Patent Application
20050076141
The present invention relates to communication networks and more particularly to privately addressed networks.
Users requiring a globally unique address space on the Internet are obliged to obtain such addresses from an Internet registry. However, the Internet Assigned Numbers Authority (IANA) has also reserved the following three blocks of the Internet Protocol version 4 (IPv4) address space for private networks:
The first block comprises a single class A network number, the second block comprises a set of 16 contiguous class B network numbers, and the third block comprises a set of 256 contiguous class C network numbers. The foregoing three blocks of IP address space may be used without coordination by IANA or any other Internet registry and may thus result in the existence of globally ambiguous addresses. IP routing cannot be reliably performed under such circumstances.
Existing implementations of private networks employ Network Address Translation (NAT) at an Application Level Gateway (ALG) or a Residential Gateway, which translates globally unique network names to private addresses. Such translation can generally only be performed automatically when communications are routed from within a private network to a destination external to the private network (e.g., a host or device connected the Internet). Communications in the reverse direction, that is from a source device external to a private network to a destination device internal to the private network, require either manual configuration of the network address translation capability or a specialised signalling protocol.
Additionally, private address ranges are not intended to be routed on public networks, and many routers filter the private address ranges out. This is another reason private address ranges are not useful for public networks.
In the arrangement shown in
Disadvantageously, manual configuration requires skill and effort that is beyond the capability many users of privately addressed networks, particularly home networks. Furthermore, most existing Internet applications require modification to implement the signalling required to pass through network address translation (NAT) at the gateway of a privately addressed network.
According to aspects of the present invention, there are provided a method and an apparatus for accessing, via a public network, a device connected to a privately addressed network. The method comprises the steps of automatically assigning a globally unique name to the device, which resolves to a gateway of the privately addressed network, automatically associating the globally unique name with a private address of the device, and automatically routing communications comprising the globally unique name to the device based on the private address. The public network may comprise the Internet and the foregoing steps may be performed by a network gateway device.
The method may comprise either or both of the further steps of automatically registering the globally unique name and an address of the gateway with a Domain Name System (DNS) and automatically extracting data relating to the globally unique name from Dynamic Host Configuration Protocol (DHCP) data.
The assigning step may be executed in response to a request from the device. The request may be received by a Dynamic Host Configuration Protocol (DHCP) server, which may provide an Internet Protocol (IP) address to said device.
The routing step may comprise the sub-steps of receiving a communication for the device from another device via the Internet, the communication comprising said globally unique name; automatically obtaining a private address for the device, the private address dependent on the globally unique name; and automatically routing the communication to the private address.
The apparatus embodies the method described herein and may comprise a network gateway device.
A small number of embodiments of the present invention are described hereinafter, by way of example only, with reference to the accompanying drawings in which:
a and 4b are block diagrams showing additional detail of
Methods and apparatuses for accessing a device connected to a privately addressed network via a public network are described hereinafter with reference to embodiments that include the Internet as a public network. However, the small number of embodiments described are not intended to be limiting in this regard since the principles described hereinafter have general applicability to other types of communication networks and network protocols. The embodiments have applicability to Internet Protocol version 4 (IPv4), which is limited to a 32-bit address space. However, the embodiments may also have applicability to Internet Protocol version 6 (IPv6), which has a 128-bit address space. Methods and apparatuses described hereinafter also relate to both enterprise and home private networks. Such networks include, but are not limited to, local area networks (LAN's), wireless networks, power-line networks and phone-line networks.
Some embodiments use Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) to achieve reverse proxying of the Hypertext Transfer Protocol (HTTP). DHCP is a protocol for assigning dynamic IP addresses on a network. Dynamic addressing enables a device to have different IP addresses assigned to the device, for example, each time that the device connects to a network. The DNS is a distributed Internet service that translates domain names into IP addresses. For example, the domain name ‘cube.aidan.eg.org’ might translate into the IP address 203.213.140.43. If a particular DNS server is unable to translate a particular domain name, the DNS server forwards the request to another DNS server. This process recurs until the domain name is resolved and returned to the original DNS server.
The globally unique IP address 203.213.140.43 resolves to the gateway 220. The internal IP addresses 192.168.1.43 and 192.168.2.18, both of which are within one of the blocks reserved by IANA for private network addressing, resolve internally to the web servers 230 and 240, respectively. The web servers 230 and 240 (‘cube’ and ‘noizi’, respectively) are added to the name of the privately addressed network (‘.private.arpa’) to produce names ‘cube.private.arpa’ and ‘noizi.private.arpa’, respectively. More generally, the names of devices or hosts connected to a privately addressed network are added to the privately addressed network's name to create internal names, which are translated into local addresses. While the IP addresses of the web servers 230 and 240 are unique within the privately addressed network 210, such addresses are ambiguous to, and/or hidden from, devices external to the privately addressed network 210 (e.g., devices connected to other privately addressed networks or the Internet 250). Additionally, if both of the web servers 230 and 240 offer web services on port 80 (the standard web server port), the gateway 220 has no way of knowing which of the web servers 230 and 240 a particular request should be forwarded to, or even if requests should be automatically forwarded.
Hosts or devices external to the privately addressed network 210 can communicate with the web servers 230 and 240 by sending requests 261, 262 and 263 to the gateway 220 that point or resolve to the global IPv4 address of the gateway 220 (i.e., 203.213.140.43). Each request 261, 262 and 263 comprise the name of the internal host or the web server that the request is directed to (e.g., ‘cube.aidan.eg.org’ and ‘noizi.aidan.eg.org’ for the web servers 230 and 240, respectively). An example of a request header relating to a request 261 from an external browser or a host directed to the internal webserver 230 is as follows:
The gateway 220 proxies such requests 261, 262 and 263 from an external host to the internal web servers 230 and 240 based on the name contained in the request header. In other words, the gateway 220 ‘demultiplexes’ requests directed to specific devices or hosts connected to the privately addressed network 210, based on the name contained in the request header. Although the foregoing description specifically relates to an externally generated request, the same principles apply to an externally generated response to a request generated by an internal host or device.
A proxy (in this case the gateway 220) accepts a connection on behalf of a device or host internal to a network (in this case the privately addressed network 210) and communicates with an external host or device making the connection. Additionally, the proxy opens a connection to the relevant internal device and communicates with that device. A proxy is thus a go-between for two communicating devices.
At step 310, a globally unique name is automatically assigned to an internal host/device in a privately addressed network. The globally unique name resolves to an address of a gateway of the privately addressed network.
At step 320, the globally unique name is automatically associated with a private address of the device.
At step 330, communications (e.g., requests and responses) comprising the globally unique name are automatically routed to the host/device in the privately addressed network based on the private address of the device.
An embodiment that uses Dynamic Host Configuration Protocol (DHCP) is described hereinafter. A DHCP server receives a request from an internal host/device that contains a hostname and provides the internal host/device with an IP address. To enable Virtual Hosting Reverse Proxy (VHRP) or reverse proxying, the hostname is mapped into a globally unique name pointing at the gateway and this name is stored in a DNS. Another mapping is created that associates the internal IP address with the external name. As an example with reference to the network environment shown in
a and 4b are block diagrams of a networking environment showing additional detail of the gateway 220 in
Referring to
Referring specifically to
In one embodiment, an intermediate software program executing on the proxy server 426 extracts data from the DHCP lease file administered by the DHCP server 422, and registers the data with the DNS server 424. However, those skilled in the art would understand that numerous other embodiments to achieve the same result are possible. For example, the use of Dynamic DNS (DDNS), as described in RFC2136, enables a static hostname to be resolved to a dynamic IP address. Request For Comments (RFC) documents are official specification documents of the Internet Engineering Taskforce (IETF), which can be obtained from various websites and archives accessible via the Internet (e.g., http://www.ietf.org/internet-drafts/).
Referring specifically to
For illustration purposes only, an example of the association and registration of separate hostname and address pairs for internal and external use with reference to
As can be seen from the foregoing description, the DCHP server is involved in the initial registration and mapping process (i.e., step 310 of
While
A bridge 850 interfaces the processor bus 840 and a peripheral bus 860, which typically operates at lower data rates than the processor bus 840. Various interfaces are in turn coupled to the peripheral bus 860. For example, one or more of several ‘downlink’ communications interfaces may be practiced to connect devices in a privately addressed network to the gateway using a private addressing scheme and an associated naming scheme. The gateway 800 has as examples of such interfaces an IEEE 802.11b wireless interface 880, an Ethernet interface 882, and a Universal Serial Bus (USB) interface 884. The foregoing are merely examples and other network interfaces may be practiced, such as a Token Ring interface, other wireless LAN interfaces, and an IEEE 1394 (Firewire) interface. For connections external to a privately addressed network (e.g., to a global address via a public network such as the Internet), other ‘uplink’ network interfaces may be practiced. For example, the gateway 800 may have a network interface card 872 for connection to another network. Alternatively, the gateway 800 may comprise an Ethernet interface 870, which can be connected to a suitable modem 890 (e.g., a broadband modem). Still other network interfaces may be practiced including ATM and DSL, as examples of a few.
A protocol-specific proxy accepts connections via an ‘uplink’ interface, demultiplexes the connections based on a public hostname, and communicates with a device accessible via a ‘downlink’ interface on behalf of a device connected to the ‘uplink’ interface.
The methods for accessing a device or host connected to a privately addressed network via a public network may be implemented as software or computer programs carried out in conjunction with the processing unit and the storage unit(s) of the gateway. In certain embodiments, the translation of external names to internal addresses for use by a proxy is performed by a DNS server internal to the gateway that is automatically configured by DHCP in response to requests for registration of internal hosts. However, it would be readily appreciated by those skilled in the art that such translation can be performed externally to the gateway. Similarly, the translation of external names to the gateway's address for use by external hosts can be performed by a DNS server external to the gateway. This can be augmented by name registration triggered by an external DHCP request.
External name queries are directed to a name resolution mechanism or service external to the gateway. In an embodiment described hereinbefore, this is achieved by registering the gateway's domain name (e.g., ‘aidan.eg.org’) with an appropriate external DNS server.
While the gateway 800 has been depicted as a standalone device by itself, or in combination with a suitable modem, it will be well understood by those skilled in the art that the gateway may be implemented using a computer system with suitable software to implement the gateway functionality. Other variations may also exist. Specifically, the gateway 800 may be implemented as a discrete consumer device, which is configurable by a web interface attached to a privately addressed network. Hardware platforms such as those capable of performing the functions of a firewall or router can also be used to implement the methods described herein.
Advantageously, the methods and apparatuses described hereinbefore enable hosts and devices connected to privately addressed networks to be automatically exposed to hosts on the Internet. Thus, web and Session Initiation Protocol (SIP) servers located behind network address translation can be automatically accessed by hosts external to the privately addressed network. SIP is a signalling protocol for Internet conferencing, telephony, presence, event notification and instant messaging.
The foregoing detailed description provides exemplary embodiments only, and is not intended to limit the scope, applicability or configurations of the invention. Rather, the description of the exemplary embodiments provides those skilled in the art with enabling descriptions for implementing an embodiment of the invention. It should be understood that various changes might be made in the function and arrangement of elements without departing from the spirit and scope of the invention as set forth in the appended claims.
