US20100272109A1 - Intellegent network address translator and methods for network address translation - Google Patents

Intellegent network address translator and methods for network address translation Download PDF

Info

Publication number
US20100272109A1
US20100272109A1 US12/830,264 US83026410A US2010272109A1 US 20100272109 A1 US20100272109 A1 US 20100272109A1 US 83026410 A US83026410 A US 83026410A US 2010272109 A1 US2010272109 A1 US 2010272109A1
Authority
US
United States
Prior art keywords
address
network
packet
translation
public
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
US12/830,264
Other versions
US7822873B1 (en
Inventor
Amit Paunikar
Bikramjit Singh
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Gate Worldwide Holdings LLC
Original Assignee
Nomadix Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US12/830,264 priority Critical patent/US7822873B1/en
Application filed by Nomadix Inc filed Critical Nomadix Inc
Priority to US12/908,341 priority patent/US8051206B2/en
Publication of US7822873B1 publication Critical patent/US7822873B1/en
Application granted granted Critical
Publication of US20100272109A1 publication Critical patent/US20100272109A1/en
Priority to US13/276,217 priority patent/US8234409B2/en
Priority to US13/550,079 priority patent/US8370524B2/en
Priority to US13/756,341 priority patent/US8832315B2/en
Assigned to NOMADIX, INC. reassignment NOMADIX, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: PAUNIKAR, AMIT, SINGH, BIKRAMJIT
Priority to US14/478,429 priority patent/US9491136B2/en
Assigned to NTT DOCOMO, INC. reassignment NTT DOCOMO, INC. SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: NOMADIX, INC.
Priority to US15/343,587 priority patent/US10291580B2/en
Assigned to NTT DOCOMO, INC. reassignment NTT DOCOMO, INC. MODIFICATION TO PATENT SECURITY AGREEMENT Assignors: NOMADIX, INC.
Assigned to GATE WORLDWIDE HOLDINGS LLC reassignment GATE WORLDWIDE HOLDINGS LLC ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: NOMADIX, INC.
Assigned to GATE WORLDWIDE HOLDINGS LLC reassignment GATE WORLDWIDE HOLDINGS LLC ASSIGNMENT OF PATENT SECURITY AGREEMENT Assignors: NTT DOCOMO, INC.
Assigned to Knobbe, Martens, Olson & Bear, LLP reassignment Knobbe, Martens, Olson & Bear, LLP SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: NOMADIX, INC.
Priority to US16/409,584 priority patent/US10979385B2/en
Assigned to NOMADIX, INC. reassignment NOMADIX, INC. RELEASE BY SECURED PARTY (SEE DOCUMENT FOR DETAILS). Assignors: Knobbe, Martens, Olson & Bear, LLP
Assigned to NOMADIX, INC. reassignment NOMADIX, INC. QUITCLAIM Assignors: GATE WORLDWIDE HOLDINGS LLC
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00Network arrangements, protocols or services for addressing or naming
    • H04L61/50Address allocation
    • H04L61/5007Internet protocol [IP] addresses
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00Network arrangements, protocols or services for addressing or naming
    • H04L61/09Mapping addresses
    • H04L61/25Mapping addresses of the same type
    • H04L61/2503Translation of Internet protocol [IP] addresses
    • H04L61/2514Translation of Internet protocol [IP] addresses between local and global IP addresses
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00Routing or path finding of packets in data switching networks
    • H04L45/74Address processing for routing
    • H04L45/745Address table lookup; Address filtering
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00Network arrangements, protocols or services for addressing or naming
    • H04L61/09Mapping addresses
    • H04L61/10Mapping addresses of different types
    • H04L61/106Mapping addresses of different types across networks, e.g. mapping telephone numbers to data network addresses
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00Network arrangements, protocols or services for addressing or naming
    • H04L61/09Mapping addresses
    • H04L61/25Mapping addresses of the same type
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00Network arrangements, protocols or services for addressing or naming
    • H04L61/09Mapping addresses
    • H04L61/25Mapping addresses of the same type
    • H04L61/2503Translation of Internet protocol [IP] addresses
    • H04L61/2557Translation policies or rules
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00Network arrangements, protocols or services for addressing or naming
    • H04L61/50Address allocation
    • H04L61/5046Resolving address allocation conflicts; Testing of addresses

Definitions

  • the present invention relates generally to communication networks. More particularly, the present invention provides for a network address translator that is configured to transmit packets via different modes of network address translation and to determine the appropriate mode of network translation to use for a packet.
  • NAT Network Address Translation
  • IP addresses Internet Protocol addresses
  • One network is designated the inside network and the other is the outside.
  • IP addresses Internet Protocol addresses
  • One network is designated the inside network and the other is the outside.
  • a company maps its local inside network addresses to one or more global outside IP addresses and un-maps the global IP addresses on incoming packets back into local IP addresses. This helps ensure security since each outgoing or incoming request must go through a translation process that also offers the opportunity to qualify or authenticate the request or match it to a previous request.
  • NAT also conserves on the number of global IP addresses that a company needs and it lets the company use a single IP address in its communication with the world.
  • Network Address Translation allows a single device, such as a gateway device or router, to act as an agent between the Internet (or “public network”) and a local (or “private”) network. This means that only a single, unique IP address is required to represent an entire group of hosts.
  • the impetus towards increasing use of NAT comes from a number of factors including, a world shortage of IP addresses, security needs and ease and flexibility of network administration.
  • NAT has two modes of operation—basic NAT and Network Address Port Translation (NAPT).
  • NAPT Network Address Port Translation
  • Basic NAT provides for a group of public host IP addresses to be assigned to a NAT gateway device.
  • basic NAT operates by providing for one to one mapping of private addresses to public addresses. This one to one mapping can either be done statically or dynamically.
  • static NAT an unregistered IP address is mapped to a registered IP address on a one-to-one basis (i.e., the IP address of the host is always translated to the same address).
  • dynamic NAT an unregistered IP address is mapped to a registered IP address from a group of registered IP addresses (i.e., the IP address of the host is translated to the first available address).
  • NAPT maps all addresses in the private realm to a single public domain address.
  • NAPT distinguishes network sessions coming from the same or different private IP addresses by mapping the private source IP address and the private source port to a unique public source port.
  • the data packets are translated on the basis of the unique public source port using a single public IP address.
  • NAPT allows for mapping multiple private addresses to one public address by associating each host with a port (i.e., source IP and source port to source port mapping).
  • Basic NAT allows for one-to-one mapping/translation exists between the private address and the public address.
  • basic NAT requires that a sizable pool of addresses be available for one-to-one mapping and, as such, basic NAT inherently has a poor IP address reusability factor.
  • basic NAT is only capable of supporting as many Virtual Private Network (VPN) connections as the number of public IP addresses available in the pool at any point in time.
  • VPN Virtual Private Network
  • NAPT which provides mapping all addresses in the private realm to a single public domain address, does not require the same magnitude of available public addresses.
  • the need for less public addresses is offset by a system that offers limited functionality for certain protocols and applications, such as VPN.
  • United States patent application publication number US 2002/0010799 entitled “Communication Data Relay System and Method of Controlling Connectability Between Domains” by Kubota et al., published on Jan. 24, 2002 describes a relay system between two private local area networks.
  • the teaching pertains to connectivity between different routing domains that might be implementing different routing protocols and/or routing data.
  • the relay system requires address translation between the two LANs and similar address translation with the Internet.
  • the publication teaches that the relay may perform basic NAT and NAPT, or IP masquerading, depending upon the address translation module, algorithm, and lookup-table configured for each LAN.
  • the Kubuto publication does not teach an address translation process that chooses a mode of translation to efficiently or effectively allocate network addresses.
  • United States patent application publication number 2002/0087721 entitled “Duplicate Private Address Translating System and Duplicate Address Network System”, in the name of inventors Sato et al., published on Jul. 4, 2002 describes a duplicate network address translating device which provides translation between private addresses on independent private networks and a global address on the Internet.
  • the device allows separate private networks to maintain duplicate IP addresses by using different protocols or by adding additional independent network address information.
  • the disclosure teaches that basic network address translation (basic NAT) would be unable to communicate between private networks using duplicate identical IP addresses on each of the independent networks.
  • the duplicate network address translating system described would perform network address translation (NAT) or network address port translation (NAPT) between the private networks and the Internet via a global address.
  • the teaching relies on Virtual Local Area network (VLAN) tags and Multi-Protocol Label Switching (MPLS) in combination with the source IP and source port to construct a translation table.
  • VLAN Virtual Local Area network
  • MPLS Multi-Protocol Label Switching
  • the present invention provides for an intelligent network address translation system and methods for intelligent network address translation.
  • the invention analyzes all data packets being communicated between the private address realm and the public address realm and performs a predefined mode of network address translation based on the packet type.
  • the system and method of the present invention is able to adjust the mode of network address translation dynamically during a network user's ongoing network session. Additionally, by basing which mode of translation will be employed based on packet type the translation method of the present invention insures that IP addresses are distributed efficiently and distribution of the amount of addresses is minimized.
  • the system and methods of the present invention can accomplish this task without limiting the level of security provided by the translation process.
  • the intelligent network address translation system of the present invention provides for a heightened IP address reusability factor. This is apparent because the system provides for different hosts connecting to different network destinations to use the same public IP address, concurrently.
  • the system maps assigned public IP addresses to destination addresses and only denies re-using the same public IP address if subsequent network users are connecting to the same destination address.
  • Another advantage of the present invention is that translation address allocation does not depend on the order in which a network host accesses the system and the order of entry does not determine if a network host is capable of creating a Virtual Private Network (VPN) connection.
  • VPN Virtual Private Network
  • the amount of IP addresses in the public IP pool will dictate how many network users can be assigned a NAT address.
  • the public IP pool consists of 100 IP addresses
  • the first 100 network users that access the system and warrant a network address translation will be assigned the addressed.
  • the 101st user will be denied network address translation.
  • two factors prevent the system denying network address translation based on the order in which a network user accesses the system.
  • network users that access the system may not require a unique address from the public IP pool (i.e., they may only require assignment of the default IP address).
  • IP addresses can be re-used as long as the network user is attempting to access a different destination address than a previously connected network user.
  • a method for network address translation in a communication network includes the steps of determining a data packet type for a data packet being communicated from private hosts to public network services, determining if the data packet type requires assigning an IP address from available public IP addresses and assigning the data packet an IP address from the available public IP addresses if a determination is made that the packet type requires such. Lastly the method includes, translating the address of the data packet to the assigned IP address.
  • the method described above may further include the step of assigning the data packet a default public IP address and a source port if a determination is made that the data packet type does not require assigning an IP address from available public IP addresses.
  • the method may also include the steps of storing the assigned IP address in an address binding (i.e., correlation) table that maps the assigned IP address to a data packet destination address and/or the step of storing the assigned IP address in a correlation table that maps the assigned IP address to the private IP address.
  • the storage steps allow for outgoing data packets to be checked for previous network address translation processing, thus hastening data transmission and provides for an effective IP address reusability factor.
  • a method for network address translation in a communications network including the steps of analyzing each outgoing data packets to determine data packet type, determining, from multiple modes of network address translation, a mode of network address translation for each outgoing data packets based upon the determined data packet type of each outgoing data packet and performing network address translation on outgoing data packets based on the determined mode of network translation.
  • the method allows for the modes of network address translation to include the basic NAT-type translation method of assigning a public IP address from a public IP address pool or the NAPT-type translation the method of assigning a default public IP address and a related source port.
  • the invention is also defined by a network address translator system for providing network address translation in a communications network.
  • the system includes an address selector module that analyzes the data packet type of outgoing data packets to determine a mode of network address translation and selects a translation address based on the determined mode of network address translation and a translation module in communication with the outgoing connection lookup module that performs network address translation on outgoing data packets using the selected translation address.
  • the network address translator system may include an outgoing connection lookup module that communicates with a connection lookup table to determine if outgoing data packets have previously undergone network address translation and/or a connection creation routine that compiles translation information, including the assigned network address translation for outgoing data packets, and stores the compiled translation information in the connection lookup table.
  • the system may include a connection lookup table to determine connection parameters for incoming data packets and a reverse translator module that performs reverse network address translation on incoming data packets based on the determined connection parameters in the connection lookup table.
  • FIG. 1 is a block diagram of a communication network implementing intelligent network address translation, in accordance with an embodiment of the present invention.
  • FIG. 2 is a block diagram of the system for intelligent network address translation, in accordance with an embodiment of the present invention.
  • FIG. 3 is a flow diagram of a method for intelligent network address translation, in accordance with an embodiment of the present invention.
  • FIG. 4 is a flow diagram of the sub-method for address selection within the method for intelligent network translation, in accordance with an embodiment of the present invention.
  • the present invention is described as an intelligent network address translator that is implemented in a communication network.
  • the intelligent network address translator analyzes each outgoing data packet based on packet type (i.e., protocol and destination address) and decides, based on the packet type, what mode of network address translation will be applied.
  • the modes of network address translation will include mapping addresses in the private realm to a single public domain Internet Protocol (IP) address and source port or assigning a public IP address from a pool of available IP addresses.
  • IP Internet Protocol
  • the intelligent network address translator of the present invention is able to dynamically change network address translation modes during an on-going network session by recognizing changes in packet types.
  • a network user initiates a network session from a host, begins accessing a public network, and the intelligent network translator of the present invention recognizes the packet type.
  • the translator Upon recognition of the packet type the translator assigns a mode of network address translation based upon the functional requirements of the protocol (i.e., the packet type). If the functionality of the protocol is not dependent on assignment of globally unique IP addresses per destination server, then the data packets will typically be mapped to a default public domain IP address and source port. If, however, later in the same network session, the network user begins accessing a private network by using a Virtual Private Network (VPN), the intelligent network address translator recognizes a change in data packet type.
  • VPN Virtual Private Network
  • the data packets may be assigned a public IP address from the available pool of IP addresses.
  • the intelligent network translator of the present invention is able to more effectively assign IP addresses and limit the amount of IP addresses that are being used at any given time.
  • the components, process steps, and/or data structures of the intelligent network address translator are implemented using a gateway device.
  • Different implementations may be used and may include other types of operating systems, computing platforms, computer programs, and/or general-purpose machines.
  • devices of a less general purpose nature such as hardwired devices, devices relying on FPGA (Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit) technology, or the like, may also be used without departing from the scope and spirit of the inventive concepts disclosed herewith.
  • FIG. 1 depicts a block diagram of a communication network 10 that implements an intelligent network translation system, in accordance with an embodiment of the present invention.
  • the communication network typically includes a plurality of user/subscriber hosts 12 that access the communication network in order to gain access to other networks or Internet services.
  • the communication network also includes a gateway device 14 that provides an interface between the plurality of hosts and the various networks or other online services.
  • the gateway device is located proximate to the hosts at a relatively low position in the structure of the overall network. However, the gateway device can be located at a higher position in the overall network structure such as at a Point of. Presence (PoP) of Network Operating Center (NOC), if so desired.
  • PoP Point of. Presence
  • NOC Network Operating Center
  • the gateway device can be physically embodied in many different fashions, the gateway device typically includes a controller and a memory device in which software is stored that defines the operational characteristics of the gateway device.
  • the gateway device can be embedded within another network device, such as the access controller or a router, or the software that defines the functioning of the gateway device can be stored on a PCMCIA card that can be inserted into the host in order to automatically reconfigure the host to communicate with a different communications network.
  • the communication system 10 also typically includes an access controller 16 positioned between the hosts 12 and the gateway device 14 for multiplexing the signals received from the plurality of hosts onto a to gateway device link.
  • the access controller can be configured in different manners.
  • the access controller can be a digital subscriber line access module (DSLAM) for signals transmitted via regular telephone lines, a cable modem termination system (CMTS) for signals transmitted via coaxial/optical fiber cables, a wireless access point (WAP) for signals transmitted via a wireless network, a switch or the like.
  • DSLAM digital subscriber line access module
  • CMTS cable modem termination system
  • WAP wireless access point
  • the network system typically includes one or more routers 18 and/or servers (not shown in FIG.
  • the communication network in communication with a plurality of networks 20 or other Internet services 22 .
  • the communication network is depicted to have a single router, the communication network will typically have a plurality of routers, switches, bridges, or the like that are arranged in some hierarchical fashion in order to appropriately route traffic to and from the various networks or other Internet services.
  • the gateway device typically establishes a link with one or more routers.
  • the routers in turn, establish links with the servers of other networks or other online service providers, such as Internet service providers, based upon the subscriber's selection.
  • the components, process steps, and/or data structures of the intelligent network address translator 24 are implemented using gateway device 14 .
  • the intelligent network address translator may be implemented in other network devices, such as traditional routers, servers or the like.
  • the gateway device may communicate with external storage devices (not shown in FIG. 1 ) in order to implement the system for intelligent network address translation of the present invention.
  • FIG. 2 is a block diagram of the intelligent network address translation system 100 , in accordance with an embodiment of the present invention.
  • the outgoing connection lookup module is in communication with the session table 120 .
  • the session table provides a log of all current network sessions/connections, the corresponding translated network address that has been assigned the current network sessions/connection and other session/connection related data, such as source and destination addresses, session state, time outs and sequence number handling.
  • the outgoing connection lookup performs a routine, in conjunction with the session table, to determine if an outgoing data packet has a corresponding network address translation entry in the session table. If a corresponding entry exists in the session table, (i.e., data packets determined to be similar have already undergone intelligent network address translation) then the data packet and the network address translation information are forwarded to the translation module 130 .
  • the translation routine performs the requisite network address translation by altering address information in the header of the data packet.
  • the outgoing connection lookup module 110 is in communication with a connection creation routine 140 . If the outgoing connection lookup module determines that no corresponding entry exists for the data packet in the session table 120 then the intelligent network address translator proceeds to the connection creation routine.
  • the connection creation routine serves to compile the requisite connection information, including the translated network address that will subsequently be stored in the session table.
  • the connection creation routine is in communication with the address selector module 150 .
  • the connection creation routine communicates packet parameters, such as, protocol, source address and destination address to the address selector module.
  • the address selector module is responsible for determining the mode of network address translation that is to be implemented based on the packet type of the data packet.
  • the address selector module 150 is in communication with an address-selection binding table 160 and an address storage unit 170 .
  • the address selection binding maps the network address translation to the destination address and the address storage unit is the resource for all available network address translation addresses.
  • the address selector module 150 will analyze the data packet to determine the packet type. Packet type will be indicated by the protocols assigned to the data packet. Based on the packet type the data packet will be assigned a mode of network address translation. In one embodiment of the invention, predetermined packet types are specified as requiring assignment of a default public IP address and port (i.e., effectively performing NAPT-type network address translation) and other predetermined packet types are specified as requiring assignment of a public IP address from the pool of available IP addresses.
  • the address selector module 150 determines that the packet type requires assigning a public IP address from the pool of available addresses then the address selector module will determine the data packet's destination address.
  • the address selector module communicates with the address storage 170 to retrieve a public IP address.
  • the destination address is then used to determine if the address-selection binding table 160 has an entry that corresponds to the destination address and the retrieved public IP address. If an entry does exist for the destination address, it means that the corresponding public IP address is being used for another session to the same destination by another network user and therefore this public IP address cannot be used for the current new data packet. In this instance, the address selector module will access the address storage for another public IP address.
  • the address selector module assigns the new public IP address to this destination address.
  • an entry is placed in the binding table to signify that the IP address corresponds to the destination address of the data packet.
  • the assigned public pool IP translation address and related parameters are communicated by the address selector 150 to the connection creation routine 140 at which a session/connection table entry is compiled and forwarded to the session table 120 . Additionally, the translation network address and related parameters are communicated to the translation module 130 where the translation routine performs the requisite network address translation by altering address information in the header of the data packet.
  • the address selector module 150 determines that the packet type requires assigning a default public IP address and a source port then the address selector module will assign the default public IP address and bind the data packet to a corresponding source port of the device that implements the intelligent network address translation.
  • the default public IP translation address, assigned port and related parameters are communicated by the address selector 150 to the connection creation routine 140 at which a session/connection table entry is compiled and forwarded to the session table 120 . Additionally, the translation network address and related parameters are communicated to the translation module 130 where the translation routine performs the requisite network address translation by altering address information in the header of the data packet.
  • Incoming data packets that are being transmitted from the address space, typically a network service or the Internet to the private address space, typically a network host are communicated to the incoming connection lookup module 180 .
  • the incoming connection lookup module is in communication with the session table 120 .
  • the session table provides a log of all current network sessions/connections and, therefore, the session table provides the correlation between the translated network address of the incoming data packet and the private address.
  • the incoming connection lookup module is in communication with the reverse translation module 190 .
  • the incoming connection module communicates the private address and related address information to the reverse translator module and the reverse translator module reconfigures the network address in the header of the data packet such that packets that are forwarded to the private address space indicate the originally assigned private address.
  • modules depicted in FIG. 2 can be formed in numerous different ways, but are typically embodied by the controller operating under software control to perform the recited functions.
  • FIG. 3 is a flow diagram of a process for intelligent network address translation, in accordance with an embodiment of the present invention.
  • a data packet arrives at the intelligent network translation system and, at step 210 , the system determines whether the data packet is an outgoing data packet.
  • Outgoing data packets are data packets that emanate from a private address space, such as a network host and are to communicated to the public address space, such as a network service, the Internet or the like.
  • Incoming data packets are data packets that emanate from the public address space and are to be communicated to the public address space. This determination is necessary because outgoing data packets will require network address translation and incoming data packets will require reverse network address translation.
  • connection memory i.e., session table
  • the system performs a lookup to determine if a connection exists in corresponding connection memory (i.e., session table).
  • connection memory i.e., session table
  • the existence of a connection means that data packets from the same private address have previously been mapped to a translated network address during the current connection and, therefore, no further analysis of the data packet is necessary prior to translation.
  • the determination is made to assess whether a connection is found in the connection memory. If a connection is found in the connection memory then, at step 240 , the process performs the translation using the connection parameters and translation network address found in the connection memory and the outgoing data packets are communicated to the public address realm.
  • FIG. 3 illustrates a simplified method for creating a new connection (i.e., selecting a translation network address), in accordance with an embodiment of the present invention. For a more detailed method flow for selecting an address see FIG. 4 and the discussion that ensues, infra.
  • the process determines whether the packet type of the data packet has been predetermined to be “special”. In this instance, “special” is defined as those packet types that will require a specified mode of network translation. The network administrator is capable of predefining, and changing based on need, which data packet types will be defined as “special”.
  • packet types which are defined by the packet protocol, will be deemed “special” if they belong to a protocol that does not function if the packets undergo port translation.
  • packet types that are determined to be “special” will be assigned, at step 270 , a public IP address from the pool of available IP addresses. If the packet type is not determined to be “special”, then, at step 280 , a default public IP address is assigned and a source port is assigned. Once a translation address has been assigned, either from the public IP pool or the default public IP address the process performs the translation, at step 240 , using the assigned translation network address and associated connection parameters and the outgoing data packets are communicated to the public address realm.
  • the data packet is determined to not be an outgoing data it is then deemed to be an incoming data packet that emanated from the public address realm.
  • an incoming lookup connection process is employed to determine the connection corresponding to the translated network address in the data packet.
  • the process determines whether an entry exists in the corresponding connection memory. If no entry is found, meaning the connection entry was never established or entered for the outgoing data packets then, at step 310 , the data packet is dropped and no further communication of the data packet ensues.
  • connection parameters and the private address mapped to translation network address are used, at step 320 , to reverse translate the data packet back to the original private network address and the reverse translated data packets are then communicated to the private address realm.
  • FIG. 4 provides a detailed method for address selection in an intelligent address translation system, in accordance with an embodiment of the present invention.
  • FIG. 4 is a more detailed flow of the method illustrated by steps 260 - 280 of FIG. 3 .
  • a packet type determination is made by analyzing the data packet and determining the packet's protocol. Once the packet type is determined then the process assesses the packet to determine the mode of network address translation that is required. The system of the present invention will predefine which protocols will dictate which mode of network translation.
  • the process determines if the packet type is deemed special and, thus, requires basic NAT-type network address translation (i.e., assigning a public IP address from the pool of available IP address).
  • the data packet is assigned the default public IP address.
  • a source port is allocated to the connection.
  • step 440 a determination is made as to whether an IP address is available in the associated public IP pool and an entry corresponding to the IP address and the data packet destination address does not exist in the address binding table. If such an IP address is available, then, at step 450 , the IP address that is available is assigned to the connection as the translation network address. This mapping of the assigned public IP address and the destination address is added to the address binding table. However, if a determination is made that no IP address is available then, at step 460 , no network address translation can be performed on the data packet and the packet is dropped from further communication.
  • the present invention significantly increases the IP address reusability factor. This allows more potential network users to establish NAT-type connections and significantly lessens the dependency on when a network user accesses the system to determine IP address allocation.
  • the present invention is capable of intelligent network address translation.
  • the intelligent aspect of the translation system is realized by analyzing different parameters of all data packets being communicated between the private address realm and the public address realm and performing a predefined mode of network address translation based on the packet type.
  • the system and method of the present invention is able to adjust the mode of network address translation dynamically during a network user's ongoing network session. Additionally, by basing which mode of translation will be employed based on packet type the translation method of the present invention insures that IP addresses are distributed efficiently and distribution of the amount of addresses is minimized.

Abstract

An intelligent network address translation system and methods for intelligent network address translation. In one embodiment, a network packet is received from a host device, and a stored record associated with the host device is identified. The stored record includes information relating to connection parameters associated with the host device. Using the stored record, a processor determines whether the network packet should be assigned a dedicated address. If so, then the network packet is transmitted using communication parameters including a dedicated IP address. If the packet should not be assigned a dedicated address, then the packet is transmitted using connection parameters including a default public IP address and a port number.

Description

    CROSS-REFERENCE TO RELATED APPLICATIONS
  • This application is a continuation of U.S. patent application Ser. No. 10/271,640, filed Oct. 15, 2002, currently pending, entitled “Intelligent Network Address Translator and Methods for Network Address Translation,” which is hereby incorporated by reference.
  • FIELD OF THE INVENTION
  • The present invention relates generally to communication networks. More particularly, the present invention provides for a network address translator that is configured to transmit packets via different modes of network address translation and to determine the appropriate mode of network translation to use for a packet.
  • BACKGROUND
  • Network Address Translation (NAT) is a term used to describe the method by which Internet Protocol addresses (IP addresses) used within one network are mapped (i.e., translated) to a different IP address known within another network, in an attempt to provide transparent routing to host computers. One network is designated the inside network and the other is the outside. Typically, a company maps its local inside network addresses to one or more global outside IP addresses and un-maps the global IP addresses on incoming packets back into local IP addresses. This helps ensure security since each outgoing or incoming request must go through a translation process that also offers the opportunity to qualify or authenticate the request or match it to a previous request. NAT also conserves on the number of global IP addresses that a company needs and it lets the company use a single IP address in its communication with the world.
  • Network Address Translation allows a single device, such as a gateway device or router, to act as an agent between the Internet (or “public network”) and a local (or “private”) network. This means that only a single, unique IP address is required to represent an entire group of hosts. The impetus towards increasing use of NAT comes from a number of factors including, a world shortage of IP addresses, security needs and ease and flexibility of network administration.
  • Traditionally NAT has two modes of operation—basic NAT and Network Address Port Translation (NAPT).
  • Basic NAT provides for a group of public host IP addresses to be assigned to a NAT gateway device. In implementation, basic NAT operates by providing for one to one mapping of private addresses to public addresses. This one to one mapping can either be done statically or dynamically. In static NAT, an unregistered IP address is mapped to a registered IP address on a one-to-one basis (i.e., the IP address of the host is always translated to the same address). In dynamic NAT, an unregistered IP address is mapped to a registered IP address from a group of registered IP addresses (i.e., the IP address of the host is translated to the first available address).
  • In contrast to basic NAT, NAPT maps all addresses in the private realm to a single public domain address. NAPT distinguishes network sessions coming from the same or different private IP addresses by mapping the private source IP address and the private source port to a unique public source port. In this regard, the data packets are translated on the basis of the unique public source port using a single public IP address. NAPT allows for mapping multiple private addresses to one public address by associating each host with a port (i.e., source IP and source port to source port mapping).
  • These two modes of operation, basic NAT and NAPT, both provide benefits to the network provider and/or network user. Basic NAT allows for one-to-one mapping/translation exists between the private address and the public address. However, basic NAT requires that a sizable pool of addresses be available for one-to-one mapping and, as such, basic NAT inherently has a poor IP address reusability factor. In this regard, basic NAT is only capable of supporting as many Virtual Private Network (VPN) connections as the number of public IP addresses available in the pool at any point in time.
  • NAPT, which provides mapping all addresses in the private realm to a single public domain address, does not require the same magnitude of available public addresses. However, in the NAPT environment the need for less public addresses is offset by a system that offers limited functionality for certain protocols and applications, such as VPN.
  • Recent network advancements have attempted to provide the capability to implement both basic NAT and NAPT in one comprehensive network system. For example, U.S. Pat. No. 6,058,431, entitled “System and Method for Network Address Translation as an External Service in the Access Server of a Service Provider”, issued in the name of inventors Srisuresh et al., on May 2, 2000. The Srisuresh '431 patent describes an external network address translation service, which performs NAT and NAPT, concurrently. Essentially, this service is intended to reduce the cost of stub routers by removing the need for network address translation features in stub routers. In the Srisuresh '431 patent the basis of choosing NAT versus NAPT is the service agreed upon with the stub networks. This decision is made at the inception of the network connection and is fixed throughout the network session. Thus, the Srisuresh '431 patent does not teach a NAT versus NAPT decision process that is adaptable throughout the network session to accommodate the type of service desired by the network user.
  • Additionally, United States patent application publication number US 2002/0010799, entitled “Communication Data Relay System and Method of Controlling Connectability Between Domains” by Kubota et al., published on Jan. 24, 2002 describes a relay system between two private local area networks. The teaching pertains to connectivity between different routing domains that might be implementing different routing protocols and/or routing data. The relay system requires address translation between the two LANs and similar address translation with the Internet. The publication teaches that the relay may perform basic NAT and NAPT, or IP masquerading, depending upon the address translation module, algorithm, and lookup-table configured for each LAN. However, the Kubuto publication does not teach an address translation process that chooses a mode of translation to efficiently or effectively allocate network addresses.
  • In the same regard, United States patent application publication number 2002/0087721, entitled “Duplicate Private Address Translating System and Duplicate Address Network System”, in the name of inventors Sato et al., published on Jul. 4, 2002 describes a duplicate network address translating device which provides translation between private addresses on independent private networks and a global address on the Internet. The device allows separate private networks to maintain duplicate IP addresses by using different protocols or by adding additional independent network address information. The disclosure teaches that basic network address translation (basic NAT) would be unable to communicate between private networks using duplicate identical IP addresses on each of the independent networks. However, the duplicate network address translating system described would perform network address translation (NAT) or network address port translation (NAPT) between the private networks and the Internet via a global address. The teaching relies on Virtual Local Area network (VLAN) tags and Multi-Protocol Label Switching (MPLS) in combination with the source IP and source port to construct a translation table.
  • Thus, a need remains unfulfilled for an intelligent network address translator capable of improved connectivity, security, and flexible private network administration.
  • SUMMARY
  • The present invention provides for an intelligent network address translation system and methods for intelligent network address translation. The invention analyzes all data packets being communicated between the private address realm and the public address realm and performs a predefined mode of network address translation based on the packet type. By analyzing every packet that the network encounters and adjusting the network address translation mode based on the packet type, the system and method of the present invention is able to adjust the mode of network address translation dynamically during a network user's ongoing network session. Additionally, by basing which mode of translation will be employed based on packet type the translation method of the present invention insures that IP addresses are distributed efficiently and distribution of the amount of addresses is minimized. The system and methods of the present invention can accomplish this task without limiting the level of security provided by the translation process.
  • In addition, the intelligent network address translation system of the present invention provides for a heightened IP address reusability factor. This is apparent because the system provides for different hosts connecting to different network destinations to use the same public IP address, concurrently. The system maps assigned public IP addresses to destination addresses and only denies re-using the same public IP address if subsequent network users are connecting to the same destination address. Another advantage of the present invention is that translation address allocation does not depend on the order in which a network host accesses the system and the order of entry does not determine if a network host is capable of creating a Virtual Private Network (VPN) connection. In a basic NAT type system the amount of IP addresses in the public IP pool will dictate how many network users can be assigned a NAT address. For example, if the public IP pool consists of 100 IP addresses, the first 100 network users that access the system and warrant a network address translation will be assigned the addressed. As such, the 101st user will be denied network address translation. In the present invention, two factors prevent the system denying network address translation based on the order in which a network user accesses the system. First, network users that access the system may not require a unique address from the public IP pool (i.e., they may only require assignment of the default IP address). Second, in those instances in which a unique IP address is required, IP addresses can be re-used as long as the network user is attempting to access a different destination address than a previously connected network user.
  • In one embodiment of the invention, a method for network address translation in a communication network includes the steps of determining a data packet type for a data packet being communicated from private hosts to public network services, determining if the data packet type requires assigning an IP address from available public IP addresses and assigning the data packet an IP address from the available public IP addresses if a determination is made that the packet type requires such. Lastly the method includes, translating the address of the data packet to the assigned IP address.
  • The method described above may further include the step of assigning the data packet a default public IP address and a source port if a determination is made that the data packet type does not require assigning an IP address from available public IP addresses. The method may also include the steps of storing the assigned IP address in an address binding (i.e., correlation) table that maps the assigned IP address to a data packet destination address and/or the step of storing the assigned IP address in a correlation table that maps the assigned IP address to the private IP address. The storage steps allow for outgoing data packets to be checked for previous network address translation processing, thus hastening data transmission and provides for an effective IP address reusability factor.
  • In an alternate embodiment of the invention, a method for network address translation in a communications network is defined as, the method including the steps of analyzing each outgoing data packets to determine data packet type, determining, from multiple modes of network address translation, a mode of network address translation for each outgoing data packets based upon the determined data packet type of each outgoing data packet and performing network address translation on outgoing data packets based on the determined mode of network translation. The method allows for the modes of network address translation to include the basic NAT-type translation method of assigning a public IP address from a public IP address pool or the NAPT-type translation the method of assigning a default public IP address and a related source port.
  • The invention is also defined by a network address translator system for providing network address translation in a communications network. The system includes an address selector module that analyzes the data packet type of outgoing data packets to determine a mode of network address translation and selects a translation address based on the determined mode of network address translation and a translation module in communication with the outgoing connection lookup module that performs network address translation on outgoing data packets using the selected translation address.
  • Additionally, the network address translator system may include an outgoing connection lookup module that communicates with a connection lookup table to determine if outgoing data packets have previously undergone network address translation and/or a connection creation routine that compiles translation information, including the assigned network address translation for outgoing data packets, and stores the compiled translation information in the connection lookup table. In order to reverse translate the incoming data packets, the system may include a connection lookup table to determine connection parameters for incoming data packets and a reverse translator module that performs reverse network address translation on incoming data packets based on the determined connection parameters in the connection lookup table.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • Having thus described the invention in general terms, reference will now be made to the accompanying drawings, which are not necessarily drawn to scale, and wherein:
  • FIG. 1 is a block diagram of a communication network implementing intelligent network address translation, in accordance with an embodiment of the present invention.
  • FIG. 2 is a block diagram of the system for intelligent network address translation, in accordance with an embodiment of the present invention.
  • FIG. 3 is a flow diagram of a method for intelligent network address translation, in accordance with an embodiment of the present invention.
  • FIG. 4 is a flow diagram of the sub-method for address selection within the method for intelligent network translation, in accordance with an embodiment of the present invention.
  • DETAILED DESCRIPTION
  • The present invention now will be described more fully hereinafter with reference to the accompanying drawings, in which preferred embodiments of the invention are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Like numbers refer to like elements throughout.
  • The present invention is described as an intelligent network address translator that is implemented in a communication network. The intelligent network address translator analyzes each outgoing data packet based on packet type (i.e., protocol and destination address) and decides, based on the packet type, what mode of network address translation will be applied. In one embodiment the modes of network address translation will include mapping addresses in the private realm to a single public domain Internet Protocol (IP) address and source port or assigning a public IP address from a pool of available IP addresses. In effect, the intelligent network address translator of the present invention is able to dynamically change network address translation modes during an on-going network session by recognizing changes in packet types.
  • For example, a network user initiates a network session from a host, begins accessing a public network, and the intelligent network translator of the present invention recognizes the packet type. Upon recognition of the packet type the translator assigns a mode of network address translation based upon the functional requirements of the protocol (i.e., the packet type). If the functionality of the protocol is not dependent on assignment of globally unique IP addresses per destination server, then the data packets will typically be mapped to a default public domain IP address and source port. If, however, later in the same network session, the network user begins accessing a private network by using a Virtual Private Network (VPN), the intelligent network address translator recognizes a change in data packet type. In this instance, if the packet type and the protocol require globally unique IP addresses to function, the data packets may be assigned a public IP address from the available pool of IP addresses. As such, the intelligent network translator of the present invention is able to more effectively assign IP addresses and limit the amount of IP addresses that are being used at any given time.
  • In accordance with an embodiment of the present invention, the components, process steps, and/or data structures of the intelligent network address translator are implemented using a gateway device. Different implementations may be used and may include other types of operating systems, computing platforms, computer programs, and/or general-purpose machines. In addition, those of ordinary skill in the art will readily recognize that devices of a less general purpose nature, such as hardwired devices, devices relying on FPGA (Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit) technology, or the like, may also be used without departing from the scope and spirit of the inventive concepts disclosed herewith.
  • FIG. 1 depicts a block diagram of a communication network 10 that implements an intelligent network translation system, in accordance with an embodiment of the present invention. The communication network typically includes a plurality of user/subscriber hosts 12 that access the communication network in order to gain access to other networks or Internet services. The communication network also includes a gateway device 14 that provides an interface between the plurality of hosts and the various networks or other online services. Most commonly, the gateway device is located proximate to the hosts at a relatively low position in the structure of the overall network. However, the gateway device can be located at a higher position in the overall network structure such as at a Point of. Presence (PoP) of Network Operating Center (NOC), if so desired. Although the gateway device can be physically embodied in many different fashions, the gateway device typically includes a controller and a memory device in which software is stored that defines the operational characteristics of the gateway device. Alternatively, the gateway device can be embedded within another network device, such as the access controller or a router, or the software that defines the functioning of the gateway device can be stored on a PCMCIA card that can be inserted into the host in order to automatically reconfigure the host to communicate with a different communications network.
  • The communication system 10 also typically includes an access controller 16 positioned between the hosts 12 and the gateway device 14 for multiplexing the signals received from the plurality of hosts onto a to gateway device link. Depending upon the medium by which the hosts are connected to the access controller, the access controller can be configured in different manners. For example, the access controller can be a digital subscriber line access module (DSLAM) for signals transmitted via regular telephone lines, a cable modem termination system (CMTS) for signals transmitted via coaxial/optical fiber cables, a wireless access point (WAP) for signals transmitted via a wireless network, a switch or the like. As also shown in FIG. 1, the network system typically includes one or more routers 18 and/or servers (not shown in FIG. 1) in communication with a plurality of networks 20 or other Internet services 22. While the communication network is depicted to have a single router, the communication network will typically have a plurality of routers, switches, bridges, or the like that are arranged in some hierarchical fashion in order to appropriately route traffic to and from the various networks or other Internet services. In this regard, the gateway device typically establishes a link with one or more routers. The routers, in turn, establish links with the servers of other networks or other online service providers, such as Internet service providers, based upon the subscriber's selection.
  • In accordance with an embodiment of the present invention, the components, process steps, and/or data structures of the intelligent network address translator 24 are implemented using gateway device 14. Those skilled in the art will realize that the intelligent network address translator may be implemented in other network devices, such as traditional routers, servers or the like. In addition, the gateway device may communicate with external storage devices (not shown in FIG. 1) in order to implement the system for intelligent network address translation of the present invention.
  • FIG. 2 is a block diagram of the intelligent network address translation system 100, in accordance with an embodiment of the present invention. Outgoing data packets that are being transmitted from the private address space, typically a network host, to the public address space, typically a network service or the Internet, are communicated to the outgoing connection lookup module 110. The outgoing connection lookup module is in communication with the session table 120. The session table provides a log of all current network sessions/connections, the corresponding translated network address that has been assigned the current network sessions/connection and other session/connection related data, such as source and destination addresses, session state, time outs and sequence number handling. In this regard, the outgoing connection lookup performs a routine, in conjunction with the session table, to determine if an outgoing data packet has a corresponding network address translation entry in the session table. If a corresponding entry exists in the session table, (i.e., data packets determined to be similar have already undergone intelligent network address translation) then the data packet and the network address translation information are forwarded to the translation module 130. The translation routine performs the requisite network address translation by altering address information in the header of the data packet.
  • The outgoing connection lookup module 110 is in communication with a connection creation routine 140. If the outgoing connection lookup module determines that no corresponding entry exists for the data packet in the session table 120 then the intelligent network address translator proceeds to the connection creation routine. The connection creation routine serves to compile the requisite connection information, including the translated network address that will subsequently be stored in the session table. The connection creation routine is in communication with the address selector module 150. The connection creation routine communicates packet parameters, such as, protocol, source address and destination address to the address selector module. The address selector module is responsible for determining the mode of network address translation that is to be implemented based on the packet type of the data packet.
  • The address selector module 150 is in communication with an address-selection binding table 160 and an address storage unit 170. The address selection binding maps the network address translation to the destination address and the address storage unit is the resource for all available network address translation addresses.
  • The address selector module 150 will analyze the data packet to determine the packet type. Packet type will be indicated by the protocols assigned to the data packet. Based on the packet type the data packet will be assigned a mode of network address translation. In one embodiment of the invention, predetermined packet types are specified as requiring assignment of a default public IP address and port (i.e., effectively performing NAPT-type network address translation) and other predetermined packet types are specified as requiring assignment of a public IP address from the pool of available IP addresses.
  • If the address selector module 150 determines that the packet type requires assigning a public IP address from the pool of available addresses then the address selector module will determine the data packet's destination address. The address selector module communicates with the address storage 170 to retrieve a public IP address. The destination address is then used to determine if the address-selection binding table 160 has an entry that corresponds to the destination address and the retrieved public IP address. If an entry does exist for the destination address, it means that the corresponding public IP address is being used for another session to the same destination by another network user and therefore this public IP address cannot be used for the current new data packet. In this instance, the address selector module will access the address storage for another public IP address. If no entry exists in the binding table for the destination address then the address selector module assigns the new public IP address to this destination address. Upon assignment of the new IP address, an entry is placed in the binding table to signify that the IP address corresponds to the destination address of the data packet.
  • The assigned public pool IP translation address and related parameters are communicated by the address selector 150 to the connection creation routine 140 at which a session/connection table entry is compiled and forwarded to the session table 120. Additionally, the translation network address and related parameters are communicated to the translation module 130 where the translation routine performs the requisite network address translation by altering address information in the header of the data packet.
  • If the address selector module 150 determines that the packet type requires assigning a default public IP address and a source port then the address selector module will assign the default public IP address and bind the data packet to a corresponding source port of the device that implements the intelligent network address translation.
  • The default public IP translation address, assigned port and related parameters are communicated by the address selector 150 to the connection creation routine 140 at which a session/connection table entry is compiled and forwarded to the session table 120. Additionally, the translation network address and related parameters are communicated to the translation module 130 where the translation routine performs the requisite network address translation by altering address information in the header of the data packet.
  • Incoming data packets that are being transmitted from the address space, typically a network service or the Internet to the private address space, typically a network host are communicated to the incoming connection lookup module 180. The incoming connection lookup module is in communication with the session table 120. The session table provides a log of all current network sessions/connections and, therefore, the session table provides the correlation between the translated network address of the incoming data packet and the private address. The incoming connection lookup module is in communication with the reverse translation module 190. The incoming connection module communicates the private address and related address information to the reverse translator module and the reverse translator module reconfigures the network address in the header of the data packet such that packets that are forwarded to the private address space indicate the originally assigned private address.
  • It should be obvious to those of ordinary skill in the art that the modules depicted in FIG. 2 can be formed in numerous different ways, but are typically embodied by the controller operating under software control to perform the recited functions.
  • FIG. 3 is a flow diagram of a process for intelligent network address translation, in accordance with an embodiment of the present invention. At step 200, a data packet arrives at the intelligent network translation system and, at step 210, the system determines whether the data packet is an outgoing data packet. Outgoing data packets are data packets that emanate from a private address space, such as a network host and are to communicated to the public address space, such as a network service, the Internet or the like. Incoming data packets are data packets that emanate from the public address space and are to be communicated to the public address space. This determination is necessary because outgoing data packets will require network address translation and incoming data packets will require reverse network address translation.
  • If a determination is made that the data packet is an outgoing data packet then, at step 220, the system performs a lookup to determine if a connection exists in corresponding connection memory (i.e., session table). The existence of a connection means that data packets from the same private address have previously been mapped to a translated network address during the current connection and, therefore, no further analysis of the data packet is necessary prior to translation. As such, at step 230, the determination is made to assess whether a connection is found in the connection memory. If a connection is found in the connection memory then, at step 240, the process performs the translation using the connection parameters and translation network address found in the connection memory and the outgoing data packets are communicated to the public address realm.
  • If a connection is not found in the corresponding connection memory, then at step 250, the process determines that a new connection entry must be determined. FIG. 3 illustrates a simplified method for creating a new connection (i.e., selecting a translation network address), in accordance with an embodiment of the present invention. For a more detailed method flow for selecting an address see FIG. 4 and the discussion that ensues, infra. At step 260, the process determines whether the packet type of the data packet has been predetermined to be “special”. In this instance, “special” is defined as those packet types that will require a specified mode of network translation. The network administrator is capable of predefining, and changing based on need, which data packet types will be defined as “special”. Typically, packet types, which are defined by the packet protocol, will be deemed “special” if they belong to a protocol that does not function if the packets undergo port translation. In one embodiment of the invention, packet types that are determined to be “special” will be assigned, at step 270, a public IP address from the pool of available IP addresses. If the packet type is not determined to be “special”, then, at step 280, a default public IP address is assigned and a source port is assigned. Once a translation address has been assigned, either from the public IP pool or the default public IP address the process performs the translation, at step 240, using the assigned translation network address and associated connection parameters and the outgoing data packets are communicated to the public address realm.
  • If, at step 210, the data packet is determined to not be an outgoing data it is then deemed to be an incoming data packet that emanated from the public address realm. As such, at step 290, an incoming lookup connection process is employed to determine the connection corresponding to the translated network address in the data packet. At step 300 the process determines whether an entry exists in the corresponding connection memory. If no entry is found, meaning the connection entry was never established or entered for the outgoing data packets then, at step 310, the data packet is dropped and no further communication of the data packet ensues. If an entry is found in the corresponding connection memory, then the connection parameters and the private address mapped to translation network address are used, at step 320, to reverse translate the data packet back to the original private network address and the reverse translated data packets are then communicated to the private address realm.
  • FIG. 4 provides a detailed method for address selection in an intelligent address translation system, in accordance with an embodiment of the present invention. FIG. 4 is a more detailed flow of the method illustrated by steps 260-280 of FIG. 3. At step 400, a packet type determination is made by analyzing the data packet and determining the packet's protocol. Once the packet type is determined then the process assesses the packet to determine the mode of network address translation that is required. The system of the present invention will predefine which protocols will dictate which mode of network translation. At step 410, the process determines if the packet type is deemed special and, thus, requires basic NAT-type network address translation (i.e., assigning a public IP address from the pool of available IP address). If, at step 420, the determination is made that the packet type is not special and, therefore, does not require basic NAT-type network address translation then the data packet is assigned the default public IP address. In association with assigning the default public IP address, at step 430, a source port is allocated to the connection.
  • If the data packet is determined to be “special” and, thus require basic NAT-type processing then, at step 440, a determination is made as to whether an IP address is available in the associated public IP pool and an entry corresponding to the IP address and the data packet destination address does not exist in the address binding table. If such an IP address is available, then, at step 450, the IP address that is available is assigned to the connection as the translation network address. This mapping of the assigned public IP address and the destination address is added to the address binding table. However, if a determination is made that no IP address is available then, at step 460, no network address translation can be performed on the data packet and the packet is dropped from further communication.
  • By providing for mapping of public pool IP addresses to destination addresses and only denying reusability of the public pool IP address if it has been mapped to the same destination address that a subsequent network user desires to access, the present invention significantly increases the IP address reusability factor. This allows more potential network users to establish NAT-type connections and significantly lessens the dependency on when a network user accesses the system to determine IP address allocation.
  • As such, the present invention is capable of intelligent network address translation. The intelligent aspect of the translation system is realized by analyzing different parameters of all data packets being communicated between the private address realm and the public address realm and performing a predefined mode of network address translation based on the packet type. By analyzing every packet that the network encounters and adjusting the network address translation mode based on the packet type, the system and method of the present invention is able to adjust the mode of network address translation dynamically during a network user's ongoing network session. Additionally, by basing which mode of translation will be employed based on packet type the translation method of the present invention insures that IP addresses are distributed efficiently and distribution of the amount of addresses is minimized.
  • Many modifications and other embodiments of the invention will come to mind to one skilled in the art to which this invention pertains having the benefit of the teachings presented in the foregoing descriptions and the associated drawings. Therefore, it is to be understood that the invention is not to be limited to the specific embodiments disclosed and that modifications and other embodiments are intended to be included within the scope of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.

Claims (16)

1. A method of network address translation having a default public IP address and a plurality of dedicated public IP addresses, the method comprising:
receiving a network packet from a host device;
identifying a stored record associated with the host device, the stored record comprising information relating to connection parameters associated with the host device;
determining, using a processor and the stored record, whether the network packet should be assigned a dedicated address; and
transmitting the network packet, using communication parameters comprising either a dedicated public IP address selected from the plurality of dedicated public IP addresses if the network packet should be assigned a dedicated address, or a default public IP address and a port number if the network packet should not be assigned a dedicated address.
2. The method of claim 1, wherein identifying the stored record associated with the host device comprises retrieving, from a connection lookup table, the communication parameters in association with a destination address of the network packet.
3. The method of claim 2, wherein the connection lookup table comprises identifiers of host computers and information indicative of which of the host computers require a dedicated address.
4. The method of claim 2, further comprising:
receiving, at the gateway device, an incoming data packet;
locating stored connection parameters in the connection lookup table corresponding to the incoming data packet; and
transmitting the incoming data packet from the gateway device, using the stored connection parameters.
5. The method of claim 1, wherein transmitting the network packet from the gateway device comprises altering address information in the header of the network packet.
6. A computer-readable medium comprising instructions that are configured to operate a network address translation system, when executed on one or more processors connected to a public network interface, the system comprising:
a host address selector module;
a network access translation module; and
a network address port translation module;
wherein the host address selector module is configured to receive a network packet from a host device, determine whether the host device is associated with a dedicated IP address, and execute either the network access translation module if the host device is associated with a dedicated IP address or the network address port translation module if the host device is not associated with a dedicated IP address;
wherein the network access translation module is configured to transmit the network packet via the public network interface using connection parameters based on the dedicated IP address; and
wherein the network address port translation module is configured to transmit the network packet via the public network interface using connection parameters based on a default public IP address and a port.
7. The computer-readable medium of claim 6, wherein the host address selector module is configured to determine whether the host device is associated with a dedicated IP address by determining a protocol associated with data transmitted from the host device.
8. The computer-readable medium of claim 6, wherein the network address translation system further comprises a session table and a storage routine configured to store, in the session table, information representing the association between the dedicated IP address of the network packet and the host device.
9. The computer-readable medium of claim 6, wherein the network packet is received from the host device via a private network interface connected to the one or more processors.
10. A network address translation system configured to provide network address translation services in a communications network, the system comprising:
a processor;
a public network interface associated with a default public IP address;
an address selector module configured to be executed on the processor;
a network access translation module configured to be executed on the processor; and
a network address port translation module configured to be executed on the processor;
the address selector module configured to receive an outgoing data packet from a host device and to execute either the network access translation module or the network address port translation module based on a determination performed at least in part using information included in the outgoing data packet;
the network access translation module configured to transmit the outgoing data packet via the public network interface using connection parameters including a public IP address different from the default public IP address; and
the network address port translation module configured to transmit the network packet via the public network interface using connection parameters based on the default public IP address and a selected port.
11. The network address translation system of claim 10, wherein the information included in the outgoing packet identifies a protocol associated with the packet.
12. The network address translation system of claim 10, wherein the information included in the outgoing packet identifies the host device.
13. The network address translation system of claim 10, further comprising an outgoing connection lookup module that communicates with a connection lookup table to identify connection parameters associated with the host device.
14. The network address translation system of claim 13, further comprising a connection creation routine that receives the connection parameters from the network access translation module or the network address port translation module and stores the connection parameters in association with a destination address of the outgoing data packet in the connection lookup table.
15. The network address translation system of claim 13, further comprising:
an incoming connection lookup module that communicates with the connection lookup table to determine connection parameters for incoming data packets based on the source address of the incoming data packets; and
a reverse translator module that performs reverse network address translation on the incoming data packets based on the determined connection parameters in the connection lookup table.
16. The network address translation system of claim 10, further comprising a packet type detection module configured to receive an initial outgoing data packet from a host, determine whether the initial outgoing data packet is associated with a protocol requiring a globally unique IP address, and allocating a dedicated IP address to the host if the initial outgoing data packet is associated with a protocol requiring a globally unique IP address.
US12/830,264 2002-10-15 2010-07-02 Intelligent network address translator and methods for network address translation Expired - Lifetime US7822873B1 (en)

Priority Applications (8)

Application Number Priority Date Filing Date Title
US12/830,264 US7822873B1 (en) 2002-10-15 2010-07-02 Intelligent network address translator and methods for network address translation
US12/908,341 US8051206B2 (en) 2002-10-15 2010-10-20 Intelligent network address translator and methods for network address translation
US13/276,217 US8234409B2 (en) 2002-10-15 2011-10-18 Intelligent network address translator and methods for network address translation
US13/550,079 US8370524B2 (en) 2002-10-15 2012-07-16 Systems and methods for network address translation
US13/756,341 US8832315B2 (en) 2002-10-15 2013-01-31 Systems and methods for network address translation
US14/478,429 US9491136B2 (en) 2002-10-15 2014-09-05 Systems and methods for network address translation
US15/343,587 US10291580B2 (en) 2002-10-15 2016-11-04 Systems and methods for network address translation
US16/409,584 US10979385B2 (en) 2002-10-15 2019-05-10 Systems and methods for network address translation

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US10/271,640 US7752334B2 (en) 2002-10-15 2002-10-15 Intelligent network address translator and methods for network address translation
US12/830,264 US7822873B1 (en) 2002-10-15 2010-07-02 Intelligent network address translator and methods for network address translation

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US10/271,640 Continuation US7752334B2 (en) 2002-10-15 2002-10-15 Intelligent network address translator and methods for network address translation

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/908,341 Continuation US8051206B2 (en) 2002-10-15 2010-10-20 Intelligent network address translator and methods for network address translation

Publications (2)

Publication Number Publication Date
US7822873B1 US7822873B1 (en) 2010-10-26
US20100272109A1 true US20100272109A1 (en) 2010-10-28

Family

ID=32069179

Family Applications (9)

Application Number Title Priority Date Filing Date
US10/271,640 Active 2028-04-08 US7752334B2 (en) 2002-10-15 2002-10-15 Intelligent network address translator and methods for network address translation
US12/830,264 Expired - Lifetime US7822873B1 (en) 2002-10-15 2010-07-02 Intelligent network address translator and methods for network address translation
US12/908,341 Expired - Fee Related US8051206B2 (en) 2002-10-15 2010-10-20 Intelligent network address translator and methods for network address translation
US13/276,217 Expired - Lifetime US8234409B2 (en) 2002-10-15 2011-10-18 Intelligent network address translator and methods for network address translation
US13/550,079 Expired - Lifetime US8370524B2 (en) 2002-10-15 2012-07-16 Systems and methods for network address translation
US13/756,341 Expired - Lifetime US8832315B2 (en) 2002-10-15 2013-01-31 Systems and methods for network address translation
US14/478,429 Expired - Lifetime US9491136B2 (en) 2002-10-15 2014-09-05 Systems and methods for network address translation
US15/343,587 Expired - Fee Related US10291580B2 (en) 2002-10-15 2016-11-04 Systems and methods for network address translation
US16/409,584 Expired - Lifetime US10979385B2 (en) 2002-10-15 2019-05-10 Systems and methods for network address translation

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US10/271,640 Active 2028-04-08 US7752334B2 (en) 2002-10-15 2002-10-15 Intelligent network address translator and methods for network address translation

Family Applications After (7)

Application Number Title Priority Date Filing Date
US12/908,341 Expired - Fee Related US8051206B2 (en) 2002-10-15 2010-10-20 Intelligent network address translator and methods for network address translation
US13/276,217 Expired - Lifetime US8234409B2 (en) 2002-10-15 2011-10-18 Intelligent network address translator and methods for network address translation
US13/550,079 Expired - Lifetime US8370524B2 (en) 2002-10-15 2012-07-16 Systems and methods for network address translation
US13/756,341 Expired - Lifetime US8832315B2 (en) 2002-10-15 2013-01-31 Systems and methods for network address translation
US14/478,429 Expired - Lifetime US9491136B2 (en) 2002-10-15 2014-09-05 Systems and methods for network address translation
US15/343,587 Expired - Fee Related US10291580B2 (en) 2002-10-15 2016-11-04 Systems and methods for network address translation
US16/409,584 Expired - Lifetime US10979385B2 (en) 2002-10-15 2019-05-10 Systems and methods for network address translation

Country Status (6)

Country Link
US (9) US7752334B2 (en)
EP (1) EP1554860B1 (en)
AT (1) ATE504151T1 (en)
AU (1) AU2003211139A1 (en)
DE (1) DE60336573D1 (en)
WO (1) WO2004036877A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8266266B2 (en) 1998-12-08 2012-09-11 Nomadix, Inc. Systems and methods for providing dynamic network authorization, authentication and accounting

Families Citing this family (79)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8713641B1 (en) 1998-12-08 2014-04-29 Nomadix, Inc. Systems and methods for authorizing, authenticating and accounting users having transparent computer access to a network using a gateway device
US7194554B1 (en) 1998-12-08 2007-03-20 Nomadix, Inc. Systems and methods for providing dynamic network authorization authentication and accounting
US6738382B1 (en) 1999-02-24 2004-05-18 Stsn General Holdings, Inc. Methods and apparatus for providing high speed connectivity to a hotel environment
ES2320724T3 (en) * 1999-10-22 2009-05-28 Nomadix, Inc. SYSTEMS AND PROCEDURES FOR THE DYNAMIC MANAGEMENT OF THE BANDWIDTH BY PAYABLE IN A COMMUNICATIONS NETWORK.
AU1224101A (en) 1999-10-22 2001-05-08 Nomadix, Inc. Gateway device having an xml interface and associated method
US7752334B2 (en) 2002-10-15 2010-07-06 Nomadix, Inc. Intelligent network address translator and methods for network address translation
US7573876B2 (en) * 2002-12-05 2009-08-11 Intel Corporation Interconnecting network processors with heterogeneous fabrics
US6985920B2 (en) * 2003-06-23 2006-01-10 Protego Networks Inc. Method and system for determining intra-session event correlation across network address translation devices
US7633948B2 (en) * 2003-07-07 2009-12-15 Panasonic Corporation Relay device and server, and port forward setting method
WO2005051008A1 (en) * 2003-11-19 2005-06-02 Research In Motion Limited Systems and methods for added authentication in distributed network delivered half-duplex communications
DE602005015366D1 (en) * 2005-03-29 2009-08-20 Research In Motion Ltd METHOD AND DEVICES FOR USE IN THE MANUFACTURING OF MEETING INTRODUCTION PROTOCOL TRANSMISSIONS FOR VIRTUAL PRIVATE NETWORKING
EP1894371A1 (en) * 2005-05-18 2008-03-05 Ninety9.com PTY Ltd. Dynamic address mapping
US20070162968A1 (en) * 2005-12-30 2007-07-12 Andrew Ferreira Rule-based network address translation
JP5132059B2 (en) * 2006-01-30 2013-01-30 富士通株式会社 Packet relay method and packet relay system
US8145733B1 (en) * 2006-02-15 2012-03-27 Trend Micro Incorporated Identification of computers located behind an address translation server
US20070214232A1 (en) * 2006-03-07 2007-09-13 Nokia Corporation System for Uniform Addressing of Home Resources Regardless of Remote Clients Network Location
KR20090092503A (en) * 2008-02-27 2009-09-01 주식회사 휴커넥스 Multiport apparatus capable of supporting a plurality of ip equipments with a single ip address
US7890657B2 (en) * 2008-06-12 2011-02-15 Genband Us Llc System and method for correct routing and enforcement policy in a network having address or port translation
US8836601B2 (en) 2013-02-04 2014-09-16 Ubiquiti Networks, Inc. Dual receiver/transmitter radio devices with choke
US9634373B2 (en) 2009-06-04 2017-04-25 Ubiquiti Networks, Inc. Antenna isolation shrouds and reflectors
US9496620B2 (en) 2013-02-04 2016-11-15 Ubiquiti Networks, Inc. Radio system for long-range high-speed wireless communication
US20110030037A1 (en) 2009-07-07 2011-02-03 Vadim Olshansky Zone migration in network access
JP2011077804A (en) * 2009-09-30 2011-04-14 Oki Networks Co Ltd Communication device and communication method of the same
US20110305160A1 (en) * 2010-06-14 2011-12-15 G2, Inc. System, device, and terminal for resolving an obfuscated network address of a network device within a network
JP6104178B2 (en) 2011-01-18 2017-03-29 ノマディックス・インコーポレイテッドNomadix,Inc. System and method for group bandwidth management in a communication system network
US9232560B2 (en) * 2011-08-26 2016-01-05 Open Invention Network, Llc Mobile wide area network IP translation configuration
US8953623B1 (en) * 2011-11-23 2015-02-10 Juniper Networks, Inc. Predictive network services load balancing within a network device
CN102546588B (en) * 2011-11-28 2015-02-25 深圳奥联信息安全技术有限公司 Method for penetrating through LINUX fire walls to build communication
CN103167049B (en) * 2011-12-13 2016-09-07 中国电信股份有限公司 Demand assigned method for network address translation, equipment and system
CN103458060B (en) * 2012-06-05 2018-03-02 中兴通讯股份有限公司 The transmission method and device of hostid under a kind of multistage network address conversion
US9042304B2 (en) * 2012-06-05 2015-05-26 Vmware, Inc. Controlling a paravirtualized wireless interface from a guest virtual machine
US9137281B2 (en) 2012-06-22 2015-09-15 Guest Tek Interactive Entertainment Ltd. Dynamically enabling guest device supporting network-based media sharing protocol to share media content over local area computer network of lodging establishment with subset of in-room media devices connected thereto
CN102891903B (en) * 2012-10-31 2015-12-09 杭州华三通信技术有限公司 A kind of NAT method and equipment
US10164913B2 (en) * 2013-01-16 2018-12-25 Cfph, Llc Router for performing NAT and/or PAT translations
US9543635B2 (en) 2013-02-04 2017-01-10 Ubiquiti Networks, Inc. Operation of radio devices for long-range high-speed wireless communication
US9397820B2 (en) 2013-02-04 2016-07-19 Ubiquiti Networks, Inc. Agile duplexing wireless radio devices
US20160218406A1 (en) 2013-02-04 2016-07-28 John R. Sanford Coaxial rf dual-polarized waveguide filter and method
US9373885B2 (en) 2013-02-08 2016-06-21 Ubiquiti Networks, Inc. Radio system for high-speed wireless communication
KR102189609B1 (en) * 2013-07-12 2020-12-11 스카이후크 와이어리스, 인크. Associating attributes with network addresses
US9667595B2 (en) * 2013-07-24 2017-05-30 Cisco Technology, Inc. Selectively using network address translated mapped addresses based on their prior network reachability
EP3648359A1 (en) 2013-10-11 2020-05-06 Ubiquiti Inc. Wireless radio system optimization by persistent spectrum analysis
US9584367B2 (en) * 2013-11-05 2017-02-28 Solarwinds Worldwide, Llc Node de-duplication in a network monitoring system
US9148402B2 (en) * 2013-12-06 2015-09-29 Qualcomm Innovation Center, Inc. Systems, methods, and apparatus for full-cone and address restricted cone network address translation using hardware acceleration
PL3114884T3 (en) 2014-03-07 2020-05-18 Ubiquiti Inc. Cloud device identification and authentication
US9325516B2 (en) 2014-03-07 2016-04-26 Ubiquiti Networks, Inc. Power receptacle wireless access point devices for networked living and work spaces
US10574474B2 (en) 2014-03-07 2020-02-25 Ubiquiti Inc. Integrated power receptacle wireless access point (AP) adapter devices
EP3120642B1 (en) 2014-03-17 2023-06-07 Ubiquiti Inc. Array antennas having a plurality of directional beams
US10200282B1 (en) 2014-03-26 2019-02-05 Juniper Networks, Inc. Systems and methods for virtualizing customer-premises equipment
US9565103B1 (en) * 2014-03-26 2017-02-07 Juniper Networks, Inc. Systems and methods for virtualizing customer-premises equipment
DK3127187T3 (en) 2014-04-01 2021-02-08 Ubiquiti Inc Antenna device
GB2525434A (en) * 2014-04-25 2015-10-28 Ibm Method and device for duplicating a data center
US10425536B2 (en) 2014-05-08 2019-09-24 Ubiquiti Networks, Inc. Phone systems and methods of communication
WO2016003864A1 (en) 2014-06-30 2016-01-07 Ubiquiti Networks, Inc. Wireless radio device alignment tools and methods
CN109905842B (en) 2014-06-30 2020-11-17 优倍快公司 Method for determining radio transmission characteristics
US10476764B2 (en) * 2014-08-19 2019-11-12 Citrix Systems, Inc. Systems and methods for high volume logging and synchronization for large scale network address translation
CN110149650B (en) 2014-08-31 2022-06-28 优倍快公司 Method for monitoring wireless network and wireless device
CN104243629B (en) * 2014-09-24 2017-11-03 浙江宇视科技有限公司 A kind of device intercommunicating method and system based on NAT types
US10164332B2 (en) 2014-10-14 2018-12-25 Ubiquiti Networks, Inc. Multi-sector antennas
US10284268B2 (en) 2015-02-23 2019-05-07 Ubiquiti Networks, Inc. Radio apparatuses for long-range communication of radio-frequency information
CN106295381B (en) * 2015-05-19 2019-05-07 澜起科技股份有限公司 For monitoring device and internal storage to the data access of internal storage
CN105100297B (en) * 2015-06-30 2019-01-22 新华三技术有限公司 A kind of method for processing resource and device
US10136233B2 (en) 2015-09-11 2018-11-20 Ubiquiti Networks, Inc. Compact public address access point apparatuses
WO2017053956A1 (en) 2015-09-25 2017-03-30 Ubiquiti Networks, Inc. Compact and integrated key controller apparatus for monitoring networks
US9761954B2 (en) 2015-10-09 2017-09-12 Ubiquiti Networks, Inc. Synchronized multiple-radio antenna systems and methods
US9860195B2 (en) * 2015-12-31 2018-01-02 Hughes Network Systems, Llc Method and system of providing carrier grade NAT (CGN) to a subset of a subscriber base
KR102019173B1 (en) * 2016-10-31 2019-09-09 삼성에스디에스 주식회사 Method and apparatus for cutting off client session for web application server
US10187356B2 (en) * 2016-11-22 2019-01-22 Citrix Systems, Inc. Connectivity between cloud-hosted systems and on-premises enterprise resources
US10733599B2 (en) 2017-05-31 2020-08-04 Paypal, Inc. Accessing digital wallet information using a point-of-sale device
WO2019014229A1 (en) 2017-07-10 2019-01-17 Ubiquiti Networks, Inc. Wearable video camera medallion with circular display
US10972358B2 (en) 2017-08-30 2021-04-06 Citrix Systems, Inc. Inferring congestion and signal quality
EP3688960B1 (en) 2017-09-27 2022-06-29 Ubiquiti Inc. Systems for automatic secured remote access to a local network
US10469287B2 (en) * 2017-10-25 2019-11-05 ColorTokens, Inc. Port translation for network segmentation
WO2019139993A1 (en) 2018-01-09 2019-07-18 Ubiquiti Networks, Inc. Quick connecting twisted pair cables
US11153203B2 (en) 2018-10-05 2021-10-19 Sandvine Corporation System and method for adaptive traffic path management
CN109743414B (en) * 2019-02-18 2021-12-31 国家计算机网络与信息安全管理中心 Method for improving address translation availability using redundant connections and computer readable storage medium
JP2022547955A (en) 2019-09-13 2022-11-16 ユービキティ インコーポレイテッド Augmented reality for internet connection settings
US10841121B1 (en) 2019-09-30 2020-11-17 Hilton International Holding Llc Hospitality system and method of using the same
US20220200952A1 (en) * 2020-12-21 2022-06-23 Oracle International Corporation Network address translation between networks
CN115514732B (en) * 2022-09-02 2023-08-25 上海量讯物联技术有限公司 Source NAT IP distribution method and device based on TCP connection number

Citations (55)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5185860A (en) * 1990-05-03 1993-02-09 Hewlett-Packard Company Automatic discovery of network elements
US5293488A (en) * 1991-09-03 1994-03-08 Hewlett-Packard Company Message-routing apparatus
US5678041A (en) * 1995-06-06 1997-10-14 At&T System and method for restricting user access rights on the internet based on rating information stored in a relational database
US5699520A (en) * 1994-08-25 1997-12-16 Hewlett-Packard Company Flow control apparatus and method for a computer interconnect using adaptive credits and flow control tags
US5793763A (en) * 1995-11-03 1998-08-11 Cisco Technology, Inc. Security system for network address translation systems
US5835061A (en) * 1995-06-06 1998-11-10 Wayport, Inc. Method and apparatus for geographic-based communications service
US5940394A (en) * 1996-08-08 1999-08-17 At&T Corp Transferring messages in networks made up of subnetworks with different namespaces
US6064674A (en) * 1997-10-22 2000-05-16 International Business Machines Corporation Method and apparatus for hardware forwarding of LAN frames over ATM networks
US6115545A (en) * 1997-07-09 2000-09-05 Hewlett-Packard Company Automatic internet protocol (IP) address allocation and assignment
US6128664A (en) * 1997-10-20 2000-10-03 Fujitsu Limited Address-translating connection device
US6130892A (en) * 1997-03-12 2000-10-10 Nomadix, Inc. Nomadic translator or router
US6141690A (en) * 1997-07-31 2000-10-31 Hewlett-Packard Company Computer network address mapping
US6173322B1 (en) * 1997-06-05 2001-01-09 Silicon Graphics, Inc. Network request distribution based on static rules and dynamic performance data
US6240533B1 (en) * 1999-02-25 2001-05-29 Lodgenet Entertainment Corporation Method and apparatus for providing uninterrupted communication over a network link
US6256307B1 (en) * 1998-03-27 2001-07-03 Hewlett-Packard Co. Local area network receive filter
US6259405B1 (en) * 1995-06-06 2001-07-10 Wayport, Inc. Geographic based communications service
US6353614B1 (en) * 1998-03-05 2002-03-05 3Com Corporation Method and protocol for distributed network address translation
US6414635B1 (en) * 2000-10-23 2002-07-02 Wayport, Inc. Geographic-based communication service system with more precise determination of a user's known geographic location
US20020116523A1 (en) * 2001-02-22 2002-08-22 Warrier Ulhas S. Assigning a source address to a data packet based on the destination of the data packet
US20020116502A1 (en) * 2001-02-22 2002-08-22 Iyer Prakash N. Proxy-less packet routing between private and public address realms
US6453353B1 (en) * 1998-07-10 2002-09-17 Entrust, Inc. Role-based navigation of information resources
US6470386B1 (en) * 1997-09-26 2002-10-22 Worldcom, Inc. Integrated proxy interface for web based telecommunications management tools
US6470027B1 (en) * 1999-04-30 2002-10-22 At&T Corp. System and method for providing message redirection in networked environments
US6571221B1 (en) * 1999-11-03 2003-05-27 Wayport, Inc. Network communication service with an improved subscriber model using digital certificates
US6574664B1 (en) * 1999-01-29 2003-06-03 Hewlett-Packard Development Company, L.P. Apparatus and method for IP and MAC address discovery at the process layer
US6584505B1 (en) * 1999-07-08 2003-06-24 Microsoft Corporation Authenticating access to a network server without communicating login information through the network server
US6636794B2 (en) * 2001-05-11 2003-10-21 Mitsubishi Denki Kabushiki Kaisha Passive safety system
US6738382B1 (en) * 1999-02-24 2004-05-18 Stsn General Holdings, Inc. Methods and apparatus for providing high speed connectivity to a hotel environment
US6751677B1 (en) * 1999-08-24 2004-06-15 Hewlett-Packard Development Company, L.P. Method and apparatus for allowing a secure and transparent communication between a user device and servers of a data access network system via a firewall and a gateway
US6760416B1 (en) * 1999-04-30 2004-07-06 Hewlett-Packard Development Company, L.P. Metering data transfer between end systems
US6823059B2 (en) * 1998-08-04 2004-11-23 At&T Corp. Method for allocating network resources
US6829239B1 (en) * 1999-04-20 2004-12-07 3Com Corporation Apparatus and methods for determining the correct workstation within a LAN for a LAN modem to route a packet
US6834341B1 (en) * 2000-02-22 2004-12-21 Microsoft Corporation Authentication methods and systems for accessing networks, authentication methods and systems for accessing the internet
US6857009B1 (en) * 1999-10-22 2005-02-15 Nomadix, Inc. System and method for network access without reconfiguration
US6856800B1 (en) * 2001-05-14 2005-02-15 At&T Corp. Fast authentication and access control system for mobile networking
US6859960B1 (en) * 2004-01-07 2005-03-01 New Harbour Inc. Portable nap roll for children
US6868399B1 (en) * 1999-10-22 2005-03-15 Nomadix, Inc. Systems and methods for integrating a network gateway device with management systems
US6934754B2 (en) * 2000-04-03 2005-08-23 Ibahn General Holdings, Inc. Methods and apparatus for processing network data transmissions
US6970927B1 (en) * 2000-04-18 2005-11-29 Wayport, Inc. Distributed network communication system which provides different network access features
US6993595B1 (en) * 2001-12-28 2006-01-31 Nortel Networks Limited Address translation change identification
US7003578B2 (en) * 2001-04-26 2006-02-21 Hewlett-Packard Development Company, L.P. Method and system for controlling a policy-based network
US7007080B2 (en) * 1999-12-23 2006-02-28 Solution Inc Limited System for reconfiguring and registering a new IP address for a computer to access a different network without user intervention
US7032243B2 (en) * 2000-12-15 2006-04-18 Hewlett-Packard Development Company, L.P. System and method for a group-based network access control for computer
US7072056B1 (en) * 2000-05-15 2006-07-04 Hewlett-Packard Development Company, L.P. Apparatus and method for translating and sending digital information to different types of receiving devices
US7088727B1 (en) * 1997-03-12 2006-08-08 Nomadix, Inc. System and method for establishing network connection with unknown network and/or user device
US7120678B2 (en) * 2001-02-27 2006-10-10 Hewlett-Packard Development Company, L.P. Method and apparatus for configurable data collection on a computer network
US7126915B1 (en) * 1999-12-28 2006-10-24 At&T Corp. Network traffic regulation
US7240106B2 (en) * 2001-04-25 2007-07-03 Hewlett-Packard Development Company, L.P. System and method for remote discovery and configuration of a network device
US7269653B2 (en) * 2003-11-07 2007-09-11 Hewlett-Packard Development Company, L.P. Wireless network communications methods, communications device operational methods, wireless networks, configuration devices, communications systems, and articles of manufacture
US7349982B2 (en) * 2004-01-12 2008-03-25 Hewlett-Packard Development Company, L.P. Enablement of route table entries
US7356841B2 (en) * 2000-05-12 2008-04-08 Solutioninc Limited Server and method for providing specific network services
US7376113B2 (en) * 2005-04-01 2008-05-20 Arubs Networks, Inc. Mechanism for securely extending a private network
US7428413B2 (en) * 2003-03-11 2008-09-23 Wayport, Inc. Method and system for providing network access and services using access codes
US7472191B2 (en) * 1999-11-03 2008-12-30 Cisco Systems, Inc. Providing different network access levels in a network communication system
US7474617B2 (en) * 2005-03-04 2009-01-06 Ibahn General Holdings Corporation Detection of multiple users of a network access node

Family Cites Families (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US3240533A (en) * 1963-09-09 1966-03-15 Possis Machine Corp Coating apparatus having slidable flow control member
GB8904277D0 (en) * 1989-02-24 1989-04-12 Bp Advanced Materials Limited Method for manufacturing composite material
JP4086340B2 (en) 1996-05-17 2008-05-14 富士通株式会社 Network authentication system
JPH11282804A (en) 1998-03-31 1999-10-15 Secom Joho System Kk Communication system having user authentication function and user authentication method
US6058431A (en) 1998-04-23 2000-05-02 Lucent Technologies Remote Access Business Unit System and method for network address translation as an external service in the access server of a service provider
US6717949B1 (en) * 1998-08-31 2004-04-06 International Business Machines Corporation System and method for IP network address translation using selective masquerade
US6636894B1 (en) * 1998-12-08 2003-10-21 Nomadix, Inc. Systems and methods for redirecting users having transparent computer access to a network using a gateway device having redirection capability
US6643287B1 (en) * 1999-11-24 2003-11-04 Pluris, Inc. Apparatus and method for forwarding encapsulated data packets on a network having multiple links between nodes
US20020112076A1 (en) * 2000-01-31 2002-08-15 Rueda Jose Alejandro Internet protocol-based computer network service
US6779035B1 (en) * 2000-03-06 2004-08-17 Microsoft Corporation Application programming interface and generalized network address translator for translation of transport-layer sessions
US7003574B1 (en) * 2000-11-01 2006-02-21 Microsoft Corporation Session load balancing and use of VIP as source address for inter-cluster traffic through the use of a session identifier
US8112545B1 (en) * 2000-12-19 2012-02-07 Rockstar Bidco, LP Distributed network address translation control
WO2002067531A1 (en) 2001-02-20 2002-08-29 Eyeball Networks Inc. Method and apparatus to permit data transmission to traverse firewalls
US20020138622A1 (en) * 2001-03-21 2002-09-26 Motorola, Inc. Apparatus and method of using long lived addresses in a private network for push messaging to mobile devices
US7370353B2 (en) * 2001-11-05 2008-05-06 Cisco Technology, Inc. System and method for managing dynamic network sessions
US6985479B2 (en) * 2002-03-04 2006-01-10 Qualcomm Incorporated Method and apparatus for processing internet protocol transmissions
US7224696B2 (en) * 2002-06-10 2007-05-29 Nortel Networks, Ltd. Access nodes in packet-based communications networks
US7333500B2 (en) * 2002-09-24 2008-02-19 Nortel Networks Limited Methods for discovering network address and port translators
US7752334B2 (en) 2002-10-15 2010-07-06 Nomadix, Inc. Intelligent network address translator and methods for network address translation
US7539291B2 (en) * 2002-10-16 2009-05-26 J2 Global Communications Enhancing messaging services using translation gateways
US7283542B2 (en) * 2002-11-15 2007-10-16 Nortel Networks Limited Network address translator and secure transfer device for interfacing networks
US7899932B2 (en) * 2003-01-15 2011-03-01 Panasonic Corporation Relayed network address translator (NAT) traversal
US7639686B2 (en) * 2005-04-07 2009-12-29 Cisco Technology, Inc. Access network clusterhead for providing local mobility management of a roaming IPv4 node
US7818454B2 (en) * 2005-09-15 2010-10-19 Hostway Corporation Host migration system
US8798060B1 (en) * 2010-10-21 2014-08-05 Juniper Networks, Inc. Converting between tunneling protocols
US9258272B1 (en) * 2011-10-21 2016-02-09 Juniper Networks, Inc. Stateless deterministic network address translation

Patent Citations (67)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5185860A (en) * 1990-05-03 1993-02-09 Hewlett-Packard Company Automatic discovery of network elements
US5293488A (en) * 1991-09-03 1994-03-08 Hewlett-Packard Company Message-routing apparatus
US5699520A (en) * 1994-08-25 1997-12-16 Hewlett-Packard Company Flow control apparatus and method for a computer interconnect using adaptive credits and flow control tags
US6259405B1 (en) * 1995-06-06 2001-07-10 Wayport, Inc. Geographic based communications service
US5835061A (en) * 1995-06-06 1998-11-10 Wayport, Inc. Method and apparatus for geographic-based communications service
US5969678A (en) * 1995-06-06 1999-10-19 Wayport, Inc. System for hybrid wired and wireless geographic-based communications service
US6697018B2 (en) * 1995-06-06 2004-02-24 Wayport, Inc. Method and apparatus for geographic-based communications service
US5678041A (en) * 1995-06-06 1997-10-14 At&T System and method for restricting user access rights on the internet based on rating information stored in a relational database
US6452498B2 (en) * 1995-06-06 2002-09-17 Wayport, Inc. System and method for providing geographic-based advertising
US7009556B2 (en) * 1995-06-06 2006-03-07 Wayport, Inc. Providing geographic based promotion services to a computing device
US7058594B2 (en) * 1995-06-06 2006-06-06 Wayport, Inc. Distributed network system which transmits information to users based on past transactions of the users
US6326918B1 (en) * 1995-06-06 2001-12-04 Wayport, Inc. Method and apparatus for geographic-based communications service
US5793763A (en) * 1995-11-03 1998-08-11 Cisco Technology, Inc. Security system for network address translation systems
US5940394A (en) * 1996-08-08 1999-08-17 At&T Corp Transferring messages in networks made up of subnetworks with different namespaces
US7088727B1 (en) * 1997-03-12 2006-08-08 Nomadix, Inc. System and method for establishing network connection with unknown network and/or user device
US6130892A (en) * 1997-03-12 2000-10-10 Nomadix, Inc. Nomadic translator or router
US6173322B1 (en) * 1997-06-05 2001-01-09 Silicon Graphics, Inc. Network request distribution based on static rules and dynamic performance data
US6115545A (en) * 1997-07-09 2000-09-05 Hewlett-Packard Company Automatic internet protocol (IP) address allocation and assignment
US6141690A (en) * 1997-07-31 2000-10-31 Hewlett-Packard Company Computer network address mapping
US6470386B1 (en) * 1997-09-26 2002-10-22 Worldcom, Inc. Integrated proxy interface for web based telecommunications management tools
US6128664A (en) * 1997-10-20 2000-10-03 Fujitsu Limited Address-translating connection device
US6064674A (en) * 1997-10-22 2000-05-16 International Business Machines Corporation Method and apparatus for hardware forwarding of LAN frames over ATM networks
US6353614B1 (en) * 1998-03-05 2002-03-05 3Com Corporation Method and protocol for distributed network address translation
US6567405B1 (en) * 1998-03-05 2003-05-20 3Com Corporation Method and protocol for distributed network address translation
US6256307B1 (en) * 1998-03-27 2001-07-03 Hewlett-Packard Co. Local area network receive filter
US6453353B1 (en) * 1998-07-10 2002-09-17 Entrust, Inc. Role-based navigation of information resources
US6823059B2 (en) * 1998-08-04 2004-11-23 At&T Corp. Method for allocating network resources
US6574664B1 (en) * 1999-01-29 2003-06-03 Hewlett-Packard Development Company, L.P. Apparatus and method for IP and MAC address discovery at the process layer
US6738382B1 (en) * 1999-02-24 2004-05-18 Stsn General Holdings, Inc. Methods and apparatus for providing high speed connectivity to a hotel environment
US6996073B2 (en) * 1999-02-24 2006-02-07 Ibahn General Holdings Corporation Methods and apparatus for providing high speed connectivity to a hotel environment
US7580376B2 (en) * 1999-02-24 2009-08-25 Ibahn General Holdings Corporation Methods and apparatus for providing high speed connectivity to a hotel environment
US6240533B1 (en) * 1999-02-25 2001-05-29 Lodgenet Entertainment Corporation Method and apparatus for providing uninterrupted communication over a network link
US6829239B1 (en) * 1999-04-20 2004-12-07 3Com Corporation Apparatus and methods for determining the correct workstation within a LAN for a LAN modem to route a packet
US6470027B1 (en) * 1999-04-30 2002-10-22 At&T Corp. System and method for providing message redirection in networked environments
US6760416B1 (en) * 1999-04-30 2004-07-06 Hewlett-Packard Development Company, L.P. Metering data transfer between end systems
US6584505B1 (en) * 1999-07-08 2003-06-24 Microsoft Corporation Authenticating access to a network server without communicating login information through the network server
US7016960B2 (en) * 1999-07-08 2006-03-21 Microsoft Corporation Authenticating user access to a network server without communicating user authentication cookie to the network server
US6751677B1 (en) * 1999-08-24 2004-06-15 Hewlett-Packard Development Company, L.P. Method and apparatus for allowing a secure and transparent communication between a user device and servers of a data access network system via a firewall and a gateway
US6857009B1 (en) * 1999-10-22 2005-02-15 Nomadix, Inc. System and method for network access without reconfiguration
US6868399B1 (en) * 1999-10-22 2005-03-15 Nomadix, Inc. Systems and methods for integrating a network gateway device with management systems
US6732176B1 (en) * 1999-11-03 2004-05-04 Wayport, Inc. Distributed network communication system which enables multiple network providers to use a common distributed network infrastructure
US7472191B2 (en) * 1999-11-03 2008-12-30 Cisco Systems, Inc. Providing different network access levels in a network communication system
US6571221B1 (en) * 1999-11-03 2003-05-27 Wayport, Inc. Network communication service with an improved subscriber model using digital certificates
US7526538B2 (en) * 1999-12-23 2009-04-28 Solutioninc Limited System using server to provide mobile computer accessing to a different network without reconfiguring the mobile computer
US7007080B2 (en) * 1999-12-23 2006-02-28 Solution Inc Limited System for reconfiguring and registering a new IP address for a computer to access a different network without user intervention
US7126915B1 (en) * 1999-12-28 2006-10-24 At&T Corp. Network traffic regulation
US6834341B1 (en) * 2000-02-22 2004-12-21 Microsoft Corporation Authentication methods and systems for accessing networks, authentication methods and systems for accessing the internet
US6934754B2 (en) * 2000-04-03 2005-08-23 Ibahn General Holdings, Inc. Methods and apparatus for processing network data transmissions
US6970927B1 (en) * 2000-04-18 2005-11-29 Wayport, Inc. Distributed network communication system which provides different network access features
US7356841B2 (en) * 2000-05-12 2008-04-08 Solutioninc Limited Server and method for providing specific network services
US7072056B1 (en) * 2000-05-15 2006-07-04 Hewlett-Packard Development Company, L.P. Apparatus and method for translating and sending digital information to different types of receiving devices
US6414635B1 (en) * 2000-10-23 2002-07-02 Wayport, Inc. Geographic-based communication service system with more precise determination of a user's known geographic location
US7032243B2 (en) * 2000-12-15 2006-04-18 Hewlett-Packard Development Company, L.P. System and method for a group-based network access control for computer
US20020116502A1 (en) * 2001-02-22 2002-08-22 Iyer Prakash N. Proxy-less packet routing between private and public address realms
US20020116523A1 (en) * 2001-02-22 2002-08-22 Warrier Ulhas S. Assigning a source address to a data packet based on the destination of the data packet
US7120678B2 (en) * 2001-02-27 2006-10-10 Hewlett-Packard Development Company, L.P. Method and apparatus for configurable data collection on a computer network
US7240106B2 (en) * 2001-04-25 2007-07-03 Hewlett-Packard Development Company, L.P. System and method for remote discovery and configuration of a network device
US7003578B2 (en) * 2001-04-26 2006-02-21 Hewlett-Packard Development Company, L.P. Method and system for controlling a policy-based network
US6636794B2 (en) * 2001-05-11 2003-10-21 Mitsubishi Denki Kabushiki Kaisha Passive safety system
US6856800B1 (en) * 2001-05-14 2005-02-15 At&T Corp. Fast authentication and access control system for mobile networking
US6993595B1 (en) * 2001-12-28 2006-01-31 Nortel Networks Limited Address translation change identification
US7428413B2 (en) * 2003-03-11 2008-09-23 Wayport, Inc. Method and system for providing network access and services using access codes
US7269653B2 (en) * 2003-11-07 2007-09-11 Hewlett-Packard Development Company, L.P. Wireless network communications methods, communications device operational methods, wireless networks, configuration devices, communications systems, and articles of manufacture
US6859960B1 (en) * 2004-01-07 2005-03-01 New Harbour Inc. Portable nap roll for children
US7349982B2 (en) * 2004-01-12 2008-03-25 Hewlett-Packard Development Company, L.P. Enablement of route table entries
US7474617B2 (en) * 2005-03-04 2009-01-06 Ibahn General Holdings Corporation Detection of multiple users of a network access node
US7376113B2 (en) * 2005-04-01 2008-05-20 Arubs Networks, Inc. Mechanism for securely extending a private network

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8266266B2 (en) 1998-12-08 2012-09-11 Nomadix, Inc. Systems and methods for providing dynamic network authorization, authentication and accounting

Also Published As

Publication number Publication date
US20040073704A1 (en) 2004-04-15
US20170214652A1 (en) 2017-07-27
US8832315B2 (en) 2014-09-09
US10291580B2 (en) 2019-05-14
EP1554860B1 (en) 2011-03-30
DE60336573D1 (en) 2011-05-12
US20130238812A1 (en) 2013-09-12
US10979385B2 (en) 2021-04-13
US8051206B2 (en) 2011-11-01
US8234409B2 (en) 2012-07-31
US7822873B1 (en) 2010-10-26
US20200076765A1 (en) 2020-03-05
US20110035479A1 (en) 2011-02-10
US8370524B2 (en) 2013-02-05
US7752334B2 (en) 2010-07-06
US9491136B2 (en) 2016-11-08
US20120284364A1 (en) 2012-11-08
US20150215275A1 (en) 2015-07-30
AU2003211139A1 (en) 2004-05-04
ATE504151T1 (en) 2011-04-15
EP1554860A1 (en) 2005-07-20
WO2004036877A1 (en) 2004-04-29
US20120036224A1 (en) 2012-02-09

Similar Documents

Publication Publication Date Title
US10979385B2 (en) Systems and methods for network address translation
US9253149B2 (en) Method for providing an internal server with a shared public IP address
US6801528B2 (en) System and method for dynamic simultaneous connection to multiple service providers
US7929533B2 (en) System for selecting a connectivity mechanism
KR20090041407A (en) Method and device for identifying and selecting an interface to access a network
Cisco Configuring TCP/IP
Cisco Configuring TCP/IP
Cisco Configuring TCP/IP
Cisco Configuring TCP/IP
Cisco Configuring TCP/IP
Cisco Configuring TCP/IP
Cisco Configuring TCP/IP
Cisco Configuring TCP/IP
Cisco Configuring IP
Cisco Configuring IP
Cisco Configuring IP
Cisco Configuring IP
Cisco Configuring IP
Cisco Configuring IP
Cisco Configuring IP
Cisco Configuring IP
Cisco Configuring IP
Cisco Configuring IP
Cisco Configuring IP
Cisco Configuring IP

Legal Events

Date Code Title Description
STCF Information on status: patent grant

Free format text: PATENTED CASE

CC Certificate of correction
FPAY Fee payment

Year of fee payment: 4

AS Assignment

Owner name: NOMADIX, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:PAUNIKAR, AMIT;SINGH, BIKRAMJIT;REEL/FRAME:033449/0125

Effective date: 20021210

AS Assignment

Owner name: NTT DOCOMO, INC., JAPAN

Free format text: SECURITY INTEREST;ASSIGNOR:NOMADIX, INC.;REEL/FRAME:036721/0341

Effective date: 20150929

AS Assignment

Owner name: NTT DOCOMO, INC., JAPAN

Free format text: MODIFICATION TO PATENT SECURITY AGREEMENT;ASSIGNOR:NOMADIX, INC.;REEL/FRAME:043710/0387

Effective date: 20170829

AS Assignment

Owner name: GATE WORLDWIDE HOLDINGS LLC, NEW YORK

Free format text: ASSIGNMENT OF PATENT SECURITY AGREEMENT;ASSIGNOR:NTT DOCOMO, INC.;REEL/FRAME:045113/0937

Effective date: 20170905

Owner name: GATE WORLDWIDE HOLDINGS LLC, NEW YORK

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:NOMADIX, INC.;REEL/FRAME:045113/0928

Effective date: 20180112

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552)

Year of fee payment: 8

AS Assignment

Owner name: KNOBBE, MARTENS, OLSON & BEAR, LLP, CALIFORNIA

Free format text: SECURITY INTEREST;ASSIGNOR:NOMADIX, INC.;REEL/FRAME:048655/0621

Effective date: 20190315

AS Assignment

Owner name: NOMADIX, INC., CALIFORNIA

Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:KNOBBE, MARTENS, OLSON & BEAR, LLP;REEL/FRAME:050440/0042

Effective date: 20190520

AS Assignment

Owner name: NOMADIX, INC., CALIFORNIA

Free format text: QUITCLAIM;ASSIGNOR:GATE WORLDWIDE HOLDINGS LLC;REEL/FRAME:051095/0529

Effective date: 20191121

MAFP Maintenance fee payment

Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1553); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Year of fee payment: 12