Distributed and scalable network address translation

• US 8,902,743 B2
• Filed: 06/28/2010
• Issued: 12/02/2014
• Est. Priority Date: 06/28/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Greenberg, Albert, Maltz, David A., Patel, Parveen K., Yuan, Lihua
• Primary Examiner(s): Banks Harold, Marsha D
• Assistant Examiner(s): LUO, ANTHONY L
• Application Number:
  US12/824,989
• Publication Number:
  US 20110317554A1
• Time in Patent Office: 1,618 Days
• Field of Search: 370/230, 370/392, 370/231, 370/235, 370/395.1, 370/395.5, 370/395.52, 370/401, 370465-467, 370/349, 370/471, 790/203, 790/230, 790/238, 790/249, 711/203, 711/206, 711/216, 726/3, 726 11- 15, 709/203, 709/218, 709/238, 709/242, 709/245, 709/249
• US Class Current: 370/230
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2517 using port numbers
• CPC Class Codes: H04L 61/2525 Translation at a client

Abstract

A method of enabling an electronic privately addressable source to be publicly addressable starts at a receiver where an electronic message is received. It is communicated from a sender with a private address outside a subnet of the receiver through a translator. The translator retrieves a lease to at least one of a public address or a port from a lease manager, translates the private address and the private port into a public address and a public port and communicates identifying data such as the public address and the public port to the receiver. If a response is communicated to the private sender, the response may be communicated to the private sender through the network. The public address and the public port on the message may be translated to the private address and the port of the private sender and the private address and the private port may be used to properly route the response to the private sender.

Claims

1. A method of enabling an electronic privately addressable source to be publicly addressable comprising:

receiving packets from a tenant virtual machine at a policy routing component;

determining if the packets are destined for Internet;

determining if the packets contain a private address as a source;

if the packets are destined for the Internet and contain the private address as the source, communicating the packets through a network address translation device wherein the network address translation device is identified by a first virtual IP address;

encapsulating the packets with the first virtual IP address as the destination address;

communicating the packets to a first server or load balancer that handles packets addressed to the first virtual IP address, at the first server or load balancer, receiving the packets;

determining if the packets are destined for the first virtual IP address of the network address translation device;

if the packets are destined for the first virtual IP address;

selecting the network address translation device,

communicating an inner packet to the network address translation device, at the network translation device,

using the source address and the destination address and the source port and the destination port to select a public address and a public port,

translating the source address and source port to those selected at the network address translation device, and

communicating the packet out on the Internet;

if the packets are destined for the public IP address chosen above;

selecting the network translation device,

communicating the packet to the network address translation device,

at the network address translation device, using the source address and destination address and source port and destination port to select a private address and private port,

translating the destination address and destination port to those selected at the network address translation device, and

communicating the packet to the private address sender.

2. The method of claim 1, wherein using the source and destination address and source and destination port to select a public address and port comprises applying a hash function to the destination address and destination port.

3. The method of claim 1, wherein the using the source and destination address and source and destination port to select a public address and port comprises selecting an unused public address and public port from a set of available public addresses and public ports and recording state that this combination of public address and public port correspond to the source private address and source private port.

4. The method of claim 1, wherein the tenant virtual machine and the network address translation device are on separate computing machines.