Virtual Network Data Encapsulation for NAT Bypass
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Messages intended for virtual destination addresses on networks with packet filtering or network address translation devices often fail to reach their intended destinations due to configuration limitations and rewriting of packet origins by edge devices like NAT boxes.
Innovation Solution
Encapsulating messages in higher level protocols, such as transport and application protocols, before sending them through a virtual address resolution facility that registers and resolves virtual IP addresses into real IP addresses, allowing the messages to bypass packet filtering and network address translation by accessing higher layers of the protocol stack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If messages are sent directly to virtual destination addresses through standard network layers, then network simplicity is maintained, but messages fail to reach destinations behind packet filtering or NAT devices
Solution Approach 1:
The patent implements protocol nesting by encapsulating IP packets within higher-level protocol data units. The original IP packet becomes the payload of a transport layer protocol (TCP/UDP), which is then encapsulated within application layer protocols. This nested structure allows messages to traverse NAT devices and firewalls that operate at lower layers while preserving the original message integrity at the application layer.
Solution Approach 2:
The patent transitions from operating solely at the network layer (IP address routing) to utilizing multiple protocol dimensions including transport layer (port numbers) and application layer protocols. This dimensional expansion enables messages to bypass single-layer filtering mechanisms by providing alternative routing paths through higher protocol layers that NAT devices cannot intercept or rewrite.
2Adaptability or versatility
If edge devices perform packet filtering and NAT functions, then network security and address management are improved, but virtual destination addresses on interior networks become inaccessible
Solution Approach 1:
The patent introduces reflecting agents as intermediary components that reside on interior networks behind NAT devices. These agents receive encapsulated messages, extract the original IP packets, and forward them to the appropriate interior destinations. The agents act as mediators between the external network and interior network resources, enabling access without requiring configuration changes to the NAT device itself.
Solution Approach 2:
The patent performs preliminary encapsulation of messages in higher-level protocols before they reach the edge device. This advance preparation ensures that messages are structured in a way that bypasses NAT filtering, eliminating the need for post-filtering configuration or modification. The encapsulation is performed in advance at the source, making the message compatible with restrictive network environments.
Data Source
AI summary
A method of extending the functionality of a virtual network is disclosed. Messages intended for a virtual destination address located on a network equipped with a device performing packet filtering, network address translation or a similar function on the edge of the network (an “edge device”), are encapsulated in higher level protocols prior to being sent to the edge device. The virtual destination address may be associated with a process on the edge device or a process on another device in the interior of the network. Higher level protocol designations, including transport protocol designations accompanied by a port number and application protocol designations, are retrieved from an extended virtual address registration. Messages arriving at the edge device are determined by the Network layer to contain a higher level protocol and are passed up the Internet Protocol model stack to a higher layer. The higher layers of the edge device, such as the Transport layer and the Application layer, may be accessible and therefore configurable to a non-Systems Administrator thus allowing the message to reach the intended virtual destination address.