Method and system for sending a message through a secure connection

Abstract

The method and system enable secure forwarding of a message from a first computer to a second computer via an intermediate computer in a telecommunication network. A message is formed in the first computer or in a computer that is served by the first computer, and in the latter case, sending the message to the first computer. In the first computer, a secure message is then formed by giving the message a unique identity and a destination address. The message is sent from the first computer to the intermediate computer after which the destination address and the unique identity are used to find an address to the second computer. The current destination address is substituted with the found address to the second computer, and the unique identity is substituted with another unique identity. Then the message is forwarded to the second computer.

Claims

1. An intermediate computer for secure forwarding of messages in a telecommunication network, comprising: an intermediate computer configured to connect to a telecommunication network; the intermediate computer configured to receive an encrypted signaling message from a first computer, the first computer being a mobile computer connected to the telecommunication network using a wireless connection; the intermediate computer configured to access a first mapping between a first unique identity and an address of the first computer; the intermediate computer configured to change the address of the first computer in the first mapping after receiving the encrypted signaling message from the first computer; the intermediate computer configured to access a second mapping between a second unique identity and an address of a second computer; the intermediate computer configured to receive from the first computer a first message containing a first encrypted payload and a single field containing the second unique identity, the first encrypted payload encrypted with a first encryption key derived from a key exchange protocol and the first message being encapsulated with an encapsulation protocol; the intermediate computer configured to use the second unique identity and the second mapping to find the address of the second computer; the intermediate computer configured to forward the first encrypted payload to the second computer using the encapsulation protocol, wherein the intermediate computer does not have the first encryption key; the intermediate computer configured to receive from the second computer a second message containing a second encrypted payload and a single field containing the first unique identity, the second encrypted payload encrypted with a second encryption key derived from the key exchange protocol and the second message being encapsulated with the encapsulation protocol; the intermediate computer configured to use the first unique identity and the first mapping to find the address of the first computer; the intermediate computer configured to forward the second encrypted payload to the first computer using the encapsulation protocol, wherein the intermediate computer does not have the second encryption key; and the intermediate computer configured to perform a retransmission protocol to prevent dropped messages between the first computer and the intermediate computer.

2. The intermediate computer of claim 1, wherein the retransmission protocol is based on a sequence number.

3. The intermediate computer of claim 1, wherein the retransmission protocol is based on a replay protection window.

4. The intermediate computer of claim 1, wherein the encapsulation protocol is SSL or TLS.

5. The intermediate computer of claim 1, wherein the encapsulation protocol supports NAT traversal.

6. The intermediate computer of claim 1, wherein the encapsulation protocol is UDP.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

(1) FIG. 1 illustrates an example of a telecommunication network of the invention.

(2) FIG. 2 describes generally an example of the method of the invention.

(3) FIG. 3 illustrates an example of an IPSec translation table used by the intermediate computer to change the outer IP address and SPI value.

(4) FIG. 4 describes a detailed example of how the SA is formed in the invention.

(5) FIG. 5 illustrates an example of translation tables for the modified key exchange of the invention.

(6) FIG. 6 shows a mapping table for identification values of the user Security Gateway (SGW) addresses.

DETAILED DESCRIPTION OF THE INVENTION

(7) An example of a telecommunication network of the invention is illustrated in FIG. 1, comprising a first computer, here a client computer 1 served by an intermediate computer, here as a server 2, and a host computer 4, that is served by the second computer, here a security gateway (SGW) 3. The security gateway supports the standard IPSec protocol and optionally the IKE key exchange protocol. The client computer and the server computer support a modified IPSec and IKE protocol.

(8) The invention is not restricted to the topology of FIG. 1. In other embodiments, the first computer may e.g. be a router; or there might e.g. not be a host behind the second computer (in which case the first and the second computer are talking to each other directly), etc.

(9) The IPSec translations taking place in the scenario of FIGS. 1, 2, and 3 are discussed first. The IPSec connections (such as SAs) in the scenario may be established manually, or using some key exchange protocol, such as the Internet Key Exchange (IKE). To illustrate how a key exchange protocol would be used in the scenario of FIG. 1, a modified IKE protocol based on IKE translation is also presented later.

(10) In the invention, an IPSec connection is shared by the first computer and the second computer, while the intermediate computer holds information required to perform address and IPSec SPI translations for the packets. These translations accomplish the effect of “double tunnelling” (described in the technical background section), but with the method of the invention the confidentiality of the packets is not compromised, while simultaneously having no extra overhead when compared to standard IPSec. The intermediate computer does not know the cryptographic keys used to encrypt and/or authenticate the packets, and can thus not reveal their contents.

(11) The advantage of the invention is that the logical IPSec connection shared by the first and the second computer can be enhanced by the first and the intermediate computer without involvement of the second computer. In particular the so-called “ingress filtering” performed by some routers does not pose any problems when translations of addresses are used. In the example presented, each host also manages its own IPSec SPI space independently.

(12) In the example of FIG. 1, an IPSec connection is formed between the client computer 1 (the first computer) and the security gateway 3 (the second computer). To create an IPSec tunnel, a SA (or usually a SA bundle) is formed between the respective computers with a preceding key exchange. The key exchange between the first and the second computer can take place manually or it can be performed with an automatic key exchange protocol such as the IKE protocol. For performing said key exchange, a standard IKE protocol is used between the server 2 and the security gateway 3, and a modified IKE protocol is used between the client computer 1 and the server 2. An example of a modified IKE protocol that can be used in the invention is described in connection with FIG. 4.

(13) Messages to be sent to the host terminal 4 from the client computer 1 are first sent to the server 2, wherein an IPSec translation and an IKE translation takes place. After that the message can be sent to the security gateway 3, which sends the message further in plain text to the host terminal 4.

(14) The method of the invention, wherein messages in packet form are sent by routing to the end destination, is generally described in connection with FIG. 2. It is assumed in the following description that the IPSec connection between the first and second computer already is formed. The IPSec connection can be set up manually or automatically by e.g. an IKE exchange protocol which is described later.

(15) FIG. 2 illustrates the sequence of events that take place when the first computer, corresponding to the mobile terminal in FIG. 1, sends a packet to a destination host, labelled X in the figure, and when the host X sends a packet to the mobile terminal.

(16) IP packets consist of different parts, such as a data payload and protocol headers. The protocol headers in turn consist of fields.

(17) In step 1 of FIG. 2, the first computer, e.g. a mobile terminal, forms an IP packet that is to be sent to host X. Typically, this packet is created by an application running on the mobile terminal. The IP packet source address is the address of the mobile terminal, while the destination address is host X.

(18) The packet is processed using an IPSec tunnel mode SA, which encapsulates the IP packet securely. The example assumes that IPSec encryption and/or authentication of ESP type is used for processing the-packet, although the invention is not limited to the use of only ESP; instead, an arbitrary IPsec connection may be used.

(19) In said processing, a new IP header is constructed for the packet, with so-called outer IP addresses. The outer source address of the packet can be the same as the inner IP address—i.e., the address of the mobile terminal—but can be different, if the mobile terminal is visiting a network. The outer source address corresponds to the care of address obtained by the mobile terminal from the visited network, in this case. The outer destination address is the address of the intermediate computer. In addition to the new IP header, an ESP header is added, when using IPSec ESP mode. The SPI field of the ESP header added by the IPSec processing is set to the SPI value that the intermediate computer uses for receiving packets from the mobile terminal. In general, there may be more than one SPI field in a packet.

(20) The processing of packets in the intermediate computer is based on a translation table i.e. an IPSec translation table shown in FIG. 3. The table has been divided into two partitions. The left one, identified by the prefix “c-”, refers to the network connection between the first computer (host 1 in FIG. 1) and the intermediate computer (host 2 in FIG. 1). The right one, identified by the prefix “s-”, refers to the network connection between the intermediate computer and the second computer (computer 3 in FIG. 1). The postfix number (“−1”, “−2”, or “−3”) identifies the host in question. Thus, the address fields (“addr”) refer to outer addresses of a packet, while the SPI fields (“SPI”) refer to the receiver of packets, which packets were sent with this SPI. Thus, “c-SPI-2” is the SPI value used by host 2 (the intermediate computer) when receiving packets from host 1 (the first computer), and the SPI-value “c-SPI-1” is the SPI-value with which the first computer receives messages and the SPI-value with which the intermediate computer sends messages to the first computer and so on.

(21) In terms of FIG. 3, the outer source address would be “c-addr-1” (195.1.2.3), the outer destination address “c-addr-2” (212.90.65.1), while the SPI field would be “c-SPI-2” (0×12341234). The notation 0×NNNNNNNN indicates a 32-bit unsigned integer value, encoded using a hexadecimal notation (base 16). The inner source address is processed by IPSec in the first computer, and would typically be encrypted. In this example, the inner source address would be the static address of the mobile terminal, e.g. 10.0.0.1.

(22) When the intermediate computer receives the packet sent in step 1 described above, it performs an address and SPI translation, ensuring that the security gateway (host 3 of FIG. 1) can accept the packet. Most of the packet is secured using IPSec, and since the intermediate computer does not have the cryptographic keys to undo the IPSec processing done by the mobile terminal, it cannot decrypt any encrypted portions of the packet but is able to use the outer IP addresses and the incoming SPI value to determine how to modify the outer address and the SPI to suite the second computer, which is the next destination. SPI is now changed to 0×56785678 in the intermediate computer and the address is changed to the address of the second computer. This is done by means of the IPSec translation table of FIG. 3.

(23) The first row of FIG. 3 is a row that the intermediate computer has found that matches the packet in the example, and thus the intermediate computer chooses it for translation. The new outer source address s-addr-2 (212.90.65.1) is substituted for the outer source address c-addr-1 (195.1.2.3), and the new outer destination address s-addr-3 (103.6.5.4) is substituted for the outer destination address c-addr-2 (212.90.65.1). The new SPI value, s-SPI-3 (0×56785678), is substituted for the SPI value c-SPI-2 (0×12341234). If more than one SPI values are used, all the SPI values are substituted similarly. In the example, s-addr-2 and c-addr-2 happen to be the same on both partitions of the table. This is not necessarily so but the intermediate computer might use another address for sending.

(24) In step 2 of FIG. 2, the translated packet is sent further to the second computer. The inner IP packet has not been modified after that the first computer sent the packet. The second computer processes the packet using standard IPSec algorithms. The security gateway (the second computer) can e.g. decipher and/or check the authenticity of the packet, then remove the IPSec tunnelling, and forward the original packet towards the destination host, X. Thus, the entire original packet was unaffected by the translation as the IP header, and thus the address fields, was covered by IPSec.

(25) After uncovering the original packet from the IPsec tunnel, the second computer makes a routing decision based on the IP header of the original packet. In the example, the IP destination address is X (host X in FIG. 2), and thus the second computer delivers the packet either directly to X, or to the next hop router.

(26) In step 3 of FIG. 2, the packet is sent from the second computer (corresponding to SGW in FIG. 1) to host X, having now only the original source IP address 10.0.0.1 and the original destination IP address X in the IP header. Thus, in step 3, host X receives the packet sent by the second computer. Usually, an application process running on host X would generate some return traffic. This would cause an IP packet to be generated and sent to the second computer.

(27) If a packet is sent back from host X to the first computer (corresponding to the client computer in FIG. 1), steps analogous to steps 1-3 are performed. The packet is thus first sent to the second computer, with the source IP address being X and the destination IP address being 10.0.0.1, in step 4. The generated packet is then received by the second computer. The IPSec policy of the second computer requires that the packet be IPSec-processed using a tunnel mode IPSec SA. This processing is similar to the one in steps 1 and 2. A new, outer IP header is added to the packet in the second computer, after which the resulting packet is secured using the IPSec SA. The outer IP source address is set to s-addr-3 (103.6.5.4) while the outer IP destination address is set to s-addr-2 (212.90.65.1). The SPI field is set to s-SPI-2 (0×c1230012). In step 5, the resulting packet is sent to the address indicated by the new outer IP destination address, s-addr-2, the intermediate computer. The intermediate computer receives the packet and performs a similar address and SPI translation.

(28) The inner addresses are still the same, and are not modified by the intermediate computer. Since the packet intended to be sent to the first computer, the new, translated outer destination IP address indicate the address of the first computer.

(29) The resulting packet is sent to the first computer in step 6.

(30) As a result of step 6, the packet is received by the first computer. The IPSec processing is undone, i.e. decryption and/or authentication is performed, and the original packet is uncovered from the IPSec tunnel. The original packet is then delivered to the application running on the first computer. In case the first computer acts as a router, the packet may be delivered to a host in a subnet for which the first computer acts as a router.

(31) The first computer may be a mobile terminal, the outer address of which changes from time to time. The translation table is then modified using some form of signalling messages, as described in the summary section. Upon receiving a request for modifying a translation, the intermediate computer updates the related translation table entry to match the new information supplied by the first computer. The operation of the protocol then proceeds as discussed above.

(32) The above discussion is a limited example for illustration purposes. In other embodiments e.g. more than one SA for the connection—for instance, ESP followed by AH, can be used. This introduces two SPI values that must be translated. More than two is also, of course, possible. Furthermore, the example was considered for IPsec ESP only. The changes required for an embodiment in which AH (or ESP+AH) is used, are discussed next.

(33) Changes for Using AH:

(34) If the Authentication Header (AH) IPSec security transform is to be used, there are more considerations than in the previous example. In particular, modifications of the packet fields—even the outer IP header—are detected if AH is used. Thus, the following nominal processing is required by the first computer. The second computer performs standard IPSec processing also in this case.

(35) In step 1, when sending a packet, the first computer must perform IPsec processing using the SPI values and addresses used in the connection between the intermediate computer and the second computer. For instance, the SPI value would be s-SPI-3, the outer source address s-addr-2, and the outer destination address s-addr-3. The AH integrity check value (ICV) must be computed using these values. ICV is a value, which authenticates most of the fields of the packet. In practice, all fields that are never modified by routers are authenticated.

(36) After computing the AH integrity check value, the outer addresses and the SPI value are replaced with the values used between the first computer and the intermediate computer: c-addr-1 for the outer source address, c-addr-2 for the outer destination address, and c-SPI-2 for the SPI.

(37) In step 2, the intermediate computer performs the address and SPI translations as in the example with ESP described above. The resulting packet is identical to the one used by the first computer for the AH integrity check value calculation, except possibly for fields not covered by AH (such as the Time-To-Live field, the header checksum, etc). Thus, the AH integrity check value is now correct.

(38) In step 3, the second computer performs standard IPSec processing of AH. The packet, which now is uncovered from the tunnel is sent to the host X. As in the previous example, an application in host X usually generates a return packet that is to be sent to the first computer. This packet is sent to the second computer in step 4.

(39) Upon receiving the packet, the processing of the second computer are the same as in the example with ESP. The second computer computes an AH integrity check value of the tunneled packet it is sending to the mobile terminal. The integrity check value is computed against the outer source address of s-addr-3, outer destination address of s-addr-2, and the SPI value of s-SPI-2.

(40) In step 5, when the intermediate computer receives the packet, it performs ordinary translation of the packet. The new outer source address is c-addr-2, the outer destination address is c-addr-1, and the SPI value is c-SPI-1. At this point the AH integrity check value is incorrect, which was caused by the translations.

(41) When the mobile terminal receives the packet, it performs a translation of the current outer addresses and the SPI field for the original ones used by the second computer: s-addr-3 for the outer source address, s-addr-2 for the outer destination address, and s-SPI-2 for the SPI value. This reproduces the packet originally sent by the second computer, except possibly for fields not covered by AH. This operation restores the AH integrity check value to its original, correct value. The AH integrity check is then performed against these fields.

(42) Key Exchange Considerations

(43) The above example discussed the “steady state” IPSec translations performed by the intermediate computer. The IPSec SAs and the IPSec translation table entries may be set up manually, or using some automated protocol, such as the Internet Key Exchange (IKE) protocol.

(44) Because the security gateway (the second computer) is a standard IPSec host, it implements some standard key exchange protocol, such as IKE. The first computer and the intermediate computer may use some modified version of IKE, or any other suitable automatic key exchange protocol.

(45) The key exchange must appear as a standard key exchange according to the key exchange protocol supported by the security gateway (the second computer), such as IKE. Also, the overall key exchange performed by the first, intermediate, and second computer must establish not only cryptographic keys, but also the IPSec translation table entries. The overall key exchange protocol should not reveal the IPSec cryptographic keys to the intermediate computer to avoid even the potential for security problems.

(46) In the following, an example of a modified IKE protocol is presented to outline the functionality of such a protocol in the context of the invention. The protocol provides the functionality described above. In particular, the intermediate computer has no knowledge of the IPSec cryptographic keys established. The protocol is presented on a general level to simplify the presentation.

(47) The automatic IKE protocol is used prior to other protocols to provide strongly authenticated cryptographic session keys for the IPSec protocols ESP and AH. IKE performs the following functions: (1) security policy negotiation (what algorithms shall be used, lifetimes etc.), (2) a Diffie-Hellman key exchange, and (3) strong user/host authentication (usually using either RSA-based signatures or pre-shared authentication keys). IKE is divided into two phases: phase 1 and phase 2. Phase 1 negotiates and establishes cryptographic keys for internal use of the IKE protocol itself, and also performs the strong user or host authentication. Phase 2 negotiates and establishes cryptographic keys for IPSec. If IPSec tunnel mode is used, phase 2 also negotiates the kind of traffic that may be sent using the tunnel (so-called traffic selectors).

(48) The IKE framework supports several “sub-protocols” for phase 1 and phase 2. The required ones are “main mode” for phase 1, and “quick mode” for phase 2. These are used as illustrations, but the invention is not limited to these sub-protocols of IKE.

(49) For the security gateway (second computer), the IKE session seems to be coming from the address s-addr-2 in FIG. 3. Since there may be any number of mobile terminals served by the intermediate computer, the intermediate computer should either (1) manage a pool of addresses to be used for the s-addr-2 translation table address, thus providing each user with a separate “surrogate address”, or (2) use the same address (or a limited set of addresses), and ensure that the mobile terminals are identified using some other means than their IP address (IKE provides for such identification types, so this is not a problem).

(50) The modified IKE protocol specified is analogous to the IPSec translation table approach. However, instead of SPIs, the so-called IKE cookies are used as translation indices instead. IKE cookies are essentially IKE session identifiers, and are thus analogous to the IPSec SPI values, which is another form of a session or context identifier. There are two cookies: the initiator cookie, chosen by the host that initiates the IKE session, and the responder cookie, chosen by the host that responds to a session initiation.

(51) The essential features of the protocol are (1) that it appears to be an entirely ordinary IKE key exchange for the security gateway, (2) that the IPsec translation table entry is formed by the intermediate computer during the execution of the protocol, (3) that the first computer obtains all the necessary information for its packet processing, and (4) that the intermediate computer does not obtain the IPsec cryptographic session keys.

(52) The overall steps of the protocol are: 1. The first computer initiates the key exchange protocol by sending a message to the intermediate computer. This message is essentially the IKE main mode initiation message, with some modifications required for this application. 2. The intermediate computer determines which security gateway (second computer) to forward this IKE session to, and also establishes a preliminary IKE translation table entry based on the information available from the message. 3. The security gateway (the second computer) replies to the IKE main mode initiation message. 4. The intermediate computer completes the IKE mapping based on the reply message. 5. The modified IKE protocol run continues through IKE main mode (the phase 1 exchange), which is followed by quick mode (the phase 2 exchange). Extensions of standard IKE messages are used between the first computer and the intermediate computer to accomplish the extra goals required by this modified IKE protocol.

(53) In FIG. 4, the IKE session is described message by message. The following text indicates the contents of each message, and how they are processed by the various hosts. There are six main mode messages in the protocol, named mm1, mm2, . . . , mm6, and three quick mode messages, named qm1, qm2, and qm3.

(54) FIG. 5 illustrates the IKE translation table entry related to the modified IKE key exchange being performed. The bolded entries in each step are added or changed in that step as a result of the processing described in the text.

(55) The IKE translation table partition for the connection between the first computer and the intermediate computer is as follows (the field name in FIG. 5 is given in parentheses):

(56) Local and remote IP address (c-addr-1, c-addr-2)

(57) Initiator and responder cookie (c-icky, c-rcky)

(58) IKE identification of the first computer (c-userid, e.g. joe@netseal.com)

(59) The IKE translation table partition for the connection between the intermediate computer and the second computer is as follows (the field name in FIG. 5 is given in parentheses):

(60) Local and remote IP address (s-addr-2, s-addr-3)

(61) Initiator cookie and responder cookie (s-icky, s-rcky)

(62) In addition to these entries, other data may be kept by the intermediate computer and/or the first computer.

(63) The key exchange is initiated by generating an initiator cookie and sending a zero responder cookie to the second computer. A responder cookie is generated in the second computer and a mapping between IP addresses and IKE cookie values in the intermediate computer is established. A translation table to modify IKE packets in flight by modifying the external IP addresses and possibly IKE cookies of the IKE packets is used.

(64) Either the modified IKE protocol between the first computer and the intermediate computer is modified such that the IKE keys are transmitted from the first computer to the intermediate computer for decryption and modification of IKE packets or, alternatively, the modified IKE protocol between the first computer and the intermediate computer is modified such that the IKE keys are not transmitted from the first computer to the intermediate computer for decryption and modification of IKE packets, and the modification of IKE packets is done by the first computer with the intermediate computer requesting such modifications. The latter alternative is discussed in the example that follows, since it is more secure than the first alternative.

(65) Extra information, such as user information and SPI change requests, to be sent between the first and the intermediate computer, is sent by appending the extra information to the standard IKE messages. The IKE standard has message encoding rules that indicate a definite length, thus the added extra information can be separated from the IKE message itself. The extra information fields are preferably encrypted and authenticated, for instance by using a secret shared by the first computer and the intermediate computer.

(66) The details of this process are not relevant to the invention.

(67) The extra information slot in each IKE message is called the message “tail” in the following.

(68) IKE messages consist of an IKE header, which includes the cookie fields and message ID field, and of a list of payloads. A payload has a type, and associated information.

(69) FIG. 4 considers an example of the routing of packets according to the invention considering IPSec security association set-up for distribution of keys. As in the foregoing FIG. 2, the session begins with sending a packet from the client (first computer) to the server (intermediate computer).

(70) The key exchange is initiated by the first computer. Thus, in step 1 of FIG. 4, the first computer constructs mm1. The IP header of the message contains the following values: IP source address: 195.1.2.3 (c-addr-1) IP destination address: 212.90.65.1 (c-addr-2)

(71) The IKE header contains the following values (step 1 in Figure X): Initiator cookie: CKY1 (c-icky) Responder cookie: 0 (c-rcky) Message ID: 0

(72) The message contains the following payloads: A Security Association (SA) payload, which contains the IKE phase 1 security policy offers from the first computer. The message may contain additional payloads, such as Vendor Identification (VID) payloads, certificate requests/responses, etc. A VID payload can be used to indicate that the first computer supports the protocol described here.

(73) The message tail contains the following information: User identification type and value—the c-userid field. These are used by the intermediate computer to choose a security gateway to forward this session to. The identification type may be any of the IKE types, but additional types can be defined. An alternative to this field is to directly indicate the security gateway for forwarding. There are other alternatives as well, but these are not essential to the invention.

(74) In step 2, the mm1 is received by the intermediate computer. The intermediate computer examines the message, and forms the preliminary IKE translation table entry. FIG. 5, step 1 illustrates the contents of this preliminary entry. The c-userid field is sent in the mm1 tail.

(75) The intermediate computer then determines which security gateway to forward this IKE session to. The determination may be based on any available information, static configuration, load balancing, or availability requirements. The presented, simple method is to use the identification information in the mm1 tail to look up the first matching identification type and value from a table. An example of such a table is presented in FIG. 6.

(76) The identification mapping table of FIG. 6, is one method for choosing a security gateway that matches the incoming mobile terminal. The identification table would in this example be an ordered list of identification type/value entries, that match to a given security gateway address. When the incoming mobile terminal identification matches the identification in the table, the corresponding security gateway is used. For instance, john.smith@netseal.com would match the first row of the table, i.e., the security gateway 123.1.2.3, while joe@netseal.com matches the second row, i.e., the security gateway 103.6.5.4. The identification types include any identification types defined for the IKE protocol, and may contain other types as well, such as employee numbers, etc.

(77) Other methods of determining the security gateway to be used may be employed. One such method is for the mobile terminal to directly indicate a given security gateway to be used. The mobile terminal may also indicate a group of security gateways, one of which is used. The exact details are not relevant to the invention.

(78) In addition to determining the security gateway address, the intermediate computer determines which address its for communication between itself and the second computer. The same address as is used for the communication between the first and the intermediate computer may be used, but a new address may also be used. The address can be determined using a table similar to the one in FIG. 6, or the table of FIG. 6 may be extended to include this address.

(79) The intermediate computer then generates its own initiator cookie. This is done to keep the two session identifier spaces entirely separate, although the same initiator cookie may be passed as is.

(80) After these determinations, the preliminary translation table entry is modified. FIG. 5, step 2 illustrates the contents of the entry at this point.

(81) The original IP header fields are modified as follows (step 2 in FIG. 4): IP source address: 212.90.65.1 (s-addr-2) IP destination address: 103.6.5.4 (s-addr-3)

(82) The IKE header is modified as follows: Initiator cookie: CKY2 (s-icky) Responder cookie: 0 (s-rcky) Message ID: 0

(83) The message tail is removed. The VID payload that identifies support for this modified protocol is also removed. The mm1 is then forwarded to the second computer.

(84) In step 3, the second computer responds with mm2. The IP header of the message contains the following values (step 3 in FIG. 4): IP source address: 103.6.5.4 (s-addr-3) IP destination address: 212.90.65.1 (s-addr-2)

(85) The IKE header contains the following values: Initiator cookie: CKY2 (s-icky) Responder cookie: CKY3 (s-rcky) Message ID: 0

(86) The message contains the following payloads: Security Association (SA) payload. This is a reply to the offer by the first computer, and indicates which security configuration is acceptable for the second computer (this scenario assumes success, so the case of an error reply is not considered). Possibly optional IKE payloads, such as VID payloads, certificate requests/replies, etc.

(87) There is no message tail.

(88) In step 4, the mm2 is received by the intermediate computer. The intermediate computer updates its IKE translation table based on the received message. Step 3 in FIG. 5 illustrates the contents of the translation table entry at this point.

(89) The intermediate computer generates its own responder cookie, CKY4, and updates the translation table yet again. Step 4 in FIG. 5 illustrates the entry at this point. After this step, the translation table entry is complete, and the address and cookie translations are performed as in steps 1-4 for the following messages.

(90) The translated message contains the following IP header fields (FIG. 4, step 4) IP source address: 212.90.65.1 (c-addr-2) IP destination address: 195.1.2.3 (c-addr-1)

(91) The translated IKE header contains the following fields: Initiator cookie: CKY1 (c-icky) Responder cookie: CKY4 (c-rcky)

(92) The message contains the following payloads: The SA payload sent by the second computer. Any optional payloads sent by the second computer. A VID payload may be added to indicate support of this modified protocol to the first computer.

(93) A message tail is added, and contains the following information: Address and/or identification information of the chosen security gateway (the second computer). This information can be used by the client to choose proper authentication information, such as RSA keys.

(94) The message is then forwarded to the first computer.

(95) In step 5, the first computer constructs mm3. The message contains the following payloads: A Key Exchange (KE) payload, that contains Diffie-Hellman key exchange data of the first computer. A Nonce (NONCE) payload, that contains a random number chosen by the first computer. Possibly optional IKE payloads.

(96) The message is sent to the intermediate computer.

(97) In step 6, the mm3 is forwarded to the second computer. The contents of the message are not changed, only the IP header addresses and the IKE cookies, in the manner described in steps 1-4.

(98) In step 7, the second computer receives mm3 and responds with mm4. The message contains the following payloads: A Key Exchange (KE) payload, that contains Diffie-Hellman key exchange data of the second computer. A Nonce (NONCE) payload, that contains a random number chosen by the second computer. Possibly optional IKE payloads.

(99) In step 8, the mm4 is forwarded to the first computer.

(100) In step 9, the first computer constructs mm5, which is the first encrypted message in the session. All subsequent messages are encrypted using the IKE session keys established from the previous Diffie-Hellman key exchange (the messages mm3 and mm4) by means of hash operations, as described in the IKE specification. Note that the intermediate computer does not possess these keys, and can thus not examine the contents of any subsequent IKE messages. In fact, the intermediate computer has no advantage compared to a hostile attacker if it attempts to decipher the IKE traffic. Instead, the intermediate computer indirectly modifies some fields in the IKE messages by sending a modification request in the IKE message tail to the first computer, which does the requested modifications before IKE encryption processing.

(101) The message contains the following payloads: An Identification (ID) payload, that identifies the first computer to the second computer. This identification may be the same as the identification sent in the mm1 tail, but may differ from that. These two identifications serve different purposes: the mm1 tail identification (c-userid) is used to select a security gateway for IKE session forwarding (the second computer), while the ID payload in this message is used by the second computer for IKE authentication purposes, for instance, to select proper RSA authentication keys. A Signature (SIG) or Hash (HASH) payload, that serves as an authenticator. A signature payload is used if RSA- or DSS-based authentication is used, while a hash payload is used for pre-shared key authentication. There are other authentication methods in IKE, and IKE can also be extended with new authentication methods. These are not essential to the invention, and the following text assumes RSA authentication (i.e., use of the signature payload). Possibly optional IKE payloads.

(102) The message tail contains the-following information: The SPI value that the first computer wants to use for receiving IPsec-protected messages from the intermediate computer, i.e., the c-SPI-1 value of the IPsec translation table in FIG. 3. More than one SPI value could be transmitted here, but for simplicity, the following discussion assumes that only a single SPI is necessary (i.e. only one SA is applied for IPsec traffic processing). Extending the scheme to multiple SPIs is straightforward.

(103) In step 10, the mm5 is forwarded to the second computer.

(104) The intermediate computer removes the message tail, and performs the IKE translation discussed previously, and then forwards the message to the second computer.

(105) In step 11, the second computer receives the mm5 message, and authenticates the user (or the host, depending on what identification type is used). Assuming that the authentication succeeds, the second computer proceeds to authenticate itself to the first computer.

(106) The mm6 message contains the following payloads: An Identification (ID) payload, that identifies the second computer to the first computer. A Signature (SIG) payload (here RSA authentication is assumed). Possibly optional IKE payloads.

(107) In step 12, the mm6 is received by the intermediate computer. The intermediate computer does not change the message itself, but adds a tail with the following information: The SPI value that the intermediate computer wants the first computer to offer to the second computer in the qm1 message. Since the intermediate computer cannot access the contents of the IKE messages, this modification request is made using the message tail (see the discussion of step 9). The SPI value sent matches the s-SPI-2 field of the IPsec translation table of FIG. 3. The SPI value that the intermediate computer wants the first computer to use for messages sent to itself. This matches the c-SPI-2 field of the IPsec translation table of FIG. 3.

(108) The resulting message is forwarded to the first computer.

(109) In step 13, the first computer constructs qm1, which contains the following IKE payloads: A Hash (HASH) payload, that serves as an authenticator of the message. A Security Association (SA) payload, which contains the IKE phase 2 security policy offers from the first computer, i.e., the IPsec security policy offers. The SA payload contains the SPI value assigned to the first computer in the mm6 message, i.e., s-SPI-2 in FIG. 3. Optionally, a Key Exchange (KE) payload, if a new Diffie-Hellman key exchange is to be performed in phase 2 (this depends on the contents of the SA payload). A Nonce (NONCE) payload, which contains a random value chosen by the first computer. Optionally, two Identification (ID) payloads that indicate the IPsec traffic selectors that the first computer proposes for an IPsec tunnel mode SA. If IPsec transport mode is used, these are not necessary, but they may still be used. They may also be omitted if IPsec tunnel mode is used.

(110) The IKE header is the same as previously, except that the Message ID field now contains a non-zero 32-bit value, that serves as a phase 2 session identifier. This identifier remains constant for the entire quick mode exchange.

(111) The message is sent to the intermediate computer.

(112) In step 14, the intermediate computer forwards the qm1 message to the second computer.

(113) In step 15, the second computer inspects the security policy offers and other information contained in the qm1 message, and determines which security policy offer matches its own security policy (the case when no security policies match results in an error notification message).

(114) The second computer responds with qm2 message that contains the following payloads: A Hash (HASH) payload, that serves as an authenticator of the message. A Security Association (SA) payload, which indicates the security policy offer chosen by the second computer. The message also contains the SPI value that the second computer wants to use when receiving IPsec-protected messages. The SPI value matches s-SPI-3 of the IPsec translation table in FIG. 3. Optionally, a Key Exchange (KE) payload, if a new Diffie-Hellman key exchange is to be performed in phase 2. A Nonce (NONCE) payload, which contains a random value chosen by the second computer. If Identification (ID) payloads were sent by the first computer, the second computer also sends Identification payloads.

(115) In step 16, the intermediate computer forwards the qm2 message to the first computer.

(116) In step 17, the first computer constructs qm3 message, which contains the following payloads: A Hash (HASH) payload, that serves as an authenticator of the message.

(117) The following information is sent in the message tail: The SPI value sent by the second computer in the qm2 message. This is sent here, because the intermediate computer cannot decrypt the qm2 message and look up the SPI from there. The SPI value matches s-SPI-3 of the IPsec translation table in FIG. 3.

(118) In step 18, the intermediate computer receives the qm3 and reads the s-SPI-3 value from the message tail. All the information required to construct the IPsec translation table entry is now gathered, and the entry can be added to the translation table. In particular, the information fields are as follows: c-addr-1: same as c-addr-1 of the IKE session (195.1.2.3). c-addr-2: same as c-addr-2 of the IKE session (212.90.65.1). c-SPI-1: received in the mm5 message tail from the first computer. c-SPI-2: chosen by the intermediate computer, sent to the first computer in the mm6 message tail. s-addr-2: same as s-addr-2 of the IKE session (212.90.65.1 in this example, may be different than c-addr-2). s-addr-3: same as s-addr-3 of the IKE session (103.6.5.4). s-SPI-2: chosen by the intermediate computer, sent to the first computer in mm6 message tail. s-SPI-3: sent by the second computer in qm2 to the first computer, which sends it to the intermediate computer in qm3 message tail.

(119) The intermediate computer forwards the qm3 message to the second computer, which completes the IKE key exchange, and the IPsec translation table set up.

(120) The IPsec cryptographic keys established using the modified IKE key exchange presented above are either derived from the Diffie-Hellman key exchange performed in IKE main mode, or from the (optional) Diffie-Hellman key exchange performed in quick mode. In both cases, the intermediate computer has no access to the shared secret established using the Diffie-Hellman algorithm. In fact, the intermediate computer has no advantage when compared to a random, hostile attacker.

(121) The above presentation was simplified and exemplified to increase clarity of the presentation. There are several issues not discussed, but these issues are not essential to the invention.

(122) Some of these issues are the following: The phase 1 used main mode. Any other IKE phase 1 exchange can be used; this changes the details of the protocol but not the essential ideas. There are other approaches than the one presented here. One approach is for the first computer to reveal the IKE keys to the intermediate computer, so that the second computer is able to modify the required fields of the message (namely, SPI values). The discussion assumes that the first computer initiates the IKE exchange. The opposite direction is possible, too, but requires more considerations. The commit bit feature of IKE is not used. Adding that is simple. Security gateway selection is based on a table lookup indexed by an identification type/value pair sent by the first computer. Other mechanisms are easy to implement. The discussion assumes a successful IKE key exchange. Error cases are easy to handle. Phase 1 policy lookup (when processing mm1 and mm2 messages) is not based on the identity of the IKE counterpart. This is not a major issue, since the phase 1 security policy can be independent of the counterpart without limiting usability. Phase 1 is a pre-requisite for executing the protocol in the example. This can be easily changed by moving some of the “tail” items to phase 2. The protocol establishes a pair of SAs, one for each direction, and manages the SPI value modifications of these SAs. It is easy to extend this to cover SA bundles with more than one SA, i.e., SAs applied in sequence (ESP followed by AH, for instance). This requires more than one SPI for each direction, but is easy to add to the protocol described.

(123) The invention is not concerned with the details of the key exchange protocol. The presented outline for one such protocol is given as an example, several other alternatives exist. The invention is also not concerned with the IKE key exchange protocol: other key exchange protocols exist, and similar ideas can be applied in using them in the content of the invention.

(124) While the present invention has been described in accordance with preferred compositions and embodiments, it is to be understood that certain substitutions and alterations may be made thereto without departing from the spirit and scope of the following claims.