Symmetric NAT Address Discovery for Stable IPsec Tunnels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Symmetric NAT functionality introduces complexity in IPsec tunnels and Security Associations by altering the IP and port combinations used for encryption and decryption, leading to security vulnerabilities and inefficiencies in communication systems.
Innovation Solution
A mechanism for enterprise endpoints to securely discover their peer endpoints' NAT-translated IP addresses and port numbers using encrypted, one-way UDP probe packets, which update NAT-Traversal tables to maintain accurate IPsec tunnels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If Symmetric NAT functionality is used to translate IP addresses and ports, then network address translation is achieved, but Security Associations and IPsec tunnels become unstable due to changing IP and port combinations
Solution Approach 1:
The patent segments the IP header into multiple layers: outer IP header (for NAT translation) and inner IP header (for IPsec tunnel identification). This segmentation allows the outer header to change due to Symmetric NAT while the inner header remains stable for Security Association matching, resolving the conflict between NAT adaptability and tunnel stability
Solution Approach 2:
The patent introduces an intermediary mechanism (inner IP header with preserved source/destination addresses) that mediates between the changing outer IP addresses required by Symmetric NAT and the stable address pairs required by IPsec Security Associations. This intermediary layer ensures reliable tunnel maintenance despite NAT-induced address changes
2Reliability
If dynamic authentication and key exchange using IKEv2 protocol is implemented, then secure IPsec tunnel establishment is achieved, but resource consumption increases significantly in full-mesh deployments
Solution Approach 1:
The patent performs preliminary key exchange and Security Association establishment through the GDOI controller before endpoints need actual data transmission. This preliminary action allows endpoints to reuse pre-established Security Associations rather than performing resource-intensive IKEv2 negotiations for each communication session, reducing overall resource consumption while maintaining security
Solution Approach 2:
The patent introduces a GDOI controller as an intermediary that centralizes key management and Security Association establishment. This intermediary eliminates the need for direct peer-to-peer IKEv2 negotiations between all endpoint pairs in a full-mesh deployment, significantly reducing computational resource consumption while maintaining secure tunnel establishment
3Extent of automation
If GDOI controller distributes public IP addresses and port numbers, then centralized key management is achieved, but the controller cannot learn the correct NAT-translated addresses for endpoint packets
Solution Approach 1:
The patent extracts the NAT-translated address information learning process from the GDOI controller and places it at the endpoint level. Endpoints independently learn their public IP addresses and port numbers by sending probe packets through the Symmetric NAT, then use this extracted information to populate the outer IP header, solving the information loss problem while maintaining centralized key management
Solution Approach 2:
The patent implements self-service at the endpoint level where each endpoint autonomously discovers its own NAT-translated public IP address and port number by sending probe packets through the Symmetric NAT. This self-service approach allows endpoints to obtain accurate NAT translation information without requiring the GDOI controller to learn or manage these dynamically changing addresses
Data Source
AI summary
In an enterprise having a local endpoint located behind a Symmetric NAT node, the local endpoint distributes its public IP address for endpoint packets to remote endpoints by generating probe packets having the local endpoint's private IP address as the source address in an outer IP header and the local endpoint's ID as the source address in an inner IP header. The Sym-NAT node replaces the private IP address with the public IP address for endpoint packets as the outer IP header's source address. Each remote endpoint uses the local endpoint's ID in the probe packet's inner IP header and uplink information from decrypted probe data to identify the source address in the probe packet's outer IP header as the local endpoint's public IP address for endpoint packets, thereby solving the problem of remote nodes receiving only the local endpoint's public IP address for controller packets from the enterprise controller.