Controller-Based NAT Filtering for Overlapping Cloud Addresses

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current VPC management tools fail to provide adequate safeguards for identifying and modifying messages with overlapping network addresses, leading to security risks and unreliable data routing due to manual configurations and dynamic scaling in cloud platforms.

Innovation Solution

A network traffic filtering system operating within a centralized controller detects and manages network address overlapping conditions by performing automatic network address translations using mapped NATs, ensuring secure and reliable routing through edge gateways.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If manual network address translation configuration is used in spoke VPCs, then flexibility in VPC deployment is maintained, but security risks increase due to inability to identify and modify overlapping network addresses

Engineering Contradiction:

ImproveVPC deployment flexibilityVSAvoidsecurity risk from overlapping network addresses

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

A controller is introduced as an intermediary component between spoke VPCs and the cloud platform network. The controller receives control plane messages, performs automated network address translation using mapped NATs, and filters messages with overlapping network addresses before forwarding them to edge gateways. This intermediary resolves the security issue while preserving deployment flexibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary filtering and address translation of control plane messages before they are propagated through the cloud platform network. By checking for overlapping network addresses in advance and translating addresses proactively, the system prevents security issues before they can manifest, rather than reacting to problems after they occur.

Inventive Principle:

Principle #10Preliminary action

2Device complexity

If manual NAT configuration is implemented, then device complexity is reduced, but reliability deteriorates due to inability to guarantee proper routing of data traffic

Engineering Contradiction:

ImproveNAT configuration complexityVSAvoiddata traffic routing reliability

Core Design Contradiction:

Device complexityVSReliability

Solution Approach 1:

The controller automatically performs network address translation and routing configuration without requiring manual intervention. The system self-manages the complexity of NAT mappings and routing policies, dynamically adjusting configurations based on the specific requirements of each VPC and the current network state, thereby ensuring reliable routing while reducing operational complexity.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system dynamically changes network address parameters through automated translation. Instead of static manual configurations, the controller dynamically maps network addresses based on the specific VPC requirements and network conditions, ensuring proper routing while adapting to changing network states without requiring manual reconfiguration.

Inventive Principle:

Principle #35Parameter changes

3Object-affected harmful factors

If automated network address translation is implemented in a centralized controller, then security is enhanced by preventing overlapping address propagation, but device complexity increases

Engineering Contradiction:

Improveoverlapping network address propagationVSAvoidcontroller system complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The system segments the network address management function into a separate centralized controller, distinct from the edge gateways and spoke VPCs. This segmentation allows the controller to specialize in address translation and filtering operations, managing complexity in a dedicated component rather than distributing it across the entire network infrastructure.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12470512B1Controller-based traffic filtering and address modification

Publication Date: 2025.11.11 AVIATRIX SYSTEMS INC

AI summary

In communication with components of a cloud platform, namely a software-defined network constructed to overlay at least one public cloud network, a controller features a virtual processor and a data store. The data store includes network address translation (NAT) processing logic configured to determine whether a control plane message from tenant resources is associated with a network address overlapping condition, which represents a first network address included in the control plane message overlaps a network address range relied upon by either (a) at least one of the components of the cloud platform or (b) a component associated with other tenant resources. The NAT processing logic is further configured to alter routing data stores that maintain routing information for each of the components of the cloud platform to substitute the first network address with a first virtual network address for subsequent data message routing.