Supplemental DNAT Hub Routing Across Overlapping Private IP Spaces

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional cloud computing systems cannot facilitate communication between virtual networks with overlapping IP addresses, preventing processes like onboarding new partners or integrating new acquisitions due to non-routable IP networks.

Innovation Solution

Implementing a DNAT hub (firewall) that performs destination network address translation (DNAT) to translate destination IP addresses and enable communication between overlapping private networks by applying routing rules based on source and destination IP addresses.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If conventional NAT is used at the firewall, then communication from the public internet to private networks is enabled, but communication between virtual networks with overlapping IP addresses cannot be facilitated

Engineering Contradiction:

Improvecommunication capability between virtual networksVSAvoidrouting complexity for overlapping IP spaces

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent introduces a DNAT hub as an intermediary device between virtual networks with overlapping IP addresses. The hub receives packets with its own IP as destination, translates the destination IP address to the target virtual network's IP address using routing rules, and forwards the packet. This intermediary approach enables communication between overlapping networks without requiring complex routing configurations at each firewall or router.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the network communication process by introducing a dedicated DNAT hub that handles IP address translation specifically for overlapping virtual networks. This separates the routing complexity from the standard firewall NAT functionality, allowing conventional NAT to continue working for public internet access while the DNAT hub handles inter-virtual-network communication.

Inventive Principle:

Principle #1Segmentation

2Manufacturing precision

If IP address translation is performed without source IP evaluation, then routing simplicity is maintained, but accurate routing to the correct subnetwork cannot be determined in overlapping IP address spaces

Engineering Contradiction:

Improverouting accuracy to correct subnetworkVSAvoidpacket evaluation complexity

Core Design Contradiction:

Manufacturing precisionVSDevice complexity

Solution Approach 1:

The patent implements preliminary action by evaluating the source IP address of incoming packets before performing DNAT translation. The DNAT hub checks routing rules against the source IP address to determine which virtual network the packet originated from, and then applies the appropriate translation rule. This ensures accurate routing decisions are made before the packet is forwarded, preventing misrouting in overlapping IP address spaces.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If conventional cloud computing services are used, then hardware support for customer virtual networks is provided, but processes like onboarding new partners or integrating new acquisitions are prevented

Engineering Contradiction:

Improveability to onboard partners and integrate acquisitionsVSAvoidnetwork routability

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The DNAT hub acts as a mediator that enables new virtual networks with overlapping IP addresses to be integrated into the existing cloud computing environment. By providing a standardized mechanism for IP address translation, the hub allows partners and acquisitions to be onboarded without requiring changes to their existing network configurations, thereby improving adaptability while maintaining network reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Productivity

If DNAT is applied without source IP address evaluation, then processing speed is maintained, but routing rules cannot be accurately applied to translate destination IP addresses

Engineering Contradiction:

Improvepacket processing speedVSAvoidrouting rule matching accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The patent performs preliminary evaluation of the source IP address against routing rules before applying DNAT translation. This preliminary action ensures that the correct translation rule is selected based on the source network, improving routing precision. The evaluation is performed efficiently using predefined routing rules, minimizing impact on packet processing speed.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentEP4657827A1Supplemental DNAT for communication within overlapping IP address space in a private network

Publication Date: 2025.12.03 MICROSOFT TECHNOLOGY LICENSING LLC

Figure 1
Figure 2
Figure 3

AI summary

A system may receive, at a firewall, a data packet destined to a conflicting private IP address of the first private subnetwork and the second private subnetwork within the private network, the data packet including a destination IP address identifying the firewall. The system may evaluate, at the firewall, the data packet to determine whether a source IP address of the data packet satisfies a routing condition corresponding to a routing rule. The system may apply, at the firewall, the routing rule to determine a translated destination IP address of the first private subnetwork. The system may send the data packet to the first private subnetwork.