NAPT Port Translation Table for Duplicate Source Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Incompatibilities between network address or port translation and IPsec processing cause issues such as duplicate sources, leading to network integrity breaches, particularly when clients are served by a NAPT, with existing solutions failing to provide effective general solutions.
Innovation Solution
The implementation of a Source Port Translation Table (SPTT) and an Available Source Port Pool (ASPP) to determine and assign available port numbers that comply with security associations, preventing duplicate sources by decapsulating packets and managing port translations dynamically.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If Network Address Port Translation (NAPT) is used to translate both IP addresses and port numbers, then public address usage is economized and multiple clients can share a single public address, but duplicate source addresses are created causing network integrity breaches
Solution Approach 1:
The patent segments the port address space by creating distinct pools for different client groups. The NAPT device divides the available port range into multiple non-overlapping pools, assigning each client a unique pool. This segmentation ensures that even though multiple clients share the same public IP address, their translated source port combinations remain unique, preventing duplicate source identification and maintaining network integrity while allowing efficient address sharing.
Solution Approach 2:
The patent introduces an additional dimension to the translation space by implementing hierarchical port allocation. Instead of a flat port assignment, it creates a multi-dimensional structure where ports are organized in ranges and sub-ranges associated with specific clients. This dimensional organization allows the system to track and manage translations across multiple layers, ensuring uniqueness in the translated address space while maintaining the benefits of NAPT.
2Reliability
If a large range of port numbers is allocated to each client to ensure unique identification, then duplicate sources are avoided, but the complexity of port management and tracking increases
Solution Approach 1:
The patent implements dynamic port pool management where the NAPT device can flexibly allocate, adjust, and reuse port ranges based on current client needs and connection states. Rather than static assignments, the system dynamically manages port availability, allowing pools to be expanded, contracted, or reallocated as clients connect and disconnect. This dynamic approach maintains unique identification while adapting to changing network conditions and reducing management overhead.
Solution Approach 2:
The patent incorporates feedback mechanisms where the NAPT device continuously monitors the usage state of port pools and adjusts allocations accordingly. The system tracks which port ranges are actively in use, which are available, and detects potential conflicts. This feedback loop enables automatic adjustment of port assignments, ensuring unique identification is maintained while optimizing the distribution of port resources and reducing manual management complexity.
3Reliability
If port numbers are dynamically assigned and tracked for each client, then network security is enhanced through proper source identification, but the processing overhead and memory requirements increase
Solution Approach 1:
The patent segments the tracking data structure by organizing translation information in client-specific tables or data structures. Each client has an associated data structure that tracks only their assigned port range, rather than maintaining a single large global table. This segmentation reduces the search space and memory access requirements, lowering processing overhead while maintaining comprehensive tracking for security purposes.
Solution Approach 2:
The patent performs preliminary allocation of port ranges to clients before actual connections are established. By pre-assigning port pools and configuring tracking structures in advance, the system avoids the need for complex real-time calculations and searches during connection establishment. This preliminary action reduces processing overhead during critical path operations while maintaining the security benefits of dynamic port management.
Data Source
AI summary
Preventing duplicate sources on a protocol connection that uses network addresses, protocols and port numbers to identify connections that include port number translation. In response to an inbound IPsec packet from a remote source client, a determination is made as to whether or not a port number is available within a range of port numbers that comply with a security association governing the connection. If so, an available port number is assigned to the connection, thereby avoiding a possibility of a duplicate source. If a port number is not available, the packet is rejected.