KR20150089894A - Network Address Translation apparatus with cookie proxy function and method for NAT supporting cookie proxy function - Google Patents

Abstract

According to the present invention, a network address translation (NAT) device includes: a NAT unit which converts an address to enable the communications between a client and a server through an external network with reference to a NAT table managing an internal IP address and an external IP address mapped onto the internal IP address; and a cookie proxy unit which provides cookies for the client with reference to an access cookie table managing the cookies corresponding to the external IP address when there is a cookie request from the client.

Description

[0001] The present invention relates to a network address translation apparatus having a cookie proxy function and a network address translation method for supporting a cookie proxy function,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network address translation apparatus and a network address translation method, and more particularly, to a network address translation apparatus and a network address translation method for performing a cookie proxy function together.

The performance of the network that the user experiences depends on the bandwidth of the network, the packet loss rate, and the packet delay time. Bandwidth greatly affects performance when transmitting large amounts of data, but there is little difference in performance due to packet delay time. However, when transmitting a small amount of data, the user's performance is more sensitive to packet delay than bandwidth.

HTTP 2.0 to reduce latency in applications such as the Web, TCP Fast Open (TFO) to reduce connection latency in Transmission Control Protocol (TCP), Low Latency (low) based on User Datagram Protocol (UDP) protocols such as QUIC (Quick UDP Internet Connections), which provide connectivity to the Internet, are proposed and studied.

Generally, a protocol such as HTTP (HyperText Transfer Protocol) in a web application that a client makes a request to and receives a response from the server operates in a higher layer of TCP. TCP performs a 3-way handshake for end-to-end connections, which takes a RTT (Round Trip Time) time until the connection is established. In order to reduce the connection time, a method of sending a request message (HTTP request in HTTP) together with a connection request is considered, which is used in TFO with modified TCP and QUIC operating on UDP.

 However, there is a security problem with the method of sending the connection request and the request message together. One problem is that it is more vulnerable to Distributed Denial of Service (DDoS) attacks because it processes the response to the request message without checking whether the other party is valid through the existing 3-way handshake.

To compensate for this vulnerability, protocols such as TFO and QUIC use connection cookies. When a client makes a connection to the server for the first time, it receives a connection cookie from the server and then sends a request with the connection cookie when it makes a request to the server so that the client is a valid target Object) of the subject.

 However, the method of using the connection cookie is difficult to operate in a network address translation (NAT) environment. In general, a connection cookie is generated for each unique client IP address (for each remote IP). In a NAT environment, there are many cases where a NAT external IP and a NAT internal IP do not have a 1: 1 relationship.

For example, even if one client has already received a connection cookie, the next session may not be able to use the already received connection cookie if another NAT external IP is assigned by the NAT device. From the server's point of view, the same connection cookie can not be used because the client's IP has changed. In addition, if an access cookie is requested by another client having the same NAT external IP, the existing connection cookie can not be used.

SUMMARY OF THE INVENTION The present invention provides a NAT device and a NAT method for using a connection cookie even in a NAT environment, thereby minimizing the connection delay time while eliminating the IP address shortage problem.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a NAT apparatus and a NAT method for efficiently transferring an access cookie through a connection cookie proxy for using an access cookie in a NAT environment.

The technical problems of the present invention are not limited to the above-mentioned technical problems, and other technical problems which are not mentioned can be understood by those skilled in the art from the following description.

A network address translation (NAT) apparatus according to an embodiment of the present invention refers to a NAT table that manages an inside IP address and an outside IP address mapped to an internal IP address, A NAT unit for converting an address so as to allow a client and a server to communicate with each other, and, when there is a cookie request from the client, referring to an access cookie table managing a cookie corresponding to the external IP address, The cookie proxy function can be performed even in the NAT environment including the cookie proxy section.

In one embodiment, the cookie proxy unit comprises: a packet discrimination unit for discriminating whether a received packet corresponds to a cookie request packet or a cookie response packet; and, if the received packet is a cookie request packet, And a cookie derivation unit for deriving a cookie from the connection cookie table by searching the external IP address of the connection cookie table. The NAT device may further include a cookie responding section for generating a cookie response based on the derived cookie.

The cookie derivation unit may forward the received packet to the NAT unit if the received packet is a cookie request packet or if there is no entry corresponding to the external IP address in the connection cookie table. According to an embodiment, the NAT unit may perform a network address translation for a received packet corresponding to the cookie request packet and request a cookie to the server.

In one embodiment, the cookie proxy unit may include a cookie management unit that updates the connection cookie table or generates a new entry based on the cookie information included in the received packet when the received packet is a cookie response packet .

If the received packet does not correspond to at least one of the cookie request packet or the cookie response packet, the cookie distinguishing unit may perform the network address translation operation by providing the received packet to the NAT unit.

In one embodiment, the NAT device may further include a client terminal physically connected to the client-side network and a server terminal physically connected to the server-side network. The packet determining unit may determine whether the received packet is a cookie request packet only when the received packet is received from the client terminal, and may determine whether or not the received packet is a cookie response packet only when the received packet is received from the server.

In one embodiment, the connection cookie table may include a pointer in the NAT table corresponding to the external IP of the cookie, or external port information corresponding to the external IP address.

A network address translation method according to embodiments of the present invention is a network address translation (NAT) apparatus having a connection cookie table for managing a cookie corresponding to an external IP address, Determining whether the received packet corresponds to a request packet or a cookie response packet; and if the received packet corresponds to the cookie request packet, deriving a cookie from the connection cookie table to provide a cookie response, Function can be supported.

In one embodiment, the step of providing the cookie response may include retrieving an external IP address from the NAT table based on the internal IP address included in the received packet, retrieving from the connection cookie table based on the retrieved external IP address Deriving the cookie, and generating the derived cookie as the cookie response.

And performing a network address translation on the received packet when there is no entry of the external IP address of the received packet in the connection cookie table.

The NAT method according to an embodiment of the present invention may further include managing the connection cookie table based on the cookie information included in the received packet when the received packet is a cookie response packet.

And performing a network address translation operation on the received packet if the received packet does not correspond to at least one of the cookie response packet or the cookie request packet.

According to the present invention, since the access cookie can be used in an NAT environment that can protect the internal network from the outside while eliminating the problem of lacking the IP address, the connection delay time can be reduced while securing high security.

It will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. .

1 is a conceptual illustration of a communication system including a network address translation apparatus having a cookie proxy function according to an embodiment of the present invention.
2 is a diagram illustrating a NAT device having a cookie proxy function according to an embodiment of the present invention.
3 shows an exemplary NAT table (table_N).
4 is a diagram showing exemplary connection cookie tables (table_C).
5 is a block diagram illustrating a cookie proxy unit according to an embodiment of the present invention.
FIG. 6 is a flowchart illustrating a NAT method supporting a cookie proxy function according to an exemplary embodiment of the present invention. Referring to FIG.
7 and 8 are flowcharts for illustrating exemplary connection cookie proxy operations according to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The same reference numerals are used for the same constituent elements in the drawings and redundant explanations for the same constituent elements are omitted.

For the embodiments of the invention disclosed herein, specific structural and functional descriptions are set forth for the purpose of describing an embodiment of the invention only, and it is to be understood that the embodiments of the invention may be practiced in various forms, The present invention should not be construed as limited to the embodiments described in Figs.

In describing the components of the embodiment of the present invention, terms such as first, second, A, B, (a), and (b) may be used. These terms are intended to distinguish the constituent elements from other constituent elements, and the terms do not limit the nature, order or order of the constituent elements.

1 is a conceptual illustration of a communication system including a network address translation apparatus having a cookie proxy function according to an embodiment of the present invention.

Referring to FIG. 1, when the client 10 and the server 30 communicate with each other, the NAT device 20 performs network address translation between the internal network and the external network. In NAT, one external IP address is mapped to a client with one internal IP, and one external IP address is mapped to the internal IPs of a plurality of clients, thereby eliminating the problem of lacking an IP address or hiding the presence of a client from the external network .

In this specification, an outside IP address indicates an address used in a public, global, or external network, and an inside IP address indicates a private or local network Can be used to indicate the address to be used.

The NAT device 20 includes a NAT table for managing an internal IP address and an external IP address corresponding to the internal IP address to convert the internal IP address of the packet received from the client 10 into an external IP address, .

In addition, the external IP address of the packet received from the server 30 is converted into an internal IP address and provided to the client 10.

However, in the environment of the NAT device 20, there is a problem that it is not possible to apply the connection cookie method in which one cookie is assigned to one IP as described above. Accordingly, every time the client 10 connects, Cookies may need to be assigned.

The NAT device 20 according to the present invention has a cookie proxy function and can derive a cookie from an internal connection cookie table based on the internal IP address of the client 10 and provide the cookie to the client 10. [ Therefore, it is possible to use the connection cookie even in the NAT environment, thereby improving the security and reducing the connection delay time.

2 is a diagram illustrating a NAT device having a cookie proxy function according to an embodiment of the present invention.

Referring to FIG. 2, the NAT device 20 may include a NAT unit 210 and a cookie proxy unit 230. Further, the NAT device 20 can manage the NAT table (table_N) and the connection cookie table (table_C). 2, the NAT unit 210 and the cookie proxy unit 230 represent block diagrams for conceptually showing transmission / reception of data with the NAT table (table_N) and the connection cookie table (table_C). However, the NAT table (table_N) The connection cookie table (table_C) may be managed in another database format or stored internally in the NAT unit 210 or the cookie proxy unit 230.

The NAT unit 210 converts the internal IP address of the received packet into the external IP address by referring to the NAT table (table_N), converts the external IP address of the received packet into the external IP address, . In this specification, this operation of the NAT unit 210 is described as performing a network address translation operation.

3 shows an exemplary NAT table (table_N).

3, a NAT internal IP address and an external IP address (NAT Outside IP) are mapped and managed in Table (a), and a mapping lifetime between them is included It is possible. Each of these tables is referred to as an entry.

The NAT table (table_N) may additionally include port information in addition to the IP address as shown in table (b).

The cookie proxy unit 230 determines whether the received packet is a cookie request packet or a cookie response packet. If the received packet is a cookie request packet, the cookie proxy unit 230 derives from the NAT table (table_N) an external IP address corresponding to the internal IP address included in the packet , And retrieves the cookie of the connection cookie table (table_C) corresponding to the external IP address accordingly.

The connection cookie table (table_C) may include cookie information corresponding to the external IP address and the remote IP address (that is, the IP address of the server).

4 is a diagram showing exemplary connection cookie tables (table_C).

Referring to FIG. 4, the connection cookie table table_C includes an external IP address (NAT outside IP), a remote IP address (remote IP) (a state IP connecting with the external IP, But the remote IP address may correspond to the IP of another client other than the server IP, depending on what the client is communicating with), and a cookie as an essential component.

(a) shows an example of a basic connection cookie table (table_C).

Depending on the embodiment, the connection cookie table (table_C) may be different depending on the protocol used. For example, when the NAT device 20 supports a protocol in which a cookie is generated in the upper layer of a transport layer, the NAT device 20 may additionally include a remote port item as shown in the table (b). Also, according to the embodiment, the connection cookie table (table_C) includes the binding expiration information of the cookie or the internal IP address (NAT inside IP) or the inside port (NAT inside port) information included in the NAT table (table_N) It is possible to shorten the time for searching the NAT table (table_N) by including it in the table (table_C).

Referring to the table (c), a pointer may be provided for each entry of the connection cookie table (table_C). (c) If the pointer is provided as in the table, it is possible to reduce the time for the cookie proxy unit 230 to search the NAT table (table_N) for other information corresponding to the external IP address (NAT outside IP).

As described above, the connection cookie table (table_C) can be variously modified as needed.

When the cookie for the cookie request packet exists, the cookie proxy unit 230 processes the cookie as a cookie response and provides the cookie to the client (10 in FIG. 1). For example, it searches the NAT table (table_N) for the external IP address (NAT outside IP) corresponding to the internal IP address (NAT inside IP) included in the cookie request packet, Derive a cookie. The cookie proxy unit 230 generates a cookie response based on the derived cookie and provides it to the client 10. The cookie response may be provided by setting the source IP address and port number of the packet according to the protocol as required. The type of the packet generated in response to the cookie may differ depending on the protocol supported by the NAT device 20. [

For example, the cookie proxy unit 230 may generate an arbitrary SYN number in the case of a TFO, and may further transmit a TCP FIN or TCP RST packet to a client requesting the cookie to inform the server of a SYN number To be received.

If the cookie does not exist in the connection cookie table (table_C), the cookie proxy unit 230 transmits a cookie request packet to the NAT unit 210 to perform a NAT operation as it is and sends a cookie request to the server 30 .

In addition, when the received packet is not a cookie request packet or a cookie response packet, the cookie proxy unit 230 provides the received packet to the NAT unit 210 to perform the NAT operation. That is, when the received packet is not a cookie request packet or a cookie response packet, it operates in the same manner as a general NAT device 20.

When the received packet is a cookie response packet, the cookie proxy unit 230 can update the connection cookie table (table_C) based on the cookie information included in the cookie response or generate a new entry.

For example, the cookie response packet may be provided from the server 30. When a cookie corresponding to the external IP address (NAT outside IP) is searched in the connection cookie table (table_C), a cookie different from the conventional cookie If it does, it updates the connection cookie table (table_C). In addition, if the cookie information corresponding to the external IP address (NAT outside IP) included in the cookie response from the server 30 is not present in the connection cookie table (table_C), a new entry is created to be utilized later.

The cookie proxy unit 230 may manage the cookie by updating the connection cookie table (table_C), and then perform a NAT operation on the cookie response to provide the client 10 with a cookie.

According to an embodiment, the NAT device 20 may include a client terminal 21 and a server terminal 23. The client terminal 21 is a terminal physically and electrically connected to the client side network, and the server terminal 23 is a terminal physically and electrically connected to the server side network. The NAT device 20 receives a packet from the client 10 via the client terminal 21 and receives the packet from the server 30 via the server terminal 23. [

The cookie proxy unit 230 determines that the packet received through the client terminal 21 is not a cookie response packet at all and therefore determines whether or not the packet received through the client terminal 21 is a cookie request packet It can search the connection cookie table (table_C) and provide a cookie to the client (10) or perform a NAT operation to transmit a cookie request to the server (30).

The cookie proxy unit 230 can know that the packet received through the server terminal 23 does not correspond to at least the cookie request packet. Therefore, the cookie proxy unit 230 determines whether the packet received through the server terminal 23 is a cookie response packet, manages the connection cookie table (table_C), provides a cookie response to the client 10, To provide the client 10 with a received packet.

However, according to the embodiment, the cookie proxy unit 230 may determine whether a received packet corresponds to a cookie request packet or a cookie response packet based on information of a received packet regardless of a physical location of the received packet.

5 is a block diagram illustrating a cookie proxy unit according to an embodiment of the present invention.

Referring to FIG. 5, the cookie proxy unit 230 may include a packet determination unit 231, a cookie derivation unit 233, and a cookie management unit 235.

The packet determination unit 231 determines whether the received packet corresponds to a cookie request packet or a cookie response packet. The packet determination unit 231 determines whether the received packet corresponds to a cookie request packet or a cookie response packet based on the information of the received packet (for example, field configuration or field information) Terminal can determine whether the received packet corresponds to the cookie request packet or the cookie response packet.

The packet discrimination unit 231 may be included in the NAT unit 210 or may be included in the NAT unit 210. The packet discrimination unit 231 may be included in the cookie proxy unit 230, Or may be implemented in a separate configuration in the memory 20.

When the received packet does not correspond to at least one of the cookie request packet or the cookie response packet, the packet discriminator 231 provides the received packet to the NAT unit 210 to perform a NAT operation on the received packet. That is, in this case, only the NAT operation is performed on the received packet to allow the internal network and the external network to communicate.

When the received packet corresponds to the cookie request packet, the packet determination unit 231 delivers the cookie request packet to the cookie derivation unit 233. If the received packet corresponds to the cookie response packet, the packet determination unit 231 transmits the cookie to the cookie management unit 235, And transmits a response packet.

The cookie derivation unit 233 retrieves the NAT table (table_N) based on the internal IP address (NAT inside IP) included in the cookie request packet to derive an external IP address (NAT outside IP). And searches the connection cookie table (table_C) based on the derived external IP address (NAT outside IP) to derive the cookie for the cookie request packet.

If the cookie for the client that sent the cookie request packet exists in the connection cookie table (table_C), the cookie is immediately provided to the client without requesting the server 30. Therefore, if the NAT device 20 according to the present invention is provided, the connection cookie can be used without an additional connection process such as a 3-way handshake.

However, if the cookie derivation unit 233 retrieves the cookie for the client that transmitted the cookie request packet from the connection cookie table (table_C), but the cookie for the client's external IP address (NAT outside IP) does not exist, Performs a NAT operation on the packet, and requests the server 30 to request a cookie.

The cookie proxy unit 230 according to an embodiment of the present invention may further include a cookie response generation unit 237. [ The cookie response generation unit 237 can generate a cookie response as a standard corresponding to a specification supported by the NAT device 20 based on the cookie information received from the cookie derivation unit 233 and provide the cookie response to the client.

The cookie management unit 235 determines whether the cookie in the connection cookie table (table_C) should be updated or the cookie for the external IP address (NAT outside IP) of the received cookie response packet with respect to the cookie response received from the packet determination unit 231 If it does not exist in the connection cookie table (table_C), it manages the cookie by creating a new entry.

The cookie management unit 235 provides the cookie response to the NAT unit 210 so that the cookie response is provided to the client.

FIG. 6 is a flowchart illustrating a NAT method supporting a cookie proxy function according to an exemplary embodiment of the present invention. Referring to FIG.

Referring to FIG. 6, the packet determination unit 231 determines whether a received packet corresponds to a cookie request packet (step S610). If the received packet corresponds to the cookie request packet (YES in step S610), the packet determination unit 231 provides the received packet to the cookie derivation unit 233 and refers to the connection cookie table (table_C) It is determined whether a cookie exists (step S611).

If the cookie for the cookie request packet exists in the connection cookie table (step S611, YES), the cookie derivation unit 233 provides the cookie information to the cookie response generation unit 237 to generate a cookie response (Step S613). The generated cookie response is provided to the client.

If the cookie is searched for the cookie request packet but the cookie for the cookie request packet does not exist in the connection cookie table (table_C) (step S611, NO), the cookie derivation unit 233 provides the received packet to the NAT unit 210 To perform the NAT operation (step S630). The cookie request packet in which the NAT operation has been performed can be transmitted to the server 30 via the external network.

If the received packet is not a cookie request packet (step S610), the packet determination unit 231 can determine whether the received packet corresponds to a cookie response packet (step S620). 6, it is determined that the packet is a cookie request packet before the packet is determined to be a cookie response packet. However, the order is not limited. Preferably, the packet determination unit 231 determines that the received packet corresponds to a cookie request packet or a cookie response packet Whether or not it is possible to simultaneously determine whether or not to do so.

2, in the case where the packet determination unit 231 grasps the characteristics of the received packet based on the physical receiving terminal on which the received packet is received, it is determined whether the received packet is a cookie request packet (Step S610), or an operation of determining whether the received packet is a cookie response packet (step S620) may be omitted.

More specifically, if the received packet is received from the server terminal 23 communicating with the server side, steps S610, S611, and S613 may be omitted because at least the received packet is not a cookie request packet. The packet determination unit 231 determines whether or not the received packet corresponds to the cookie response packet.

Conversely, if the received packet is received from the client terminal 21 communicating with the client side, at least the received packet will not be a cookie response packet. Accordingly, the process of determining whether the received packet is a cookie response packet (step S620) and the process of managing the cookie (step S621) may be omitted.

If the received packet is determined to be a cookie response packet (step S620, YES), the packet determination unit 231 provides the received packet to the cookie management unit 235. [

The cookie management unit 235 searches the connection cookie table table_C for the external IP address (NAT outside IP) included in the received packet, that is, the received cookie response packet. If the cookie mapped to the external IP address (NAT outside IP) is not the same as the received cookie response packet in the connection cookie table (table_C), the cookie management unit 235 Update the cookie table (table_C). If the external IP address (NAT outside IP) included in the received cookie response packet is not retrieved from the connection cookie table (table_C), a new entry for the corresponding external IP address (NAT outside IP) and remote IP And manages the cookie (step S621).

When the cookie management is completed, the cookie management unit 235 provides the received packet to the NAT unit 210 to perform the NAT operation so that the cookie response is provided to the client 10 (step S530).

If the received packet is not a cookie request packet (NO in step S610) and is not a cookie response packet (step S620, NO), it is not necessary to perform an operation related to a cookie with respect to a received packet. And provides it to the NAT unit 210 to perform the NAT operation (step S630).

The connection cookie proxy operation according to the present invention will now be described with reference to the flowcharts of FIGS. 7 and 8. FIG.

The NAT device 20 that refers to the NAT table (table_N) including the entry as shown in Table 1 can operate as shown in FIG.

NAT Inside IP NAT Inside Port NAT Outside
IP NAT Outside
Port Binding Lifetime A P C Q 120s

The client 10A having the internal IP address 'A' (and the internal port address 'P') is located in the external network of the NAT device 20. The remote IP address of the server is 'S' ', And let's look at the process of communicating later.

The external IP address (NAT outside IP) to the client 10A is 'C' (and the external port address is 'Q').

In order for the client 10A to establish a connection with the external IP address (NAT outside IP) 'C' to the server 30, the client 10A first sends a cookie request packet.

In FIG. 5, the packet is indicated by < X, Y, Z >. X is the source IP address, Y is the destination IP address, and Z is the type of message.

The client 10A transmits a packet of < A, S, cookie request > to the NAT device 20. That is, a packet of a cookie request is sent from the destination IP address of 'A' to the destination address of 'S'.

The packet determination unit 231 of the NAT device 20 determines that the received packet is a cookie request packet (step S711). The cookie retrieval unit 233 retrieves the connection cookie table table C based on the information of the received packet but does not retrieve the cookie corresponding to the internal IP address 'C' (step S713) A NAT internal IP 'A' is converted into an external IP address 'C' through the ISP 210 and a packet of <C, S, cookie request> is transmitted to the server 30 .

The server 30 allocates a cookie (#cookie) to the NAT external IP address of 'C' to provide the NAT device 20 with a cookie response packet of <S, C, #cookie>.

The packet determination unit 231 included in the NAT device 20 determines that the packet received from the server 30 is a cookie response packet (step S721). Since there is no entry of the connection cookie table (table_C) for the external IP address 'C' in the previous step (step S713), the cookie management unit 235 generates the corresponding entry by reading the connection cookie table table_C (Step S723).

That is, the cookie management unit 235 creates an entry as shown in Table 2 in the connection cookie table (table_C).

NAT Outside IP Remote IP Cookie C S #cookie

The cookie management unit 235 provides the received packet to the NAT unit 210 to convert the NAT external IP 'C' into the internal IP address 'A' &Gt; to the client 10A.

The process described is referred to as a cookie transaction. After the cookie is assigned to the external IP address (NAT outside IP) through the cookie transaction, the client 10A receiving the cookie can use the cookie without an additional 3-way handshake connection process.

Therefore, the client 10A can then perform a normal transaction. The client 10A transmits <A, S, # cookie + request> to the NAT device 20.

The packet determining unit 231 of the NAT device 20 determines that the packet received from the client 10A does not correspond to either the cookie request packet or the cookie response packet (step S731). Accordingly, the received packet is provided to the NAT unit 210 to convert the NAT inside IP 'A' to the external IP address 'C' to generate the <C, S, # cookie + request> packet To the server (30).

The server 30 provides the NAT device 20 with < S, C, response > in response to the received packet, and the packet determination unit 231 of the NAT device 20 determines whether the received packet is a cookie request It is determined that the packet is not a cookie response packet (step S741), and only the NAT operation is performed (step S743).

Finally, the client 10A receives a packet of < S, A, response >.

A new client having an internal IP address 'B' may make a cookie request to the server 30 with the same external IP address (NAT outside IP).

The NAT device 20 and the NAT method according to an embodiment of the present invention will be described with reference to FIG.

The client 10B having the internal IP address 'B' requests a cookie to the server. The packet at this time may be &lt; B, S, cookie request &gt;.

The NAT device 20 determines that the packet received from the client 10B is a cookie request packet (step S811). The cookie derivation unit 233 retrieves an external IP address (NAT outside IP) from the internal IP address (NAT inside IP) of the received packet.

The 'NAT' inside IP 'C' may be mapped to the 'B' in the same manner as the internal IP address 'A' in the internal IP address as described above.

The cookie derivation unit 233 searches the connection cookie table table_C for a cookie for the external IP address 'C'. The cookie derivation unit 233 derives the cookie (step S815), and the cookie response generation unit (step S815) determines whether or not the cookie has a cookie corresponding to the external IP address 'C' 237).

The cookie response generating unit 237 generates a cookie response conforming to the specification supported by the NAT device 20 based on the derived cookie (step S817), and transmits a cookie response of <S, B, #cookie> ).

As described above, the time for the client 10B to access the server 30 can be reduced by providing the cookie directly from the NAT device 20 to the client 10B without a 3-way handshake connection process.

The client 10B can perform the normal transaction based on the received cookie information. The following procedure is substantially the same as the normal transaction described with reference to FIG.

When the client 10B transmits a packet of <B, S, # cookie + request> to the NAT device 20, the packet determination unit 231 of the NAT device 20 determines whether the received packet is a cookie request packet or a cookie response It is determined that the packet is not a packet (step S732), NAT operation is performed (step S734), and a packet of <C, S, # cookie + request> is transmitted to the server 30.

The server 30 responds with the <S, C, response> to the packet of the client 10B and the NAT device 20 determines that the packet received from the server 30 does not correspond to the cookie request or the cookie response packet (Step S742), performs a NAT operation (step S744), and provides a packet of <S, B, response> to the client 10B.

The NAT device and the NAT method according to an embodiment of the present invention can perform the cookie proxy function even in an environment where the NAT inside IP address and the NAT outside IP address are not corresponded one to one. Accordingly, it is possible to improve the security and reduce the access delay time.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. Will be clear to those who have knowledge of.

20: NAT device
210: NAT unit
230: Cookie Proxy Department
231: Packet discrimination unit
233:
235:
237: Cookie Response Generation Unit

Claims (15)

Network address translation (NAT) table that manages the inside IP address and the outside IP address mapped to the internal IP address is referred to and the address is set so that the client and the server can communicate with each other through the external network A translating NAT unit; And
And a cookie proxy unit for providing a cookie to the client by referring to a connection cookie table managing a cookie corresponding to the external IP address when the client makes a request for a cookie. One NAT device. The method according to claim 1,
The cookie-
A packet discrimination unit for discriminating whether a received packet corresponds to a cookie request packet or a cookie response packet; And
And a cookie derivation unit configured to retrieve an external IP address of the received packet from the NAT table to derive a cookie from the connection cookie table if the received packet is a cookie request packet. The method of claim 2,
And a cookie responding section for generating a cookie response based on the derived cookie. The method of claim 2,
The cookie-
When the received packet does not include a cookie request packet or an entry corresponding to the external IP address in the connection cookie table, transfers the received packet to the NAT unit. The method of claim 4,
Wherein the NAT unit performs a network address translation for a received packet corresponding to the cookie request packet to request a cookie to the server. The method of claim 2,
The cookie-
And a cookie management unit for updating the connection cookie table or generating a new entry based on the cookie information included in the received packet when the received packet is a cookie response packet. The method of claim 2,
The cookie-
Wherein the NAT control unit provides the received packet to the NAT unit to perform a network address translation operation when the received packet does not correspond to at least one of the cookie request packet or the cookie response packet. The method of claim 2,
Further comprising a client terminal physically connected to the client-side network and a server terminal physically connected to the server-side network. The method of claim 8,
The packet determination unit may determine,
Wherein the control unit determines whether the received packet is a cookie request packet when the received packet is received from the client terminal and only determines whether or not the received packet is a cookie response packet when the received packet is received from the server. The method according to claim 1,
Wherein the connection cookie table includes a pointer in the NAT table corresponding to the external IP of the cookie or external port information corresponding to the external IP address. 1. A network address translation (NAT) apparatus having a connection cookie table for managing a cookie corresponding to an external IP address,
Determining whether the received packet corresponds to a cookie request packet or a cookie response packet; And
And if the received packet corresponds to the cookie request packet, deriving a cookie from the connection cookie table and providing a cookie response. The method of claim 11,
Wherein providing the cookie response comprises:
Retrieving an external IP address from the NAT table based on the internal IP address included in the received packet;
Deriving the cookie from the connection cookie table based on the retrieved external IP address; And
And generating the derived cookie as the cookie response. The method of claim 12,
And performing a network address translation on the received packet if there is no entry of the external IP address of the received packet in the connection cookie table. The method of claim 11,
Further comprising the step of managing the connection cookie table based on the cookie information included in the received packet when the received packet is a cookie response packet. The method of claim 11,
Further comprising performing a network address translation operation on the received packet if the received packet does not correspond to at least one of the cookie response packet or the cookie request packet.

Images