Address translation method, device and system

Abstract

The invention provides an address conversion method, device and system, and belongs to the technical field of networks. According to the scheme provided by the invention, based on the fact that the first message of the first user is the message of the target application, the source address of the first message is converted from the first private network address to the target address and then is sent to the first forwarding device. Moreover, the source tracing information of the first user not only comprises a target address corresponding to the first private network address, but also comprises a first public network address and a first port range corresponding to the first private network address. In the tracing information of the first user, the first private network address corresponds to two different addresses, so that the source address of the message can be converted into different network addresses from the first private network address based on the type of the application to which the message belongs when network address conversion is performed on the message of the first user; therefore, the flexibility of address translation is effectively improved.

Description

Technical Field

[0001] This application relates to the field of network technologies, and particularly to an address conversion method, apparatus, and system. Background Art

[0002] A broadband remote access server (BRAS) is an access gateway for broadband network applications. To implement an application acceleration function, a service awareness (SA) service board can be added to the BRAS. The BRAS can divert user traffic to the SA service board for application identification, and then divert it to a distributed network address translation (NAT) service board for Internet protocol (IP) address conversion. Thereafter, the SA service board can forward the traffic of a specified application identified to an acceleration router.

[0003] The acceleration router can perform centralized NAT processing on the received traffic and forward it to an acceleration access point, so that the acceleration access point can send the traffic to a destination device through a dedicated acceleration channel. Moreover, the acceleration router can also publish a NAT public network route to the acceleration channel to ensure that the return traffic sent by the target device can also be forwarded by the acceleration router.

[0004] However, the flexibility of the above address conversion method is relatively low. Summary of the Invention

[0005] This application provides an address conversion method, apparatus, and system, which can solve the technical problem of relatively low flexibility of the address conversion method in related technologies.

[0006] In a first aspect, an address conversion method is provided. The method includes: based on a first message of a first user being a message of a target application, converting the source address of the first message from a first private network address to a target address and sending it to a first forwarding device, and reporting the traceability information of the first user to an authentication server. The traceability information includes the target address corresponding to the first private network address, as well as a first public network address and a first port range corresponding to the first private network address. Among them, the target address is different from the first public network address.

[0007] Since there are two different addresses corresponding to the first private network address in the traceability information of the first user, when performing network address conversion on the message of the first user, the source address of the message can be converted from the first private network address to different network addresses based on the type of the application to which the message belongs, thereby effectively improving the flexibility of address conversion.

[0008] Optionally, the first private network address belongs to a first private network address pool. The process of converting the source address of the first packet from the first private network address to the target address based on the received first packet of the first user being a packet for a target application may include: based on the received first packet of the first user being a packet for a target application, converting the source address of the first packet from the first private network address to a target address in a second private network address pool. That is, the target address may be a private network address. Here, the second private network address pool is different from the first private network address pool.

[0009] For the scenario where the target address is a private network address, since the target address can only represent the first user, it can be ensured that the first forwarding device can perform network address translation on the first packet in a static mapping manner, and the resources of the public network addresses required for static mapping on the first forwarding device can be saved. Moreover, when tracing the first user, tracing can be performed through the tracing information stored in the authentication server and the static mapping algorithm in the first forwarding device. Since there is no need to separately deploy a system log (syslog) server for the first forwarding device, the system structure is effectively simplified and the system cost is reduced.

[0010] Optionally, the first public network address belongs to a first public network address pool. The process of converting the source address of the first packet from the first private network address to the target address based on the received first packet of the first user being a packet for a target application may include: based on the received first packet of the first user being a packet for a target application, converting the source address of the first packet from the first private network address to a target address in a second public network address pool. That is, the target address may be a public network address. Here, the second public network address pool is different from the first public network address pool.

[0011] For the scenario where the target address is a public network address, since the source address of the first packet has been converted to a public network address in an independent public network address pool before being sent to the first forwarding device, the first forwarding device does not need to perform network address translation on the first packet anymore. Moreover, when tracing the first user, tracing can be directly performed through the tracing information stored in the authentication server. This solution does not require separately deploying a syslog server for the first forwarding device, thus effectively simplifying the system structure and reducing the system cost.

[0012] Optionally, for the scenario where the target address is a public network address, the method may further include: converting the source port of the first packet to a port within a second port range. That is, when performing network address translation on the packet of the target application sent by the first user, not only the source address can be converted, but also the source port can be converted.

[0013] Optionally, for the scenario where the target address is a public network address, the method further includes: publishing the route of the second public network address pool to the first forwarding device for the first forwarding device to publish the route of the second public network address pool.

[0014] Since the source address of the packet of the target application is converted into the public network address in the second public network address pool, the first forwarding device does not need to perform network address translation on the packet of the target application anymore. Therefore, in order to ensure that the return traffic of the target application can still be forwarded by the first forwarding device, the first forwarding device needs to publish the route of the second public network address pool.

[0015] Optionally, the process of reporting the traceability information of the first user to the authentication server may include: reporting the first information to the authentication server and reporting the second information to the authentication server. The first information includes the first public network address and the first port range corresponding to the first private network address, and the second information includes the target address corresponding to the first private network address. That is, the target address and the first public network address can be reported to the authentication server in batches.

[0016] The first information and the second information may both be remote authentication dial in user service (RADIUS) information, or may also be referred to as RADIUS interface messages.

[0017] Optionally, the process of reporting the first information to the authentication server may include: after the first user goes online, reporting a charging start message to the authentication server, and the charging start message includes the first information. The process of reporting the second information to the authentication server may include: based on the received first packet being a packet of the target application, reporting a charging update message to the authentication server, and the charging update message includes the second information.

[0018] It can be understood that after the first user goes online, the first private network address, the corresponding first public network address and the first port range can be allocated to the first user and reported to the authentication server through the charging start message. After receiving the first packet of the target application sent by the first user, the target address can be re-allocated to the first user from the second private network address pool or the second public network address pool and reported to the authentication server through the charging update message.

[0019] Optionally, the method may further include: based on the received second packet of the first user not being a packet of the target application, converting the source address of the second packet from the first private network address into the first public network address and converting the source port of the second packet into the port in the first port range and then sending it to the second forwarding device.

[0020] For packets of non-target applications, network address translation can be performed according to the first public network address and the first port range assigned when the first user logs on, and the packets are sent to the second forwarding device. The first forwarding device can be a forwarding device for forwarding the traffic of the target application, and the second forwarding device can be a forwarding device for forwarding the traffic of non-target applications. That is, the traffic of the target application and the traffic of non-target applications can be forwarded by different forwarding devices.

[0021] Optionally, the method may further include: based on the fact that the third packet received from the second user is not a packet of the target application, converting the source address of the third packet from the second private network address to the second public network address, and converting the source port of the third packet to a port within the third port range and then sending it to the second forwarding device. The first private network address and the second private network address belong to the same private network address pool, and the first public network address and the second public network address belong to the same public network address pool.

[0022] It can be understood that after each user logs on, a private network address can be assigned to the user from the first private network address pool, and a corresponding public network address and port range can be assigned to the user from the first public network address pool. For packets of non-target applications sent by the user, network address translation can be performed using the public network address and port range assigned at logon.

[0023] Optionally, the method may further include: determining, through the SA service board, that the first packet of the first user is a packet of the target application; or determining, through an access control list (ACL), that the first packet of the first user is a packet of the target application. The SA service board can parse the packet at the seventh layer protocol to detect whether the received packet is a packet of the target application.

[0024] Optionally, the above address translation method can be applied to a broadband remote access server, also known as a broadband network gateway (BNG).

[0025] Optionally, the target application can be an application for deploying an acceleration service. Correspondingly, the first forwarding device can be a forwarding device capable of forwarding the packet to an acceleration path, such as an acceleration router.

[0026] In a second aspect, an address translation method is provided, which is applied to an authentication server. The method includes: receiving the traceability information of the first user. The traceability information includes a target address corresponding to the first private network address of the first user, and a first public network address and a first port range corresponding to the first private network address. The target address is different from the first public network address.

[0027] After receiving the traceability information of the first user, the authentication server can store the traceability information, that is, store the NAT log of the first user, so as to trace the first user.

[0028] Optionally, the process of receiving the traceability information of the first user may include: receiving a first message, where the first message includes a first public network address and a first port range corresponding to the first private network address; receiving a second message, where the second message includes a target address corresponding to the first private network address.

[0029] Optionally, the process of receiving the first message may include: receiving a charging start message, where the charging start message includes the first message. The process of receiving the second message may include: receiving a charging update message, where the charging update message includes the second message.

[0030] Optionally, the first private network address belongs to a first private network address pool, the target address belongs to a second private network address pool, and the second private network address pool is different from the first private network address pool; or, the first public network address belongs to a first public network address pool, the target address belongs to a second public network address pool, and the second public network address pool is different from the first public network address pool. The second message may further include a second port range corresponding to the first private network address.

[0031] In a third aspect, an address conversion method is provided, which is applied to an address conversion system. The system includes: a broadband remote access server and a first forwarding device. The method includes: based on the received first message of the first user being a message for a target application, the broadband remote access server converts the source address of the first message from a first private network address to a target address and then sends it to the first forwarding device. The first forwarding device forwards the first message. The broadband remote access server reports the traceability information of the first user to the authentication server. The traceability information includes the target address corresponding to the first private network address, as well as the first public network address and the first port range corresponding to the first private network address. Among them, the target address is different from the first public network address.

[0032] Optionally, the first public network address belongs to a first public network address pool. The process by which the broadband remote access server converts the source address of the first message from the first private network address to a target address based on the first message of the first user received being a message for a target application may include: The broadband remote access server converts the source address of the first message from the first private network address to a target address in a second public network address pool based on the first message of the first user received being a message for a target application, and converts the source port of the first message to a port within a second port range, where the second public network address pool is different from the first public network address pool. The method may further include: The broadband remote access server publishes a route for the second public network address pool to a first forwarding device; the first forwarding device publishes a route for the second public network address pool. Among them, the source address of the first message forwarded by the first forwarding device is the target address, that is, the first forwarding device does not perform network address translation on the first message.

[0033] Optionally, the first private network address belongs to a first private network address pool. The process by which the broadband remote access server converts the source address of the first message from the first private network address to a target address based on the first message of the first user received being a message for a target application may include: The broadband remote access server converts the source address of the first message from the first private network address to a target address in a second private network address pool based on the first message of the first user received being a message for a target application, where the second private network address pool is different from the first private network address pool. The process by which the first forwarding device forwards the first message may include: The first forwarding device converts the target address of the first message to a public network address in a third public network address pool, and after converting the source port of the first message to a port within a fourth port range, forwards the first message.

[0034] Optionally, the method may further include: The broadband remote access server converts the source address of the second message from the first private network address to a first public network address and converts the source port of the second message to a port within a first port range based on the second message of the first user received not being a message for a target application, and then sends it to a second forwarding device. The broadband remote access server converts the source address of the third message from the second private network address to a second public network address and converts the source port of the third message to a port within a third port range based on the third message of the second user received not being a message for a target application, and then sends it to the second forwarding device. The second forwarding device forwards the second message and the third message. Among them, the first private network address and the second private network address belong to the same private network address pool, and the first public network address and the second public network address belong to the same public network address pool.

[0035] Optionally, the first forwarding device may be an acceleration router for accelerating the forwarding of messages for the target application.

[0036] Fourthly, an address conversion method is provided, which includes: based on that the first packet sent by the first user is a packet for the target application, sending the first packet to the first forwarding device for the first forwarding device to perform network address conversion on the first packet, and based on that the second packet sent by the first user is not a packet for the target application, performing network address conversion on the second packet and then sending it to the second forwarding device. Wherein, the source address of the first packet is a first private network address, and the source address of the second packet after network address conversion is different from the first private network address.

[0037] Since this method can distinguish applications for packets to perform network address conversion or not, the flexibility of address conversion is effectively improved. Moreover, since the first packet of the target application is not subjected to network address conversion, the source address of this packet can only represent the first user. Thus, it can be ensured that the first forwarding device can perform network address conversion on the first packet in the way of static mapping. Correspondingly, when tracing back to the first user, it can be directly traced through the static mapping algorithm in the first forwarding device, without the need to deploy a syslog server separately, thus effectively simplifying the system structure and reducing the system cost.

[0038] Optionally, the method may further include: after the first user goes online, allocating a first private network address for the first user from the first private network address pool; and after the second user goes online, allocating a second private network address for the second user from the second private network address pool. Wherein, the first user is a user applying for the acceleration service of the target application, and the second user is a user not applying for the acceleration service of the target application. The first private network address pool is different from the second private network address pool.

[0039] Since the method provided by this application can plan an independent private network address pool for users applying for the acceleration service of the target application, after directly sending the packets of this part of users to the first forwarding device, it can be ensured that the source addresses of the packets received by the first forwarding device are continuously distributed. Correspondingly, the public network address pool planned in the first forwarding device for performing network address conversion only needs to cover the users applying for the acceleration service of the target application, thus effectively saving the public network address resources of the first forwarding device.

[0040] Optionally, the method may further include: performing network address conversion on the third packet sent by the second user and then sending it to the second forwarding device. That is, for users not applying for the acceleration service of the target application, it is not necessary to distinguish whether the packets sent by the user are packets for the target application, but the packets can be directly subjected to network address conversion and then forwarded.

[0041] In a fifth aspect, an address conversion method is provided, which is applied to a forwarding device. The method includes: performing a first static mapping conversion on a first packet of a first user sent by a broadband remote access server and then forwarding it; and performing a second static mapping conversion on a second packet of a second user sent by the broadband remote access server and then forwarding it. The first static mapping conversion includes: converting the source address of the first packet from a first private network address to a first public network address, and converting the source port of the first packet from a first private network port to a first public network port within a first public network port range. The second static mapping conversion includes: converting the source address of the second packet from the first private network address to the first public network address, and converting the source port of the second packet from a second private network port to a second public network port within a second public network port range. The first private network port belongs to a first private network port range, and the second private network port belongs to a second private network port range.

[0042] The static mapping algorithm deployed in the forwarding device can perform network address conversion based on the private network address and the private network port range. That is, for the same private network address, if the private network port ranges are different, they can be converted to the same public network address and different public network port ranges. Thus, it can be ensured that a user can be uniquely determined based on this static mapping algorithm, and static traceability of the user can be achieved. Since there is no need to deploy a syslog server separately, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation computer room can be avoided.

[0043] Optionally, the method further includes: based on a received traceability instruction for the first public network address and the first public network port range, determining a first private network address and a first private network port range corresponding to the first public network address and the first public network port range through the static mapping algorithm; and based on a received traceability instruction for the first public network address and the second public network port range, determining a first private network address and a second private network port range corresponding to the first public network address and the second public network port range through the static mapping algorithm.

[0044] Based on the above analysis, when tracing a public network address and a public network port range using the static mapping algorithm, a corresponding private network address and a private network port range can be determined. Based on this, even if the one private network address represents multiple users, a user can be uniquely determined through the private network port range, thereby achieving accurate traceability of the user.

[0045] In a sixth aspect, an address conversion device is provided. The address conversion device includes at least one module, and the at least one module can be used to implement the address conversion method provided in any of the above aspects.

[0046] In a seventh aspect, an address conversion device is provided. The address conversion device includes: a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the address conversion method provided in any of the above aspects is implemented.

[0047] In an eighth aspect, an address conversion device is provided. The address conversion device may include: a main control board and an interface board, and the main control board and the interface board may be used to implement the address conversion method provided in any of the above aspects.

[0048] In a ninth aspect, a computer-readable storage medium is provided. Instructions are stored in the computer-readable storage medium, and when the instructions are executed by a processor, the address conversion method provided in any of the above aspects is implemented.

[0049] In a tenth aspect, a computer program product including instructions is provided. When the instructions run on a processor, the processor is caused to execute the address conversion method provided in any of the above aspects.

[0050] In an eleventh aspect, an address conversion system is provided. The address conversion system includes: a broadband remote access server and a first forwarding device. Among them, the broadband remote access server is used to implement the address conversion method provided in the first aspect or the fourth aspect above. Alternatively, the first forwarding device is used to implement the address conversion method provided in the fifth aspect above.

[0051] Optionally, for the scenario where the broadband remote access server is used to implement the address conversion method provided in the first aspect above, the address conversion system may further include an authentication server, and the authentication server may be used to implement the address conversion method provided in the second aspect above. Among them, the authentication server may be an authentication, authorization, and accounting (AAA) server.

[0052] In a twelfth aspect, a chip is provided, and the chip may be used to implement the address conversion method provided in any of the above aspects.

[0053] In summary, the present application provides an address conversion method, apparatus, and system. The solution provided by the present application can use the first message of the first user as the message of the target application, convert the source address of the first message from the first private network address to the target address, and then send it to the first forwarding device. Moreover, the traceability information of the first user not only includes the target address corresponding to the first private network address, but also includes the first public network address and the first port range corresponding to the first private network address. Since there are two different addresses corresponding to the first private network address in the traceability information of the first user, when performing network address conversion on the message of the first user, the source address of the message can be converted from the first private network address to different network addresses based on the type of the application to which the message belongs, thereby effectively improving the flexibility of address conversion. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 FIG. is a schematic structural diagram of a broadband remote access system provided by an embodiment of the present application;

[0055] Figure 2 FIG. is a schematic structural diagram of a NAT traceability scenario provided by an embodiment of the present application;

[0056] Figure 3 FIG. is a schematic diagram of a static mapping algorithm provided by an embodiment of the present application;

[0057] Figure 4 FIG. is a schematic diagram of an application scenario of an address conversion method provided by an embodiment of the present application;

[0058] Figure 5 FIG. is a schematic flowchart of an address conversion method provided by an embodiment of the present application;

[0059] Figure 6 FIG. is a schematic flowchart of another address conversion method provided by an embodiment of the present application;

[0060] Figure 7 FIG. is a schematic flowchart of a process of reporting a charging message to an authentication server provided by an embodiment of the present application;

[0061] Figure 8 FIG. is a schematic flowchart of a process of a broadband remote access server forwarding a message provided by an embodiment of the present application;

[0062] Figure 9 FIG. is a schematic flowchart of yet another address conversion method provided by an embodiment of the present application;

[0063] Figure 10 FIG. is a schematic flowchart of another process of reporting a charging message to an authentication server provided by an embodiment of the present application;

[0064] Figure 11It is a schematic flow diagram of another address conversion method provided by an embodiment of the present application;

[0065] Figure 12 It is a schematic flow diagram of another address conversion method provided by an embodiment of the present application;

[0066] Figure 13 It is a schematic flow diagram of another address conversion method provided by an embodiment of the present application;

[0067] Figure 14 It is a schematic structural diagram of an address conversion device provided by an embodiment of the present application;

[0068] Figure 15 It is a schematic structural diagram of another address conversion device provided by an embodiment of the present application;

[0069] Figure 16 It is a schematic structural diagram of another address conversion device provided by an embodiment of the present application;

[0070] Figure 17 It is a schematic structural diagram of another address conversion device provided by an embodiment of the present application;

[0071] Figure 18 It is a schematic structural diagram of another address conversion device provided by an embodiment of the present application;

[0072] Figure 19 It is a schematic structural diagram of another address conversion device provided by an embodiment of the present application. Detailed implementation manners

[0073] The following will introduce in detail the address conversion method, device and system provided by the embodiments of the present application. First, the technical terms involved in the solutions provided by the embodiments of the present application will be introduced.

[0074] Application acceleration: Forward the traffic of the application to the acceleration path (also called the dedicated acceleration channel), so as to ensure both the latency and bandwidth of the client accessing the application server, and improve the user experience.

[0075] Acceleration path: A forwarding path with small latency and guaranteed bandwidth.

[0076] Acceleration router: A router deployed at the front end of the acceleration path, used to introduce (i.e., divert) the traffic to the acceleration path.

[0077] Static traceability: A NAT traceability technology that uses the static mapping of private network addresses to public network addresses for network address conversion, and is a traceability method without NAT logs.

[0078] RADIUS Traceability: A NAT traceability technology where users dynamically obtain public IP addresses and port segments, which are transmitted to the AAA server through RADIUS accounting messages for traceability. It is a traceability method that does not require NAT logs.

[0079] To implement application acceleration functions, such as Figure 1 As shown, SA service boards can be added to the BRAS (which can also be called BNG). The BRAS can divert the traffic of end users to the SA service board for application identification, and then divert it to the distributed NAT service board for network address translation (i.e., NAT processing). After that, the SA service board can forward the traffic of the identified specified application to the acceleration router. For example, the SA service board can use policy-based routing redirection to divert the traffic of the specified application to the acceleration router through a virtual private network (VPN) tunnel or an SRv6 tunnel. Among them, SRv6 refers to the Internet protocol version 6 (IPv6) technology based on segment routing (SR). It can be understood that the BRAS (or BNG) can be a physical BRAS, or it can also be a BRAS with separated control plane (controlplane, CP) and user plane (user plane, UP) (also known as CU separation), which is also called a virtual broadband remote access server (vBRAS) system. SA service boards can be inserted on both types of BRAS, and the SA service board in the vBRAS system can be inserted on the UP device.

[0080] The acceleration router can perform centralized NAT processing on the received traffic (i.e., a NAT device for NAT processing of traffic can be hung beside the acceleration router), and forward it to the acceleration access point so that the acceleration access point can send the traffic to the destination device through a dedicated acceleration channel. Optionally, the destination device can be an overseas server. And to ensure that the traffic returned from the destination device can also return to the acceleration router through the dedicated acceleration channel, the acceleration router (such as the hung NAT device) also needs to publish a public network route to the dedicated acceleration channel. Thus, after the acceleration access point receives the traffic returned from the destination device, it can return the traffic from the dedicated acceleration channel to the acceleration router through route lookup, and then the acceleration router returns it to the BRAS.

[0081] For the traffic of other applications (i.e., non-accelerated traffic), such as Figure 1As shown, the BRAS can divert this traffic to the distributed NAT service board for NAT processing. Subsequently, the traffic can be forwarded to the backbone router through the core router (CR). The backbone router can then forward the traffic to the destination device through the Internet (i.e., the non-accelerated channel).

[0082] From Figure 1 It can be seen that the traffic of end users can be forwarded to the BRAS through network devices such as optical network terminals (ONTs), optical line terminals (OLTs), and local area network switches (LAN switches, LSWs). Both the acceleration router and the acceleration access point can be deployed in the data center (DC) computer room.

[0083] Since the NAT technology changes the IP address of users accessing the Internet, in order to facilitate network supervision and Internet access auditing, it is usually necessary to save NAT logs for home broadband users accessing the Internet through NAT. The regulatory agency can determine user information by querying the NAT logs based on the IP address and port of the traffic accessing a certain website. Before deploying the application acceleration solution, the BRAS can use the RAIDUS method for traceability, that is, the BRAS can report the private IP address, public IP address, and port segment information of users to the AAA server for storage through RAIDUS charging messages to achieve NAT traceability. After deploying the application acceleration solution, a NAT device is newly added on the acceleration router. Since the acceleration router does not interact with the AAA server and cannot use RAIDUS for traceability, therefore as Figure 2 shown, a syslog server needs to be configured for the acceleration router to meet the requirements of NAT traceability. However, adding a new syslog server will increase the cost of NAT traceability and the burden on the operator's computer room space and power consumption.

[0084] Figure 3 is a schematic diagram of the principle of a static mapping algorithm provided by an embodiment of the present application. As Figure 3As shown, the static mapping algorithm can map an internal network IP address in the inside pool to a public network IP address and a port segment in the global pool. For example, the port segment can include n = 4023 ports. When performing NAT traceability, the internal network IP address in the inside pool can be retrieved in reverse through the public network IP address and the port segment in the global pool, and the AAA server can query the specific user through this internal network IP address. Among them, the inside pool can be a private network address pool or a public network address pool. Based on the principle of the above static mapping algorithm, to ensure that a user can be accurately determined through the internal network IP address, it is necessary to ensure that one internal network IP address represents only one user.

[0085] Since the BRAS uses NAT technology to convert the private network IP addresses of multiple users to a single public network IP address, for the traffic received by the acceleration router, one public network IP address represents multiple users. After adding a NAT device to the acceleration router, if the NAT device uses the static mapping algorithm for static traceability, since the static mapping algorithm requires that one internal network IP address before conversion (such as the public network IP address after BRAS conversion) represents only one user, it is necessary to plan the entire home broadband address segment for the inside pool. Correspondingly, it is required that the public network address pool planned on the acceleration router can also cover all home broadband users. However, after deploying the application acceleration solution, not all users will use the specified application that needs to be accelerated. For example, for a certain game application, the users using this game application only account for 10% of the total home broadband users, and the private network addresses are not fixed. Correspondingly, in fact, only 10% of the users' traffic needs to be diverted to the acceleration router, so most of the public network addresses planned on the acceleration router will not be used, resulting in a waste of public network address resources.

[0086] Figure 4 It is a schematic structural diagram of an address conversion system provided by an embodiment of the present application. As Figure 4 shown, the system can include: BRAS 01 and the first forwarding device 02. Among them, BRAS 01 is responsible for allocating private network IP addresses, public network IP addresses, and port segments (also called port ranges) when home broadband users go online. As Figure 4As shown in the figure, an SA service board and a NAT service board are also deployed on the BRAS 01. The SA service board can be used to identify the applications of the traffic received by the BRAS 01 to identify the traffic of the target application. The NAT service board can perform network address translation on the traffic received by the BRAS 01, that is, perform NAT processing. Among them, for the traffic of the identified target application, the BRAS 01 can redirect the traffic of the target application to the first forwarding device 02 through policy routing. For example, assume that there is a VPN tunnel between the BRAS 01 and the first forwarding device 02, then the BRAS 01 can redirect the accelerated traffic to the VPN tunnel through policy routing.

[0087] The first forwarding device 02 can be a forwarding device dedicated to forwarding the traffic of the target application. For example, assume that the target application is an application with an acceleration service deployed, then the first forwarding device 02 can be an acceleration router, which can forward packets through an acceleration forwarding channel. Moreover, the first forwarding device 02 can publish the IP address routing of the independent public network pool to the destination device (such as an overseas server) through the dedicated acceleration channel to divert the return traffic of the destination device.

[0088] Optionally, continue to refer to Figure 4 , the address conversion system may further include an authentication server 03 and a second forwarding device 04. Among them, the authentication server 03 can be an AAA server, which is used to receive the traceability information of the user reported by the BRAS 01 and store NAT logs, also known as RADIUS logs. Among them, the traceability information may include the private IP address, public IP address and port range of the user.

[0089] The second forwarding device 04 can be a forwarding device for forwarding the traffic of non-target applications. For example, the second forwarding device 04 can be a backbone network router, which can forward packets through a public Internet channel. For example, as Figure 1 shown, the BRAS 01 can establish communication connections with the first forwarding device 02 and the second forwarding device 04 through CR respectively.

[0090] Optionally, the BRAS 01 or BNG can be an intelligent device, that is, the BRAS can be an iBRAS, and the BNG can be an iBNG.

[0091] Figure 5 is a flowchart of an address conversion method provided by an embodiment of the present application. This method can be applied to an address forwarding device. Optionally, the address forwarding device can be such as Figure 4The broadband remote access server (BRAS) in the system shown. Moreover, this address translation method can achieve NAT traceability in the application acceleration scenario without deploying a syslog server in the system, thus effectively simplifying the system structure, reducing system power consumption and costs. Taking this address forwarding device as the broadband remote access server as an example, as Figure 5 shown, this method includes:

[0092] Step 101: Based on the first packet of the first user received by the broadband remote access server being a packet for the target application, the broadband remote access server converts the source address of the first packet from the first private network address to the target address and then sends it to the first forwarding device.

[0093] In the embodiment of the present application, after receiving the first packet of the first user, the broadband remote access server can identify whether the first packet is a packet for the target application. If the first packet is a packet for the target application, the broadband remote access server can convert the source address of the first packet from the first private network address to the target address, and send the first packet after the address conversion to the first forwarding device. That is, the broadband remote access server can perform network address translation on the first packet and then forward it to the first forwarding device, so that the first forwarding device can continue to forward the first packet.

[0094] Among them, the target application can be an application that needs to be traffic-forwarded by the first forwarding device. For example, the first forwarding device can be an acceleration router, and the target application can be an application with an acceleration service deployed, that is, the target application can be an acceleration application.

[0095] Step 102: The broadband remote access server reports the traceability information of the first user to the authentication server, and the traceability information includes the target address corresponding to the first private network address, as well as the first public network address and the first port range corresponding to the first private network address.

[0096] Among them, the target address is different from the first public network address, that is, in the traceability information of the first user, the first private network address corresponds to two different IP addresses. In the embodiment of the present application, the target address can be a private network address or a public network address. The first public network address and the first port range can be used for the broadband remote access server to perform network address translation on other packets of the first user (that is, packets that do not belong to the target application).

[0097] Optionally, the broadband remote access server can report the first information and the second information to the authentication server respectively. Among them, the first information can include the first public network address and the first port range corresponding to the first private network address. The second information can include the target address corresponding to the first private network address. For example, both the first message and the second message can be RADIUS messages.

[0098] In summary, the embodiment of the present application provides an address conversion method. Based on the first packet of the first user being a packet for a target application, the source address of the first packet is converted from a first private network address to a target address and then sent to a first forwarding device. Moreover, the traceability information of the first user not only includes the target address corresponding to the first private network address, but also includes the first public network address and the first port range corresponding to the first private network address. Since there are two different addresses corresponding to the first private network address in the traceability information of the first user, when performing network address conversion on the packets of the first user, the source address of the packet can be converted from the first private network address to different network addresses based on the type of the application to which the packet belongs, thereby effectively improving the flexibility of address conversion.

[0099] Among them, for the scenario where the target address is a private network address, the target address can only represent the first user, thereby ensuring that the first forwarding device can perform network address conversion on the first packet in a static mapping manner. Moreover, when tracing the first user, tracing can be performed through the traceability information stored in the authentication server and the static mapping algorithm in the first forwarding device. For the scenario where the target address is a public network address, since the broadband remote access server has already converted the source address of the first packet into a public network address in an independent public network address pool, the first forwarding device does not need to perform network address conversion on the first packet anymore. Moreover, when tracing the first user, tracing can be directly performed through the traceability information stored in the authentication server. Neither of the above two scenarios requires the deployment of a syslog server, thereby effectively simplifying the system structure, reducing the system cost, and avoiding increasing the burden of the space and power consumption of the operation computer room.

[0100] The following takes the target address being a private network address as an example to introduce the address conversion method provided by the embodiment of the present application. As Figure 6 shown, the method includes:

[0101] Step 201: After the first user goes online, the broadband remote access server reports a charging start packet to the authentication server.

[0102] Reference Figure 7, after detecting that the first user goes online, the broadband remote access server can first authenticate the first user through an authentication server (such as an AAA server). After determining that the first user passes the authentication, the broadband remote access server can allocate a first private network address for the first user from a pre-configured first private network address pool, and can allocate a first public network address for the first user from a pre-configured first public network address pool, as well as a corresponding first port range. After that, the broadband remote access server can report an accounting start message to the authentication server, and the accounting start message includes the first public network address corresponding to the first private network address and the first port range. It can be understood that the accounting start message may also include the first private network address.

[0103] It can also be understood that the first private network address pool can be a general private network address pool, and the first public network address pool can be a public network address pool used for network address translation of traffic for non-target applications, that is, a public network address pool for non-accelerated traffic.

[0104] For example, assume that the first private network address pool configured on the broadband remote access server is 172.0.0.0 / 15, and the first public network address pool is 10.0.0.0 / 19. After the first user goes online, the broadband remote access server can allocate the first private network address 172.0.0.1 for the first user from the first private network address pool, and allocate the first public network address 10.0.0.1 and the first port range 1024 - 5055 for the first user from the first public network address pool.

[0105] And, as Figure 7 shown, the broadband remote access server can report an accounting request message to the authentication server. This accounting request message belongs to the start type, so it can also be called an accounting start message. The accounting start message includes the following type length value (TLV) fields: NAT IP Address (NAT-IP-Address) field, NAT Start Port (NAT-Start-Port) field, and NAT End Port (NAT-End-Port) field. The NAT IP Address field carries the first public network address 10.0.0.1, the NAT Start Port field carries the start port 1024 of the first port range, and the NAT End Port field carries the end port 5055 of the first port range.

[0106] Step 202: Based on the first message of the first user received by the broadband remote access server being a message for a target application, the broadband remote access server converts the source address of the first message from the first private network address to a target address in the second private network address pool.

[0107] After receiving the first packet of the first user, the broadband remote access server can first detect whether the first packet is a packet of a target application. Among them, the target application can be an application that needs to be traffic-forwarded by the first forwarding device, for example, it can be an application that deploys an acceleration service. If the broadband remote access server determines that the first packet is a packet of the target application, it can convert the source address of the first packet from the first private network address to the target address in the second private network address pool, that is, the target address is a private network address. Among them, the second private network address pool can be a private network address pool configured in the broadband remote access server and dedicated to performing network address translation on the traffic of the target application (such as acceleration traffic). It can be seen from this that the second private network address pool is different from the first private network address pool. For example, the second private network address pool can be 172.100.0.0 / 18.

[0108] In the embodiment of the present application, when the broadband remote access server performs network address translation on the first packet, it can only translate the source address of the first packet without translating the source port of the first packet. That is to say, the broadband remote access server can perform NAT processing on the first packet in a non-port address translation (no port address translation, no-PAT) manner.

[0109] As a possible example, as Figure 4 shown, an SA service board is deployed in the broadband remote access server, and the broadband remote access server can determine that the first packet of the first user is a packet of the target application through the SA service board.

[0110] As another possible example, an SA service board may not be deployed in the broadband remote access server, and the broadband remote access server can determine that the first packet of the first user is a packet of the target application through an ACL.

[0111] For example, refer to Figure 8, multiple line processing units (LPUs) and multiple versatile service units (VSUs) can be deployed in a broadband remote access server. Among them, the LPU is also called an interface board, and the VSU can be used as an SA service board or a NAT service board. Suppose the destination address of the first packet received by the LPU is 201.1.1.1, the source address is 172.0.0.1, the destination port is 80, and the source port is 50001. After the SA service board identifies the first packet (for example, through seven-layer parsing), and determines that the first packet is a packet of the target application, it can add a tag to the first packet, and this tag is used to indicate that the first packet is a packet of the target application. For example, the SA can encapsulate a packet header outside the first packet and add a tag in the packet header. Then, the SA service board can divert the first packet to the NAT service board. The NAT service board can then convert the source address of the first packet from 172.0.0.1 to the target address 172.100.0.1 in the second private network address pool 172.100.0.0 / 18 based on the tag in the first packet. From Figure 8 It can be seen that after the NAT service board performs NAT processing on the first packet, the source port of the first packet remains unchanged.

[0112] Step 203: The broadband remote access server sends the first packet after network address translation to the first forwarding device.

[0113] After the broadband remote access server completes the network address translation of the first packet, it can send the first packet after network address translation to the first forwarding device. By way of example, refer to Figure 8 , the NAT service board in the broadband remote access server can forward the first packet after network address translation to the LPU, and the LPU can then forward the first packet to the first forwarding device, such as a acceleration router, so that the acceleration router can forward the first packet through an acceleration path.

[0114] It can be understood that before sending the first packet to the first forwarding device, the LPU can also remove the packet header encapsulated outside the first packet by the SA service board to avoid affecting the normal forwarding of the first packet.

[0115] Step 204: The broadband remote access server reports a charging update packet to the authentication server based on the fact that the received first packet is a packet of the target application.

[0116] Since the broadband remote access server can convert the source address of the first packet to the target address and then forward it after determining that the first packet is a packet of the target application, in order to facilitate tracing the first user, the broadband remote access server also needs to report a charging update packet to the authentication server. The charging update packet includes the target address corresponding to the first private network address.

[0117] For example, Figure 7 as shown, the broadband remote access server can report a charging request packet to the authentication server, and the charging request packet belongs to the interim update type, so it can also be called a charging update packet.

[0118] Optionally, the charging update packet may include a newly added TLV field: NAT-Ext-IP-Address field, and the NAT-Ext-IP-Address field can carry the target address 172.100.0.1.

[0119] Alternatively, the charging update packet can reuse the existing fields to update and report the target address, as well as the first public network address and the first port range. For example, referring to Figure 7 , the charging update packet may include two NAT IP address fields, which respectively carry the first public network address 10.0.0.1 and the target address 172.100.0.1. And, the charging update packet also includes a NAT start port field and a NAT end port field for carrying the first port range.

[0120] It can be understood that the broadband remote access server can report the charging update packet of the first user to the authentication server after receiving the first packet of the target application sent by the first user.

[0121] It can also be understood that the above charging start packet and charging update packet can also be collectively referred to as RADIUS messages, RADIUS interface messages or RADIUS packets. After receiving the RADIUS message, the authentication server can save the NAT log information of the first user.

[0122] Step 205: The first forwarding device performs network address translation on the first packet and then forwards it.

[0123] In the embodiment of the present application, the first forwarding device can perform network address translation on the received first packet in the way of NAT static mapping, and forward the first packet after the network address translation. For example, referring to Figure 1, assuming that the first forwarding device is an acceleration router, the acceleration router can forward the first packet to the acceleration access point, so that the acceleration access point can send the first packet to the destination device through the acceleration channel.

[0124] It can be understood that in the NAT static mapping algorithm configured in the first forwarding device, the internal network IP segment is the second private network address pool (for example, 172.100.0.0 / 18), and the public network IP segment can be the third public network address pool, for example, 20.0.0.0 / 24.

[0125] It can also be understood that the NAT static mapping method adopted by the first forwarding device can be the PAT method, that is, when performing network address translation, both the source address and the source port are translated. For example, the first forwarding device can translate the source address of the first packet from the first private network address to the public network address in the third public network address pool, and translate the source port of the first packet to the port in the fourth port range.

[0126] In the embodiment of the present application, in order to ensure that the return traffic of the destination device can also be forwarded through the first forwarding device, the first forwarding device also needs to publish the route of the third public network address pool (for example, 20.0.0.0 / 24). For example, the first forwarding device can publish the user network route (UNR) of the third public network address pool to the acceleration access point, and the acceleration access point then publishes the UNR route to the acceleration channel.

[0127] Step 206, the broadband remote access server performs network address translation on the second packet based on the fact that the second packet received from the first user is not a packet of the target application.

[0128] If the broadband remote access server receives the second packet of the first user, it can also first detect whether the second packet is a packet of the target application, for example, detect whether the second packet belongs to the accelerated traffic. This detection method can refer to the relevant description in step 202 above and will not be elaborated here. If the broadband remote access server determines that the second packet is not a packet of the target application, it can perform network address translation on the second packet. This network address translation can include: translating the source address of the second packet from the first private network address to the first public network address, and translating the source port of the second packet to the port in the first port range. That is, the broadband remote access server can perform NAT processing on the second packet using the PAT method.

[0129] Exemplarily, continue to refer to Figure 8, assume that the destination address of the second message received by the LPU is 201.1.1.1, the source address is 172.0.0.1, the destination port is 80, and the source port is 50001. After the SA service board identifies the second message, if it determines that the second message is not a message for the target application, it can directly divert the second message to the NAT service board. The NAT service board can then convert the source address of the second message from the first private network address 172.0.0.1 to the first public network address 10.0.0.1, and convert the source port of the second message from 50001 to the port 1025 in the first port range.

[0130] Step 207: The broadband remote access server sends the second message after network address translation to the second forwarding device.

[0131] After the broadband remote access server completes the network address translation of the second message, it can send the second message after the network address translation to the second forwarding device. Among them, the second forwarding device can be a device for forwarding traffic of non-target applications. For example, the second forwarding device can be a backbone network router for forwarding ordinary traffic (i.e., non-accelerated traffic).

[0132] Exemplarily, refer to Figure 8 , the NAT service board in the broadband remote access server can forward the second message after NAT processing to the LPU, and the LPU can then forward the second message to the backbone network router so that the backbone network router can forward the second message through an ordinary path (such as the Internet).

[0133] Optionally, as Figure 8 shown, the messages of the target application (such as the first message) and the messages of non-target applications (such as the second message) can be forwarded by different LPUs in the broadband remote access server, or can also be forwarded by the same LPU. The embodiments of the present application do not limit this.

[0134] Step 208: The broadband remote access server performs network address translation on the third message based on the fact that the third message received from the second user is not a message for the target application.

[0135] If the broadband remote access server receives the third message from the second user, it can also first detect whether the third message is a message for the target application, for example, detect whether the third message belongs to accelerated traffic. This detection method can refer to the relevant description in step 202 above and will not be elaborated here. If the broadband remote access server determines that the third message is not a message for the target application, it can perform network address translation on the third message. The network address translation can include: converting the source address of the third message from the second private network address to the second public network address, and converting the source port of the third message to the port in the third port range.

[0136] Among them, the second private network address can be allocated by the broadband remote access server from the first private network address pool for the second user after the second user goes online. The second public network address and the third port range can be allocated by the broadband remote access server from the first public network address pool for the second user after the second user goes online.

[0137] Step 209: The broadband remote access server sends the third packet after network address translation to the second forwarding device.

[0138] After the broadband remote access server completes the network address translation of the third packet, it can send the third packet after network address translation to the second forwarding device. The implementation process of this step 209 can refer to the relevant description of the above step 207 and will not be elaborated here.

[0139] Based on the above steps 201 to 209, it can be seen that after the user goes online, the broadband remote access server can first allocate a private network address for the user from the first private network address pool, and allocate a public network address and a port range for the user from the first public network address pool. For the normal traffic of the user, the broadband remote access server can perform NAT processing in the PAT manner on the normal traffic according to the allocated public network address and port range, and then forward it to the second forwarding device. For the traffic of the target application, the broadband remote access server can perform NAT processing in the no-PAT manner on the traffic of the target application by using the second private network address pool, and then forward it to the first forwarding device.

[0140] Optionally, for the packet of the target application sent by any user, the broadband remote access server can perform network address translation on the packet by using the method shown in the above step 202, that is, perform network address translation on the packet by using the second private network address pool. Or, the broadband remote access server can also perform network address translation on the packet of the target application sent only by the target user by using the method shown in the above step 202. Among them, the target user can be a user who has applied for the service of the target application (such as an acceleration service). For the packets of the target application sent by other users and the non-target application packets sent by the target user, network address translation can be performed by using the method shown in the above step 206 or step 208.

[0141] It can be understood that the sequence of steps of the address translation method provided by the embodiments of the present application can be appropriately adjusted, and the steps can also be increased or decreased accordingly according to the situation. For example, the above step 204 can be executed before step 203; or, steps 206 and 207 can be deleted according to the situation; or, steps 208 and 209 can be deleted according to the situation.

[0142] In summary, the address conversion method provided by the embodiments of the present application can use the first packet of the first user as the packet of the target application, convert the source address of the first packet from the first private network address to the target address in the second private network address pool, and then send it to the first forwarding device. Moreover, the traceability information of the first user not only includes the target address corresponding to the first private network address, but also includes the first public network address and the first port range corresponding to the first private network address. Since the target address can only represent the first user, it can be ensured that the first forwarding device can perform network address conversion on the first packet in a static mapping manner. Correspondingly, when tracing the first user, tracing can be performed through the traceability information stored in the authentication server and the static mapping algorithm in the first forwarding device. Since there is no need to deploy a syslog server, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation computer room can be avoided.

[0143] Moreover, since the source address of the packet of the target application can be converted to an independent second private network address pool, it can be ensured that the source addresses of the packets of the target application received by the first forwarding device are continuously distributed. Thus, the public network address resources required for static mapping on the first forwarding device can be saved, and the waste of public network address resources can be avoided.

[0144] The following uses the target address as the public network address as an example to introduce the address conversion method provided by the embodiments of the present application. As Figure 9 shown, the method includes:

[0145] Step 301: After the first user logs on, the broadband remote access server reports a charging start packet to the authentication server.

[0146] Refer to Figure 10 , after detecting that the first user logs on, the broadband remote access server can first authenticate the first user through an authentication server (such as an AAA server). After determining that the first user authentication is passed, the broadband remote access server can allocate a first private network address for the first user from a pre-configured first private network address pool, and can allocate a first public network address for the first user from a pre-configured first public network address pool, as well as the corresponding first port range. Then, the broadband remote access server can report a charging start packet to the authentication server, and the charging start packet includes the first public network address and the first port range corresponding to the first private network address. It can be understood that the charging start packet may also include the first private network address.

[0147] It can also be understood that the first private network address pool can be a general private network address pool, and the first public network address pool can be an address pool used for network address conversion of non-target application traffic, that is, a non-accelerated traffic public network address pool.

[0148] For example, assume that the first private network address pool configured on the broadband remote access server is 172.0.0.0 / 15, and the first public network address pool is 10.0.0.0 / 19. After the first user goes online, the broadband remote access server can allocate the first private network address 172.0.0.1 to the first user, as well as the corresponding first public network address 10.0.0.1 and the first port range 1024 to 5055. As Figure 10 shown, in the charging start report sent by the broadband remote access server to the authentication server, the NAT IP address field carries the first public network address 10.0.0.1, the NAT start port field carries the start port 1024 of the first port range, and the NAT end port field carries the end port 5055 of the first port range.

[0149] Step 302: The broadband remote access server publishes the route of the second public network address pool to the first forwarding device.

[0150] In the embodiment of the present application, a second public network address pool is also configured in the broadband remote access server. This second public network address pool can be a public network address pool dedicated to performing network address translation on the traffic of the target application (such as acceleration traffic). It can be seen from this that the second public network address pool is different from the first public network address pool. For example, the second public network address pool can be 20.0.0.0 / 24.

[0151] It can be understood that after the broadband remote access server performs network address translation on the traffic of the target application using the second public network address pool, it will be forwarded to the first forwarding device, and the first forwarding device does not need to perform network address translation on the received traffic of the target application, that is, no NAT processing is required. Therefore, the broadband remote access server also needs to publish the route of the second public network address pool to the first forwarding device, so that the first forwarding device can publish the route of the second public network address pool.

[0152] Step 303: The first forwarding device publishes the route of the second public network address pool.

[0153] After receiving the route of the second public network address pool published by the broadband remote access server, the first forwarding device can continue to publish the route of the second public network address pool, so that the return traffic of the target application can also be forwarded through the first forwarding device.

[0154] For example, assume that a VPN tunnel is established between the broadband remote access server and the first forwarding device. Then the broadband remote access server can introduce the route of the second public network address pool (i.e., the NAT public network route) into the VPN tunnel. The first forwarding device can then cross-introduce the VPN route into the public network and publish it to the destination device (such as an overseas server).

[0155] Step 304: The broadband remote access server converts the source address of the first packet from the first private network address to the target address in the second public network address pool based on the fact that the first packet received from the first user is a packet for the target application.

[0156] After the broadband remote access server receives the first packet from the first user, it can first detect whether the first packet is a packet for the target application. For example, it detects whether the first packet belongs to the accelerated traffic. If it is determined that the first packet is a packet for the target application, the source address of the first packet can be converted from the first private network address to the target address in the second public network address pool.

[0157] Optionally, the broadband remote access server can also convert the source port of the first packet to a port within the second port range. That is, the broadband remote access server can perform NAT processing on the first packet in the PAT manner.

[0158] As a possible example, as Figure 4 shown, an SA service board is deployed in the broadband remote access server, and the broadband remote access server can determine that the first packet received from the first user is a packet for the target application through this SA service board.

[0159] As another possible example, an SA service board may not be deployed in the broadband remote access server, and the broadband remote access server can determine that the first packet received from the first user is a packet for the target application through the ACL.

[0160] Step 305: The broadband remote access server sends the first packet after network address conversion to the first forwarding device.

[0161] After the broadband remote access server completes the network address conversion of the first packet, it can send the first packet after the network address conversion to the first forwarding device. The implementation process of this step 305 can refer to the relevant description of the above step 203, and will not be elaborated here.

[0162] Step 306: The broadband remote access server reports a charging update packet to the authentication server based on the fact that the first packet received is a packet for the target application.

[0163] Since the broadband remote access server can convert the source address of the first packet to the target address in the second public network address pool and then forward it after determining that the first packet is a packet for the target application, in order to facilitate tracing the first user, the broadband remote access server also needs to report a charging update packet to the authentication server. The charging update packet includes the target address corresponding to the first private network address. And if the broadband remote access server also converts the source port of the first packet based on the second port range, the charging update packet may also include the second port range.

[0164] For example Figure 10 As shown, the charging update message reported by the broadband remote access server to the authentication server may include newly added TLV fields: NAT newly added IP address (Nat-Ext-IP-Address) field, NAT newly added start port (Nat-Ext-Start-Port) field, and NAT newly added end port (Nat-Ext-End-Port) field. Among them, the NAT newly added IP address field may carry the destination address 20.0.0.1, the NAT newly added start port field may carry the start port 1024 of the second port range, and the NAT newly added end port field may carry the end port 2047 of the second port range.

[0165] Alternatively, the charging update message may reuse existing fields to update and report the destination address, the second port range, and the first public network address and the first port range. For example, referring to Figure 10 , the charging update message may include two NAT IP address fields, and the two NAT IP address fields respectively carry the first public network address 10.0.0.1 and the destination address 20.0.0.1. Moreover, the charging update message also includes two NAT start port fields and two NAT end port fields to respectively carry the first port range and the second port range.

[0166] It can be understood that after receiving the message of the first target application sent by the first user, the broadband remote access server may report the charging update message of the first user to the authentication server.

[0167] It can also be understood that the above-mentioned charging start message and charging update message may also be collectively referred to as RADIUS message, RADIUS interface message or RADIUS packet. After receiving the RADIUS message, the authentication server can save the NAT log information of the first user.

[0168] Step 307, the first forwarding device forwards the first packet.

[0169] After receiving the first packet, the first forwarding device may directly forward the first packet. For example, it may forward the first packet to the acceleration access point. Moreover, the first forwarding device does not need to perform network address translation on the first packet. Correspondingly, the source address of the first packet forwarded by the first forwarding device is still the destination address.

[0170] Step 308, based on the fact that the second packet of the first user received is not a packet of the target application, the broadband remote access server performs network address translation on the second packet.

[0171] If the broadband remote access server receives a second message from the first user, it can also first detect whether the second message is a message of the target application, for example, detect whether the second message belongs to accelerated traffic. This detection method can refer to the relevant descriptions in steps 202 and 304 above, which will not be elaborated here. If the broadband remote access server determines that the second message is not a message of the target application, it can perform network address translation on the second message. This network address translation can include: converting the source address of the second message from the first private network address to the first public network address, and converting the source port of the second message to a port within the first port range. That is, the broadband remote access server can perform NAT processing on the second message using the PAT method.

[0172] Step 309: The broadband remote access server sends the second message after network address translation to the second forwarding device.

[0173] The second forwarding device can be a device for forwarding messages of non-target applications. For example, the second forwarding device can be a backbone network router for forwarding ordinary traffic (i.e., non-accelerated traffic).

[0174] Step 310: Based on the fact that the third message from the second user is not a message of the target application, the broadband remote access server performs network address translation on the third message.

[0175] If the broadband remote access server receives a third message from the second user, it can also first detect whether the third message is a message of the target application, for example, detect whether the third message belongs to accelerated traffic. This detection method can refer to the relevant descriptions in steps 202 and 304 above, which will not be elaborated here. If the broadband remote access server determines that the third message is not a message of the target application, it can perform network address translation on the third message. This network address translation can include: converting the source address of the third message from the second private network address to the second public network address, and converting the source port of the third message to a port within the third port range.

[0176] Among them, the second private network address can be assigned by the broadband remote access server from the first private network address pool for the second user after the second user logs on. The second public network address and the third port range can be assigned by the broadband remote access server from the first public network address pool for the second user after the second user logs on.

[0177] Step 311: The broadband remote access server sends the third message after network address translation to the second forwarding device.

[0178] After the broadband remote access server completes the NAT processing of the third packet, it can send the third packet after NAT processing to the second forwarding device. The implementation processes of the above steps 308 to 311 can refer to the relevant descriptions of steps 206 to 209, which will not be elaborated here.

[0179] Based on the above steps 301 to 311, it can be seen that after the user goes online, the broadband remote access server can first allocate a private network address for the user from the first private network address pool, and allocate a public network address and port range for the user from the first public network address pool. For the ordinary traffic of the user, the broadband remote access server can perform NAT processing on the ordinary traffic in the PAT manner according to the allocated public network address and port range, and forward it to the second forwarding device. For the traffic of the target application, the broadband remote access server can re-allocate a public network address and port range from the second public network address pool, and perform NAT processing on the traffic of the target application in the PAT manner using the re-allocated public network address and port range, and then forward it to the first forwarding device.

[0180] Based on the above steps 301 to 311, it can also be seen that for the scenario where the target address is the target address in the second public network address pool, since the first forwarding device does not need to perform network address conversion on the received packets of the target application, there is no need to deploy a NAT device on the first forwarding device.

[0181] Optionally, for the packets of the target application sent by any user, the broadband remote access server can perform network address conversion on the packets using the method shown in step 304 above, that is, perform network address conversion on the packets using the second public network address pool. Or, the broadband remote access server can also perform network address conversion on the packets of the target application sent only by the target user using the method shown in step 304 above. Among them, the target user can be a user who has applied for the service of the target application (such as an acceleration service). For the packets of the target application sent by other users and the non-target application packets sent by the target user, network address conversion can be performed using the method shown in step 308 or step 310 above.

[0182] It can be understood that the order of the steps of the address conversion method provided in the embodiments of the present application can be appropriately adjusted, and the steps can also be increased or decreased accordingly according to the situation. For example, the above step 302 can be executed before step 301; or, step 306 can be executed before step 305; or, steps 308 and 309 can be deleted according to the situation; or, steps 310 and 311 can be deleted according to the situation.

[0183] In summary, in the address conversion method provided by the embodiment of the present application, when the broadband remote access server determines that the first packet sent by the first user is a packet for the target application, the broadband remote access server can convert the source address of the first packet from the first private network address to the target address in the second public network address pool and then send it to the first forwarding device. Moreover, the traceability information of the first user not only includes the target address corresponding to the first private network address, but also includes the first public network address and the first port range corresponding to the first private network address. Since the broadband remote access server has already converted the source address of the first packet into a public network address, the first forwarding device does not need to perform network address conversion on the first packet anymore. And when tracing the first user, it can directly trace through the traceability information stored in the authentication server. The above solution does not need to deploy a syslog server anymore, thus effectively simplifying the system structure, reducing the system cost, and avoiding increasing the burden of the space and power consumption of the operation computer room.

[0184] Table 1 shows Figure 6 and Figure 9 the differences between the method embodiments shown. Referring to Table 1, it can be seen that for the scenario where the target address is a private network address in the second private network address pool, the traffic of the target application needs to go through two NAT processes, and when tracing the user information, two methods, namely static tracing and RADIUS tracing, need to be combined for tracing. For the scenario where the target address is a public network address in the second public network address pool, the traffic of the target application only needs to be subjected to one NAT process by the broadband remote access server, and when tracing the user information, only the RADIUS tracing method needs to be used for tracing.

[0185] Table 1

[0186]

[0187] Figure 11 is a flowchart of another address conversion method provided by the embodiment of the present application. This method can be applied to an address forwarding device. Optionally, the address forwarding device can be, for example, Figure 4 the broadband remote access server (BRAS) in the system shown in Figure 11 . Taking the address forwarding device as the broadband remote access server as an example, as shown in

[0188] Step 401: When it is determined that the first packet sent by the first user is a packet for the target application, send the first packet to the first forwarding device for the first forwarding device to perform network address conversion on the first packet.

[0189] In an embodiment of the present application, after receiving a first packet from a first user, the broadband remote access server can identify whether the first packet is a packet of a target application. If the first packet is a packet of the target application, the broadband remote access server can directly send the first packet to a first forwarding device. That is, the broadband remote access server does not need to perform network address translation on the first packet, that is, it does not need to perform NAT processing on the first packet.

[0190] Among them, the source address of the first packet is a first private network address. The first forwarding device can perform network address translation on the received first packet. The target application can be an application that requires traffic forwarding by the first forwarding device. For example, the first forwarding device can be an acceleration router, and the target application can be an application deployed with an acceleration service, that is, the target application can be an acceleration application.

[0191] Optionally, the first user can be a user who has applied for the service of the target application (such as an acceleration service), and the first user can also be called a subscribed user.

[0192] Step 402: Based on the fact that the second packet sent by the first user is not a packet of the target application, perform network address translation on the second packet and then send it to a second forwarding device.

[0193] If the broadband remote access server determines that the second packet sent by the first user is not a packet of the target application, it can first perform network address translation (i.e., NAT processing) on the second packet, and then send it to the second forwarding device. Among them, the source address of the second packet is also the first private network address. For example, the broadband remote access server can convert the source address of the second packet from the first private network address to a first public network address, and convert the source port of the second packet to a port within the range of the first public network ports.

[0194] In summary, the embodiment of the present application provides an address translation method, which can directly send the first packet of the target application to the first forwarding device, that is, does not perform network address translation on the first packet of the target application. And this method can perform network address translation on the second packet that is not the target application and then send it to the second forwarding device. Since the method provided by the embodiment of the present application can distinguish applications for packets to perform network address translation or not, the flexibility of address translation is effectively improved.

[0195] Moreover, since the network address translation is not performed on the first packet of the target application, the source address of the first packet can only represent the first user. Thus, it can be ensured that the first forwarding device can perform network address translation on the first packet in a static mapping manner. Correspondingly, when tracing back to the first user, the static mapping algorithm in the first forwarding device can be directly used for tracing back, without the need to separately deploy a syslog server. Thereby, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation computer room can be avoided.

[0196] Figure 12 is a flowchart of another address translation method provided by an embodiment of the present application. This method can be applied to a system such as Figure 4 shown. As Figure 12 shown, this method includes:

[0197] Step 501: After the first user goes online, the broadband remote access server allocates a first private network address for the first user from the first private network address pool.

[0198] In an embodiment of the present application, the broadband remote access server is configured with a first private network address pool, which can be a dedicated address pool for allocating private network addresses to target users. Herein, the target user can refer to a user who has applied for the service of the target application. After the first user goes online, if the broadband remote access server determines that the first user is a target user, it can allocate a first private network address for the first user from the first private network address pool.

[0199] It can be understood that the target application can be an application that requires traffic forwarding by the first forwarding device. For example, the first forwarding device can be an acceleration router, and the target application can be an application deployed with an acceleration service, that is, the target application can be an acceleration application. Correspondingly, the target user can refer to a user who has applied (or subscribed) to the acceleration service of the target application, and this target user can also be called a subscribed user.

[0200] It can also be understood that the broadband remote access server can also be configured with a first public network address pool, which can be used for address translation of traffic of non-target applications. After the first user goes online, the broadband remote access server can also allocate a first public network address and a first port range for the first user from the first public network address pool. Moreover, the broadband remote access server can also report the tracing information of the first user (for example, it can be reported through a charging start packet) to the authentication server, and the tracing information includes the first private network address, as well as the first public network address and the first port range corresponding to the first private network address.

[0201] Exemplarily, assume that the first private network address pool is 172.100.0.0 / 18, and the first public network address pool is 10.0.0.0 / 19. Then, the first private network address assigned by the broadband remote access server to the first user can be 172.100.0.1, the first public network address can be 10.0.0.1, and the first port range can be 1024 to 5055.

[0202] Step 502: After the second user goes online, the broadband remote access server assigns a second private network address to the second user from the second private network address pool.

[0203] The broadband remote access server is also configured with a second private network address pool, which is different from the first private network address pool. Moreover, the second private network address pool can be an address pool for assigning private network addresses to ordinary users, that is, the second private network address pool can be a general private network address pool. Herein, an ordinary user can refer to a user who has not applied for the service of the target application (such as an acceleration service), and this ordinary user can also be called a non-subscribed user. After the second user goes online, if the broadband remote access server determines that the second user is an ordinary user, it can assign a second private network address to the second user from the second private network address pool.

[0204] It can be understood that after the second user goes online, the broadband remote access server can also assign a second public network address and a second port range to the second user from the first public network address pool. Moreover, the broadband remote access server can also report the traceability information of the second user (such as reporting through a charging start message) to the authentication server. The traceability information includes the second private network address, as well as the second public network address and the second port range corresponding to the second private network address. Herein, the second public network address is different from the first public network address, and the second port range can be the same as or different from the first port range. The embodiments of the present application do not limit this.

[0205] Exemplarily, assume that the second private network address pool is 172.0.0.0 / 15, and the first public network address pool is 10.0.0.0 / 19. Then, the second private network address assigned by the broadband remote access server to the second user can be 172.0.0.1, the second public network address can be 10.0.0.2, and the second port range can be 1024 to 5055.

[0206] Step 503: Based on the fact that the first message sent by the first user is a message for the target application, the broadband remote access server sends the first message to the first forwarding device.

[0207] After receiving the first packet sent by the first user, the broadband remote access server can detect whether the first packet is a packet of a target application. For example, it can detect whether the first packet belongs to accelerated traffic. If it is determined that the first packet is a packet of a target application, the first packet can be directly sent to the first forwarding device without performing network address translation on the first packet. It can be understood that the source address of the first packet of the first user received by the broadband remote access server is the first private network address, and the source address of the first packet sent by it to the first forwarding device is also the first private network address.

[0208] As a possible example, as Figure 4 shown, an SA service board is deployed in the broadband remote access server, and the broadband remote access server can determine that the first packet of the first user is a packet of a target application through the SA service board.

[0209] As another possible example, an SA service board may not be deployed in the broadband remote access server, and the broadband remote access server can determine that the first packet of the first user is a packet of a target application through an ACL.

[0210] Step 504: The first forwarding device performs network address translation on the first packet and then forwards it.

[0211] In the embodiment of the present application, the first forwarding device can perform network address translation on the received first packet in the form of NAT static mapping and forward the first packet after the network address translation. For example, referring to Figure 1 , assuming that the first forwarding device is an acceleration router, the acceleration router can forward the first packet to an acceleration access point so that the acceleration access point can send the first packet to the destination device through an acceleration channel.

[0212] It can be understood that in the NAT static mapping algorithm configured in the first forwarding device, the internal network IP segment is the first private network address pool (for example, 172.100.0.0 / 18), and the public network IP segment can be the second public network address pool, for example, 20.0.0.0 / 24.

[0213] It can also be understood that the NAT static mapping method adopted by the first forwarding device can be the PAT method, that is, when performing network address translation, both the source address and the source port are translated. For example, the first forwarding device can translate the source address of the first packet from the first private network address to the public network address in the second public network address pool and translate the source port of the first packet to the port in the third port range.

[0214] In an embodiment of the present application, to ensure that the backhaul traffic of the destination device can also be forwarded by the first forwarding device, the first forwarding device also needs to publish the route of the second public network address pool (such as 20.0.0.0 / 24). For example, the first forwarding device can publish the UNR route of the second public network address pool to the acceleration access point, and the acceleration access point then publishes the UNR route to the acceleration channel.

[0215] Step 505: Based on the fact that the second packet sent by the first user is not a packet of the target application, the broadband remote access server performs network address translation on the second packet.

[0216] If the broadband remote access server receives the second packet of the first user, it can also first detect whether the second packet is a packet of the target application, such as detecting whether the second packet belongs to the accelerated traffic. This detection method can refer to the relevant description in step 503 above and will not be elaborated here. If the broadband remote access server determines that the second packet is not a packet of the target application, it can perform network address translation on the second packet.

[0217] Among them, the network address translation may include: converting the source address of the second packet from the first private network address to the first public network address, and converting the source port of the second packet to a port within the first port range. That is, the broadband remote access server can perform NAT processing on the second packet using the PAT method.

[0218] Step 506: The broadband remote access server sends the second packet after network address translation to the second forwarding device.

[0219] The second forwarding device can be a device for forwarding packets of non-target applications. For example, the second forwarding device can be a backbone network router for forwarding ordinary traffic (i.e., non-accelerated traffic).

[0220] Step 507: The broadband remote access server performs network address translation on the third packet sent by the second user.

[0221] If the broadband remote access server receives the third packet of the second user, since the second user has not applied for the service of the target application, the broadband remote access server does not need to determine whether the third packet is a packet of the target application, but can directly perform network address translation on the third packet. The network address translation may include: converting the source address of the third packet from the second private network address to the second public network address, and converting the source port of the third packet to a port within the second port range.

[0222] Step 508: The broadband remote access server sends the third packet after network address translation to the second forwarding device.

[0223] After the broadband remote access server completes the network address translation of the third message, it can send the third message after the network address translation to the second forwarding device.

[0224] Based on the above steps 501 to 508, it can be seen that the solution provided by the embodiment of the present application can fix the private network address of the target user in an independent private network address pool (i.e., the first private network address pool). For the traffic of the target application of the target user (such as acceleration traffic), the broadband remote access server does not perform NAT processing, but directly redirects it to the first forwarding device (such as redirecting to the VPN), and performs NAT processing on the first forwarding device. For ordinary users, there is no need to distinguish whether the message sent by the ordinary user is a message of the target application, and it can uniformly perform NAT processing in the PAT manner through the first public network address pool.

[0225] It can be understood that the order of the steps of the address translation method provided by the embodiment of the present application can be appropriately adjusted, and the steps can also be increased or decreased accordingly according to the situation. For example, the above step 502 can be executed before step 501; or, step 505 can be executed before step 503; or, steps 507 and 508 can be deleted according to the situation.

[0226] In summary, the embodiment of the present application provides an address translation method, which can directly send the first message of the target application to the first forwarding device, that is, does not perform network address translation on the first message of the target application. And this method can perform network address translation on the second message that is not the target application and then send it to the second forwarding device. Since the network address of the first message of the target application is not translated, the source address of this message can only represent the first user. Therefore, it can be ensured that the first forwarding device can perform network address translation on the first message in the form of static mapping. Correspondingly, when tracing back to the first user, it can directly trace back through the static mapping algorithm in the first forwarding device, without the need to deploy a syslog server separately. Therefore, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation computer room can be avoided.

[0227] And because the method provided by the embodiment of the present application can plan an independent first private network address pool for the users applying for the service of the target application, after directly sending the messages of this part of users to the first forwarding device, it can be ensured that the source addresses of the messages received by the first forwarding device are continuously distributed. Correspondingly, the public network address pool planned in the first forwarding device for performing network address translation only needs to cover the users applying for the acceleration service of the target application, so that the public network address resources of the first forwarding device can be effectively saved.

[0228] Table 2 shows Figure 12 andFigure 6 As for the differences between the illustrated embodiments, it can be seen from Table 2 that for Figure 6 the illustrated embodiment, the traffic of the target application needs to go through two NAT processes, and when tracing the user information, two methods of static tracing and RADIUS tracing need to be combined for tracing. For Figure 12 the illustrated embodiment, the traffic of the target application only needs to be subjected to one NAT process by the first forwarding device, and when tracing the user information, two methods of static tracing and RADIUS tracing need to be combined for tracing. Among them, static tracing can determine the internal network IP address (such as the converted target address or the first private network address of the first user), and then the user information can be finally determined through RADIUS tracing.

[0229] Moreover, in Figure 6 the illustrated embodiment, the broadband remote access server can convert the source address of the packet of the target application to a dedicated second private network address pool. Figure 12 In

[0230] Table 2

[0231]

[0232]

[0233] Figure 13 is a flowchart of another address conversion method provided by an embodiment of the present application. This method can be applied to a forwarding device. For example, it can be applied to the first forwarding device in a system such as Figure 4 the illustrated system. As shown in Figure 13 the following, this method includes:

[0234] Step 601: After performing a first static mapping conversion on the first packet of the first user sent by the broadband remote access server, forward it.

[0235] In an embodiment of the present application, this forwarding device can be a forwarding device for forwarding the traffic of the target application. For example, assuming that the target application is an application for deploying an acceleration service, then this forwarding device can be an acceleration router. Correspondingly, the packets received by this forwarding device from the broadband remote access server can all be packets of the target application.

[0236] A static mapping algorithm can be deployed in the forwarding device, which can perform static mapping conversion on the received packets through this static mapping algorithm. Moreover, this static mapping algorithm can map an internal network IP address in the internal network IP segment and a corresponding internal network port range to a public network IP address and a public network port range in the public network IP segment. That is, for the same internal network IP address and different internal network port ranges, this static mapping algorithm can map to the same public network IP and different public network port ranges. Among them, the internal network IP segment can be the first public network address pool deployed in the broadband remote access server for performing network address translation on the traffic of the target user, such as a carrier-grade NAT (CGN) address pool. The target user can be a user who has applied for the service of the target application (such as an acceleration service), and this target user can also be called a subscribed user.

[0237] For the first packet of the first user sent by the broadband remote access server, the forwarding device can perform the first static mapping conversion on the first packet and then forward it, for example, it can be forwarded to the acceleration access point. Among them, the first static mapping conversion can include: converting the source address of the first packet from the first internal network address to the first public network address, and converting the source port of the first packet from the first internal network port to the first public network port within the first public network port range.

[0238] Among them, the first internal network address can belong to the first public network address pool, and the first internal network port can belong to the first internal network port range. After the first user goes online, the broadband remote access server can allocate a first private network address for the first user, and based on the first user being the target user, allocate a public network address (i.e., the first internal network address) and a port range (i.e., the first internal network port range) for the first user from the first public network address pool. After receiving the first packet sent by the first user, the broadband remote access server can convert the source address of the first packet from the first private network address to the first internal network address, and convert the source port of the first packet to the first internal network port, and then send it to the forwarding device.

[0239] Step 602: Perform the second static mapping conversion on the second packet of the second user sent by the broadband remote access server and then forward it.

[0240] The second static mapping conversion includes: converting the source address of the second packet from the first internal network address to the first public network address, and converting the source port of the second packet from the second internal network port to the second public network port within the second public network port range. The second internal network port belongs to the second internal network port range.

[0241] It can be understood that after the second user logs on, the broadband remote access server can allocate a second private network address for the second user, and can allocate a public network address (i.e., the first internal network address) and a port range (i.e., the second internal network port range) for the second user from the first public network address pool with the second user as the target user. After receiving the second packet sent by the second user, the broadband remote access server can convert the source address of the second packet from the second private network address to the first internal network address, and convert the source port of the second packet to the second internal network port, and then send it to the forwarding device.

[0242] Combined with the above step 601, it can be seen that for different target users, the broadband remote access server can allocate different private network addresses, and can allocate public network addresses and port ranges from the first public network address pool. If the public network addresses of two target users are the same, due to the different port ranges, a public network address and a port range can indicate a target user. Since the static mapping algorithm deployed in the forwarding device can perform network address conversion based on the internal network address + port range, it can be ensured that the target user can be uniquely determined based on this static mapping algorithm, realizing static traceability of the target user.

[0243] It can also be understood that a second public network address pool can be configured in the broadband remote access server, and the second public network address pool can be used to allocate public network addresses and port ranges for non-target users. Moreover, after the broadband remote access server performs network address conversion on the packets of non-target users, it can forward them to the second forwarding device. It can be seen from this that the broadband remote access server can allocate public network addresses and port ranges for users from different public network address pools based on the type of user (i.e., target user or non-target user) after the user logs on. After receiving the packet of the user, it can directly perform network address conversion on the packet based on the allocated public network address and port range, without having to detect whether the packet is a packet of the target application. Correspondingly, an SA service board does not need to be deployed in the broadband remote access server.

[0244] Continue to refer to Figure 13 , the method may further include:

[0245] Step 603, based on the received traceability instruction for the first public network address and the first public network port range, determine the first internal network address and the first internal network port range corresponding to the first public network address and the first public network port range through the static mapping algorithm.

[0246] In an embodiment of the present application, if the forwarding device receives a tracing instruction for the first public network address and the first public network port range, it can determine the corresponding first private network address and the first private network port range through a static mapping algorithm. Since the first private network address and the first private network port range can represent the first user, accurate tracing of the first user can be achieved.

[0247] Step 604: Based on the received tracing instruction for the first public network address and the second public network port range, determine the corresponding first private network address and the second private network port range through a static mapping algorithm.

[0248] If the forwarding device receives a tracing instruction for the first public network address and the second public network port range, it can determine the corresponding first private network address and the second private network port range through a static mapping algorithm. Since the first private network address and the second private network port range can represent the second user, accurate tracing of the second user can be achieved.

[0249] Based on the above analysis, when tracing a public network address and a public network port range using a static mapping algorithm, a corresponding private network address and a private network port range can be determined. Based on this, even if the private network address represents multiple users, a user can be uniquely determined through the private network port range, thereby achieving accurate tracing of the user.

[0250] In summary, the embodiment of the present application provides an address conversion method. The forwarding device can perform network address conversion on the received packet using a static mapping algorithm. The static mapping algorithm can perform network address conversion based on the private network address and the private network port range. That is, for the same private network address, if the private network port ranges are different, they can be converted to the same public network address and different public network port ranges. Thus, it can be ensured that a user can be uniquely determined based on this static mapping algorithm, and static tracing of the user can be achieved. Since there is no need to deploy a syslog server separately, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation computer room can be avoided.

[0251] Figure 14 is a schematic structural diagram of an address conversion device provided by an embodiment of the present application. The address conversion device can be applied to a system such as Figure 4 shown in the figure. For example, the address conversion device can be a broadband remote access server and can implement the steps performed by the broadband remote access server in the above method embodiment. As Figure 14 shown in the figure, the address conversion device includes:

[0252] The conversion module 701 is used to convert the source address of the first message of the first user for the message of the target application from the first private network address to the target address. The implementation of the function of the conversion module 701 can refer to the relevant description of step 101 in the above method embodiment.

[0253] The sending module 702 is used to send the first message to the first forwarding device.

[0254] The sending module 702 is further used to report the traceability information of the first user to the authentication server. The traceability information includes the target address corresponding to the first private network address, the first public network address corresponding to the first private network address, and the first port range. Among them, the target address is different from the first public network address. The implementation of the function of the sending module 702 can refer to the relevant description of step 102 in the above method embodiment.

[0255] Optionally, the first private network address belongs to the first private network address pool; the conversion module 701 is used to convert the source address of the first message of the first user for the message of the target application from the first private network address to the target address in the second private network address pool. Among them, the second private network address pool is different from the first private network address pool. The implementation of the function of the conversion module 701 can also refer to the relevant description of step 202 in the above method embodiment.

[0256] Optionally, the first public network address belongs to the first public network address pool; the conversion module 701 is used to convert the source address of the first message of the first user for the message of the target application from the first private network address to the target address in the second public network address pool. Among them, the second public network address pool is different from the first public network address pool. The implementation of the function of the conversion module 701 can also refer to the relevant description of step 304 in the above method embodiment.

[0257] Optionally, the conversion module 701 can also be used to convert the source port of the first message to the port in the second port range.

[0258] Optionally, the sending module 702 is further used to publish the route of the second public network address pool to the first forwarding device for the first forwarding device to publish the route of the second public network address pool. The implementation of the function of the sending module 702 can also refer to the relevant descriptions of step 302 and step 303 in the above method embodiment.

[0259] Optionally, the sending module 702 can be used to: report the first information to the authentication server, the first information includes the first public network address and the first port range corresponding to the first private network address; and report the second information to the authentication server, the second information includes the target address corresponding to the first private network address.

[0260] Optionally, the sending module 702 may be configured to: after the first user goes online, report a charging start message to the authentication server, where the charging start message includes the first information; and, based on the received first message being a message for the target application, report a charging update message to the authentication server, where the charging update message includes the second information. The implementation of the functions of the sending module 702 may also refer to the relevant descriptions in steps 201 and 204, and steps 301 and 306 in the above method embodiments.

[0261] Optionally, the conversion module 701 may also be configured to: based on the received second message of the first user not being a message for the target application, convert the source address of the second message from the first private network address to the first public network address, and convert the source port of the second message to a port within the first port range. The implementation of the functions of the conversion module 701 may also refer to the relevant descriptions in steps 206 and 308 in the above method embodiments.

[0262] The sending module 702 may also be configured to send the second message after network address conversion to the second forwarding device. The implementation of the functions of the sending module 702 may also refer to the relevant descriptions in steps 207 and 309 in the above method embodiments.

[0263] Optionally, the conversion module 701 is further configured to: based on the received third message of the second user not being a message for the target application, convert the source address of the third message from the second private network address to the second public network address, and convert the source port of the third message to a port within the third port range. The first private network address and the second private network address belong to the same private network address pool, and the first public network address and the second public network address belong to the same public network address pool. The implementation of the functions of the conversion module 701 may also refer to the relevant descriptions in steps 208 and 310 in the above method embodiments.

[0264] The sending module 702 may also be configured to send the third message after network address conversion to the second forwarding device. The implementation of the functions of the sending module 702 may also refer to the relevant descriptions in steps 209 and 311 in the above method embodiments.

[0265] Optionally, the conversion module 701 may be configured to: determine that the first message of the first user is a message for the target application through a service awareness (SA) service board; or determine that the first message of the first user is a message for the target application through an access control list (ACL).

[0266] Optionally, the target application may be an application for deploying an acceleration service.

[0267] In summary, the embodiment of the present application provides an address conversion device. The device can use the first packet of the first user as a packet for a target application, convert the source address of the first packet from a first private network address to a target address, and then send it to a first forwarding device. Moreover, the traceability information of the first user not only includes the target address corresponding to the first private network address, but also includes the first public network address and the first port range corresponding to the first private network address. Since there are two different addresses corresponding to the first private network address in the traceability information of the first user, when performing network address conversion on the packets of the first user, the source address of the packet can be converted from the first private network address to different network addresses based on the type of the application to which the packet belongs, thereby effectively improving the flexibility of address conversion.

[0268] Among them, for the scenario where the target address is a private network address, the target address can only represent the first user, thereby ensuring that the first forwarding device can perform network address conversion on the first packet in a static mapping manner. Moreover, when tracing the first user, tracing can be performed through the traceability information stored in the authentication server and the static mapping algorithm in the first forwarding device. For the scenario where the target address is a public network address, since the address conversion device has already converted the source address of the first packet into a public network address in an independent public network address pool, the first forwarding device does not need to perform network address conversion on the first packet anymore. Moreover, when tracing the first user, tracing can be directly performed through the traceability information stored in the authentication server. Neither of the above two scenarios requires the deployment of a syslog server, thereby effectively simplifying the system structure, reducing the system cost, and avoiding increasing the burden of the space and power consumption of the operation computer room.

[0269] Figure 15 FIG. is a schematic structural diagram of another address conversion device provided by the embodiment of the present application. The address conversion device can be applied to a system such as Figure 4 shown in the figure. The address conversion device can be an authentication server and can implement the steps executed by the authentication server in the above method embodiment. As Figure 15 shown in the figure, the address conversion device includes:

[0270] A receiving module 801, configured to receive the traceability information of the first user, where the traceability information includes a target address corresponding to the first private network address of the first user, and a first public network address and a first port range corresponding to the first private network address. Among them, the target address is different from the first public network address. The implementation of the function of the receiving module 801 can refer to the relevant description of step 102 in the above method embodiment.

[0271] Optionally, the receiving module 801 may be configured to: receive a first piece of information, which includes a first public network address corresponding to a first private network address and a first port range; and receive a second piece of information, which includes a target address corresponding to the first private network address.

[0272] Optionally, the receiving module 801 may be configured to: receive a charging start message, which includes the first piece of information; and receive a charging update message, which includes the second piece of information. The implementation of the functions of the receiving module 801 may also refer to the relevant descriptions in steps 201 and 204, and steps 301 and 306 in the above method embodiments.

[0273] Optionally, the first private network address belongs to a first private network address pool, the target address belongs to a second private network address pool, and the second private network address pool is different from the first private network address pool. Alternatively, the first public network address belongs to a first public network address pool, the target address belongs to a second public network address pool, and the second public network address pool is different from the first public network address pool.

[0274] In summary, the embodiment of the present application provides an address conversion device. The traceability information of the first user received by this device not only includes the target address corresponding to the first private network address, but also includes the first public network address corresponding to the first private network address and the first port range. Since there are two different addresses corresponding to the first private network address in the traceability information of the first user, when performing network address conversion on the packets of the first user, the source address of the packets can be converted from the first private network address to different network addresses, thereby effectively improving the flexibility of address conversion.

[0275] Figure 16 FIG. is a schematic structural diagram of another address conversion device provided by the embodiment of the present application. This address conversion device may be applied to a system such as Figure 4 shown, and this address conversion device may be a broadband remote access server. As Figure 16 shown, this address conversion device includes:

[0276] A sending module 901, configured to, based on that the first packet sent by a first user is a packet for a target application, send the first packet to a first forwarding device for the first forwarding device to perform network address conversion on the first packet, where the source address of the first packet is a first private network address. The implementation of the functions of the sending module 901 may refer to the relevant descriptions in steps 401 and 503 in the above method embodiments.

[0277] The conversion module 902 is configured to perform network address conversion on the second message based on that the second message sent by the first user is not a message for the target application, and the source address of the second message after the network address conversion is different from the first private network address. The implementation of the function of the conversion module 902 may refer to the relevant descriptions of steps 402 and 505 in the above method embodiment.

[0278] The sending module 901 is further configured to send the second message after the network address conversion to the second forwarding device. The implementation of the function of the sending module 901 may also refer to the relevant description of step 506 in the above method embodiment.

[0279] Optionally, continue to refer to Figure 16 The address conversion device further includes an allocation module 903, and the allocation module 903 is configured to: after the first user goes online, allocate the first private network address for the first user from the first private network address pool; and after the second user goes online, allocate the second private network address for the second user from the second private network address pool.

[0280] Wherein, the first user is a user who applies for the acceleration service of the target application, the second user is a user who does not apply for the acceleration service of the target application, and the first private network address pool is different from the second private network address pool. The implementation of the function of the allocation module 903 may refer to the relevant descriptions of steps 501 and 502 in the above method embodiment.

[0281] Optionally, the conversion module 902 is further configured to perform network address conversion on the third message sent by the second user. The implementation of the function of the conversion module 902 may also refer to the relevant description of step 507 in the above method embodiment.

[0282] The sending module 901 is further configured to send the third message after the network address conversion to the second forwarding device. The implementation of the function of the sending module 901 may also refer to the relevant description of step 508 in the above method embodiment.

[0283] In summary, the embodiment of the present application provides an address conversion device. This device can directly send the first message of the target application to the first forwarding device, that is, it does not perform network address conversion on the first message of the target application. Moreover, this device can perform network address conversion on the second message that is not the target application and then send it to the second forwarding device. Since the first message of the target application is not subjected to network address conversion, the source address of this message can only represent the first user. Thus, it can be ensured that the first forwarding device can perform network address conversion on this first message in the way of static mapping. Correspondingly, when tracing back to the first user, it can be directly traced through the static mapping algorithm in the first forwarding device, without the need to separately deploy a syslog server. Therefore, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation computer room can be avoided.

[0284] Figure 17 FIG. 4 is a schematic structural diagram of another address conversion device provided by the embodiment of the present application. This address conversion device can be applied to a system such as Figure 4 shown in FIG. 4, and this address conversion device can be the first forwarding device. As Figure 17 shown in FIG. 4, this address conversion device includes:

[0285] A conversion module 1001, configured to perform a first static mapping conversion on the first message of the first user sent by the broadband remote access server, and to perform a second static mapping conversion on the second message of the second user sent by the broadband remote access server. The functional implementation of the conversion module 1001 can refer to the relevant descriptions of steps 601 and 602 in the above method embodiment.

[0286] A sending module 1002, configured to forward the first message and the second message after static mapping conversion.

[0287] Among them, the first static mapping conversion includes: converting the source address of the first message from a first private network address to a first public network address, and converting the source port of the first message from a first private network port to a first public network port within the range of the first public network port;

[0288] The second static mapping conversion includes: converting the source address of the second message from the first private network address to the first public network address, and converting the source port of the second message from a second private network port to a second public network port within the range of the second public network port;

[0289] The first private network port belongs to the first private network port range, and the second private network port belongs to the second private network port range.

[0290] Optionally, continuing to refer to Figure 17 , this address conversion device may further include:

[0291] A determination module 1003, configured to determine, based on a received traceability instruction for the first public network address and the first public network port range, the first private network address and the first private network port range corresponding to the first public network address and the first public network port range through a static mapping algorithm; and determine, based on a received traceability instruction for the first public network address and the second public network port range, the first private network address and the second private network port range corresponding to the first public network address and the second public network port range through a static mapping algorithm. The functional implementation of the determination module 1003 may refer to the relevant descriptions of steps 603 and 604 in the foregoing method embodiment.

[0292] In summary, the embodiment of the present application provides an address conversion device, which can perform network address conversion on the received packet by using a static mapping algorithm. The static mapping algorithm can perform network address conversion based on the private network address and the private network port range. That is, for the same private network address, if the private network port ranges are different, they can be converted to the same public network address and different public network port ranges. Therefore, it can be ensured that the user can be uniquely determined based on the static mapping algorithm, and static traceability of the user can be achieved. Since there is no need to deploy a syslog server separately, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation computer room can be avoided.

[0293] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the above-described address conversion device and each module can refer to the corresponding processes in the foregoing method embodiment, and will not be elaborated herein.

[0294] It should be understood that the address conversion device provided in the embodiment of the present application can be implemented by a specific application integrated circuit (ASIC) or a programmable logic device (PLD). The above PLD can be a complex programmable logic device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. In addition, the address conversion method provided in the foregoing method embodiment can also be implemented by software. When the address conversion method provided in the foregoing method embodiment is implemented by software, the address conversion device may include a software module for implementing the foregoing method.

[0295] Figure 18It is a schematic structural diagram of an address conversion device provided by an embodiment of the present application. The address conversion device can be applied to a system such as Figure 4 shown in the figure, and can be a broadband remote access server, an authentication server, or a first forwarding device in the system. Referring to Figure 18 , the address conversion device includes: a processor 1101, a memory 1102, a network interface 1103, and a bus 1104.

[0296] Among them, a computer program 11021 is stored in the memory 1102, and the computer program 11021 is used to implement various application functions. The processor 1101 is used to execute the computer program 11021 to implement the address conversion method provided by the above method embodiment. For example, the processor 1101 is used to execute the computer program 11021 to implement the functions of each module in the address conversion device shown in any one of the above Figures 14 to 17 figures.

[0297] The processor 1101 can be a central processing unit (CPU), and the processor 1101 can also be other general-purpose processors, digital signal processors (DSPs), ASICs, FPGAs, graphics processing units (GPUs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0298] The memory 1102 can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchlink dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).

[0299] There can be multiple network interfaces 1103, and the network interface 1103 is used to implement a communication connection (which can be wired or wireless) with other devices. Among them, in the embodiments of the present application, the network interface 1103 is used to send and receive packets. Among them, other devices can be devices such as terminals, servers, VMs, or other network devices.

[0300] The bus 1104 is used to connect the processor 1101, the memory 1102, and the network interface 1103. And, in addition to including a data bus, the bus 1104 can also include a power bus, a control bus, a status signal bus, etc. However, for the sake of clear illustration, all kinds of buses are labeled as the bus 1104 in the figure.

[0301] Among them, if the address conversion device is a broadband remote access server, the detailed processing procedure of the processor 1101 may refer to the steps executed by the broadband remote access server in the above method embodiments; if the address conversion device is an authentication server, the detailed processing procedure of the processor 1101 may refer to the steps executed by the authentication server in the above method embodiments; if the address conversion device is a first forwarding device, the detailed processing procedure of the processor 1101 may refer to the steps executed by the first forwarding device in the above method embodiments; details are not described herein again.

[0302] Figure 19 FIG. 4 is a schematic structural diagram of another address conversion device provided by an embodiment of the present application. The address conversion device may be applied to a system such as shown in FIG. 4, and may be a broadband remote access server, an authentication server, or a first forwarding device in the system. As Figure 19 shown, the address conversion device may include: a main control board 1201 and at least one interface board (the interface board is also referred to as a line card or a service board), for example Figure 19 the interface board 1202 and the interface board 1203 are shown in FIG. In the case of multiple interface boards, the address conversion device may further include a switching network board 1204, and the switching network board 1204 is used to complete data exchange between each interface board.

[0303] Among them, the main control board 1201 is also referred to as a main processing unit (MPU) or a route processor card. The main control board 1201 is used to complete functions such as system management, device maintenance, and protocol processing. There are mainly three types of functional units on the main control board 1201: a system management control unit, a system clock unit, and a system maintenance unit. The main control board 1201 includes: a central processor 12011 and a memory 12012.

[0304] The interface boards 1202 and 1203 are also referred to as line processing unit (LPU) cards, line cards, or service boards. The interface boards are used to provide various service interfaces and implement packet forwarding. Among them, the service interfaces provided by the interface boards may include: packet over SONET / SDH (POS) interfaces, gigabit Ethernet (GE) interfaces, asynchronous transfer mode (ATM) interfaces, etc. Among them, SONET refers to synchronous optical network, and SDH refers to synchronous digital hierarchy. The main control board 1201, the interface board 1202, and the interface board 1203 are connected to each other through the system bus and the system backplane to achieve intercommunication. As Figure 19 shown, the interface board 1202 includes one or more central processors 12021. The central processor 12021 is used to control and manage the interface board 1202 and communicate with the central processor 12011 on the main control board 1201. The memory 12024 on the interface board 1202 is used to store forwarding table entries, and the network processor 12022 can forward packets by looking up the forwarding table entries stored in the memory 12024. The memory 12024 can also be used to store program code.

[0305] The interface board 1202 further includes one or more physical interface cards 12023, which are used to receive packets sent by the previous-hop node and send the processed packets to the next-hop node according to the instructions of the central processor 12021.

[0306] In addition, it can be understood that Figure 19 the central processor 12021 and / or the network processor 12022 in the interface board 1202 can be dedicated hardware or chips. For example, ASIC can be used to implement the above functions, and this implementation method is usually referred to as the method of using dedicated hardware or chips for processing on the forwarding plane. In another embodiment, the central processor 12021 and / or the network processor 12022 can also use a general-purpose processor, such as a general-purpose CPU, to implement the functions described above.

[0307] In addition, it should be understood that there may be one or more main control boards 1201. When there are multiple main control boards, they may include a primary main control board and a standby main control board. There may be one or more interface boards. The stronger the data processing ability of this address conversion device, the more interface boards are provided. As Figure 19As shown in the figure, the address conversion device includes interface boards 1202 and 1203. When adopting a distributed forwarding mechanism, the structure of interface board 1203 is basically the same as that of interface board 1202, and the operations on interface board 1203 are basically similar to those on interface board 1202. For the sake of simplicity, they will not be elaborated here. When the address conversion device has multiple interface boards, these multiple interface boards can communicate through one or more switching network boards 1204, and load sharing and redundant backup can be achieved to provide a large-capacity data exchange and processing capability.

[0308] In a centralized forwarding architecture, the address conversion device may not require the switching network board 1204, and the interface board undertakes the processing function of the service data of the entire system. Therefore, the data access and processing capabilities of the address conversion device in a distributed architecture are greater than those of the address conversion device in a centralized architecture. Which architecture to adopt specifically depends on the specific networking deployment scenario, and no specific limitation is made here.

[0309] In the embodiments of the present application, the memories 12012 and 12024 may be ROM or other types of static storage devices that can store static information and instructions, may also be RAM or other types of dynamic storage devices that can store information and instructions, may also be EEPROM, compact disc read-only memory (CD-ROM), or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disks, or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 12024 in interface board 1202 may exist independently and be connected to the central processing unit 12021 through a communication bus; or, the memory 12024 may also be integrated with the central processing unit 12021. The memory 12012 in the main control board 1201 may exist independently and be connected to the central processing unit 12011 through a communication bus; or, the memory 12012 may also be integrated with the central processing unit 12011.

[0310] The program code stored in the memory 12024 is controlled and executed by the central processing unit 12021, and the program code stored in the memory 12012 is controlled and executed by the central processing unit 12011. The central processing unit 12021 and / or the central processing unit 12011 can implement the address conversion method provided in the above method embodiments by executing the program code. The program code stored in the memory 12024 and / or the memory 12012 may include one or more software units, and these one or more software units may be Figures 14 to 17 the functional modules shown in any one of the accompanying drawings.

[0311] In an embodiment of the present application, the physical interface card 12023 may be a device such as any transceiver for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0312] Optionally, Figures 14 to 18 The address conversion device shown may also be implemented Figure 19 using the structure shown.

[0313] An embodiment of the present application also provides a computer-readable storage medium storing instructions that, when run on a processor, cause the processor to execute the steps performed by the broadband remote access server, authentication server, or first forwarding device in the above method embodiment.

[0314] An embodiment of the present application also provides a computer program product containing instructions that, when run on a processor, cause the processor to execute the steps performed by the broadband remote access server, authentication server, or first forwarding device in the above method embodiment.

[0315] In an embodiment of the present application, the terms "first", "second", and "third" are for descriptive purposes only and should not be construed as indicating or implying relative importance. In an embodiment of the present application, the term "at least one" means one or more, and "multiple" means two or more. In an embodiment of the present application, the term "and / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this article generally represents an "or" relationship between the associated objects before and after.

[0316] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present application and are not intended to limit them; although the embodiments of the present application have been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. An address conversion method, characterized in that: The method comprises: Based on the received first message from the first user being a message of the target application, converting the source address of the first message from the first private network address to the target address and then sending the first message to the first forwarding device; Reporting the tracing information of the first user to the authentication server, the tracing information including the target address corresponding to the first private network address, and the first public network address and first port range corresponding to the first private network address; The target address is different from the first public network address.

2. The method according to claim 1, characterized in that The first private network address belongs to a first private network address pool; and the converting, based on the received first message from the first user being a message of a target application, the source address of the first message from the first private network address to the target address includes: Based on the received first message from the first user being a message of the target application, converting the source address of the first message from the first private network address to the target address in the second private network address pool; The second private network address pool is different from the first private network address pool.

3. The method according to claim 1, characterized in that The first public network address belongs to a first public network address pool; and the converting, based on the received first message from the first user being a message of a target application, the source address of the first message from the first private network address to the target address includes: Based on the received first message of the first user being a message of the target application, converting the source address of the first message from the first private network address to the target address in the second public network address pool; The second public network address pool is different from the first public network address pool.

4. The method according to claim 3, characterized in that The method further comprises: Convert the source port of the first message to a port in the second port range.

5. The method according to claim 3 or 4, characterized in that The method further comprises: Publish the routes of the second public network address pool to the first forwarding device, so that the first forwarding device can publish the routes of the second public network address pool.

6. The method according to any one of claims 1 to 5, characterized in that: The reporting of the traceability information of the first user to the authentication server includes: Reporting first information to the authentication server, the first information including the first public network address and the first port range corresponding to the first private network address; Report second information to the authentication server, where the second information includes the target address corresponding to the first private network address.

7. The method according to claim 6, characterized in that The reporting of the first information to the authentication server includes: After the first user comes online, reporting a billing start message to the authentication server, where the billing start message includes the first information; The reporting of the second information to the authentication server includes: Based on the received first message being a message of the target application, a billing update message is reported to the authentication server, where the billing update message includes the second information.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Based on the fact that the second message received from the first user is not a message of the target application, the source address of the second message is converted from the first private network address to the first public network address, and the source port of the second message is converted to a port in the first port range and then sent to the second forwarding device.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: Based on the fact that the received third message of the second user is not a message of the target application, converting the source address of the third message from the second private network address to the second public network address, and converting the source port of the third message to a port in the third port range before sending it to the second forwarding device; The first private network address and the second private network address belong to the same private network address pool, and the first public network address and the second public network address belong to the same public network address pool.

10. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: Determining, through the service-aware SA service board, that the first message of the first user is a message of a target application; Alternatively, it is determined through an access control list (ACL) that the first message of the first user is a message of a target application.

11. The method according to any one of claims 1 to 10, characterized in that: The method is applied to a broadband remote access server.

12. The method according to any one of claims 1 to 11, characterized in that: The target application is an application for which acceleration services are deployed.

13. An address conversion method, characterized in that: Applied to an authentication server, the method includes: Receive tracing information of a first user, the tracing information including a target address corresponding to a first private network address of the first user, and a first public network address and a first port range corresponding to the first private network address; The target address is different from the first public network address.

14. The method according to claim 13, wherein: The receiving the traceability information of the first user includes: Receive first information, where the first information includes the first public network address and the first port range corresponding to the first private network address; Second information is received, where the second information includes the target address corresponding to the first private network address.

15. The method according to claim 14, characterized in that The receiving the first information includes: receiving a billing start message, wherein the billing start message includes the first information; The receiving the second information includes: receiving a billing update message, wherein the billing update message includes the second information.

16. The method according to any one of claims 13 to 15, characterized in that: The first private network address belongs to a first private network address pool, the target address belongs to a second private network address pool, and the second private network address pool is different from the first private network address pool; Alternatively, the first public network address belongs to a first public network address pool, the target address belongs to a second public network address pool, and the second public network address pool is different from the first public network address pool.

17. An address conversion method, characterized in that: Applied to an address translation system, the system includes: a broadband remote access server and a first forwarding device; the method includes: The broadband remote access server converts the source address of the first message from the first private network address to the target address based on the received first message from the first user being a message of the target application, and then sends the converted message to the first forwarding device; The first forwarding device forwards the first message; The broadband remote access server reports the tracing information of the first user to the authentication server, where the tracing information includes the target address corresponding to the first private network address, and the first public network address and first port range corresponding to the first private network address; The target address is different from the first public network address.

18. The method according to claim 17, characterized in that The first public network address belongs to a first public network address pool; and the broadband remote access server converts the source address of the first message from the first private network address to the target address based on the received first message from the first user being a message of the target application, including: The broadband remote access server converts a source address of the first message from a first private network address to a target address in a second public network address pool based on the first message received from the first user being a message of a target application, wherein the second public network address pool is different from the first public network address pool; The method further comprises: The broadband remote access server publishes the route of the second public network address pool to the first forwarding device; The first forwarding device advertises routes of the second public network address pool; The source address of the first message forwarded by the first forwarding device is the target address.

19. The method according to claim 17, wherein The first private network address belongs to a first private network address pool; and the broadband remote access server converts the source address of the first message from the first private network address to the target address based on the received first message from the first user being a message of the target application, including: The broadband remote access server converts the source address of the first message from the first private network address to a destination address in a second private network address pool based on the received first message from the first user being a message of a target application, where the second private network address pool is different from the first private network address pool; The first forwarding device forwarding the first message includes: The first forwarding device converts the destination address of the first message into a public network address in a third public network address pool, converts the source port of the first message into a port in a fourth port range, and then forwards the first message.

20. The method according to any one of claims 17 to 19, characterized in that The method further comprises: The broadband remote access server, based on the fact that the received second message from the first user is not a message of the target application, converts the source address of the second message from the first private network address to the first public network address, converts the source port of the second message to a port in the first port range, and then sends the second message to the second forwarding device; The broadband remote access server converts the source address of the third message from the second private network address to the second public network address based on the fact that the third message received from the second user is not a message of the target application, and converts the source port of the third message to a port in a third port range before sending the third message to the second forwarding device; The second forwarding device forwards the second message and the third message; The first private network address and the second private network address belong to the same private network address pool, and the first public network address and the second public network address belong to the same public network address pool.

21. The method according to any one of claims 17 to 20, characterized in that The first forwarding device is an acceleration router, which is used to accelerate the forwarding of the message of the target application.

22. An address conversion method, characterized in that: The method comprises: Based on the fact that the first message sent by the first user is a message of the target application, the first message is sent to the first forwarding device, so that the first forwarding device performs network address translation on the first message, wherein the source address of the first message is the first private network address; Based on the fact that the second message sent by the first user is not a message of the target application, the second message is network-addressed and then sent to a second forwarding device, and the source address of the second message after network-addressed translation is different from the first private network address.

23. The method according to claim 22, characterized in that The method further comprises: After the first user comes online, allocating the first private network address to the first user from the first private network address pool; After the second user comes online, allocating a second private network address to the second user from the second private network address pool; The first user is a user who applies for the acceleration service of the target application, the second user is a user who does not apply for the acceleration service of the target application, and the first private network address pool is different from the second private network address pool.

24. The method according to claim 23, wherein The method further comprises: The third message sent by the second user is subjected to network address translation and then sent to the second forwarding device.

25. An address translation device, characterized in that: The address translation device includes: a memory, a processor, and a computer program stored in the memory and capable of running on the processor. When the processor executes the computer program, it implements the method according to any one of claims 1 to 16, or the method according to any one of claims 22 to 24.

26. A computer-readable storage medium, characterized in that The computer-readable storage medium stores instructions, and when the instructions are executed on a processor, the processor executes the method according to any one of claims 1 to 16, or the method according to any one of claims 22 to 24.

27. A computer program product comprising instructions, characterized in that The instructions are executed by a processor to implement the method according to any one of claims 1 to 16, or the method according to any one of claims 22 to 24.

28. A chip, characterized in that: The chip is used to implement the method according to any one of claims 1 to 16, or the method according to any one of claims 22 to 24.

29. An address translation system, characterized in that: The system includes: a broadband remote access server and a forwarding device; The broadband remote access server is used to implement the method according to any one of claims 1 to 12, or the method according to any one of claims 22 to 24.

Images