EP2127328A2

EP2127328A2 - Addressing system

Info

Publication number: EP2127328A2
Application number: EP08709197A
Authority: EP
Inventors: Sam Machin; Chris Box; Paul Ross
Original assignee: Orange Personal Communications Services Ltd
Current assignee: Orange SA
Priority date: 2007-02-23
Filing date: 2008-02-25
Publication date: 2009-12-02
Also published as: WO2008102013A3; GB2446877A; WO2008102013A2; GB0703595D0

Abstract

Embodiments of the invention are concerned with transmitting data between devices in a network. The invention involves use of a fixed network node, which can retrieve temporarily assigned IP addresses of the terminals and replace the source or destination addresses of packets with a retrieved IP address, and an association between temporarily assigned IP addresses and subscription data. In addition, applications running on a mobile terminal are preconf igured to transmit packets to this fixed node, which, in response to receiving such packets, is triggered to retrieve a dynamically assigned IP address corresponding to the subscription and translate the destination address to this IP address. IP addresses of respective devices forming part of any given subscription are associated by a subscription identifier such as an MSISDN; since, when packets originate from a mobile terminal the MSISDN accompanies packets received by the fixed node, this ensures selection of the appropriate IP address on the basis of the previously defined association between the temporary IP addresses.

Description

Addressing System

Field of the Invention

The present invention relates to a method of and system for transmitting data between devices in a network, and is particularly, but not exclusively, suitable for transmitting data between two devices that are associated with a given network subscription and whose network addresses are dynamically assigned in accordance with their mobility and/or connection status.

Background of the Invention

Network operators are increasingly offering converged services to subscribers, such services including a mobile device and a broadband connection for the subscriber's home computer(s). The home computer(s) are connected to a public network such as the Internet via an access point, such as an ADSL router, and can run applications such as video applications connected to a webcam, digital TV applications, and/or gaming applications and the like. The mobile device and computer can communicate with each other and/or any other connected device, enabling the mobile device to retrieve data from and display the application data running on the home computer. A key characteristic of these services is that the Internet Protocol (IP) addresses of the mobile and home devices are temporarily assigned from a pool of IP addresses; the addresses persist for as long as the respective device is being used, or in the case of the mobile device, for as long as the mobile device remains connected to a given gateway GPRS support node (GGSN). As a result, the IP address allocated to a device on one day, or in one location, can change; since transmission of data is wholly dependent on knowing the respective source and destination addresses, this presents a problem when the mobile device is communicating with the home computer.

Known systems provide a solution to this problem, which involves the user of the mobile terminal manually entering the IP address allocated to their broadband service, typically via configuration settings associated with a particular application; however, this requires the user to have access to the broadband IP address and also to be capable of updating the settings on their device. Also, and precisely because access to remote data is dependent on settings that can be set manually, there are significant questions in relation to the security of such converged services. As a result, users are typically reluctant to make full use of this converged service.

Summary of the Invention

In accordance with one aspect of the present invention, there is provided a method of transmitting data between a first terminal and a second terminal in a network, the first terminal having a first temporary network address and the second terminal having a second temporary network address, the network comprising a storage system arranged to hold data indicative of an association between said first temporary network address and said second temporary network address, the first terminal being configured with one or more predetermined network addresses for use in addressing data transmitted from the first terminal to the second terminal during a communications session, the method comprising: receiving data transmitted from the first terminal, the received data having a said first temporary network address as source address and a said predetermined network address as destination address; identifying a said second temporary network address on the basis of the first temporary network address; transmitting data derived from the received data, the transmitted data having the identified second temporary network address as destination address and said predetermined network address as source address.

Embodiments of the invention are particularly suited to arrangements in which the first terminal is a mobile device and the second terminal is a fixed device, such as is provided by converged services configurations. In such embodiments, applications running on a mobile terminal are preconfigured to transmit packets to a fixed node within the network, even though the packets are actually destined for a terminal other than the node (i.e. the second terminal). In response to receipt of the packets, the node translates the destination address of the packets so as to match the temporarily assigned IP address of the actual destination terminal. Selection of the appropriate IP address is ensured by the association between the temporary IP addresses, which, when the two end points are part of a given network subscription comprising a mobile and home service, can be subscription identifiers such as MSISDN and/or home identifiers.

In one arrangement the association between said first temporary network address and said second temporary network address includes a subscription identifier, for example an account reference corresponding to a network subscription comprising services associated with the first terminal and the second terminal. In another arrangement the association comprises an external identifier such as a MSISDN for use in routing communications to said first terminal, whilst in a yet further arrangement the association comprises an identifier associated with the second terminal such as a home account identifier.

Conveniently the method can include storing the first temporary network address and said identified second temporary network address in a cache, for use in translating source and destination addresses of packets subsequently transmitted between the first and second terminals during the communications session. This storing of the temporary addresses in a cache, preferably locally, removes the need for access to the storage system once the communications session has started; particularly advantageously, data can be deleted from the cache in response to certain predetermined conditions being satisfied, such as receiving data indicative of the communications session having been terminated. In one arrangement the predetermined network address is a static network address, for example an IP address that is directly accessible from the first terminal. Thus for embodiments in which the first terminal comprises a mobile device, the predetermined network address is an IP address local to the mobile network. Most preferably the predetermined network address corresponds to a network node that is capable of performing address translation whereby to translate the destination address to the identified second temporary network address as destination address and the source address to that of the network node.

In order to effect embodiments of the invention the first device is preferably configured with a software application arranged to cooperate with the second device, the software application being preconfigured with a said one or more predetermined network addresses such that packets transmitted from said software application are routed to a network node associated with the predetermined network address.

Since the applications are preconfigured to transmit data to a specified network node, the provider of the service can advantageously apply a generic configuration to each device at the point of manufacture. Moreover, since the applications are preconfigured, the subscriber does not have to configure their device(s). Particularly advantageously, because the actual addressing of packets is controlled by a node within the network and is performed purely on the basis of subscription data, access to the home services is controlled by the network and, subject to appropriate firewall settings, is bounded such that only those devices associated with a subscription can access the corresponding home services. Furthermore, since the invention involves address translation at the IP layer, embodiments of the invention are independent of the application layer and will thus work with all IP based services.

According to a further aspect of the present invention there is provided a distributed system arranged to perform the afore-mentioned steps.

Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings.

Brief Description of the Drawings

Figure Ia is a schematic block diagram showing an arrangement of a communications network within which embodiments of the invention operate; Figure Ib is a schematic block diagram showing an alternative representation of a communications network within which embodiments of the invention operate;

Figure 2 is a schematic diagram showing a database structure for storing IP addresses in an embodiment of the invention;

Figure 3 is a schematic diagram showing an alternative database structure for storing IP addresses in an embodiment of the invention;

Figure 4 is a schematic block diagram showing a configuration of the control point shown in Figure Ia; Figure 5 is a timing diagram showing steps involved in transmitting data from the mobile device shown in Figure Ia to the remote terminal associated with the mobile device also shown in Figure Ia; and

Figure 6 is a timing diagram showing steps involved in transmitting data from the remote terminal of Figure Ia to the mobile device of Figure Ia.

Detailed Description of the Invention

As described above, embodiments of the invention are concerned with a method of and system for transmitting data between devices, more specifically of providing a mobile device with the capability to view, in real-time, application and service data that are running on a remote device and without having to manually configure settings on the mobile device.

Embodiments of the invention are implemented on devices operating within a communications network arrangement such as that shown in Figures Ia and Ib. Referring to Figure Ia, the network arrangement comprises three network portions: a mobile network portion 1, a public network portion 3, for example the Internet, and a fixed network portion 4. Mobile terminals A, B communicate with the mobile network portion 1 , in a known fashion, using any wireless technology capable of supporting an IP access network, such as Global

System for Mobile Communications (GSM), Universal Mobile Telephone System (UMTS), 3G, General Packet Radio Service (GPRS), Wireless Local (or

Wide) Area Network technologies, and the public network portion 3 essentially serves to route data packets between the mobile terminals A, B and other devices; for the purposes of the present invention this includes servers Sl, S2 in a fixed location and connected to the public network portion 3 via a fixed network portion 4, a Local Area Network (LAN) 7, an access point (AP) and a Broadband Remote Access Server (B-RAS). Embodiments of the invention are particularly well suited to subscribers having a converged service, that is to say one that involves provision of mobile services and broadband services, so that the network provider in relation to terminal A, B is the same as that associated with access point 5. Servers Sl, S2 could be configured to run security and media applications such as are provided by web cam and Slingbox™ technologies, and the access point AP 5 is preferably equipped with (known) firewall technologies configured so as to control access thereto.

In embodiments of the invention the mobile terminal A is equipped to send and receive packetised data via a Serving GPRS Support Node (SGSN; not shown) and a gateway GPRS support node (GGSN) forming part of the mobile network portion 1 , and, once registered with the mobile network portion 1 , the terminal A is assigned an IP address by the GGSN in accordance with known methods; clearly, as the mobile terminal A switches on and off and/or as an existing IP connection is lost, the IP address assigned thereto changes. In relation to the AP 5, typically the service provider (not shown) providing the broadband service allocates an IP address to the AP 5 whenever the AP 5 broadcasts its presence (e.g. when the access point AP 5 is turned on).

Figure Ia also shows a storage system DBl, which in embodiments of the invention is arranged to store address and identification data corresponding to the AP 5 and the mobile terminals A, B, more specifically Internet Protocol (IP) addresses that are dynamically assigned to the AP 5 and mobile terminals A, B, together with their respective permanent identifiers (MSISDN in the case of the mobile terminals A, B and CLI in the case of the access point 5). The database DBl is responsive to write-requests received as a result of the mobile terminals A, B and/or AP 5 being dynamically assigned an IP address, such write-requests being received from the GGSN in the case of the mobile terminals A, B, and from a Broadband Remote Access Server (B-RAS) in the case of the AP 5.

Figure Ib is an alternative representation of the network arrangement, illustrating that the Remote Access Servers (GGSN, BRAS), the database DBl and control point CP (to be described in detail below) are all within the control of the operator offering converged mobile and fixed services.

Embodiments of the invention essentially comprise two distinct, but related, processes. The first is a registration process, which involves storing associations between permanent addresses and temporary addresses so as to enable data to be transmitted between mobile and fixed terminals. The second is a data transmission process, which involves transmitting data to a particular device in accordance with preconfigured settings of the mobile terminal A, the device then modifying the destination address of the transmitted data on the basis of the stored address associations. The first process will now be described in more detail with reference to

Figures 2 and 3: in one arrangement, the storage system DBl comprises a plurality of logically distinct portions: Da, Dh, Dm, these comprising functionality capable of associating, respectively, permanent network identifiers (Da), temporary network identifier with permanent network identifier corresponding to the mobile device A (Dm); and temporary network identifier with permanent network identifier corresponding to the broadband device 5 (Dh).

The steps involved in populating the respective database portions will now be explained in relation to one of the mobile terminals, namely terminal A: when a subscriber registers for the converged mobile and broadband services, an update to database portion Da (step 2.1) is requested, which generates a mapping between the mobile number MSISDN (in this example terminal A) and an identifier corresponding to the broadband connection of the subscriber, which could be a CLI, an account number or a username; for illustrative purposes it will be assumed that the identifier is the CLI. When an IP address is dynamically assigned to the mobile terminal A, such as is the case when a mobile terminal creates a new IP connection, the GGSN allocating the new IP address IP A completes the allocation process by sending the newly allocated IP address IP A to database portion Dm, together with an update request. Upon receipt of the update request, the database portion Dm stores the MSISDN corresponding to mobile terminal A in association with the allocated IP address IP A (step 2.2). Similarly, when the broadband connection is established via AP 5, the B-RAS allocating a new IP address IP Home completes the allocation process by sending the newly allocated IP address IP Home to database portion Dh, causing database portion Dh to store the CLI corresponding to the broadband connection (or other, similar, identifier for the broadband connection) in association with the allocated IP address IP Home (step 2.3). These messages can be transmitted using the known RADIUS™ protocol.

It will be appreciated that these database portions Da, Dh, Dm could instead be part of the same logical storage system, resulting in a database structure such as that shown in Figure 3. It will also be appreciated that steps 2.1, 2.2 and 2.3 can occur asynchronously (indeed, several instances of steps 2.2 and 2.3 can be expected during any given day). Whilst the foregoing makes mention of the subscription involving one mobile terminal A, it could include more than one mobile terminal - for example in the case where a given subscription is a group subscription corresponding to the two mobiles A, B shown in Figure Ia and have one broadband connection.

The second process, which involves transmission of data between two different devices (referred to generically as first and second devices) that are associated with a given subscription, will now be described. In the current embodiment, the first device is mobile terminal A and the second device is one of the application servers Sl, S2 associated with the broadband connection facilitated via access point 5. The mobile terminal A is configured with one or more applications Al, A2, each being associated with the subscription and which requests and displays data received from one of application servers Sl, S2. As described above, in conventional systems the user of mobile terminal A has to manually configure the IP address of access point AP 5, and because this IP address is dynamically assigned by the B-RAS, it is difficult for the user to know the current IP address. This, together with the fact that most users would in any event prefer to avoid having to configure their devices, means that take- up of remote access to home applications is limited. In an embodiment of the invention, applications Al, A2 residing on the mobile terminal A are configured such that all outgoing data ultimately destined for an application server S 1 , S2 are in fact addressed to a device in the network, shown in Figures Ia and Ib as control point CP. The control point CP has a fixed IP address and is arranged to access the storage system DBl in response to receipt of data, sending a query comprising the source address of the received packets. Thus in addition to standard operating system, disc storage, memory and input/output components, the control point CP comprises bespoke software components arranged either to translate the source and destination addresses on the basis of data received from a database lookup as described below, or to extract payload data from messages received from devices, and to create new packets having a payload identical to that extracted from messages, but different source and destination addresses. In either scenario, packets transmitted from the control point CP have a destination address based on the source address of received messages, and a source address corresponding to the IP address of the control point CP. Referring back to Figure Ia, it will be appreciated that embodiments of the invention can operate within many different network configurations involving one or more various different network portions; however, in order to ensure that packets transmitted from the mobile device A to reach the control point CP, and because of the preconfigured settings of the applications Al, A2, the route between the mobile device A and the control point CP should not include any address translation devices.

Referring to Figure 4, in some arrangements, and in order to provide a fault-tolerant and scaleable system, the control point CP can be implemented as a load balancing component 401 and a plurality of address translation processing systems 403a ... 403n, arranged as a cluster of servers. In such arrangements messages are delivered to the load balancing component 401, which allocates a given message to one of the address translation processing systems 403a ... 403n in accordance with a load balancing algorithm so as to ensure that the address translation load is distributed over more than one processing system. Each of the address translation systems in the cluster has an individual IP address, which means that the source address of packets sent from the control point CP will have the IP address of whichever address translation processing system 403a ... 403n the packet was allocated to.

This process will be described with reference to Figure 5. Assuming for illustration purposes that the IP address of the control point CP is 01.01.01.01, and that the current IP address of the mobile terminal A is that stored in database portion Dm (56.56.12.145, as indicated in Figures 2 and 3), then in response to selection by the user, application Al residing on the mobile device A sends a request message Ml having source address 56.56.12.145 and destination address 01.01.01.01 (together with the port number corresponding to application server Sl), so that the message Ml is delivered via the mobile network portion 1 to the control point CP (step S5.1). In response to receipt of message Ml, the control point CP extracts the source address of the message Ml, and formulates a query based thereon, requesting an IP address from database portion Dh in response (step S5.3). In the case where data are stored in database portions Dm, Dh, Da (as per Figure 2), the lookup procedure followed by the database system DBl is a multi-step process comprising a) accessing database portion Dm to extract the MSISDN corresponding to mobile terminal A (in this example 07770 12345); b) accessing database portion Da to look up a home identifier corresponding to the converged account (in this example 01111 12345); and c) accessing database portion Dh to identify an IP address corresponding to the home identifier (in this example 01.24.24.255) (step S5.5).

Once the home IP address has been retrieved from database portion Dh, the IP address is returned to the control point CP (step S5.7), and at step S5.9 the control point CP sets the source address for a message M2 comprising the payload of message Ml to its own IP address (01.01.01.01) and the destination address to the IP address returned at step S5.5, together with the port number included in the destination address of message Ml. It will be appreciated that for arrangements involving use of the load balancing component 401, the database request sent at step S5.3 will be sent by whichever address translation processor 403a ... 403n has been allocated message Ml, and that the source address of message M2 will correspondingly be set to the IP address of this address translation processor 403 a ... 403n.

Thus step S5.9 essentially involves translating both source and destination addresses on the basis of data returned at step S5.5. In addition, step S5.9 involves the control point CP (or allocated address translation processor 403a ... 403n) populating a locally stored session table with port and IP address data for use in translating IP addresses relating to future messages transmitted during a given communications session.

The message M2 is then transmitted by the control point CP (or allocated address translation processor 403a ... 403n) at step S5.11, and is delivered to the access point 5 in accordance with standard IP routing methods. Since the home IP address is assigned to the access point 5, the message M2 is subsequently passed to server Sl in dependence on port configuration settings and/or load balancing algorithms in operation on the access point 5.

In an alternative arrangement - that in which the address and identification data are stored as shown in Figure 3 - step S5.5 involves matching the source address of message Ml (i.e. IP address of mobile terminal A) against an entry of the form "Dynamic IP address (Mobile <n>)". This query should return only one entry, because the dynamically assigned addresses are unique.

In relation to packets subsequently transmitted from the mobile terminal A to the application server S 1 during a given communications session (that is to say, while the IP addresses assigned to the mobile terminal A and access point 5 remain unchanged), the control point CP (or allocated address translation processor 403a ... 403n) can proceed without recourse to the database DBl, instead using the data stored in the local connection table that was populated at step S5.9. Turning now to Figure 6, the steps involved when data are transmitted from the application server S 1 to the mobile device A will now be described. It will be appreciated that depending on the applications running on the servers S 1 , S2, data packets can be pushed to, or pulled from, the mobile device A once the initial connection has been established in the manner described above. Thus whilst Figure 6 only shows one series of steps (in respect of packets represented generically as message M3), it will be appreciated that the steps will occur many times during any given communications session.

At step S6.1, the access point 5 forwards the message M3 transmitted from application server Sl to the control point CP (or allocated address translation processor 403a ... 403n), because the message M3 has the IP address of the control point CP (or allocated address translation processor 403a ... 403n) as its destination address and that of the access point 5 as the source address. Once received, the control point CP (or allocated address translation processor 403a ... 403n) performs a reverse mapping process based on port and corresponding connection data so as to identify the mobile terminal (in this case terminal A) the message M3 is destined for. At step S6.3, the control point CP creates a message M4 (either as a new message, or more preferably by simply changing the destination and source addresses of the message M3), which has the payload of message M3, the source address of the control point CP and the destination address of the mobile terminal A, this being derivable from the port and connection data stored at step S5.9. Since the control point CP (or allocated address translation processor 403a ... 403n) maintains a record of the connection data and port in respect of a given communications session, there is no need for recourse to the storage system DB 1 in relation to communications towards the mobile device A. It is to be noted that irrespective of the device that received message M3 (i.e. the control point CP or one of the address translation processors 403a ... 403n), the source address of message M4 will be the IP address of the control point CP. The control point CP subsequently transmits the message M4, which is delivered to the mobile terminal A, and thence to application Al, in accordance with standard routing methods (step S6.5).

It will thus be appreciated that with embodiments of the invention, management of the connection data required for transmission of packets between the mobile terminal and application servers Sl, S2 is coordinated within the network rather than at the mobile terminal A. This functionality is performed by a control point CP within the network and of course the centralised updating of the dynamically assigned IP addresses, which collectively means that the applications Al, A2 running on the mobile terminal

A, B can be configured with a static (or fixed) IP address. As a result the user of the mobile terminal A does not need to configure the mobile terminal in order to receive data from the remote "home" applications.

Additional Details and Modifications

The foregoing assumes that the mobile terminal A, B remains connected to the application server S 1 during the communications session; however, in the event that the connection status of either the mobile terminal A, the access point 5, or the application server Sl changes, resulting in the affected terminal disconnecting from the network 1, 3, this results in a change to the communications session and to the data stored by the control point CP.

In the case where the mobile terminal A loses an existing IP connection (due to processes occurring at the application layer or because the terminal A is switched off), the mobile terminal A terminates the connection with the existing GGSN, resulting in the GGSN sending a disconnect message to the database DBl; this can be effected using the known RADIUS™ protocol. In response, the database system DBl can clear the entry in the corresponding dynamic IP address field corresponding to the MSISDN in storage portion Dm, and can transmit an instruction to the control point CP, resulting in the control point CP clearing the cache in respect of the corresponding IP address (IPl in Figure 2). Alternatively the GGSN and/or B-RAS could be configured to send the disconnect RADIUS™ message to the control point CP as well as to the database system DBl.

In the event that the access point 5 has disconnected, meaning that the control point CP is unable to redirect traffic thereto, the control point CP is arranged to send a message indicative of an error message, which, when application Al is a HTTP service, can be a 500-type error code (temporary not permanent). In addition or as an alternative, the control point CP could transmit a short message service (SMS) message to the mobile terminal A with an error message. The above embodiments are to be understood as illustrative examples of the invention; in particular, whilst the first terminal is described as being a mobile terminal, it is to be understood that the first and second terminals could both be mobile devices and/or fixed devices, or the first terminal could be a fixed terminal and the second terminal a mobile terminal. It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims.

Claims

1. A method of transmitting data between a first terminal and a second terminal in a network, the first terminal having a first temporary network address and the second terminal having a second temporary network address, the network comprising a storage system arranged to hold data indicative of an association between said first temporary network address and said second temporary network address, the first terminal being configured with one or more predetermined network addresses for use in addressing data transmitted from the first terminal to the second terminal during a communications session, the method comprising: receiving data transmitted from the first terminal, the received data having a said first temporary network address as source address and a said predetermined network address as destination address; identifying a said second temporary network address on the basis of the first temporary network address; transmitting data derived from the received data, the transmitted data having the identified second temporary network address as destination address and said predetermined network address as source address.

2. A method according to claim 1, in which the association between said first temporary network address and said second temporary network address includes a subscription identifier corresponding to a network subscription comprising services associated with the first terminal and the second terminal.

3. A method according to claim 1 or claim 2, in which the association comprises an external identifier for use in routing communications to said first terminal.

4. A method according to claim 2 or claim 3, in which the association further comprises an identifier associated with the second terminal.

5. A method according to any one of the preceding claims, including storing the first temporary network address and said identified second temporary network address in a cache, for use in translating source and destination addresses of packets subsequently transmitted between the first and second terminals during the communications session.

6. A method according to claim 5, including deleting data from the cache in response to a specified condition being satisfied.

7. A method according to claim 6, in which the specified condition comprises receiving data indicative of the communications session having been terminated.

8. A method according to any one of the preceding claims, in which the predetermined network address is a static network address.

9. A method according to claim 8, in which the static network address corresponds to a network node capable of performing address translation whereby to translate the destination address to the identified second temporary network address as destination address and the source address to that of the network node.

10. A method according to any one of the preceding claims, including configuring the first device with a software application arranged to cooperate with the second device, the software application being preconfigured with a said one or more predetermined network addresses such that packets transmitted from said software application are routed to a network node associated with the predetermined network address.

11. An address translation device capable of retrieving connection data from a storage system in respect of a given communications session, the connection data corresponding to at least two terminals associated with a given subscription, wherein the subscription comprises services associated with the at least two terminals and the address translation device is arranged to store the retrieved connection data in a local store and to use the locally stored connection data so as to translate at least the destination address of packets that are associated with the given communications session, the address translation device being further arranged to delete connection data from the local store in the event that a predetermined connection criterion has been met.

12. A system for controlling transmission of data between a first terminal and a second terminal in a network, the first terminal having a first temporary network address and the second terminal having a second temporary network address, the system comprising: a storage system arranged to hold data indicative of an association between said first temporary network address and said second temporary network address, the first terminal being configured with one or more predetermined network addresses for use in addressing data transmitted from the first terminal to the second terminal during a communications session, the method comprising: an interface arranged to receive data transmitted from the first terminal, the received data having a said first temporary network address as source address and a said predetermined network address as destination address; a processing system arranged to identify a said second temporary network address from the storage system on the basis of the first temporary network address and to transmit data derived from the received data, the transmitted data having the identified second temporary network address as destination address and said predetermined network address as source address.

13. A system according to claim 12, wherein the received data comprises packet data having a source address, a destination address, and a message body, the processing system comprising an address translation processor arranged to translate the source address of the packet data to an address corresponding thereto and to translate the destination of the packet data to said identified second temporary network address.

14. A system according to claim 12 or claim 13, wherein the processing system comprises a load balancing processor and a plurality of address translation processors, wherein the load balancing processor is arranged to allocate the data received from the first terminal to one of the address translation processors on the basis of a load balancing algorithm.

15. A system according to claim 14, wherein the address translation processor to which the received data is allocated is arranged to translate the source address of the packet data to an address corresponding thereto.

16. A system according to any one of claim 12 to claim 15, wherein the interface is arranged to receive data transmitted from the second terminal, the received data having a said second temporary network address as source address and a said predetermined network address as destination address, the processing system being arranged to identify a said first temporary network address on the basis of data previously received relating to the second temporary network address and to transmit data derived from the data transmitted from the second terminal, the derived data having the identified first temporary network address as destination address and said predetermined network address as source address.

17. A computer program, or a suite of computer programs, comprising a set of instructions causing a computer, or a suite of computers, to perform the method according to any one of claim 1 to claim 10.

18. A computer readable medium comprising the computer program of claim 17.