Packet transfer apparatus having network address translation circuit which enables high-speed address translation during packet reception processing

• US 7,197,035 B2
• Filed: 03/22/2002
• Issued: 03/27/2007
• Est. Priority Date: 10/18/2001
• Status: Active Grant

• Current Assignee: Socionext Inc.
• Original Assignee: Fujitsu Limited
• Inventors: Asano, Kazuya
• Primary Examiner(s): Chan; Wing
• Assistant Examiner(s): HALIYUR, VENKATESH N
• Application Number:
  US10/102,796
• Publication Number:
  US 20030076830A1
• Time in Patent Office: 1,831 Days
• Field of Search: 370/392, 370/466, 370/475, 370/401
• US Class Current: 370/392
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/327 in the session layer [OSI layer 5]

Abstract

In a packet transfer apparatus for transferring packets between first and second networks, a translated network address is assigned to a first node in the first network and having a first private network address when the first packet from the first node is transferred to a second node in the second network, and said translated network address is stored in an address management circuit associated with said first and second network addresses. Thereafter, address translation for realizing an NAT function is performed on subsequent packets transferred between the first and second nodes, by a dedicated hardware circuit and reference to the address management circuit, while performing processing for receiving the packets.

Claims

1. A packet transfer apparatus for transferring packets between first and second networks, comprising:

an address assignment circuit which assigns a translated network address to a first node belonging to said first network and having a first network address when said packet transfer apparatus transfers a first packet from the first node to a second node belonging to said second network and having a second network address through a connection;

an address management circuit which stores for said connection said translated network address, associated with said first and second network addresses; and

an address translation circuit which is realized by a dedicated hardware circuit, and translates said first network address contained in a second packet into said translated network address by reference to said address management circuit when said packet transfer apparatus transfers the second packet from said first node to said second node through said connection, and translates said translated network address contained in a third packet into the first network address by reference to said address management circuit when said packet transfer apparatus transfers the third packet from said second node to said first node through said connection,

wherein said address management circuit stores at least one reference information item on at least one connection, and each of the at least one reference information item includes a combination of a network address of a node belonging to the first network, a network address of a node belonging to the second network, and a translated network address,

said address translation circuit reads in parallel said at least one reference information item from said address management circuit, compares a first predetermined portion of a fourth packet with the at least one reference information item in parallel in order to search for one of the at least one reference information item which matches with the first predetermined portion of the fourth packet, and translates a third network address of a third node belonging to said first network, contained in the fourth packet, into the translated network address included in said one of the at least one reference information item when said fourth packet is transferred from said first network to said second network, or translates a translated network address contained in the fourth packet into the network address of the node belonging to the first network, included in the one of the at least one reference information item, when said fourth packet is transferred from said second network to said first network.

2. The packet transfer apparatus according to claim 1, wherein said address translation circuit separately stores a combination of said translated network address and said first and second network addresses for each port number defined in said second network so that an identical translated network address can be assigned to more than one node in said first network.

3. The packet transfer apparatus according to claim 1, further comprising a start-of-communication detection circuit which detects a start of communication through a connection, and

when said start-of-communication detection circuit detects a start of communication through a connection, information on said connection is registered in said address management circuit.

4. The packet transfer apparatus according to claim 1, further comprising a termination-of-communication detection circuit which detects termination of communication through a connection, and

when said termination-of-communication detection circuit detects termination of communication through a connection, information on said connection registered in said address management circuit is deleted.

5. The packet transfer apparatus according to claim 1, wherein said address translation circuit comprises a multiplexer and a counter, and said address translation circuit translates said first network address into said translated network address, and said translated network address into the first network address, in the multiplexer by reference to a count value of the counter.

6. The packet transfer apparatus according to claim 1, further comprising a checksum calculation circuit which calculates at least one checksum of each of said second and third packets after said address translation circuit translates said first network address into said translated network address or said translated network address into the first network address.

7. The packet transfer apparatus according to claim 6, wherein said checksum calculation circuit comprises a multiplexer and a counter, and said checksum calculation circuit inserts said at least one checksum in at least one appropriate portion of each packet by using the multiplexer by reference to a count value of the counter.

8. The packet transfer apparatus according to claim 6, wherein said at least one checksum includes a TCP or UDP checksum, and said checksum calculation circuit calculates the TCP or UDP checksum by using data of each packet before and after translation by said address translation circuit.

9. The packet transfer apparatus according to claim 1, further comprising a software processing unit which realizes an NAT function by software when said address management circuit has no space for storing said translated network address.

10. A communication system comprising:

a first network;

a second network; and

a packet transfer apparatus for transferring packets between first and second networks;

said packet transfer apparatus comprises,

an address assignment circuit which assigns a translated network address to a first node belonging to said first network and having a first network address when said packet transfer apparatus transfers a first packet from the first node to a second node belonging to said second network and having a second network address through a connection,

an address management circuit which stores for said connection said translated network address, associated with said first and second network addresses, and

an address translation circuit which is realized by a dedicated hardware circuit, and translates said first network address contained in a second packet into said translated network address by reference to said address management circuit when said packet transfer apparatus transfers the second packet from said first node to said second node through said connection, and translates said translated network address contained in a third packet into the first network address by reference to said address management circuit when said packet transfer apparatus transfers the third packet from said second node to said first node through said connection,

wherein said address management circuit stores at least one reference information item on at least one connection, and each of the at least one reference information item includes a combination of a network address of a node belonging to the first network, a network address of a node belonging to the second network, and a translated network address,

said address translation circuit reads in parallel said at least one reference information item from said address management circuit, compares a first predetermined portion of a fourth packet with the at least one reference information item in parallel in order to search for one of the at least one reference information item which matches with the first predetermined portion of the fourth packet, and translates a third network address of a third node belonging to said first network, contained in the fourth packet, into the translated network address included in said one of the at least one reference information item when said fourth packet is transferred from said first network to said second network, or translates a translated network address contained in the fourth packet into the network address of the node belonging to the first network, included in the one of the at least one reference information item, when said fourth packet is transferred from said second network to said first network.

11. A semiconductor device for use in a packet transfer apparatus which transfers packets between first and second networks, comprising:

an address assignment circuit which assigns a translated network address to a first node belonging to said first network and having a first network address when said packet transfer apparatus transfers a first packet from the first node to a second node belonging to said second network and having a second network address through a connection;

an address management circuit which stores for said connection said translated network address, associated with said first and second network addresses; and

an address translation circuit which is realized by a dedicated hardware circuit, and translates said first network address contained in a second packet into said translated network address by reference to said address management circuit when said packet transfer apparatus transfers the second packet from said first node to said second node through said connection, and translates said translated network address contained in a third packet into the first network address by reference to said address management circuit when said packet transfer apparatus transfers the third packet from said second node to said first node through said connection,

wherein said address management circuit stores at least one reference information item on at least one connection, and each of the at least one reference information item includes a combination of a network address of a node belonging to the first network, a network address of a node belonging to the second network, and a translated network address,

said address translation circuit reads in parallel said at least one reference information item from said address management circuit, compares a first predetermined portion of a fourth packet with the at least one reference information item in parallel in order to search for one of the at least one reference information item which matches with the first predetermined portion of the fourth packet, and translates a third network address of a third node belonging to said first network, contained in the fourth packet, into the translated network address included in said one of the at least one reference information item when said fourth packet is transferred from said first network to said second network, or translates a translated network address contained in the fourth packet into the network address of the node belonging to the first network, included in the one of the at least one reference information item, when said fourth packet is transferred from said second network to said first network.

12. A method for transferring packets between a first network including first nodes and a second network including second nodes, where first network addresses usable in the first network are assigned to the first nodes, and second network addresses usable in the second network are assigned to the second nodes, said method comprising the steps of:

(a) assigning to one or more of the first nodes one ore more translated network addresses usable in the second network, when one or more packets are transferred from the one or more of the first nodes and to one or more of the second nodes;

(b) storing, in an address management circuit, said one or more translated network addresses respectively associated with one or more of the first network addresses assigned to said one or more of the first nodes and one or more of the second network addresses assigned to said one or more of the second nodes so as to form one or more reference information sets each including one of the one or more translated network addresses, one of the one or more of the first network addresses, and one of the one or more of the second network addresses which are associated with each other;

(c) performing a first operation by a dedicated hardware circuit when a first packet containing a first one of said first network addresses and a first one of said second network addresses is transferred from a first one of said first nodes to a first one of said second nodes, where the first operation includes the substeps of,

(c1) reading in parallel said one or more reference information sets from said address management circuit,

(c2) comparing a predetermined portion of said first packet with said one or more reference information sets in parallel in order to search for a first one of the one or more reference information sets which matches with the predetermined portion of the first packet, and

(c3) translating said first one of said first network addresses into a first one of said one or more translated network addresses included in said first one of the one or more reference information sets; and

(d) performing a second operation by a dedicated hardware circuit when a second packet containing a second one of said second network addresses and a translated network address is transferred from a second one of said second nodes to a second one of said first nodes, where the second operation includes the subsets of,

(d1) reading in parallel said one or more reference information sets from said address management circuit,

(d2) comparing a predetermined portion of said second packet with said one or more reference information sets in parallel in order to search for a second one of the one or more reference information sets which matches with the predetermined portion of the second packet; and

(d3) translating said translated network address contained in said second packet into a second one of said one or more first network addresses included in said second one of the one or more reference information sets.