WO2011064511A1

WO2011064511A1 - Technique for setting up a tunnel between a gateway and a translation device in a communication network

Info

Publication number: WO2011064511A1
Application number: PCT/FR2010/052548
Authority: WO
Inventors: Adil Andaloussi; Christophe Proust
Original assignee: France Telecom
Priority date: 2009-11-30
Filing date: 2010-11-26
Publication date: 2011-06-03
Also published as: FR2953355A1

Abstract

The invention relates to a technique for setting up a tunnel for carrying data packets relating to at least one session of a client entity (21, 22) of a private network (2) by means of a gateway (20) connected to an intermediate network (1). When restoring the tunnel, the gateway sets up a tunnel in the intermediate network with a translation device (10) of the intermediate network. Said translation device is suitable for translating a session identifier in the private network to a session identifier in a public network in a data packet, and vice-versa, a session identifier being made up of an address and a port number. The gateway is identified when setting up the tunnel with an address in the intermediate network which was modified. In said modified address, translation information including an address in the public network and a range of port numbers is included in a private portion. Upon receiving a data packet initiating a session, the translation device then selects the port number from the range of port numbers obtained from the modified address, the session identifier in the public network then comprising the address in the public network and the selected port number.

Description

Technique for establishing a tunnel between a bridge and a translation equipment in a communication network

The invention lies in the field of communication networks, and more particularly in that of the routing of traffic to a client in such a network.

To connect to a communication network, such as the Internet, a customer must have an address in this network, called public address; this address must make it possible to identify it in a unique way in order to convey the traffic intended for it. This address is assigned by a provider of access to the communication network.

In the following, we will designate as "gateway" any interconnection equipment between a private network and a communication network, the private network may as well be a residential network that a corporate network.

Currently, a public address in version 4 of the Internet protocol, denoted IPv4, is assigned to the client. The number of I adressesν4 public addresses is limited. A new version of the Internet protocol, known as IPv6, has been planned, in particular to make up for a depletion of the number of IPv4 public addresses. ISDN providers have plans to deploy public IPv4 address sharing solutions based on equipment called CGN for "Carrier Grade NAT" in English. Such solutions consist in introducing an address translation function or NAT, for "Network Address Translation" in this CGN equipment. This address translation function thus makes it possible to share a plurality of public ffv4 addresses between several clients. Such a solution is for example defined by the IETF, for "Internet Engineering Task Force", in the document entitled "draft-ietf-softwire-dual-stack-lite-02". It consists in introducing into the access provider's network a specific DS-Lite AFTR device, for "Dual-Stack Lite Address Family Transition Router" and consists in combining two technologies: the emission of data in a tunnel or "tunneling" and the address translation function. A tunnel is established between a B4 gateway for Basic Bridging BroadBand and the DS-Lite AFTR device and encapsulates an IPv4 data stream transmitted by private network equipment to the DS equipment. -Lite AFTR. A data flow is related to a session established between a sending equipment of the private network and a receiving equipment in the public network. In particular, this session is identified in the private network by an IPv4 address private to the equipment of the sending private network and a source port number. The data stream is then decapsulated at the DS-Lite AFTR device and the session identifier in the private network is translated using the NAT function of the DS-Lite AFTR device to a public IΡν4 address and a public port number, both allocated by DS-Lite AFTR equipment. Conversely, when a data flow arrives at the public IPv4 address and the allocated public port number, the DS-Lite device AFTR translates using the NAT function the public IPv4 address and the public port number allocated to the associated private IPv4 address and private port number, and then encapsulates the data stream in the tunnel to the gateway .

An IPv6 prefix is allocated to the gateway by the ISP and the latter is configured only with an IPv6 address belonging to the prefix; no public or private IPv4 address is assigned to it. The gateway is thus responsible for establishing the IPv6 tunnel with the DS-Lite AFTR device, but it simply simply routes the private IPv4 traffic generated at the private network level to this tunnel] Pv6. This means that private IPv4 traffic is translated only once at the DS-Lite AFTR device.

However, the use of this mechanism in the network of the access provider poses a problem of traceability. Indeed, from the moment when the traffic of a plurality of clients is translated to a single public IPv4 address, the access provider is unable to find, from a public address in the IPv4 network, an identifier of one of the plurality of clients having issued a data packet. However, the access provider must be able to identify a source of a ff data packet to respond to a request from a judicial authority. For this reason, the service provider must memorize the information on sessions translated by DS-Lite AFTR equipment, including:

a protocol type: TCP for Transmission Control Protocol, UDP for User Datagram Protocol, or ICMP for Internet Control Message Protocol;

the Pv6 address of the gateway;

a public IΡv4 address allocated to the session;

a public port number or an ICMP identifier allocated to the session;

the date, the start and end times of the allocation at the session.

Thus, when a judicial authority requests the access provider to identify a client sending a given IPv4 packet, the access provider can determine it by first consulting the base of translated sessions, using the public IPv4 address, the public source port number, used in the data packet, and a time tag of the data packet. It then obtains an IPv6 address or prefix delegated to the client, and then in a second time an identifier of the client.

However, this procedure requires the memorization of all the information relating to the translations of sessions for a significant duration, typically one year. The amount of information to be stored depends on the number of clients federated by the DS-Lite AFTR device as well as the average number of sessions generated per client. For example, for equipment managing thirty thousand gateways or clients, with an order of magnitude of one hundred simultaneous sessions per client, the storage means required are of the order of eight terabytes. Thus, this technique requires significant investments in storage means. One of the aims of the invention is to overcome disadvantages of the state of the art and / or to make improvements.

According to a first aspect, the subject of the invention is a method for establishing a tunnel for conveying data packets relating to at least one session of a client entity of a private network via a gateway connected to an intermediate network, said method comprising the following steps implemented by the gateway:

a step of establishing a tunnel in the intermediate network between the gateway and a translation equipment of the intermediate network, said translation equipment being able to perform a translation of a session identifier in the private network to an identifier of session in a public network in a data packet and vice versa, a session identifier consisting of an address and a port number.

The establishment method is remarkable in that it further comprises a step of modifying an address of the gateway in the interlay network by inclusion in a private part of said translation information address, said translation information comprising an address in the public network and a range of port numbers, and in that when establishing the tunnel, the gateway is identified by the modified address.

Correlatively, the invention further relates to a method of allocating a session identifier in a public network to a session of a client entity of a private network, the data packets of the client entity transiting, by the intermediate of a tunnel established in an intermediate network between a bridge and a translation equipment, said method comprising the following steps implemented by said translation equipment:

a step of receiving a packet initiating the session via the tunnel,

a step of selecting a session identifier in the public network, a session identifier consisting of an address and a port number, the data packets relating to the session received in the tunnel being translated from a session identifier in the private network to the session identifier in the selected public network and vice versa,

characterized in that the method further comprises:

a step of obtaining an address of the gateway in the intermediate network, translation information being included in a private part of said address and comprising an address in the public network and a range of port numbers;

and in that during the selection step, the port number is selected in the range of port numbers, the session identifier in the public network then consisting of the address in the public network and the number of the selected port.

The private network is for example an IPv4 type network and the addresses in this network are thus private addresses, which do not allow to route data traffic outside the private network. The public network is a type IΡν4 network in which the addresses are public. The intermediate network is for example an IPv6 type network. In this case, the gateway and the translation equipment correspond respectively to the B4 and DS-Lite equipment AFPR of the ETF document cited above. Subsequently, a session identifier in a network is a pair consisting of an address in the network and a port number.

Through the tunnel establishment process, one end of the tunnel identifies itself using an address in the interlay network that has been modified. Thus, a private part, also called free, of the coding of an IPv6 address is used to carry translation information, that is to say a public address in the public network and a range of port numbers. Any packet of data transmitted by the gateway in the tunnel is associated with the tunnel and thus with the address in the gateway's interlay network. The gateway performs no translation function and transmits the data packet as received from the client entity. The free portion of the IPv6 address encoding is not generally used by the translation equipment, constituting the other end of the tunnel. Thus, the mechanisms implemented by the gateway are modified only in a prior phase of establishing the tunnel. No changes are made to the operation when routing packets. According to the method of allocating a session identifier, the translation equipment uses the address in the interlay network that has been modified to determine a session identifier in the public network. This allows in particular to share an address in the public network between a plurality of client entities, possibly belonging to different private networks. This preserves one of the advantages of the solution proposed by the IETF. In addition, the allocation of the session identifier is done simply by analyzing the IPv6 address of the end of the tunnel. The changes made to the translation equipment are thus minimal. Once the session identifier in the public network has been allocated and stored in association with the session in a translation table, the routing of the data packets relating to the session is carried out in the same way as in the prior art, by reading of the translation table.

From a packet intercepted in the public network, it is possible to determine the associated session identifier and thus the address in the public network and the public port. This information makes it possible to identify the gateway or the client in a unique way, without resorting to a memorization of all the sessions that have been the subject of translation over time. This makes it possible to satisfy the legal obligations of an operator without requiring significant storage space. In addition, it is not necessary to provide at the level of the translation equipment protocol modules, such as SNMP for "Simple Network Management Protocol" or Syslog, allowing the latter to transmit the traces memorizing all sessions to a central server. It is also emphasized that these methods also limit the commissioning operations of the translation equipment, since it is no longer necessary to configure addresses in the public network and, if necessary, port ranges.

According to a particular characteristic, the establishment method comprises a step of obtaining from a server of the translation information.

It is thus possible to configure the gateway on request using the translation information.

It is also possible to preconfigure the gateway with translation information stored for example in a programmable memory.

According to another particular characteristic of the establishment method, on receipt of a message indicating a depletion of the range of port numbers from the translation equipment, the gateway again implements the obtaining step in order to to obtain other translation information.

Thus, the gateway obtains new translation information and establishes a new tunnel by identifying itself with a new modified address, including the new translation information. This makes it possible to provide a service adapted to customers initiating a large number of sessions.

According to a particular characteristic of the allocation method, when the set of port numbers of the range has been allocated, the initiation of the session is rejected.

This solution makes it possible to retain the advantage mentioned above because it does not require storage means. A gateway whose client entities have exhausted the range of available port numbers is then limited in its number of concurrent sessions.

According to another particular characteristic of the allocation method, when all the port numbers of the range have been allocated, a port number is selected in another range of port numbers and a trace of the translation is stored.

This provides overflow port number ranges used by client entities of different gateways. Storage means are then provided for storing the translations performed. With judicious sizing of port number ranges, this case should occur only rarely.

According to a second aspect, the invention furthermore relates to a gateway arranged for conveying data relating to at least one session of a client entity of a private network via a tunnel established in a network interleaved with a piece of equipment. translation device, said translation equipment being able to perform a translation in a data packet of a session identifier in the private network to a session identifier in a public network and conversely, a session identifier consisting of an address and a port number, said gateway comprising:

means for modifying an address of the gateway in the intermediate network by inclusion in a private part of said translation information address, said translation information comprising an address in the public network and a range of port numbers,

means for establishing the tunnel in the intermediate network between the gateway and the translation equipment, in which the gateway is identified by the modified address.

According to a third aspect, the invention furthermore relates to a translation equipment arranged for conveying data relating to at least one session of a client entity of a private network via a tunnel established in an intermediate network with a gateway, said translation equipment comprising:

means for receiving a packet initiating the session via the tunnel,

means for selecting a session identifier in the public network, a session identifier consisting of an address and a port number,

translation means, arranged to translate in a data packet a session identifier in the private network to the selected session identifier in a public network and vice versa,

characterized in that said translation equipment further comprises:

means for obtaining an address of the gateway in the intermediate network, translation information being included in a private part of said address and comprising an address in the public network and a range of port numbers;

and wherein the selection means is arranged to select the port number in the range of port numbers, the session identifier in the public network then consisting of the address in the public network and the selected port number.

According to a fourth aspect, the invention further relates to a system for conveying data relating to at least one session of a client entity of a private network, said system comprising at least one gateway and a translation equipment such as previously described. .

According to a fifth aspect, the invention further relates to a computer program comprising instructions for implementing the method of establishing a tunnel as described previously by a gateway, when this program is executed by a processor.

According to a sixth aspect, the invention further relates to a computer program comprising instructions for implementing the method of allocating a session identifier as described previously by a translation equipment, when this program is executed. by a processor. The invention will be better understood with the aid of the following description of a particular embodiment of the methods of the invention, with reference to the appended drawings in which:

FIG. 1 represents a system for accessing a public network in its environment according to a particular embodiment of the invention;

FIG. 2 represents the steps of the method of establishing a tunnel according to a particular embodiment of the invention;

FIG. 3 represents the steps of the translation method according to a particular embodiment of the invention;

FIG. 4 represents an address in an intermediate network according to a particular embodiment of the invention;

FIG. 5 represents a gateway according to a particular embodiment of the invention;

Figure 6 shows a translation equipment according to a particular embodiment of the invention.

The general principle of the invention is based on the construction of an IPv6 type address including translation information in a portion of the private address, also called private or free part of this address.

As a reminder, an IPv6 type address is sixteen bytes long, or one hundred and twenty eight bits. An IPv6 address has two parts:

the left side identifies a subnet of the domain;

the right part identifies an interface of a machine connected to the subnet.

Typically, the longest prefixes allocated to a subnet are prefixes 764 ", i.e. they have 64 bits to identify them, and the 64 bits to the right of the address are used to identify a particular interface of a machine belonging to the subnet The use of the last 64 bits in this block remains private For a residential type network, a prefix of length 56, denoted "/ 56", is delegated to the network.

Still as a reminder, an IPv4 address is four octets long, or thirty two bits.

Port values between 0 and 1024 (in decimal) are known and pre-reserved values by the ΙΑΝΑ (for "Internet Assigned Numbers Authority"). They are reserved for known services and should not be used to characterize sessions. There are also ports registered with the ΙΑΝΑ whose numbers range from 1024 to 49151. To conclude, there are dynamic and / or private ports, whose port numbers range from 49152 to 65535.

Subsequently, a session identifier in a network is a pair consisting of an address in this network and a port number. An access system 15 to a public network 3 is shown in FIG. 1 in its environment.

The access system 15 includes a gateway 20 and a router CGN, for "Carrier Grade NAT", also called translation equipment. It should be noted that for purposes of simplification, only one gateway has been shown in FIG. 1. A router CGN can be connected to a plurality of gateways. Similarly, the network operator can set up several CGN routers of this type.

In the context of the invention, it is considered that the gateway 20 is dual layer or "Dual-Stack" (DS), that is to say having activated the two IPv4 and IPv6 protocol stacks. As a result, such a gateway 20 is able to process, in particular receive and transmit, data packets of IPv4 or Pv6 type. This gateway 20 corresponds to the "DS-Lite Basic Bridging BroadBand" equipment noted B4 in the 1TETF document entitled "draft-ietf-softwire-dual-stack-lite-02".

The CGN router 10 corresponds to the equipment "DS-Lite Address Family Transition Router" noted AFTR in this same document.

The gateway 20 and the CGN router 10 communicate via a tunnel established in an intermediate network 1, for example an IPv6 type network. The tunnel is established at the initiative of the gateway 20. The two ends of this tunnel are the respective addresses in the intermediate network 1 of the gateway 20 and the CGN router 10. It may be a generic ffv6 tunnel compliant ETF RFC 2473, "Generic Packet Tunneling in IΡν6 Specification". It can also be an L2TP tunnel, for "Layer 2 Tunneling Protocol", or an IPsec tunnel, for "Internet Protocol Security", or a tunnel TSP, for "Tunnel Setup Protocol". In addition, the establishment of these tunnels can be automatic or manual.

The gateway 20 allows access to client or terminal entities 21 and 22 of a private network 2 to the public network 3, including equipment 31 and 32 of this public network. The public network 3 is of IPv4 type and public addressing. The private network 2 is of the IPv4 type and is privately addressed. When the gateway 20 transmits a packet received from one of the terminals 21, 22 which is connected to it, it sends the packet in the tunnel to the router CGN. Conversely, it receives packets for terminals 21, 22 in the tunnel and retransmits them in the private network 2 to their recipients.

The CGN router 10 is in charge of performing a translation between a session identifier in the private network 2 and a session identifier in the public network 3 in packets, these packets being received via the tunnel established in the network. For this purpose, it notably comprises a translation table 100, represented in FIG. 6, in which it stores the translation to be carried out, that is to say the IPv6 address of the gateway 20 and the session identifier in the private network 2 (source private IPv4 address, private source port) to a session identifier in the public network 3 (public IPv4 address, public source port) and vice versa.

For example, an entry of the translation table 100 is as follows:

IN:

Source IPv6 address: IPv6 address of gateway 20 + private source IPv4 address: 192.168.1.2 + transport protocol identifier: TCP + private source port: 11111

OUT:

Public IPv4 address: 80.66.57.12 + public source port: 44444

which results in the header of a packet received from the IPv6 address of the gateway and belonging to the session, the session being identified by a private IPv4 address 192.168.1.2 and a private source port 1 1 1 1 1, is translated to a header including a session identifier, including the public source IPv4 address 80.66.57.12 and the public source port 44444. Reciprocally, the header of a packet received from the public network 3, comprising the EPv4 public source address 80.66.57.12 and the public source port 44444 is translated to a header comprising notably the session identifier in the private network, composed of the private IPv4 address 192.168.1.2 and the source port TCP 11 111. The packet is then transmitted on the tunnel to the IPv6 address of the gateway 20.

The same public ΓΡν4 address is likely to be shared between different gateways or clients.

It should be noted that for purposes of simplification, only two terminals have been shown in FIG. 1. The methods naturally apply to a greater number of terminals.

A server 1 1 is also represented in FIG. 1. It is a DHCP server, for "Dynamic Host Configuration Protocol", arranged to provide on request of a client or a gateway 20 a public IPv4 address and a range of port numbers, as detailed later.

The tunneling method between the gateway 20 and the CGN router 10, as implemented by the gateway, will now be described in connection with FIG. 2.

In a step E1 of the establishment method, the gateway 20 obtains an IPv6 address from an IPv6 DHCP server, not shown in FIG. 1.

In a step E2 of the establishment process, the gateway 20 transmits a request to the DHCP server 1 1 in order to obtain translation information. The translation information includes a public EPv4 address and a range of port numbers. This is for example a DHCPDISCOVER request, conforming to the IETF document entitled "draft-bajko-v6ops-port-restricted-ipaddr-assign-02", in which the gateway 20 indicates that it supports this option OPTION-IPv4-RPR. The DHCP server 11 then transmits it back a DHCPACK message indicating that it supports OPTION-IPv4-OPR and includes a public IPv4 address and a range of port numbers. This port range is represented as an "end port range". Only port numbers belonging to this range can be used in association with the public IPv4 address. It is emphasized here that the public IPv4 address can thus be shared by different clients or gateways, these clients or gateways being uniquely identified using the combination of the public IPv4 address and the range interval. port allocated. Thus, at the end of this step E2, the gateway 20 has the translation information.

During a step E3 of the establishment process, the gateway 20 modifies its IPv6 address by inclusion in the private part of its address of the translation information. By way of example, such an IPv6 address 40, hereinafter referred to as the extended IPv6 address, is represented in FIG. 4. It comprises in the left-hand part a field 41 comprising the IPv6 prefix to which the gateway's IPv6 address belongs. a field 42 identifying the sub-network. These two fields form the fixed part of the IPv6 address. The IPv6 address 40 also comprises, in a particular embodiment of the invention, a field 43 comprising a port mask or "Port Mask" coded on 16 bits, a field 44 comprising a mask locator or "Locator Mask" coded on sixteen bits and a field thirty-two bits long 45 including the allocated public IPv4 address. Fields 43 and 44 are coded in accordance with the IETF document "draft-boucadair-dhc-port-range-01". The range of port numbers is thus encoded using thirty two bits. The gateway 20 then uses this extended IPv6 address to identify itself.

In a step E4 of the establishment process, the gateway 20 initiates tunnel establishment to the CGN router 10 by identifying itself using the extended IPv6 address. The establishment of this tunnel is performed according to the known methods of the prior art as specified above. We then place ourselves in the case where the tunnel is established.

At the end of these steps E1 to E4, the tunnel between the gateway 20 and the CGN router 10 is established and the packets to or from the gateway 20 are encapsulated in this tunnel.

In a variant of the establishment method, the gateway 20 is preconfigured with the aid of translation information stored for example in a programmable memory. Step E2 of the establishment process is then not implemented.

The translation method, comprising the method of allocating a session identifier, as implemented by the CGN router 10, will now be described in relation to FIG. 3.

In a step F1 of the translation process, the CGN router 10 receives a packet P from the tunnel established with the gateway 20 or from the public network 3. In a step F2 of the translation method, the CGN router 10 determines the nature of the packet P.

If it is a packet initiating a session, the translation process proceeds to a step

F3.

If it is a session release package, the translation process moves to a step

F10.

In the other cases, that is to say if it is a data packet belonging to an established session, the translation process proceeds to a step F20.

During the step F3 of the translation method, the CGN router 10 obtains the address of the tunnel end, ie the extended IPv6 address of the gateway 20.

In a step F4 of the translation method, the CGN router 10 determines from this extended IPv6 address obtained a public IPv4 address and a range of port numbers.

In a step F5 of the translation method, the CGN router 10 checks in an address table 101, shown in Figure 6, if there is in this range of port numbers associated with the public IPv4 address a free port.

If this is the case, in a step F8 of the translation process, the CGN router 10 allocates this port to the session being initiated and stores in the addressing table 101 that the port is now occupied. The translation process then proceeds to a step F9 of the translation process.

If this is not the case, that is to say that all the ports of the range is allocated, the CGN router 10 selects in a step F6 of the translation process a port number in an overflow range associated with the public IPv4 address. In this case, the port number allocated in the overflow range and the public IPv4 address do not uniquely identify the gateway 20.

The CGN router 10 then stores in a trace memory area 102, shown in FIG. 6, a trace associated with this translation. Specifically, the CGN router 10 stores: a protocol type: TCP for "Transmission Control Protocol", UDP for "User Datagram Protocol" or ICMP for "Internet Control Message Protocol";

the IPv6 address of the gateway 20;

the public IPv4 address allocated to the session;

the client's private IPv4 address

the private source port number of the client;

the public source port number in the overflow range allocated to the session;

the date, the start and end times of the allocation at the session.

During the step F9 of the translation process, the CGN router 10 stores in the translation table 100 in association with the IPv6 address of the gateway 20, the translation of the session identifier in the private network 2, as read from the packet header P, including the private IPv4 address and the private source port number, to the session identifier in the public network 3, including the public IPv4 address and the allocated public source port number.

The translation process then returns to step F1 awaiting reception of a packet P.

In step F10 of the translation method, that is to say, in the case of a session release packet P, the CGN router 10 releases the public port allocated to the session. Specifically, the GCN router 10 indicates in the addressing table 101 that the allocated public port associated with the public IPv4 address is now free. If a trace has been stored in the trace memory area 102, in this case, the CGN router 10 stores the end date of the session.

In the step F1 of the translation method, the CGN router 10 deletes from the translation table 100 the entry corresponding to the session being released.

From the step F20 of the translation method, that is to say when it is a packet P of data, the CGN router 10 implements the translation steps, as known from FIG. prior art. More precisely, in step F20 of the translation method, the CGN router 10 obtains from the translation table 100:

in a first case, if it is a packet P coming from the public network 3, the session identifier in the private network 2 and the IPv6 address of the gateway 20;

in a second case, if it is a packet P coming from the gateway 20, the session identifier in the public network 3.

In step F21 of the translational method, the CGN router 10 carries out the necessary translation and then transmits during the step F22 of the translation method the packet P in the tunnel in the first case and in the public network 3 in the second. case.

The translation process then returns to the step F1 waiting to receive a packet P.

Thanks to the methods according to the invention, it is thus possible to identify a client from a packet intercepted on the public network 3. The range of public port numbers is determined from the packet P and thus, in association with the public IPv4 address, the client is determined. When the port number belongs to the overflow range associated with the public IPv4 address, the client is identified using the trace stored in the tracing memory area 102. The tracing memory area 102 is, however, limited size when proper sizing is chosen for the range of public port numbers. Observations show that, in general, a terminal is likely to initiate a maximum of 60 sessions concurrent. By way of non-limiting example, a range comprising one hundred numbers of public ports may be selected.

In an alternative to this embodiment, when determining in step F5 of the translation method that there is no free public port, the request for initiation of the session is rejected, the steps F6 and F7 of the translation process not being implemented in this case. This makes it possible to avoid administering overflow ranges and thus to provide a trace memory area 102.

Still in this case, that is to say when there is no free public port and the request for initiation of the session is rejected, the gateway 20 then receives an ICMP message in this case indicating that there are no more public ports available, that is to say a depletion of the port number range. In this case, the gateway 20 may again implement steps E1 through E4 to obtain a second range of public port numbers. In this case, the gateway 20 builds a second IPv6 address taking into account this second range of public port numbers. It is emphasized here that it is possible in an IPv6 type network to have several IPv6 addresses.

In this particular embodiment, the range of public port numbers has been predicted to be thirty-two bits in the extended IPv6 address.

It is also possible to provide codings of this range of public port numbers less consuming, for example on sixteen bits.

In a group of six bits out of the sixteen bits, a range of port numbers is coded. We can then identify sixty-four ranges and we obtain then by range a number of ports of the order of one thousand.

The values are given later in hexadecimal notation. A first range of port numbers is [0400-043F], that is, the set of values between 0400 and 043F. The second range of port numbers is [0440-047F] and so on until the last port number range [FFCO-FFFF]. Other forms of constitution of the port number ranges are also possible, for example a sequential distribution of the port numbers in the different ranges.

Still as an example, in this case the first value of the range of port numbers is indicated, ie 0440 for [0440-047F]. It is also possible to take the last value, or any other value. This is a rating agreement.

By using a coding of the sixteen-bit port number range, it is then possible to also include in the extended IPv6 address the overflow range. In this case, the gateway 20 obtains in step E2 of the establishment process the overflow range and includes it in the step E3 of the establishment method in the extended IPv6 address. The router CGN 10 then obtains from the extended IPv6 address the overflow range to be used if necessary at the step F6 of the allocation process. It is understood that this overflow range can be allocated to several clients or gateways administered by the same CGN router 10;

The gateway 20 according to a particular embodiment will now be described in relation to FIG. 5.

Such a gateway 20 is arranged to convey data relating to at least one session of a client entity 21, 22 of a private network 2 via a tunnel established in an intermediate network 1 with a router CGN. For this purpose, the gateway 20 comprises:

a module 202 for transmission / reception in the private network:

a module 204 for transmission / reception in the intermediate network;

a module 206 for managing the tunnel in the intermediate network, arranged to establish the tunnel and to encapsulate packets of. data received from client entities of the private network and decapsulate data packets received from the CGN router;

a module 208 for modifying an address of the gateway in the intermediate network, arranged to include in a private part of said address translation information, which includes an address in a public network and a range of port numbers; .

The module 206 is further arranged to identify the gateway during the establishment of the tunnel using the modified address.

The gateway 20 may be statically configured with the address in the public network and the range of port numbers.

Optionally, the gateway 20 further comprises a module 210 for obtaining the translation information, arranged to obtain from a server 11 the address in the public network and the range of port numbers.

The CGN router 10 according to a particular embodiment will now be described in relation to FIG.

Such equipment 10 is arranged to convey data relating to at least one session of a client entity 21, 22 of a private network 2 via a tunnel established in an intermediate network 1 with a gateway 20.

For this purpose, the translation equipment comprises:

the tabs 100 of translation, 101 of addressing presented previously;

a transmission / reception module 110 in the intermediate network;

a module 1 12 of transmission / reception in the public network;

a module 1 14 for managing the tunnel in the intermediate network, arranged to establish the tunnel and to encapsulate data packets destined for the gateway and to decapsulate data packets received from the gateway;

a module 116 for selecting a session identifier in the public network: a translation module 118, arranged to translate in a data packet a session identifier in the private network to the selected session identifier in the public network and vice versa,

a module 120 for obtaining an address of the gateway in the intermediate network, translation information being included in a private part of this address and comprising an address in the public network and a range of port numbers.

The selection module 116 is further arranged to select the port number in the range of port numbers, the session identifier in the public network then consisting of the address in the public network and the selected port number.

In one variant, the CGN router 10 also includes the trace memory area

102, previously described. The selection module 1 16 is also arranged to select a port number in another range of port numbers when all the port numbers of the range have been allocated and to store a trace of the translation in the memory area of the port. trace 102.

The modules 206, 208, 210 of a gateway 20 are arranged to implement the steps of the previously described tunnel establishment method executed by the gateway. These are preferably software modules comprising software instructions for executing the steps of establishment of a previously described tunnel, implemented by a gateway. The invention therefore also relates to:

a gateway program, comprising program instructions for controlling the execution of the steps of the tunneling method previously described which are executed by said gateway, when said program is executed by a processor thereof;

a recording medium readable by a gateway on which the gateway program is recorded.

The modules 1 16, 120 of a translation equipment 10 or CGN router are arranged to implement the steps of the method of allocation of a previously described session identifier executed by the translation equipment. These are preferably software modules comprising software instructions for executing the allocation steps of a session identifier previously described, implemented by a translation equipment. The invention therefore also relates to:

a program for translation equipment, comprising program instructions intended to control the execution of the steps of the method of allocation of a previously described session identifier which are executed by said translation equipment, when said program is executed by a processor of it; - A recording medium readable by a translation equipment on which is recorded the program for translation equipment.

The software modules can be stored in or transmitted by a data carrier. This may be a hardware storage medium, for example a CD-ROM, a magnetic diskette or a hard disk, or a transmission medium such as an electrical signal, optical or radio, or a telecommunications network.

The invention also relates to a system 15 for accessing a public network for conveying data relating to at least one session of a client entity of a private network, comprising at least one gateway and a translation equipment, as described previously.

Claims

A method of establishing a tunnel for routing data packets relating to at least one session of a client entity (21, 22) of a private network (2) via a gateway ( 20) connected to an intermediate network (1), said method comprising the following steps implemented by the gateway:

a step (E4) for establishing a tunnel in the intermediate network between the gateway and an equipment (10) for translating the intermediate network, said translation equipment being able to perform a translation of a session identifier in the private network to a session identifier in a public network (3) in a data packet and vice versa, a session identifier consisting of an address and a port number,

characterized in that the method further comprises:

a step (E3) of modifying an address of the gateway in the intermediate network by inclusion in a private part of said translation information address, said translation information comprising an address in the public network and a range of numbers; of ports,

and in that, when establishing the tunnel, the gateway is identified by the modified address.

2. Method according to claim 1, further comprising a step (E2) of obtaining from a server (1 1) translation information.

3. Method according to claim 2, wherein, on receiving a message indicating a depletion of the range of port numbers coming from the translation equipment, the gateway (20) again implements the step d obtaining in order to obtain other translation information.

4. A method for allocating a session identifier in a public network (3) to a session of a client entity (21, 22) of a private network (2), the data packets of the client entity transiting, via a tunnel established in an intermediate network (1) between a bridge (20) and a translation equipment (10), said method comprising the following steps implemented by said translation equipment:

a step (Fl) of receiving a packet initiating the session via the tunnel,

a step (F8) for selecting a session identifier in the public network, a session identifier consisting of an address and a port number, the data packets relating to the session received in the tunnel being translated from a session identifier in the private network to the session identifier in the selected public network and vice versa, characterized in that the method further comprises:

a step (F3) of obtaining an address of the gateway in the intermediate network, translation information being included in a private part of said address and comprising an address in the public network and a range of port numbers;

and in that during the selection step, the port number is selected in the range of port numbers, the session identifier in the public network then consisting of the address in the public network and the number selected port.

The allocation method of claim 4, wherein when the set of port numbers of the range has been allocated, the initiation of the session is rejected.

The allocation method according to claim 4, wherein when the set of port numbers of the range has been allocated, selecting (F6) a port number in another range of port numbers and storing a trace of the translation.

A gateway (20) arranged to convey data relating to at least one session of a client entity (21, 22) of a private network through a tunnel established in an interposer network (1) with a translation equipment (10), said translation equipment being able to perform a translation in a data packet from a session identifier in the private network to a session identifier in a public network (3) and vice versa, an identifier of session consisting of an address and a port number, said gateway comprising:

means (208) for modifying an address in the intermediate network of the gateway by inclusion in a private part of said translation information address, said translation information including an address in the public network and a range of numbers; of ports,

means (206) for establishing the tunnel in the intermediate network between the gateway and the translation equipment, in which the gateway is identified by the modified address.

S. Translation equipment (10) arranged to convey data relating to at least one session of a client entity (21, 22) of a private network (2) via a tunnel established in an intermediate network (1) with a bridge (20), said translation equipment comprising:

means (1 10) for receiving a packet initiating the session via the tunnel,

means (116) for selecting a session identifier in the public network, a session identifier consisting of an address and a port number, translation means (118), arranged to translate in a data packet a session identifier in the private network to the selected session identifier in a public network (3) and conversely,

characterized in that said translation equipment further comprises:

means (120) for obtaining an address of the gateway in the intermediate network, translation information being included in a private part of said address and comprising an address in the public network and a range of port numbers;

System (15) for conveying data relating to at least one session of a client entity of a private network, said system comprising at least one gateway according to claim 7 and a translation equipment according to claim 8.

A computer program comprising instructions for implementing the tunneling method of claim 1 by a gateway, when the program is executed by a processor.

11. Computer program comprising instructions for implementing the method of allocating a session identifier according to claim 4 by a translation device, when the program is executed by a processor.