244 results about "Network address translation" patented technology

The disclosure provides an approach for processing inter-network communications. Embodiments include configuring, by a management component of a data center, a first virtual private network (VPN) session between a first endpoint outside of the data center and a first gateway of the data center. Embodiments include configuring, by the management component, a second VPN session between a second endpoint outside of the data center and a second gateway of the data center. Embodiments include programming, by the management component, one or more network address translation (NAT) tables of the data center such that, for the first VPN session and the second VPN session, a single public network address of the data center is exposed to the first endpoint and the second endpoint.

The invention provides an attack link restoration method and system based on a large language model and a traditional AI model, and effectively solves the problem that attack link restoration is incomplete and inaccurate when a current attack link restoration scheme faces complex factors such as network address translation. The method comprises the following steps: acquiring an attack semantic knowledge base containing an attack context knowledge matrix, wherein the knowledge base is generated by processing an attack framework, a security log and a traceability report by a generative large model; obtaining an asset access relation graph generated by analyzing the metadata of the target network infrastructure by the large model and reasoning in combination with an attack semantic knowledge base; regularly acquiring security alarm logs in a first time window and scoring, and acquiring context logs if the security alarm logs exceed a threshold value; based on a time sequence diagram attention network model, determining the confidence degree that edges in an asset access relation graph corresponding to logs containing access pairs in the alarm logs and the context logs belong to attack links; and performing sub-graph extraction in the atlas to obtain candidate sub-graphs, and then determining a target attack link.

The invention discloses an ALG (Application Layer Gateway) processing method and device, electronic equipment and a storage medium. The method comprises the steps that a control channel session table corresponding to a first message is detected, the control channel session table is used for recording a message load content length change difference value before and after a preset type of message is subjected to target conversion, and the preset type of message is a multi-channel protocol negotiation message based on a transmission control protocol; the target conversion is ALG application layer message information analysis and address conversion performed when passing through an NAT (Network Address Translation) router; determining a second message according to the type of the first message and a control channel session table corresponding to the first message, wherein the second message is a subsequent message which correspondingly needs to be forwarded after the first message; and carrying out forwarding processing on the second message. According to the technical scheme, the problem that the serial number operation consumption of the subsequent message after TCP message conversion in the NAT ALG scene is large is solved.

Anycast addressing is utilized to support the connection of multiple application connectors fronting an application(s) to a network element and anycast routing of network traffic destined for the application(s). When an application is indicated for onboarding in a tenant's network fabric, a network controller allocates virtual and anycast addresses to the application. Allocation of anycast addresses is per domain name and port / protocol combination. Upon determining that the application is available, the application connector(s) advertises reachability of the application via the anycast address. The network controller orchestrates configuration of a domain name system entry that resolves the application name to its virtual Internet Protocol (IP) address and destination network address translation rules that translate the virtual IP address to the anycast address and the anycast address to the application's private IP address. Application network traffic can thus be forwarded to the application via any application connector that advertised the anycast address.

In communication with components of a cloud platform, namely a software-defined network constructed to overlay at least one public cloud network, a controller features a virtual processor and a data store. The data store includes network address translation (NAT) processing logic configured to determine whether a control plane message from tenant resources is associated with a network address overlapping condition, which represents a first network address included in the control plane message overlaps a network address range relied upon by either (a) at least one of the components of the cloud platform or (b) a component associated with other tenant resources. The NAT processing logic is further configured to alter routing data stores that maintain routing information for each of the components of the cloud platform to substitute the first network address with a first virtual network address for subsequent data message routing.

The invention discloses a network address translation gateway implementation method and device based on a flow control transmission protocol, equipment and a medium, and relates to the technical field of computer networks and data transmission, and the method comprises the following steps: after receiving a network message, identifying the network message by using a P4 technology through a message identification end, determining whether the network message is a target message of a flow control transmission protocol; if the network message is determined to be a target message, determining connection information of the target message by using a P4 technology through a message processing end, allocating a unique internal address and a port number for connection of the target message according to the connection information, and packaging the target message so as to send the packaged message to a gateway conversion end; and converting the internal address and the port number of the packaged message through a gateway conversion end so as to forward the converted message to a target address. Therefore, smooth traversal and forwarding of the SCTP message can be realized on the premise of not modifying the existing NAT gateway equipment or introducing new equipment.

The present invention relates to the field of computer networks, and provides a generalized network intelligent optimization method and a generalized network intelligent optimization terminal. The generalized network intelligent optimization method comprises: acquiring a domain name access request and a web request initiated by a user network device; on the basis of a target domain name, a custom upstream host, and a pre-established DNS set, determining an optimal DNS server, and analyzing the target domain name by means of the optimal DNS server to obtain a target IP address; acquiring performance parameters of each network address translation (NAT) server in a NAT server cluster; on the basis of the performance parameters of each NAT server, determining an optimal NAT server, and, by means of the optimal NAT server and on the basis of the target IP address, responding to the web request by using full-cone NAT technology; and controlling the transmission rate of the user network device by using a BBR algorithm. According to the present invention, domain name resolution speed is increased, and network transmission efficiency is improved.

The present application discloses a method, system, and computer system for providing intelligent DNS load balancing using a combination of a dynamic DNAT pool and application providing in a connector-based solution for private application access. The method includes: (a) performing a DNS re-resolution for resolving an application Fully Qualified Domain Name (FQDN) to obtain a plurality of IP addresses for a plurality of application servers, (b) performing periodic application server probing, and (c) dynamically updating a destination network address translation (DNAT) to provide DNS load balancing for application traffic. The DNAT is updated based at least in part on one or more of the DNS re-resolution and the application server probing.

A method for configuring a network address translation NAT gateway based on a public cloud service including: a cloud management platform obtains NAT gateway creation information that is input by a tenant; The cloud management platform creates the NAT gateway in the first VPC based on the NAT gateway creation information; The cloud management platform obtains configuration information that is input by the tenant and applied to the NAT gateway; The cloud management platform sets, based on the identifier of the second VPC, the NAT gateway to be connected to the second VPC, and sends the first NAT rule to the NAT gateway, where the first NAT rule is used to indicate the NAT gateway to: bind a first network segment in the first VPC to a first elastic IP address EIP; and bind the first network segment in the first VPC to a first transit private IP address.

The invention provides an address conversion method, device and system, and belongs to the technical field of networks. According to the scheme provided by the invention, based on the fact that the first message of the first user is the message of the target application, the source address of the first message is converted from the first private network address to the target address and then is sent to the first forwarding device. Moreover, the source tracing information of the first user not only comprises a target address corresponding to the first private network address, but also comprises a first public network address and a first port range corresponding to the first private network address. In the tracing information of the first user, the first private network address corresponds to two different addresses, so that the source address of the message can be converted into different network addresses from the first private network address based on the type of the application to which the message belongs when network address conversion is performed on the message of the first user; therefore, the flexibility of address translation is effectively improved.

Provided are an adaptive network address translation (NAT) method and apparatus for VoIP. The NAT method includes: obtaining a first public network address of a STUN server, and connecting to the STUN server through a first port; obtaining a second public network address and a second port based on a connection status with the STUN server, where the second public network address and the second port are generated by the STUN server or a registration server; and initiating registration with the registration server based on the second public network address and the second port, whereby a public network address and a port of a phone in the registration server are respectively updated to the second public network address and the second port, and then a call center establishes a connection to the phone through the second public network address and the second port.

Two electronic devices attempt to communicate and exchange Internet Protocol (IP) packets over a cellular communication network, and at least one of the two devices is behind a symmetric Network Address Translation (NAT) service. At least one of the two devices executes a Session Traversal Utilities for NAT (STUN) protocol, which provides to that device a pair of external IP address and port of that device; which that device then informs to a Message Broker Unit that is accessible to both devices via the public Internet. The Message Broker Unit provides the external IP address and port of that device, to the other device; which then connects to a Virtual Private Network (VPN) server and sends to the first device one or more User Datagram Protocol (UDP) packets that penetrate or puncture the NAT service in an application-agnostic manner.

Devices, systems, methods, and processes for flow entropy management using network address translation (NAT) scheme are described herein. Typically, due to fewer flows and high bandwidth demands in backend data center networks, hash distribution algorithms may exhibit bias, leading to congestion on certain network paths while others remain underutilized, a phenomenon known as low flow entropy. To address the low flow entropy problem, a network interface controller (NIC) decomposes a traffic flow into multiple flowlets and applies a NAT operation on each flowlet. In the NAT operation, an actual source port value of a flowlet is replaced with a unique unused source port value to make the flowlet look like a different traffic flow to a switch. Thus, the switch processes each flowlet as a different traffic flow and uses load balancing schemes to distribute the flowlets across various network paths. Thus, improving the flow entropy of the network.

Operations include: identifying a first dataflow associated with a particular communications protocol; evaluating the first dataflow to determine that the first dataflow meets a hardware-based Network Address Translation (NAT) usage criteria; responsive to determining that the first dataflow meets the hardware-based NAT usage criteria, executing a set of hardware-based NAT operations to process a first set of packets corresponding to the first dataflow; identifying a second dataflow associated with the same particular communications protocol; evaluating the second dataflow to determine that the second dataflow does not meet the hardware-based NAT usage criteria; and responsive to determining that the second dataflow does not meet the hardware-based NAT usage criteria, executing a first set of software-based NAT operations to process a second set of packets corresponding to the second dataflow.

A user equipment device (UE) initiates the creation of a dedicated bearer between a local gateway (L-GW) and a packet data network gateway (P-GW). A GTP tunnel is established to connect the L-GW, a serving gateway (S-GW), and the P-GW. The L-GW and P-GW apply Network Address Translation (NAT) and / or Traffic Flow Template (TFT) to route the traffic between the LS and a Service Capacity Server / Application Server (SCS / AS). Alternatively, an SCS-initiates the bearer creation, and an SCEF manages the creation of the GTP tunnel connection. The L-GW may be co-located with an Evolved UTRAN Node B (eNB) and / or connected to multiple eNBs which are not co-located with the L-GW.

An information processing method, apparatus, device and readable storage medium are provided, which relates to the field of communication technology. The method includes: obtaining network address translation information from a first device or function; performing a processing according to the network address translation information; where the network address translation information includes one or more of the following: a correspondence between a public network address and a private network address; a public network address; a private network address; a port number of public network address; a port number of private network address.

The disclosure provides an approach for gateway optimization. Embodiments include receiving, at a first gateway associated with a first tenant within a data center, a packet directed to a first public network address of an endpoint associated with a second tenant within the data center. Embodiments include performing, by the first gateway, network address translation (NAT) to translate the first public network address to a private network address of the endpoint. Embodiments include forwarding, by the first gateway, the packet to an edge gateway of the data center. Embodiments include forwarding, by the edge gateway, the packet to a second gateway associated with the second tenant within the data center without sending the packet to a public interface of the edge gateway. Embodiments include forwarding, by the second gateway, the packet to the endpoint.

The invention relates to the technical field of computer network communication technology, and discloses an automatic multi-time NAT (Network Address Translation) implementation method and system based on network data packet circulation. The automatic multi-time NAT implementation method is applied to a network address translation device, and specifically comprises the following steps: S101, obtaining a request destination and a route of a source node, and finally reaching a destination address according to the request destination and the route through one or more times of forwarding in a cloud topology so as to generate an access line path topology; s102, searching all paths from a source node to a destination node by using depth-first, and simulating whether a route from each path to the destination node is reachable or not for a data packet from the source node; according to the method, a path prediction technology based on a depth-first search (DFS) algorithm is introduced, all network equipment through which a network data packet passes from a source node to a destination node is automatically analyzed and calculated, the circulation conditions of the data packet on different paths are accurately simulated, and NAT strategy configuration requirements are automatically identified.

The invention discloses a remote intelligent control system for multimedia equipment and an implementation method thereof, and belongs to the technical field of network communication, and the implementation method comprises the following steps: acquiring network environment information of the multimedia equipment, judging an NAT (Network Address Translation) type, and generating a mixed penetration protocol selection rule to determine an initial penetration protocol; the method comprises the following steps: acquiring port allocation characteristics of NAT equipment based on an initial penetration protocol, generating port prediction parameters through linear increment prediction and LSTM neural network training, and formulating a port prediction and keep-alive strategy; executing UDP (User Datagram Protocol) penetration according to a keep-alive strategy, starting a TCP (Transmission Control Protocol) standby mechanism when the UDP penetration fails, and generating a penetration scheme by combining HTTP tunnel encapsulation and firewall inbound rule configuration; equipment identification information collection, signaling interaction, penetration attempt and connection establishment are completed based on a penetration scheme, successful feedback is generated after verification is passed, and remote control is realized; according to the invention, the stability and efficiency of remote connection of the multimedia equipment in a complex network environment are improved.

The invention discloses a domain name resolution method and device, equipment, a storage medium and a product. The method is applied to a CoreDNS server in a cluster, and comprises the following steps: receiving a target domain name resolution request message which is sent by a target host network Pod and is processed by a first network address translation rule and a second network address translation rule respectively; determining a corresponding target application IP address based on the target domain name resolution request message; and sending the target application IP address to the target host network Pod, so that the target host network Pod establishes connection with the target application based on the target application IP address. According to the scheme, the host network Pod can immediately use the domain name service function of the CoreDNS without any change on the host network Pod, and meanwhile, the method is friendly to an actual production environment and has no influence on services.

The embodiment of the invention discloses a data processing method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a network address translation type, a power consumption level and network topology information of network equipment when a registration request of the network equipment is received, and carrying out the registration of the network equipment according to the network address translation type, the power consumption level and the network topology information, generating equipment associated information; when a connection request of a client is received, analyzing a target device identifier in the connection request, and determining a target network device corresponding to the target device identifier and pre-stored device association information; and determining an adaptive point-to-point transmission strategy according to the equipment association information, and establishing point-to-point direct connection between the target network equipment and the client based on the determined point-to-point transmission strategy and an interactive enhanced session description protocol between the target network equipment and the client, and the scheme can provide a hole digging success rate.

The embodiment of the invention relates to the technical field of virtual network resource scheduling, and provides a port mapping method and device for multiple private clouds to share an elastic public network IP, and the method comprises the steps: creating multiple private clouds in a Cloud platform, and configuring and sharing one elastic public network IP for the multiple private clouds; an ARP pickup flow table of the elastic public network IP is configured on a gateway node of the elastic public network IP through a breip network bridge of the Cloud pods platform, the ARP pickup flow table is used for guiding a data center network to guide the flow accessing the elastic public network IP to the gateway node of the elastic public network IP, the gateway node is a node deployed in a centralized manner on the Cloud pods platform, and the flow of the elastic public network IP is guided by the data center network to the gateway node of the elastic public network IP. The public network flow processing module is used for uniformly processing public network flow of all private clouds sharing an elastic public network IP; and configuring a network address translation rule on the breip network bridge, and mapping a specified port of the elastic public network IP to an intranet IP of the target virtual machine in the corresponding private cloud and a port of the corresponding service. An elastic public network IP is shared in a virtual machine service scene of multiple tenants and multiple private clouds.

A method for providing stream control transmission protocol (SCTP) multihoming between a Kubernetes environment and a non-Kubernetes environment includes receiving, at an SCTP multihoming router (SMR) deployed as a pod within the Kubernetes environment and from a client in the non-Kubernetes environment, an SCTP INIT message for establishing a multi-homed SCTP association between first and second Internet protocol (IP) addresses of the client and first and second local IP addresses of the SMR. The first and second local IP addresses of the SMR are added to an SCTP header of the SCTP INIT message. Source and destination network address translations (NATs) are performed to change a source IP address and a destination IP address in an IP header of an IP datagram carrying the SCTP INIT message to a third local IP address of the SMR and a service IP address of a service in the Kubernetes environment, respectively.

The invention discloses an SFC deployment method of a symmetric flow firewall based on a cloud platform, and relates to the technical field of the cloud platform, and the method comprises the steps that a VPC1 and a VPC2 are created on the cloud platform, the VPC1 is used for bearing a virtual machine VM1 created by a user, and the VPC2 is a network environment needed for constructing SFC deployment of the symmetric flow firewall; a virtual machine is deployed on the cloud platform to serve as a network flow transfer virtual machine; four virtual network cards are created in the transfer virtual machine; the method comprises the following steps: deploying a plurality of virtual flow symmetric firewall virtual machines on a cloud platform, and creating two virtual network cards in each firewall virtual machine; closing security group protection mechanisms of all virtual network cards; oVS software is installed in the transfer virtual machine in advance, and a network bridge connected with the virtual network card is established through the OVS software; and the transfer virtual machine provides a source network address translation function through an OVS flow table, so that flow received by all firewall virtual machines is symmetrical, and translation between a floating IP address FIP1 and a local IP address is realized. According to the invention, north-south network traffic security guarantee service is provided for the virtual machine.

The embodiment of the invention provides a data forwarding method and system, and the method comprises the steps: extracting an outgoing source IP private network address from an outgoing data packet when an NAT gateway server configured with Open vSwitch receives the outgoing data packet from an internal network to a public network; when the first flow table judges that the outgoing source IP private network address needs to be subjected to network address translation, the outgoing source IP private network address is translated into a corresponding outgoing source IP public network address through a network address translation flow table, and the outgoing source IP private network address in the outgoing data packet is replaced; and sending the outgoing data packet with the replaced network address to the outgoing destination IP address. According to the technical scheme, the OVS flow table based on the Open vSwitch is arranged on the NAT gateway server, conversion between the intranet address and the public network address is carried out through the flow table, the method has the advantages of being high in performance, simple in configuration, extensible and the like, and due to the unique design of the OVS flow table Pipeline, the network address conversion process is optimized, and the processing delay and expenditure of data packets are reduced.

In one embodiment, a system includes a plurality of first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines comprises at least one public-cloud virtual machine (VM) that performs network address translation; and a plurality of second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines comprises one or more private-cloud virtual machines, wherein the public-cloud VM is configured to receive, via a network tunnel from the private-cloud VM, one or more first packets to be sent to a public Internet Protocol (IP) address of a public network host, translate, using a NAT mapping, a source address of each first packet from a private IP address of the private-cloud VM to an IP address of the public-cloud VM, and send the first packet to the IP address of the public-cloud VM.

This document describes a system and method for detecting the presence of Internet of Things (IoTs) from network traffic that has undergone a Network Address Translation (NAT) process, i.e., NATed network traffic, regardless of whether the network traffic comprises IP Flow Information Export (IPFIX) type of traffic or Domain Name System (DNS) type of traffic. Such a capability is crucial as the adoption rate of IoTs have increased exponentially over the past few years. In order to protect IoTs from cyber-attacks, one would first have to understand what type of IoTs are being used, and how many / how widely used these IoTs are. Once the IoT landscape has been defined, cyber defenders may then dedicate resources to identify and subsequently address vulnerabilities that may be in these IoTs.

Systems and methods are disclosed herein that enable a Network Function (NF) consumer or Application Function (AF) to obtain a public Internet Protocol (IP) address and port for a User Equipment (UE) after Network Address Translation (NAT), when the NF consumer or AF has only the Subscription Permanent Identifier (SUPI) (or GPSI) of the UE.

Some embodiments provide a method for forwarding data messages at multiple edge gateways of a logical network that process data messages between the logical network and an external network. At a first edge gateway, the method receives a data message, having an external address as a destination address, from the logical network. Based on the destination address, the method applies a default route to the data message that routes the data message to a second edge gateway and specifies a first output interface of the first edge gateway for the data message. After routing the data message, the method applies a stored NAT entry that (i) modifies a source address of the data message to be a public NAT address associated with the first edge gateway and (ii) redirects the modified data message to a second output interface of the first edge gateway instead of the first output interface.

Techniques for resource sharing between cloud-hosted virtual networks are described. A first network address of a first virtual network is associated with a resource connected to a second virtual network, the first and second virtual networks within a cloud provider network. A service of the cloud provider network receives a message destined for the first network address. The service translates the first network address to a second network address of the resource in the second virtual private network. The service sends the message to the resource at the second network address in the second virtual network.