Method and apparatus for network address translation
View Patent ↗A method and system for improved network address translation (NAT) to enable efficient translation of packets destined for communication systems within a domain utilizing network addresses that are incompatible with the source and destination addresses indicated in packets delivered from the global Internet. Since the addresses are not compatible with global Internet addresses, delivery cannot be accomplished except by some method of address translation. Traditional systems have not been constructed to enable such inbound translations, providing instead only communications outbound from the incompatibly addressed domain towards the global Internet. An embodiment of the system employs deep packet inspection (DPI) search techniques known from widely deployed systems in use today, to acquire a resource identifier, and to attempt to match the resource identifier to complete the flow of traffic on a packet-by-packet basis.
1. A method of performing network address translation, the method comprising:
performing a deep packet inspection (DPI) of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a pending or a previously established flow having a corresponding destination address, the flow being a communication between an external domain and an internal domain;
based on a result of the DPI, associating the external domain address and the destination address with the flow;
performing a look-up based on the destination address to determine an internal domain address within the NAT device; and
associating the internal domain address with the flow.
2. The method according to claim 1 wherein, for an application traffic packet, performing the DPI and associating the destination address with the flow occurs on a packet-by-packet basis.
3. The method according to claim 1
wherein the look-up is performed in a flow management table.
4. The method according to claim 1 wherein the external domain address is a legacy communications protocol address and wherein the internal domain address is an upgraded version of the legacy communications protocol address.
5. The method according to claim 4 wherein the external domain address is an Internet Protocol version 4 (IPv4) address and wherein the internal domain address is an Internet Protocol version 6 (IPv6) address.
6. The method according to claim 1 wherein the external domain address of the NAT device is an IPv4 address and wherein the internal domain address of the NAT device is an IPv4 address.
7. The method according to claim 1 wherein the external domain address and the internal domain address use the same or different network communications protocol addressing.
8. The method according to claim 1 wherein performing the DPI includes performing the DPI at an application layer, a transport layer, an Internet layer, or a network access layer of a TCP/IP stack.
9. The method according to claim 8 wherein performing the DPI identifies the destination address of the flow from within a payload of the traffic packet, the payload beginning after transport information in a header of the traffic packet.
10. The method according to claim 1 wherein performing the DPI further includes locating a destination host name in a payload of the traffic packet using application-specific information to parse the traffic packet.
11. The method according to claim 10 wherein performing the DPI further includes inspecting application payload of the traffic packet.
12. The method according to claim 1 wherein the flow maintains at least four parameters:
for a packet arriving at the NAT device, a source address being an address of a device in the external domain and a destination address being a NAT address on an external side of the NAT device; and
for a packet being transmitted from the NAT device, a source address being the NAT address on the external side of the NAT device and a destination address being an address of a device in the internal domain.
13. The method according to claim 1 further comprising:
maintaining the external domain address in a pending state following receipt from another network node that the external domain address was given to an external node; and
changing the pending state to an established state following receipt of traffic corresponding to the external domain address.
14. An apparatus for performing network address translation, the apparatus comprising:
a deep packet inspection (DPI) module configured to perform deep packet inspection of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a pending or a previously established flow having a corresponding destination address, the flow being a communication between an internal domain and an external domain;
a traffic association module configured to associate the external domain address and the destination address with the flow based on a result of the DPI; and
a look-up module configured to perform a look-up based on the destination address to determine an internal domain address within the NAT device, the traffic association module further configured to associate the internal domain address with the flow.
15. The apparatus according to claim 14 wherein, for an application traffic packet, the DPI module and traffic association module are configured to operate on a packet-by-packet basis.
16. The apparatus according to claim 14
wherein the look-up module is further configured to perform the look-up in a flow management table.
17. The apparatus according to claim 14 wherein the external domain address is a legacy communications protocol address and wherein the internal domain address is an upgraded version of the legacy communications protocol address.
18. The apparatus according to claim 17 wherein the external domain address is an Internet Protocol version 4 (IPv4) address and wherein the internal domain address is an Internet Protocol version (IPv6) address.
19. The apparatus according to claim 14 wherein the external domain address is an IPv4 address and wherein the internal domain address is an IPv4 address.
20. The apparatus according to claim 14 wherein the external domain address and the internal domain address use the same or different network communications protocol addressing.
21. The apparatus according to claim 14 wherein the DPI module is further configured to perform DPI at an application layer, a transport layer, an Internet layer, or a network access layer of a TCP/IP stack.
22. The apparatus according to claim 21 wherein the DPI module is further configured to identify the destination address of the flow from within a payload of the traffic packet, where the payload begins after transportation information in a header of the traffic packet.
23. The apparatus according to claim 14 wherein the DPI module is further configured to locate a destination host name in a payload of the traffic packet by using application-specific information to parse the traffic packet.
24. The apparatus according to claim 23 wherein the DPI module is further configured to inspect application payload of the traffic packet.
25. The apparatus according to claim 14 wherein the flow maintains at least four parameters:
for a packet arriving at the NAT device, a source address being an address of a device in the external domain and a destination address being a NAT address on an external side of the NAT device; and
for a packet being transmitted from the NAT device, a source address being the NAT address on the external side of the NAT device and a destination address being an address of a device in the internal domain.
26. The apparatus according to claim 14 further comprising:
an address state tracking module configured to:
maintain the external domain address in a pending state following receipt from another network node that the external domain address was given to an external node; and
change the pending state to an established state following receipt of traffic corresponding to the external domain address.
27. A computer program product including a non-transitory computer readable medium having stored thereon computer readable instructions to perform network address translation, wherein the computer readable instructions, when executed by a processor, cause the processor to:
perform a deep packet inspection (DPI) of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a flow having a corresponding destination address, the flow being a communication between an internal domain and an external domain;
associate the external domain address and the destination address with the flow, based on a result of the DPI;
perform a look-up based on the destination address to determine an internal domain address within the NAT device; and
associate the internal domain address with the flow.
28. A method of performing network address translation, the method comprising:
performing a deep packet inspection (DPI) of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a pending or a previously established flow having a corresponding destination address, the flow being a communication between an external domain and an internal domain; and
based on a result of the DPI, associating the external domain address and the destination address with the flow, wherein performing the DPI includes performing the DPI at one or more of an application layer, a transport layer, an Internet layer, or a network access layer of a TCP/IP stack.
29. The method according to claim 28 wherein performing the DPI identifies the destination address of the flow from within a payload of the traffic packet, the payload beginning after transport information in a header of the traffic packet.
30. A method of performing network address translation, the method comprising:
performing a deep packet inspection (DPI) of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a pending or a previously established flow having a corresponding destination address, the flow being a communication between an external domain and an internal domain; and
based on a result of the DPI, associating the external domain address and the destination address with the flow, wherein performing the DPI includes locating a destination host name in a payload of the traffic packet using application-specific information to parse the traffic packet.
31. The method according to claim 30 wherein performing the DPI further includes inspecting application payload of the traffic packet.
32. A method of performing network address translation, the method comprising:
performing a deep packet inspection (DPI) of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a pending or a previously established flow having a corresponding destination address, the flow being a communication between an external domain and an internal domain; and
based on a result of the DPI, associating the external domain address and the destination address with the flow, the flow maintaining at least four parameters: for a packet arriving at the NAT device, a source address being an address of a device in the external domain and a destination address being a NAT address on an external side of the NAT device, and for a packet being transmitted from the NAT device, a source address being the NAT address on the external side of the NAT device and a destination address being an address of a device in the internal domain.
33. A method of performing network address translation, the method comprising:
performing a deep packet inspection (DPI) of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a pending or a previously established flow having a corresponding destination address, the flow being a communication between an external domain and an internal domain;
based on a result of the DPI, associating the external domain address and the destination address with the flow;
maintaining the external domain address in a pending state following receipt from another network node that the external domain address was given to an external node; and
changing the pending state to an established state following receipt of traffic corresponding to the external domain address.
34. An apparatus for performing network address translation, the apparatus comprising:
a deep packet inspection (DPI) module configured to perform deep packet inspection of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a pending or a previously established flow having a corresponding destination address, the flow being a communication between an internal domain and an external domain, the DPI module further configured to perform DPI at an application layer, a transport layer, an Internet layer, or a network access layer of a TCP/IP stack; and
a traffic association module configured to associate the external domain address and the destination address with the flow based on a result of the DPI.
35. The apparatus according to claim 34 wherein the DPI module is further configured to identify the destination address of the flow from within a payload of the traffic packet, where the payload begins after transportation information in a header of the traffic packet.
36. An apparatus for performing network address translation, the apparatus comprising:
a deep packet inspection (DPI) module configured to perform deep packet inspection of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a pending or a previously established flow having a corresponding destination address, the flow being a communication between an internal domain and an external domain, the DPI module further configured to locate a destination host name in a payload of the traffic packet by using application-specific information to parse the traffic packet; and
a traffic association module configured to associate the external domain address and the destination address with the flow based on a result of the DPI.
37. The apparatus according to claim 36 wherein the DPI module is further configured to inspect application payload of the traffic packet.
38. An apparatus for performing network address translation, the apparatus comprising:
a deep packet inspection (DPI) module configured to perform deep packet inspection of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a pending or a previously established flow having a corresponding destination address, the flow being a communication between an internal domain and an external domain, the flow maintaining at least four parameters: for a packet arriving at the NAT device, a source address being an address of a device in the external domain and a destination address being a NAT address on an external side of the NAT device, and for a packet being transmitted from the NAT device, a source address being the NAT address on the external side of the NAT device and a destination address being an address of a device in the internal domain; and
a traffic association module configured to associate the external domain address and the destination address with the flow based on a result of the DPI.
39. An apparatus for performing network address translation, the apparatus comprising:
a deep packet inspection (DPI) module configured to perform deep packet inspection of a traffic packet having an external domain address of a network address translation (NAT) device, the external domain address being associated with a pending or a previously established flow having a corresponding destination address, the flow being a communication between an internal domain and an external domain;
a traffic association module configured to associate the external domain address and the destination address with the flow based on a result of the DPI; and
an address state tracking module configured to:
maintain the external domain address in a pending state following receipt from another network node that the external domain address was given to an external node; and
change the pending state to an established state following receipt of traffic corresponding to the external domain address.