Packet Origin Tracking Across NAT Boundaries Using Payload Hashes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Tracking the identity of network packets as they traverse boundaries that perform Network Address Translation (NAT) is challenging due to the alteration of source addresses and checksums, making it difficult to authenticate the origin of packets.
Innovation Solution
A computer-implemented method and system that calculates hashes of packet application layer payloads before and after a NAT boundary, storing these hashes with timestamps, and matching them to determine the packet identity, utilizing commodity servers with full packet capture capabilities and cryptographic hashing algorithms like MD5.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Network Address Translation (NAT) is implemented to allow multiple nodes to share an IP address and hide internal topology, then network security and address conservation are improved, but the ability to track and authenticate packet origins deteriorates
Solution Approach 1:
The patent introduces hash values as an intermediary mechanism to track packet origins. Instead of directly tracking modified IP addresses through NAT boundaries, the system computes hash values from application layer payloads before and after NAT translation. These hash values serve as mediators that preserve packet identity information despite address changes, enabling origin tracking while maintaining NAT's security benefits.
Solution Approach 2:
The patent creates copies of packet identity information in the form of hash values at both boundaries of the NAT network. By computing and storing hash values of application layer payloads on both the internal and external sides of the NAT boundary, the system preserves packet origin information without altering the actual packet flow or NAT functionality.
2Adaptability or versatility
If NAT boundaries alter source IP addresses and checksums in packet headers, then address conservation and topology hiding are achieved, but packet identity authentication becomes difficult
Solution Approach 1:
The patent replaces traditional mechanical packet tracking methods (based on IP address monitoring) with a cryptographic hashing approach. Instead of attempting to track packets through IP address changes at NAT boundaries, the system substitutes this with computation of hash values from application layer payloads, providing precise packet identity authentication independent of address alterations.
Solution Approach 2:
The patent changes the parameter used for packet identification from network layer IP addresses to application layer hash values. By shifting the identification parameter from the network layer (which is modified by NAT) to the application layer (which remains unchanged), the system maintains accurate packet identity authentication despite address changes.
3Measurement precision
If multiple sensors and hash matching mechanisms are deployed to track packets across NAT boundaries, then packet origin identification accuracy is improved, but system complexity increases
Solution Approach 1:
The patent designs the hash computation and matching mechanism to serve multiple functions simultaneously. The same hash values computed from application layer payloads are used for packet identification, origin tracking, and authentication across NAT boundaries. This multi-functional approach reduces overall system complexity compared to implementing separate mechanisms for each function.
Solution Approach 2:
The system uses the existing application layer payload data to generate hash values, rather than requiring separate packet capture and analysis infrastructure. The application layer data that already exists in the packet stream serves the dual purpose of being both the communication payload and the source of identification information, reducing the need for additional system components.
Data Source
AI summary
A method is described for calculating a first hash of a packet application layer payload at an inside sensor before a boundary, and storing a first hash data record at a device that has direct access to the inside sensor. A second hash of the packet application layer payload can be calculated at an outside sensor after the boundary, and a second hash data record can be stored at a device that has direct access to the outside sensor. The packet can be transmitted from a client to a server, or from a server to a client, and the boundary is between the client and the server. The first hash data record and second hash data record can include a hash value, an IP address, and a timestamp. Finally, a determination can be made whether the first hash data record and the second hash data record match.