Patent Application
20100183019
The invention relates to network, and in particular, to a network device for distributing data packets to multiple network addresses.
NAT is a process for translation of IP address. It enables a local-area network (LAN) to use a first set of network addresses for internal traffic and a second set of network addresses for external traffic. A network device that is capable of performing NAT operations is located preferably where a LAN meets a wide area network (WAN). The most commonly used network address is based on the Internet Protocol, the IP address. The first set of IP addresses for internal traffic can be reused in many different LANs and are not unique. The second set of IP addresses for external traffic are unique and can not be reused by other networks. Each of the first set of IP addresses is assigned to a host in the LAN. Therefore, when a first host in a LAN intends to communicate with a second host on the Internet, it first transmits packets to a network device that is capable of performing NAT operations. In the IP header of each packet, there is a source address and a destination address. The source address is one of the first set of addresses that is assigned to the host and cannot be used outside the LAN. Therefore, in order to transmit the data packet to its destination address, the network device replaces the source address with an address from the second set of addresses which can be used for external communication. The operation of replacing the source address of the packet with an address from the second set of addresses is part of the NAT process. After the NAT, the resulting source address of the packet can be uniquely used for external traffic, such as Internet communication.
Nowadays, many network devices such as routers, firewalls, and ISDN routers are capable of performing NAT operations. All these devices employ only one NAT operation to transfer a data packet from a source address to a destination address.
With the rapid development of information technology, the functions provided by network devices are becoming more and more powerful and sophisticated. In today's network devices, besides basic functions, such as routing, many other functions or processing procedures, such as content-filtering, anti-virus, encryption, decryption and anti-spam, can be provided. These additional functions can be accomplished either in one processing unit or in many processing units. Performing some of the functions or processing procedures, such as an anti-virus processing procedure, is very complicated and time-consuming. To solve the problem, these additional processing procedures are usually executed by different processing units. A CPU in the network device is used to distribute data packets to different processing units for processing. However, this distribution method results in a huge consumption of the CPU resource. Thus, the above-mentioned method greatly limits the system performance.
To solve this problem many solutions, such as using a more powerful CPU, providing extra hardware, and employing software implementation, have been proposed. However, the use of powerful CPU, extra hardware, or extra software implementation increases the system complexity and cost.
Therefore, it is to an improved solution that is capable of transmitting data packets to various network processing units without increasing the cost and system complexity that the present invention primarily directs.
The present invention provides a network device that employs multiple NAT operations to transmit data packets to various network processing units. Since the NAT is a standard function of many network devices, the present invention is capable of transferring data packets to various network processing units according to system requirement without extra CPU or software operation. Consequently, system complexity and the cost can be reduced.
In one embodiment of the invention, there is provided a network device including a plurality of network addresses for indicating locations of a plurality of network processing units, and further including a data packet distributing unit for transferring a data packet to the network processing units in sequence by replacing a destination address of the data packet with the network addresses. The data packet distributing unit performs the actions of determining whether the data packet has been transferred to each of the network processing units, transferring the data packet to a network processing unit after replacing the destination address of the data packet with a corresponding network address if the data packet has not been transferred to the network processing unit, and outputting the data packet if the data packet has been transferred to each of the processing units.
In another embodiment of the invention, there is also provided a network system including a plurality of network processing units for executing a plurality of predefined procedures on a data packet, and further including a data packet distributor coupled to the network processing units for transferring the data packet to the network processing units in sequence by replacing an destination address of the data packet with a plurality of network addresses for indicating locations of the network processing units respectively. The data packet distributor performs the actions of determining whether the data packet has been transferred to each of the network processing units, transferring the data packet to a network processing unit after replacing the destination address of the data packet with a corresponding network address if the data packet has not been transferred to the processing unit, and outputting the data packet if the data packet has been transferred to each of the processing units.
In yet another embodiment of the invention, there is also provided a method for distributing a data packet to a plurality of network processing units in sequence for processing. The method includes determining at a data packet distributing unit whether the data packet has been transferred to each of the network processing units. If the data packet has not been transferred to a network processing unit, the data packet distributing unit operates the steps of replacing a destination address of the data packet with a network address indicating a location of the network processing unit at the data packet distributing unit, and transferring the data packet from the data packet distributing unit to the network processing unit according to the destination address. If the data packet has been transferred to each of the processing units, the data packet distributing unit outputs the data packet.
Features and advantages of embodiments of the invention will become apparent as the following Detailed Description proceeds, and upon reference to the Drawings, where like numerals depict like elements, and in which:
The data packets distributor 102 is capable of receiving data packets from either the network 1100 or the network 2104. When the network 1100 transfers a data packet that has a source address and a destination address to the network 2104, the data packet is received at the data packets distributor 102. At the data packet distributing unit 106 of the data packets distributor 102, the destination address of the data packet is replaced by a first network address that indicates a location of a certain network processing unit (e,g, P1108) among P1108, P2110 . . . Pn 112. Replacing the destination address with the first network address is referred to as a first NAT operation herein. According to the first network address, the data packet is transferred to P1108. At P1108, the data packet is processed, according to some of the procedures that executed by the P1108, such as content-filtering, anti-virus, encryption, decryption anti-spam, etc. After processing, the data packet is transferred back to the data packet distributing unit 106 from P1108.
After the processed data packet is received at data packet distributing unit 106, the data packet distributing unit 106 checks whether the data packet needs to be transferred to other processing units for further processing. If further processing procedure is required, the data packet distributing unit 106 may replaces the destination address of the data packet with a second network address that indicates a second processing unit among the plurality of processing units P1108, P2110 . . . Pn 112 and transmits the data packet to the second processing unit for further processing. Replacing the destination address with the second network address is also a NAT.
When the data packet distributing unit 106 detects that the data packet has been transferred to all the processing units it needs to be transferred to, the data packet distributing unit 106 may replace the current destination address of the data packet with its original destination address (a predefined address). Finally, the data packet is transmitted to the network 2104. Replacing the second network address with the destination address is referred to as a second NAT herein.
It is appreciated by those skilled in the art that the in the aforementioned embodiment of the invention, the data packets distributor 102 employs multiple NAT operations that contains at least two NAT operations to transfer the data packet from its source address to its destination address. In the course of distributing the data packet, the concept of NAT is employed and no CPU or software is involved. Therefore, the goal of a reduced cost and system complexity can be achieved.
For some special processing procedures, such as content-filtering, anti-spam and anti-virus, the associated processing units that handle the special processing procedures may check whether the data packet meets security requirements and transmission requirements. If the associated processing units detect that a data packet does not comply with the system security requirement, such as containing some virus, it may drop the data packet and log the dropping of the data packet. If any processing unit among P1108, P2110 . . . Pn 112, drops the data packet, the transmission of the data packet stops.
The terms and expressions which have been employed herein are used as terms of description and not of limitation, and there is no intention, in the use of such terms and expressions, of excluding any equivalents of the features shown and described (or portions thereof), and it is recognized that various modifications are possible within the scope of the claims. Other modifications, variations, and alternatives are also possible. Accordingly, the claims are intended to cover all such equivalents.
This application is a Continuation Application of the co-pending, commonly-owned U.S. patent pplication with Attorney Docket No. O-001.P015/0357, Ser. No. 11/602,669, filed on Nov. 21, 2006, by Zhiming Wang, and entitled “Method and apparatus for distributing data packets by using multi-network address translation”.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 11602669 | Nov 2006 | US |
| Child | 12726832 | US |
