Internet protocol filter

DC CAFC

US 6,128,298 A
Filed: 04/24/1997
Issued: 10/03/2000
Est. Priority Date: 04/24/1996
Status: Expired due to Term

- Alert
- Pin

Associated Cases

Associated Defendants

First Claim

Patent Images

1. A method of interfacing private and public data communications networks, through a filter node in communication with both networks, the filter node having an address known in the public network, comprising the steps of:

routing from nodes in the private network, to the filter node, outgoing data packets having destination information, which includes a destination address and a destination port, corresponding to nodes in the public network and having source information, which includes a source address and a source port, of the respective private network nodes;

for each outgoing data packet received from the private network, at the filter node, maintaining the source information taken from the outgoing data packet in correlation with a unique value representing a port of the filter node, and replacing in the outgoing data packet the source address with the filter node address and the source port with the filter node port value; and

routing from the filter node, to nodes in the public network, the outgoing data packets having the replaced source information, according to the destination information in each, to the corresponding public network nodes.

View all claims

20 Assignments

Timeline View

Assignment View

Litigations

6 Petitions

Accused Products

Abstract

The IP filter, embodying the present invention, is a communications device designed to provide public network or Internet access to nodes of private networks, advantageously without requiring the private nodes on such networks to register public Internet addresses. The IP filter presents a single IP address to the Internet and uses a plurality of IP ports to solve the problem of IP address conservation. It initiates sessions by assigning private side IP sessions to a unique port of the IP filter'"'"'s public address. The IP filter effects a translation between a source port number for the private network and a destination port number for the public network for communication therebetween. Benefits of the IP filter include private node security and conservation of Internet-registered addresses.

267 Citations

32 Claims

1. A method of interfacing private and public data communications networks, through a filter node in communication with both networks, the filter node having an address known in the public network, comprising the steps of:
- routing from nodes in the private network, to the filter node, outgoing data packets having destination information, which includes a destination address and a destination port, corresponding to nodes in the public network and having source information, which includes a source address and a source port, of the respective private network nodes;
  
  for each outgoing data packet received from the private network, at the filter node, maintaining the source information taken from the outgoing data packet in correlation with a unique value representing a port of the filter node, and replacing in the outgoing data packet the source address with the filter node address and the source port with the filter node port value; and
  
  routing from the filter node, to nodes in the public network, the outgoing data packets having the replaced source information, according to the destination information in each, to the corresponding public network nodes.
- View Dependent Claims (2, 3, 4, 5, 9)
- - 2. A method as claimed in claim 1, comprising the steps of:
    - routing from nodes in the public network, to the filter node, incoming data packets each having the address of the filter node as the destination address;
      
      for each incoming data packet received from the public network, at the filter node, correlating the destination port of the destination information in the incoming data packet to particular source information being maintained and replacing, in the incoming data packet, the destination information with the particular source information;
      
      routing from the filter node, in the private network, the incoming data packets having the replaced destination information to the corresponding private network nodes.
  - 3. A method as claimed in claim 2, comprising ignoring by the filter node any incoming data packet received from the public network, if the destination port of the destination information in that incoming data packet can not be correlated to the maintained source information.
  - 4. A method as claimed in claim 3, wherein maintaining the source information includes storing the source information from each outgoing data packet as an entry in a lookup table, and the filter node port value correlating to the source information constitutes an index into the table for that entry.
  - 5. A method as claimed in claim 4, wherein the incoming and outgoing data packets include packets in accordance with a transmission control protocol (TCP) over an internet protocol (IP).
  - 9. A method as claimed in claim 4, wherein the data packets include packets in accordance with a user datagram protocol (UDP) over an internet protocol (IP).

6. A method of interfacing private and public data communications networks, through a filter node in communication with both networks, the filter node having an address known in the public network, comprising the steps of:
- routine from nodes in the private network, to the filter node, outgoing data packets having destination information, which includes a destination address and a destination port, corresponding to nodes in the public network and having source information, which includes a source address and a source port, of the respective private network nodes;
  
  for each outgoing data packet received from the private network, at the filter node, maintaining the source information taken from the outgoing data packet in correlation with a unique value representing a port of the filter node, and replacing in the outgoing data packet the source address with the filter node address and the source port with the filter node port value;
  
  routing from the filter node, to nodes in the public network, the outgoing data packets having the replaced source information, according to the destination information in each, to the corresponding public network nodes;
  
  routing from nodes in the public network, to the filter node, incoming data packets each having the address of the filter node as the destination address;
  
  for each incoming data packet received from the public network, at the filter node, correlating the destination port of the destination information in the incoming data packet to particular source information being maintained and replacing, in the incoming data packet, the destination information with the particular source information;
  
  routing from the filter node, in the private network, the incoming data packets having the replaced destination information to the corresponding private network nodes;
  
  ignoring by the filter node any incoming data packet received from the public network, if the destination port of the destination information in that incoming data packet can not be correlated to the maintained source information,wherein maintaining the source information includes storing the source information from each outgoing data packet as an entry in a lookup table, and the filter node port value correlating to the source information constitutes an index into the table for that entry;
  
  wherein the incoming and outgoing data packets include packets in accordance with a transmission control protocol (TCP) over an internet protocol (IP); and
  
  receiving at the filter node an outgoing TCP packet from the private network; and
  
  if an entry corresponding to the outgoing TCP packet is not found in the lookup table and the outgoing TCP packet indicates that this is a connection request, storing the source information together with the destination information from the outgoing TCP packet as a new entry in the lookup table.
- View Dependent Claims (7, 8)
- - 7. A method as claimed in claim 6, comprising receiving at the filter node an incoming TCP packet from the public network;
    - and if the source port in the received incoming TCP packet is different from the destination port in a source information entry of the lookup table, indexed by the destination port in the outgoing TCP packet, and if the incoming TCP packet indicates that this packet is a first response to the connection request, then updating by the filter node the destination port in the table entry with the source port from the received incoming TCP packet.
  - 8. A method as claimed in claim 7, comprising receiving at the filter node any incoming TCP packet having an end of transmission code in the packet and zeroing an entry in the lookup table corresponding to that received incomingTCP packet.

10. A method of interfacing private and public data communications networks, through a filter node in communication with both networks, the filter node having an address known in the public network, comprising the steps of:
- routing from nodes in the private network, to the filter node, outgoing data packets having destination information, which includes a destination address and a destination port, corresponding to nodes in the public network and having source information, which includes a source address and a source port, of the respective private network nodes;
  
  for each outgoing data packet received from the private network, at the filter node, maintaining the source information taken from the outgoing data packet in correlation with a unique value representing a port of the filter node, and replacing in the outgoing data packet the source address with the filter node address and the source port with the filter node port value;
  
  routing from the filter node, to nodes in the public network, the outgoing data packets having the replaced source information, according to the destination information in each, to the corresponding public network nodes;
  
  routing from nodes in the public network, to the filter node, incoming data packets each having the address of the filter node as the destination address;
  
  for each incoming data packet received from the public network, at the filter node, correlating the destination port of the destination information in the incoming data packet to particular source information being maintained and replacing, in the incoming data packet, the destination information with the particular source information;
  
  routing from the filter node, in the private network, the incoming data packets having the replaced destination information to the corresponding private network nodes;
  
  ignoring by the filter node any incoming data packet received from the public network, if the destination port of the destination information in that incoming data packet can not be correlated to the maintained source information,wherein maintaining the source information includes storing the source information from each outgoing data packet as an entry in a lookup table, and the filter node port value correlating to the source information constitutes an index into the table for that entry;
  
  wherein the data packets include packets in accordance with a user datagram protocol (UDP) over an internet protocol (IP); and
  
  receiving at the filter node a UDP data packet from the private network, and adding the source information and the destination information from the UDP packet together with an interval indication for an expiration timer as a new entry in the lookup table.

11. A method of interfacing private and public data communications networks, through a filter node in communication with both networks, comprising the steps of:
- (a) receiving at the filter node, from the private network, a data packet having a destination address corresponding to a node in the public network and a source address corresponding to a node in the private network;
  
  (b) maintaining, by the filter node, the source address taken from the data packet;
  
  (c) replacing, in the data packet, the source address with an address of the filter node, wherein the source address includes a port number of the node in the private network and the address of the filter node includes a port number of the filter node;
  
  (d) routing from the filter node, in the public network, the data packet having the replaced source address, according to the destination address, to the corresponding public node network;
  
  (e) waiting for a return packet from the public network, responsive to the data packet having the replaced source information;
  
  (f) replacing, in the return packet, the destination address with the maintained source address; and
  
  (g) routing from the filter node, in the private network, the return packet having the replaced destination address to the corresponding private network node.
- View Dependent Claims (12, 13)
- - 12. A method as claimed in claim 11, comprising buffering, at the filter node, further data packets received from the private network while waiting for the return packet, and repeating steps (b) through (g) on an individual basis for the further packets, if any, that were buffered.
  - 13. A method as claimed in claim 12, wherein the data packets include packets in accordance with an internet control message protocol (ICMP).

14. A method of operating a filter node for interfacing first and second data communications networks, comprising the steps of:
- receiving from the first network, an outgoing data packet having destination information, which includes a destination address and a destination port, corresponding to a node in the second network and having source information, which includes a source address and a source port, corresponding to a node in the first network;
  
  maintaining the source information taken from the outgoing data packet in correlation with a unique value representing a port of the filter node;
  
  replacing in the outgoing data packet the source address with an address of the filter node and the source port with the filter node port value; and
  
  sending to the second network the outgoing data packet having the replaced source information, whereby the packet is routed according to its destination information to the corresponding second network node.
- View Dependent Claims (15, 16, 17, 18, 22)
- - 15. A method as claimed in claim 14, further comprising the steps of:
    - receiving from the second network, an incoming data packet having the address of the filter node as the destination address;
      
      correlating the destination port of the destination information in the incoming data packet to particular source information being maintained;
      
      replacing, in the incoming data packet, the destination information with the particular source information;
      
      sending to the first network the incoming data packet having the replaced destination information, whereby that packet is routed according to its destination information to the corresponding first network node.
  - 16. A method as claimed in claim 15, comprising ignoring the incoming data packet received from the second network, if the destination port of the destination information in that data packet can not be correlated to the maintained source information.
  - 17. A method as claimed in claim 16, wherein maintaining the source information includes storing the source information from the outgoing data packet as an entry in a lookup table, and the filter node port value correlating to the source information constitutes an index into the table for that entry.
  - 18. A method as claimed in claim 17, wherein the incoming and outgoing data packets include packets in accordance with a transmission control protocol (TCP) over an internet protocol (IP).
  - 22. A method as claimed in claim 17, wherein the outgoing and incoming data packets include packets in accordance with a user datagram protocol (UDP) over an internet protocol (IP).

19. A method of operating a filter node for interfacing first and second data communications networks comprising the steps of:
- receiving from the first network, an outgoing data packet having destination information, which includes a destination address and a destination port, corresponding to a node in the second network and having source information, which includes a source address and a source port, corresponding to a node in the first network;
  
  maintaining the source information taken from the outgoing data packet in correlation with a unique value representing a port of the filter node;
  
  replacing in the outgoing data packet the source address with an address of the filter node and the source port with the filter node port value;
  
  sending to the second network the outgoing data packet having the replaced source information, whereby that packet is routed according to its destination information to the corresponding second network node,receiving from the second network, an incoming data packet having the address of the filter node as the destination address;
  
  correlating the destination port of the destination information in the incoming data packet to particular source information being maintained;
  
  replacing, in the incoming data packet, the destination information with the particular source information;
  
  sending to the first network the incoming data packet having the replaced destination information whereby that packet is routed according to its destination information to the corresponding first network node;
  
  ignoring the incoming data packet received from the second network, if the destination port of the destination information in that data packet can not be correlated to the maintained source information,wherein maintaining the source information includes storing the source information from the outgoing data packet as an entry in a lookup table, and the filter node port value correlating to the source information constitutes an index into the table for that entrywherein the incoming and outgoing data packets include packets in accordance with a transmission control protocol (TCP) over an internet protocol (IP); and
  
  receiving an outgoing TCP packet from the first network; and
  
  if an entry corresponding to the outgoing TCP packet is not found in the lookup table and the outgoing TCP packet indicates that this is a connection request, storing the source information together with the destination information from the TCP packet as a new entry in the lookup table.
- View Dependent Claims (20, 21)
- - 20. A method as claimed in claim 19, comprising receiving any incoming TCP packet from the second network;
    - and if the source port in that received incoming TCP packet is different from the destination port in a source information entry of the lookup table, indexed by the destination port in the outgoing TCP packet, and if that incoming TCP packet indicates that it is a first response to the connection request, then updating the destination port in the table entry with the source port from that received incoming TCP packet.
  - 21. A method as claimed in claim 20, comprising receiving any incoming TCP packet having an end of transmission code in the packet, and zeroing an entry in the lookup table corresponding to that received incoming TCP packet.

23. A method of operating a filter node for interfacing first and second data communications networks, comprising the steps of:
- receiving from the first network, an outgoing data packet having destination information, which includes a destination address and a destination port, corresponding to a node in the second network and having source information, which includes a source address and a source port, corresponding to a node in the first network;
  
  maintaining the source information taken from the outgoing data packet in correlation with a unique value representing a port of the filter node;
  
  replacing in the outgoing data packet the source address with an address of the filter node and the source port with the filter node port value;
  
  sending to the second network the outgoing data packet having the replaced source information, whereby that packet is routed according to its destination information to the corresponding second network node;
  
  receiving from the second network, an incoming data packet having the address of the filter node as the destination address;
  
  correlating the destination port of the destination information in the incoming data packet to particular source information being maintained;
  
  replacing, in the incoming data packet, the destination information with the particular source information;
  
  sending to the first network the incoming data packet having the replaced destination information, whereby that packet is routed according to its destination information to the corresponding first network node; and
  
  ignoring the incoming data packet received from the second network, if the destination port of the destination information in that data packet can not be correlated to the maintained source information,wherein maintaining the source information includes storing the source information from the outgoing data packet as an entry in a lookup table, and the filter node port value correlating to the source information constitutes an index into the table for that entry;
  
  wherein the outgoing and incoming data packets include packets in accordance with a user datagram protocol (UDP) over an internet protocol (IP); and
  
  receiving a UDP data packet from the first network, and adding the source information and the destination information from the UDP packet together with an interval indication for an expiration timer as a new entry in the lookup table.

24. A method of operating a filter node for interfacing first and second data communications networks, comprising the steps of:
- (a) receiving from the first network, a data packet having a destination address corresponding to a node in the second network and a source address corresponding to a node in the first network;
  
  (b) maintaining the source address taken from the data packet;
  
  (c) replacing, in the data packet, the source address with an address of the filter node, wherein the source address includes a source port number and the address of the filter node includes a port number of the filter node;
  
  (d) sending to the second network the data packet having the replaced source address, whereby that packet is routed to the corresponding second network node;
  
  (e) receiving a return packet from the second network, responsive to the data packet having the replaced source information;
  
  (f) replacing, in the return packet, the destination address with the maintained source address; and
  
  (g) sending to the first network the return packet having the replaced destination address, whereby that packet is routed to the corresponding first network node.
- View Dependent Claims (25, 26)
- - 25. A method as claimed in claim 24, comprising buffering further data packets received from the first network while waiting for the return packet, and repeating steps (b) through (g) on an individual basis for the further packets, if any, that were buffered.
  - 26. A method as claimed in claim 25, wherein the data packets include packets in accordance with an internet control message protocol (ICMP).

27. A filter node for interfacing first and second data communications networks, comprising:
- means for receiving from the first network, a data packet having destination information, which includes a destination address and a destination port, corresponding to a node in the second network and having source information, which includes a source address and a source port, corresponding to a node in the first network;
  
  means for maintaining the source information taken from the data packet in correlation with a unique value representing a port of the filter node;
  
  means for replacing in the data packet the source address with an address of the filter node and the source port with the filter node port value; and
  
  means for sending to the second network, the data packet having the replaced source information, whereby that packet is routed according to its destination information to the corresponding second network node.
- View Dependent Claims (28, 29, 30)
- - 28. A filter node as claimed in claim 27, comprising:
    - means for receiving from the second network, a data packet having the address of the filter node as the destination address;
      
      means for correlating the destination port of the destination information in the data packet to particular source information being maintained;
      
      means for replacing, in the data packet, the destination information with the particular source information; and
      
      means for sending to the first network the data packet having the replaced destination information, whereby that packet is routed according to its destination information to the corresponding first network node.
  - 29. A filter node as claimed in claim 28, comprising means for ignoring a data packet received from the second network, if the destination port of the destination information in that data packet can not be correlated to the maintained source information.
  - 30. A filter node as claimed in claim 29, wherein the means for maintaining the source information includes means for storing the source information from the data packet as an entry in a lookup table, and wherein the filter node port value correlating to the source information constitutes an index into the table for that entry.

31. A filter node for interfacing first and second data communications networks, comprising:
- (a) means for receiving from the first network, a data packet having a destination address corresponding to a node in the second network;
  
  (b) means for maintaining the source address taken from the data packet;
  
  (c) means for replacing, in the data packet, the source address with an address of the filter node, wherein the source address includes a source port number and the address of the filter node includes a port number of the filter node;
  
  (d) means for sending to the second network the data packet having the replaced source address, whereby that packet is routed to the corresponding second network node;
  
  (e) means for receiving a return packet from the second network, responsive to the data packet having the replaced source information;
  
  (f) means for replacing, in the return packet, the destination address with the maintained source address; and
  
  (g) means for sending to the first network the return packet having the replaced destination address, whereby that packet is routed to the corresponding the first network node.
- View Dependent Claims (32)
- - 32. A filter node as claimed in claim 31, comprising means for buffering further data packets received from the first network while waiting for the return packet, and means for controlling means (b) through (g) on an individual basis for processing the further packets, if any, that were buffered.

Specification

Resources

Litigation Campaign Assessment

Litigation Data

Current Assignee
RPX Clearinghouse LLC (RPX Corporation)
Original Assignee
Nortel Networks Corporation
Inventors
Colvin, William G., Wootton, Bruce Anthony
Primary Examiner(s)
Patel, Ajit
Assistant Examiner(s)
Phunkulh, Bob A.

Application Number

US08/842,328
Time in Patent Office

1,258 Days
Field of Search

370/351, 370/352, 370/355, 370/389, 370/390, 370/392, 370/393, 370/400, 370/401, 370/402, 370/409, 395/200.6, 395/200.62, 395/200.68, 395/200.72, 713/201
US Class Current

370/392
CPC Class Codes

H04L 12/4604   LAN interconnection over a ...

H04L 12/66   Arrangements for connecting...

H04L 61/00   Network arrangements, proto...

H04L 61/2514   between local and global IP...

H04L 61/2517   using port numbers

H04L 63/0281   Proxies

H04L 63/029   Firewall traversal, e.g. tu...

Internet protocol filter

First Claim

20 Assignments

Litigations

6 Petitions

Accused Products

Abstract

267 Citations

32 Claims

Specification

Use Cases

Quick Links

Others

Internet protocol filter

First Claim

20 Assignments

Subscription Required

Subscription Required

Litigations

6 Petitions

Subscription Required

Accused Products

Subscription Required

Abstract

267 Citations

32 Claims

Specification

Subscription Required

Use Cases

Quick Links

Others