Network abstraction and isolation layer rules-based federation and masquerading

• US 7,643,484 B2
• Filed: 02/09/2005
• Issued: 01/05/2010
• Est. Priority Date: 09/26/2003
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Surgient, Inc. (Quest Software, Inc.)
• Inventors: Willman, Charles A., McCrory, Dave D., Johnson, Scott C., Hirschfeld, Robert A.
• Primary Examiner(s): Ryman; Daniel J.
• Assistant Examiner(s): Tran; Thinh D
• Application Number:
  US11/053,770
• Publication Number:
  US 20050147120A1
• Time in Patent Office: 1,791 Days
• Field of Search: 370/466, 370/389, 370/392, 370/397, 370/399, 370/395.54, 709223-229, 709/238
• US Class Current: 370/392
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2521 Translation architectures other than single NAT servers

Abstract

A computer system of a federation coupled to a network including a server having an internal address associated with a first subnet and a network abstraction and isolation layer rules-based federation and masquerading (NAIL RBFM) interface that interfaces the server with the network. The NAIL RBFM interface transforms the internal address between the first subnet and a second subnet for intra-federation communications. The NAIL RBFM interface performs transform and inverse transform operations to convert between internal and external addresses of intra-federation network traffic. The operations may be performed on source and destination addresses, and may be configured in any of several manners, such as modifying at least one bit of an address, replacing at least one octet of an IP address, substituting a prefix of an address, replacing an entire address, etc.

Claims

1. A network, comprising:

a private network link;

a first federation, coupled to said private network link, being associated with a first private subnet and including a first plurality of servers, each server having a corresponding one of a plurality of local addresses;

a second federation, coupled to said private network link, being associated with a second private subnet and including a second plurality of servers, each server of said second plurality of servers being a copy of a corresponding one of said first plurality of servers and including a corresponding one of said plurality of local addresses;

a plurality of first network abstraction and isolation layer (NAIL) rules-based federation and masquerading (RBFM) interfaces, each interfacing a corresponding one of said first plurality of servers to said private network link, and each performing an address transformation to associate said corresponding server into said first private subnet; and

a plurality of second NAIL RBFM interfaces, each interfacing a corresponding one of said second plurality of servers to said private network link, and each performing an address transformation to associate said corresponding server into said second private subnet.

2. The network of claim 1, wherein each NAIL RBFM interface is operative to identify outgoing traffic to another server within a common one of said first and second federations, to transform source and destination addresses of said outgoing traffic, and to pass said transformed traffic onto said private network link.

3. The network of claim 1, wherein each NAIL RBFM interface is operative to identify incoming traffic on said private network link from another server within a common one of said first and second federations, to transform source and destination addresses of said incoming traffic, and to pass transformed traffic to said corresponding server.

4. The network of claim 1, wherein said address transformation comprises modifying at least one bit of an address.

5. The network of claim 1, wherein said address transformation comprises a lookup transformation.

6. The network of claim 1, wherein said address transformation comprises substituting a prefix of an internet protocol (IP) address.

7. The network of claim 1, wherein said address transformation comprises replacing an address.

8. The network of claim 1, wherein each of said first and second NAIL RBFM interfaces selectively blocks communications between said first and second federations.