Dynamic Port Range Allocation for NAT Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing demand for IP addresses due to a growing number of network users leads to depletion, prompting network service providers to use NAT, which allocates static port ranges to subscribers, increasing their susceptibility to security attacks as attackers can easily guess used ports within the static range.
Innovation Solution
A method where a network device allocates an initial port range to a user device, measures a period of time, and then allocates a new port range when the measured time equals a set period, continuously migrating sessions to new port ranges until the user disconnects, thereby changing the port range frequently and reducing the risk of attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If a static port range is allocated to a subscriber, then the amount of binding information to be stored is minimized, but the subscriber's susceptibility to security attacks increases
Solution Approach 1:
The patent applies dynamics by transitioning from a static port range allocation to a dynamic port range allocation. The network device periodically reallocates port ranges to subscribers based on session activity and time-based criteria. This dynamic approach maintains the benefit of reduced binding information storage while mitigating security risks by preventing attackers from guessing persistent port ranges, as ports are periodically changed based on measured time periods and session states.
2Object-affected harmful factors
If individual ports are allocated per session, then security is improved, but the amount of binding information to be stored increases substantially
Solution Approach 1:
The patent applies partial action by allocating port ranges rather than individual ports per session. Instead of tracking every single port assignment, the network device allocates a range of ports and tracks the range as a whole. This partial tracking approach maintains adequate security by still binding IP addresses to port ranges while substantially reducing the amount of binding information that needs to be stored compared to tracking individual port-session mappings.
3Quantity of substance
If a continuous port range is allocated to a subscriber, then storage costs are reduced, but the ease of guessing used ports by attackers increases
Solution Approach 1:
The patent applies periodic action by implementing time-based port range reallocation. The network device measures time periods and periodically reallocates port ranges to subscribers based on these measured periods and session activity. This periodic change of port ranges maintains the storage efficiency of range-based allocation while increasing the difficulty of port guessing, as attackers cannot rely on static port ranges and must account for periodic changes based on time measurements and session states.
Data Source
AI summary
A network device may receive a packet from a user device; allocate a first port range to the user device; measure a period of time after allocating the first port range; and allocate a second port range to the user device when the measured period of time is equal to a particular period of time. The first port range may be associated with a first Internet Protocol (IP) address.