Method and apparatus for communication of data packets between local networks

• US 8,295,285 B2
• Filed: 03/20/2009
• Issued: 10/23/2012
• Est. Priority Date: 03/20/2008
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Kolhi, Johan, Gotare, Christian, Thyni, Tomas, Welin, Annikki
• Primary Examiner(s): HO, DUC CHI
• Application Number:
  US12/922,974
• Publication Number:
  US 20110013641A1
• Time in Patent Office: 1,313 Days
• Field of Search: None
• US Class Current: 370/392
• CPC Class Codes: H04L 12/4604 LAN interconnection over a backbone network, e.g. Internet, Frame Relay
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 61/2535 Multiple local networks, e.g. resolving potential IP address conflicts
• CPC Class Codes: H04L 61/2567 for reachability, e.g. inquiring the address of a correspondent behind a NAT server
• CPC Class Codes: H04L 61/2589 over a relay server, e.g. traversal using relay for network address translation [TURN]
• CPC Class Codes: H04L 61/2592 using tunnelling or encapsulation
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Method and arrangement for obtaining unambiguous addressing for data packets communicated between devices in two different local networks using private IP address spaces. A VPN tunnel is initially established between gateways in the two local networks and an internal IP address space is defined in each network for devices in the opposite network, not overlapping with an internal IP address space used for its own devices. When the gateway of one network receives a data packet from a device in the opposite network, the packet'"'"'s header is modified by changing the destination and source addresses, which belong to address spaces valid in the opposite network, into addresses belonging to address spaces valid in the present network.

Claims

1. A method of communicating data packets between a first communications device in a first local network and a second communications device in a second local network, wherein private IP addresses are used for devices in the first and second local networks, comprising:

establishing a VPN (Virtual Private Network) tunnel between a first gateway serving the first local network and a second gateway serving the second local network, wherein a public IP address has been assigned to each gateway;

defining, in the first gateway, a selected internal IP address space to be used in the first local network for devices in the second local network, the selected internal IP address space being separate from an internal IP address space used in the first local network for devices in the first local network;

receiving, in the first gateway, an incoming data packet from the second device via said VPN tunnel, the incoming packet having an internal IP header including a first internal destination address used in the second local network for the first device and a first internal source address used in the second local network for the second device;

changing the first internal destination address to a second internal destination address used in the first local network for the first device;

changing the first internal source address to a second internal source address that is within the selected internal IP address space and is used in the first local network for the second device; and

forwarding the incoming packet to the first device with a modified internal IP header including the changed second internal destination address and the changed second internal source address.

2. A method according to claim 1, wherein the incoming packet further comprises an external IP header including the public IP addresses of said first and second gateways as external destination and source addresses, respectively, wherein the external IP header is removed from the incoming packet by the first gateway.

3. A method according to claim 1, further comprising:

receiving, in the first gateway, an outgoing data packet from the first device, the outgoing packet having an internal IP header including an internal destination address used in the first local network for the second device and an internal source address used in the first local network for the first device;

encapsulating the outgoing data packet with an external IP header including the public IP addresses of said gateways as external destination and source addresses, respectively;

determining a correct VPN tunnel for the outgoing data packet based on the internal destination address in the outgoing data packet; and

sending the outgoing data packet to the second gateway via the correct VPN tunnel.

4. A method according to claim 1, wherein VPN tunnels are established between the first local network and a plurality of opposite local networks, and a selected internal IP address space is defined for each opposite local network to be used in the first local network for devices in each respective opposite local network, each selected internal IP address space being separate from any other address space used in the first local network.

5. A method according to claim 4, wherein the selected internal IP address spaces include IPv4-based addresses and a unique number in a second or third octet of each IPv4-based address is allocated to represent the corresponding opposite local network.

6. A method according to claim 5, wherein a VPN tunnel is determined for each outgoing packet based on said unique number in an internal destination address in the outgoing packet, and the outgoing packet is then sent via the determined VPN tunnel.

7. A method according to claim 4, wherein establishing the VPN tunnels includes adding in the gateway of each local network a DNS-registered name and corresponding public PKI key of each opposite gateway.

8. A method according to claim 7, wherein said public PKI key and a corresponding private PKI key are generated for each gateway and the public PKI keys are stored in a PKI server accessible by the gateways.

9. A method according to claim 1, wherein a trust list with trusted parties is created for the first local network, and a VPN tunnel is established between the first local network and a candidate local network if the candidate local network is associated with a first party present in said trust list.

10. A method according to claim 9, wherein the VPN tunnel is established if the candidate local network is indirectly associated with said first party in the trust list by being associated with a second party present in a trust list of the first party.

11. A method according to claim 10, wherein the VPN tunnel is established depending on a predetermined number of trust levels approved for the first local network.

12. A method according to claim 9, wherein the candidate local network is evaluated for establishment of the VPN tunnel in response to a VPN tunnel request from the candidate local network.

13. A method according to claim 9, wherein an established VPN tunnel between two local networks is terminated automatically if a trust list associated with either network is modified to disqualify the established VPN tunnel.

14. An arrangement in a first gateway serving a first local network, configured for communicating data packets between a first communications device in the first local network and a second communications device in a second local network served by a second gateway, the first gateway being configured to establish a VPN tunnel between the first gateway and the second gateway, wherein a public IP address has been assigned to each gateway, and private IP addresses are used for devices in each local network, said arrangement comprising:

an IP address defining module configured to define a selected internal IP address space to be used in the first local network for devices in the second local network, the selected internal IP address space being separate from an internal IP address space used in the first local network for devices in the first local network;

a receiving module configured to receive an incoming data packet from the second device via said VPN tunnel, the incoming packet having an internal IP header including a first internal destination address used in the second local network for the first device and a first internal source address used in the second local network for the second device;

an IP address changing module configured to change the first internal destination address to a second internal destination address used in the first local network for the first device, and to change the first internal source address to a second internal source address that is within the selected internal IP address space and is used in the first local network for the second device; and

a forwarding module configured to forward the incoming packet to the second device with a modified internal IP header including the changed second internal destination address and the changed second internal source address.

15. An arrangement according to claim 14, wherein the incoming packet further comprises an external IP header including the public IP addresses of said first and second gateways as external destination and source addresses, respectively, and wherein the IP address changing module is further configured to remove the external IP header from the incoming packet.

16. An arrangement according to claim 14, further configured to:

receive an outgoing data packet from the first device, the outgoing data packet having an internal IP header including an internal destination address used in the first local network for the second device and an internal source address used in the first local network for the first device;

encapsulate the outgoing data packet with an external IP header including the public IP addresses of said gateways as external destination and source addresses, respectively;

determine a correct VPN tunnel for the outgoing data packet based on the internal destination address in the outgoing data packet; and

send the outgoing packet to the second gateway via the correct VPN tunnel.

17. An arrangement according to claim 14, wherein VPN tunnels are established between the first local network and a plurality of opposite local networks, and a selected internal IP address space is defined for each opposite network to be used in the first local network for devices in each respective opposite network, each selected internal IP address space being separate from any other address space used in the first local network.

18. An arrangement according to claim 17, wherein the selected IP address spaces include IPv4-based addresses and a unique number in a second or third octet of each IPv4-based address is allocated to represent the corresponding opposite local network.

19. An arrangement according to claim 18, wherein the arrangement is further configured to determine a VPN tunnel for each outgoing data packet based on said unique number in an internal destination address in the outgoing packet, and then send the packet via the determined VPN tunnel.

20. An arrangement according to claim 19, wherein the VPN tunnel is established by adding in the gateway of each local network a DNS-registered name and corresponding public PKI key of each opposite gateway.

21. An arrangement according to claim 20, wherein said public PKI key and a corresponding private PKI key are generated for each gateway and the public PKI keys are stored in a PKI server accessible by the gateways.

22. An arrangement according to claim 14, further configured to create a trust list with trusted parties for the first local network, and establish a VPN tunnel between the first local network and a candidate local network if the candidate local network is associated with a first party present in said trust list.

23. An arrangement according to claim 22, further configured to establish the VPN tunnel if the candidate local network is indirectly associated with said first party in the trust list by being associated with a second party present in a trust list of the first party.

24. An arrangement according to claim 23, further configured to establish the VPN tunnel depending on a predetermined number of trust levels approved for the first local network.

25. An arrangement according to claim 22, further configured to evaluate the candidate local network for establishment of a VPN tunnel in response to a VPN tunnel request from the candidate local network.

26. An arrangement according to claim 22, further configured to terminate an established VPN tunnel between two local networks automatically if a trust list associated with either network is modified to disqualify the VPN tunnel.

27. A non-transitory computer-readable medium comprising a computer program configured for a first gateway that serves a first local network and is configured for communicating data packets between a first communications device in the first local network and a second communications device in a second local network served by a second gateway, wherein a VPN tunnel is established between the first gateway and the second gateway, a public IP address has been assigned to each gateway, and private IP addresses are used for devices in each local network, and when executed on the first gateway, causes the first gateway to:

define a selected internal IP address space to be used in the first local network for devices in the second local network, the selected internal IP address space being separate from an internal IP address space used in the first local network for devices in the first local network; and

when receiving from the second device via said VPN tunnel an incoming packet having an internal IP header including a first internal destination address used in the second local network for the first device and a first internal source address used in the second local network for the second device;

change the first internal destination address to a second internal destination address used in the first local network for the first device;

change the second internal source address to a second internal source address that is within the selected internal IP address space and is used in the first local network for the second device; and

forward the incoming packet to the first device with a modified internal IP header including the changed second internal destination address and the changed second internal source address.