| 摘要 |
PURPOSE: A network address translation gateway for local area networks using local IP addresses and non-translatable port addresses is provided to permit the use of ISAKMP protocol authentication and key exchanges between a computer having a non-global IP address and a host computer, using the internet as a transmission medium, to allow any number of computers on a private LAN using local IP addresses to initiate or receive messages via the internet using ISAKMP protocol, and to employ virtual private networking between two or more LAN sites on the internet, using ISAKMP protocol to initiate secure communications. CONSTITUTION: A private local area network (LAN)(10) is connected to a computing site(30) located on the internet(50). The LAN(10) uses local IP addresses, and is connected to the internet through the network address translation(NAT) gateway of this invention(20). The computing site(30) may be a business headquarters, or one of any number of private LANs used by a multinational corporation, an educational facility, or any other site which will be frequently accessed from remote locations. Such sites will normally have a firewall or gateway(35) capable of running encryption and other security applications. Such a gateway will have the ability to open a packet, decrypt or otherwise access its contents, and perform address translation, routing, de-encapsulation, and data manipulation functions as well. While such devices are able to support ISAKMP and other IPSec protocols, they do so by opening and decrypting packets, and manipulating data, and are, by and large, too expensive and powerful to be employed efficiently at remote LAN sites needing to establish a VPN with the main computing site.
|
