Network infrastructure management and data routing framework and method thereof

• US 20040049594A1
• Filed: 09/11/2002
• Published: 03/11/2004
• Est. Priority Date: 09/11/2002
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Li, Chi-Bin, Luo, Jiann-Cherng, Song, Feng-Shiuh, Chen, Chih-Yu, Lo, Chung-Ling
• Granted Patent: US 7,373,423 B2
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 45/22 Alternate routing
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

The invention generally provides a method for routing data into and out of a network having a plurality of host computers corresponding to a plurality of network topologies. The method of the invention primarily comprises the steps of electing a destination host from the plurality of host computers in the network, determining an addressing methodology for the destination host in accordance with a destination topology out of the plurality of network topologies corresponding to the destination host, addressing the destination host according to the determined addressing methodology, determining a routing path corresponding to the determined addressing methodology, and routing the data to the destination host through the determined routing path. The routing path can be an inbound or an outbound routing path with respect to the network. The method according to the invention further comprises the step of defining the routing path with a host ID comprising a sequence of at least one host address corresponding to at least one of the plurality of host computers.

Claims

1. A method for routing data into and out of a network having a plurality of host computers corresponding to a plurality of network topologies, the method comprising the steps of:

electing a destination host from said host computers;

determining an addressing methodology for said destination host in accordance with a destination topology out of said network topologies corresponding to said destination host;

addressing said destination host according to said determined addressing methodology;

determining a routing path corresponding to said determined addressing methodology; and

routing said data to said destination host through said determined routing path.

2. The method of claim 1 wherein said network topologies further comprise:

a packet filtering firewall topology;

a port forwarding firewall topology;

a proxy topology;

a private Internet protocol (IP) topology;

multiple Internet protocol (IP) topology; and

a dynamic host configuration protocol (DHCP) assigned Internet protocol (IP) topology.

3. The method of claim 1 further comprising the step of defining said routing path with a host ID comprising a sequence of at least one host address corresponding to at least one of said host computers.

4. The method of claim 3 wherein said host ID further comprises:

an Internet protocol (IP) address;

a domain name;

a network port number;

a hypertext transfer protocol (HTTP) proxy separator;

a SOCKS proxy separator; and

a concatenator.

5. The method of claim 1 wherein said routing path comprises an inbound routing path and an outbound routing path with respect to said network.

6. The method of claim 3 further comprising the steps of:

determining if said destination host is directly accessible; and

assigning a host address of said destination host as said host ID if it is determined that said destination host is directly accessible.

7. The method of claim 6 wherein said host address comprises an Internet protocol (IP) address with a network port number.

8. The method of claim 6 wherein said host address comprises a domain name plus a network port number.

9. The method of claim 6 further comprising the step of:

determining if said destination host comprises two or more Internet protocol (IP) addresses; and

wherein said host address comprises said IP addresses separated by an address separator if it is determined that said destination host is directly accessible and said destination host comprises two or more Internet protocol (IP) addresses.

10. The method of claim 6 wherein said host address comprises, in sequential order, an Internet protocol (IP) address with a network port number, an address separator, and a further IP address with a further network port number.

11. The method of claim 9 wherein said host address comprises a domain name plus a network port number.

12. The method of claim 6 further comprising the steps of:

determining if said destination host comprises a private Internet protocol (IP) address and a public IP address; and

assigning said public IP address as said host address if it is determined that said destination host is directly accessible.

13. The method of claim 6 further comprising the steps of:

determining if said destination host comprises a private Internet protocol (IP) address in a private network and a public IP address; and

assigning said private IP address as said host address wherein said destination host is located within said private network.

14. The method of claim 3 further comprising the steps of:

determining if said destination topology is a packet filtering firewall topology; and

assigning a host address of said destination host as said host ID if it is determined that said destination topology is a packet filtering firewall topology.

15. The method of claim 14 wherein said host address comprises an Internet protocol (IP) address with a network port number.

16. The method of claim 14 wherein said host address comprises a domain name plus a network port number.

17. The method of claim 3 further comprising the steps of:

determining if said destination topology is a port forwarding firewall topology; and

assigning a port address of a firewall port connected to said destination host as said host ID if it is determined that said destination topology is a port forwarding firewall topology.

18. The method of claim 17 wherein said port address comprises an Internet protocol (IP) address with a network port number.

19. The method of claim 17 wherein said port address comprises a domain name plus a network port number.

20. The method of claim 3 further comprising the steps of:

determining if said destination topology is a proxy topology; and

assigning a host address of said destination host with a port address of a proxy port connected to said destination host as said host ID if it is determined that said destination topology is a proxy topology.

21. The method of claim 20 wherein said host address and said port address are separated by an address separator.

22. The method of claim 21 wherein said address separator further comprises a hypertext transfer protocol (HTTP) proxy separator and a SOCKS proxy separator.

23. The method of claim 20 wherein said host address comprises, in sequential order, an Internet protocol (IP) address with a network port number, an address separator, and a further IP address with a further network port number.

24. The method of claim 3 wherein said elected destination host is the Internet.

25. The method of claim 24 further comprising the steps of:

determining if the Internet is directly accessible; and

directly routing said data to the Internet if it is determined that the Internet is directly accessible.

26. The method of claim 24 further comprising the steps of:

determining if said destination topology is a proxy topology; and

assigning a proxy address with a port address of a proxy port connected to the Internet as said host ID if it is determined that said destination topology is a proxy topology.

27. The method of claim 26 wherein said host ID comprises an Internet protocol (IP) address with a network port number.

28. The method of claim 3 further comprising the step of embedding authentication data in said host ID.

29. The method of claim 1 further comprising the steps of:

defining said routing path in a host ID comprising an Internet protocol (IP) address;

determining if said destination topology is a dynamic host configuration protocol (DHCP) assigned Internet protocol (IP) topology;

determining if said IP address has dynamically changed if it is determined that said destination topology is a DHCP assigned IP topology; and

substituting said IP address in said host ID with said dynamically changed IP address.

30. The method of claim 3 wherein said host ID further comprises an address separator.

40. The method of claim 6 wherein said host address comprises, in sequential order, an Internet protocol (IP) address with a network port number, an address separator, and a further IP address with a further network port number.

31. A method for routing data into and out of a network having a plurality of computers corresponding to a plurality of network topologies, the method comprising the steps of:

determining if said data are routed inbound with respect to said network;

electing a destination computer from said computers if it is determined that said data are routed inbound;

determining if said data are routed outbound with respect to said network;

determining an inbound routing path to said destination computer having an inbound host ID in accordance with an inbound topology out of said network topologies, if it is determined that said data are routed inbound;

determining an outbound routing path to the Internet having an outbound host ID in accordance with an outbound topology with respect to the Internet out of said network topologies, if it is determined that said data are routed outbound;

routing said data to said destination computer according to said inbound routing path if it is determined that said data are routed inbound; and

routing said data to the Internet according to said outbound routing path if it is determined that said data are routed outbound.

32. The method of claim 31 wherein said network topologies further comprise:

a packet filtering firewall topology;

a port forwarding firewall topology;

a proxy topology;

a private Internet protocol (IP) topology;

multiple Internet protocol (IP) topology; and

dynamic host configuration protocol (DHCP) assigned Internet protocol (IP) topology.

33. The method of claim 31 wherein said inbound host ID further comprises:

an Internet protocol (IP) address;

a domain name;

a network port number;

a hypertext transfer protocol (HTTP) proxy separator;

a SOCKS proxy separator; and

a concatenator.

34. The method of claim 31 wherein said outbound host ID further comprises:

an Internet protocol (IP) address;

a domain name;

a network port number;

a hypertext transfer protocol (HTTP) proxy separator;

a SOCKS proxy separator; and

a concatenator.

35. The method of claim 31 wherein said inbound host ID further comprises a sequence of at least one host address corresponding to at least one of said computers.

36. The method of claim 31 further comprising the steps of:

determining if said destination computer is directly accessible; and

assigning a host address of said destination computer as said inbound host ID if it is determined that said destination computer is directly accessible.

37. The method of claim 36 wherein said host address comprises an Internet protocol (IP) address with a network port number.

38. The method of claim 36 wherein said host address comprises a domain name plus a network port number.

39. The method of claim 36 further comprising the step of:

determining if said destination computer comprises two or more Internet protocol (IP) addresses; and

wherein said host address comprises said IP addresses separated by an address separator if it is determined that said destination computer is directly accessible and said destination computer comprises two or more IP addresses.

41. The method of claim 39 wherein said host address comprises a domain name plus a network port number.

42. The method of claim 36 further comprising the steps of:

determining if said destination computer comprises a private Internet protocol (IP) address and a public IP address; and

assigning said public IP address as said host address if it is determined that said destination computer is directly accessible.

43. The method of claim 36 further comprising the steps of:

determining if said destination computer comprises a private Internet protocol (IP) address in a private network and a public IP address; and

assigning said private IP address as said host address wherein said destination computer is located within said private network.

44. The method of claim 31 further comprising the steps of:

determining if said inbound topology is a packet filtering firewall topology; and

assigning a host address of said destination computer as said inbound host ID if it is determined that said inbound topology is a packet filtering firewall topology.

45. The method of claim 44 wherein said host address comprises an Internet protocol (IP) address with a network port number.

46. The method of claim 44 wherein said host address comprises a domain name plus a network port number.

47. The method of claim 31 further comprising the steps of:

determining if said inbound topology is a port forwarding firewall topology; and

assigning a port address of a firewall port connected to said destination computer as said inbound host ID if it is determined that said destination topology is a port forwarding firewall topology.

48. The method of claim 47 wherein said port address comprises an Internet protocol (IP) address with a network port number.

49. The method of claim 47 wherein said port address comprises a domain name plus a network port number.

50. The method of claim 31 further comprising the steps of:

determining if said inbound topology is a proxy topology; and

assigning a host address of said destination computer with a port address of a proxy port connected to said destination computer as said inbound host ID if it is determined that said inbound topology is a proxy topology.

51. The method of claim 50 wherein said host address and said port address are separated by an address separator.

52. The method of claim 51 wherein said address separator further comprises a hypertext transfer protocol (HTTP) proxy separator and a SOCKS proxy separator.

53. The method of claim 50 wherein said host address comprises, in sequential order, an Internet protocol (IP) address with a network port number, an address separator, and a further IP address with a further network port number.

54. The method of claim 31 wherein said data are routed to an external network through the Internet if it is determined that said data are routed outbound.

55. The method of claim 31 further comprising the steps of:

if it is determined that said data are routed outbound,

determining if the Internet is directly accessible; and

directly routing said data to the Internet if it is determined that the Internet is directly accessible.

56. The method of claim 31 further comprising the steps of:

if it is determined that said data are routed outbound,

determining if said outbound topology is a proxy topology; and

assigning a proxy address with a port address of a proxy port connected to the Internet as said outbound host ID if it is determined that said outbound topology is a proxy topology.

57. The method of claim 56 wherein said outbound host ID comprises an Internet protocol (IP) address with a network port number.

58. The method of claim 31 further comprising the step of embedding authentication data in said inbound host ID and said outbound host ID.

59. The method of claim 31 further comprising the steps of:

if it is determined that said data are routed inbound,

determining if said inbound topology is a dynamic host configuration protocol (DHCP) assigned Internet protocol (IP) topology;

determining if an IP address in said inbound host ID has dynamically changed if it is determined that said inbound topology is a DHCP assigned IP topology; and

substituting said IP address in said inbound host ID with said dynamically changed IP address.

60. The method of claim 31 wherein each of said inbound host ID and said outbound host ID further comprises an address separator.

61. A network for routing data thereto and therefrom comprising:

a plurality of computers corresponding to a plurality of network topologies;

means for determining if said data are routed inbound with respect to said network;

an elector electing a destination computer from said computers if it is determined that said data are routed inbound;

means for determining if said data are routed outbound with respect to said network;

means for determining an inbound routing path to said destination computer having an inbound host ID in accordance with an inbound topology out of said network topologies, if it is determined that said data are routed inbound;

means for determining an outbound routing path to said Internet having an outbound host ID in accordance with an outbound topology with respect to the Internet out of said network topologies, if it is determined that said data are routed outbound;

an inbound router routing said data to said destination computer according to said inbound routing path if it is determined that said data are routed inbound; and

an outbound router routing said data to said Internet according to said outbound routing path if it is determined that said data are routed outbound.

62. The network of claim 61 wherein said network topologies further comprise:

a packet filtering firewall topology;

a port forwarding firewall topology;

a proxy topology;

a private Internet protocol (IP) topology;

multiple Internet protocol (IP) topology; and

dynamic host configuration protocol (DHCP) assigned Internet protocol (IP) topology.

63. The network of claim 61 wherein said inbound host ID further comprises:

an Internet protocol (IP) address;

a domain name;

a network port number;

a hypertext transfer protocol (HTTP) proxy separator;

a SOCKS proxy separator; and

a concatenator.

64. The network of claim 61 wherein said outbound host ID further comprises:

an Internet protocol (IP) address;

a domain name;

a network port number;

a hypertext transfer protocol (HTTP) proxy separator;

a SOCKS proxy separator; and

a concatenator.

65. The network of claim 61 wherein said inbound host ID further comprises a sequence of at least one host address corresponding to at least one of said computers.

66. The network of claim 61 further comprising:

means for determining if said destination computer is directly accessible; and

an address assignor assigning a host address of said destination computer as said inbound host ID if it is determined that said destination computer is directly accessible.

67. The network of claim 66 wherein said host address comprises an Internet protocol (IP) address with a network port number.

68. The network of claim 66 wherein said host address comprises a domain name plus a network port number.

69. The network of claim 66 further comprising:

means for determining if said destination computer comprises two or more Internet protocol (IP) addresses; and

wherein said host address comprises said IP addresses separated by an address separator if it is determined that said destination computer is directly accessible and said destination computer comprises two or more IP addresses.

70. The network of claim 66 wherein said host address comprises, in sequential order, an Internet protocol (IP) address with a network port number, an address separator, and a further IP address with a further network port number.

71. The network of claim 69 wherein said host address comprises a domain name plus a network port number.

72. The network of claim 66 further comprising:

means for determining if said destination computer comprises a private Internet protocol (IP) address and a public IP address; and

an address assignor assigning said public IP address as said host address if it is determined that said destination computer is directly accessible.

73. The network of claim 66 further comprising:

means for determining if said destination computer comprises a private Internet protocol (IP) address in a private network and a public IP address; and

an address assignor assigning said private IP address as said host address wherein said destination computer is located within said private network.

74. The network of claim 61 further comprising:

means for determining if said inbound topology is a packet filtering firewall topology; and

an address assignor assigning a host address of said destination computer as said inbound host ID if it is determined that said inbound topology is a packet filtering firewall topology.

75. The network of claim 63 wherein said host address comprises an Internet protocol (IP) address with a network port number.

76. The network of claim 74 wherein said host address comprises a domain name plus a network port number.

77. The network of claim 61 further comprising:

means for determining if said inbound topology is a port forwarding firewall topology; and

an address assignor assigning a port address of a firewall port connected to said destination computer as said inbound host ID if it is determined that said destination topology is a port forwarding firewall topology.

78. The network of claim 77 wherein said port address comprises an Internet protocol (IP) address with a network port number.

79. The network of claim 77 wherein said port address comprises a domain name plus a network port number.

80. The network of claim 61 further comprising

means for determining if said inbound topology is a proxy topology;

and

an address assignor assigning a host address of said destination computer with a port address of a proxy port connected to said destination computer as said inbound host ID if it is determined that said inbound topology is a proxy topology.

81. The network of claim 80 wherein said host address and said port address are separated by an address separator.

82. The network of claim 81 wherein said address separator further comprises a hypertext transfer protocol (HTTP) proxy separator and a SOCKS proxy separator.

83. The network of claim 80 wherein said host address comprises, in sequential order, an Internet protocol (IP) address with a network port number, an address separator, and a further IP address with a further network port number.

84. The network of claim 61 wherein said data are routed to an external network through said Internet if it is determined that said data are routed outbound.

85. The network of claim 61 further comprising:

if it is determined that said data are routed outbound,

means for determining if said Internet is directly accessible; and

an outbound router directly routing said data to said Internet if it is determined that said Internet is directly accessible.

86. The network of claim 61 further comprising:

if it is determined that said data are routed outbound,

means for determining if said outbound topology is a proxy topology; and

an address assignor assigning a proxy address with a port address of a proxy port connected to said Internet as said outbound host ID if it is determined that said outbound topology is a proxy topology.

87. The network of claim 86 wherein said outbound host ID comprises an Internet protocol (IP) address with a network port number.

88. The network of claim 61 wherein authentication data are embedded in said inbound host ID and said outbound host ID.

89. The network of claim 61 further comprising:

if it is determined that said data are routed inbound,

means for determining if said inbound topology is a dynamic host configuration protocol (DHCP) assigned Internet protocol (IP) topology;

means for determining if an IP address in said inbound host ID has dynamically changed if it is determined that said inbound topology is a DHCP assigned IP topology; and

an address assignor substituting said IP address in said inbound host ID with said dynamically changed IP address.

90. The network of claim 61 wherein each of said inbound host ID and said outbound host ID further comprises an address separator.