Back to results
US 8,701,179 B1Granted
Secure network address translation
AssigneeJuniper Networks, Inc.
InventorsReinaldo Penno, Sarat Kamisetty, Alexander Arseniev, Rajesh Mohan, Mayuresh Bakshi
Life of this patent
Estimating the term…
Abstract
Techniques are described for providing secure network address translation (NAT) in a NAT device that provides endpoint-independent mapping (EIM) and endpoint-independent filtering (EIF) operations.
Claims18
A network device comprising:
- a plurality of interfaces configured to send and receive packets for communication sessions associated with subscribers of a service provider network;
- a database storing network address translation (NAT) bindings that map private network addresses of the subscribers to public network addresses, wherein the database stores session data for the communication sessions associated with the NAT bindings;
- a NAT controller that provides network address translation for the packets to translate between the private network addresses the public network addresses;
- an interface that provides a refresh control input to control refresh of the communication sessions associated with the NAT bindings;
- wherein the NAT controller maintains a session timer for each of the communication sessions and removes session data for a communication session from the database when the session timer indicates that packets have not been detected on the communication session for a threshold amount of time,
- wherein, responsive to receiving outbound packets from the subscribers, the NAT controller processes each of the outbound packets to determine whether the outbound packet comprises an outbound data packet or an outbound error message, and
- wherein, in accordance with a security setting of the refresh control input, the NAT controller restarts the session timer in response to determining the outbound packet comprises an outbound data packet from the subscribers and does not restart the session timer in response to determining the outbound packet comprises an outbound error message sent by the subscribers in reply to inbound packets.
4 more elements
A method comprising:
- receiving, with a network device, packets for a communication session associated with a subscriber of a service provider network;
- processing the packets with the network device to translate between a private network address of the subscriber and a public network address;
- maintaining a session timer for the communication sessions that indicates when packets have not been detected on the communication session for a threshold amount of time,
- responsive to receiving outbound packets from the subscriber, processing each of the outbound packets to determine whether the outbound packet comprises an outbound data packet or an outbound error message, and
- restarting the session timer in response to determining the outbound packet comprises an outbound data packet from the subscriber and not restarting the session timer in response to determining the outbound packet comprises an outbound error message sent by the subscriber in reply to inbound packets.
2 more elements
A network router comprising:
- a plurality of interfaces configured to send and receive packets for communication sessions associated with subscribers of a service provider network;
- a routing engine comprising a control unit that executes a routing protocol to maintain routing information specifying routes through a network;
- a forwarding component configured by the routing engine to select next hops for the packets in accordance with the routing information, the forwarding component comprising a switch fabric to forward the packets to the interfaces based on the selected next hops;
- and
- a database storing network address translation (NAT) bindings that map private network addresses of the subscribers to public network addresses, wherein the database stores session data for the communication sessions associated with the NAT bindings;
- a NAT controller that provides network address translation for the packets to translate between the private network addresses the public network addresses;
- an interface that provides a refresh control input to control refresh of the communication sessions associated with the NAT bindings;
- wherein the NAT controller maintains a session timer for each of the communication sessions and removes session data for a communication session from the database when the session timer indicates that packets have not been detected on the communication session for a threshold amount of time,
- wherein, responsive to receiving outbound packets from the subscribers, the NAT controller processes the outbound packets to determine whether each of the outbound packets comprises an outbound data packet or an outbound error message, and
- wherein, in accordance with the refresh control input, the NAT controller restarts the respective session timer for each of the communication sessions associated with a respective subscriber in response to determining the outbound packet comprises an outbound data packet from the respective subscriber and does not restart the session timer in response to determining the outbound packet comprises an outbound error message sent by the respective subscriber in reply to inbound packets.
7 more elements
Dependencies are inferred from the claim text.