Method for realizing NAT (Network Address Translation) on UPF network element of core network

Abstract

The invention relates to a method for realizing NAT on a core network UPF network element, and the method comprises the steps: when a user terminal establishes a 5G session, the UPF pre-allocates a public network IPv4 address and a continuous source port set for the session, the number of ports is dynamically adjusted according to a user package, and resources are bound to a session data structure; receiving a downlink packet of which a destination address is a public network IP based on a private network-to-public network mapping relation, positioning a session level hash table through a flow label direct index mechanism, adding a GTP-U packet header after reverse NAT conversion, and forwarding the packet to a mobile phone through service processing; on the basis of a stream label direct index mechanism, each session exclusively occupies an IP port pool and a hash table through a session-level resource isolation architecture, and is used for avoiding global lock competition in combination with multi-core CPU parallel processing; based on a DPI function switching strategy, an NAT mapping table is synchronized through a UPF cluster session mirroring mechanism for node fault switching zero packet loss.

Description

Technical Field

[0001] The present application relates to the field of wireless communication network technology, and in particular to a method for implementing NAT on a core network UPF network element. Background Art

[0002] Due to the shortage of public IPv4 addresses, carriers or ISPs often use NAT technology to provide Internet access to end users. The IPv4 addresses assigned to user terminals are private addresses within the carrier. NAT converts these addresses into public IPv4 addresses for Internet access (servers on the Internet must use public IPv4 to communicate). This allows carriers to serve more users with fewer public IPv4 addresses (by reusing the same source IP address but different source ports). Disadvantages of existing technologies: An independent CGNAT device is required for address translation services. This device has high forwarding processing performance requirements (for concurrent users exceeding millions), and operators need to invest in additional servers and hardware resources. Glossary: ​​NAT: Address Translation Protocol, CGNAT: Carrier-Grade NAT, UPF: 5G Core Network Data Plane Functional Network Element, DPI: Deep Packet Inspection. The solution proposed by the present invention to the shortcomings of the above-mentioned existing technologies is: to implement the NAT function inside the UPF of the data plane of the 5G core network, and directly implement the IPv4 address conversion function in the UPF, which not only streamlines the network structure and saves operators from additional CGNAT equipment investment, but also can make full use of the data plane forwarding logic of the UPF, reducing the computational overhead and network transit delay required for address conversion. Summary of the Invention

[0003] In order to solve the problems existing in the above-mentioned prior art, the purpose of this application is to provide a method for implementing NAT on the core network UPF network element.

[0004] The method for implementing NAT on a core network UPF network element described in this application includes the following steps: Step S101: When a user terminal establishes a 5G session, the UPF pre-allocates a public IPv4 address and a set of consecutive source ports for the session. The number of ports is dynamically adjusted according to the user package, and the resources are bound to the session data structure. Step S102: Based on the session data structure, the mobile phone uplink data packet is received, the GTP-U packet header is stripped off, and service processing is performed. DPI detection and NAT mapping are completed through a single joint table lookup operation, which specifically includes: querying the session-level hash table with the data flow quintuple as the key. If it is a new flow, the DPI module inserts the flow record. The NAT module selects a port from the pre-allocated port pool and records the mapping relationship between the private network and the public network. After performing NAT conversion, it is forwarded to the Internet. Step S103: Based on the private network to public network mapping relationship, a downlink packet with a destination address of a public network IP is received, a session-level hash table is located using a flow label direct indexing mechanism, a GTP-U packet header is added after reverse NAT conversion, and the packet is forwarded to the mobile phone after service processing; Step S104: Based on the flow label direct indexing mechanism, each session is given exclusive use of the IP port pool and hash table through a session-level resource isolation architecture, and multi-core CPU parallel processing is combined to avoid global lock contention; Step S105: Based on the session-level resource isolation architecture, uplink packets complete DPI record and NAT mapping through a single table lookup synchronization mechanism, downlink packets use flow label direct indexing to obtain the mapping relationship, and support DPI function switch policy for flexible table lookup mode; Step S106: Based on the DPI function switch policy, the NAT mapping table is synchronized through the UPF cluster session mirroring mechanism for node failover with zero packet loss.

[0005] Preferably, in step S101, when the user terminal establishes a 5G session, the UPF pre-allocates a public network IPv4 address and a set of consecutive source ports for the session. The number of ports is dynamically adjusted according to the user package, and resources are bound to the session data structure, including: Parse the session request, obtain the user ID and package type, determine the preliminary parameters and required port range, if the range exceeds the limit, process the port group in segments and update the parameters, dynamically adjust the relationship between the public network address and the port group, generate a provisioning plan, extract continuous address ports and bind them to the session, reallocate resources when conflicts are detected, and finally update the session status and store it.

[0006] Preferably, in step S102, based on the session data structure, receiving the mobile phone uplink data packet, stripping the GTP-U packet header and performing service processing, completing DPI detection and NAT mapping through a single joint table lookup operation, including: Receive and parse the uplink data packet from the mobile phone, and if it belongs to a known session, index the session structure; Otherwise, create a new stream, get the session configuration through the hash table, and use the support vector machine to deeply detect the data stream: If abnormal, it will be marked; if normal, it will enter address translation, allocate ports from the port pool, record the mapping relationship and convert the address, forward the data packet, update the session status and synchronize it into the database.

[0007] Preferably, in step S103, based on the private network to public network mapping relationship, receiving a downlink packet with a destination address of a public network IP, locating the session-level hash table through a flow label direct indexing mechanism, adding a GTP-U packet header after reverse NAT conversion, and forwarding to the mobile phone after service processing, including: Receives downlink data packets from the public network and verifies their format. It matches the session hash table through the flow label index, obtains the session context, performs reverse address translation (public network to private network), adds and verifies the GTP-U packet header to complete encapsulation, classifies and sorts the data streams, and sends them to the mobile phone through the forwarding terminal. After delivery, it updates the session status.

[0008] Preferably, in step S104, based on the flow label direct indexing mechanism, each session is given exclusive use of the IP port pool and hash table through a session-level resource isolation architecture, combined with multi-core CPU parallel processing to avoid global lock contention, including: The data packet session is identified through flow labels and directed to the corresponding IP port pool. The session record is located in the direct index hash table, the context is extracted, and the data is allocated to an independent processing unit through resource isolation. The multi-core CPU is called to slice and process the data stream. The processed fragments are reassembled to the IP port through the pool allocation mechanism. The global lock status is detected, and scheduling is completed if there is no conflict.

[0009] Preferably, in step S105, based on the session-level resource isolation architecture, the uplink packet completes the DPI record and NAT mapping through a single table lookup synchronization mechanism, and the downlink packet obtains the mapping relationship using the flow label direct index, and supports the DPI function switch policy for a flexible table lookup mode, including: Data flows are classified through the session isolation mechanism. If they meet the rules, they are assigned to the isolation unit. Resource allocation is directed to the processing unit and consistency is verified. A single table lookup is performed on the uplink data for deep detection. If the feature matches, the mapping address is associated. The downlink data uses the flow label to quickly locate the mapping relationship. If there is a match, the table lookup mode is dynamically adjusted. The detection and conversion results are integrated. The processing is completed when the data flow status is complete.

[0010] Preferably, in step S106, based on the DPI function switch policy, synchronizing the NAT mapping table through the UPF cluster session mirroring mechanism for node failover with zero packet loss includes: Through session mirroring, the network address translation mapping table is synchronized and verified in real time. When a node fails over, the data flow is backed up and confirmed. Deep packet inspection analyzes traffic characteristics, dynamically adjusts the processing path, redirects the data flow and verifies it during failover, updates the mapping table and confirms it, and monitors the data flow to ensure continuous protection during switching.

[0011] The method for implementing NAT on a core network UPF network element described in the present application has the advantage that the NAT function is implemented in the UPF network element in combination with 5G service processing and forwarding solutions, which has more efficient processing capabilities than simply superimposing a NAT device or NAT module. At the same time, it can reduce network latency and optimize the network structure. By utilizing multi-core CPU concurrent processing, each data packet processing is a lock-free operation, which improves performance. The data of the NAT function is embedded in the mobile phone user session data structure, and the public network address and source port are pre-allocated to each user, which reduces the size of the NAT mapping table, reduces the table lookup overhead, and improves performance. The NAT conversion function is embedded in the UPF data service for processing, and works through direct function calls, reducing network forwarding overhead and latency. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a process of implementing NAT on a core network UPF network element as described in this application Figure 1 ; Figure 2 This is a process of implementing NAT on a core network UPF network element as described in this application Figure 2 . DETAILED DESCRIPTION

[0013] like Figure 1-Figure 2 As shown, the method for implementing NAT on a core network UPF network element described in this application includes the following steps: like Figure 1-Figure 2 As shown, in step S101, when the user terminal establishes a 5G session, the UPF pre-allocates a public IPv4 address and a continuous source port set for the session. The number of ports is dynamically adjusted according to the user package, and the resources are bound to the session data structure.

[0014] Furthermore, in step S101, when a session is initiated by a user terminal, session request information is obtained, the user identification and package type information contained therein are parsed, and preliminary session parameter configuration is obtained; Based on the preliminary session parameter configuration and the mapping between package type and port quantity, the required source port group size is calculated using preset rules to determine the range of allocated ports. If the calculated port number range exceeds the preset threshold, the source port group is segmented, the segmented port set is obtained, and the session parameter configuration is updated; Based on the updated session parameter configuration, the correspondence between the public network address and the source port group is dynamically adjusted to generate an address provisioning plan and obtain a resource allocation result; Extract a continuous set of public network addresses and ports from the resource allocation result, bind them to the session data structure, and form a session binding record; Based on the session binding records, the resource occupancy status in the data structure is detected. If a resource conflict is found, the resource reallocation process is triggered to determine the final resource binding status; The final resource binding state is used to update the session state information of the user terminal, completing the storage and synchronization of the session data structure.

[0015] Specifically, in step S101, when the user terminal establishes a 5G session, the system implements resource allocation and management through a series of automated processes; First, when a user terminal initiates a session request, the core network's session management function (SMF) queries the user's subscription data from the database based on the user ID and package information. Assuming the user's premium package offers 50GB of monthly traffic, the system automatically determines the need to allocate a public IPv4 address and a larger source port set, such as 203.0.113.5. It also reserves a port range of 1024 to 2048, for a total of 1024 ports. This range is calculated based on the package level using the following formula: Number of ports = base port number (512) + package level coefficient (×256). The premium package coefficient is 2, resulting in 512 + 2 × 256 = 1024 ports. Next, the UPF (User Plane Function) binds the IP address and port set to the session data structure. The specific method is to map the user session ID (for example, the session ID is 12345678) to the IP and port resources through a hash algorithm. The hash function is hash(ID) = ID mod 65536. This ensures unique resource allocation and fast retrieval. At the same time, a record is created in memory containing the session ID, IP address, port range, and timestamp (for example, 2023-10-01 10:00:00) to facilitate rapid resource location during subsequent session management. In addition, the system dynamically adjusts port allocation based on network load. If the current UPF load exceeds 80%, a load balancing algorithm will forward some port allocation requests to the backup UPF. Assuming the primary UPF has a processing capacity of 10,000 sessions and has currently processed 8,000, with a load rate of 80%, the system will automatically trigger the backup UPF to take over resource allocation for new sessions to ensure service continuity. Analysis shows that this dynamic adjustment mechanism can reduce the resource allocation failure rate from 5% to 1%, significantly improving system stability. Finally, after resource binding is completed, the system will record the allocation details through logs and feedback the allocation results to SMF, forming a closed-loop management to ensure the traceability of resource usage during session establishment. For example, the log record format is "Session ID: 12345678, IP: 203.0.113.5, Port range: 1024-2048, Allocation time: 2023-10-01 10:00:00", providing data support for subsequent troubleshooting.

[0016] like Figure 1-Figure 2 As shown, step S102, based on the session data structure, receives the mobile phone uplink data packet, strips the GTP-U packet header and performs business processing, and completes DPI detection and NAT mapping through a single joint table lookup operation, specifically including: using the data flow quintuple as the key to query the session-level hash table, if it is a new flow, the DPI module inserts the flow record, the NAT module selects a port from the pre-allocated port pool and records the private network to public network mapping relationship, performs NAT conversion and forwards it to the Internet.

[0017] Furthermore, in step S102, the data packet from the terminal is obtained through the mobile phone uplink data receiving module, and a preliminary analysis is performed on the received data packet to obtain basic information of the data flow; Based on the basic information of the data flow obtained from the preliminary analysis, the data packet is classified and processed using the preset rules to determine whether the data packet belongs to a known session. If it does, it directly enters the subsequent mapping process; If it does not belong to a known session, a new flow record is added to determine the processing path of the new flow; For new flow records or basic data flow information of known sessions, quickly index through the session-level hash table to obtain the corresponding session data structure and obtain the configuration information that matches the data flow; Based on the acquired session data structure configuration information, deep packet inspection is performed, and the support vector machine algorithm is used to extract features from the data stream content to determine whether the data packet has abnormal features. If abnormal features are present, the data stream is marked as a data stream to be processed. If there are no abnormal features, the address conversion process will be entered; For data flows marked as pending or without abnormal characteristics, the network address translation module selects an available port from the pre-allocated port pool, records the mapping relationship between the private network and the public network, and obtains the converted address information; According to the converted address information, the data packet forwarding operation is performed, and the processed data packet is forwarded to the target address through the Internet, completing the transmission processing of the data stream; For the forwarded data stream, the state information in the session data structure is updated, and the updated state information is stored in the database through the synchronization mechanism to obtain the final session record.

[0018] Specifically, in step S102, when processing the uplink data packet of the mobile phone, the system first receives a data packet from the user terminal. Assume that the five-tuple information of the data packet is the source IP address 192.168.1.10, the source port 5000, the destination IP address 8.8.8.8, the destination port 53, and the protocol type is UDP. Then, the system strips the GTP-U packet header through an automated process to extract the payload data. The stripping process involves parsing the GTP-U header field, obtaining the tunnel identifier TEID value of 987654, and forwarding the payload to the service processing module. Next, the system uses the five-tuple as the index key and uses a hash algorithm to query the session-level hash table. The hash function uses a simple modulo method, that is, hash(key) = source IP + source port + destination IP + destination port + protocol mod 1024. The result is the index value 256. The system uses this index to search the hash table for the corresponding session record. If the data flow is found to be new, the DPI module automatically inserts a flow record containing the five-tuple information and the initial timestamp 2023-10-02 14:30:00. The module also analyzes the packet content and identifies the application type as a DNS query. This occupies approximately 0.5KB of memory and stores the identification result in the flow table for subsequent fast matching. At the same time, the NAT module selects an available port from the pre-allocated port pool. Assuming the port pool range is 3000 to 4000, port 3001 is currently selected. A mapping relationship is established between the private IP address 192.168.1.10 and the public IP address 198.51.100.7. The port mapping is from 5000 to 3001. The mapping record is stored in the NAT table. The table entry size is 1KB. System analysis shows that a single mapping takes about 0.002 seconds. The system then performs NAT translation, replacing the source IP and source port of the data packet with the public IP and mapped port, generating a new data packet. The system then searches the routing table for the next hop address, assuming the next hop is the gateway IP address 198.51.100.1. Finally, the data packet is forwarded to the Internet, completing the entire processing flow. The above process realizes seamless connection between DPI detection and NAT mapping through joint table lookup operation, ensuring the continuity of data flow processing.

[0019] like Figure 1-Figure 2 As shown, in step S103, based on the private network to public network mapping relationship, a downlink packet with a destination address of a public network IP is received, the session-level hash table is located through the flow label direct index mechanism, a GTP-U packet header is added after reverse NAT conversion, and the packet is forwarded to the mobile phone after service processing.

[0020] Furthermore, in step S103, the data receiving module captures the downlink data packet from the public network address, parses the basic information of the data packet, and determines whether the data packet meets the preset format requirements. If it meets the format requirements, the subsequent positioning process is entered to obtain a preliminary parsing result; Based on the preliminary analysis results, the flow label index mechanism is used to quickly match the downlink data packet and locate the corresponding record in the session hash table. If a match is successful, the session-related information is obtained to determine the session context of the data packet. Perform reverse conversion on the acquired session context, and restore the public network address to the private network address based on the network address mapping relationship to obtain the converted address information; The packet header adding module constructs a GTP-U packet header based on the converted address information and appends it to the data packet. It then determines whether the packet header is appended correctly. If so, the packet encapsulation process is completed, and the encapsulated data stream is obtained. According to the encapsulated data flow, the business processing flow is executed, the preset rules are called to classify and prioritize the data flow, and the status of the processed data flow is obtained; According to the processed data flow status, the data packet is sent to the mobile terminal through the forwarding terminal module to determine whether it is successfully delivered. If it is successfully delivered, the status record in the session hash table is updated to complete the transmission process of the downlink data packet.

[0021] Specifically, in step S103, when processing downlink data packets, the system first receives a data packet from the Internet. Assuming that the destination IP address of the data packet is the public IP 203.0.113.5, the destination port is 4500, the source IP address is 172.16.254.1, the source port is 8080, and the protocol type is TCP, the system parses the data packet header through an automated process, extracts the five-tuple information, and records the receiving timestamp as 2023-11-01 09:15:30. The data packet size is analyzed to be 1.2KB, and after confirming that it is valid data, it proceeds to the next step of processing; Next, the system uses the flow label direct indexing mechanism, with the destination IP and destination port as the core fields, and combines it with a hash algorithm to calculate the index value. Assuming the hash function is hash(key) = destination IP + destination port mod 2048, the result is an index value of 512. The system uses this index to quickly locate the corresponding record in the session-level hash table. The query takes about 0.001 seconds. The mapping relationship stored in the table shows that the public IP address 203.0.113.5 and port 4500 correspond to the private IP address 10.0.0.15 and port 6000. The system then performs a reverse NAT translation, replacing the packet's destination IP and port with the private IP address 10.0.0.15 and port 6000. This translation involves verifying the integrity of the mapping table to ensure no data loss. Analysis shows that the translation takes approximately 0.003 seconds, and the resulting new packet size remains 1.2KB. Next, the system adds a GTP-U header to the data packet, automatically generates a tunnel identifier TEID value of 1234567, and calculates a checksum of 0x5A3F during the encapsulation process to ensure data integrity. After encapsulation, the data packet size increases to 1.3KB. Finally, the system queries the routing information through the business processing module and determines that the next hop is the base station IP address 10.0.0.1. The data packet is sent to the mobile terminal through the internal forwarding mechanism. The sending process is logged. Analysis shows that the forwarding delay is 0.005 seconds. The entire process is completed through the automated system, ensuring seamless transmission of data packets from the public network to the private network. At the same time, the associated business module updates the traffic statistics and records the downlink data volume as 1.3KB for subsequent network optimization analysis.

[0022] like Figure 1-Figure 2 As shown, in step S104, based on the flow label direct indexing mechanism, each session is allowed to exclusively use the IP port pool and hash table through the session-level resource isolation architecture, combined with multi-core CPU parallel processing to avoid global lock contention.

[0023] Furthermore, in step S104, the session ownership information of the data packet is obtained through the identification function of the flow label to determine whether the data packet belongs to the allocated session-level resources. If it does belong to the allocated resources, it is directed to the corresponding IP port pool to obtain a preliminary classified data flow; Based on the initially classified data stream, a direct index method is used to quickly locate the session record in the hash table to determine whether the record exists. If so, the session-level context information is extracted to determine the processing path of the data stream. Based on the extracted session-level context information, the data flow is allocated to an independent processing unit through the resource isolation architecture. The success of the allocation is determined. If successful, the resource status after allocation is obtained. According to the allocated resource status, the parallel processing capabilities of the multi-core CPU are called to slice the data stream and determine whether the processing is complete. If so, the processed data fragments are obtained; Through the processed data fragments, combined with the pool allocation mechanism, the data flow is reintegrated to the corresponding IP port to determine whether the integration is consistent. If it is consistent, the direction of the integrated data flow is determined; Obtain the integrated data flow, adopt a contention avoidance strategy, detect the status of the global lock, and determine whether there is a conflict. If there is no conflict, complete the final scheduling of the data flow.

[0024] Specifically, in step S104, in the field of network data processing, the system implements efficient session management through a flow label direct indexing mechanism, combining session-level resource isolation architecture and multi-core CPU parallel processing to optimize resource allocation and performance; The system first allocates a separate IP port pool for each session. For example, suppose the public IP assigned to a session is 192.168.100.10, the port range is 5000 to 5100, and the port pool size is 100. The system calculates the port utilization rate through an automated allocation algorithm. Analysis shows that the current utilization rate is 30%, and the number of remaining ports is 70, ensuring sufficient resources. The system then constructs a separate hash table for each session. Assuming the hash table holds 1024 records, the system uses the hash function hash(key) = source IP + source port mod 1024 to calculate the index value of a data stream as 256. The system automatically stores the relevant information for that data stream in the corresponding location. This storage process takes 0.002 seconds. Analysis shows that the hash collision rate is 1.5%. Conflicts are resolved using the chain address method to ensure data accuracy. Next, the system uses a session-level resource isolation architecture to allocate processing tasks for different sessions to different cores of a multi-core CPU. For example, if a system has an 8-core CPU and a session is assigned to core 3 with the processing thread priority set to high, the system detects that core 3 is at 40% load, indicating sufficient processing capacity. It automatically adjusts task allocation, and analysis shows that task switching takes 0.0015 seconds, improving parallel efficiency. Finally, to avoid global lock contention, the system uses a distributed lock mechanism, setting an independent lock for each session's hash table operation. Assuming the lock acquisition time is 0.0005 seconds and the release time is 0.0003 seconds, the system finds a 0.8% lock conflict probability through automated monitoring, dynamically optimizes the lock granularity, and associates business modules to record lock contention logs for subsequent performance tuning. The entire process is automated by the system, ensuring efficient and stable session processing.

[0025] like Figure 1-Figure 2 As shown, in step S105, based on the session-level resource isolation architecture, the uplink packet completes the DPI record and NAT mapping through a single table lookup synchronization mechanism, and the downlink packet uses the flow label direct index to obtain the mapping relationship, and supports the DPI function switch strategy for flexible table lookup mode.

[0026] Furthermore, in step S105, the uplink data and the downlink data are classified and processed by the session isolation mechanism, the classified data flow information is obtained, and it is determined whether the data flow meets the preset isolation rules. If so, the isolation unit of the data flow is determined; According to the classified data flow information, a resource allocation strategy is adopted to direct the data flow to the corresponding processing unit, obtain the allocated unit identifier, and determine whether the unit identifier is consistent with the preset allocation rule. If so, the allocation confirmation result is obtained; Based on the allocation confirmation result, a single table lookup method is used to perform in-depth detection and processing on the uplink data to obtain the detected content features and determine whether the content features meet the preset detection standards. If so, the feature matching status is determined; Through the feature matching state, combined with the synchronous mode, the address conversion of the uplink data is associated and mapped, the converted address identifier is obtained, and it is determined whether the address identifier is consistent with the preset mapping table entry. If it is consistent, the mapping completion information is obtained; Based on the mapping completion information, the flow label indexing technology is used to quickly locate the downlink data, obtain the corresponding mapping relationship data, and determine whether the mapping relationship data matches the preset index record. If so, the positioning accuracy is determined; Based on positioning accuracy and combined with the function switching strategy, the table lookup mode of the downlink data is dynamically adjusted to obtain the adjusted table lookup path. It is then determined whether the table lookup path complies with the preset flexible table lookup rules. If so, the final table lookup result is obtained. The final table lookup result is used, combined with the associated information of deep detection and address conversion, to integrate the data stream, obtain the integrated data stream status, and determine whether the data stream status is consistent with the preset integrity standard. If consistent, the processing completion status of the data stream is determined.

[0027] Specifically, in step S105, in the field of network data processing, based on the session-level resource isolation architecture, the system handles the efficient mapping and identification functions of uplink and downlink data packets through an automated mechanism; For uplink data packets, the system uses a single table lookup synchronization mechanism to automatically complete deep packet inspection records and network address translation mapping. Assuming that the source address of an uplink packet is 10.0.0.5 and the source port is 12345, the system locates the corresponding record in the mapping table through a preset search algorithm. The table capacity is 2048, and the search takes 0.003 seconds. Analysis shows a hit rate of 98.2%. Missed records are automatically supplemented by the backup query module to ensure data integrity. At the same time, the mapping relationship is synchronized to the storage unit. The synchronization takes 0.0012 seconds. For downlink packets, the system uses flow label direct indexing technology to quickly obtain mapping relationships. Assuming the destination address of a downlink packet is 10.0.0.8 and the destination port is 54321, the system calculates the label value as 512 through the indexing algorithm. The positioning time is 0.0025 seconds. Analysis shows that the indexing accuracy is 99.1%. Unmatched packets are automatically placed in the cache queue for secondary processing. In addition, the system supports deep packet inspection function switch strategies and flexibly adjusts the table lookup mode for different business scenarios. Assuming that the switch is set to on in a certain business scenario, the system automatically loads the deep detection rule base with 500 rule entries and takes 0.004 seconds to load. Analysis shows that the rule matching rate is 95.3%. Unmatched data packets are automatically supplemented by the backup rule base. At the same time, the system automatically adjusts the switch status according to business traffic fluctuations. If the traffic peak exceeds 1 million packets per second, some detection functions are temporarily closed to release resources. The adjustment process takes 0.0018 seconds. The associated traffic monitoring module records the adjustment log in real time to form a complete data processing link to ensure stable operation of the system under different loads.

[0028] like Figure 1-Figure 2 As shown, step S106, based on the DPI function switch policy, synchronizes the NAT mapping table through the UPF cluster session mirroring mechanism for node failure switching with zero packet loss.

[0029] Furthermore, in step S106, the network address translation mapping table is synchronized in real time through the session mirroring technology of the user plane function cluster, the synchronized mapping table data is obtained, and it is determined whether the mapping table data is consistent with the preset synchronization standard. If it is consistent, the synchronization completion status is determined; Based on the synchronization completion status, for node failover scenarios, session mirroring technology is used to back up the data transmission stream, obtain the backed-up data stream information, and determine whether the data stream information matches the preset backup rules. If so, a backup confirmation result is obtained; Through the backup confirmation results, combined with the deep packet inspection function, the data transmission flow is analyzed, the analyzed traffic characteristics are obtained, and the traffic characteristics are judged to see whether they meet the preset detection conditions. If they do, the traffic analysis status is determined; Based on the traffic analysis status, the function switch policy is used to dynamically adjust the processing mode of the data transmission flow, obtain the adjusted processing path, and determine whether the processing path is consistent with the preset policy rules. If so, the path adjustment result is obtained; Based on the path adjustment results, the pre-established switching support mechanism is used to redirect the data flow for seamless data transmission during node failover. The redirected data flow direction is obtained and it is determined whether the data flow direction matches the preset redirection standard. If so, the redirection completion status is determined. According to the redirection completion status, combined with the synchronization processing mechanism, the network address translation mapping table is updated, the updated mapping table content is obtained, and it is determined whether the mapping table content is consistent with the preset update rules. If it is consistent, the update confirmation information is obtained; By updating the confirmation information, the data flow is monitored and processed by using a protection mechanism that supports switching for the continuity of the data transmission flow, and the status data after monitoring is obtained to determine whether the status data meets the preset continuity standards. If so, the data flow protection status is determined.

[0030] Specifically, in step S106, in the field of network data processing, for the combined application of the DPI function switch strategy and the UPF cluster session mirroring mechanism, the system uses automation technology to achieve seamless synchronization of the NAT mapping table and node failover to ensure the continuity of data transmission; First, based on the DPI function switching policy, the system automatically detects the current network load and decides whether to enable deep inspection. Assuming network traffic reaches 800,000 packets per second, the system calculates the current cluster load rate to 85.6% through the load balancing algorithm. Analysis shows that some inspection functions need to be enabled to balance resources. After automatic adjustment, the function activation ratio is 60%, and the adjustment takes 0.0021 seconds. Subsequently, the system synchronizes the NAT mapping table to the backup node in real time through the UPF cluster session mirroring mechanism. Assuming that the mapping table capacity of the primary node is 4096 entries, the synchronization algorithm uses an incremental update method, with 512 entries synchronized each time, taking 0.0015 seconds. Analysis shows that the synchronization integrity reaches 99.5%. Unsynchronized data is automatically supplemented by the backup verification module to ensure data consistency. Next, when a primary node failure is detected, the system automatically triggers a switchover mechanism, with the backup node taking over traffic. Assuming the switchover trigger time is 0.0008 seconds, the system activates the mirrored session data using a preloading algorithm, which takes 0.0013 seconds. Analysis shows that data integrity during the switchover process is 98.8%. Sessions that have not completed the switchover are automatically placed in a temporary cache queue and re-recorded by the auxiliary recovery module within 0.002 seconds. Finally, to ensure business continuity, the system works with the billing module to automatically update session status. Assuming the billing record update frequency is 5,000 per minute and the update time is 0.0032 seconds, analysis shows that the record accuracy is 99.2%. Unupdated records are automatically processed by the background batch processing module in the next cycle, forming a complete data closed loop to ensure that business logic is not affected during the fault switching process.

[0031] Those skilled in the art can make various other corresponding changes and deformations based on the technical solutions and concepts described above, and all of these changes and deformations should fall within the scope of protection of the claims of this application.

Claims

1. A method for implementing NAT on a core network UPF network element, characterized in that: include: When a user terminal establishes a 5G session, the UPF pre-allocates a public IPv4 address and a set of consecutive source ports for the session. The number of ports is dynamically adjusted based on the user's package, and the resources are bound to the session data structure. Based on the session data structure, the system receives uplink data packets from the mobile phone, strips off the GTP-U packet header, performs service processing, and completes DPI detection and NAT mapping through a single joint table lookup operation, specifically including: querying the session-level hash table with the data flow quintuple as the key, inserting the flow record if it is a new data flow, and the NAT module selecting a port from the pre-allocated port pool and recording the mapping relationship between the private network and the public network, performing NAT conversion, and forwarding the data to the Internet; Based on the private network to public network mapping relationship, a downlink packet with a destination address of a public network IP is received, a session-level hash table is located through a flow label direct indexing mechanism, a GTP-U packet header is added after reverse NAT conversion, and the packet is forwarded to the mobile phone after service processing; Based on the flow label direct indexing mechanism, a session-level resource isolation architecture is used to allow each session to exclusively use the IP port pool and hash table, combined with multi-core CPU parallel processing to avoid global lock contention; Based on the session-level resource isolation architecture, uplink packets complete DPI records and NAT mapping through a single table lookup synchronization mechanism, and downlink packets use flow label direct indexing to obtain the mapping relationship, and support DPI function switch policies for flexible table lookup mode; Based on the DPI function switch policy, the NAT mapping table is synchronized through the UPF cluster session mirroring mechanism for node failover with zero packet loss.

2. A method for implementing NAT on a core network UPF network element according to claim 1, characterized in that: The pre-allocated public network IPv4 address and continuous source port set include: Parse the user ID and package type in the session request to determine the initial port allocation range. When the number of ports exceeds the preset threshold, segment the source port group and update the session parameters. Dynamically adjust the binding relationship between the public network address and the port group. Trigger the reallocation process when detecting resource conflicts.

3. The method for implementing NAT on a core network UPF network element according to claim 1, characterized in that: The single joint table lookup operation includes: The session-level hash table is queried using the data flow quintuple as the key value, DPI deep detection is performed on the new data flow, and the support vector machine algorithm is used to identify traffic characteristics. Based on the detection results, available ports are selected and a mapping record from the private network to the public network is generated.

4. The method for implementing NAT on a core network UPF network element according to claim 1, characterized in that: The flow label direct indexing mechanism is specifically as follows: The destination IP and destination port of the downlink data packet are extracted as the index key, the index value is calculated through the hash function, the mapping relationship record in the session-level hash table is directly located, and the reverse NAT conversion is completed in a single table lookup based on the mapping relationship.

5. The method for implementing NAT on a core network UPF network element according to claim 1, characterized in that: The session-level resource isolation architecture includes: An independent IP port pool and hash table are allocated to each session, and the session data flow is directed to the designated processing unit based on the flow label.

6. The method for implementing NAT on a core network UPF network element according to claim 1, characterized in that: The UPF cluster session mirroring mechanism includes: The NAT mapping table of the primary node is copied to the standby node in real time using incremental synchronization, and the mirrored session data of the standby node is activated during failover.

Images