Systems and methods for network address translation

• US 9,491,136 B2
• Filed: 09/05/2014
• Issued: 11/08/2016
• Est. Priority Date: 10/15/2002
• Status: Expired due to Term

• Current Assignee: Nomadix, Inc. (Nippon Telegraph and Telephone Corporation)
• Original Assignee: Nomadix, Inc. (Nippon Telegraph and Telephone Corporation)
• Inventors: Paunikar, Amit, Singh, Bikramjit
• Primary Examiner(s): JACOBS, LASHONDA T
• Application Number:
  US14/478,429
• Publication Number:
  US 20150215275A1
• Time in Patent Office: 795 Days
• Field of Search: 709/227, 709/238, 709/245, 370/352, 370/401
• US Class Current: 1/1
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 61/106 across networks, e.g. mapping telephone numbers to data network addresses
• CPC Class Codes: H04L 61/25 of the same type
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5046 Resolving address allocation conflicts; Testing of addresses testing when self-assigning an address H04L61/5092

Abstract

An intelligent network address translation system and methods for intelligent network address translation. In one embodiment, a network packet is received from a host device, and a stored record associated with the host device is identified. The stored record includes information relating to connection parameters associated with the host device. Using the stored record, a processor determines whether the network packet should be assigned a dedicated address. If so, then the network packet is transmitted using communication parameters including a dedicated IP address. If the packet should not be assigned a dedicated address, then the packet is transmitted using connection parameters including a default public IP address and a port number.

Claims

1. A method of processing network packets comprising:

receiving a network packet at a network management system, said network packet corresponding to a connection between a first computer having a first destination IP address in a first network and a second computer on a second network that is external to the first network;

determining, using the network management system, whether the connection poses a security risk based at least in part on content associated with the network packet; and

translating the network packet to a second destination IP address different than the first destination IP destination address based at least on said determination that the connection poses a security risk, thereby hiding the first IP address from the second computer.

2. The method of claim 1, wherein said determination that the connection poses a security risk further comprises determining a port associated with the network packet.

3. The method of claim 1, wherein said determination that the connection poses a security risk further comprises determining a protocol associated with the network packet.

4. The method of claim 1, wherein said determination that the connection poses a security risk further comprises determining data relating to the second computer associated with the network packet.

5. The method of claim 1, wherein said determination that the connection poses a security risk further comprises determining data relating to the first computer associated with the network packet.

6. The method of claim 1, further comprising transmitting the network packet to the first computer using the first destination IP address based at least on said determination from the content of the network packet that the connection does not pose a security risk.

7. The method of claim 1, wherein said translating comprises altering address information in the header of the network packet.

8. The method of claim 1, wherein the first destination IP address comprises a public IP address.

9. The method of claim 1, wherein the second destination IP address comprises a private IP address.

10. A network management system comprising:

a network port processor configured for receiving a network packet, said network packet corresponding to a connection between a first computer having a first destination IP address in a first network and a second computer on a second network that is external to the first network;

a storage device configured to store a plurality of IP addresses including a second destination IP address; and

a hardware processor configured for;

determining whether the connection poses a security risk based at least in part on content associated with the network packet; and

translating the network packet to the second destination IP address different than the first destination IP destination address based at least on said determination that the connection poses a security risk, thereby hiding the first IP address from the second computer.

11. The method of claim 10, wherein said determination that the connection poses a security risk further comprises determining a port associated with the network packet.

12. The method of claim 10, wherein said determination that the connection poses a security risk further comprises determining a protocol associated with the network packet.

13. The method of claim 10, wherein said determination that the connection poses a security risk further comprises determining data relating to the second computer associated with the network packet.

14. The method of claim 10, wherein said determination that the connection poses a security risk further comprises determining data relating to the first computer associated with the network packet.

15. The method of claim 10, further comprising transmitting the network packet to the first computer using the first destination IP address based at least on said determination from the content of the network packet that the connection does not pose a security risk.

16. The method of claim 10, wherein said translating comprises altering address information in the header of the network packet.

17. The method of claim 10, wherein the first destination IP address comprises a public IP address.

18. The method of claim 10, wherein the second destination IP address comprises a private IP address.

19. A network management system comprising:

a network port processor configured for receiving a plurality of network packets, said plurality of network packets corresponding to a connection between a first computer having a first destination IP address in a first network and a second computer on a second network that is external to the first network;

a storage device configured to store a plurality of IP addresses including a second destination IP address different from the first destination IP address; and

a hardware processor configured for;

determining based at least on content of one or more of the plurality of network packets whether the connection requires network address translation;

transmitting the plurality of network packets to the second computer using the first destination IP address based at least on said determination that the connection does not require network address translation; and

transmitting the plurality of network packets to the second computer using the second destination IP address based at least on said determination that the connection requires network address translation.