IPsec AH Authentication After NAT Traversal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The coexistence of IPSEC packets in AH mode with Network Address Translation (NAT) traversal poses challenges, including increased processing pressure on NAT devices and upgrade costs, as NAT devices struggle to perceive and authenticate IPSEC packets effectively after NAT traversal.
Innovation Solution
The method involves using IKE negotiation to detect NAT traversal ability and establish an NAT translation table, allowing the original IP address and port number to be carried in IKE packets, which are then used to replace and recalculate checksums for AH authentication on IPSEC packets that have traversed NAT devices, ensuring successful authentication without requiring NAT devices to perceive IPSEC packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If AH mode IPSEC packets traverse NAT devices, then network address translation is achieved, but authentication fails due to packet modification
Solution Approach 1:
The patent applies preliminary action by performing AH authentication before NAT traversal. The sending end calculates the authentication value over the original IP header fields before the packet reaches the NAT device. This ensures that the authentication is established on the pre-translation state, and the NAT device can translate packet fields without affecting the already-computed authentication value, thus preventing authentication failure while enabling NAT traversal.
2Adaptability or versatility
If NAT devices perceive and process IPSEC packets, then NAT traversal is enabled, but processing pressure on NAT devices increases
Solution Approach 1:
The patent extracts the authentication verification function from the NAT device processing flow. By performing AH authentication before NAT traversal at the sending end, the NAT device only needs to perform simple packet translation without complex authentication processing. This separation of functions reduces the processing burden on NAT devices while maintaining IPSEC security, thereby improving processing throughput.
3Reliability
If existing NAT devices are upgraded to support IPSEC packets, then authentication reliability improves, but upgrade costs increase
Solution Approach 1:
The patent employs a cost-effective approach by implementing authentication before NAT traversal at the sending end, which requires no expensive upgrades to existing NAT devices. The solution uses standard IPSEC AH mode functionality already present in most networking equipment, avoiding the need for costly hardware or software upgrades while maintaining authentication reliability. This makes the solution economically viable for widespread deployment.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
A method and device for performing an AH authentication on an IPSEC packet having gone through NAT traversal are disclosed. The method includes: a receiving end receiving an IKE second-stage negotiation packet from a sending end; extracting an original IP address and port number from a payload of the IKE second-stage negotiation packet as a first IP address and port number, and extracting an IP address and port number from a packet header of the IKE second-stage negotiation packet as a second IP address and port number; establishing an NAT translation table according to the first IP address and port number and the second IP address and port number; and performing the AH authentication on the received IPSEC packet by using the NAT translation table.