361 results about "Network address translation" patented technology

A method, system, and computer-readable medium are disclosed for: receiving traffic from a client device, wherein the client device is physically located in a particular region, wherein the traffic is internet protocol (IP) traffic, and wherein the traffic has a destination associated therewith; augmenting the traffic with metadata, wherein the metadata is indicative of the particular region; and transmitting the augmented traffic to an egress gateway, wherein the egress gateway is configured to perform source network address translation (NAT) on the traffic by setting a source address associated with the traffic to an IP address that is associated with the particular region.

Techniques are disclosed for sending Protocol Independent Multicast (PIM) messages across a Layer-3 (L3) transport network. In one example, a first network device receives, via an L2 network from a multicast sender device, a multicast packet for a multicast group associated with a multicast service. The first network device generates, based on the multicast packet, a unicast L3 packet comprising a PIM register request configured to register the first network device as a multicast source for the multicast group. A header of the unicast L3 packet specifies a source address comprising a network address translation (NAT) to an address of a virtual loopback interface of a second network device. The virtual loopback interface is associated with a PIM service between the first and second network devices for the multicast service. The first network device forwards the unicast L3 packet across an L3 transport network to the second network device.

The disclosure provides an approach for processing inter-network communications. Embodiments include configuring, by a management component of a data center, a first virtual private network (VPN) session between a first endpoint outside of the data center and a first gateway of the data center. Embodiments include configuring, by the management component, a second VPN session between a second endpoint outside of the data center and a second gateway of the data center. Embodiments include programming, by the management component, one or more network address translation (NAT) tables of the data center such that, for the first VPN session and the second VPN session, a single public network address of the data center is exposed to the first endpoint and the second endpoint.

The invention discloses a connection establishment method and device, a storage medium and electronic equipment. The method comprises the following steps: receiving a data request message sent by terminal equipment, establishing relay connection between the terminal equipment and target equipment in response to the data request message, and obtaining network address translation types corresponding to the terminal equipment and the target equipment, and based on whether the network address translation types corresponding to the terminal device and the target device are symmetric, point-to-point connection between the terminal device and the target device is established through address exchange, and relay connection is interrupted. According to the method and the device, the technical problems that the influence of resource consumption on code stream transmission in the NAT penetration process is too large, and the equipment resource overhead is relatively high are solved.

A process can include determining a plurality of Network Address Translation (NAT) routes associated with respective edge routers included in a same virtual private network (VPN) for communicating with a software-defined wide area network (SDWAN). A process can include identifying a first subset of the plurality of NAT routes as mapped to a first public NAT address included in a NAT pool associated with the VPN. A process can include tagging each NAT route of the first subset with a tag value indicative of a preferred router for receiving return traffic of the respective NAT route. A process can include routing traffic on a respective NAT route of the plurality of NAT routes based on applying, at an SDWAN controller, a corresponding control policy matching the tag value of the respective NAT route.

The invention provides an attack link restoration method and system based on a large language model and a traditional AI model, and effectively solves the problem that attack link restoration is incomplete and inaccurate when a current attack link restoration scheme faces complex factors such as network address translation. The method comprises the following steps: acquiring an attack semantic knowledge base containing an attack context knowledge matrix, wherein the knowledge base is generated by processing an attack framework, a security log and a traceability report by a generative large model; obtaining an asset access relation graph generated by analyzing the metadata of the target network infrastructure by the large model and reasoning in combination with an attack semantic knowledge base; regularly acquiring security alarm logs in a first time window and scoring, and acquiring context logs if the security alarm logs exceed a threshold value; based on a time sequence diagram attention network model, determining the confidence degree that edges in an asset access relation graph corresponding to logs containing access pairs in the alarm logs and the context logs belong to attack links; and performing sub-graph extraction in the atlas to obtain candidate sub-graphs, and then determining a target attack link.

The invention relates to an extranet access method and device, computer equipment, a readable storage medium and a product, and relates to the technical field of communication. The method comprises the following steps: when receiving extranet access requests sent by at least one piece of intranet equipment, acquiring priorities of the extranet access requests respectively transmitted to at least two gateway servers; the priority is determined based on the connection attribute between the gateway server and the intranet equipment; sending the extranet access request to a first gateway server with the highest priority, and performing network address translation; when the first gateway server is abnormal in the network address translation process, an external network access request is sent to a second gateway server with the highest priority in the gateway servers except the first gateway server, and network address translation is carried out; and when the second gateway server converts the intranet address of the intranet equipment into the public network address of the extranet indicated by the extranet access request, obtaining an extranet access result. By adopting the method, the external network access efficiency can be improved.

The invention discloses an ALG (Application Layer Gateway) processing method and device, electronic equipment and a storage medium. The method comprises the steps that a control channel session table corresponding to a first message is detected, the control channel session table is used for recording a message load content length change difference value before and after a preset type of message is subjected to target conversion, and the preset type of message is a multi-channel protocol negotiation message based on a transmission control protocol; the target conversion is ALG application layer message information analysis and address conversion performed when passing through an NAT (Network Address Translation) router; determining a second message according to the type of the first message and a control channel session table corresponding to the first message, wherein the second message is a subsequent message which correspondingly needs to be forwarded after the first message; and carrying out forwarding processing on the second message. According to the technical scheme, the problem that the serial number operation consumption of the subsequent message after TCP message conversion in the NAT ALG scene is large is solved.

The disclosure relates to a 5G or 6G communication system for supporting a higher data transmission rate. Disclosed is a method of operation by a first network entity in a wireless communication system. The method includes transmitting a first request message for a list of services which can be provided to the first network entity and type information of network address translation (NAT) to a second network entity having an NAT function, receiving a first response message including the list of the services which can be provided to the first network entity and the type information of the NAT from the second network entity, transmitting an operation indication message related to a timer of IP address mapping information managed by the NAT to the second network entity, and receiving a response message to the operation indication message from the second network entity.

Anycast addressing is utilized to support the connection of multiple application connectors fronting an application(s) to a network element and anycast routing of network traffic destined for the application(s). When an application is indicated for onboarding in a tenant's network fabric, a network controller allocates virtual and anycast addresses to the application. Allocation of anycast addresses is per domain name and port / protocol combination. Upon determining that the application is available, the application connector(s) advertises reachability of the application via the anycast address. The network controller orchestrates configuration of a domain name system entry that resolves the application name to its virtual Internet Protocol (IP) address and destination network address translation rules that translate the virtual IP address to the anycast address and the anycast address to the application's private IP address. Application network traffic can thus be forwarded to the application via any application connector that advertised the anycast address.

In communication with components of a cloud platform, namely a software-defined network constructed to overlay at least one public cloud network, a controller features a virtual processor and a data store. The data store includes network address translation (NAT) processing logic configured to determine whether a control plane message from tenant resources is associated with a network address overlapping condition, which represents a first network address included in the control plane message overlaps a network address range relied upon by either (a) at least one of the components of the cloud platform or (b) a component associated with other tenant resources. The NAT processing logic is further configured to alter routing data stores that maintain routing information for each of the components of the cloud platform to substitute the first network address with a first virtual network address for subsequent data message routing.

The invention discloses a network address translation gateway implementation method and device based on a flow control transmission protocol, equipment and a medium, and relates to the technical field of computer networks and data transmission, and the method comprises the following steps: after receiving a network message, identifying the network message by using a P4 technology through a message identification end, determining whether the network message is a target message of a flow control transmission protocol; if the network message is determined to be a target message, determining connection information of the target message by using a P4 technology through a message processing end, allocating a unique internal address and a port number for connection of the target message according to the connection information, and packaging the target message so as to send the packaged message to a gateway conversion end; and converting the internal address and the port number of the packaged message through a gateway conversion end so as to forward the converted message to a target address. Therefore, smooth traversal and forwarding of the SCTP message can be realized on the premise of not modifying the existing NAT gateway equipment or introducing new equipment.

Techniques for creating an optimal and secure data plane based on network constraints. Techniques may include establishing an initial networking connection (118) for a data flow between a client device (102) and a resource (104) such that data plane traffic of the data flow is routed through a relay node (122) disposed between the client device and the resource; determining an alternative networking connection (126) bypassing the relay node for the data stream using a session traversal utility (STUN) server (124) of the network address translator; and causing the data plane traffic of the data stream to be routed through the alternate networking connection based at least in part on determining that the alternate networking connection is a better path for the data plane traffic than the initial networking connection.

The present invention relates to the field of computer networks, and provides a generalized network intelligent optimization method and a generalized network intelligent optimization terminal. The generalized network intelligent optimization method comprises: acquiring a domain name access request and a web request initiated by a user network device; on the basis of a target domain name, a custom upstream host, and a pre-established DNS set, determining an optimal DNS server, and analyzing the target domain name by means of the optimal DNS server to obtain a target IP address; acquiring performance parameters of each network address translation (NAT) server in a NAT server cluster; on the basis of the performance parameters of each NAT server, determining an optimal NAT server, and, by means of the optimal NAT server and on the basis of the target IP address, responding to the web request by using full-cone NAT technology; and controlling the transmission rate of the user network device by using a BBR algorithm. According to the present invention, domain name resolution speed is increased, and network transmission efficiency is improved.

The present application discloses a method, system, and computer system for providing intelligent DNS load balancing using a combination of a dynamic DNAT pool and application providing in a connector-based solution for private application access. The method includes: (a) performing a DNS re-resolution for resolving an application Fully Qualified Domain Name (FQDN) to obtain a plurality of IP addresses for a plurality of application servers, (b) performing periodic application server probing, and (c) dynamically updating a destination network address translation (DNAT) to provide DNS load balancing for application traffic. The DNAT is updated based at least in part on one or more of the DNS re-resolution and the application server probing.

A method for configuring a network address translation NAT gateway based on a public cloud service including: a cloud management platform obtains NAT gateway creation information that is input by a tenant; The cloud management platform creates the NAT gateway in the first VPC based on the NAT gateway creation information; The cloud management platform obtains configuration information that is input by the tenant and applied to the NAT gateway; The cloud management platform sets, based on the identifier of the second VPC, the NAT gateway to be connected to the second VPC, and sends the first NAT rule to the NAT gateway, where the first NAT rule is used to indicate the NAT gateway to: bind a first network segment in the first VPC to a first elastic IP address EIP; and bind the first network segment in the first VPC to a first transit private IP address.

The invention provides an address conversion method, device and system, and belongs to the technical field of networks. According to the scheme provided by the invention, based on the fact that the first message of the first user is the message of the target application, the source address of the first message is converted from the first private network address to the target address and then is sent to the first forwarding device. Moreover, the source tracing information of the first user not only comprises a target address corresponding to the first private network address, but also comprises a first public network address and a first port range corresponding to the first private network address. In the tracing information of the first user, the first private network address corresponds to two different addresses, so that the source address of the message can be converted into different network addresses from the first private network address based on the type of the application to which the message belongs when network address conversion is performed on the message of the first user; therefore, the flexibility of address translation is effectively improved.

Provided are an adaptive network address translation (NAT) method and apparatus for VoIP. The NAT method includes: obtaining a first public network address of a STUN server, and connecting to the STUN server through a first port; obtaining a second public network address and a second port based on a connection status with the STUN server, where the second public network address and the second port are generated by the STUN server or a registration server; and initiating registration with the registration server based on the second public network address and the second port, whereby a public network address and a port of a phone in the registration server are respectively updated to the second public network address and the second port, and then a call center establishes a connection to the phone through the second public network address and the second port.

Two electronic devices attempt to communicate and exchange Internet Protocol (IP) packets over a cellular communication network, and at least one of the two devices is behind a symmetric Network Address Translation (NAT) service. At least one of the two devices executes a Session Traversal Utilities for NAT (STUN) protocol, which provides to that device a pair of external IP address and port of that device; which that device then informs to a Message Broker Unit that is accessible to both devices via the public Internet. The Message Broker Unit provides the external IP address and port of that device, to the other device; which then connects to a Virtual Private Network (VPN) server and sends to the first device one or more User Datagram Protocol (UDP) packets that penetrate or puncture the NAT service in an application-agnostic manner.

The invention provides a network address translation behavior detection method and device, and relates to the technical field of network security. The network address translation behavior detection method comprises: according to a first response message, determining a dynamic fingerprint of a terminal device, the first response message being obtained by the terminal device responding to a first detection message; the reference dynamic fingerprint is matched with the dynamic fingerprint of the terminal equipment to obtain a first detection result, the reference dynamic fingerprint is the dynamic fingerprint of the reference terminal equipment which is legally accessed, and the first detection result represents whether a network address translation behavior exists or not. According to the invention, whether the network address translation behavior occurs can be accurately and efficiently detected.

Devices, systems, methods, and processes for flow entropy management using network address translation (NAT) scheme are described herein. Typically, due to fewer flows and high bandwidth demands in backend data center networks, hash distribution algorithms may exhibit bias, leading to congestion on certain network paths while others remain underutilized, a phenomenon known as low flow entropy. To address the low flow entropy problem, a network interface controller (NIC) decomposes a traffic flow into multiple flowlets and applies a NAT operation on each flowlet. In the NAT operation, an actual source port value of a flowlet is replaced with a unique unused source port value to make the flowlet look like a different traffic flow to a switch. Thus, the switch processes each flowlet as a different traffic flow and uses load balancing schemes to distribute the flowlets across various network paths. Thus, improving the flow entropy of the network.

Operations include: identifying a first dataflow associated with a particular communications protocol; evaluating the first dataflow to determine that the first dataflow meets a hardware-based Network Address Translation (NAT) usage criteria; responsive to determining that the first dataflow meets the hardware-based NAT usage criteria, executing a set of hardware-based NAT operations to process a first set of packets corresponding to the first dataflow; identifying a second dataflow associated with the same particular communications protocol; evaluating the second dataflow to determine that the second dataflow does not meet the hardware-based NAT usage criteria; and responsive to determining that the second dataflow does not meet the hardware-based NAT usage criteria, executing a first set of software-based NAT operations to process a second set of packets corresponding to the second dataflow.

A user equipment device (UE) initiates the creation of a dedicated bearer between a local gateway (L-GW) and a packet data network gateway (P-GW). A GTP tunnel is established to connect the L-GW, a serving gateway (S-GW), and the P-GW. The L-GW and P-GW apply Network Address Translation (NAT) and / or Traffic Flow Template (TFT) to route the traffic between the LS and a Service Capacity Server / Application Server (SCS / AS). Alternatively, an SCS-initiates the bearer creation, and an SCEF manages the creation of the GTP tunnel connection. The L-GW may be co-located with an Evolved UTRAN Node B (eNB) and / or connected to multiple eNBs which are not co-located with the L-GW.

An information processing method, apparatus, device and readable storage medium are provided, which relates to the field of communication technology. The method includes: obtaining network address translation information from a first device or function; performing a processing according to the network address translation information; where the network address translation information includes one or more of the following: a correspondence between a public network address and a private network address; a public network address; a private network address; a port number of public network address; a port number of private network address.

The disclosure provides an approach for gateway optimization. Embodiments include receiving, at a first gateway associated with a first tenant within a data center, a packet directed to a first public network address of an endpoint associated with a second tenant within the data center. Embodiments include performing, by the first gateway, network address translation (NAT) to translate the first public network address to a private network address of the endpoint. Embodiments include forwarding, by the first gateway, the packet to an edge gateway of the data center. Embodiments include forwarding, by the edge gateway, the packet to a second gateway associated with the second tenant within the data center without sending the packet to a public interface of the edge gateway. Embodiments include forwarding, by the second gateway, the packet to the endpoint.

The invention relates to the technical field of computer network communication technology, and discloses an automatic multi-time NAT (Network Address Translation) implementation method and system based on network data packet circulation. The automatic multi-time NAT implementation method is applied to a network address translation device, and specifically comprises the following steps: S101, obtaining a request destination and a route of a source node, and finally reaching a destination address according to the request destination and the route through one or more times of forwarding in a cloud topology so as to generate an access line path topology; s102, searching all paths from a source node to a destination node by using depth-first, and simulating whether a route from each path to the destination node is reachable or not for a data packet from the source node; according to the method, a path prediction technology based on a depth-first search (DFS) algorithm is introduced, all network equipment through which a network data packet passes from a source node to a destination node is automatically analyzed and calculated, the circulation conditions of the data packet on different paths are accurately simulated, and NAT strategy configuration requirements are automatically identified.

The invention discloses a remote intelligent control system for multimedia equipment and an implementation method thereof, and belongs to the technical field of network communication, and the implementation method comprises the following steps: acquiring network environment information of the multimedia equipment, judging an NAT (Network Address Translation) type, and generating a mixed penetration protocol selection rule to determine an initial penetration protocol; the method comprises the following steps: acquiring port allocation characteristics of NAT equipment based on an initial penetration protocol, generating port prediction parameters through linear increment prediction and LSTM neural network training, and formulating a port prediction and keep-alive strategy; executing UDP (User Datagram Protocol) penetration according to a keep-alive strategy, starting a TCP (Transmission Control Protocol) standby mechanism when the UDP penetration fails, and generating a penetration scheme by combining HTTP tunnel encapsulation and firewall inbound rule configuration; equipment identification information collection, signaling interaction, penetration attempt and connection establishment are completed based on a penetration scheme, successful feedback is generated after verification is passed, and remote control is realized; according to the invention, the stability and efficiency of remote connection of the multimedia equipment in a complex network environment are improved.

The invention discloses a domain name resolution method and device, equipment, a storage medium and a product. The method is applied to a CoreDNS server in a cluster, and comprises the following steps: receiving a target domain name resolution request message which is sent by a target host network Pod and is processed by a first network address translation rule and a second network address translation rule respectively; determining a corresponding target application IP address based on the target domain name resolution request message; and sending the target application IP address to the target host network Pod, so that the target host network Pod establishes connection with the target application based on the target application IP address. According to the scheme, the host network Pod can immediately use the domain name service function of the CoreDNS without any change on the host network Pod, and meanwhile, the method is friendly to an actual production environment and has no influence on services.

The embodiment of the invention discloses a data processing method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a network address translation type, a power consumption level and network topology information of network equipment when a registration request of the network equipment is received, and carrying out the registration of the network equipment according to the network address translation type, the power consumption level and the network topology information, generating equipment associated information; when a connection request of a client is received, analyzing a target device identifier in the connection request, and determining a target network device corresponding to the target device identifier and pre-stored device association information; and determining an adaptive point-to-point transmission strategy according to the equipment association information, and establishing point-to-point direct connection between the target network equipment and the client based on the determined point-to-point transmission strategy and an interactive enhanced session description protocol between the target network equipment and the client, and the scheme can provide a hole digging success rate.

Route tables may be associated with ingress traffic for logically isolated networks. A routing device at the edge of a logically isolated network may receive a route to include in a route table that is associated with ingress traffic to the logically isolated network, where the ingress traffic is destined for a block of public or private IP addresses. The route instructs the edge routing device to forward such ingress traffic to a network interface of a network appliance hosted in the logically isolated network. Network packets received at the edge routing device may have a destination of one or more public or private IP addresses in the block of public / private IP addresses. The edge routing device may identify the route in the route table that forwards the ingress network traffic destined for the block of public or private IP addresses to the network interface for the network appliance.