Deterministic NAPT for Subscriber Identification Without Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Service providers face significant challenges in managing network address translation (NAT) logs in high-traffic environments, as generating and storing logs for each session consumes resources and bandwidth, making it burdensome to trace network traffic back to specific customers.
Innovation Solution
The implementation of deterministic network address translation (NAT) techniques, specifically source network address and port translation (NAPT), which algorithmically maps a subscriber's private address to a public address and port range, allowing for dynamic port allocation and reducing the need for voluminous log maintenance by storing only date ranges and available address subnets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional NAT logging is implemented to trace network traffic back to customers, then service providers can identify subscribers, but resources and bandwidth are consumed due to generating and storing voluminous logs
Solution Approach 1:
The patent extracts only the essential information needed for subscriber identification (public IP address, port range, date range) from the complete NAT translation data, eliminating the need to store comprehensive session logs while maintaining the ability to trace traffic back to customers
Solution Approach 2:
Instead of logging all NAT translations and then querying them for identification, the patent inverts the approach by creating deterministic mappings that enable direct computation of subscriber identity from the public IP and port information, eliminating the need for extensive log storage
2Reliability
If comprehensive NAT translation logs are maintained for law enforcement requirements, then subscriber identification is possible, but device complexity and processing burden increase
Solution Approach 1:
The patent performs preliminary action by pre-establishing deterministic mapping rules that define how private IP addresses are mapped to public IP addresses and port ranges. This allows the system to comply with law enforcement requirements through simple date range and address subnet storage without complex real-time logging processing
3Adaptability or versatility
If dynamic port allocation is used for each session, then flexibility is improved, but the ability to deterministically identify subscribers worsens
Solution Approach 1:
The patent segments the port space into deterministic ranges associated with specific private IP addresses. Each subscriber is assigned a specific port range that can be determined algorithmically from their private IP address, maintaining deterministic identification while allowing dynamic allocation within that range
Solution Approach 2:
The patent changes the parameter from completely dynamic port allocation to deterministic port range allocation based on the private IP address. The port range is computed using a deterministic algorithm that takes the private IP address as input, ensuring that the same private IP always maps to the same public IP and port range
Data Source
AI summary
A source network address and port translation (NAPT) mechanism is described that reduces or eliminates the need to log any NAT translations. As described herein, a mapping between a subscriber's private address to a public address and port range is determined algorithmically. Given a particular mapping rule, as specified by the service provider, a subscriber is repeatedly and deterministically mapped to the same public network address and a specific port range for that network address. Once the public address and port range for a subscriber are computed, the particular ports for each session for that subscriber are allocated dynamically within the computed NAT port range on per session basis.