Gateway Authentication for NAT-Protected Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In communication systems with gateways and gatekeepers across different IP address ranges, the conversion of IP addresses using Network Address Translation (NAT) causes cryptographic checksums to mismatch, leading to rejected messages, and existing solutions require each gateway to access a user database for authentication and authorization, increasing administration effort.
Innovation Solution
The solution involves separating authentication and authorization checks, where the gateway authenticates the request message and only forwards it to the gatekeeper for authorization, eliminating the need for gateways to access user-related data and reducing database connections, allowing for secure communication with lower administration effort.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the gateway performs IP address conversion using NAT, then communication between different IP address ranges is enabled, but the cryptographic checksum no longer matches and the message is rejected
Solution Approach 1:
The patent segments the authentication and authorization functions: authentication is performed by the gateway before NAT conversion, while authorization is performed by the gatekeeper after conversion. This separation allows the gateway to verify message authenticity before modifying IP addresses, preventing checksum mismatches while enabling cross-network communication.
Solution Approach 2:
The gateway performs authentication checking before the IP address conversion takes place. By verifying the cryptographic checksum and authenticating the message prior to NAT modification, the system ensures that the original message integrity is confirmed before any changes are made to the message content.
2Reliability
If each gateway accesses the user database for authentication and authorization, then proper security checks are performed, but the administration effort and database connections increase
Solution Approach 1:
The patent extracts the authentication function from the authorization function and assigns it to the gateway. The gatekeeper retains only the authorization function and accesses the user database. This extraction eliminates the need for multiple gateways to access the database, reducing administration effort while maintaining security.
Solution Approach 2:
The gateway acts as an intermediary that performs authentication locally without needing to access the central user database. This intermediary role allows the gateway to verify message authenticity independently, while the gatekeeper handles authorization centrally, reducing the complexity of database connections across multiple gateways.
3Adaptability or versatility
If multiple gateways perform IP address conversion and authentication checks, then communication across different networks is supported, but the administration effort increases
Solution Approach 1:
The patent segments the functions so that authentication is performed locally at each gateway without requiring access to the central user database. This segmentation allows multiple gateways to operate independently with their own authentication capabilities, reducing the administration effort required to manage database connections across the system.
Solution Approach 2:
Each gateway performs self-service authentication by checking the cryptographic checksum locally without needing to access the central user database. This self-service capability allows multiple gateways to manage their own authentication independently, significantly reducing the administration effort compared to centralized database access requirements.
Data Source
AI summary
A communication system is proposed which, as its communication elements (KE) has a gatekeeper (GK), a gateway (GW) coupled to the gatekeeper (GK) and at least one communication unit (KEH) coupled to the gateway (GW), with the communication system being set up so that, to register a communication relationship of the communication unit (KEH) in the communication system (KS), a request message (ANF) is transmitted from the communication unit (KEH) via the gateway (GW) to the gatekeeper (GK), which is checked in the gateway (GW) for authenticity and in the gatekeeper (GK) for authorization.