SDN Controller End-Station Identification Across NAT
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Public cloud applications face challenges in uniquely identifying end-stations on private networks due to network address translation (NAT), as standard identification methods like IP addresses are lost when packets traverse a NAT router, and existing solutions require explicit actions or modifications to end-stations, limiting their applicability to legacy devices.
Innovation Solution
Employing a Software-Defined Networking (SDN) framework using the OpenFlow protocol to modify packets with unique parameters, allowing external applications to identify end-stations even after NAT, by assigning communication parameters such as IP destination addresses, source port values, or IP Options, and using hash values to map packets to specific end-stations without requiring explicit actions from the end-stations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If standard identification methods (IP address) are used to identify end-stations, then identification is simple, but the identification fails after packets traverse a NAT router
Solution Approach 1:
The patent introduces an intermediary mechanism where the controller acts as a mediator between the data-path device and external applications. The controller receives packets from the data-path device, extracts end-station identification information before NAT translation occurs, and provides this information to external applications. This intermediary approach preserves the original IP address information that would otherwise be lost during NAT routing.
Solution Approach 2:
The patent applies preliminary action by extracting and capturing the original end-station IP address information from packets before they traverse the NAT router. The controller intercepts packets at the data-path device, extracts the source IP address field before NAT translation occurs, and stores this information for later use. This preliminary extraction ensures the original identification information is preserved despite subsequent NAT operations.
2Measurement precision
If explicit actions or modifications are required from end-stations for identification, then identification can be achieved, but legacy end-stations cannot be identified
Solution Approach 1:
The patent implements self-service by having the network infrastructure (controller and data-path device) perform the identification function automatically without requiring any actions from the end-stations. The controller automatically extracts IP address information from packets passing through the data-path device and makes this information available to external applications. This eliminates the need for end-station modifications while maintaining identification capability for all legacy devices.
3Measurement precision
If packets are modified to contain unique parameters for identification, then end-station identification is enabled across NAT, but packet modification complexity increases
Solution Approach 1:
The patent applies extraction by separating the identification function from the packet data itself. Instead of modifying packets to carry unique parameters, the system extracts the original IP address information from packets at the data-path device and stores it in a separate data structure. External applications query this data structure to obtain end-station identification information, eliminating the need for complex packet modifications while maintaining accurate identification.
Data Source
AI summary
A protocol such as OpenFlow providing communication between an SDN framework controller on one network and a data plane device for another network can be used to modify or process network packets so that an external application or server can communicate with the controller and obtain information needed to uniquely associate the packets with particular end-stations even after those packets have traversed a NAT router.