Distributed Remote Access via NAT Hole Punching and Dynamic Headend Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote access (RA) headends face challenges with dynamic private wide area network (WAN) IP addresses, leading to reachability issues, high operational costs, and vulnerability to DDoS attacks, while static public IPs result in poor quality of service and inefficient load distribution.
Innovation Solution
A controller-based architecture is implemented to eliminate the need for static public IPs, enabling dynamic and optimal distribution of RA clients across headends using geolocation and load-based policies, with edge devices performing hole punching to traverse NAT gateways and connect to a central controller.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static public IP is assigned to RA headend, then reachability is improved, but operational cost increases and DDoS vulnerability increases
Solution Approach 1:
The patent applies dynamics by transitioning from static public IPs to dynamic private IPs for RA headends. The system uses a controller to dynamically manage IP address assignments and NAT mappings, allowing headends to obtain and release IP addresses as needed. This dynamic approach eliminates the need for permanent static public IPs, reducing both cost and DDoS vulnerability while maintaining reachability through dynamic NAT translation tables managed by the controller.
Solution Approach 2:
The controller acts as an intermediary between RA headends and clients. It manages the NAT translation tables and coordinates IP address assignments, enabling headends with dynamic private IPs to remain reachable. The controller mediates the communication by maintaining mapping information that translates dynamic private IP addresses to accessible addresses for clients, eliminating the need for static public IPs at headends.
2Productivity
If RA headends are decentralized, then service scalability is improved, but reachability issues occur with dynamic private IPs
Solution Approach 1:
The system segments the RA headend functions across multiple distributed locations while using a centralized controller for coordination. Each headend is independent and can be deployed at various sites, enabling scalability. The controller segments the management function by maintaining separate NAT translation tables for each headend, allowing decentralized operation with centralized coordination for IP address management and reachability.
Solution Approach 2:
The controller implements feedback mechanisms by monitoring NAT translation tables and coordinating IP address assignments across distributed headends. When headends need to establish connections, the controller receives requests, checks availability, assigns appropriate private IPs, and updates translation tables accordingly. This feedback loop ensures reachability is maintained as headends are dynamically added or removed from the network.
3Ease of manufacture
If dynamic private IP is used for RA headend, then operational cost is reduced, but reachability and load distribution are compromised
Solution Approach 1:
The system changes the IP address parameter from static to dynamic, reducing operational costs. The controller manages parameter changes by dynamically assigning and releasing private IP addresses to headends based on actual usage patterns. This allows cost savings while maintaining service quality, as the dynamic assignment can be optimized to distribute load effectively across available headends rather than being fixed in advance.
Data Source
AI summary
A method of implementing controller-based distributed remote access may include connecting a plurality of edge devices to a controller via a network. The plurality of edge devices may perform hole punching to traverse a network address translation (NAT) gateway to create a NAT hole. The method may also include connecting a client device to the controller. The client device may be directly connected to one of the plurality of edge devices via the NAT hole in the network. The method may further include directly connecting the client device to one of the plurality of edge devices by receiving a query from the client device and returning public IP/ports of a most relevant edge device to the client device, the most relevant edge device being based on attributes of the client device, attributes of the plurality of edge devices, or combinations thereof.