation method discovery protocol for network address translation gateway traversal

• US 8,059,641 B1
• Filed: 07/20/2006
• Issued: 11/15/2011
• Est. Priority Date: 07/20/2006
• Status: Expired due to Fees

• Current Assignee: Arlington Technologies, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Avaya Incorporated
• Inventors: Rai, Anupam
• Primary Examiner(s): WONG, XAVIER S
• Application Number:
  US11/458,824
• Time in Patent Office: 1,944 Days
• Field of Search: None
• US Class Current: 370/389
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present invention is directed to a communication device including a discovery agent 348 operable to determine an encapsulation method used by a tunnel by transmitting packets generated using different encapsulation protocols until a responsive packet is received on a selected receive port.

Claims

1. In a Virtual Private Network or VPN comprising a Network Address Translation or NAT device and a voice communication device, a method to determine an encapsulation used by a tunnel, comprising:

a processor selecting a first encapsulation method for use in a pre-existing tunnel;

the processor transmitting a packet encapsulated by the first encapsulation method;

the processor determining if the packet has been received;

the processor determining if a response to the packet has been received;

if either the packet or the response has been received, the processor increasing a receive packet counter;

the processor waiting for a selected period of time;

the processor determining if the receive packet counter has been increased;

if the receive packet counter has not been increased in the selected period of time, the processor selecting a second encapsulation method; and

the processor repeating the transmitting through selecting steps (b) and (c) using the second encapsulation method.

2. The method of claim 1, wherein the step of transmitting a packet encapsulated by the first encapsulation method comprises the substeps:

generating the packet containing an arbitrary payload, wherein the packet is sourced from and destined for a secured communication client; and

introducing the packet directly into the tunnel so that the packet bypasses a native protocol stack.

3. The method of claim 1, wherein the step of transmitting a packet encapsulated by the first encapsulation method comprises the substeps:

generating the packet comprising a name translation and/or resolution query for a predefined string, the packet being addressed to a name translator and/or resolver; and

transmitting the packet via the tunnel to a security gateway positioned between the NAT device and the name translator and/or resolver.

4. The method of claim 1, wherein the step of transmitting a packet encapsulated by the first encapsulation method comprises the substeps:

generating the packet comprising a ping message, the packet being addressed to a selected computational component; and

transmitting the packet via the tunnel to a security gateway positioned between the NAT device and the selected computational component.

5. The method of claim 1, wherein the step of transmitting a packet encapsulated by the first encapsulation method comprises the substeps:

generating the packet, the packet comprising a ping message, wherein the packet is addressed to an address X, where X is one of;

(i) an IP address of a known selected host, (ii) a randomly selected address in the same subnet as the communication device, and (iii) a randomly selected address in a subnet different from the subnet of the communication device; and

transmitting the packet via the tunnel to a security gateway positioned logically on the other side of the NAT device from the communication device.

6. The method of claim 1, wherein no response is received when using the first and second encapsulation methods and further comprising:

tearing down the old tunnel; and

building a new tunnel, wherein in the new tunnel one of the following statements is true;

(i) when the old tunnel was setup with Internet Key Exchange (IKE) NAT traversal enabled, the IKE NAT traversal in the new tunnel is disabled and (ii) when the old tunnel was setup with IKE NAT traversal disabled, IKE NAT traversal in the new tunnel is enabled.

7. The method of claim 1, wherein the packet contains an arbitrary payload and a value for an identifier associated with the tunnel and wherein the value for the identifier is selected to be incorrect.

8. The method of claim 2, wherein the step of transmitting a packet encapsulated by the first encapsulation method comprises the substeps:

generating the packet comprising a name translation and/or resolution query for a predefined string, the packet being addressed to a name translator and/or resolver; and

transmitting the packet via the tunnel to a security gateway positioned between the NAT device and the name translator and/or resolver.

9. The method of claim 8, wherein the step of transmitting a packet encapsulated by the first encapsulation method comprises the substeps:

generating the packet, the packet comprising a ping message, wherein the packet is addressed to an address X, where X is one of;

(i) an internet protocol (IP) address of a known selected host, (ii) a randomly selected address in the same subnet as the communication device, and (iii) a randomly selected address in a subnet different from the subnet of the communication device; and

transmitting the packet via the tunnel to a security gateway positioned logically on the other side of the NAT device from the communication device.

10. The method of claim 1, wherein, when a response is received timely, the selected encapsulation method and transmit and receive ports are in use by the tunnel, wherein, when the selected encapsulation method is unacceptable for voice communications, the existing tunnel is torn down and a new tunnel established, the new tunnel using a different encapsulation method than the existing tunnel.

11. The method of claim 1, wherein the step of transmitting a packet encapsulated by the first encapsulation method comprises the substeps:

periodically introducing the packet into the tunnel at a selected frequency for a predetermined time, wherein the source and destination ports in a packet header are set to a randomly generated number, wherein the packet is sourced from and destined to a secured communication client, wherein the packet header is set to a selected number of bytes and initialized with a randomly generated byte pattern and wherein the packet comprises a timestamp;

when the packet is received by the secured communication client, determining at least one of a round trip time of the packet and a number of packets lost; and

when the at least one of a round trip time and number of packets lost is not acceptable for voice communications, tearing down the tunnel.

12. A tangible, non-transitory computer readable medium comprising processor executable instructions to perform the steps of claim 1.

13. In a Virtual Private Network or VPN comprising a Network Address Translation or NAT device and a voice communication device, a method to determine a tunnel quality, comprising:

a processor periodically introducing a packet into the tunnel at a selected frequency for a predetermined time, wherein the packet is sourced from and destined to a secured communication client of a voice communication device and wherein the packet comprises a timestamp;

when the packet is received by the secured communication client, the processor determining a round trip time of the packet and a number of packets lost; and

while the tunnel is functioning and when the round trip time and the number of packets lost is not acceptable for voice communications, the processor tearing down the tunnel.

14. The method of claim 13, wherein the source and destination ports in a packet header of the packet are set to a randomly generated number and wherein the packet header is set to a selected number of bytes and initialized with a randomly generated byte pattern.

15. The method of claim 13, wherein the step of periodically introducing a packet into the tunnel comprises the substeps:

selecting a first encapsulation method;

transmitting a first packet encapsulated by the first encapsulation method on a selected transmit port;

determining, from a receive packet counter associated with a selected receive port, whether the first packet has been received; and

when the first packet has not been received within a selected period of time, selecting a second encapsulation method; and

repeating the steps of determining a round trip time of the packet and a number of packets lost and while the tunnel is functioning and when the round trip time and the number of packets lost is not acceptable for voice communications, the processor tearing down the tunnel, using the second encapsulation method.

16. A packet-switched voice communication device, comprising:

a secured communication client; and

a discovery agent operable to perform the following operations;

select a first encapsulation method;

transmit a packet encapsulated by the first encapsulation method on a selected transmit port;

determine if the packet has been received;

determine if a response to the packet has been received;

if either the packet or the response has been received, increase a receive packet counter;

wait for a selected period of time;

determine if the receive packet counter has been increased;

if the receive packet counter has been increased in the selected period of time, select a second encapsulation method; and

repeat the transmit through selected steps using the second encapsulation method.

17. The communication device of claim 16, wherein the packet contains an arbitrary payload and a value for an identifier associated with a tunnel and wherein the value for the identifier is selected to be incorrect.

18. The communication device of claim 16, wherein the transmit operation comprises the sub-operations of:

generating the packet containing an arbitrary payload, wherein the packet is sourced from and destined for a secured communication client; and

introducing the packet directly into a tunnel so that the packet bypasses a native protocol stack.

19. The communication device of claim 16, wherein the transmit operation comprises the sub-operations of:

generating the packet comprising a name translation and/or resolution query for a predefined string, the packet being addressed to a name translator and/or resolver; and

transmitting the packet via a tunnel to a security gateway positioned between the NAT device and the name translator and/or resolver.

20. The communication device of claim 16, wherein the transmit operation comprises the sub-operations of:

generating the packet comprising a ping message, the packet being addressed to a selected computational component; and

transmitting the packet via a tunnel to a security gateway positioned between the NAT device and the selected computational component.

21. The communication device of claim 16, wherein the transmit operation comprises the sub-operations of:

generating the packet, the packet comprising a ping message, wherein the packet is addressed to an address X, where X is one of;

(i) an IP address of a known selected host, (ii) a randomly selected address in the same subnet as the communication device, and (iii) a randomly selected address in a subnet different from the subnet of the communication device; and

transmitting the packet via a tunnel to a security gateway positioned logically on the other side of the NAT device from the communication device.

22. The communication device of claim 16, wherein, when a response is received timely, the selected encapsulation method and transmit and receive ports are in use by a tunnel.