公开(公告)号：US20170279767A1

公开(公告)日：2017-09-28

申请号：US15617854

申请日：2017-06-08

申请人： International Business Machines Corporation

发明人： Michael J. FORK ,  Christopher T. GLOE ,  Kevin G. PATERSON

IPC分类号： H04L29/12 ,  G06F9/455 ,  H04L29/06 ,  H04L29/08

CPC分类号： H04L61/2592 ,  G06F9/45558 ,  H04L61/2578 ,  H04L63/0272 ,  H04L67/10

摘要： Techniques are disclosed for configuring a virtual machine instance accessed over a publically routable network address to host intranet applications. A virtual (or “dummy”) interface on the virtual machine instance is assigned an IP address that is inaccessible from the public interface. An application executed on the virtual machine instance is bound to a port on the network address assigned to this dummy interface. A virtual private network server assigns client's IP addresses that can be routed to the dummy interface. When a client computing system connects to the VPN server over the virtual machine instance's public interface, the client forwards traffic destined for the dummy interface's inaccessible network over the VPN connection.

公开(公告)号：US09749291B2

公开(公告)日：2017-08-29

申请号：US13183884

申请日：2011-07-15

申请人： Michael J. Fork ,  Christopher T. Gloe ,  Kevin G. Paterson

发明人： Michael J. Fork ,  Christopher T. Gloe ,  Kevin G. Paterson

IPC分类号： H04L29/12 ,  H04L29/06 ,  H04L29/08 ,  G06F9/455

CPC分类号： H04L61/2592 ,  G06F9/45558 ,  H04L61/2578 ,  H04L63/0272 ,  H04L67/10

摘要： Techniques are disclosed for configuring a virtual machine instance accessed over a publically routable network address to host intranet applications. A virtual (or “dummy”) interface on the virtual machine instance is assigned an IP address that is inaccessible from the public interface. An application executed on the virtual machine instance is bound to a port on the network address assigned to this dummy interface. A virtual private network server assigns client's IP addresses that can be routed to the dummy interface. When a client computing system connects to the VPN server over the virtual machine instance's public interface, the client forwards traffic destined for the dummy interface's inaccessible network over the VPN connection.

公开(公告)号：US20160373406A1

公开(公告)日：2016-12-22

申请号：US15255253

申请日：2016-09-02

申请人： SSH Communications Security OYJ

发明人： Tero Kivinen ,  Tatu Ylonen

IPC分类号： H04L29/12 ,  H04L12/751 ,  H04L29/08 ,  H04L29/06 ,  H04L12/46

CPC分类号： H04L61/256 ,  H04L12/4633 ,  H04L29/12009 ,  H04L29/12367 ,  H04L29/12471 ,  H04L29/125 ,  H04L29/12528 ,  H04L29/12537 ,  H04L45/026 ,  H04L61/2007 ,  H04L61/25 ,  H04L61/2514 ,  H04L61/2553 ,  H04L61/2564 ,  H04L61/2575 ,  H04L61/2578 ,  H04L61/6063 ,  H04L63/0272 ,  H04L63/029 ,  H04L63/04 ,  H04L63/0428 ,  H04L63/164 ,  H04L67/2842 ,  H04L69/16 ,  H04L69/161 ,  H04L69/165

摘要： This invention provides a method for providing network security services, such as those provided by the IPSEC protocol, through network address translation (NAT). The method is based on determining the transformations that occur on a packet and compensating for the transformations. Because only TCP and UDP protocols work through NATs, the IPSEC AH/ESP packets are encapsulated into UDP packets for transport. Special operations are performed to allow reliable communications in such environments.

公开(公告)号：US20160173444A1

公开(公告)日：2016-06-16

申请号：US14574359

申请日：2014-12-17

申请人： Ixia

发明人： Marius Pavel Nistor

IPC分类号： H04L29/12 ,  H04L29/06 ,  H04L12/26

CPC分类号： H04L61/256 ,  H04L41/0806 ,  H04L43/50 ,  H04L61/2514 ,  H04L61/2578 ,  H04L63/029 ,  H04L69/16 ,  H04L69/30 ,  H04W84/105

摘要： Methods, systems, and computer readable media for initiating and executing a performance test of a private network and/or components thereof are disclosed. Methods and systems include a receiver endpoint in a private network, and a sender endpoint in a public network. The receiver endpoint initiates a transport layer connection with the sender endpoint. The sender endpoint allocates a port, binds to the port, and sends an Internet Protocol (IP) address and a port number over the transport layer connection. The receiver endpoint then sends a hole punch datagram from the private network to the public network to create a hole in a firewall that is separating the public and private networks. The sender endpoint receives the hole punch datagram and uses IP address and port information in the hole punch datagram to send test traffic through the hole in the firewall.

摘要翻译： 公开了用于启动和执行专用网络的性能测试的方法，系统和计算机可读介质和/或其组件。 方法和系统包括专用网络中的接收器端点和公共网络中的发送者端点。 接收端点发起与发送方端点的传输层连接。 发送方端点分配端口，绑定到端口，并通过传输层连接发送Internet协议（IP）地址和端口号。 接收器端点然后从专用网络向公共网络发送打孔数据报，以在分离公共和专用网络的防火墙中创建一个孔。 发送方端点接收打孔数据报，并在打孔数据报中使用IP地址和端口信息，通过防火墙的孔发送测试流量。

公开(公告)号：US20150237010A1

公开(公告)日：2015-08-20

申请号：US14701397

申请日：2015-04-30

申请人： Google Inc.

发明人： James Anthony ROSKIND ,  Ian Douglas SWETT

IPC分类号： H04L29/06

CPC分类号： H04L63/029 ,  H04L9/3013 ,  H04L61/2578 ,  H04L63/04 ,  H04L63/0428 ,  H04L63/0435 ,  H04L63/0876 ,  H04L63/123 ,  H04L67/2814 ,  H04L67/42 ,  H04L69/169

摘要： Systems, methods, and machine-readable media for low latency server-side redirection of User Datagram Protocol (UDP)-based transport protocols traversing a client-side Network Address Translation (NAT) are provided. A request may be sent from a client for a data resource to a first server. The data resource may be received from a second server that has not been previously connected to the client. Receiving the data resource from the second server may be facilitated by the first server through redirecting the request to the second server and providing for the second server to connect to the client and directly respond to the request. The first server may lack at least one of the requested data resource or resources for providing the requested data resource.

摘要翻译： 提供了用于通过客户端网络地址转换（NAT）的基于用户数据报协议（UDP）的传输协议的低延迟服务器端重定向的系统，方法和机器可读介质。 请求可以从用于数据资源的客户端发送到第一服务器。 可以从尚未先前连接到客户端的第二服务器接收数据资源。 第一服务器可以通过将请求重定向到第二服务器并且为第二服务器提供连接到客户端并直接响应该请求，从而可以方便地从第二服务器接收数据资源。 第一服务器可能缺少用于提供所请求的数据资源的所请求的数据资源或资源中的至少一个。

公开(公告)号：US20140379875A1

公开(公告)日：2014-12-25

申请号：US14484510

申请日：2014-09-12

申请人： Core Wireless Licensing S.A.R.L.

发明人： Titos SARIDAKIS

IPC分类号： H04L29/08 ,  H04L29/12 ,  H04L29/06

CPC分类号： H04L67/104 ,  H04L61/2578 ,  H04L63/029 ,  H04L67/02 ,  H04L67/28

摘要： A method of circumventing network obstacles to provide a peer-to-peer communication channel between peers utilizing hypertext transfer protocol (HTTP) includes communicating a HTTP request from a peer device to a relay through a network including an obstacle where the HTTP request is intended for another peer device. The method further includes communicating a HTTP response from the relay to the peer device and establishing a communication channel between the peer device and the another peer device via the relay. The communication channel permits the peer device and the another peer device to send and receive data.

摘要翻译： 一种避开网络障碍物以利用超文本传输​​协议（HTTP）在对等体之间提供对等通信信道的方法包括：通过网络将HTTP请求从对等设备传送到中继站，该网络包括HTTP请求旨在用于 另一个对等设备。 所述方法还包括将所述中继器的HTTP响应传送到所述对等设备，以及经由所述中继器在所述对等设备与所述另一对等设备之间建立通信信道。 通信信道允许对等设备和另一个对等设备发送和接收数据。

公开(公告)号：US08918858B2

公开(公告)日：2014-12-23

申请号：US14012130

申请日：2013-08-28

申请人： SSH Communications Security OYJ

发明人： Tero Kivinen ,  Tatu Ylonen

IPC分类号： H04L29/06 ,  H04L12/46 ,  H04L29/12

CPC分类号： H04L61/256 ,  H04L12/4633 ,  H04L29/12009 ,  H04L29/12367 ,  H04L29/12471 ,  H04L29/125 ,  H04L29/12528 ,  H04L29/12537 ,  H04L45/026 ,  H04L61/2007 ,  H04L61/25 ,  H04L61/2514 ,  H04L61/2553 ,  H04L61/2564 ,  H04L61/2575 ,  H04L61/2578 ,  H04L61/6063 ,  H04L63/0272 ,  H04L63/029 ,  H04L63/04 ,  H04L63/0428 ,  H04L63/164 ,  H04L67/2842 ,  H04L69/16 ,  H04L69/161 ,  H04L69/165

摘要： A method, apparatus, and computer-readable media are presented that provide a configuration for communications through network address translation. The configuration includes transmitting, by a first computer device, a packet that includes a predetermined value indicating that the first computer device supports an extension of a communications protocol, wherein the communications protocol is used for communications across a network translator device and the extension is capable of traversing network address translation.

摘要翻译： 提供了一种通过网络地址转换提供用于通信的配置的方法，装置和计算机可读介质。 该配置包括由第一计算机设备发送包括指示第一计算机设备支持通信协议的扩展的预定值的分组，其中该通信协议用于跨越网络转换器设备的通信，并且该扩展能力 遍历网络地址转换。

公开(公告)号：US20140372499A1

公开(公告)日：2014-12-18

申请号：US14364831

申请日：2012-12-13

申请人： Koninklijke KPN N.V. ,  Nederlandse Organisatie voor Toegepast- Natuurwetenschappelijk Onderzoek TNO

发明人： Hans Maarten Stokking ,  Frank Den Hartog ,  Manuel Herrera Van Der Nood ,  Bernardus Hillen ,  Harm Mulder

IPC分类号： H04L29/12

CPC分类号： H04L61/25 ,  H04L61/2575 ,  H04L61/2578 ,  H04L67/303 ,  H04L69/40

摘要： The invention relates to a method and system for facilitating traversal of NATs. The method includes a server providing NAT-related information for NATs of a first NAT type to at least one terminal in a first local network, the first local network comprising a NAT of the first NAT type. The NAT-related information for the NATs of the first NAT type enables the terminal in the first local network to traverse the NAT in that local network. NAT-related information obtained by testing a NAT of a specific NAT type, such as e.g. a specific brand, model, and/or firmware version of a NAT, may be re-used for other NATs of the same type, irrespective of the local network in which those NATs are used, thus alleviating the need to separately test the NATs of the same type in each local network that contains these NATs.

摘要翻译： 本发明涉及一种便于穿越NAT的方法和系统。 该方法包括向第一本地网络中的至少一个终端提供针对第一NAT类型的NAT的NAT相关信息的服务器，所述第一本地网络包括第一NAT类型的NAT。 第一种NAT类型NAT的NAT相关信息使得第一本地网络中的终端能够遍历本地网络中的NAT。 通过测试特定NAT类型的NAT获得的与NAT相关的信息，例如， NAT的特定品牌，型号和/或固件版本可以重用于相同类型的其他NAT，而不管使用哪些NAT的本地网络，因此减轻了单独测试NAT的NAT的需要 每个本地网络中包含这些NAT的类型相同。

公开(公告)号：US08874911B2

公开(公告)日：2014-10-28

申请号：US12713240

申请日：2010-02-26

申请人： Yasuhiro Kudo

发明人： Yasuhiro Kudo

IPC分类号： H04L9/32 ,  H04L9/00 ,  G06F21/00 ,  H04L29/06 ,  H04L29/12

CPC分类号： H04L65/1069 ,  H04L29/12452 ,  H04L29/125 ,  H04L29/12528 ,  H04L61/2546 ,  H04L61/2564 ,  H04L61/2575 ,  H04L61/2578 ,  H04L63/06 ,  H04L63/08 ,  H04L65/1006

摘要： A second terminal device is used in a system including a connection management server, a first terminal device, and the second terminal device. The second terminal device includes: a local address obtaining unit configured to obtain a first local IP address and first authentication information of the first terminal device from the connection management server, if a first global IP address matches a second global IP address; a determination unit configured to determine, by using of the obtained first authentication information, whether a first particular terminal device with which the second terminal device can communicate by use of the first local IP address is the first terminal device; and a target data communication unit configured to communicate first data with the first terminal device by using the first local IP address, if the first particular terminal device is determined to be the first terminal device.

摘要翻译： 在包括连接管理服务器，第一终端设备和第二终端设备的系统中使用第二终端设备。 第二终端装置包括：本地地址获取单元，被配置为如果第一全局IP地址与第二全局IP地址匹配，则从连接管理服务器获得第一本地IP地址和第一终端设备的第一认证信息; 确定单元，被配置为通过使用所获得的第一认证信息来确定第二终端设备可以通过使用第一本地IP地址与其通信的第一特定终端设备是否是第一终端设备; 以及目标数据通信单元，被配置为如果所述第一特定终端设备被确定为所述第一终端设备，则通过使用所述第一本地IP地址与所述第一终端设备通信第一数据。

公开(公告)号：US08774183B2

公开(公告)日：2014-07-08

申请号：US12096584

申请日：2006-12-08

申请人： Jun Kitamura ,  Shinpei Yashima ,  Atsuki Ishida

发明人： Jun Kitamura ,  Shinpei Yashima ,  Atsuki Ishida

IPC分类号： H04L12/56 ,  H04L12/46

CPC分类号： H04L12/4679 ,  H04L12/2818 ,  H04L12/2825 ,  H04L12/4625 ,  H04L12/4633 ,  H04L29/12028 ,  H04L29/12254 ,  H04L29/12405 ,  H04L29/12537 ,  H04L49/20 ,  H04L61/103 ,  H04L61/2038 ,  H04L61/2528 ,  H04L61/2578 ,  H04L61/2592

摘要： A simple means is used to realize a virtual network communication via an home network and Internet. A relay device 4 comprises bridge module 12 provided between a network protocol stack 13 and each of network devices 10, 11 for bridging for packets which are not addressed to the relay device or VLAN, or not broadcast request packets; a server address storage section 17 for storing the global address of a server; a tunneling session establishing section 20 for establishing a tunneling connection with the server based on the global address; a capsulating processing section 21 for capsulating a originating address and sending it to the server via the tunneling connection; and a virtual IP address/private IP address conversion section 22 for decapsulating a packet addressed to the relay device, converting a destination virtual network address included in this packet to a private IP address on the LAN of a client apparatus, and sending it onto the LAN via the bridge module.

摘要翻译： 一种简单的手段用于通过家庭网络和互联网实现虚拟网络通信。 中继设备4包括网桥模块12，桥模块12设置在网络协议栈13和网络设备10,11之间，用于桥接不寻址到中继设备或VLAN的分组，或不广播请求分组; 用于存储服务器的全局地址的服务器地址存储部分17; 隧道会话建立部分20，用于基于全局地址建立与服务器的隧道连接; 封装处理部分21，用于封装始发地址并经由隧道连接将其发送到服务器; 以及虚拟IP地址/私有IP地址转换部分22，用于解封装到中继装置的分组，将包中包含的目的虚拟网络地址转换成客户装置的LAN上的私有IP地址，并将其发送到 LAN通过桥模块。