US6154839A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Translating packet addresses based upon a user identifier
Assignee: Avaya Inc
•
Filing: 1998-04-23
•
Granted: 2000-11-28
•
Expires: 2018-04-23
Abstract
Abstract One embodiment of the present invention includes a system that translates addresses in a data packet based upon a user identifier in the data packet. The system receives the data packet sent from a source node to a destination node by a user. This data packet includes a source address of the source node, a destination address of the destination node and the user identifier that identifies the user. The system uses the user identifier to look up communication privileges associated with the user. If the communication privileges allow the user to communicate with the destination node, the system replaces the source address in the data packet with a privileged address, and forwards the data packet to the destination node. In a variation on this embodiment, the privileged address is recognized by a system firewall so that it facilitates passage of the packet through firewall. In another variation, the privileged address specifies a return address of a given address translation unit and thereby facilitates load balancing across multiple address translation units. In a further variation, the system receives a reply packet from the destination node directed to the privileged address, and replaces the privileged address in the reply packet with the source address so that the reply packet is directed to the source node, before forwarding the reply packet to the source node. In another variation, receiving the reply packet includes acting as a proxy for the privileged address under the address resolution protocol. Another variation further includes authenticating, encrypting and optionally compressing the data packet.
Inventors
- 👤 Leslie J. Arrow
- 👤 Henk J. Bots
- 👤 Mark R. Hoke
- 👤 William E. Hunt
- 👤 Bruce T. Huntley
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-26 22:06
CPC Classifications
H; H04; H04L; H04L12/00; H04L12/28; H04L12/46; H04L12/4641; H04L61/00; H04L61/09; H04L61/25; H04L61/2503; H04L61/2514; H04L61/255; H04L61/2557; H04L63/00; H04L63/02; H04L63/0272
Claims Analysis
Total Claims: 29
Claim 1
Independent Claim
190 words
A method for translating addresses for a data packet based upon a user identifier in the data packet in order to forward the data packet through a firewall, comprising: receiving the data packet sent by a user from a source node outside the firewall to a protected destination node within the firewall, the data packet including, a source address of the source node, a destination address of the protected destination node and the user identifier that identifies the user; reading the user identifier from the data packet; using the user identifier to determine communication privileges associated with the user; replacing the source address in the data packet with a privileged address from a set of privileged addresses recognized by the firewall if the communication privileges allow the user to communicate with the protected destination node; wherein the firewall is configured to allow only data packets from the set of privileged addresses to pass through the firewall; and forwarding the data packet to the protected destination node through the firewall; whereby the privileged address in the source field of the data packet allows the data packet to pass through the firewall.
Claim 2
Independent Claim
190 words
A method for translating addresses for a data packet based upon a user identifier in the data packet in order to forward the data packet through a firewall, comprising: receiving the data packet sent by a user from a source node outside the firewall to a protected destination node within the firewall, the data packet including, a source address of the source node, a destination address of the protected destination node and the user identifier that identifies the user; reading the user identifier from the data packet; using the user identifier to determine communication privileges associated with the user; replacing the source address in the data packet with a privileged address from a set of privileged addresses recognized by the firewall if the communication privileges allow the user to communicate with the protected destination node; wherein the firewall is configured to allow only data packets from the set of privileged addresses to pass through the firewall; and forwarding the data packet to the protected destination node through the firewall; whereby the privileged address in the source field of the data packet allows the data packet to pass through the firewall.
Claim 3
Dependent Claim
56 words
The method of claim 1, further comprising: receiving a reply packet from the protected destination node directed to the privileged address through the firewall; replacing the privileged address in the reply packet with the source address so that the reply packet is directed to the source node; and forwarding the reply packet to the source node.
Claim 4
Dependent Claim
24 words
The method of claim 2, wherein receiving the reply packet includes acting as a proxy for the privileged address under the address resolution protocol.
Claim 5
Dependent Claim
31 words
The method of claim 1, further comprising authenticating the data packet by looking up an authentication key for the data packet, and using the authentication key to authenticate the data packet.
Claim 6
Dependent Claim
22 words
The method of claim 4, wherein looking up the authentication key includes looking up the authentication key based upon the user identifier.
Claim 7
Dependent Claim
11 words
The method of claim 1, further comprising encrypting the data packet.
Claim 8
Dependent Claim
39 words
The method of claim 1, further comprising: associating the user identifier with the source node; and if a packet is subsequently received with the user identifier from a node other than the source node, indicating a possible network attack.
Claim 9
Dependent Claim
50 words
The method of claim 1, wherein receiving the data packet includes receiving the data packet at a virtual private network unit, the virtual private network unit being coupled to a public network and providing secure communications on the public network for communications that pass through the virtual private network unit.
Claim 10
Dependent Claim
19 words
The method of claim 1, wherein receiving the data packet includes receiving the data packet at a network router.
Claim 11
Dependent Claim
17 words
The method of claim 1, wherein the privileged address is retrieved from a pool of privileged addresses.
Claim 12
Dependent Claim
23 words
The method of claim 1, wherein the source node is a remote client that can assume different source addresses for different connection sessions.
Claim 13
Independent Claim
266 words
A method for translating addresses for a data packet based upon a user identifier in the data packet in order to forward the data packet through a firewall, comprising: receiving the data packet sent by a user from a source node outside the firewall to a protected destination node within the firewall, the data packet including, a source address of the source node, a destination address of the protected destination node and the user identifier that identifies the user; reading the user identifier from the data packet; authenticating the data packet by looking up an authentication key for the data packet using the user identifier, and using the authentication key to authenticate the data packet; using the user identifier to determine communication privileges associated with the user; replacing the source address in the data packet with a privileged address from a set of privileged addresses recognized by the firewall if the communication privileges allow the user to communicate with the protected destination node; wherein the firewall is configured to allow only data packets from the set of privileged addresses to pass through the firewall; forwarding the data packet to the protected destination node through the firewall; whereby the privileged address in the source field of the data packet allows the data packet to pass through the firewall; receiving a reply packet from the protected destination node directed to the privileged address through the firewall; replacing the privileged address in the reply packet with the source address so that the reply packet is directed to the source node; and forwarding the reply packet to the source node.
Claim 14
Independent Claim
266 words
A method for translating addresses for a data packet based upon a user identifier in the data packet in order to forward the data packet through a firewall, comprising: receiving the data packet sent by a user from a source node outside the firewall to a protected destination node within the firewall, the data packet including, a source address of the source node, a destination address of the protected destination node and the user identifier that identifies the user; reading the user identifier from the data packet; authenticating the data packet by looking up an authentication key for the data packet using the user identifier, and using the authentication key to authenticate the data packet; using the user identifier to determine communication privileges associated with the user; replacing the source address in the data packet with a privileged address from a set of privileged addresses recognized by the firewall if the communication privileges allow the user to communicate with the protected destination node; wherein the firewall is configured to allow only data packets from the set of privileged addresses to pass through the firewall; forwarding the data packet to the protected destination node through the firewall; whereby the privileged address in the source field of the data packet allows the data packet to pass through the firewall; receiving a reply packet from the protected destination node directed to the privileged address through the firewall; replacing the privileged address in the reply packet with the source address so that the reply packet is directed to the source node; and forwarding the reply packet to the source node.
Claim 15
Dependent Claim
11 words
The method of claim 12, further comprising encrypting the data packet.
Claim 16
Independent Claim
240 words
An apparatus that translates addresses for a data packet based upon a user identifier in the data packet in order to forward the data packet through a firewall, comprising: a packet receiving mechanism, for receiving the data packet sent by a user from a source node outside the firewall to a protected destination node within the firewall, the data packet including, a source address of the source node, a destination address of the protected destination node and the user identifier that identifies the user; a packet storage unit, coupled to the packet receiving mechanism, for storing the data packet; a communication privilege determination mechanism, in communication with the packet storage unit, that is configured to determines communication privileges associated with the user based upon the user identifier; a replacement mechanism, in communication with the packet storage unit, that replaces the source address in the data packet with a privileged address from a set of privileged addresses recognized by the firewall if the communication privileges allow the user to communicate with the protected destination node; wherein the firewall is configured to allow only data packets from the set of privileged addresses to pass through the firewall; and a packet forwarding unit, coupled to the packet storage unit, that forwards the data packet to the protected destination node through the firewall; whereby the privileged address in the source field of the data packet allows the data packet to pass through the firewall.
Claim 17
Independent Claim
240 words
An apparatus that translates addresses for a data packet based upon a user identifier in the data packet in order to forward the data packet through a firewall, comprising: a packet receiving mechanism, for receiving the data packet sent by a user from a source node outside the firewall to a protected destination node within the firewall, the data packet including, a source address of the source node, a destination address of the protected destination node and the user identifier that identifies the user; a packet storage unit, coupled to the packet receiving mechanism, for storing the data packet; a communication privilege determination mechanism, in communication with the packet storage unit, that is configured to determines communication privileges associated with the user based upon the user identifier; a replacement mechanism, in communication with the packet storage unit, that replaces the source address in the data packet with a privileged address from a set of privileged addresses recognized by the firewall if the communication privileges allow the user to communicate with the protected destination node; wherein the firewall is configured to allow only data packets from the set of privileged addresses to pass through the firewall; and a packet forwarding unit, coupled to the packet storage unit, that forwards the data packet to the protected destination node through the firewall; whereby the privileged address in the source field of the data packet allows the data packet to pass through the firewall.
Claim 18
Dependent Claim
60 words
The apparatus of claim 14, further comprising: a reply receiving mechanism, for receiving a reply packet from the protected destination node directed to the privileged address through the firewall; and wherein the replacement mechanism is configured to replace the privileged address in the reply packet with the source address so that the reply packet is directed to the source node.
Claim 19
Dependent Claim
26 words
The apparatus of claim 15, wherein the reply receiving mechanism is configured to act as a proxy for the privileged address under the address resolution protocol.
Claim 20
Dependent Claim
21 words
The apparatus of claim 14, further comprising an authentication mechanism, coupled to the packet storage unit, for authenticating the data packet.
Claim 21
Dependent Claim
22 words
The apparatus of claim 17, wherein the authentication mechanism is configured to look up the authentication key based upon the user identifier.
Claim 22
Dependent Claim
21 words
The apparatus of claim 14, further comprising an encryption mechanism in communication with the packet storage unit, for encrypting the packet.
Claim 23
Dependent Claim
46 words
The apparatus of claim 14, further comprising a user identifier association unit, for associating the user identifier with the source node, and if a data packet is subsequently received with the user identifier from a node other than the source node, indicating a possible network attack.
Claim 24
Dependent Claim
45 words
The apparatus of claim 14, wherein the apparatus is part of a virtual private network unit, the virtual private network unit being coupled to a public network and providing secure communications on the public network for communications that pass through the virtual private network unit.
Claim 25
Dependent Claim
14 words
The apparatus of claim 14, wherein the apparatus is part of a network router.
Claim 26
Dependent Claim
22 words
The apparatus of claim 14, wherein the replacement mechanism is configured to retrieve the privileged address from a pool of privileged addresses.
Claim 27
Dependent Claim
23 words
The apparatus of claim 14, wherein the source node is a remote client that can assume different source addresses for different connection sessions.
Claim 28
Dependent Claim
205 words
A program storage device storing instructions that when executed by a computer perform a method for translating addresses for a data packet based upon a user identifier in the data packet in order to forward the data packet through a firewall, the method comprising: receiving the data packet sent by a user from a source node outside the firewall to a protected destination node within the firewall, the data packet including, a source address of the source node, a destination address of the protected destination node and the user identifier that identifies the user; reading the user identifier from the data packet; using the user identifier to determine communication privileges associated with the user; replacing the source address in the data packet with a privileged address from a set of privileged addresses recognized by the firewall if the communication privileges allow the user to communicate with the protected destination node; wherein the firewall is configured to allow only data packets from the set of privileged addresses to pass through the firewall; and forwarding the data packet to the protected destination node through the firewall; whereby the privileged address in the source field of the data packet allows the data packet to pass through the firewall.
Claim 29
Dependent Claim
205 words
A program storage device storing instructions that when executed by a computer perform a method for translating addresses for a data packet based upon a user identifier in the data packet in order to forward the data packet through a firewall, the method comprising: receiving the data packet sent by a user from a source node outside the firewall to a protected destination node within the firewall, the data packet including, a source address of the source node, a destination address of the protected destination node and the user identifier that identifies the user; reading the user identifier from the data packet; using the user identifier to determine communication privileges associated with the user; replacing the source address in the data packet with a privileged address from a set of privileged addresses recognized by the firewall if the communication privileges allow the user to communicate with the protected destination node; wherein the firewall is configured to allow only data packets from the set of privileged addresses to pass through the firewall; and forwarding the data packet to the protected destination node through the firewall; whereby the privileged address in the source field of the data packet allows the data packet to pass through the firewall.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-11-28 | 2004-05-29 | 2004-11-28 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-11-28 | 2008-05-29 | 2008-11-28 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-11-28 | 2012-05-29 | 2012-11-28 | $7700.00 | Window Closed / Lapsed |