IPsec AH Authentication After NAT Traversal

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

The coexistence of IPSEC packets in AH mode with Network Address Translation (NAT) traversal poses challenges, including increased processing pressure on NAT devices and upgrade costs, as NAT devices struggle to perceive and authenticate IPSEC packets effectively after NAT traversal.

Innovation Solution

The method involves using IKE negotiation to detect NAT traversal ability and establish an NAT translation table, allowing the original IP address and port number to be carried in IKE packets, which are then used to replace and recalculate checksums for AH authentication on IPSEC packets that have traversed NAT devices, ensuring successful authentication without requiring NAT devices to perceive IPSEC packets.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If AH mode IPSEC packets traverse NAT devices, then network address translation is achieved, but authentication fails due to packet modification

Engineering Contradiction:
ImproveNAT traversal capabilityVSAvoidAuthentication success rate
Core Design Contradiction:
Adaptability or versatilityVSReliability

Solution Approach 1:

The patent applies preliminary action by performing AH authentication before NAT traversal. The sending end calculates the authentication value over the original IP header fields before the packet reaches the NAT device. This ensures that the authentication is established on the pre-translation state, and the NAT device can translate packet fields without affecting the already-computed authentication value, thus preventing authentication failure while enabling NAT traversal.

Inventive Principle:
Principle #10Preliminary action

2Adaptability or versatility

If NAT devices perceive and process IPSEC packets, then NAT traversal is enabled, but processing pressure on NAT devices increases

Engineering Contradiction:
ImproveIPSEC packet processing capabilityVSAvoidNAT device processing throughput
Core Design Contradiction:
Adaptability or versatilityVSProductivity

Solution Approach 1:

The patent extracts the authentication verification function from the NAT device processing flow. By performing AH authentication before NAT traversal at the sending end, the NAT device only needs to perform simple packet translation without complex authentication processing. This separation of functions reduces the processing burden on NAT devices while maintaining IPSEC security, thereby improving processing throughput.

Inventive Principle:
Principle #2Taking out (Extraction)

3Reliability

If existing NAT devices are upgraded to support IPSEC packets, then authentication reliability improves, but upgrade costs increase

Engineering Contradiction:
ImprovePacket authentication reliabilityVSAvoidNetwork infrastructure upgrade cost
Core Design Contradiction:
ReliabilityVSEase of manufacture

Solution Approach 1:

The patent employs a cost-effective approach by implementing authentication before NAT traversal at the sending end, which requires no expensive upgrades to existing NAT devices. The solution uses standard IPSEC AH mode functionality already present in most networking equipment, avoiding the need for costly hardware or software upgrades while maintaining authentication reliability. This makes the solution economically viable for widespread deployment.

Inventive Principle:
Principle #27Cheap short-living objects (Disposable)

Data Source

PatentEP3131269B1Method and device for conducting ah authentication on ipsec packet which has gone through NAT traversal
Publication Date: 2018.10.31 ZTE CORP
  • EP3131269B1 patent drawingFigure 1~2
  • EP3131269B1 patent drawingFigure 3~4
  • EP3131269B1 patent drawingFigure 5~6

AI summary

A method and device for performing an AH authentication on an IPSEC packet having gone through NAT traversal are disclosed. The method includes: a receiving end receiving an IKE second-stage negotiation packet from a sending end; extracting an original IP address and port number from a payload of the IKE second-stage negotiation packet as a first IP address and port number, and extracting an IP address and port number from a packet header of the IKE second-stage negotiation packet as a second IP address and port number; establishing an NAT translation table according to the first IP address and port number and the second IP address and port number; and performing the AH authentication on the received IPSEC packet by using the NAT translation table.