Patent Application
20060198374
The present disclosure is generally related to computer networks and to computer network address resolution.
Internet protocol (IP) addresses are used to communicate among various IP devices. In order for such devices to communicate, the IP address is to be unique. With private addresses, security and scalability for private networks is offered. However, problems arise when these private networks need to communicate with each other. A common technique to solve this problem for private networks is to use network address translation (NAT). For example, if two different customers have an internal application server with the same IP address, each of the customers configures a static address translation through their firewall or router. As businesses conduct additional business-to-business communication, network address translation becomes complicated and unmanageable. For each two-way connection, each customer is required to create a network address translation on the router or firewall. This leads to errors and difficulty in troubleshooting network problems and increased costs of overall network management.
Accordingly, there is a need for an improved method and system of communicating using computer network addresses.
Referring to
The first customer at location 120 includes a gateway router 112 coupled via a data connection 130 to the public network 110. The first customer location 120 further includes an internal network connection 114 between the publicly accessible router 112 and an internal private network switch 116 and a private router 118. The private network also includes an internal server 122 as shown.
Similarly, the illustrated second customer location 140 includes internal network connection 144 coupling a publicly accessible gateway router 142 to an internal private network switch 146 and to a private network router 148 coupled thereto. The second customer location 140 also includes an internal server 150.
The gateway router 112 at the first customer location 120 has an external network address (151.0.1.1/24) and includes an internal address (192.168.1.3/24). The external address is publicly viewable when used by external systems such as the network management system 102 to route data traffic to the location 120. The internal address of the gateway router 112 is an address of the internal private network and is used for internal data traffic routing inside the private network (i.e. inside the protective security firewall). The elements within the internal private network, such as the router 118 and the server 120, include private network addresses as shown.
In a similar manner, the second customer location 140 includes elements having internal addresses such as switch 146, router 148 and server 150. In addition, the gateway router 142 includes both an external address and an internal address as discussed above with respect to the first location 120.
In the particular illustrative embodiment shown, the internal network address of the first server 122 at the first customer location 120 is the same as the internal network address of the second server 150 within the second customer location 140. Since both servers have the same network address, to the extent that the first customer communicates with the second customer over the public network connection 130, the network address destinations could be confused. In addition, with respect to a network management system 102 having connections to both customer locations 120 and 140, the centralized network management system 102 desires to provide unique communication identifiers for each of the servers 122 and 150. To address this complexity and common address problem, the system 102 may utilize an application routing (layer 7 routing) methodology. With the application layer 7 routing method, when the second customer 140 desires to access the server at the first customer location 120, the application may attempt to connect to the server 122 using a special formatted network address. In a particular embodiment, the special format for the network address includes an application name field followed by a private network address followed by a delimiter symbol, such as the “1” (at) symbol, followed by a publicly accessible IP address. An example of the network address format is shown with respect to
Where a particular location, such as the second customer bank location 140 does business with many different schools or other destinations and desires to access various servers at such locations, the bank customer 140 may access such servers by connecting to the server using the address of the private server address at the identified public gateway address. This method provides a scalable technique to interconnect private networks without the need for complex NAT and routing. In addition, this method allows for many service providers, such as a service provider using network management system 102, to communicate and monitor many servers such as servers for a plurality of different customers, even those having the same internal addresses.
As illustrated, the format of the network address for a data connection may be in the form of an internal address followed by an “@” (at) symbol and followed by an external address. With such a formatted address, the connection is first routed to the external address that is a publicly available and unique address. Once a connection is received by a target device at the external address, a particular router or firewall may look at its access control list to determine whether a connection is permitted. If an internal destination connection is permitted, the target device at the external address will route the data to the private internal address. Once a destination server receives a connection, the server replies back to the external target address. This routing device may then forward the communication back to the original requesting device over the public network. Each application for the originating destination and intermittent devices will have capability and logic to handle layer 7 routing and properly process the network addresses in such special format.
Referring to
Referring to
The disclosed system and method addresses the need to resolve complicated network address translation issues with business to business private network communications over intervening public data networks. The disclosed approach also allows managed service providers (MSP) that need to access their customer's internal network without requiring complex NAT and routing problems when accessing destination devices within different customer networks that have the same internal address. By using layer 7 routing and the identified computer network address format illustrated herein, the MSP may offer a scalable system that addresses the duplicate/overlapping IP address problem. In addition, the layer 7 routing approach allows for different applications, such as the Telnet, FTP, or Ping application to be utilized on a device of a remote network. Accordingly, an improved system and method of communicating between private networks has been disclosed.
The above disclosed subject matter is to be considered illustrative, and not restrictive, and the appended claims are intended to cover all such modifications, enhancements, and other embodiments which fall within the true spirit and scope of the present invention. Thus, to the maximum extent allowed by law, the scope of the present invention is to be determined by the broadest permissible interpretation of the following claims and their equivalents, and shall not be restricted or limited by the foregoing detailed description.
