Overlay Edge Router for IPSec AH NAT Traversal

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Network Address Translation (NAT) devices are incompatible with Internet Protocol Security (IPSec) Authentication Header (AH) due to modifications in IP addresses, which cause integrity check value failures, preventing secure IP packet transmission across NAT routers.

Innovation Solution

Implementing overlay edge routers between private domains and NAT routers to compute and update IPSec AH authentication data using final IP addresses before delivery, creating an overlay domain with overlay edge routers and controllers to facilitate secure IPSec AH authentication across NAT devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If NAT devices modify IP addresses in IP packets, then address mapping functionality is improved, but IPSec AH authentication fails due to integrity check value mismatches

Engineering Contradiction:

Improveaddress mapping functionalityVSAvoidIPSec AH authentication

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces an intermediary component (NAT traversal module or overlay edge router) positioned between the NAT device and IPSec endpoints. This intermediary computes IPSec AH authentication data using the original pre-NAT IP addresses while allowing the NAT device to modify addresses for address mapping. The intermediary recalculates integrity check values after NAT translation, enabling both address mapping functionality and IPSec AH authentication to coexist without compromising either.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If IPSec AH includes integrity check over IP addresses, then authentication security is improved, but compatibility with NAT devices deteriorates

Engineering Contradiction:

Improveauthentication securityVSAvoidNAT device compatibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent applies preliminary action by computing the IPSec AH integrity check value (ICV) in advance using the original pre-NAT IP addresses before the packet undergoes NAT translation. The overlay edge router or NAT traversal module performs this authentication computation beforehand, storing the ICV based on original addresses. When the NAT-modified packet arrives, the system retrieves and verifies the pre-computed ICV, allowing authentication security to be maintained while adapting to NAT address modifications.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If NAT modifies source and destination IP addresses, then private address translation is improved, but packet integrity verification fails

Engineering Contradiction:

Improveprivate address translationVSAvoidpacket integrity verification

Core Design Contradiction:

Adaptability or versatilityVSManufacturing precision

Solution Approach 1:

The patent resolves this contradiction by operating in another dimension - the overlay network layer. While the underlying NAT network modifies IP addresses at the network layer, the overlay edge routers maintain original address information and compute authentication data in the overlay dimension. This dual-layer approach allows private address translation to function at the network layer while packet integrity verification is performed at the overlay layer using original addresses, preventing verification failures.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

Data Source

PatentUS10333919B2System and method for traversing a NAT device with IPSec AH authentication

Publication Date: 2019.06.25 CISCO TECHNOLOGY INC

AI summary

A method for routing IP packets with IPSec AH authentication is disclosed. The method includes locating overlay edge routers between private domains and their associated NAT routers. Outbound packets from a source private domain are modified by its overlay edge router to include IPSec AH authorization data computed using IP source and destination addresses that match a packet's final source and destination IP address upon final NAT translation immediately prior to delivery to a host of a destination private domain.