Unified NAT Gateway Configuration for Multi-VPC Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud computing systems require separate public and private NAT gateways for different network access scenarios, leading to increased development and maintenance costs, complex configurations, and security risks due to the lack of centralized access control.

Innovation Solution

A method for configuring a unified NAT gateway that integrates public and private NAT functions, providing a single cloud service with multi-egress capability and access control, managed through a cloud management platform.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If separate public and private NAT gateways are deployed for different network access scenarios, then network access functionality is improved, but device complexity and maintenance costs increase

Engineering Contradiction:

Improvenetwork access functionalityVSAvoidgateway quantity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent merges public NAT gateway and private NAT gateway functions into a single unified NAT gateway. The gateway maintains separate network interfaces - one connected to public network and another to private VPC - allowing it to perform both public internet access and private VPC intercommunication functions simultaneously, eliminating the need for separate gateway deployments

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The unified NAT gateway is designed with multi-functionality to handle diverse network access scenarios. It can perform source NAT for public internet access, destination NAT for public service exposure, and private NAT for VPC intercommunication, all through a single gateway instance with configurable routing rules

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Adaptability or versatility

If separate public and private NAT gateways are deployed, then network access functionality is improved, but operation and maintenance costs increase

Engineering Contradiction:

Improvenetwork access functionalityVSAvoidmaintenance costs

Core Design Contradiction:

Adaptability or versatilityVSLoss of energy

Solution Approach 1:

By combining multiple NAT gateway functions into one unified gateway, the patent reduces the total number of devices requiring deployment, monitoring, and maintenance. This consolidation directly lowers operation and maintenance costs while preserving all necessary network access capabilities

Inventive Principle:

Principle #5Merging (Combining)

3Adaptability or versatility

If separate public and private NAT gateways are deployed, then network access functionality is improved, but configuration complexity increases

Engineering Contradiction:

Improvenetwork access functionalityVSAvoidconfiguration complexity

Core Design Contradiction:

Adaptability or versatilityVSEase of operation

Solution Approach 1:

The unified NAT gateway provides a single configuration interface and management point for all NAT operations. Users can configure different NAT rules (source NAT, destination NAT, private NAT) and routing policies through one gateway, simplifying configuration management compared to coordinating multiple separate gateways

Inventive Principle:

Principle #6Universality (Multi-functionality)

4Adaptability or versatility

If separate public and private NAT gateways are deployed, then network access functionality is improved, but security control effectiveness decreases

Engineering Contradiction:

Improvenetwork access functionalityVSAvoidsecurity control

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The unified NAT gateway consolidates security control functions in a single device with centralized management. It implements access control lists (ACLs) and routing policies that can differentiate between public and private traffic flows, providing enhanced security control effectiveness compared to distributed gateway configurations

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS20250379845A1Method for Configuring Network Address Translation Gateway and Cloud Management Platform

Publication Date: 2025.12.11 HUAWEI CLOUD COMPUTING TECHNOLOGIES CO LTD

AI summary

A method for configuring a network address translation NAT gateway based on a public cloud service including: a cloud management platform obtains NAT gateway creation information that is input by a tenant; The cloud management platform creates the NAT gateway in the first VPC based on the NAT gateway creation information; The cloud management platform obtains configuration information that is input by the tenant and applied to the NAT gateway; The cloud management platform sets, based on the identifier of the second VPC, the NAT gateway to be connected to the second VPC, and sends the first NAT rule to the NAT gateway, where the first NAT rule is used to indicate the NAT gateway to: bind a first network segment in the first VPC to a first elastic IP address EIP; and bind the first network segment in the first VPC to a first transit private IP address.