Internet of Things private network flow processing method and related equipment

Abstract

The invention discloses an Internet of Things private network flow processing method and related equipment. The method comprises the following steps: acquiring session flow between a base station and a terminal and flow direction of the session flow; determining the flow type of the session flow based on the flow direction; when the flow type of the session flow is uplink three-layer session flow, converting a target IP of the session flow into a local private IP, executing downlink packet receiving processing on a flow message, and sending the flow message to the terminal; and when the flow type of the session flow is the downlink three-layer session flow, replacing the local private IP with the target IP of the session flow, and sending the flow data to the terminal. The method can be widely applied to the technical field of network resource scheduling.

Description

Technical Field

[0001] The present application relates to the technical field of network resource scheduling, and in particular to a traffic processing device for an Internet of Things private network and related equipment. Background Art

[0002] 5G Industrial IoT (IIoT) represents the deep integration of fifth-generation mobile communications technology and the Industrial Internet of Things (IIoT). It aims to drive the transformation of industrial manufacturing towards intelligent, digital, and automated processes through high-speed, low-latency, and high-capacity network connectivity. Typical 5G IIoT applications include real-time monitoring of production equipment status, remote operation of automated guided vehicles (AGVs), and collaborative multi-robot operations via 5G.

[0003] Related technologies address these typical private network traffic scenarios, presenting a range of deployment challenges, including security, cost, latency, and performance. Furthermore, these traffic flows do not require complex core network processing processes, such as PDR, FAR, and URR. Currently, deploying a mature 5G Industrial IoT network typically requires coordination among base stations, the core network, and wired fixed networks. Existing private IoT network traffic processing also relies on these same devices, resulting in low data processing efficiency and long data transmission latency. Consequently, related technologies still present challenges that need to be addressed. Summary of the Invention

[0004] The purpose of this application is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0005] To this end, one purpose of an embodiment of the present application is to provide a method and related equipment for processing traffic in an IoT private network, which can improve the timeliness of traffic processing in an IoT private network and reduce the delay of traffic processing.

[0006] In order to achieve the above-mentioned technical objectives, the technical solutions adopted by the embodiments of the present application include: a method for processing traffic in an IoT private network, comprising the following steps: obtaining the session traffic between a base station and a terminal and the traffic direction of the session traffic; determining the traffic type of the session traffic based on the traffic direction; when the traffic type of the session traffic is uplink layer 3 session traffic, converting the target IP of the session traffic into a local private IP and performing downlink packet processing on the traffic message and sending it to the terminal; when the traffic type of the session traffic is downlink layer 3 session traffic, replacing the local private IP with the target IP of the session traffic and sending the traffic data to the terminal.

[0007] This embodiment has at least the following beneficial effects: This embodiment provides a method, device, electronic device, storage medium, and program product for processing traffic in an IoT private network. This solution obtains the session traffic between a base station and a terminal and the traffic direction of the session traffic; based on the traffic direction, determines the traffic type of the session traffic; when the traffic type of the session traffic is uplink Layer 3 session traffic, converts the target IP of the session traffic to a local private IP, performs downlink packet processing on the traffic message, and sends it to the terminal; when the traffic type of the session traffic is downlink Layer 3 session traffic, replaces the local private IP with the target IP of the session traffic, and sends the traffic data to the terminal. This application can improve the timeliness of IoT private network traffic processing and reduce the delay of traffic processing through a new processing method.

[0008] In addition, the method for processing traffic in an IoT private network according to the above embodiment of the present invention may also have the following additional technical features: Furthermore, in an embodiment of the present application, when the traffic type of the session traffic is uplink layer-3 session traffic, converting the target IP of the session traffic to a local private IP and performing downlink packet reception processing on the traffic message and sending it to the terminal specifically includes: When the traffic type of the session traffic is uplink layer 3 session traffic, detecting whether the traffic is private network traffic; If so, convert the target IP of the session traffic to a local private IP and recalculate the IP checksum, then call the first socket to send the data, and the kernel state will perform SNAT conversion according to the preset rules and send the data to the terminal on the intranet through the first preset network port; If not, it is determined whether the destination IP is the session IP in the preset mapping table. If so, the message is directly sent to the terminal as a downlink packet.

[0009] Furthermore, in an embodiment of the present application, when the traffic type of the session traffic is downlink layer 3 session traffic, replacing the local private IP with the target IP of the session traffic and sending the traffic data to the terminal specifically includes: When downlink layer 3 session traffic arrives at the network port, the kernel state will undergo Dnat conversion, replace the local private I with the target IP and recalculate the checksum; The target IP and the verification code are packaged as traffic data and sent to the terminal.

[0010] Furthermore, in the embodiment of the present application, the method further includes: The traffic type of the session traffic is not marked as private network traffic, and the session traffic is sent to the UPF of the core network through the N3 port for processing.

[0011] Furthermore, in the embodiment of the present application, the method further includes: When the traffic type of the session traffic is uplink Layer 2 session traffic, determining whether the destination Mac is the same as any Mac in the preset mapping table; If they are the same, the traffic message is processed as a downlink packet and sent to the terminal.

[0012] Furthermore, in the embodiment of the present application, the method further includes: When the traffic type of the session traffic is downlink layer 2 session traffic, the first connector is started to monitor traffic messages, and the traffic messages are sent to the terminal.

[0013] To achieve the above objectives, another aspect of an embodiment of the present application provides a computer-readable storage medium, which, when executed by a processor, implements any of the methods described above.

[0014] To achieve the above objectives, another aspect of the present application provides an IoT private network traffic processing device, comprising: An acquiring unit, configured to acquire session traffic between a base station and a terminal and a traffic direction of the session traffic; a first processing unit, configured to determine a traffic type of the session traffic based on the traffic direction; The second processing unit is used to, when the traffic type of the session traffic is uplink three-layer session traffic, convert the target IP of the session traffic into a local private IP and perform downlink packet processing on the traffic message and send it to the terminal; or, when the traffic type of the session traffic is downlink three-layer session traffic, replace the local private IP with the target IP of the session traffic and send the traffic data to the terminal.

[0015] To achieve the above objectives, another aspect of the present application provides an electronic device, including: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements any of the above methods.

[0016] To achieve the above objectives, another aspect of an embodiment of the present application provides a computer program product, including a computer program, which implements the aforementioned method when executed by a processor.

[0017] The embodiments of the present application include at least the following beneficial effects: The present application provides a method, device, electronic device, storage medium, and program product for processing traffic in an IoT private network. This solution obtains the session traffic between the base station and the terminal and the traffic direction of the session traffic; based on the traffic direction, determines the traffic type of the session traffic; when the traffic type of the session traffic is uplink layer 3 session traffic, converts the target IP of the session traffic to a local private IP and performs downlink packet processing on the traffic message and sends it to the terminal; when the traffic type of the session traffic is downlink layer 3 session traffic, replaces the local private IP with the target IP of the session traffic and sends the traffic data to the terminal. This application can improve the timeliness of IoT private network traffic processing and reduce the delay of traffic processing through a new processing method. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flow chart of a method for processing traffic in an IoT private network provided by an embodiment of the present application; Figure 2 This is a flowchart of the initial registration process of a terminal provided by an embodiment of the present application; Figure 3 This is a schematic diagram of a terminal session establishment process provided by an embodiment of the present application; Figure 4 This is a flow chart of a Layer 3 session traffic forwarding process provided by an embodiment of the present application; Figure 5 This is a flow chart of a Layer 2 session traffic forwarding process provided by an embodiment of the present application; Figure 6 This is a schematic diagram of the architecture of a networking solution provided by an embodiment of the present application; Figure 7 This is a business flow chart of another method for processing traffic in an IoT private network provided by an embodiment of the present application; Figure 8 This is a structural diagram of an IoT private network traffic processing device provided by an embodiment of the present application; Figure 9 This is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present application; Figure 10 This is a schematic diagram of the hardware structure of an electronic device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0019] The following describes in detail the embodiments of the present invention with reference to the accompanying drawings to illustrate the principles and processes of the Internet of Things private network traffic processing method, electronic device, device and storage medium in the embodiments of the present invention.

[0020] First, some English terms appearing in this application are explained: RRC (Radio Resource Control) is an abbreviation for radio resource control. In wireless communications, it refers to the core protocol for managing radio resources through policy. The RRC layer is part of the access layer and acts as the "commander" or "control center" between the terminal device (UE, such as a mobile phone) and the base station (gNB in ​​5G, eNB in ​​4G). The NAS layer stands for the Non-Access Stratum (Non-Access Stratum). It is a functional layer in the mobile communications protocol stack, located between the core network and user devices. It handles signaling and data transmission between the two, encompassing functions such as mobility management and session management. This layer is independent of radio access technology and is adaptable to GSM, GPRS, and WCDMA networks. Its control plane includes protocols such as CM, MM, and SM, while its user plane is implemented based on the IP packet switching protocol.

[0021] Snat stands for Source Network Address Translation. It is a type of network address translation technology that modifies the source IP address of a data packet, allowing internal network devices to access the external network through a shared public IP address.

[0022] Destination Network Address Translation (DNAT) is a firewall technology that forwards network traffic by modifying the destination address of packets. This technology maps public IP addresses to the real IP addresses of private servers. It is primarily used to allow external users to access internal services and supports TCP port forwarding. Its implementation includes access control list classification and packet reassembly.

[0023] The Tap port is a virtual network device interface in the Linux system. It mainly works at the data link layer and is used to implement interaction between user space programs and the kernel network protocol stack.

[0024] GTPU is a tunneling protocol used in wireless mobile networks to carry user plane data. It encapsulates user plane data in GTP-U packets and transmits them over the core network. GTPU ensures data transmission reliability, sequence, and integrity.

[0025] ETH is the abbreviation of Ethernet. Ethernet is a computer local area network technology and also a random access technology. It specifies the contents including physical layer connections, electronic signals and media access layer protocols.

[0026] PDCP is short for Packet Data Convergence Protocol. It is a wireless transmission protocol stack responsible for compressing and decompressing IP headers, transmitting user data, and maintaining sequence numbers for radio bearers set up for the lossless wireless network service subsystem.

[0027] The Authentication Management Function (AMF) is a key control plane element in the 5G core network, primarily responsible for terminal access authentication and mobility management. In the 5G network architecture, the AMF interacts with other network elements through the N11 reference point, fulfilling functions similar to the MME in 4G networks and supporting interoperability with 3G / 4G networks. Its core mechanisms include encrypting the user identity (SUPI) into SUCI and collaborating with the AUSF (Authentication Server Function) and UDM (Unified Data Management Function) to complete the bidirectional identity authentication and key negotiation process.

[0028] SMF is the abbreviation of Session Management Function, which is responsible for tunnel maintenance, IP address allocation and management, UP function selection, policy implementation and QoS control, billing data collection, roaming, etc.

[0029] UPF stands for User Plane Function. It has functions such as packet routing and forwarding, policy enforcement, traffic reporting, and QoS processing.

[0030] AUSF stands for Authentication Server Function, which can implement 3GPP and non-3GPP access authentication.

[0031] UDM stands for The Unified Data Management, which means unified data management function in Chinese. It has functions such as 3GPPAKA authentication, user identification, access authorization, registration, mobility, subscription, and SMS management.

[0032] A packet data unit (PDU) is a unit of data transmitted between protocol peers in a communications network. In the OSI reference model, the information units exchanged by each protocol layer are collectively referred to as PDUs. The physical layer corresponds to bit streams, the data link layer to frames, the network layer to packets, the transport layer to segments, and higher layers to messages. In GPRS networks, PDUs are encapsulated and transmitted via the GTP tunneling protocol within the core network or LLC connections within the radio access network. Routing is based on identifiers such as the TID, NSAPI, and TLLI.

[0033] Netfilter is a subsystem introduced in Linux 2.4.x. As a general, abstract framework, it provides a complete set of hook function management mechanisms, making it possible to perform packet filtering, network address translation (NAT), and protocol-based connection tracking.

[0034] Mac stands for Media access control address, which is also called LAN Address, MAC Address, Ethernet Address, Hardware Address or Physical Address. It can be seen that "MAC address" is actually the adapter address or adapter identifier EUI-48, which is the address used to confirm the location of the network device.

[0035] QoS (Quality of Service) is a mechanism in network technology that optimizes bandwidth allocation, reduces latency and packet loss, and ensures the transmission quality of critical services (such as voice and video).

[0036] An API (Application Programming Interface) is a set of predefined functions. Its purpose is to provide applications and developers with access to a set of routines based on a piece of software or hardware without requiring access to the source code or understanding the details of the internal workings.

[0037] In addition, this application provides a method for processing traffic in a private network of the Internet of Things. Figure 1 ,exist Figure 1 In the method, the method may include steps S101 to S103, or steps S101, S102, and S104.

[0038] S101: Acquire session traffic between a base station and a terminal and a traffic direction of the session traffic.

[0039] S102: Determine the traffic type of the session traffic based on the traffic direction.

[0040] S103: When the traffic type of the session traffic is uplink layer-3 session traffic, convert the target IP of the session traffic into a local private IP, perform downlink packet receiving processing on the traffic message, and send the result to the terminal.

[0041] S104: When the traffic type of the session traffic is downlink layer-3 session traffic, the local private IP is replaced with the target IP of the session traffic and the traffic data is sent to the terminal.

[0042] This application obtains the session traffic between the base station and the terminal and the traffic direction of the session traffic; determines the traffic type of the session traffic based on the traffic direction; when the traffic type of the session traffic is uplink three-layer session traffic, converts the target IP of the session traffic to a local private IP and performs downlink packet processing on the traffic message and sends it to the terminal; when the traffic type of the session traffic is downlink three-layer session traffic, replaces the local private IP with the target IP of the session traffic and sends the traffic data to the terminal. This application can improve the timeliness of traffic processing in the IoT private network and reduce the delay of traffic processing through a new processing method.

[0043] Furthermore, in an embodiment of the present application, when the traffic type of the session traffic is uplink Layer 3 session traffic, the destination IP address of the session traffic is converted to a local private IP address, and downlink packet reception processing is performed on the traffic message and sent to the terminal, specifically including: When the traffic type of the session traffic is uplink Layer 3 session traffic, check whether the traffic is private network traffic.

[0044] If so, the target IP of the session traffic is converted to a local private IP and the IP checksum is recalculated, and then the first socket is called to send the data. The kernel state will perform Snat conversion according to the preset rules and send the data to the terminal on the intranet through the first preset network port.

[0045] If not, it is determined whether the destination IP is the session IP in the preset mapping table. If so, the message is directly sent to the terminal as a downlink packet.

[0046] Furthermore, in an embodiment of the present application, when the traffic type of the session traffic is downlink layer 3 session traffic, the local private IP is replaced with the target IP of the session traffic and the traffic data is sent to the terminal, specifically including: When downlink Layer 3 session traffic arrives at the network port, the kernel state will undergo Dnat conversion, replace the local private I with the target IP and recalculate the checksum.

[0047] The target IP and verification code are packaged as traffic data and sent to the terminal.

[0048] Furthermore, in the embodiment of the present application, the method further includes: The traffic type of the session traffic is not marked as private network traffic, and the session traffic is sent to the UPF of the core network through the N3 port for processing.

[0049] Furthermore, in the embodiment of the present application, the method further includes: When the traffic type of the session traffic is uplink Layer 2 session traffic, it is determined whether the destination Mac is the same as any Mac in the preset mapping table.

[0050] If they are the same, the traffic message is processed as a downlink packet and sent to the terminal.

[0051] Furthermore, in the embodiment of the present application, the method further includes: When the traffic type of the session traffic is downlink layer 2 session traffic, the first connector is started to monitor traffic messages and send the traffic messages to the terminal.

[0052] The specific calculation principle of this application is explained below with reference to the accompanying drawings: In the industrial Internet of Things (IIoT) scenario, most private network traffic does not require the complex processing procedures of the core network. Since base stations must be deployed remotely, while the core network can be deployed centrally, the UPF processing capabilities of the 5G private network's private network traffic are decentralized to the base stations, reusing the access functions of the existing basic 5G core network. This can release the core network's data processing capabilities and improve the deployment efficiency, processing efficiency, and data security of the 5G Industrial Internet of Things. The specific methods are as follows: like Figure 2 In the networking diagram, in the industrial Internet of Things scenario, the core network can be deployed normally, and the signaling process of terminal access is not affected. Figure 3 、 Figure 4 、 Figure 5 as well as Figure 6 As shown, the signaling of the RRC and Nas layers interact normally.

[0053] After the terminal access is complete, the session registration phase begins. The base station analyzes the specific parameters of the session establishment request, including the session type, session IP address, and QoS information. However, these actions are invisible to the core network and do not affect the core network process.

[0054] The local traffic forwarding process is different for terminal Layer 2 sessions and Layer 3 sessions. Layer 3 sessions require mapping between the session IP and the local private IP, while Layer 2 sessions do not.

[0055] Based on the networking solution, a Layer 3 message forwarding module needs to be implemented and loaded as a kernel driver. This embodiment requires the following steps: Get the user-mode process that needs to process the private IP address segment.

[0056] Use the API provided by the netfilter framework to monitor data packets whose destination IP is a private IP address after the system Dnat. Otherwise, the traffic will be discarded because the destination cannot be found.

[0057] For traffic whose IP addresses fall within the private IP address range, the netlink mechanism is used to implement message interaction from kernel mode to user mode processes. Based on the networking solution, the local traffic processing flow for Layer 2 and Layer 3 session processing is as follows: When the terminal's uplink Layer 3 session's intranet traffic reaches the base station, the PDU's session IP address needs to be replaced with the local private IP address. This traffic is then sent from the network port via kernel-mode SNAT, allowing the terminal to access the intranet. Conversely, when the intranet terminal's downlink traffic reaches the network port, it is sent to the application layer via Dnat. The application layer then replaces the private IP address with the PDU's session IP address. This entire process is imperceptible to both the core network and the terminal, requiring no configuration or modification.

[0058] Create a tap port at the application layer and add the network port and tap port to the bridge port. When the terminal's Layer 2 session's intranet traffic reaches the base station's network port, it is directly sent through the tap port and enters the intranet. Conversely, when the intranet terminal's traffic reaches the network port, it is intercepted by the tap port and then sent wirelessly to the terminal. This entire process is completely invisible to the core network and the terminal.

[0059] Based on the networking solution and the above details, refer to Figure 7 The specific implementation steps are as follows: 1. The base station needs to initialize the local private network IP address pool to map the session IP address of the three-layer session message.

[0060] 2. Based on the session IP or Layer 2 service IP, configure local network traffic identification rules, and configure the first and second physical ports for forwarding local network traffic on the base station.

[0061] 3. Load the Layer 3 session message forwarding module driver.

[0062] 4. Create a bridge port and a first virtual port of the virtual port of the Layer 2 session message processing module, and add the first virtual port and the second network port of the physical port to the bridge port.

[0063] 5. Create the first socket to listen for the Layer 3 session message from the Layer 3 processing module.

[0064] 6. Create a second socket to listen to the Layer 2 session messages of the first virtual port.

[0065] 7. When the terminal accesses the base station, the signaling component interacts normally with the core network. When the base station resolves the session creation, it compares the session IP address with the rules in step 2. If a match is found, a flag is added to indicate that the session is private network traffic and does not require connection to the core network UPF. At this point, a local IP address is requested for this session, and a first preset mapping table is established between the terminal ID, session IP address, session ID, and local IP address.

[0066] 8. Create a SNAT forwarding rule for this session so that subsequent traffic for this session can be processed locally without passing through the UPF, eliminating the process from N3 to N6.

[0067] 9. When uplink Layer 3 session traffic arrives at the base station data module, if the destination IP address is a session IP address in the first preset mapping table in step 7, the message is directly processed as a downlink packet and sent to the terminal. If this session is marked as private network traffic, the local IP address is searched according to the first preset mapping table in step 7, the session IP address in the message is replaced with the local IP address, the IP checksum is recalculated, and the socket interface is called to send the data. The kernel performs SNAT conversion according to the rules in step 8, and then sends the data to the intranet through the first network port.

[0068] 10. When downlink Layer 3 session traffic arrives at the network port, it undergoes Dnat conversion in the kernel state, and the destination IP is replaced with the local IP. It is then monitored by the Layer 3 message forwarding module and sent to the first socket created in step 5. The local IP is then replaced with the session IP, the IP checksum is recalculated, and the traffic is sent to the terminal.

[0069] 11. When uplink Layer 2 session traffic arrives at the base station, a second preset mapping table of source MAC and terminal session ID needs to be created. The second preset mapping table needs to be dynamically updated and aged.

[0070] If the destination Mac exists in the second preset mapping table in step 11, the message is directly sent to the terminal as a downlink packet processing. b. If this session is marked as private network traffic, it is sent directly to the intranet through the second socket.

[0071] 12. When downlink Layer 2 session traffic arrives at the base station, it will be monitored by the second socket and sent to the terminal 13. If the session to which the traffic belongs is not marked as private network traffic, it can be sent to UPF for processing through the N3 port normally without affecting the normal processing flow.

[0072] 14. When the base station resolves the deletion or update of the session, it needs to dynamically delete or update the first preset mapping relationship table between the terminal ID, session IP, session ID, and local IP established in step 7.

[0073] 15. Users need to use the operator's customized IoT base station, connect to the open source core network normally, and configure private network traffic identification rules based on business scenarios.

[0074] The system will automatically identify and forward private network traffic based on user configuration, ensuring that private network traffic does not pass through the fixed network transmission, ensuring data processing efficiency, reducing data transmission delay, and ensuring data security. At the same time, it reduces the load on the core network and saves the operator's hardware costs.

[0075] In addition, please see Figure 8 , an embodiment of the present application also provides an IoT private network traffic processing device that can implement the above method, and the device includes an acquisition unit 1001, a first processing unit 1002, and a second processing unit 1003. The acquisition unit 1001 can be used to obtain the session traffic between the base station and the terminal and the traffic direction of the session traffic. The first processing unit 1002 can be used to determine the traffic type of the session traffic based on the traffic direction. The second processing unit 1003 can be used to convert the target IP of the session traffic into a local private IP and perform downlink packet processing on the traffic message and send it to the terminal when the traffic type of the session traffic is uplink three-layer session traffic; or, when the traffic type of the session traffic is downlink three-layer session traffic, replace the local private IP with the target IP of the session traffic and send the traffic data to the terminal.

[0076] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0077] The present application also provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the above method when executing the computer program. The electronic device can be any smart terminal including a tablet computer, an in-vehicle computer, or the like.

[0078] It can be understood that the contents of the above method embodiments are applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0079] See also Figure 9 , Figure 9 The hardware structure of an electronic device in one embodiment is shown, and the electronic device includes: The processor 901 can be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application. The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called by the processor 901 to execute the above-mentioned methods of the embodiments of this application. Input / output interface 903, used to implement information input and output; Communication interface 904, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.); Bus 905 , which transmits information between various components of the device (e.g., processor 901 , memory 902 , input / output interface 903 , and communication interface 904 ); The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0080] and Figure 1 Corresponding to the method, the embodiment of the present application also provides another electronic device, the specific structure of which can be referred to Figure 10 ,include: at least one processor 1011; at least one memory 1012, configured to store at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method for processing traffic in the IoT private network.

[0081] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above method is implemented.

[0082] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiment, the functions specifically implemented by the present storage medium embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0083] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0084] It is understandable that the contents of the above method embodiments are all applicable to the present program product embodiments, the functions specifically implemented by the present program product embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0085] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0086] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0087] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0088] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0089] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0090] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0091] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0092] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0093] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0094] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0095] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0096] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A method for processing traffic in an IoT private network, characterized in that: The following steps are involved: Acquire session traffic between a base station and a terminal and a traffic direction of the session traffic; Determining a traffic type of the session traffic based on the traffic direction; When the traffic type of the session traffic is uplink layer 3 session traffic, converting the target IP of the session traffic into a local private IP and performing downlink packet receiving processing on the traffic message and sending it to the terminal; When the traffic type of the session traffic is downlink layer-3 session traffic, the local private IP is replaced with the target IP of the session traffic and the traffic data is sent to the terminal.

2. The method according to claim 1, characterized in that When the traffic type of the session traffic is uplink layer-3 session traffic, converting the target IP address of the session traffic to a local private IP address and performing downlink packet receiving processing on the traffic message and sending the packet to the terminal specifically includes: When the traffic type of the session traffic is uplink layer 3 session traffic, detecting whether the traffic is private network traffic; If so, convert the target IP of the session traffic to a local private IP and recalculate the IP checksum, then call the first socket to send the data, and the kernel state will perform SNAT conversion according to the preset rules and send the data to the terminal on the intranet through the first preset network port; If not, it is determined whether the destination IP is the session IP in the preset mapping table. If so, the message is directly sent to the terminal as a downlink packet.

3. The method according to claim 1, characterized in that When the traffic type of the session traffic is downlink layer 3 session traffic, replacing the local private IP with the target IP of the session traffic and sending the traffic data to the terminal specifically includes: When downlink layer 3 session traffic arrives at the network port, the kernel state will undergo Dnat conversion, replace the local private I with the target IP and recalculate the checksum; The target IP and the verification code are packaged as traffic data and sent to the terminal.

4. The method according to claim 2, characterized in that The method further comprises: The traffic type of the session traffic is not marked as private network traffic, and the session traffic is sent to the UPF of the core network through the N3 port for processing.

5. The method according to claim 1, wherein The method further comprises: When the traffic type of the session traffic is uplink Layer 2 session traffic, determining whether the destination Mac is the same as any Mac in the preset mapping table; If they are the same, the traffic message is processed as a downlink packet and sent to the terminal.

6. The method according to claim 1, wherein The method further comprises: When the traffic type of the session traffic is downlink layer 2 session traffic, the first connector is started to monitor traffic messages, and the traffic messages are sent to the terminal.

7. A computer-readable storage medium, characterized in that The method comprises implementing the method according to any one of claims 1 to 6 when executed by a processor.

8. An IoT private network traffic processing device, characterized in that: include: An acquiring unit, configured to acquire session traffic between a base station and a terminal and a traffic direction of the session traffic; a first processing unit, configured to determine a traffic type of the session traffic based on the traffic direction; The second processing unit is used to, when the traffic type of the session traffic is uplink three-layer session traffic, convert the target IP of the session traffic into a local private IP and perform downlink packet processing on the traffic message and send it to the terminal; or, when the traffic type of the session traffic is downlink three-layer session traffic, replace the local private IP with the target IP of the session traffic and send the traffic data to the terminal.

9. An electronic device, characterized in that include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images