Method and device for packaging IPSec data packet by UDP

Abstract

The invention relates to the technical field of communication, and particularly provides a method and a device for packaging an IPSec (Internet Protocol Security) data packet by a UDP (User Datagram Protocol), two communication parties firstly detect whether the opposite party supports NAT-T (Network Address Translation-Transport) by exchanging VendorID (Identity) information; if the verification is passed, continuing to mutually send NAT data packets to detect whether NAT equipment exists between the two communication parties; once the existence of the NAT equipment is detected, an initiator changes a communication port into a 4500 port and then continues negotiation, and UDP format packaging must be carried out after IPSec processing is carried out; and the party which initiates negotiation by the IPSec sends a Keepalive message at regular time to judge whether the connection exists or not, and the dynamic mapping of the NAT gateway to the UDP port is not deleted. Compared with the prior art, organic fusion of the VPN technology and the NAT technology based on IPSec can be realized on the premise of less investment.

Description

Technical Field

[0001] The invention relates to the field of computer networks, and specifically provides a method and a device for UDP encapsulating IPSec data packets. Background Art

[0002] With the continuous development of the breadth and depth of enterprise informatization, more and more users are deploying IPsec-based VPN networks to achieve secure connection of enterprise intranets through public networks and provide remote access solutions.

[0003] IPSec is an open standard that can ensure channel security on the Internet. It performs high-intensity security processing on data packets at the IP layer, providing security services such as data source authentication, connectionless data integrity, data confidentiality, anti-replay, and limited business flow confidentiality.

[0004] Various applications can enjoy the security services and key management provided by the IP layer without having to design and implement their own security mechanisms. This reduces the overhead of key negotiation and the possibility of security vulnerabilities. NAT technology was proposed to solve the problem of increasingly scarce IPv4 addresses. NAT can map host addresses in private networks into public network addresses, so that users only need to register one or a few IPs to interconnect their private networks with the public network, which can greatly save users the cost of registering IPs. At the same time, NAT can also shield private and public networks and provide a certain degree of security.

[0005] However, due to the inherent reasons of the IPSec and NAT technologies and the lack of equipment that supports both, many problems will arise when IPSec and NAT are run together. How to integrate IPSec-based VPN technology with NAT technology is an urgent problem to be solved in this field. Summary of the invention

[0006] The present invention aims at the above-mentioned deficiencies of the prior art and provides a highly practical method for encapsulating IPSec data packets using UDP.

[0007] A further technical task of the present invention is to provide a UDP encapsulated IPSec data packet device which is reasonably designed and safe and applicable.

[0008] The technical solution adopted by the present invention to solve its technical problem is:

[0009] UDP encapsulation IPSec data packet method, the communicating parties first detect whether the other party supports NAT traversal (NAT-T) by exchanging VendorID information; if the verification is successful, they continue to send NAT data packets to each other to detect whether there is a NAT device between the communicating parties; once the existence of the NAT device is detected, the initiator changes the communication port to port 4500 and continues the negotiation, and UDP format encapsulation must be performed after IPSec processing;

[0010] The party initiating IPSec negotiation sends Keepalive messages periodically to determine whether a connection exists, and the NAT gateway's dynamic mapping of its UDP port is not deleted.

[0011] Furthermore, the design of NAT traversal scheme and UDP data packet encapsulation method are respectively;

[0012] The NAT traversal solution expands and partially modifies the original IKE in terms of functions, which is divided into modifications in the main mode stage and modifications in the quick mode stage.

[0013] Furthermore, the main mode stage is modified as follows:

[0014] This is done by exchanging VendorIDs, which are included in the first two messages in the first phase. The VendorID payload is exchanged to determine whether the remote host supports NAT traversal.

[0015] The communicating parties send NAT-D payloads to detect whether there is a NAT device between the communicating IKE entities and the location of the NAT device, and to check whether the IP address and port change along the transmission path;

[0016] Some NAT devices do not change port 500. These NAT devices complete the mapping with multiple clients through Cookie values ​​instead of source ports. It is necessary to move IKE transmission away from port 500.

[0017] Furthermore, after the main mode phase is completed, the negotiating parties have determined whether NAT exists. Whether to use NAT traversal is determined by the quick mode. In the second phase of IKE negotiation, IPSec SA is established under the protection of IKE SA. Through the main mode phase of IKE negotiation, it is determined whether the VPN connection passes through the NAT device and whether NAT traversal is required. If necessary, NAT traversal begins in the second phase.

[0018] Negotiate the packet encapsulation mode. The two communicating parties send the initial address of the IPSec packet to each other and use NAT-OA packets to ensure that both parties can still perform correct verification after NAT conversion.

[0019] Furthermore, the method of encapsulating the UDP data packet is:

[0020] The IPSec data packet is encapsulated with the standard UDP protocol header in the IPv4 protocol to form a UDP tunnel. The devices on the communication path see UDP data packets. Through configuration, the UDP encapsulated data packets pass through NAT and firewalls. NAT and firewalls process these data packets according to the normal UDP protocol. The UDP protocol header of the encapsulated data packet is removed at the receiving end, and the IPSec data packet will be restored.

[0021] Furthermore, the ESP and UDP encapsulation methods in the traditional mode are:

[0022] Sender: Performs general ESP encapsulation on the message, then inserts a suitable UDP header, and edits the total length field, protocol field, and checksum field in the IP header to match the received message;

[0023] Receiver: Delete the UDP header from the message, and edit the total length field, protocol field, and checksum field in the IP header to match the received message.

[0024] Furthermore, the ESP and UDP encapsulation methods in tunnel mode are:

[0025] Sender: Normal ESP encapsulation processing, inserting a UDP header of the appropriate format, editing the total length field, protocol field, and checksum field in the new IP header to match the received message;

[0026] Receiver: Delete the UDP header from the message, and edit the total length field, protocol field, and checksum field in the IP header to match the received message.

[0027] A UDP encapsulated IPSec data packet device, comprising: at least one memory and at least one processor;

[0028] The at least one memory is used to store a machine-readable program;

[0029] The at least one processor is used to call the machine-readable program to execute the UDP encapsulation IPSec data packet method.

[0030] Compared with the prior art, the UDP encapsulation IPSec data packet method and device of the present invention has the following outstanding beneficial effects:

[0031] The present invention utilizes IPSec and NAT to work together, giving users greater convenience in building networks. IPSec can continuously provide good security protection for VPNs and protect the safe transmission of data in public networks. NAT technology greatly saves users' expenses for registering IPs, and can also shield internal private networks from public networks, making internal networks more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Attached Figure 1 It is a flowchart of the UDP encapsulation IPSec data packet method. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] A best embodiment is given below:

[0036] The compatibility issues between NAT and VPN in this embodiment involve the following aspects:

[0037] IKE protocol and NAT incompatibility of IPSec data packets: IKE protocol and data packets protected by IPSec cannot be directly converted by NAT. This is because NAT will change the IP address of the IP packet, while some fields in IPSec's AH or ESP protocol (such as IP address) are fixed and cannot be modified by NAT.

[0038] AHIPSec and NAT cannot run together: NAT will change the IP address of the IP packet, and any change in the IP packet will be destroyed by the AH identifier, so AHIPSec cannot run together with NAT.

[0039] Compatibility issues of ESPIPSec in specific modes: In transport mode, ESPIPSec cannot work with NAPT (Network Address and Port Translation) because the port number is protected by ESP and any change in the port number will be considered a violation.

[0040] In tunnel mode, if ESP is used, the TCP / UDP header is invisible, so the internal and external addresses cannot be translated. However, static NAT and ESPIPSec can work together because only IP addresses need to be translated, which has no effect on the higher-level protocols.

[0041] There are the following ways to solve compatibility issues:

[0042] 1. Use IPSecESP tunnel mode: Use IPSecESP tunnel mode when working in a NAT environment (static NAT). In this mode, IPSec-protected data packets can pass through NAT routers.

[0043] 2. Ensure that NAT is processed before IPSec: One way is to deploy a NAT router after the IPSec system, which is the simplest solution. Another way is to use a device that supports both NAT and IPSec. Many routers and firewall products can complete NAT conversion before IPSec processing of data packets.

[0044] 3. Enable IPSec NAT Traversal (NAT-T): IPSec NAT Traversal (NAT-T) is designed to solve the compatibility issues of IPSec NAT. NAT-T modifies the IKE message and processing process, encapsulating IPSec protected data packets into UDP messages, thereby supporting IPSec packets to traverse NAT.

[0045] To achieve compatibility between VPN and NAT technology, the core idea of ​​this method is:

[0046] (1) Modify the IKE protocol so that the receiver has all the information needed to verify the upper-layer checksum after decryption;

[0047] (2) The UDP header encapsulates the ESPIPSec data packet, and NAT uses the UDP port to multiplex the IPSec data stream;

[0048] (3) The IPSecNAT-T parties change IKE UDP port 500 to UDP port 4500 during the main mode negotiation and configure the firewall to allow UDP port 4500;

[0049] (4) Periodically send NATKeepalive packets for subsequent IKE negotiation and UDP-encapsulated ESPPUD UPD port mapping;

[0050] (5) By sending the original address in the NAT and IKE payloads, the receiver has the original address that can be used to verify the contents of the IKE payload during quick mode negotiation;

[0051] like Figure 1 As shown, in the UDP encapsulation IPSec data packet method in this embodiment, the communicating parties first detect whether the other party supports NAT traversal (NAT-T) by exchanging VendorID information; if the verification is successful, they continue to send NAT data packets to each other to detect whether there is a NAT device between the communicating parties; once the existence of the NAT device is detected, the initiator changes the communication port to port 4500 and continues the negotiation, and UDP format encapsulation must be performed after IPSec processing;

[0052] The party initiating the IPSec negotiation (hidden behind NAT) periodically sends Keepalive messages to determine whether the connection exists, and the NAT gateway's dynamic mapping of its UDP port is not deleted.

[0053] They are the design of NAT traversal solution and the method of UDP data packet encapsulation;

[0054] NAT traversal solution: In order to enable IKE to support NAT traversal, the original IKE must be functionally expanded and partially modified, which is divided into modifications in the main mode stage and modifications in the quick mode stage.

[0055] Main mode phase modification: This is achieved by exchanging VendorIDs, which are included in the first two messages of the first phase. The VendorID payload is exchanged to determine whether the remote host supports NAT traversal.

[0056] The communicating parties send NAT-D payloads to detect whether there is a NAT device between the communicating IKE entities and the location of the NAT device, and to check whether the IP address and port change along the transmission path.

[0057] Some NAT devices do not change port 500. These NAT devices complete the mapping with multiple clients through Cookie values ​​instead of source ports. It is necessary to move IKE transmission away from port 500.

[0058] Phase 1 is completed, and the negotiating parties have determined whether NAT exists. Whether to use NAT traversal is determined by the quick mode. In the second phase of IKE negotiation, under the protection of IKE SA, IPSec SA is established. Through the main mode phase of IKE negotiation, it is determined whether the VPN connection passes through the NAT device and whether NAT traversal is required. If necessary, NAT traversal begins in the second phase.

[0059] Negotiate the packet encapsulation mode. The two communicating parties send the initial address of the IPSec packet to each other and use NAT-OA packets to ensure that both parties can still perform correct verification after NAT conversion.

[0060] UDP packet encapsulation method: Use the standard UDP protocol header in the IPv4 protocol to encapsulate IPSec packets to form a UDP tunnel. The devices on the communication path see UDP packets. Through configuration, UDP-encapsulated packets pass through NAT and firewalls. NAT and firewalls process these datagrams according to the normal UDP protocol. The UDP protocol header of the encapsulated packets is removed at the receiving end, and the IPSec packets are restored.

[0061] ESP / UDP encapsulation method in traditional mode:

[0062] Sender: Performs general ESP encapsulation on the message, then inserts a suitable UDP header, and edits the total length field, protocol field, and checksum field in the IP header to match the received message.

[0063] Receiver: Delete the UDP header from the message, and edit the total length field, protocol field, and checksum field in the IP header to match the received message.

[0064] ESP / UDP encapsulation method in tunnel mode:

[0065] Sender: Normal ESP encapsulation processing, inserting a UDP header of the appropriate format, editing the total length field, protocol field, and checksum field in the new IP header to match the received message.

[0066] Receiver: Delete the UDP header from the message, and edit the total length field, protocol field, and checksum field in the IP header to match the received message.

[0067] Compatibility with NAT traversal solutions using UDP encapsulation:

[0068] With good configurability, the UDP encapsulation traversal NAT solution is simpler and easy to implement in a short time.

[0069] The compatibility is general and cannot solve the compatibility issues between protocols other than IPSec and NAT.

[0070] Conclusion: The compatibility issues between VPN and NAT mainly stem from the interaction between IPSec protocol and NAT. These compatibility issues can be effectively resolved by adopting specific IPSec modes (such as ESP tunnel mode), ensuring that NAT is processed before IPSec, or enabling IPSecNAT traversal. In actual applications, it is necessary to select the appropriate solution based on the specific network environment and security requirements.

[0071] Based on the above method, the UDP encapsulation IPSec data packet device in this embodiment includes: at least one memory and at least one processor;

[0072] The at least one memory is used to store a machine-readable program;

[0073] The at least one processor is used to call the machine-readable program to execute the UDP encapsulation IPSec data packet method.

[0074] The above-mentioned specific implementations are only specific cases of the present invention. The patent protection scope of the present invention includes but is not limited to the above-mentioned specific implementations. Any technical solutions that conform to the above-mentioned specific implementations of the present invention and any appropriate changes or substitutions made by ordinary technicians in the relevant technical field shall fall within the patent protection scope of the present invention.

[0075] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. UDP encapsulation IPSec data packet method, characterized in that: The two communicating parties first exchange VendorID information to detect whether the other party supports NAT traversal (NAT-T); if the verification is successful, they continue to send NAT data packets to each other to detect whether there is a NAT device between the two communicating parties; once the existence of a NAT device is detected, the initiator changes the communication port to port 4500 and continues the negotiation, and UDP format encapsulation must be performed after IPSec processing; The party initiating IPSec negotiation sends Keepalive messages periodically to determine whether a connection exists, and the NAT gateway's dynamic mapping of its UDP port is not deleted.

2. The UDP encapsulation IPSec data packet method according to claim 1, characterized in that: They are the design of NAT traversal solution and the method of UDP data packet encapsulation; The NAT traversal solution expands and partially modifies the original IKE in terms of functions, which is divided into modifications in the main mode stage and modifications in the quick mode stage.

3. The UDP encapsulation IPSec data packet method according to claim 2, characterized in that: The modifications to the main mode phase are: This is done by exchanging VendorIDs, which are included in the first two messages in the first phase. The VendorID payload is exchanged to determine whether the remote host supports NAT traversal. The communicating parties send NAT-D payloads to detect whether there is a NAT device between the communicating IKE entities and the location of the NAT device, and to check whether the IP address and port change along the transmission path; Some NAT devices do not change port 500. These NAT devices complete the mapping with multiple clients through Cookie values ​​instead of source ports. It is necessary to move IKE transmission away from port 500.

4. The UDP encapsulation IPSec data packet method according to claim 3, characterized in that: After the main mode phase is completed, the negotiating parties have determined whether NAT exists. Whether to use NAT traversal is determined by the quick mode. In the second phase of IKE negotiation, IPSec SA is established under the protection of IKE SA. Through the main mode phase of IKE negotiation, it is determined whether the VPN connection passes through the NAT device and whether NAT traversal is required. If necessary, NAT traversal begins in the second phase. Negotiate the packet encapsulation mode. The two communicating parties send the initial address of the IPSec packet to each other and use NAT-OA packets to ensure that both parties can still perform correct verification after NAT conversion.

5. The UDP encapsulation IPSec data packet method according to claim 4, characterized in that: The method of UDP data packet encapsulation is: The IPSec data packet is encapsulated with the standard UDP protocol header in the IPv4 protocol to form a UDP tunnel. The devices on the communication path see UDP data packets. Through configuration, the UDP encapsulated data packets pass through NAT and firewalls. NAT and firewalls process these data packets according to the normal UDP protocol. The UDP protocol header of the encapsulated data packet is removed at the receiving end, and the IPSec data packet will be restored.

6. The UDP encapsulation IPSec data packet method according to claim 5, characterized in that: The ESP and UDP encapsulation methods in traditional mode are: Sender: Performs general ESP encapsulation on the message, then inserts a suitable UDP header, and edits the total length field, protocol field, and checksum field in the IP header to match the received message; Receiver: Delete the UDP header from the message, and edit the total length field, protocol field, and checksum field in the IP header to match the received message.

7. The UDP encapsulation IPSec data packet method according to claim 6, characterized in that: The ESP and UDP encapsulation methods in tunnel mode are: Sender: Normal ESP encapsulation processing, inserting a UDP header of the appropriate format, editing the total length field, protocol field, and checksum field in the new IP header to match the received message; Receiver: Delete the UDP header from the message, and edit the total length field, protocol field, and checksum field in the IP header to match the received message.

8. UDP encapsulation IPSec data packet device, characterized in that: include: at least one memory and at least one processor; The at least one memory is used to store a machine-readable program; The at least one processor is configured to call the machine-readable program to execute the method according to any one of claims 1 to 7.

Images