Endpoint Context Agent Traversal Through NAT Using Connection Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Endpoint Connection Agent (ECA) mechanisms do not support Network Address Tables (NATs), leading to mismatches in connection 5-tuples and inability to match network traffic with firewall metadata caches, rendering firewalls ineffective in secure network communication.
Innovation Solution
A method and system that communicate metadata with a connection identifier from a client device to a security device, allowing the security device to index entries in a metadata cache using a connection identifier within network packets, enabling ECA traversal through NATs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a NAT is used within an internal network to change the 5-tuple in network packets, then network address translation functionality is improved, but the ability to match network traffic with firewall metadata cache entries is worsened
Solution Approach 1:
The firewall receives and caches metadata including the original 5-tuple before the NAT modifies the network packets. This preliminary caching of the original connection information allows the firewall to later match incoming translated packets against the cached metadata using the connection identifier, resolving the contradiction between NAT translation and connection matching reliability
Solution Approach 2:
A connection identifier is introduced as an intermediary element that links the translated 5-tuple (after NAT) with the original 5-tuple (in metadata cache). The connection identifier acts as a mediator that allows the firewall to correlate NAT-translated packets with their original connection metadata, enabling both NAT functionality and accurate connection matching
2Measurement precision
If the firewall searches metadata cache using the 5-tuple of received connection, then connection matching is improved, but the system fails when NAT changes the 5-tuple
Solution Approach 1:
The original 5-tuple information is copied into the metadata cache before NAT translation occurs. This copy of the original connection information serves as a reference that remains unchanged despite NAT modifications to the actual network packets, allowing precise connection identification while maintaining NAT compatibility
Solution Approach 2:
The system changes from relying solely on the 5-tuple for connection identification to using a connection identifier that remains invariant under NAT translation. This parameter change allows the firewall to maintain precise connection identification regardless of NAT-induced 5-tuple modifications
Data Source
AI summary
A method, system, and computer-usable medium are disclosed for: (i) communicating, from a client device to a security device via a metadata connection, metadata regarding a data connection to be established by the client device, the metadata comprising a connection identifier uniquely identifying the data connection; and (ii) communicating, from the client device to the security device via the data connection, network traffic comprising a packet that includes the connection identifier, such that the security device may use the connection identifier to index an entry associated with the metadata that the security device has stored in a metadata cache.