Maintaining network address translations

• US 9,667,594 B2
• Filed: 09/02/2016
• Issued: 05/30/2017
• Est. Priority Date: 06/15/1999
• Status: Expired due to Fees

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications Security Oyj
• Inventors: Kivinen, Tero, Ylonen, Tatu
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US15/255,253
• Publication Number:
  US 20160373406A1
• Time in Patent Office: 270 Days
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 45/026 Details of "hello" or keep-alive messages
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2553 Binding renewal aspects, e.g. using keep-alive messages
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2564 for a higher-layer protocol, e.g. for session initiation protocol [SIP]
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 61/2578 without involvement of the NAT server
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/165 : Combined use of TCP and UDP protocols; selection criteria therefor

Abstract

This invention provides a method, apparatus, and computer-readable media for providing a configuration that sets up and maintains communication connections through the use of network address translation (NAT). The configuration includes communicating, by a device, packets from and/or to another device, in which the communication involves a network address translation, and maintaining the network address translation by transmitting, by the device, packets using the network address translation frequently enough to prevent any intermediate device from deleting a mapping for the network address translation from a cache of the intermediate device.

Claims

1. A device comprising:

a communication interface configured to communicate data-carrying User Datagram Protocol (UDP) datagrams with another device, wherein the communication involves at least one network address translation by at least one intermediate network address translator (NAT) arranged to maintain a mapping for the network address translation, wherein the at least one intermediate NAT is configured to reverse the mapping for reply UDP datagrams, and comprises a timer that times out the mapping after a period has passed without the at least one intermediate NAT performing a network address translation for the communication, and

a controller configured to force the at least one intermediate NAT to maintain the mapping for an additional period by causing sending keepalive UDP datagrams from the device to the another device through the at least one intermediate NAT frequently enough to prevent the timer from timing out the mapping for the network address translation when no data-carrying UDP datagrams are communicated between the device and the another device.

2. The device according to claim 1, wherein the controller is configured to force the intermediate NAT to handle the keepalive UDP datagrams in the same way as the data carrying UDP datagrams by generating keepalive UDP datagrams that comprise, in headers of the keepalive UDP datagrams, IP address and port information that equals IP address and port information in headers of the data-carrying UDP datagrams.

3. The device according to claim 2, wherein the at least one intermediate NAT comprises a port NAT.

4. The device according to claim 2, wherein the sending of the keepalive UDP datagrams serves solely to prevent the timing out of the mapping.

5. The device according to claim 4, wherein the controller is configured to send the keepalive UDP datagrams solely as keepalives without conveying any meaningful information to the another device.

6. The device according to claim 1, wherein the controller is configured to determine that network address translations are occurring on the UDP datagrams.

7. The device according to claim 1, wherein the controller is configured to cause sending of the keepalive UDP datagrams frequently enough so that the mapping of the network address translation remains in a cache of the at least one intermediate NAT.

8. The device according to claim 1, wherein the controller is configured to cause the sending of the keepalive UDP datagrams at a determined optimal frequency.

9. The device according to claim 1, wherein the controller is configured to cause sending of multiple keepalive UDP datagrams within an estimated shortest time out period.

10. The device according to claim 9, wherein the estimated shortest time out period is 30 seconds.

11. A method for a communication device, comprising:

communicating data-carrying User Datagram Protocol (UDP) datagrams with another device, wherein the communication involves at least one network address translation by at least one intermediate network address translator (NAT) configured to maintain a mapping for the network address translation for reply UDP datagrams, the intermediate NAT having a timer that times out the mapping after a period has passed without the at least one intermediate NAT performing a network address translation using the mapping for the communication;

receiving reply datagrams from the another device, the reply datagrams having a reverse-mapped address; and

forcing the at least one intermediate NAT to maintain the mapping for an additional period by sending keepalive UDP datagrams from the communication device to the another device through the at least one intermediate NAT frequently enough to prevent the timer from timing out the mapping for the network address translation when no data-carrying UDP datagrams are communicated between the communication device and the another device.

12. The method according to claim 11, wherein the step of forcing the at least one intermediate NAT to maintain the mapping comprises generating keepalive UDP datagrams that comprise, in headers of the keepalive UDP datagrams, IP address and port information that equals IP address and port information in headers of the data-carrying UDP datagrams.

13. The method according to claim 12, wherein the at least one intermediate NAT comprises a port NAT.

14. The method according to claim 12, wherein the sending of the keepalive UDP datagrams serves solely to prevent the timing out of the mapping.

15. The method according to claim 14, comprising sending the keepalive UDP datagrams solely as keepalives without conveying any meaningful information to the other device.

16. The method according to claim 11, comprising determining that network address translations are occurring on the UDP datagrams.

17. The method according to claim 11, comprising sending the keepalive UDP datagrams frequently enough so that the mapping of the network address translation remains in a cache of the at least one intermediate network address translator.

18. The method according to claim 11, comprising determining an optimal frequency of sending of the keepalive UDP datagrams.

19. The method according to claim 18, wherein the determining comprises experimenting.

20. The method according to claim 11, comprising causing sending of multiple keepalive UDP datagrams within an estimated shortest time out period.

21. The method according to claim 20, wherein the estimated shortest time out period is 30 seconds.

22. A non-transitory computer readable media comprising program code for causing an apparatus comprising a processor to perform instructions for:

communication of data-carrying User Datagram Protocol (UDP) datagrams between a device and another device, wherein the communication involves at least one network address translation by at least one intermediate network address translator (NAT) configured to maintain a mapping for the network address translation so that the at least one intermediate NAT can reverse the mapping for reply UDP datagrams, wherein the NAT comprises a timer that times out the mapping after a period has passed without the at least one intermediate NAT performing a network address translation for the communication;

receiving reply datagrams from the another device, the reply datagrams having a reverse-mapped address; and

forcing the at least one intermediate NAT to maintain the mapping for an additional period by sending keepalive UDP datagrams from the device to the another device through the at least one NAT frequently enough to prevent the timer from timing out the mapping for the at least one network address translation when no data-carrying UDP datagrams are communicated between the device and the another device.