Network Directory Service for Private IP Inbound Connectivity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in providing inbound connectivity and router discovery for networks using private IP address spaces, as existing NAT and proxy solutions do not effectively address name resolution and router identification issues, especially when multiple private networks are interconnected.
Innovation Solution
A network directory service and network access service are implemented, which include a network directory server and network access server, to facilitate inbound connectivity by authenticating clients, identifying the correct network access server, and issuing device access tokens for secure communication with devices on private address space networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If NAT is used to interconnect private networks to the Internet, then IP address exhaustion is prevented and security is improved, but inbound connectivity and router discovery become problematic
Solution Approach 1:
The patent introduces a network directory service as an intermediary between clients and private networks. This directory service stores mappings between device identifiers and network access server addresses, enabling name resolution without requiring clients to understand NAT complexity. The directory service mediates the connection establishment process by translating high-level device names into low-level network addresses, thus resolving the contradiction between maintaining NAT security and enabling inbound connectivity.
2Adaptability or versatility
If multiple private networks are interconnected, then network versatility is improved, but router identification and name resolution become difficult
Solution Approach 1:
The network directory service operates autonomously to manage router identification across multiple private networks. Each network access server automatically registers itself with the directory service, providing its own identification information and capabilities. When a client needs to access a device, it queries the directory service which automatically returns the appropriate network access server address. This self-service mechanism eliminates the need for complex manual router identification, thus enabling versatile network interconnection while simplifying the identification process.
3Reliability
If IP masquerading is implemented, then security is improved by hiding private networks, but inbound connectivity to specific devices becomes challenging
Solution Approach 1:
The patent segments the network architecture into distinct functional layers: the network directory service layer for name resolution, the network access server layer for connection management, and the private device layer for actual resource access. This segmentation allows IP masquerading to maintain security at the network layer while enabling controlled inbound connectivity at the application layer through the directory service. Clients can access specific devices by name without exposing the underlying network structure, thus maintaining security while improving ease of operation.
Data Source
AI summary
A network directory service, responsive to receiving a target device symbolic name from a client, identifies a network access server in communication with a network on which the target device resides, notifies the network access server of an expected connection from the client, and returns a device access token to the client. The network access server, responsive to receiving and validating the device access token, forwards the client-originated traffic to the target device by implementing a Network Address Translation (NAT) scheme.