NAT User-Identity Encapsulation for Consistent Firewall Policies

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Firewalls in networks using Network Address Translation (NAT) devices apply inconsistent security policies due to the obfuscation of user information by SNAT, leading to inconsistent access rights for users across different NAT devices.

Innovation Solution

Encapsulating user-specific information with data packets before performing SNAT, allowing firewalls to apply user-specific security policies regardless of the NAT device used.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If SNAT is performed on all communications to obfuscate user information, then network security control is improved, but user identification capability deteriorates

Engineering Contradiction:

Improvenetwork security controlVSAvoiduser identification capability

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent embeds the original user identifying information inside the NAT device's identifying information structure. The firewall receives communications with the NAT device's IP address as the outer layer, while the encapsulated original user IP address resides within this structure, allowing both security control and user identification to function simultaneously.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The patent introduces an intermediary data structure (the encapsulated identifying information) that mediates between the NAT device's obfuscation function and the firewall's identification requirement. This intermediary preserves the original user information while maintaining the NAT device's security control mechanism.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If SNAT replaces user identifying information with NAT device information, then firewall protection is improved, but access control precision deteriorates

Engineering Contradiction:

Improvefirewall protectionVSAvoidaccess control precision

Core Design Contradiction:

Object-affected harmful factorsVSMeasurement precision

Solution Approach 1:

The original user identifying information is nested within the NAT device's identifying information structure, allowing the firewall to access both the NAT device information (for security control) and the original user information (for precise access control decisions) simultaneously.

Inventive Principle:

Principle #7Nested doll (Nesting)

Solution Approach 2:

The patent performs the action of preserving user identifying information before the SNAT process completely obfuscates it. By encapsulating the original information in advance, the firewall can later retrieve precise user identification for accurate access control decisions.

Inventive Principle:

Principle #10Preliminary action

3Measurement precision

If encapsulation is used to preserve user information, then access control precision is improved, but data packet structure complexity increases

Engineering Contradiction:

Improveaccess control precisionVSAvoiddata packet structure

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent uses nested encapsulation where the original user identifying information is placed inside the NAT device's identifying information structure. This nested structure preserves user information for precise access control while maintaining a systematic and organized data format that is manageable by network devices.

Inventive Principle:

Principle #7Nested doll (Nesting)

Data Source

PatentUS12425370B1Preserving security information over NAT enabled devices using encapsulation

Publication Date: 2025.09.23 PALO ALTO NETWORKS INC

AI summary

A data packet is received. It is determined whether the data packet is encapsulated. One or more security policies are applied to the data packet based on whether the data packet is encapsulated.