Deterministic Mapping for CGN Subscriber Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing demand for IPv4 addresses forces Internet Service Providers to share a single public IPv4 address among multiple subscribers using Carrier Grade Network Address Translator (CGN), leading to significant operational challenges in storing connection logs to identify attackers and respond to law enforcement requests, due to the large volume of data required.
Innovation Solution
A deterministic algorithm that maps inside network addresses to outside addresses, allowing operators to identify subscriber identities without logging each connection, by using a compression ratio and dynamic port allocation, reducing the need for massive session data storage and processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If CGN stores detailed connection logs for each subscriber to identify attackers and respond to law enforcement requests, then identification capability is improved, but data storage volume increases significantly
Solution Approach 1:
The patent extracts only the essential identification information (subscriber ID, MAC address, assigned timestamp) from complete connection logs. Instead of storing full connection details including all packet metadata, the system extracts and stores only the minimal set of fields needed for law enforcement and security identification, reducing storage requirements while maintaining identification capability.
Solution Approach 2:
The system pre-assigns unique identifiers and MAC addresses to subscribers before connections are established. This preliminary assignment allows the CGN to store compact identification records in advance, rather than having to log and store complete connection state information for each session. The pre-assigned identifiers enable quick lookup and identification without requiring extensive connection logging.
2Reliability
If CGN maintains comprehensive connection logs for abuse reporting, then law enforcement response capability is improved, but operational complexity increases
Solution Approach 1:
The patent segments the identification system into distinct components: subscriber registration module that assigns unique identifiers and MAC addresses, connection tracking module that logs minimal essential information, and query response module that retrieves identification data. This segmentation allows each component to perform its function independently with simplified logic, reducing overall system operational complexity while maintaining reliable law enforcement response capability.
3Quantity of substance
If CGN uses traditional NAT address sharing, then IPv4 address conservation is improved, but data processing burden increases
Solution Approach 1:
The patent implements a self-service identification system where each subscriber autonomously receives a unique identifier and MAC address assignment from the CGN during registration. This pre-assigned information allows subscribers to self-identify in connection logs without requiring complex real-time processing or querying of extensive connection state databases. The subscriber essentially serves its own identification needs using pre-assigned credentials, reducing the data processing burden on the CGN.
Data Source
AI summary
Network address translating is contemplated to be of a type where a network address translator (NAT), a carrier grade NAT (CGN), or other type of translator may facilitate reconstruction of translated addresses in a manner that ameliorates the amount of data that must be stored to facilitate the reconstruction.