Interception Proxy Server GRE Tunnel NAT Elimination

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional interception proxy server systems experience high state maintenance overhead and inefficiencies due to the need for a network address translation (NAT) module, which maintains large numbers of connection entries and requires passing incoming packets through a firewall twice, leading to performance issues on busy servers.

Innovation Solution

The system processes data packets in an interception proxy server without using a NAT module by encapsulating TCP packets in a generic routing encapsulation tunnel with a user-configured redirection rule, modifying the payload header, and prepending mapping information, thereby eliminating the need for a separate NAT module and reducing state maintenance overhead.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If a NAT module is used to perform network address translation in an interception proxy server, then the server can redirect TCP traffic to local destinations, but the server experiences high state maintenance overhead and performance degradation due to maintaining large numbers of connection entries

Engineering Contradiction:

Improvetraffic redirection capabilityVSAvoidstate maintenance overhead

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent extracts the address translation functionality from the traditional NAT module and integrates it directly into the GRE tunnel processing path. By removing the separate NAT module and its associated state tables, the system maintains traffic redirection capability while eliminating the performance overhead of maintaining large numbers of connection entries.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent merges the address translation function with the GRE tunnel processing. Instead of having separate NAT and tunnel processing components, the system combines these functions so that address translation is performed as part of the tunnel encapsulation/decapsulation process, eliminating redundant operations and state maintenance.

Inventive Principle:

Principle #5Merging (Combining)

2Adaptability or versatility

If a separate NAT module is used for address translation, then the system can perform D-NAT and S-NAT operations, but incoming packets must be passed through the firewall twice causing performance issues

Engineering Contradiction:

Improveaddress translation functionalityVSAvoidpacket processing throughput

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The patent combines the firewall processing and address translation operations into a single pass through the system. By integrating NAT functionality into the GRE tunnel processing path, packets are processed once through both firewall and translation operations, eliminating the need for double firewall processing and improving throughput.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The system performs address translation as part of the preliminary GRE tunnel processing before firewall inspection, so that when packets reach the firewall, the translation is already complete. This preliminary action eliminates redundant processing steps and improves overall packet processing efficiency.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If NAT module maintains state for each TCP connection, then the system can track and manage connections, but the number of state entries grows large on busy servers leading to memory and processing overhead

Engineering Contradiction:

Improveconnection tracking accuracyVSAvoidnumber of state entries

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent removes the separate connection state tracking mechanism from the NAT module. By extracting this functionality and integrating it into the GRE tunnel processing, the system maintains connection tracking accuracy while eliminating the proliferation of state entries that occurs with traditional NAT approaches.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The GRE tunnel processing itself provides the connection tracking functionality without requiring a separate NAT state table. The tunnel processing mechanism inherently tracks connections through its own data structures, eliminating the need for additional state maintenance and reducing overall memory requirements.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS7706367B2Integrated tunneling and network address translation: performance improvement for an interception proxy server

Publication Date: 2010.04.27 X CORP

AI summary

A method for processing data packets in an interception proxy server without using a Network Address Translation module. A TCP packet received at a router is encapsulated using generic routing encapsulation (GRE). The TCP packet is redirected to a proxy server through a GRE tunnel which includes a redirection rule comprising a local destination IP address and port to be used for traffic passed through the tunnel. When the proxy server receives the TCP packet, the TCP packet is decapsulated. If a flag is set in the payload header of the TCP packet indicating that a redirection rule has been configured for traffic passed through the tunnel, the payload header of the TCP packet is modified according to the redirection rule. The modified TCP packet is then passed to a transmission control protocol of the proxy server.