Patent Grant
7443865
This application claims priority under U.S. patent application, Ser. No. 09/186,213, filed on Nov. 3, 1998, now U.S. Pat. No. 6,490,289 in the name of the same inventors and commonly owned herewith.
1. Field of the Invention
The present invention relates to the field of computer networks. More particularly, the present invention relates to managing multiple network connections from a single PPP link while performing network address translation.
2. The Background
The Point-to-Point protocol (PPP) is a data link protocol that provides dial up access over analog or digital transmission lines. PPP provides many advanced features, including error detection, support of multiple protocols, negotiation of IP addresses at connection time, and authentication. There are three main features of PPP. The first is that it provides a framing method to delineate the end of one frame and the beginning of the next one, in order to handle error detection. The second is a link control protocol for bringing lines up, testing them, negotiating options, and bringing them down again when they are no longer needed. This is known as the Link Control Protocol (LCP). The third is a way to negotiate network layer options in a way independent of the network layer protocol to be used. Thus, the method chosen may have a different Network Control Protocol (NCP) for each network layer supported.
PPP is commonly used as the data link protocol between a user and an Internet Service Provider (ISP) or access point. This is usually accomplished through the following method. The personal computer of the user by is instructed to call the ISP through a modem. After the ISP's modem receives the call and establishes a physical connection, the personal computer sends a series of LCP packets in the payload field of one or more PPP frames. These packets, and their responses, comprise the negotiation of the session, and set the PPP parameters to be used during the session.
Once the negotiation is complete, a series of NCP packets are sent to configure the network layer. Typically, the personal computer wants to run a TCP/IP protocol stack, so it needs an IP address. The NCP for IP may then be used to assign an IP address to the user (dynamic assignment of IP addresses is now common for dial-up users). At this point, the personal computer has become an Internet host and may send and receive IP packets, just as a hardwired host could. When the user has finished, NCP is used to tear down the network layer connection and free the IP address. The LCP is then used to shut down the data link layer connection. Finally, the personal computer hangs up the modem, releasing the physical layer connection.
There are currently eleven types of LCP packets. These types are illustrated in Table 1 below, along with the direction in which they travel (from Initiator (I) to responder (R) or vice-versa) and their description.
In recent years, “intranets” have been rising in popularity, especially with large companies. An intranet is an internal network that serves only a specific type of person (such as employees of a corporation, or students at a school). The intranet is usually not accessible to the general public. Intranets have become popular mainly because they allow for much more productive communication between users within the network,
even when the users are dispersed over a wide geographic area (such as in multi-national corporations).
Many entities that maintain intranets, however, have also wanted to offer users access to the Internet or to other intranets as well. There were, however, a limited number of ways that this could be accomplished. The first, and most simple, way would be for the user to first terminate the existing PPP connection between the PC 10 and the ISP or access point 24. Then the user could log into a second intranet or to the Internet. The major drawbacks of this solution are obvious. It does not allow for simultaneous connection to two intranets, or to one intranet and the Internet, thus limiting the productivity of the user. Additionally, it requires termination of the PPP link between the PC and the ISP, thus using up valuable time on the user's end, as he has to re-initiate a connection process.
The second way an entity could offer access to a second intranet or to the Internet is to have a preconfigured connection from the intranet to the second intranet or Internet, such that communications between the user and the second intranet or Internet pass through the intranet.
One major drawback of PPP, therefore, is that it is designed as a point to point protocol, meaning that it is designed for use between two endpoints. Therefore, it is currently not possible for a user to connect to two independent endpoints simultaneously (such as an intranet and the Internet, or to two independent intranets) using a single PPP link.
What is needed is a method by which a user may connect to two independent endpoints simultaneously using a single PPP link.
Multiple simultaneous network connections from a single PPP connection may be accomplished by utilizing a gateway in the following manner. A first network connection is established between the gateway and a first network. A first real network address for the user is then received, the first real network address assigned by the first network. Then, the gateway may establish a network session between the gateway and a second network and receive a second real network address for the user, the second real network address assigned by the second network. A virtual network address may be assigned to the user for network address translation purposes. Additional network connections may be added in a similar manner. Network address translation is then performed on packets traveling between the user and any of the network sessions. This allows each of the simultaneous network connections to gain the benefits of network address translation.
Those of ordinary skill in the art will realize that the following description of the present invention is illustrative only and not in any way limiting. Other embodiments of the invention will readily suggest themselves to such skilled persons.
In accordance with a presently preferred embodiment of the present invention, the components, process steps, and/or data structures are implemented using a gateway device. Different implementations may be used and may include other types of operating systems, computing platforms, computer programs, and/or general purpose machines. In addition, those of ordinary skill in the art will readily recognize that devices of a less general purpose nature, such as hardwired devices, devices relying on FPGA or ASIC technology, or the like, may also be used without departing from the scope and spirit of the inventive concepts disclosed hereinwith.
A method for making multiple network connections with network address translation is provided. This method may be executed by a gateway. A gateway is a device which performs protocol conversion between different types of networks or applications. The term gateway is not meant to be limited to a single type of device, as any device, hardware or software, that may act as a bridge between the user and the networks may be considered a gateway for purposes of this application.
In the present invention, network address translation (NAT) is utilized on all the network connections. NAT is an Internet standard that enables a local-area network (LAN), intranet, or ISP to use one set of network addresses for internal traffic and a separate set of network addresses for external traffic. Network addresses are generally Internet Protocol (IP) addresses, but there are many other possible network addresses as well. At the ISP level, there is normally a gateway, which is a device that acts as an interface between the ISP and the intranet or Internet. When network address translation is used, the Gateway will act to convert the destination addresses of incoming packets and source addresses of outgoing packets so that traffic is directed to the correct address.
Network address translation provides two main advantages. First, it adds security to the LAN or intranet, as it acts as a type of firewall, preventing users from outside the LAN or intranet from determining the internal network addressing scheme of the LAN or intranet. Second, it saves network addresses. With the ever growing popularity of the Internet and computer networks, a major issue is the availability of IP addresses. A standard IP address is 32 bytes in length, providing a total of 232 possible IP addresses. Those of ordinary skill in the art will readily recognize that not all of these possible IP addresses are available due to administrative expediencies, such as reserving blocks of IP addresses for future use. Network address translation saves IP addresses by allowing the ISP to use IP addresses internally that may be used by other networks on the Internet because there is no possibility of conflict.
At some point during the session, the user may request connection to a second network. Therefore, at step 104, the gateway may establish a second network session between the gateway and a second network. At step 106, a second real network address for the user is received, the second real network address assigned by the second network. this may or may not require an action to be taken by the gateway when the connection is established. Some forms of network address translation require that a NAT table be maintained. In such instances, the gateway may assign the user a virtual network address according to a network address translation allocation scheme and store the virtual network address in a NAT table in an entry corresponding to the real network address received from the network being connected. Some forms of network address translation involve simply applying the network address translation scheme to each packet as it is received. In such instances, not steps need to be taken by the gateway until a packet is received.
The gateway may configure more than two network sessions should the user so desire. These additional network sessions are created in a similar fashion to the other network sessions.
Additionally, “tunneling” may be utilized in the case where not all the links follow the same protocol, but the two endpoints follow the same protocol. Tunneling allows two hosts on the same type of network to communicate even though there may be different types of network in between. Tunneling is accomplished by encapsulating packets sent from a first type of network within packets of a type compatible with a second type of network for the duration of the packet's journey through the second type of network. Then, the outer packet is stripped off (and possibly some demultiplexing takes place) when the packet reaches the first type of network again. Layer Two Tunneling Protocol (L2TP) is a specific tunneling protocol that acts as an extension of the PPP protocol to allow ISPs to operate virtual private networks. L2TP or any other tunneling protocol may be used when establishing the network sessions.
A network address allocator 178 assigns the user a virtual network address. A NAT table storer 180 stores the virtual network address is a NAT table 182 in an entry 184 corresponding to the first real network address, and stores said virtual network address in the NAT table 180 in an entry 184 corresponding to the second real network address.
At step 200, a packet is received from the user. At step 202, the packet is examined to determine if its destination is the first network or the second network.
Referring back to
Likewise, when a packet is received from a network, then network address translation is performed.
The packet examiner 302 may contain a network address extractor 308, which extracts a destination network address from the packet, a routing table searcher 310, which looks up the destination network address in a routing table, and a network determiner 312, which determines that the destination is the first network or the second network based upon the listing for the destination network address in the routing table. The network determiner 312 may further determine that the destination is the first network or second network based upon a default setting if the destination network address is not listed in the routing table.
The packet receiver 300 may further receive a second packet, the second packet sent from said first network or said second network. The network address translator 304 may further perform network address translation on said second packet. The packet forwarder 306 may further forward said second packet to the user.
This invention allows for the simultaneous connection to two or more network s from only one single PPP connection. It also allows for networks to be added at the time the user requests connection, such that the networks do not need to be preconfigured. All of the benefits of networks address translation may be realized on each of the simultaneous network connections. Additionally, an increase in security is provided in that traffic to networks travel directly to the gateway rather than through one of the other simultaneously connected networks.
While embodiments and applications of this invention have been shown and described, it would be apparent to those skilled in the art that many more modifications than mentioned above are possible without departing from the inventive concepts herein. The invention, therefore, is not to be restricted except in the spirit of the appended claims.
| Number | Name | Date | Kind |
|---|---|---|---|
| 4922486 | Lidinsky et al. | May 1990 | A |
| 5136580 | Videlock et al. | Aug 1992 | A |
| 5241594 | Kung | Aug 1993 | A |
| 5274631 | Bhardwaj | Dec 1993 | A |
| 5280480 | Pitt et al. | Jan 1994 | A |
| 5423002 | Hart | Jun 1995 | A |
| 5430715 | Corbalis et al. | Jul 1995 | A |
| 5555244 | Gupta et al. | Sep 1996 | A |
| 5570361 | Norizuki et al. | Oct 1996 | A |
| 5583862 | Callon | Dec 1996 | A |
| 5592470 | Rudrapatna et al. | Jan 1997 | A |
| 5594732 | Bell et al. | Jan 1997 | A |
| 5617417 | Sathe et al. | Apr 1997 | A |
| 5655077 | Jones et al. | Aug 1997 | A |
| 5659542 | Bell et al. | Aug 1997 | A |
| 5671354 | Ito et al. | Sep 1997 | A |
| 5673265 | Gupta et al. | Sep 1997 | A |
| 5684950 | Dare et al. | Nov 1997 | A |
| 5699521 | Iizuka et al. | Dec 1997 | A |
| 5737526 | Periasamy et al. | Apr 1998 | A |
| 5740171 | Mazzola et al. | Apr 1998 | A |
| 5740176 | Gupta et al. | Apr 1998 | A |
| 5787253 | McCreery et al. | Jul 1998 | A |
| 5793763 | Mayes et al. | Aug 1998 | A |
| 5799017 | Gupta et al. | Aug 1998 | A |
| 5802047 | Kinoshita | Sep 1998 | A |
| 5802316 | Ito et al. | Sep 1998 | A |
| 5805595 | Sharper et al. | Sep 1998 | A |
| 5815665 | Teper et al. | Sep 1998 | A |
| 5835727 | Wong et al. | Nov 1998 | A |
| 5838683 | Corley et al. | Nov 1998 | A |
| 5854901 | Cole et al. | Dec 1998 | A |
| 5856974 | Gervais et al. | Jan 1999 | A |
| 5867495 | Elliott et al. | Feb 1999 | A |
| 5883893 | Rumer et al. | Mar 1999 | A |
| 5933625 | Sugiyama | Aug 1999 | A |
| 5944824 | He | Aug 1999 | A |
| 5959990 | Frantz et al. | Sep 1999 | A |
| 5991810 | Shapiro et al. | Nov 1999 | A |
| 5991828 | Horie et al. | Nov 1999 | A |
| 6009103 | Woundy | Dec 1999 | A |
| 6011909 | Newlin et al. | Jan 2000 | A |
| 6011910 | Chau et al. | Jan 2000 | A |
| 6018770 | Little et al. | Jan 2000 | A |
| 6021496 | Dutcher et al. | Feb 2000 | A |
| 6026086 | Lancelot et al. | Feb 2000 | A |
| 6026441 | Ronen | Feb 2000 | A |
| 6028848 | Bhatia et al. | Feb 2000 | A |
| 6029203 | Bhatia et al. | Feb 2000 | A |
| 6047325 | Jain et al. | Apr 2000 | A |
| 6047376 | Hosoe | Apr 2000 | A |
| 6055236 | Nessett et al. | Apr 2000 | A |
| 6065049 | Beser et al. | May 2000 | A |
| 6065064 | Satoh et al. | May 2000 | A |
| 6091951 | Sturniolo et al. | Jul 2000 | A |
| 6092196 | Reiche | Jul 2000 | A |
| 6098106 | Philyaw et al. | Aug 2000 | A |
| 6119160 | Zhang et al. | Sep 2000 | A |
| 6141687 | Blair | Oct 2000 | A |
| 6157636 | Voit et al. | Dec 2000 | A |
| 6160808 | Maurya | Dec 2000 | A |
| 6226678 | Mattaway et al. | May 2001 | B1 |
| 6269099 | Borella et al. | Jul 2001 | B1 |
| 6317594 | Gossman et al. | Nov 2001 | B1 |
| 6381646 | Zhang et al. | Apr 2002 | B2 |
| 6490289 | Zhang et al. | Dec 2002 | B1 |
| 6674758 | Watson | Jan 2004 | B2 |
| 6721329 | Van Driel | Apr 2004 | B1 |
| 6822955 | Brothers et al. | Nov 2004 | B1 |
| 6822957 | Schuster et al. | Nov 2004 | B1 |
