Remote Acceleration Gateway Packet Translation Preserving Source IP
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud service providers face difficulty in learning the source address of service request packets due to full network address translation, hindering functions like statistics and analysis.
Innovation Solution
A business service providing method that includes a border gateway and virtual forwarding device to decapsulate and encapsulate service request packets without translating the source IP address, allowing the virtual machine to learn the client's source IP address, and maintaining transparent transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If full network address translation is performed on service request packets, then network address management is simplified, but the cloud service provider cannot learn the source address of service request packets
Solution Approach 1:
The patent segments the address translation process into two distinct parts: the remote acceleration gateway performs translation only on the destination address (not the source address), while the border gateway handles source address translation. This segmentation allows the source address information to be preserved during the initial translation phase, enabling the cloud service provider to learn the source address while still maintaining simplified network address management through the structured translation approach.
Solution Approach 2:
The border gateway acts as an intermediary between the remote acceleration gateway and the cloud service provider. It receives packets from the remote acceleration gateway, performs source address translation, and forwards packets to the cloud service provider. This intermediary role ensures that the cloud service provider receives packets with proper source addresses for learning purposes, while the overall system maintains simplified address management through the coordinated translation process.
2Reliability
If full network address translation is performed, then network security is improved, but statistics and analysis functions based on source IP address cannot be implemented
Solution Approach 1:
The patent divides the address translation functionality into two stages: the remote acceleration gateway performs destination address translation for security purposes without touching the source address, preserving it for later use. The border gateway then performs source address translation. This segmentation enables both network security (through destination address translation) and statistics/analysis functions (by preserving source addresses during the first translation stage).
Solution Approach 2:
The remote acceleration gateway performs destination address translation in advance before the packet reaches the border gateway. This preliminary action secures the network by controlling destination address translation while leaving the source address intact, enabling subsequent statistics and analysis functions that require source IP address information.
3Device complexity
If source address translation is performed at the remote acceleration gateway, then network address translation is simplified, but transparent transmission of source address is lost
Solution Approach 1:
The patent segments the translation process so that the remote acceleration gateway only performs destination address translation, keeping the source address translation step separate at the border gateway. This segmentation maintains a relatively simple address translation process at each device while ensuring source address transparency is preserved until the final translation stage at the border gateway.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This application discloses a business service providing method, and relates to the field of communications technologies. The method includes: A border gateway receives a first overlay packet sent by a remote acceleration gateway, where a first service request packet is encapsulated in the first overlay packet, a source Internet Protocol IP address of the first service request packet is an IP address of a client, and a destination IP address is a public IP address associated with a virtual machine; the border gateway decapsulates the first overlay packet to obtain the first service request packet, encapsulates the first service request packet to generate a second overlay packet, and sends the second overlay packet to a virtual forwarding device; and the virtual forwarding device decapsulates the second overlay packet to obtain the first service request packet, and sends the first service request packet to the virtual machine. This application implements transparent transmission of a source address of a service request packet.