Routing data to one or more entities in a network
View Patent ↗A communications system includes a first network that includes a plurality of entities and a router. The router includes a network address translator. A node is capable of communicating data units with entities in the first network. Each data unit includes security information, such as information according to the Internet Security Association and Key Management protocol (ISAKMP) and the Encapsulating Security Payload (ESP) protocol. The network address translator is adapted to convert a destination address in a received data unit from the node to an address of one of the entities based on the security information in the received data unit.
1. A method of routing a data unit targeted to one of a plurality of entities in a network, comprising:
receiving the data unit, the data unit including security information, a first address, and a second address;
translating, by a router including a processor, the second address in the data unit to a third address of a target network entity based on the first address and the security information; and
creating one or more address translation tables used in the translation of the second address, wherein a particular one of the one or more address translation tables contains the first address, the third address of the target network entity, and security information associated with the target network entity,
wherein receiving the data unit includes receiving an Internet Protocol (IP) packet, wherein the first address is a source IP address, and the second address is a destination IP address, and where the packet includes Encapsulating Security Payload information.
2. The method of claim 1 , wherein the second address in the data unit includes a common address associated with the plurality of network entities, and each network entity is assigned a unique network address, and wherein translating the second address includes translating the common address to one of the unique network addresses.
3. The method of claim 1 , wherein translating the second address based on the first address and the security information includes translating the second address based on the first address and a Security Parameters Index field of the Encapsulating Security Payload information.
4. A method of routing a data unit targeted to one of a plurality of entities in a network, comprising:
receiving the data unit, the data unit including security information, a first address, and a second address;
translating, by a router including a processor, the second address in the data unit to a third address of a target network entity based on the first address and the security information; and
creating one or more address translation tables used in the translation of the second address, wherein a particular one of the one or more address translation tables contains the first address, the third address of the target network entity, and security information associated with the target network entity,
wherein receiving the data unit includes receiving an Internet Protocol (IP) packet, wherein the first address is a source IP address, and the second address is a destination IP address,
wherein the packet includes Internet Security Association and Key Management Protocol information.
5. The method of claim 4 , wherein translating the second address includes translating the second address based on initiator and responder cookies of the Internet Security Association and Key Management Protocol information.
6. The method of claim 1 , further comprising matching the first address and security information in the received data unit with the information in the particular address translation table.
7. A router for use in a network having one or more entities, the router comprising:
a processor;
an interface adapted to receive a data unit, the data unit containing address information and a field having security information, wherein the data unit includes an Internet Protocol packet, the address information comprising an Internet Protocol address, wherein the field having the security information in the data unit comprises a Security Parameters Index field in an Encapsulating Security Payload header; and
a translator executable on the processor to convert the address information in the data unit to an identifier of a network entity that the data unit is targeted for based on the security information, the identifier to replace the address information in the data unit.
8. The router of claim 7 , wherein the translator includes a many-to-one network address translator.
9. A router for use in a network having one or more entities, the router comprising:
a processor;
an interface adapted to receive a data unit, the data unit containing address information and a field having security information; and
a translator executable on the processor to convert the address information in the data unit to an identifier of a network entity that the data unit is targeted for based on the security information, the identifier to replace the address information in the data unit,
wherein the data unit includes an Internet Protocol packet, the address information comprising an Internet Protocol address,
wherein the field having the security information in the data unit comprises initiator and responder cookies in an Internet Security Association and Key Management Protocol header.
10. A router for use in a network having one or more entities, the router comprising:
a processor;
an interface adapted to receive a data unit, the data unit containing address information and a field having security information; and
a translator executable on the processor to convert the address information in the data unit to an identifier of a network entity that the data unit is targeted for based on the security information, the identifier to replace the address information in the data unit,
wherein the address information in the received data unit includes a source address and a destination address, the router further comprising a storage medium to store one or more address translation tables containing routing information accessible by the translator, wherein a particular one of the one or more address transaction tables includes the source address, the identifier of the network entity, and the security information.
11. An article including one or more non-transitory machine-readable storage media containing instructions for routing a data unit targeted to an entity on a network, the instructions when executed causing a processor to:
receive the data unit, the data unit containing address information and security information to provide secure communications of the data unit, wherein the address information includes an Internet Protocol address, and wherein the security information comprises a Security Parameters Index field in an Encapsulating Security Payload header;
translate the address information in the data unit to an address of the network entity that the data unit is targeted to based on the security information; and
replace, in the data unit, the address information in the data unit with the address of the network entity.
12. An article including one or more non-transitory machine-readable storage media containing instructions for routing a data unit targeted to an entity on a network, the instructions when executed causing a processor to:
receive the data unit, the data unit containing address information and security information to provide secure communications of the data unit, wherein the address information includes an Internet Protocol address, and wherein the security information includes initiator and responder cookies in an Internet Security Association and Key Management Protocol header;
translate the address information in the data unit to an address of the network entity that the data unit is targeted to based on the security information; and
replace, in the data unit, the address information in the data unit with the address of the network entity.
13. An article including one or more non-transitory machine-readable storage media containing instructions for routing a data unit targeted to an entity on a network, the instructions when executed causing a processor to:
receive the data unit, the data unit containing address information and security information to provide secure communications of the data unit; and
replace, in the data unit, the address information in the data unit with an address of the network entity, wherein the address information in the data unit is translated to the address of the network entity based on the security information,
wherein the address information in the received data unit comprises a source address and a destination address, and wherein the one or more machine-readable storage media contain instructions that when executed causes the processor to access an address translation table to match the source address and the security information in the received data unit to information in the address translation table, wherein the address translation table contains the source address, the address of the network entity, and the security information.
14. The article of claim 13 , wherein the one or more machine-readable storage media contain instructions that when executed causes the processor to match the source address and security information in the received data unit with the source address and security information in the address translation table.
15. A method of routing a data unit targeted to one of a plurality of entities in a network, comprising:
receiving the data unit, the data unit including security information and address information, the security information including Internet Security Association and Key Management Protocol (ISAKMP) information; and
converting, by a router including a processor, the address information in the data unit to an address of a target network entity based on the ISAKMP information, the address of the target network entity replacing the address information in the data unit,
wherein the address information in the received data unit includes a source address and a destination address, the method further comprising creating an address translation table used in the translation of address information, the address translation table containing the source address, the address of the target network entity, and ISAKMP information associated with the target network entity.
16. The method of claim 15 , wherein the address information in the data unit includes a common address associated with the plurality of network entities, and each network entity is assigned a unique network address, and wherein converting the address information includes converting the common address to one of the unique network addresses.
17. The method of claim 15 , wherein converting the address information includes converting the address information based on initiator and responder cookies of the ISAKMP information.
18. The method of claim 15 , further comprising matching the source address and ISAKMP information in the received data unit with the source address and ISAKMP information in the address translation table.
19. A router for use in a network having one or more entities, the router comprising:
a processor;
an interface adapted to receive a data unit, the data unit containing a source address, a destination address, and a field having security information, the security information including Internet Security Association and Key Management Protocol (ISAKMP) information; and
a translator executable on the processor to generate an identifier of a network entity that the data unit is targeted for based on the ISAKMP information, and to replace an address in the data unit with the identifier; and
a storage medium to store an address translation table containing the source address, the identifier of the network entity, and the ISAKMP information,
wherein the translator is to match the source address and ISAKMP information in the received data unit with the source address and ISAKMP information in the address translation table.
20. A router for use in a network having one or more entities, the router comprising:
a processor;
an interface adapted to receive a data unit, the data unit containing a source address, a destination address, and a field having security information, the security information including Internet Security Association and Key Management Protocol (ISAKMP) information; and
a translator executable on the processor to generate an identifier of a network entity that the data unit is targeted for based on the ISAKMP information, and to replace an address in the data unit with the identifier, wherein the data unit contains initiator and responder cookies in an ISAKMP header.
21. The router of claim 10 , wherein the translator is to match the source address and security information in the received data unit with corresponding information in the particular address translation table.
22. The article of claim 13 , wherein the address translation table further contains the destination address in the received data unit.