NAT Address Mapping via Cyclic Public IP Rotation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Resource-constrained nodes in IoT environments face security threats due to their low processing capabilities, and existing NAT technologies require frequent heartbeat messages to maintain address mapping, which is energy-intensive and vulnerable to external attacks in UDP scenarios and not effective in TCP scenarios where connections are long-lasting.
Innovation Solution
A method and apparatus that allocate multiple public network addresses to resource-constrained nodes, cyclically activating them to maintain address mapping without the need for frequent heartbeat messages, reducing energy consumption and enhancing security by ensuring the public address is not fixed, thus reducing the risk of external attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If heartbeat messages are sent frequently to maintain address mapping in NAT technology, then the address mapping relationship remains alive, but energy consumption increases and security vulnerability increases
Solution Approach 1:
The patent implements periodic address mapping updates by cyclically changing the public network address assigned to the internal device at predetermined intervals. Instead of continuous heartbeat messages, the system periodically refreshes the mapping relationship, thereby maintaining reliability while reducing energy consumption associated with frequent communications.
Solution Approach 2:
The patent introduces dynamic address allocation where the public network address is not fixed but changes periodically. The NAT device dynamically updates the mapping relationship between internal and external addresses at predetermined time intervals, making the system adaptable and reducing the need for continuous keep-alive communications.
2Stability of the object's composition
If a fixed external mapping address is used for resource constrained nodes in TCP scenarios, then connection stability is maintained, but security is reduced due to address theft risk
Solution Approach 1:
The patent makes the external mapping address dynamic rather than fixed. By periodically changing the public address assigned to the internal device, the system maintains connection stability through controlled updates while preventing address theft attacks that target fixed addresses. The dynamic nature of the address makes it difficult for external attackers to steal or predict the mapping address.
Solution Approach 2:
The patent implements preliminary address changes before potential security threats can exploit a fixed address. By proactively updating the mapping relationship at predetermined intervals, the system prevents address theft risk while maintaining connection stability through smooth transitions.
3Object-affected harmful factors
If multiple public network addresses are allocated and cyclically activated, then security is enhanced by preventing address theft, but device complexity increases
Solution Approach 1:
The patent segments the address management function by separating the pool of public network addresses from the active mapping relationship. The NAT device maintains a pool of multiple public addresses and cyclically activates them in a predetermined sequence, which enhances security by preventing address theft while managing complexity through systematic organization of address resources.
Solution Approach 2:
The patent uses periodic activation of multiple addresses in a predetermined sequence to enhance security. This systematic approach to address management, where addresses are activated in cycles rather than randomly, prevents address theft while keeping device complexity manageable through predictable patterns.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
Embodiments of the present invention provide a method and an apparatus for keeping network address translation mapping alive, so that a resource constrained node does not need to frequently send a heartbeat message to keep an address mapping relationship alive, and security of the resource constrained node is ensured. The method includes: receiving, by a network address translation NAT device, a probe request sent by an internal network device, where the probe request includes a private network address of the internal network device; sending, by the NAT device, a probe response to the internal network device, where the probe response carries indication information, and the indication information is used to indicate that the internal network device does not actively initiate a heartbeat message to keep network address translation mapping alive; and allocating at least two public network addresses to the internal network device from an address resource pool, and using, by the NAT device in each time period of a subsequent session process between the internal network device and an external network device, one of the at least two public network addresses as a current active address in the time period, to map the private network address of the internal network device to the current active address.