Network address translation in a network having multiple overlapping address domains

A technique for translating addresses in a communication network having multiple overlapping address domains involves mapping an overlapping local address from a first address domain to a unique global address that is specific to a second address domain. The unique global address is used by any device in the second address domain to reference the device in the first address domain having the overlapping local address. Furthermore, a packet sent from a source host in the first address domain to a destination host in the second address domain requires at least a source address translation in order to translate the source host local address used within the first address domain into a source host global address that is used within the second address domain, and may also require a destination address translation in order to translate the destination host global address used within the first address domain into a destination host local address used within the second address domain.

FIELD OF THE INVENTION

The present invention relates generally to communication networks, and, more particularly, to translating network addresses in a network having multiple overlapping address domains.

BACKGROUND OF THE INVENTION

In today's information age, communication networks are increasingly used for transferring information among a multitude of communication devices. As demand for communication services continues to grow, the demand on these communication networks for carrying increasing amounts of information at increasing speeds continues to grow. Therefore, communication networks are evolving to more efficiently handle these increased demands.

In a common networking model, a large communication network is typically constructed by segregating the multitude of communication devices into a number of subnetworks, and internetworking the subnetworks over a high-speed backbone network. In such a communication network, each communication device is typically assigned a network address that is used for routing packets between a source communication device and a destination communication device within the communication network. In order to permit efficient use of these network addresses, the communication network may be logically divided into multiple address domains. Network addresses are required to be unique within a particular address domain, but are not required to be unique across multiple address domains.

Unfortunately, when the communication network is logically divided into multiple address domains having overlapping network addresses, a particular network address may map to multiple communication devices, in which case the network address does not uniquely identify one communication device within the communication network. Such an overlapping network address cannot be used as the destination address of a packet because it is ambiguous as to the destination communication device for the packet. Likewise, such an overlapping network address, when used as the source address of a packet, is ambiguous as to the source communication device for the packet.

Thus, a need has remained for a network address translation technique for resolving ambiguous network addresses across multiple overlapping address domains.

SUMMARY OF THE INVENTION

In accordance with one aspect of the invention, an overlapping local address from an inbound address domain is translated into a unique global address that is specific to a specified outbound address domain.

In accordance with another aspect of the invention, a network address translator receives a translation request message that includes the overlapping local address and specifies the outbound address domain. The network address translator transmits a translation response message including the unique global address for the outbound address domain that maps to the overlapping local address in the inbound address domain.

In accordance with yet another aspect of the invention, a network address translator receives a packet that includes a source address equal to an overlapping source host local address in a source (inbound) address domain, and also includes a destination address equal to a unique destination host global address. The network address translator maintains a number of source address translation entries, where each source address translation entry maps a source host local address from a source (inbound) address domain into a unique source host global address that is specific to a destination (outbound) address domain. In order to translate the source address of the packet, the network address translator finds the source address translation entry that maps the source host local address from the source (inbound) address domain to the unique source host global address for the destination (outbound) address domain, extracts the source host global address from the source address translation entry, and inserts the source host global address as the source address of the packet. The network address translator may also maintain a number of destination address translation entries, where each destination address translation entry maps a unique destination host global address for a source (inbound) address domain to a destination host local address for a destination (outbound) address domain. In order to translate the destination address of the packet, the network address translator finds the destination address translation entry that maps the destination host global address to the destination host local address for the destination (outbound) address domain, extracts the destination host local address from the destination address translation entry, and inserts the destination host local address as the destination address of the packet

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT

As discussed above, a need has remained for a network address translation technique for resolving ambiguous network addresses across multiple overlapping address domains. In accordance with the present invention, a network address translator (NAT) maps an overlapping domain-specific network address in a first address domain (referred to hereinafter as a “local address”) to a unique global address that is specific to a second address domain. Thus, the overlapping network address in the first address domain may map to multiple global addresses, where each global address is unique to one of the other address domains. The NAT uses the network address mappings to translate the source address and/or the destination address of a packet before the packet is routed from the source communication device (referred to hereinafter as the “source host”) to its intended destination communication device (referred to hereinafter as the “destination host”). Specifically, the NAT translates the destination address from a destination host global address (which uniquely identifies both the source address domain and the destination address domain) to its corresponding destination host local address, upon determining that the destination address requires an address translation. Likewise, the NAT translates the source address from an overlapping source host local address to a unique source host global address based upon the source address domain and the destination address domain, upon determining that the source address requires an address translation. By translating the source address and/or the destination address, the resulting packet is able to be routed to the destination host in the destination address domain using the destination host local address, and the destination host is able to uniquely identify the source host for the packet using the unique source host global address.

Network address translation has been used in the past to allow local addresses to be reused within a communication network. One prior art network address translation technique is described in an Internet Engineering Task Force (IETF) document entitledThe IP Network Address Translator(NAT), by K. Egevang and P. Francis (May 1994). In a typical prior art embodiment, the NAT maps a local address to a single global address irrespective of the destination address domain. Thus, when the local address is included as the source address in a packet, the NAT translates the local address into the global address without regard for the destination address domain before forwarding the packet to the destination host. Likewise, when the global address is included as the destination address in a packet, the NAT translates the global address into the local address before routing the packet to the destination host.

In certain networking models, it is desirable for the local address to map to a different global address for each destination address domain. The present invention provides a network address translation technique that allows the local address to be mapped to a different global address for each destination address domain. Specifically, a preferred NAT maps the local address to a different global address for each destination address domain, where each global address is unique within the communication network and maps uniquely to the local address. When the local address is included as the source address in a packet transmitted to a particular destination address domain, the preferred NAT translates the local address into the specific global address for the destination address domain. Likewise, when a global address is included as the destination address of a packet, the preferred NAT translates the global address into the local address.

In a preferred embodiment of the present invention, the NAT performs address translations for routing packets in a communication network having multiple overlapping address domains, such as the exemplary communication network100as shown in FIG.1. In the exemplary communication network100, there are three (3) hosts that share a common network address A across three (3) overlapping address domains, namely host X110in address domain1, host Y120in address domain2, and host Z130in address domain3. There is also one (1) host with a non-overlapping network address, namely host B140in address domain4. Thus, the address A represents the local address for each host that uniquely identifies a particular host within its own address domain. Unfortunately, the address A is ambiguous within the entire communication network100, since it does not uniquely identify a specific host within the entire communication network100. Therefore, the communication network100includes a NAT102to perform, among other things, the network address translations needed to resolve the ambiguity of the address A within the communication network100.

In order for a host in an address domain q to reference a host in an address domain p having the overlapping address A, the NAT102maps the overlapping address A from the address domain p to a global address that is unique to the address domain q and is also unique within the communication network100. For convenience, the global address for a host having the local address A in the address domain p when referenced from a host in the address domain q is represented by the symbol Apq. Thus, Apq is the global address for the address A in address domain p when referenced from address domain q.

Thus, with reference to the example shown inFIG. 1, the NAT102typically maintains at least the following global address mappings:

A12is the host X global address when referenced from address domain2;

A13is the host X global address when referenced from address domain3;

A14is the host X global address when referenced from address domain4;

A21is the host Y global address when referenced from address domain1;

A23is the host Y global address when referenced from address domain3;

A24is the host Y global address when referenced from address domain4;

A31is the host Z global address when referenced from address domain1;

A32is the host Z global address when referenced from address domain2; and

A34is the host Z global address when referenced from address domain4.

In a preferred embodiment of the present invention, the NAT102maintains a separate source address translation table for each overlapping address domain, and maintains a single destination address translation table. Each source address translation table maps the overlapping network addresses in the source address domain to the corresponding global addresses for each of the potential destination address domains. The destination address translation table maps the global addresses to their corresponding local addresses.

Thus, in the example shown inFIG. 1, the preferred NAT102maintains three (3) source address translation tables and one (1) destination address translation table. An exemplary source address translation table for address domain1, shown inFIG. 2A, maps the host X local address (i.e., A) to the respective host X global addresses for domains2,3, and4(i.e., A12, A13, and A14, respectively). An exemplary source address translation table for address domain2, shown inFIG. 2B, maps the host Y local address (i.e., A) to the respective host Y global addresses for domains1,3, and4(i.e., A21, A23, and A24, respectively). An exemplary source address translation table for address domain3, shown inFIG. 2C, maps the host Z local address (i.e., A) to the respective host Z global addresses for domains1,2, and4(i.e., A31, A32, and A34, respectively). No source address translation table is maintained for address domain4, since, in this example, address domain4has no overlapping network addresses. An exemplary destination address translation table, shown inFIG. 2D, maps the global addresses to their corresponding local addresses.

It should be noted that, by maintaining the source (inbound) domain and the destination (outbound) domain in the tables, it is possible to combine all source address translation tables into a single source address translation table. It should also be noted that, by maintaining the source (inbound) domain and the destination (outbound) domain in the tables, the source table(s) and the destination table provide redundant information, such that, for example, the source address translation table(s) can be searched in reverse to obtain a local address corresponding to a particular global address, or the destination address translation table can be searched in reverse to obtain a global address corresponding to a particular local address in the source address domain. These and other alternative embodiments will be apparent to a skilled artisan.

In order to transfer a packet from the source host in the source address domain to the destination host in the destination address domain using network address translation, the appropriate entries must be created in the source address table(s) and the destination address table. Specifically, for any network address that must be translated, there must be a source address translation table entry mapping the source host local address in the source address domain to a unique source host global address for the destination address domain, and there must be a destination address translation table entry mapping the source host global address for the destination address domain back to the source host local address in the source address domain.

Typically, the address translation table entries are created dynamically by the NAT102, although the address translation table entries may alternatively be created manually. In order for the NAT102to create a source address translation table entry and its corresponding destination address translation table entry, the NAT102is provided with at least a source host local address, a source address domain identifier, and a destination address domain identifier. The NAT102selects a source host global address from a pool of global network addresses, and creates the address translation table entries. Specifically, the NAT102creates a source address translation table entry mapping the source host local address in the source address domain to the selected source host global address for the destination address domain, and creates a destination address translation entry mapping the selected source host global address for the destination address domain to the source host local address in the source address domain.

FIG. 3is a logic flow diagram showing exemplary NAT102logic for creating a source address translation table entry and its corresponding destination address translation table entry. Beginning at step302, the logic receives a host local address, a first address domain identifier identifying the host address domain, and a second address domain identifier identifying an address domain from which the host is referenced, in step304. The logic proceeds to select a unique global address for the host, in step306, preferably from a pool of global addresses maintained by the NAT102. Upon selecting the unique global address in step306, the logic creates a source address translation table entry in the first address domain's source address translation table, in step308, and a corresponding destination address translation table entry, in step310. The source address translation table entry maps the host local address in the first address domain to the selected global address for the second address domain. The destination address translation table entry maps the selected global address to the host local address in the first address domain. The logic terminates in step399.

In a preferred embodiment of the present invention, the NAT102dynamically creates certain address translation table entries as part of a domain name resolution procedure, and dynamically creates other address translation entries as part of a packet processing procedure (described in more detail below). The domain name resolution procedure is described in the related U.S. patent application entitled DOMAIN NAME RESOLUTION IN A NETWORK HAVING MULTIPLE OVERLAPPING ADDRESS DOMAINS, which was incorporated by reference above. The domain name resolution procedure enables the source host to obtain a destination host global address for the destination host based upon a domain name of the destination host. More particularly, in order for the source host to transmit a packet to the destination host, the source host is provided with a domain name that is associated with the destination host. The domain name uniquely identifies the destination host, although the domain name is not a network address. The source host invokes the domain name resolution procedure in order to resolve the domain name into the destination host global address. Because the destination host local address may overlap with other addresses when the communication network includes multiple overlapping address domains, a preferred domain name resolution procedure utilizes network address translation to translate the overlapping destination host local address into a unique destination host global address.

Specifically, in order for the source host to resolve the destination host domain name into the destination host global address, the source host sends a domain name resolution request to a local DNS Server in the source address domain. The domain name resolution request includes, among other things, a source address equal to the source host local address and the domain name associated with the destination host. The local DNS Server in the source address domain maintains a cache of domain name/network address mappings for hosts within the source address domain. Upon receiving the domain name resolution request from the source host, the local DNS Server in the source address domain determines the destination host domain name corresponds to a host in a different address domain. The local DNS Server therefore sends a domain name resolution request to the DNS Proxy104.

The DNS Proxy104performs domain name resolution across multiple address domains. Upon receiving the domain name resolution request from the local DNS Server in the source address domain, the DNS Proxy104determines the destination address domain for the destination host domain name, and sends a domain name resolution request to the local DNS Server in the destination address domain. The local DNS Server in the destination address domain maintains a cache of domain name/network address mappings for hosts within the destination address domain. Upon receiving the domain name resolution request from the DNS Proxy104, the local DNS Server122in the destination address domain resolves the domain name, and returns the destination host local address to the DNS Proxy104.

Upon receiving the destination host local address from the local DNS Server in the destination address domain, the DNS Proxy104sends a translation request to the NAT102to translate the destination host local address into a unique destination host global address. The translation request includes, among other things, a source address domain identifier, the destination host local address, and a destination address domain identifier.

The NAT102maintains a pool of global network addresses, and also maintains a number of address translation entries, where each address translation entry maps a local host address from one address domain to a global address that is specific to another address domain. Upon receiving the translation request from the DNS Proxy104, the NAT102first determines whether there is an existing address translation table entry mapping the destination host local address to a destination host global address that is specific to the source address domain. If there is not an existing address translation table entry mapping the destination host local address to a destination host global address that is specific to the source address domain, then the NAT102creates the appropriate address translation table entries. Specifically, the NAT102selects a destination host global address from the pool of global network addresses, and creates both a source address translation entry and a corresponding destination address translation entry mapping the destination host local address to the destination host global address specifically for the source address domain. The source address translation table entry includes a Source Local Address field equal to the destination host local address, a Source Address Domain field equal to the destination address domain, a Destination Address Domain field equal to the source address domain, and a Source Global Address field equal to the selected destination host global address. The corresponding destination address translation table entry includes a Destination Global Address field equal to the selected destination host global address, a Source Address Domain field equal to the source address domain, a Destination Address Domain field equal to the destination address domain, and a Destination Local Address field equal to the destination host local address. The NAT102sends a translation response to the DNS Proxy104including the destination host global address.

Upon receiving the translation response from the NAT102, the DNS Proxy104sends a domain name resolution response to the local DNS Server in the source address domain including the destination host global address. The local DNS Server in the source address domain, in turn, sends a domain name resolution response to the source host including the destination host global address. Thus, the domain name associated with the destination host is resolved into a unique destination host global address that the source host can use to transmit a packet to the destination host.

FIG. 4is a message flow diagram showing an exemplary message exchange among the source host in the source address domain, the local DNS Server in the source address domain, the DNS Proxy104, the local DNS Server in the destination address domain, and the NAT102for resolving the destination host domain name into the unique destination host global address. Specifically, the source host sends a domain name resolution request message402to the local DNS Server in the source address domain including, among other things, a source address equal to the source host local address and the destination host domain name. Since the local DNS Server in the source address domain is unable to resolve the destination host domain name, the local DNS Server in the source address domain sends a domain name resolution request message403to the DNS Proxy104. The DNS Proxy104, in turn, sends a domain name resolution request message404to the local DNS Server in the destination address domain including, among other things, the destination host domain name. Upon receiving the domain name resolution request message404, the local DNS Server in the destination address domain resolves the destination host domain name into its corresponding destination host local address, and sends a domain name resolution response message406to the DNS Proxy104including, among other things, the destination host local address. Upon receiving the domain name resolution response message406including the destination host local address, the DNS Proxy104sends a translation request message408to the NAT102including, among other things, the source address domain identifier, the destination host local address, and the destination address domain identifier. Upon receiving the translation request message408, the NAT102creates the appropriate address translation entries, if necessary, and sends a translation response message410to the DNS Proxy104including, among other things, the destination host global address. The DNS Proxy104sends a domain name resolution response message412to the local DNS Server in the source address domain, which, in turn, sends a domain name resolution response message414to the source host including, among other things, the destination host global address.

FIG. 5is a logic flow diagram showing exemplary DNS Proxy104logic for resolving a domain name in a network having multiple overlapping address domains. Beginning in step502, the DNS Proxy104receives the domain name resolution request message403, in step504. The domain name resolution request message403includes, among other things, the destination host domain name associated with the destination host in the destination address domain.

The DNS Proxy104sends the domain name resolution request message404to the local DNS Server in the destination address domain, in step506. The domain name resolution request message404includes, among other things, the destination host domain name. The DNS Proxy104then monitors for the domain name resolution response message406from the local DNS Server in the destination address domain including the destination host local address.

Upon receiving the domain name resolution response message406including the destination host local address, in step508, the DNS Proxy104sends the translation request message408to the NAT102, in step510. The translation request message408includes, among other things, the source address domain identifier, the destination host local address, and the destination address domain identifier. The DNS Proxy104then monitors for the translation response message410from the NAT102including the destination host global address.

Upon receiving the translation response message410from the NAT102, in step512, the DNS Proxy104sends the domain name resolution response message412, in step514. The domain name resolution response message412includes, among other things, the destination host global address. The DNS Proxy104logic terminates in step599.

FIG. 6is a logic flow diagram showing exemplary NAT102logic for translating the destination host local address into the unique destination host global address that is specific to the source address domain as part of the domain name resolution procedure. Beginning in step602, the NAT102receives the translation request message408from the DNS Proxy104, in step604. The translation request message408includes, among other things, the source address domain identifier, the destination host local address, and the destination address domain identifier. The NAT102then searches the address translation entries for an address translation entry mapping the destination host local address in the destination address domain to a unique destination host global address for the source address domain, in step606. If the NAT102finds such an address translation entry (YES in step608), then the NAT102proceeds to step618. Otherwise (NO in step608), the NAT102creates the source address translation table entry and the corresponding destination address translation entry.

In order to create the address translation table entries, the NAT102first selects a unique destination host global address, in step612, preferably from a pool of global network addresses maintained by the NAT102. Upon selecting the destination host global address in step612, the NAT102creates a source address translation table entry in the destination address domain's source address translation table, in step614, and a corresponding destination address translation table entry, in step616. The source address translation table entry maps the destination host local address in the destination address domain to the destination host global address for the source address domain. The destination address translation table entry maps the destination host global address to the destination host local address in the destination address domain.

In step618, the NAT102sends the translation response message412including the destination host global address. The NAT102logic terminates in step699.

Once the source host has obtained the destination host global address, either through domain name resolution or some other means, the source host transmits a packet including, as the destination address, the destination host global address for the source address domain, and, as the source address, the source host local address. The destination address uniquely identifies the destination host within the communication network100. However, the source address is an ambiguous address within the communication network100.

Upon receiving the packet, the NAT102uses the destination address to determine, among other things, the destination address domain for the packet. However, the NAT102cannot simply route the packet to the destination host over the destination address domain using traditional routing techniques. This is because the destination address in the packet is not equal to the destination host local address in the destination address domain, and, consequently, the packet would not be received by the destination host in the destination address domain.

Therefore, after determining that the packet requires address translation, the NAT102translates the destination address from the destination host global address into the destination host local address. In order to translate the destination address, the NAT102uses the destination address translation table to obtain the destination host local address, specifically by finding the destination address translation table entry corresponding to the destination host global address and obtaining therefrom the destination host local address.

In certain situations, the NAT102may also have to translate the source address in the packet from the source host local address in the source address domain into a unique source host global address for the destination address domain. Such an address translation is required when the source host local address is an overlapping address within the communication network. The source address translation is done so that the destination host receives a globally unique source address that uniquely identifies the source host within the communication network. The source address can therefore be used by the destination host, for example, to send a response packet to the source host.

In order to translate the source address, the NAT102first determines both the source domain (either implicitly based upon the interface over which the packet is received or explicitly from the destination address translation table entry) and the destination domain (from the destination address translation table entry) for the packet The NAT102then searches the address translation entries to find an address translation entry mapping the source host local address in the source address domain to a source host global address for the destination address domain. If the NAT102finds such an address translation entry, then the NAT102translates the source address in the packet by extracting the source host global address from the address translation entry and replacing the source host local address in the packet with the source host global address. However, if there is no address translation entry mapping the source host local address in the source address domain to a source host global address for the destination address domain, then the NAT102dynamically allocates a source host global address for the destination address domain, creates the appropriate address translation entries, and translates the source address in the packet by replacing the source host local address in the packet with the dynamically allocated source host global address.

More specifically, the NAT102first selects the source host global address from a pool of network addresses. The NAT102then creates a source address translation table entry in the source address translation table for the source address domain and a corresponding destination address translation table entry in the destination address translation table. The source address translation table entry includes a Source Local Address field equal to the source host local address, a Source Address Domain field equal to the source address domain, a Destination Address Domain field equal to the destination address domain, and a Source Global Address field equal to the selected source host global address. The corresponding destination address translation table entry includes a Destination Global Address field equal to the selected source host global address, a Source Address Domain field equal to the destination address domain, a Destination Address Domain field equal to the source address domain, and a Destination Local Address field equal to the source host local address.

After translating either the destination address, the source address, or both addresses in the packet, the NAT forwards the translated packet to the destination host over the destination address domain.

The network address translations described above can be demonstrated by example. Two examples are set forth below. The first example follows the network address translations of a packet sent by the host X110to the host Y120and a corresponding response packet sent by the host Y120back to the host X110. The second example follows the network address translations of a packet sent by the host X110to the host B140and a corresponding response packet sent by the host B140back to the host X110. In these examples, it is assumed that the host X110has obtained the destination address using domain name resolution or some other means. For convenience, the convention (S, D) is used to indicate a packet having source address S and destination address D.

FIG. 7is a message flow diagram showing an exemplary packet exchange between the host X110in the address domain1and the host Y120in the address domain2. The host X110transmits the packet702including, as the source address, the host X local address (i.e., A), and, as the destination address, the host Y global address for address domain1(i.e., A21). The host Y global address A21uniquely identifies the host Y120within the communication network100. However, the host X local address A is ambiguous within the communication network100, since it does not uniquely identify the host X110.

Upon receiving the packet702, the NAT102determines that both the source address and the destination address require address translation. In order to translate the destination address, the NAT102uses the destination address translation table shown inFIG. 2Dto find the destination address translation table entry226corresponding to the destination address A21, and obtains therefrom the host Y local address A. In order to translate the source address, the NAT102obtains the destination address domain from the destination address translation table entry226(i.e., address domain2), and also determines the source address domain (i.e., address domain1) either implicitly based upon the interface over which the packet702is received or explicitly from the destination address translation table entry226. The source address domain indicates the particular source address translation table required for the source address translation, which, in this example, is the source address translation table for address domain1shown in FIG.2A. The NAT102finds the source address translation table entry202corresponding to the host X local address for destination (outbound) address domain2, and obtains therefrom the host X global address for address domain2(i.e., A12). The NAT102then formats the packet704including, as the source address, the host X global address for address domain2(i.e., A12), and, as the destination address, the host Y local address (i.e., A). The NAT102forwards the packet704to the host Y120over the address domain2.

Upon receiving the packet704, the host Y120may transmit a response packet706including, as the source address, the host Y local address (i.e., A), and, as the destination address, the host X global address for address domain2(i.e., A12), typically copied from the source address of the packet704. The host X global address A12uniquely identifies the host X110within the communication network100. However, the host Y local address A is ambiguous within the communication network100, since it does not uniquely identify the host Y120.

Upon receiving the packet706, the NAT102determines that both the source address and the destination address require address translation. In order to translate the destination address, the NAT102uses the destination address translation table shown inFIG. 2Dto find the destination address translation table entry220corresponding to the destination address A12, and obtains therefrom the host X local address A. In order to translate the source address, the NAT102obtains the destination address domain from the destination address translation table entry220(i.e., address domain1), and also determines the source address domain (i.e., address domain2) either implicitly based upon the interface over which the packet706is received or explicitly from the destination address translation table entry220. The source address domain indicates the particular source address translation table required for the source address translation, which, in this example, is the source address translation table for address domain2shown in FIG.2B. The NAT102finds the source address translation table entry208corresponding to the host Y local address for destination (outbound) address domain1, and obtains therefrom the host Y global address for address domain1(i.e., A21). The NAT102then formats the packet708including, as the source address, the host Y global address for address domain1(i.e., A21), and, as the destination address, the host X local address (i.e., A). The NAT102forwards the packet708to the host X110over the address domain1.

FIG. 8is a message flow diagram showing an exemplary packet exchange between the host X110in the address domain1and the host B140in the address domain4. The host X110transmits the packet802including, as the source address, the host X local address (i.e., A), and, as the destination address, the host B network address (i.e., B). The host B network address B uniquely identifies the host B140within the communication network100. However, the host X local address A is ambiguous within the communication network100, since it does not uniquely identify the host X110.

Upon receiving the packet802, the NAT102determines that only the source address requires address translation. In order to translate the source address, the NAT102determines the destination address domain, for example, by finding the destination address translation table entry238in the destination address translation table, and obtaining therefrom the destination (outbound) domain (i.e., address domain4). The NAT102also determines the source address domain (i.e., address domain1) implicitly based upon the interface over which the packet502is received (there is no explicit source address domain associated with the network address B). The source address domain indicates the particular source address translation table required for the source address translation, which, in this example, is the source address translation table for address domain1shown in FIG.2A. The NAT102finds the source address translation table entry206corresponding to the host X local address for destination (outbound) address domain4, and obtains therefrom the host X global address for address domain4(i.e., A14). The NAT102then formats the packet804including, as the source address, the host X global address for address domain4(i.e., A14), and, as the destination address, the host B network address (i.e., B). The NAT102forwards the packet804to the host B140over the address domain4.

Upon receiving the packet804, the host B140may transmit a response packet806including, as the source address, the host B network address (i.e., B), and, as the destination address, the host X global address for address domain4(i.e., A14), typically copied from the source address of the packet804. The host X global address A14uniquely identifies the host X110within the communication network100. The host B network address B is unambiguous within the communication network100.

Upon receiving the packet806, the NAT102determines that only the destination address requires address translation. In order to translate the destination address, the NAT102uses the destination address translation table shown inFIG. 2Dto find the destination address translation table entry224corresponding to the destination address A14, and obtains therefrom the host X local address A. The NAT102then formats the packet808including, as the source address, the host B network address B, and, as the destination address, the host X local address A. The NAT102forwards the packet808to the host X110over the address domain1.

FIG. 9is a logic flow diagram showing exemplary NAT102logic for processing a packet received from the source host. Beginning in step902, the NAT102receives from the source host a packet including a source address equal to a source host local address and a destination address equal to a destination host global address, in step904. The destination host global address is, by definition, a unique address within the communication network100, although the destination host global address may or may not need to be translated into a destination host local it address in the destination address domain. The source host local address may be either a unique address within the communication network100or an overlapping address that needs to be translated into a source host global address for the destination address domain.

Therefore, upon receiving the packet in step904, the NAT102determines whether the destination address requires translation, in step906. If the destination address requires translation (YES in step908), then the NAT102translates the destination address from the unique destination host global address to the destination host local address in the destination in address domain, in step910, as described in detail with respect toFIG. 10Abelow.

Whether or not the destination address requires translation, the NAT102also determines whether the source address requires translation, in step912. If the source address requires translation (YES in step914), then the NAT102translates the source address from the overlapping source host local address to the unique source host global address for the destination address domain, in step916, as described in detail with respect toFIG. 10Bbelow.

After performing any required address translations, the NAT102forwards the translated packet into the destination address domain, in step918. The NAT102logic terminates in step999.

FIG. 10Ais a logic flow diagram showing exemplary NAT102destination address translation logic910in a preferred embodiment of the present invention. Beginning in step1010, the NAT102searches the destination address translation table for a destination address translation table entry corresponding to the destination host global address, in step1012, specifically by searching the destination address translation table for a destination address translation table entry having a Destination Global Address field equal to the destination host global address. Upon finding the destination address translation table entry in step1012, the NAT102obtains the destination host local address from the destination address translation table entry, in step1014, specifically by obtaining the destination host local address from the Destination Local Address field of the destination address translation table entry. Upon obtaining the destination host local address in step1014, the NAT102translates the destination address in the packet from the destination host global address into the destination host local address, in step1016. The destination address translation logic terminates in step1018.

FIG. 10Bis a logic flow diagram showing exemplary NAT102source address translation logic916in a preferred embodiment of the present invention. Beginning in step1020, the NAT102determines the source (inbound) domain for the packet, in step1022, for example, based upon the Source Address Domain field of the destination address translation table entry or the NAT102network interface over which the packet was received. The NAT102also determines the destination (outbound) domain for the packet based upon the destination address in the packet, in step1024, typically as part of the preceding destination address translation. Assuming that the NAT102maintains a separate source address translation table for each overlapping address domain, the NAT102proceeds to select a source address translation table for the source (inbound) domain, in step1026, based upon the source (inbound) domain for the packet determined in step1022. The NAT102then searches the source address translation table for a source address translation table entry mapping the source host local address in the source (inbound) address domain to the source host global address for the destination (outbound) address domain, in step1028, specifically by searching the source address translation table for a source address translation table entry having a Source Local Address field equal to the source host local address and a Destination Address Domain field equal to the destination (outbound) domain determined in step1024.

If the source address translation table entry is found (YES in step1030), then the NAT102proceeds to translate the source address in the packet from the source host local address into the source host global address for the destination (outbound) address domain, in step1038. In particular, the NAT102obtains the source host global address from the Source Global Address field of the source address translation table entry, and replaces the source host local address in the packet with the source host global address. The source address translation logic then terminates in step1040.

However, if the source address translation table entry is not found (NO in step1030), then the NAT102dynamically allocates a source host global address for the destination address domain, creates the appropriate address translation entries, and translates the source address in the packet by replacing the source host local address in the packet with the dynamically allocated source host global address. In particular, the NAT102first selects a unique source host global address from a pool of network addresses, in step1032. The NAT102then creates a source address translation table entry in the source (inbound) address domain's source address translation table mapping the source host local address in the source (inbound) address domain to the source host global address for the destination (outbound) address domain, in step1034, and creates a corresponding destination address translation table entry in the destination address translation table mapping the source host global address to the source host local address in the source (inbound) address domain, in step1036. The NAT102then translates the source address in the packet from the source host local address into the source host global address for the destination (outbound) address domain, in step1038, specifically by replacing the source host local address in the packet with the source host global address. The source address translation logic then terminates in step1040.

FIG. 11is a block diagram showing an exemplary NAT102in accordance with a preferred embodiment of the present invention. The NAT102is operably coupled to at least a source (inbound) address domain of the communication network100by way of a Source (Inbound) Network Interface1110and to a destination (outbound) address domain of the communication network100by way of a Destination (Outbound) Network Interface1150. Packets received over the Source (Inbound) Network Interface1110are processed by a Packet Processor1130. The Packet Processor1130is operably coupled to perform any necessary address translations on the packet. The translated packets are forwarded to the destination (outbound) address domain via the Destination (Outbound) Network Interface1150.

The Packet Processor1130includes both destination address translation logic (1136,1137) and source address translation logic (1132,1133). The destination address translation logic translates a destination host global address into a destination host local address in the destination (outbound) address domain, if such a translation is determined to be required. The source address translation logic translates a source host local address in the source (inbound) address domain into a source host global address for the destination (outbound) address domain, if such a translation is determined to be required. It should be noted that the destination address translation logic and the source address translation logic are shown as being operably coupled in parallel for convenience only. In a preferred embodiment of the present invention, the source address translation logic operates after completion of the destination address translation logic, and preferably obtains the source (inbound) address domain and the destination (outbound) address domain from the destination address translation table entry that is used by the destination address translation logic for translating the destination address in the packet.

The destination address translation logic determines whether the destination address requires translation, and translates the destination address from a destination host global address into a destination host local address if destination address translation is required. Specifically, the packet is processed by a Destination Address Filter1136, which determines whether or not the destination address in the packet requires translation. The Destination Address Filter1136may utilize address translation information stored in the Address Translation Table(s)1134, and particularly in a destination address translation table, in order to determine whether or not the destination address in the packet requires translation. If the Destination Address Filter1136determines that the destination address in the packet does not require address translation, then the Destination Address Filter1136forwards the packet unchanged via the path1138. However, assuming that the Destination Address Filter1136determines that the destination address in the packet does require address translation, then the Destination Address Translator1137translates the destination address from the destination host global address into the destination host local address in the destination (outbound) address domain, specifically by finding a destination address translation table entry in the Address Translation Table(s)1134corresponding to the destination host global address, obtaining the destination host local address from the destination in address translation table entry, and inserting the destination host local address into the destination address field of the packet.

The source address translation logic determines whether the source address requires translation, and translates the source address from a source host local address into a source host global address for the destination (outbound) address domain if source address translation is required. Specifically, the packet is processed by a Source Address Filter1132, which determines whether or not the source address in the packet requires translation. The Source Address Filter1132may utilize address translation information stored in the Address Translation Table(s)1134to determine whether or not the source address in the packet requires translation. If the Source Address Filter1132determines that the source address in the packet does not require address translation, then the Source Address Filter1132forwards the packet unchanged via the path1131. However, assuming that the Source Address Filter1132determines that the source address in the packet does require address translation, then the Source Address Translator1133translates the source address from the source host local address into the source host global address for the destination (outbound) address domain, specifically by selecting a source address translation table for the source (inbound) address domain, searching the source address translation table for a source address translation table entry corresponding to the source host local address and the destination (outbound) address domain, obtaining the source host global address from the source address translation table entry, and inserting the source host global address into the source address field of the packet.

In a preferred embodiment of the present invention, predominantly all of the NAT102logic and DNS Proxy104logic for processing messages and translating network addresses is implemented as a set of computer program instructions that are stored in a computer readable medium and executed by an embedded microprocessor system within the NAT102and the DNS Proxy104, respectively. Preferred embodiments of the invention may be implemented in any conventional computer programming language. For example, preferred embodiments may be implemented in a procedural programming language (e.g., “C”) or an object oriented programming language (e.g., “C++”). Alternative embodiments of the invention may be implemented using discrete components, integrated circuitry, programmable logic used in conjunction with a programmable logic device such as a Field Programmable Gate Array (FPGA) or microprocessor, or any other means including any combination thereof.

Thus, the present invention may be embodied as a method for translating addresses in a communication network having multiple overlapping address domains. The method involves receiving an overlapping local address from an inbound address domain, and translating the overlapping local address from the inbound address domain into a unique global address that is specific to a specified outbound address domain.

The present invention may also be embodied as a program product comprising a computer readable medium having embodied therein a computer program for translating addresses in a communication network having multiple overlapping address domains. The computer program includes receiving logic that is programmed to receive an overlapping local address from an inbound address domain. The computer program also includes translating logic that is programmed to translate the overlapping local address from the inbound address domain into a unique global address that is specific to a specified outbound address domain.

The present invention may also be embodied as an apparatus for translating addresses in a communication network having multiple overlapping address domains. The apparatus includes receiving logic that is operably coupled to receive an overlapping local address from an inbound address domain. The apparatus also includes translating logic that is operably coupled to translate the overlapping local address from the inbound address domain into a unique global address that is specific to a specified outbound address domain.

The present invention may also be embodied as a method for translating addresses in a communication system including a source host in a source (inbound) address domain in communication with a destination host in a destination (outbound) address domain by way of a network address translator. The method involves transmitting, by the source host in the source (inbound) address domain, a packet including a source address equal to a source host local address and a destination address equal to a destination host global address; receiving the packet by the network address translator; translating, by the network address translator, at least the source address from the source host local address to a unique source host global address that is specific to the destination (outbound) address domain; and forwarding the translated packet by the network address translator to the destination host in the destination (outbound) address domain. The method may also involve translating, by the network address translator, the destination address from the destination host global address to a destination host local address for the destination (outbound) address domain.

The present invention may also be embodied as a communication system including a source host in a source (inbound) address domain, a destination host in a destination (outbound) address domain, and a network address translator in communication with the source host and the destination host, wherein the source host is operably coupled to transmit to the network address translator a packet including a source address equal to a source host local address in the source (inbound) address domain, and the network address translator is operably coupled to translate at least the source address of the packet from the source host local address to a unique source host global address that is specific to the destination (outbound) address domain, and is further operably coupled to forward the translated packet to the destination host in the destination (outbound) address domain. The network address translator may also be operably coupled to translate the destination address of the packet from the destination host global address to a destination host local address in the destination (outbound) address domain

The present invention may be embodied in other specific forms without departing from the essence or essential characteristics. The described embodiments are to be considered in all respects only as illustrative and not restrictive.

It should be noted that the term “packet” is used herein as a generic term for a unit of information that is processed by the NAT, and should not be construed to limit application of the present invention to a specific information format or communication protocol. Thus, a packet may be any unit of information for use with any protocol including, but not limited to, a frame, a packet, a datagram, a user datagram, or a cell.