PCP Snooping for NAT Mapping in Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network security software struggles to implement fine-grained security policies and trace the origin of IP datagrams due to Network Address Translation (NAT) devices replacing source IP addresses and port numbers with translated ones, hindering micro-segmentation across computer networks.
Innovation Solution
A computer-implemented method and system that learns NAT mapping information by snooping on Port Control Protocol (PCP) packets to identify the original source IP address and port number, even when translated addresses are used, allowing for accurate PACKET ACCEPT and PACKET DROP decisions based on the original source information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If NAT devices translate source IP addresses and port numbers, then network connectivity and address management are improved, but the ability to trace the origin of IP datagrams and implement fine-grained security policies deteriorates
Solution Approach 1:
The patent introduces PCP (Port Control Protocol) as an intermediary mechanism that carries mapping information between internal and external addresses. The PCP packets serve as mediators that preserve source identification information alongside the translated addresses, allowing security software to trace the origin of IP datagrams even after NAT translation has occurred.
2Adaptability or versatility
If NAT translation is performed to enable network address substitution, then network flexibility and address reuse are improved, but security policy enforcement based on original addresses becomes difficult
Solution Approach 1:
The patent implements preliminary action by capturing and storing the mapping between internal and external addresses in PCP packets before the IP datagram traverses the network. This pre-captured mapping information is then used by security software to enforce policies based on original addresses, eliminating the need to modify security policy enforcement mechanisms.
3Reliability
If micro-segmentation is implemented without PCP snooping, then network security granularity is improved, but the ability to verify original source addresses deteriorates due to NAT translation
Solution Approach 1:
The patent implements feedback by having security software snoop PCP packets to obtain mapping information, then using this feedback to verify the original source addresses of IP datagrams. The snooped mapping data provides continuous feedback that enables accurate source verification despite NAT translation, allowing micro-segmentation policies to be enforced reliably.
Data Source
AI summary
Whenever an IP packet is routed from a source computing device through to a NAT device on the way to a destination computing device, a PCP client transmits a PCP query to a PCP server to determine the external IP address and external port number that have been substituted for the source IP address and source port number previously incorporated within the IP packet. Subsequently, the PCP server responds to the PCP client with the information denoting the mapping between the source IP address-some port number pair and the external IP address-external port number pair. A snooping agent is utilized to firstly snoop on the mapping communicated from the PCP server to the PCP client, and secondly to communicate the mapping information to a policy server incorporating a plurality of predefined firewall rules usable in deducing appropriate PACKET ALLOW/PACKET DROP decisions, based on the mapping information.