Method and system for performing asymmetric address translation

• US 20030108055A1
• Filed: 12/07/2001
• Published: 06/12/2003
• Est. Priority Date: 12/07/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Damon, Philippe, Davis, Gordon Taylor
• Granted Patent: US 7,136,385 B2
• Time in Patent Office: Days
• US Class Current: 370/401
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/255 Maintenance or indexing of mapping tables
• CPC Class Codes: H04L 61/2557 Translation policies or rules

Abstract

A method and system for performing network address translations for a session in a network is disclosed. The network includes at least one local network domain, and the at least one local network domain includes at least one computer system. Each computer system has a local address and is associated with a global address. The session exchanges packets that travel between the computer system within the local network domain and another computer system which may be outside of the local network domain. Each packet includes source and destination information. The method and system include determining a direction of travel for each packet, inbound or outbound, by searching a global address table for a match of a key for each packet. The key is provided using a portion of the destination information. The global address table includes at least one entry. Each entry corresponds to the global address for a first corresponding computer system. The method and system also include asymmetrically translating the source and destination information for each packet using an address translation table or session table based on whether or not the full match is found. The destination information is translated using information in the session table if the packet is inbound. The source information is translated based on the address translation table if the packet is outbound. The address translation table includes at least one entry. Each entry corresponds to the local address for a first corresponding computer system or a global host name for a shared host.

Claims

1. A method for performing network address translations for a session in a network, the network including at least one local network domain, the local network domain including at least one computer system, each of the at least one computer system having a local address and being associated with a global address, the session exchanging a plurality of packets that travel to and from a second at least one computer system within the network, each of the second at least one computer system being connected to the network outside of the local network domain, each of the plurality of packets including source information and destination information, the method comprising the steps of:

(a) searching a global address table for a match of a key for each of the plurality of packets to determine a direction of travel for each of the plurality of packets, the key being provided using a portion of the destination information, the global address table including at least one entry, each of the at least one entry corresponding to the global address for a first corresponding computer system; and

(b) asymmetrically translating the source information and destination information for each of the plurality of packets using an address translation table or session table based on a direction the packet is traveling, the address translation table including at least one entry, each of the at least one entry corresponding to the local address for a first at least one computer system within the at least one local network domain of the network, the session table including at least one session table entry, each of the at least one session table entry corresponding to a specific connection between two computer systems.

2. The method of claim 1, wherein the asymmetrically translating step (b) further includes the steps of:

(b1) determining that the direction the packet is traveling is inbound if an exact match is found while searching the global address table, and determining that the direction the packet is traveling is outbound if the exact match is not found while searching the global address table.

3. The method of claim 1 wherein the direction of travel can be inbound or outbound and wherein the asymmetrically translating step (b) further includes the steps of:

(b1) translating the source information using the address translation table if the packet is outbound; and

(b2) translating the destination information using the session table if the packet is inbound.

4. The method of claim 1 wherein at least one global port is associated with the network beyond the local network domain and at least one local port is associated with the local network domain connecting the first at least one computer system to the network, and wherein asymmetrically translating the source information and destination information in step (b) further includes the steps of:

(b1) if the full match is found, transposing the destination information with the source information, providing a symmetric key using transposed source and destination information, using the symmetric key to search a session table and then performing network address translation using session table data; and

(b2) if the full match is not found, searching the address translation table using the source information, performing the network address translation using address translation table data, providing the symmetric key from translated source parameters, and using the symmetric key to search the session table.

5. The method of claim 1 further including the steps of:

(c1) utilizing the symmetric key to access an entry for the session in the session table.

6. The method of claim 5 wherein the session table has a single entry per session.

7. The method of claim 1 wherein the first at least one computer system is a server.

8. The method of claim 6, wherein the server is partitioned into multiple logical servers, each of which has a different global network address.

9. The method of claim 1 wherein at least one global port is associated with the network beyond the local network domain, and at least one local port is associated with the local network domain connecting the first at least on computers system to the network and wherein asymmetrically translating the source information and destination information in step (b) further includes the steps of:

(b1) if the full match is found, providing a symmetric key using a symmetric function, using the symmetric key to search a session table and then performing network address translation using session table data; and

(b2) if the full match is not found, searching the address translation table using the source information, performing the network address translation using address translation table data, providing the symmetric key using the symmetric function and using the symmetric key from translated source parameters to search the session table.

12. The method of claim 1 wherein the direction of travel can be inbound or outbound and wherein the processor asymmetrically translates the source information by translating the source information using the address translation table if the packet is outbound and translates the destination information using the session table if the packet is inbound.

10. A system for performing network address translations for a session in a network, the network including at least one local network domain, the local network domain including at least one computer system, each of the at least one computer system having a local address and being associated with a global address, the session exchanging a plurality of packets that travel to and from a second at least one computer system within the network, each of the second at least one computer system being connected to the network outside of the local network domain, each of the plurality of packets including source information and destination information, the system comprising:

a memory for storing an address translation table, a global address table and a session table, the address translation table including at least one entry, the address translation table including at least one entry, each of the at least one entry corresponding to the local address for a first corresponding computer system within the at least one local network domain of the network, the session table including at least one session table entry, each of the at least one session table entry corresponding to a specific connection between two computer systems, the global address table including at least one entry, each of the at least one entry corresponding to the global address for a first at least one corresponding computer system; and

a processor for searching the global address table for a full match of a key for each of the plurality of packets, the key being provided using a portion of the source destination information, the processor also for asymmetrically translating the source information and destination information for each of the plurality of packets using the address translation table or a session table based on a direction the packet is traveling.

11. The system of claim 10, wherein the processor asymmetrically translates the source information by determining that the direction the packet is traveling is inbound if an exact match is found while searching the global address table, and determining that the direction the packet is traveling is outbound if the exact match is not found while searching the global address table.

13. The system of claim 11 wherein the computer system wherein the session table is indexed using the symmetric key and wherein the processor identifies the session utilizing the symmetric key to access an entry for the session in the session.

14. The system of claim 13 wherein the session table has a single entry per session.

15. The system of claim 10 wherein at least one global port is associated with the network beyond the local network domain and at least one local port is associated with the local network domain connecting the first at least one computer system to the network, and wherein if the full match is found, the processor provides a symmetric key using a symmetric function, uses the symmetric key to search a session table and then performs network address translation using session table data;

and

wherein if the full match is not found, the processor searches the address translation table using the source information, performs the network address translation using address translation table data, provides the symmetric key from translated source parameters, and uses the symmetric key to search the session table.

16. The system of claim 10 wherein the first at least one computer system is a server.

17. The system of claim 16, wherein the server is partitioned into multiple logical servers, each of which has a different global network address.

18. A computer-readable medium containing a program for performing network address translations for a session in a network, the network including at least one local network domain, the local network domain including at least one computer system, each of the at least one computer system having a local address and being associated with a global address, the session exchanging a plurality of packets that travel to and from a second at least one computer system within the network, each of the second at least one computer system being connected to the network outside of the local network domain, each of the plurality of packets including source information and destination information, the program including instructions for:

(a) searching a global address table for a match of a key for each of the plurality of packets to determine a direction of travel for each of the plurality of packets, the key being provided using a portion of the destination information, the global address table including at least one entry, each of the at least one entry corresponding to the global address for a first corresponding computer system; and

(b) asymmetrically translating the source information and destination information for each of the plurality of packets using an address translation table or session table based on a direction the packet is traveling, the address translation table including at least one entry, each of the at least one entry corresponding to the local address for a first corresponding computer system within the at least one local network domain of the network, the session table including at least one entry, each of the at least one entry corresponding to a specific connection between two computer systems.

19. The computer-readable medium of claim 18, wherein the asymmetrically translating instructions (b) further includes instructions for:

(b1) determining that the direction the packet is traveling is inbound if an exact match is found while searching the global address table, and determining that the direction the packet is traveling is outbound if the exact match is not found while searching the global address table.

20. The computer-readable medium of claim 18 wherein the direction of travel can be inbound or outbound and wherein the asymmetrically translating instructions (b) further includes instructions for:

(b1) translating the source information using the address translation table if the packet is outbound; and

(b2) translating the destination information using the session table if the packet is inbound.

21. The computer-readable medium of claim 18 wherein at least one global port is associated with the network beyond the local network domain and at least one local port is associated with the local network domain connecting the first at least one computer system to the network, and wherein asymmetrically translating the source information and destination information in instructions (b) further includes instructions for:

(b1) if the full match is found, transposing the destination information with the source information, providing a symmetric key using transposed source and destination information, using the symmetric key to search a session table and then performing network address translation using session table data; and

(b2) if the full match is not found, searching the address translation table using the source information, performing the network address translation using address translation table data, providing the symmetric key from translated source parameters, and using the symmetric key to search the session table.

22. The computer-readable medium of claim 18 wherein the program further includes instructions for:

(c) utilizing the symmetric key to access an entry for the session in the session table.

23. The computer-readable medium of claim 22 wherein the session table has a single entry per session.

24. The computer-readable medium of claim 18 wherein the first at least one computer system is a server.

25. The computer-readable medium of claim 24, wherein the server is partitioned into multiple logical servers, each of which has a different global network address.

26. The computer-readable medium of claim 18 wherein at least one global port is associated with the network beyond the local network domain, and at least one local port is associated with the local network domain connecting the first at least on computers system to the network and wherein asymmetrically translating the source information and destination information in instructions (b) further includes instructions for:

(b1) if the full match is found, providing a symmetric key using a symmetric function, using the symmetric key to search a session table and then performing network address translation using session table data; and

(b2) if the full match is not found, searching the address translation table using the source information, performing the network address translation using address translation table data, providing the symmetric key using the symmetric function and using the symmetric key from translated source parameters to search the session table.