IP Options Field for Preserving Source Address in NAT
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network Address Translation (NAT) devices, such as gateways, replace source IP addresses and port numbers with translated addresses and port numbers, making it difficult for network security software to trace the origin of IP datagrams and implement micro-segmentation, which is critical for network security and fine-grained data protection.
Innovation Solution
A method and system that insert the source IP address and source port number into the IP-options field of IP datagrams, specifically using the IP Record Route and Internet Timestamp options, to ensure these details are preserved and non-manipulable, allowing for accurate identification of the origin endpoint and enabling effective micro-segmentation policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If NAT devices replace source IP addresses and port numbers with translated addresses, then network address translation functionality is improved, but the ability to trace origin endpoint and implement micro-segmentation deteriorates
Solution Approach 1:
The patent creates a copy of the source IP address and source port number and stores it in the IP-options field of the IP datagram. This copying mechanism preserves the original addressing information alongside the translated addresses, allowing both NAT functionality and origin tracing to coexist without conflict
Solution Approach 2:
The IP-options field acts as an intermediary storage mechanism that holds the original source IP address and port number. This intermediary preserves the information that would otherwise be lost during NAT translation, enabling security software to access the original addressing data without interfering with the NAT translation process
2Reliability
If source IP address and port number are preserved in IP datagram, then micro-segmentation capability is improved, but device complexity increases
Solution Approach 1:
The patent utilizes the existing IP-options field, which was originally designed for other purposes, and repurposes it to store source IP address and port number information. This multi-functional use of an existing structure avoids adding new complex fields to the IP datagram header, thereby minimizing increased device complexity while achieving micro-segmentation capability
3Adaptability or versatility
If NAT translation is performed at gateways, then network connectivity is improved, but latency increases due to additional processing
Solution Approach 1:
The patent performs the action of copying source IP address and port number to the IP-options field at the point of NAT translation, before the packet leaves the gateway. This preliminary action ensures that the information is preserved without requiring additional processing or lookup operations later in the network path, thereby minimizing latency
Data Source
AI summary
The present disclosure envisages a computer implemented method, a corresponding computer implemented system and a computer program product that envisage inserting the mapping information—including source IP address and source port number—that maps the IP datagram back to its origin endpoint (i.e. the source computing node at which the IP datagram was originally created), into an IP-options field of the corresponding IP datagram. Additionally, the present disclosure envisages anticipating the default behaviour of the Network Address Translation (NAT) device (for instance, a gateway) characterized by replacement of the source IP address and the source port number (mapping information) stored in the IP header of the IP datagram with a translated IP address and translated port number, and facilitating trustful and non-repudiable verification of the source computing node as the creator of the IP datagram, on the destination computer network.