Relayed NAT Traversal for HTTP Server Accessibility
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network Address Translators (NATs) limit access to servers behind them, making it difficult for external users to access HTTP servers and other applications, as they require globally unique IP addresses and specific port configurations, which is complex for typical users to manage, and existing solutions like DMZ and UPnP have drawbacks such as security vulnerabilities and hardware requirements.
Innovation Solution
A NAT-discovery process using STUN tests determines the presence of a NAT, and a packet relay server with a redirect server and DDNS updates facilitate seamless communication by relaying HTTP requests and responses through a packet relay server, allowing hosts behind NATs to appear as if they are directly connected to the public network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If a NAT is used to share a single IP address among multiple computers, then IP address space efficiency is improved, but accessibility of servers behind NAT from the public internet deteriorates
Solution Approach 1:
The patent introduces a port mapping mechanism that acts as an intermediary between the public internet and servers behind NAT. The NAT device maintains a mapping table that associates external port numbers with internal server addresses and ports, allowing external users to access backend servers through the mapping relationship without requiring the servers to have directly accessible public IP addresses.
2Ease of operation
If port forwarding is configured to access specific computers behind NAT, then accessibility to specific applications is improved, but device complexity and configuration difficulty increase
Solution Approach 1:
The patent implements a self-service port mapping mechanism where the NAT device automatically discovers and configures port mappings based on service registration information. Services can register their mapping relationships with the NAT device, and the NAT device automatically maintains the mapping table, eliminating the need for manual configuration by users while still providing targeted access to specific applications.
3Ease of operation
If DMZ is used to allow direct internet connection to a machine behind NAT, then accessibility is improved, but security vulnerabilities increase
Solution Approach 1:
The patent applies local quality by implementing selective port mapping that grants different levels of access to different services. Instead of placing the entire system in a DMZ with uniform high accessibility, the NAT device creates localized access paths for specific services that require external access, while maintaining default security for other services. This allows targeted accessibility improvement without compromising overall system security.
Data Source
AI summary
Network Address Translator (NAT) traversal is performed for a host located behind the NAT running a server, e.g., an HTTP server, using a relay server and a redirect server. The host (of the HTTP server) located behind the NAT uses a NAT-discovery process to determine the presence of the interposed NAT. Seamless IP communication over the IP network is provided using a Dynamic DNS (DDNS) system that is updated using a user registration database, which contains information about the presence or absence of a NAT relative to the HTTP server.