NAPT Duplicate Source Prevention via SPMT Decapsulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Incompatibilities between network address or port translation and IPsec processing cause issues in secure Internet communications, particularly leading to duplicate sources that breach network integrity, with existing solutions failing to address these problems effectively.
Innovation Solution
A method that involves a Source Port Mapping Table (SPMT) to identify and reject duplicate sources by decapsulating UDP packets encapsulating ESP packets and dynamically building NAPT host entries based on Internet Key Exchange messages, ensuring correct associations between source IP addresses, port numbers, and protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If Network Address Port Translation (NAPT) is used to translate both IP addresses and port numbers, then public address usage is economized and private address uniqueness is simplified, but duplicate source addresses are created that breach network integrity
Solution Approach 1:
The patent introduces an intermediary verification mechanism (the checking module) that mediates between the NAPT translation process and the network communication. This intermediary checks whether translated source address-port combinations are duplicates before allowing communication, thus resolving the conflict between address translation efficiency and network integrity.
Solution Approach 2:
The patent implements a feedback mechanism where the system continuously monitors and checks for duplicate source addresses after NAPT translation. The checking module provides feedback about duplicate detection results, allowing the system to prevent or correct duplicate address issues while maintaining efficient address translation.
2Adaptability or versatility
If NAPT translates source addresses and port numbers for multiple clients, then address space is conserved, but duplicate source identification becomes impossible without additional tracking mechanisms
Solution Approach 1:
The patent applies preliminary action by performing duplicate address checking immediately after NAPT translation occurs. The checking module proactively verifies translated addresses before they are used for communication, preventing duplicate issues rather than detecting them later. This reduces the complexity of ongoing tracking mechanisms.
Solution Approach 2:
The NAPT device performs self-service by incorporating the duplicate checking function within itself. The checking module resides in the same device that performs the translation, allowing it to automatically verify its own translation outputs without requiring external verification systems, thus reducing overall system complexity.
3Reliability
If IPsec processing is applied to packets from NAPT-translated addresses, then secure communication is achieved, but the combination creates incompatibilities that prevent proper security association establishment
Solution Approach 1:
The patent segments the protocol processing into distinct functional modules: the NAPT translation module, the duplicate checking module, and the IPsec processing module. This segmentation allows each module to operate independently with well-defined interfaces, reducing compatibility issues between IPsec and NAPT while maintaining security.
Data Source
Figure 1~2
Figure 3~7
Figure 8~9
AI summary
Preventing duplicate sources on a protocol connection that uses network addresses, protocols and port numbers to identify source applications that are served by a NAPT. If an arriving packet encapsulates an encrypted packet and has passed through an NAPT en route to the destination host, the encapsulated packet is decrypted to obtain an original source port number and original packet protocol from the decrypted packet. A source port mapping table (SPMT) is searched for an association between the NAPT source address, the original source port, and the original packet protocol associated with the NAPT source address and port number. If an incorrect association is found, the packet is rejected as representing an illegal duplicate source; that is, a second packet from a different host served by a NAPT that is USING the same SOURCE port and protocol.