System and method for IP network address translation using selective masquerade

U.S. patent applications Ser. No. 09/135,102 filed Aug. 17, 1998, now U.S. Pat. No. 6,182,228, entitled “System and Method for Very Fast IP Packet Filtering”, Ser. No. 09/135,148 filed Aug. 17, 1998, now U.S. Pat. No. 6,266,707, entitled “System and Method for IP Network Address Translation and IP Filtering With Dynamic Address Resolution” and Ser. No. 09/135,253 filed Aug. 17, 1998 now U.S. Pat. No. 6,272,518, entitled “System and Method for Porting a Multithreaded Program to a Job Model”, are assigned to the same assignee hereof and contain subject matter related, in certain respect, to the subject matter of the present application. The above identified patent applications are incorporated herein by reference.

1. Technical Field of the Invention

This invention pertains to network address translation and IP filtering. More specifically, it relates to selective masquerading of internal IP addresses among a plurality of public IP address.

2. Background Art

IP Network Address Translation (NAT) and IP Filtering functions provide firewall-type capability to an Internet gateway system.

Network Address Translation (NAT) is done various ways. Among the known ways is masquerade NAT, in which IP addresses in IP packets are changed as the packets flow out of and into a masquerading system. The masquerading system is typically on the boundary between an organization's private networks and public networks, such as the Internet. The main benefits to these organizations of these address changes are:

1. Systems on the private network are free to use any subset of the IP address space, any IP class, superclass, subclass, or designated private IP addresses. This provides great flexibility, freedom, and control to the organization in assigning IP addresses and designing its internal network.

2. The IP addresses of private systems, the network and subnet architecture are kept hidden. The addresses do not appear on Internet IP packets. Improved security is the result.

Therefore, masquerade NAT is widely used by industry, government and other organizations today.

Masquerade NAT is a form of NAT defined by a many-to-one mapping of an organization's internal addresses to a single, public IP address. There is a need in the art to remove this restriction to a single address; to allow a system administrator to selectively designate subsets of internal IP addresses to be masqueraded, with each subset mapped to a different, single, public IP address; and improve management of internal IP addresses by allowing multiple network interfaces or masquerading systems to be used for load balancing.

It is an object of the invention to provide an improved masquerade NAT capability for gateway systems.

It is a further object of the invention to provide a selective masquerade NAT system capability, whereby subsets of internal IP addresses may be selectively masqueraded among a plurality of public IP addresses.

An address management system and method. ADDRESS statements and HIDE rule statements are processed to generate a file of masquerade rules for associating subsets of internal addresses among a plurality of public addresses. Responsive to these masquerade rules, network address translation is performed for incoming and outgoing IP datagrams.

Other features and advantages of this invention will become apparent from the following detailed description of the presently preferred embodiment of the invention, taken in conjunction with the accompanying drawings.

FIG. 1 is a high level system flow diagram illustrating logical relationships and data flow among key elements of a preferred embodiment of the invention.

FIG. 2 is a diagram illustrating masquerade NAT functions during processing of IP datagrams.

In accordance with the preferred embodiment of the invention, IP Network Address Translation (NAT) and IP Filtering functions provide firewall-type capability to a gateway system, such as the IBM AS/400 system. This is accomplished by providing means for a customer's system administrator to specify specific NAT and Filtering rules (via the AS/400 Operational Navigator GUI). A type of NAT, called masquerade NAT, defines a many-to-one mapping. Other vendors have implemented the ‘many’ side of the mapping as ‘all’. The problem solved by this invention is: how to allow masquerade NAT to function as many-to-one, but allow the ‘many’ to specify subsets of IP addresses? This is useful because it allows traffic separation, which improves throughput to and from external networks (e.g. the Internet). It also allows much greater flexibility in IP address management, a common source of difficulty.

Referring to FIG. 1, key elements of the invention are illustrated with the logical relationships and data flow among them. All depicted function is part of the operating system (OS) of a gateway system, such as the IBM AS/400.

This invention is concerned with the translation of HIDE statements to binary representation, and the interpretation of these masquerade rules as IP datagrams flow through the OS kernel. The NAT (and other rule) statements 120 are processed by rule compiler 122 . An output of a first invocation 124 of rule compiler 122 is two sets of files, s-rule files 126 and i-rule files 128 . These contain the binary form of rules 120 in image format (i-rule 126 ) or retain some symbolic information (s-rule 128 ). An ‘i’ or ‘s’ rule file is generated for each physical interface for which there are rules. A device driver 150 represents an OS kernel 140 code interface to such a physical interface (not shown). Later, when the interface is started (via start CP interface STRTCPIFC command processing), a second invocation 132 of rule compiler 132 completes resolution of s-rule files, and in step 142 loads resolved i-rules 126 and s-rules 128 to NAT rules file 144 in OS kernel 140 .

Binary masquerade rules 144 are now ready to be used by NAT interpreter 146 as IP datagrams enter and leave the system via the IOP (Input/Output Processor, by way of device drivers 150 ). Transport protocols 148 are accessed by interpreter 146 in the course of processing datagrams.

Table 1 shows the HIDE rule statements 120 as entered by the system administrator (a.k.a. customer) and seen by the rule compiler 122 . The words in all upper-case are keywords. The ADDRESS statements of lines 1-5 are used to define sets of IP addresses, specify the type, and associate the set of IP addresses with a name. For example, ADDRESS statement 1 in Table 1 defines as ‘Lan1’ all addresses in the 121.56.3.* subnet, and declares them as TRUSTED. ADDRESS statement 2 defines 3 addresses which are within this subnet. This illustrates the ability to define separate IP groups, which are later associated with different masquerade rules. ADDRESS statement 3 shows the third way in which multiple addresses may be specified—by a range. This is necessary because the customer does not want the entire 121.56.4.* (which is equivalent to the range 121.56.4.1 to 121.56.4.255) subnet to be treated the same. Of course, it is also possible to specify a single IP address in an ADDRESS statement (not shown).

The HIDE statement 7 specifies a masquerade rule that will cause all ‘Lan1’ addresses to be hidden (translated) behind 87.30.104.6 (publicaddress2). The first HIDE statement (statement 6 in the Table 1) hides the 3 servers in servergroup1 (see ADDRESS statement 2) behind a different global address publicaddress1. Thus the server traffic is isolated, even though all 3 servers have IP addresses within the subnet of Lan1. The normal convention applies to an address set named in HIDE statements—they must have been defined in some prior ADDRESS statement.

Referring to FIG. 2, masquerade NAT functions during the processing of IP datagrams 160 as follows. The logical steps which comprise masquerade NAT are in two groups. The first group occurs when an IP datagram 160 is first seen that matches a HIDE statement 170 . A match occurs when the source IP address 162 in datagram 160 is equal to one of the IP addresses in the HIDE left-hand-side (lhs) (which is the set 172 of addresses to the left of the BEHIND keyword). This is step 101 in the figure. This match causes a ‘conversation’ 180 to be created (steps 102 - 105 ). Essentially, one conversation 180 is created for each TCP session or UDP datagram that requires special handling (see below). Each conversation 180 has a unique right-hand-side (rhs) port 188 selected for it, from a pool 176 of port numbers (1 pool each for TCP, UDP) for use by masquerade NAT. Once created, later matching of outbound datagrams 190 is done against the conversation 180 , rather than the binary hide rule (see the pseudo-code, below).

The main purpose of conversation 180 is to permit unique matching of response (inbound) datagrams 160 , based on the rhs port number 188 . Hence, an important characteristic of masquerade NAT (regarded as a security feature), is that traffic must initiate from an internal (TRUSTED) IP address.

Once a conversation 180 is established, address translation can be done (steps 106 , 107 ). The source IP address 162 and port 164 are changed to the conversation's rhs IP address 186 , 174 and port 188 . Checksum and handling of special traffic is done (ICMP, FTP—all, not shown in figure), and the datagram 160 is set on its way. The steps for inbound masquerade NAT are simpler, since the conversation must have been established. The destination IP address 192 and port 194 are tested against conversations 180 until a conversation 180 is found that matches (has equal rhs IP address 186 and port number 188 ) (step 108 ). Then the destination IP address 192 and port 194 are changed (translated) into the conversation's lhs IP address 182 and port 184 , respectively. (Checksum and special traffic handling is then done—not shown in figure.)

A key aspect of this embodiment of the invention lies in step 101 —the outbound datagram source IP address is compared to either a list of addresses, a subnet mask, or a range of addresses. So, the broad result achieved is that, a) the internal (TRUSTED) addresses never appear in IP datagrams leaving the masquerade NAT system (which provides security and IP address isolation advantages), b) the many-to-one NAT means only a single public address is ‘consumed’ (a resource of increasing rarity) while allowing many internal systems to communicate to external systems, and c) the entire process is completely invisible to external systems (no changes or configuration necessary other than to the NAT system).

In accordance with the preferred embodiment of the invention, the method steps include:

1. Processing ADDRESS & HIDE rule statements 120 to generate binary form 144 .

2. Performing NAT 146 with the binary masquerade rules for each IP datagram 160 , 190 .

Tables 3 and 4 are pseudo-code (C++—like syntax) descriptions of these functional steps.

Advantages Over the Prior Art

It is an advantage of the system and method of the preferred embodiment of this invention that there is provided an improved masquerade NAT capability for gateway systems.

It is a further advantage that there is provided a selective masquerade NAT system capability, whereby subsets of internal IP addresses may be selectively masqueraded among a plurality of public IP addresses.

Alternative Embodiments

It will be appreciated that, although specific embodiments of the invention have been described herein for purposes of illustration, various modifications may be made without departing from the spirit and scope of the invention. In particular, it is within the scope of the invention to provide a memory device, such as a transmission medium, magnetic or optical tape or disc, or the like, for storing signals for controlling the operation of a computer according to the method of the invention and/or to structure its components in accordance with the system of the invention.

Accordingly, the scope of protection of this invention is limited only by the following claims and their equivalents.