Method, device, storage medium and system for transmitting message

Abstract

The present application provides a method, apparatus, storage medium and system for transmitting a message, wherein a first network device obtains a tunnel identity indication identifier, establishes a communication tunnel with a second network device according to the tunnel identity indication identifier, and sends a first message to the second network device on the established communication tunnel, wherein the first message includes the tunnel identity indication identifier. The first network device transmits the message on the corresponding tunnel according to the tunnel identity indication information, thereby realizing NAT traversal of multiple tunnels from point to point.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a method, device, storage medium and system for transmitting a message. Background Art

[0002] When network devices deployed on both sides of a network address translation (NAT) gateway device need to communicate through an Internet Protocol (IP) tunnel, the NAT gateway often performs address translation on the messages passing through it, changing the source IP address of the messages. For example, when there are multiple tunnels for communication between network device 1 and network device 2, or when network device 1 and network device 2 communicate with network device 3 through different IP tunnels, the NAT gateway will convert the source IP addresses of the messages passing through it into the same IP address, resulting in the same tunnel address information seen by network device 3, and it is impossible to distinguish different IP tunnels. Therefore, this point-to-multipoint NAT traversal is impossible to achieve. Summary of the invention

[0003] The present application provides a method, device, storage medium and system for transmitting messages, which can enable network devices to implement point-to-multipoint NAT traversal of multiple tunnels.

[0004] In a first aspect, a method for transmitting a message is provided, comprising: a first network device obtains a tunnel identity indication identifier, wherein the tunnel identity indication identifier includes a port number corresponding to a second network device; the first network device establishes a communication tunnel with the second network device according to the tunnel identity indication identifier; the first network device sends a first message to the second network device through the communication tunnel, wherein the first message includes the tunnel identity indication identifier.

[0005] In the above technical solution, the first network device determines on which tunnel a communication tunnel needs to be established with the second network device by obtaining tunnel identity indication information, and transmits messages to the second network device on the corresponding tunnel after establishing the communication tunnel, thereby realizing point-to-multipoint NAT traversal of multiple tunnels.

[0006] Specifically, if the first network device only encapsulates the IP header in the first message when sending the first message to the second network device, since the destination address of the IP header encapsulated in the first message is not the IP address of the second network device, but the IP address of the intermediate device NAT gateway, if the first network device needs to send messages to multiple second terminal devices, then when the NAT gateway receives multiple first messages from the first network device, it does not know on which tunnels the multiple first messages should be sent. The first network device of the above technical solution of the present application adds a tunnel identity indication identifier in the message, which allows the NAT gateway to determine to send messages to multiple second network devices on the corresponding tunnels according to the tunnel identity indication information when sending the first message, thereby realizing NAT traversal of multiple tunnels.

[0007] In combination with the first aspect, in some implementations of the first aspect, the port number corresponding to the second network device is the port number of the second network device after conversion by a network address translation NAT gateway.

[0008] In the above technical scheme, the port number of the second network device after conversion by the network address translation NAT gateway corresponds to the tunnel one by one, and a tunnel can be uniquely determined according to the converted port number. The first network device can determine on which tunnel a communication tunnel needs to be established with the second network device by obtaining the port number of the second network device after conversion by the network address translation NAT gateway. After the communication tunnel is established, the message is transmitted to the second network device on the corresponding tunnel, thereby realizing point-to-multipoint NAT traversal of multiple tunnels.

[0009] In combination with the first aspect, in some implementations of the first aspect, the first message includes a first User Datagram Protocol UDP message header, and the tunnel identity indication identifier is a destination port number in the first UDP message header.

[0010] In the above technical solution, a UDP header is introduced on the basis of the existing tunnel encapsulation format, and the tunnel identity indication information is encapsulated in the UDP header, so that point-to-multipoint NAT traversal of multiple tunnels can be achieved.

[0011] In combination with the first aspect, in some implementations of the first aspect, the port number after the destination port number in the first UDP message header is converted by the NAT gateway is used to indicate the type of the communication tunnel.

[0012] In combination with the first aspect, in some implementations of the first aspect, the first message also includes a type indication identifier of the communication tunnel.

[0013] In the above technical solution, a type indication identifier of the communication tunnel is added to the first message. When the second network device receives the first message, the type of tunnel for transmitting the first message can be determined according to the type indication identifier of the tunnel in the message.

[0014] In combination with the first aspect, in some implementations of the first aspect, the communication tunnel identifier is carried in a security parameter index SPI of the message.

[0015] In the above technical solution, an SPI is encapsulated after the UDP header, and an undefined value in the SPI is used to indicate the type of the tunnel for transmitting the first message.

[0016] In combination with the first aspect, in some implementations of the first aspect, the communication tunnel is an IP communication tunnel.

[0017] In a second aspect, a method for transmitting a message is provided, comprising: a second network device determines tunnel type indication information according to the type of the communication tunnel, the tunnel type indication information being used to indicate the type of the communication tunnel; the second network device sends a second message to a NAT gateway through the communication tunnel, the second message carrying the tunnel type indication information.

[0018] In the above technical solution, the second network device determines the tunnel type indication information according to different communication tunnel types, and encapsulates the tunnel type indication information in the second message and sends it to the NAT gateway. The first network device can determine the type of tunnel for transmitting the message according to the received message.

[0019] Specifically, if the second network device only encapsulates the IP header in the second message when sending the second message to the first network device, then the NAT gateway will convert the source IP addresses in the multiple second messages into the same NAT gateway IP address when receiving multiple second messages from multiple second network devices. For example, network device 1 (an example of the second network device) first initiates communication to network device 3 (the first network device), and the source IP address of the message encapsulated by network device 1 is converted into the IP address of the gateway NAT device after passing through the NAT device, and a NAT session flow table is established, and the reverse flow (i.e., network device 3 sends a message to network device 1) is converted by the NAT gateway and then sent to network device 1; when network device 2 (another example of the second network device) initiates communication to network device 3 again, when the NAT gateway establishes a session, the IP address information after conversion is the same, resulting in a conflict failure in NAT establishing a reverse session, and thus the flow of network device 2 cannot be NAT converted, and after the message is sent to network device 3, it will be discarded because the reverse address is a private network address and the route cannot be found. That is, IP tunnel traversal NAT cannot support NAT traversal of multiple private network device addresses with the same IP address after conversion, that is, point-to-multipoint NAT traversal cannot be achieved. In the second network device of the above technical solution of the present application, tunnel type indication information is added to the second message, so that the NAT gateway can determine to send the message to the second network device on the corresponding tunnel according to the tunnel type indication information when sending the second message, thereby achieving NAT traversal of multiple tunnels.

[0020] In combination with the second aspect, in some implementations of the second aspect, the second message includes a second UDP message header, the UDP message header includes a source port number and a destination port, and the tunnel type indication information is the destination port number in the second UDP message header.

[0021] In the above technical solution, a UDP header is introduced on the basis of the existing tunnel encapsulation format, and tunnel type indication information is encapsulated in the UDP header. The type indication identifier of the communication tunnel is used to indicate the type of the tunnel for transmitting the second message.

[0022] In combination with the second aspect, in some implementations of the second aspect, the second message includes a type indication identifier of the communication tunnel.

[0023] In the above technical solution, a type indication identifier of a communication tunnel is added to the second message, and the type indication identifier of the communication tunnel is used to indicate the type of the tunnel for transmitting the second message.

[0024] In combination with the second aspect, in some implementations of the second aspect, the communication tunnel identifier is carried in a security parameter index of the message.

[0025] In the above technical solution, an SPI is encapsulated after the UDP header, and an undefined value in the SPI is used to indicate the type of the tunnel for transmitting the second message.

[0026] In combination with the second aspect, in some implementations of the second aspect, the communication tunnel is an IP communication tunnel.

[0027] In a third aspect, the present application provides a communication device, which has the function of implementing the method in the first aspect and any possible implementation of the first aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units corresponding to the above functions.

[0028] In a fourth aspect, the present application provides a communication device, which has the function of implementing the method in the second aspect and any possible implementation of the second aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more units corresponding to the above functions.

[0029] In a fifth aspect, the present application provides a communication device, comprising at least one processor and a communication interface. The at least one processor is configured to execute a computer program or instruction so that the communication device can implement the communication method in the first aspect and any possible implementation of the first aspect.

[0030] Optionally, the communication device further comprises at least one memory, the at least one memory is coupled to the at least one processor, and the computer program or instruction is stored in the at least one memory.

[0031] In one implementation, the communication device is a first network device. When the communication device is the first network device, the communication interface may be a transceiver, or an input / output interface.

[0032] In another implementation, the communication device is a chip or a chip system. When the communication device is a chip or a chip system, the communication interface may be an input / output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit on the chip or the chip system. The processor may also be embodied as a processing circuit or a logic circuit.

[0033] In another implementation, the communication device is a chip or a chip system configured in the first network device.

[0034] Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0035] In a sixth aspect, the present application provides a communication device, comprising at least one processor and a communication interface. The at least one processor is configured to execute a computer program or instruction so that the communication device can implement the communication method in the above second aspect and any possible implementation of the second aspect.

[0036] Optionally, the communication device further comprises at least one memory, the at least one memory is coupled to the at least one processor, and the computer program or instruction is stored in the at least one memory.

[0037] In one implementation, the communication device is a second network device. When the communication device is a second network device, the communication interface may be a transceiver, or an input / output interface.

[0038] In another implementation, the communication device is a chip or a chip system. When the communication device is a chip or a chip system, the communication interface may be an input / output interface, an interface circuit, an output circuit, an input circuit, a pin or a related circuit on the chip or the chip system. The processor may also be embodied as a processing circuit or a logic circuit.

[0039] In another implementation, the communication device is a chip or a chip system configured in the second network device.

[0040] Optionally, the transceiver may be a transceiver circuit. Optionally, the input / output interface may be an input / output circuit.

[0041] In a seventh aspect, a computer program product is provided, which includes: a computer program (also referred to as code, or instruction), which, when executed, enables a computer to execute the method in the above-mentioned first aspect and any possible implementation manner of the first aspect.

[0042] In an eighth aspect, a computer program product is provided, which includes: a computer program (also referred to as code, or instruction), which, when executed, enables a computer to execute the method in the second aspect and any possible implementation of the second aspect.

[0043] In the ninth aspect, a computer-readable storage medium is provided, which stores a computer program (also referred to as code, or instruction) which, when executed on a computer, enables the computer to execute the method in the first aspect and any possible implementation of the first aspect.

[0044] In the tenth aspect, a computer-readable storage medium is provided, which stores a computer program (also referred to as code, or instructions). When the computer-readable storage medium is run on a computer, the computer executes the method in the above-mentioned second aspect and any possible implementation of the second aspect.

[0045] In the eleventh aspect, a communication system is provided, comprising the communication device as described in the third aspect or the fifth aspect and the communication device as described in the fourth aspect or the sixth aspect and a network address translation NAT gateway. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of a network architecture provided in an embodiment of the present application.

[0047] Figure 2 This is a diagram of common IP tunnel protocol message encapsulation.

[0048] Figure 3 The diagram is a diagram of a point-to-point NAT traversal scenario for an IP tunnel.

[0049] Figure 4 The diagram is a diagram of a point-to-point NAT traversal scenario for an IP tunnel.

[0050] Figure 5 It is a schematic interactive diagram of a method for transmitting messages provided in an embodiment of the present application.

[0051] Figure 6 It is a schematic diagram of a tunnel point-to-multipoint NAT traversal implementation provided in an embodiment of the present application.

[0052] Figure 7It is a schematic diagram of the point-to-multipoint NAT traversal implementation of various tunnels provided in the embodiments of the present application.

[0053] Figure 8 This is a schematic diagram of implementing NAT traversal message encapsulation of multiple tunnel types based on different ports.

[0054] Fig. 9 A schematic interactive diagram of another method for transmitting messages provided in an embodiment of the present application.

[0055] Fig.10 It is a schematic diagram of another method for transmitting messages provided in an embodiment of the present application.

[0056] Fig.11 A diagram of the standard IPSEC NAT traversal encapsulation format.

[0057] Fig.12 The figure is a schematic block diagram of the ESP message header structure in the standard IPSEC NAT traversal encapsulation.

[0058] Fig.13 The figure is a schematic diagram of multi-tunnel type NAT traversal message encapsulation based on SPI value.

[0059] Fig.14 It is a schematic interaction diagram of another method for transmitting messages provided in an embodiment of the present application.

[0060] Fig.15 A schematic block diagram of a communication device 1000 provided in the present application.

[0061] Fig.16 A schematic structural diagram of the communication device 10 provided in this application. DETAILED DESCRIPTION

[0062] The technical solution in this application will be described below in conjunction with the accompanying drawings.

[0063] Figure 1 Schematic diagram of a network architecture provided by an embodiment of the present application. Figure 1 As shown, the communication system of the embodiment of the present application may include multiple network devices, such as network device 110, network device 120, network device 130, etc., and network device 110 communicates with network device 120 through network device 130. Among them, network devices 110 and 120 may be firewalls, routers, switches with three-layer processing capabilities, and network devices with similar functions implemented by corresponding software. Network device 130 may be a NAT gateway, and a network device with similar functions implemented by corresponding software.

[0064] The embodiments of this application are Figure 1The network architecture shown uses tunneling technology for communication. Tunneling technology is a technology that transfers data between networks by using the infrastructure of the internetwork. The data (or payload) transferred using the tunnel can be data frames or packets of different protocols. The tunneling protocol re-encapsulates the data frames or packets of these other protocols in a new packet and sends them. The new packet header provides routing information so that the encapsulated payload data can be passed through the internetwork. The encapsulated data packets are routed through the public internetwork between the two endpoints of the tunnel. The logical path that the encapsulated data packets take when passing through the public internetwork is called a tunnel. Once it reaches the network endpoint, the data is decapsulated and forwarded to the final destination. Tunneling technology refers to the entire process including data encapsulation, transmission, and decapsulation.

[0065] Common Internet Protocol (IP) tunneling protocols include Layer 2 Tunneling Protocol (L2TP), Internet Protocol Security (IPSEC), Generic Routing Encapsulation (GRE), 6over4 (IPv6 over IPv4), etc. The encapsulation formats corresponding to each protocol are as follows: Figure 2 As shown. If these tunnel protocols want to traverse NAT, they need to rely on IPSEC, such as L2TP, which needs to rely on IPSEC to traverse NAT. Otherwise, when traversing, since only IP address information can be converted, the intermediate NAT device must be configured with static NAT (NAT static) or NAT server (NAT server) one-to-one address mapping, and does not support NAT traversal with the port address translation (PAT) function enabled. A large number of IP addresses are required, and the configuration is complex, so the use is relatively limited.

[0066] Figure 3 The diagram is a diagram of a point-to-point NAT traversal scenario for an IP tunnel.

[0067] The following is an example of a GRE tunnel as an IP tunnel. Customer premise equipment (CPE) 1 is located in the private network, CPE2 is located in the public network, CPE1 and CPE2 establish a tunnel and communicate, and a NAT gateway is deployed at the private network egress to achieve the conversion of public and private URLs. Since the GRE tunnel only encapsulates the source IP address and destination IP address information, the NAT gateway in the intermediate network is required to configure only one-to-one mapping of IP addresses. Therefore, the tunnel address information seen by CPE1 is (10.1.1.1, 30.1.1.2), indicating that the source address is 10.1.1.1 and the destination address is 30.1.1.2. When passing through NAT, the tunnel address information seen by CPE2 after NAT conversion is (30.1.1.1, 30.1.1.2), indicating that the source address is 30.1.1.1 and the destination address is 30.1.1.2.

[0068] The encapsulation and decapsulation process between CPE1 and CPE2 is as follows:

[0069] 1) CPE1 encapsulates a message with a source address of 10.1.1.1 and a destination address of 30.1.1.2, and sends it to the NAT gateway. After NAT conversion, the source address of the message is replaced with 30.1.1.1, and then it is forwarded to CPE2 according to the destination address 30.1.1.2. CPE2 decapsulates the message according to the decapsulation table information.

[0070] 2) CPE2 encapsulates the message with source address 30.1.1.2 and destination address 30.1.1.1, and sends it to the NAT gateway. After NAT conversion, the source address of the message remains unchanged, and the destination address 30.1.1.1 is replaced with 10.1.1.1 and forwarded to CPE1 through routing. CPE1 performs decapsulation processing according to the decapsulation table information.

[0071] Figure 3 There is only one CPE on the private network side, which can implement point-to-point IP tunnel traversal NAT. Figure 4In the scenario shown, when there are multiple CPEs on the private network side, for example, taking two CPEs as an example, the private network user devices CPE1 and CPE2 establish tunnels 1 and 2 with the public network device CPE3 respectively to communicate, and a NAT gateway is deployed at the private network egress to implement public-private network address conversion. For example, CPE1 initiates communication first, and the source IP address of the message encapsulated by CPE1 is converted into the IP address 30.1.1.1 of the gateway NAT device after passing through the NAT device, and a NAT session flow table is established. The reverse traffic (that is, CPE3 sends a message to CPE1) is converted by the NAT gateway and then sent to CPE1. When CPE2 initiates communication again, when the NAT gateway establishes a session, the information after conversion is the same, resulting in a conflict in NAT establishing a reverse session. Therefore, the CPE2 flow cannot be converted by NAT. After the message is sent to CPE3, it will be discarded because the reverse address is a private network address and the route cannot be found. That is, IP tunnel traversal NAT cannot support NAT traversal of multiple private network device addresses with the same IP address after conversion, that is, point-to-multipoint NAT traversal cannot be achieved, so in practice Figure 4 The scenario shown is not achievable.

[0072] In view of this, the embodiment of the present application optimizes the method of IP tunnel traversal NAT so as to be able to Figure 4 Point-to-multipoint NAT traversal is implemented under the network architecture shown.

[0073] In order to better understand the embodiments of the present application, the concepts involved in the embodiments of the present application are first introduced below.

[0074] Simple traversal of UDP over NATs (STUN): A client-server network protocol. This protocol defines some message formats, which are generally divided into request / response. The main function of this protocol is to establish UDP communication between two hosts behind a NAT router. It allows a client behind a NAT to find out its public network address, determine what type of NAT it is in, and the external port that the NAT binds to the client's local port.

[0075] STUN has three main functions, namely, detecting whether it is behind NAT, detecting the type of NAT, and obtaining the address and port after NAT conversion. When applied, a STUN client is installed on the intranet and a STUN server is installed on the public network. The client sends a request to the server, and the server sends a response to the client.

[0076] The process of detecting whether it is located behind NAT is that after the server receives the UDP packet sent by the client, it can obtain the converted address and port information of the private network client on the public network side. The server will use UDP to send the address and port information of the received packet back to the client. The client compares the address and port information sent by the server with the IP address and port of the local machine. If they are different, it means that it is behind NAT. If they are the same, it means that the client is in front of NAT, that is, the client is also located in the public network.

[0077] Optionally, before communicating, the network device in the embodiment of the present application can determine whether it is on both sides of the NAT gateway by interacting with STUN, and the sending side network device can obtain the address and port after NAT conversion.

[0078] Optionally, before the network devices in the embodiments of the present application communicate, the sending-side network devices may obtain the address and port after NAT conversion by means of configuration.

[0079] The various embodiments provided in the present application will be described in detail below with reference to the accompanying drawings.

[0080] Figure 5 It is a schematic interactive diagram of a method for transmitting messages provided in an embodiment of the present application.

[0081] S510: The second network device determines tunnel type indication information according to the type of the communication tunnel.

[0082] Combine the following Figure 6 The second network device shown is CPE1 or CPE2, and the first network device is CPE3 for example. A NAT gateway is deployed at the egress of the second network device to implement URL conversion. CPE1 and CPE3 communicate through tunnel 1, and CPE2 and CPE3 communicate through tunnel 2. For example, tunnel types of tunnel 1 and tunnel 2 are both GRE tunnels.

[0083] When CPE1 sends a message to CPE3 through the NAT gateway, CPE1 uses the protocol corresponding to tunnel 1 to encapsulate message A. In addition to encapsulating the source IP address and destination IP address information in the IP header, CPE1 also encapsulates the user datagram protocol (UDP) header in message A. The UDP header includes the source port number and the destination port number, where the source port number is the port number of CPE1 and the destination port number is the port number of CPE3. That is, the corresponding information quadruple in the encapsulated IP header and UDP header in message A is (source IP address, destination IP address, source port number, destination port number).

[0084] Similarly, when CPE2 sends a message to CPE3 through the same NAT gateway mentioned above, CPE2 uses the protocol corresponding to tunnel 2 to encapsulate message B. In addition to encapsulating the source IP address and destination IP address information in the IP header, CPE2 also encapsulates the UDP header in message B. The UDP header includes the source port number and the destination port number, where the source port number is the port number of CPE2, and the destination port number is the port number of CPE3, that is, the corresponding information quadruple in the encapsulated IP header and UDP header in message B is (source IP address, destination IP address, source port number, destination port number).

[0085] For example, for a tunnel type service, the network devices at both ends of the same tunnel can use the UDP message with the same port number 5000 to traverse the NAT gateway, such as Figure 6 As shown, the 4-tuple of message A encapsulated by CPE1 is (10.1.1.1, 30.1.1.2, 5000, 5000), and the 4-tuple of message B encapsulated by CPE2 is (20.1.1.1, 30.1.1.2, 5000, 5000), where 10.1.1.1 is the IP address of CPE1, 20.1.1.1 is the IP address of CPE2, and 30.1.1.2 is the IP address of CPE3. Because the destination port numbers in messages A and B will not be converted after passing through the NAT gateway, the destination port number 5000 can be used to indicate the tunnel type of tunnel 1 and tunnel 2 in addition to indicating the port number of CPE3, that is, the destination port number 5000 can be used to indicate that the tunnel type of tunnel 1 and tunnel 2 is GRE tunnel.

[0086] S520: The second network device sends a second message to the NAT gateway.

[0087] Correspondingly, the NAT gateway receives the message sent by the second network device.

[0088] For example, CPE1 sends message A (an example of the second message) to the NAT gateway on tunnel one, and CPE2 sends generated message B (another example of the second message) to the NAT gateway on tunnel two.

[0089] S530: The NAT gateway converts the second message.

[0090] The NAT gateway converts the source IP and source port of the received second message to generate a converted message.

[0091] For example, Figure 6As shown, the NAT gateway converts the source IP address 10.1.1.1 and the source port number 5000 in the four-tuple (10.1.1.1, 30.1.1.2, 5000, 5000) in the message A received from CPE1, and obtains the message C corresponding to the new four-tuple (30.1.1.1, 30.1.1.2, 45001, 5000). Similarly, the NAT gateway converts the source IP address 20.1.1.1 and the source port number 5000 in the four-tuple (20.1.1.1, 30.1.1.2, 5000, 5000) in the message B received from CPE2, and obtains the message D corresponding to the new four-tuple (30.1.1.1, 30.1.1.2, 45002, 5000). The source IP addresses in the source packets A and B sent by CPE1 and CPE2 are both converted to 30.1.1.1 after conversion, but the source port numbers are different after conversion. The source port number of packet A from CPE1 is converted to 45001, and the source port number of packet B from CPE2 is converted to 45002.

[0092] S540: The NAT gateway sends the converted message to the first network device.

[0093] Correspondingly, the second network device receives the converted message sent by the NAT gateway.

[0094] For example, the NAT gateway sends a message C to CPE3 on tunnel 1. After receiving message C, CPE3 sees the tunnel (30.1.1.1, 30.1.1.2, 45001, 5000). CPE3 obtains the tunnel identity indicator (45001) for transmitting the message from message C, that is, it determines that the message comes from tunnel 1 according to the source port number 45001 in message C, and determines that the type of tunnel 1 is a GRE tunnel according to the destination port 5000 in the message.

[0095] The NAT gateway sends message D to CPE3 on Tunnel 2. After receiving the message, CPE3 sees the tunnel (30.1.1.1, 30.1.1.2, 45002, 5000). CPE3 obtains the tunnel identity indicator (45002) of the message from message D, that is, it determines that the message comes from Tunnel 2 based on the source port number 45002 in message D, and determines that the type of Tunnel 2 is a GRE tunnel based on the destination port 5000 in the message.

[0096] Correspondingly, when the IP tunnel is decapsulated, the decapsulation table is defined according to the four-tuple. The decapsulation table of CPE3 corresponding to the encapsulation table of CPE1 (10.1.1.1, 30.1.1.2, 5000, 5000) is (30.1.1.2, 10.1.1.1, 5000, 5000). CPE3 performs decapsulation processing according to the decapsulation table information.

[0097] It should be understood that the above-mentioned tunnel 1 and tunnel 2 are of the same tunnel type, so the same port number 5000 can be used for NAT traversal. If tunnel 1 and tunnel 2 are tunnels of different types, for example, tunnel 1 is a GRE tunnel and tunnel 2 is a 6over4 tunnel, when multiple types of tunnels are established, the network devices at both ends of the tunnels can use different port numbers for traversal and hole punching, such as Figure 7 As shown in the figure, for example, CPE1 uses port number 5000 to encapsulate message A1. The four-tuple in CPE1's message A1 is (10.1.1.1, 30.1.1.2, 5000, 5000). CPE2 uses destination port 6000 to encapsulate message B1. The four-tuple in CPE2's message B1 is (10.1.1.1, 30.1.1.2, 6000, 6000). Because the NAT gateway does not convert the destination port numbers in messages A1 and B1, In this way, when CPE3 receives the converted quadruple of message C1 (30.1.1.1, 30.1.1.2, 45001, 5000) and the quadruple of message D1 (30.1.1.1, 30.1.1.2, 45002, 6000), it can confirm the tunnel type according to the destination port number in the UDP header of the converted message. For example, according to the port number 5000, it can determine that tunnel one is a GRE tunnel, and according to the port number 6000, it can determine that tunnel two is a 6over4 tunnel.

[0098] Figure 8 This is a schematic diagram of implementing NAT traversal message encapsulation of multiple tunnel types based on different ports. Figure 7 Taking the NAT traversal shown in the figure as an example, CPE1 uses port number 5000 to implement NAT traversal of the GRE tunnel, and CPE2 uses port number 6000 to implement NAT traversal of the 6over4 tunnel. The UDP header of the GRE NAT traversal encapsulated message includes the source port number 5000 and the destination port number 5000, and the UDP header of the 6over4 NAT traversal encapsulated message includes the source port number 6000 and the destination port number 6000. In actual use, different port numbers can be managed and allocated on the CPE.

[0099] In the above technical solution, a UDP header is added to the encapsulated message of the IP tunnel protocol, and the UDP header includes a source port number and a destination port number. The source port number in the UDP header in the encapsulated message of the second network device corresponds one-to-one to a converted port number in the NAT gateway. The first network device can determine which tunnel the received message is sent from based on the port number converted from the source port number, and can also determine the tunnel type of the sent message based on the destination port number.

[0100] Fig. 9 It is a schematic interaction diagram of another method for transmitting messages provided in an embodiment of the present application.

[0101] Figure 5 The embodiment shown describes a specific method for the second network device to send a message to the first network device through the NAT gateway. Fig. 9 The examples in Figure 5 Based on the above, a method is specifically described on how the first network device replies a message to the second network device through the NAT gateway after receiving the message sent by the second network device.

[0102] S910: The first network device obtains a tunnel identity indication identifier.

[0103] CPE1, CPE2, CPE3 and tunnel information are not described here. Figure 5 Description in the Examples.

[0104] CPE3 (i.e., an example of the first network device) obtains the tunnel identity indicator (45001) for transmitting the message from message C, i.e., determines that the message comes from tunnel 1 according to the source port number 45001 in message C, and determines that the type of tunnel 1 is a GRE tunnel according to the destination port 5000 in the message;

[0105] CPE3 obtains the tunnel identity indicator (45002) of the message D, that is, determines that the message comes from tunnel 2 according to the source port number 45002 in the message D, and determines that the type of tunnel 2 is a GRE tunnel according to the destination port 5000 in the message.

[0106] It should be understood that if the second network device does not send a message to the first network device, the first network device cannot obtain the tunnel identity indication identifier (for example, 45001 in C in the message, 45002 in D in the message) from the received traversal message, but the first network device still needs to actively send a message to the second network device. In this case, the first network device can obtain the port number after NAT traversal through STUN, and the port number information can be used as a tunnel identity indication identifier. The tunnel identity indication identifier can be notified to the first network device through a third-party device, or the first network device can obtain the tunnel identity indication identifier through configuration.

[0107] S920: The first network device establishes a communication tunnel with the second network device according to the tunnel identity indication identifier.

[0108] CPE3 establishes communication with CPE1 (i.e., an example of the second network device) on tunnel one according to the source port number 45001 in message C, and establishes communication with CPE2 (i.e., another example of the second network device) on tunnel two according to the source port number 45002 in message D.

[0109] S930: The first network device sends a first message to the second network device.

[0110] After receiving message C sent by CPE1, CPE3 needs to reply to CPE1 with a message. CPE3 also encapsulates message E (an example of the first message) with an IP header and a UDP header of (30.1.1.2, 30.1.1.1, 5000, 45001) according to the four-tuple. CPE3 sends message E to the NAT gateway on tunnel 1. After conversion by the NAT gateway, the destination address 30.1.1.1 in message E is replaced with 10.1.1.1, and the destination port 45001 is replaced with 5000. The four-tuple of the converted message F is (30.1.1.1, 10.1.1.1, 5000, 5000). The NAT gateway forwards message F to CPE1 according to the destination address 10.1.1.1 and the destination port 5000.

[0111] Similarly, after receiving message D sent by CPE2, CPE3 needs to reply to CPE2. CPE3 also encapsulates message G (another example of the first message) with an IP header and a UDP header of (30.1.1.2, 30.1.1.1, 5000, 45002) according to the four-tuple. CPE3 sends message G to the NAT gateway on tunnel 2. After NAT conversion, the destination address 30.1.1.1 in message G is replaced with 20.1.1.1, and the destination port 45002 is replaced with 5000. The converted message H has a four-tuple of (30.1.1.1, 20.1.1.1, 5000, 5000). The NAT gateway forwards message H to CPE2 according to the destination address 20.1.1.1 and the destination port 5000.

[0112] Optionally, the destination port number in the message F may be used to indicate the type of the first tunnel, and the destination port number in the message H may be used to indicate the type of the second tunnel.

[0113] In the above technical scheme, the first network device obtains the port number corresponding to the second network device on the NAT gateway, establishes a communication tunnel with the second network device according to the port number, and the first network device adds a UDP header to the encapsulated message to be sent, and the UDP header includes a source port number and a destination port number, wherein the destination port number is the port number corresponding to the second network device on the NAT gateway. In this way, after the first network device sends the encapsulated message to the NAT gateway on the corresponding tunnel, the NAT gateway can determine to send the message to the second network device according to the destination port number in the message, and can also determine the tunnel type of the sent message according to the destination port number after NAT conversion.

[0114] As can be seen from the above, when multiple tunnel types exist at the same time, the above solution needs to distinguish different tunnel types through different destination port numbers, which increases the management tasks of the port numbers.

[0115] In view of this, an embodiment of the present application provides a method, in which, when there are multiple tunnel types and the network devices at both ends of the tunnel use only one port number for NAT traversal, the first network device can also distinguish different tunnel types based on the information in the received message to reduce the management task of the port number.

[0116] Fig.10 It is a schematic diagram of another method for transmitting messages provided in an embodiment of the present application.

[0117] exist Figure 5 On the basis of the described technical solution, a communication tunnel type indicator is encapsulated behind the UDP header of the NAT traversal message of the non-IPSEC tunnel. For example, the communication tunnel type indicator can be carried in the security parameter index (SPI) of the traversal message. In this way, even when a port number is used for NAT hole punching, CPE3 can distinguish the tunnel type according to the communication tunnel type indicator information in the security parameter index.

[0118] Fig.11 This is a diagram of the standard IPSEC NAT traversal encapsulation format. Standard IPSEC NAT traversal is achieved by adding a UDP header to the encapsulating security payload (ESP) protocol. Fig.12 This is a schematic diagram of the ESP header structure in the standard IPSEC NAT traversal encapsulation. The IPSEC ESP header includes the ESP header, encryption part, and ESP authentication. Among them, the first four bytes of the ESP header are SPI. The SPI value range specified in the standard is 256-0xFFFFFFFF. The SPI values ​​0, 1, and 2 have been defined by the standard, and 3-255 are not defined. Fig.13 This is a schematic diagram of multi-tunnel type NAT traversal message encapsulation based on SPI value. The NAT traversal message of non-IPSEC tunnel can be Figure 8 On the basis of the encapsulation shown, four bytes of SPI fields of different sizes in the ESP message header of IPSEC are encapsulated behind the UDP header, and undefined values ​​in the SPI are used to indicate the type of the tunnel. For example, the GRE tunnel and the 6over4 tunnel use the same NAT traversal port number 5000, and SPI=255 indicates that the tunnel type is the GRE tunnel, and SPI=254 indicates that the tunnel type is the 6over4 tunnel.

[0119] The following example uses the second network device as CPE1 or CPE2 and the first network device as CPE3. CPE1 and CPE3 communicate on tunnel 1, and CPE2 and CPE3 communicate on tunnel 2. NAT gateways are deployed at the exits of CPE1 and CPE2, and tunnel 1 is a GRE tunnel and tunnel 2 is a 6over4 tunnel. CPE3 uses port 5000 for NAT hole punching on both tunnels.

[0120] When the second network device is CPE1, the CPE1 message encapsulation and transmission process is as follows:

[0121] CPE1 encapsulates the packet A2 with an IP header and a UDP header of (10.1.1.1, 30.1.1.2, 5000, 5000) according to the four-tuple, and then encapsulates four bytes of SPI of different sizes after the UDP header. SPI = 255 indicates that the type of tunnel 1 is a GRE tunnel. After the NAT gateway conversion, the source address 10.1.1.1 of the packet A2 is replaced with 30.1.1.1, and the source port 5000 is replaced with 45001. The converted four-tuple of the packet C2 is (30.1.1.1, 30.1.1.2, 4 5001,5000), and forwards message C2 to CPE3 according to the destination address 30.1.1.2 and the destination port 5000. At this time, the IP header, UDP header and SPI of message C2 received by CPE3 are (30.1.1.1,30.1.1.2,45001,5000,255). CPE3 determines the tunnel information of the transmitted message according to the source port number 45001 in message C2, that is, according to the source port number 45001, it determines that message C2 comes from tunnel 1, and at the same time, it can determine that the type of tunnel 1 is a GRE tunnel according to SPI=255.

[0122] When the second network device is CPE2, the CPE2 message encapsulation and transmission process is as follows:

[0123] CPE2 encapsulates the packet B2 with an IP header and a UDP header of (20.1.1.1, 30.1.1.2, 5000, 5000) according to the four-tuple, and then encapsulates four bytes of SPI of different sizes after the UDP header. Using SPI = 254 indicates that the type of tunnel 2 is a 6over4 tunnel. After the NAT gateway conversion, the source address 20.1.1.1 of the packet B2 is replaced with 30.1.1.1, and the source port 5000 is replaced with 45002. The converted packet D2 has a four-tuple of (30.1.1.1, 30.1.1.2, 45 002,5000), and forwards message D2 to CPE3 according to the destination address 30.1.1.2 and the destination port 5000. At this time, the message D2 received by CPE3 has an IP header, a UDP header and an SPI of (30.1.1.1, 30.1.1.2, 45002, 5000, 254). CPE3 determines the tunnel information of the transmission message D2 according to the source port number 45002 in the message D2, that is, according to the source port number 45002, it determines that the message D2 comes from tunnel 2, and at the same time, it can determine that the type of tunnel 2 is a 6over4 tunnel according to SPI=255.

[0124] In the above technical solution, all tunnels use UDP messages with the same port number to make holes in NAT traversal, and an SPI field is added after the UDP message. In this way, the first network device can determine which tunnel the message comes from by the source port number in the received message, and can also determine the type of tunnel transmitting the message according to the different values ​​of the SPI field in the message, thereby reducing the management task of the port number.

[0125] Fig.14 It is a schematic interaction diagram of another method for transmitting messages provided in an embodiment of the present application.

[0126] Fig.10 The embodiment in describes a specific method for the second network device to send a message to the first network device through the NAT gateway. Fig.14 The examples in Fig.10 Based on the above, a method is specifically described on how the first network device replies a message to the second network device through the NAT gateway after receiving the message sent by the second network device.

[0127] S1410: The first network device obtains a tunnel identity indication identifier.

[0128] CPE1, CPE2, CPE3 and tunnel information are not described here. Fig.10 Description in the Examples.

[0129] CPE3 (i.e., an example of the first network device) obtains the tunnel identity indicator (45001) of the message C2, and determines that the message comes from tunnel 1 according to the source port number 45001, and confirms that the type of tunnel 1 is a GRE tunnel according to SPI=255 in the message;

[0130] CPE3 obtains the tunnel identity indicator (45002) of the message D2, determines that the message comes from tunnel 2 according to the source port number 45002, and determines that the type of tunnel 2 is a 6over4 tunnel according to SPI=254 in the message.

[0131] It should be understood that if the second network device does not send a message to the first network device, the first network device cannot obtain the tunnel identity indication identifier (for example, 45001 in C2 in the message, 45002 in D2 in the message) from the received traversal message. However, when the first network device still needs to actively send a message to the second network device, the first network device can obtain the port number after NAT traversal through STUN. The port number information can be used as a tunnel identity indication identifier. The tunnel identity indication identifier can be notified to the first network device through a third-party device, or the first network device can obtain the tunnel identity indication identifier through configuration.

[0132] S1420: The first network device establishes a communication tunnel with the second network device according to the tunnel identity indication identifier.

[0133] CPE3 establishes communication with CPE1 (i.e., an example of the second network device) on tunnel one according to source port number 45001 in message C2, and establishes communication with CPE2 (i.e., another example of the second network device) on tunnel two according to source port number 45002 in message D2.

[0134] S1430, the first network device determines the port information and SPI value in the UDP header.

[0135] After receiving the message C2 sent by CPE1, CPE3 needs to reply to CPE1. CPE3 also encapsulates the message E1 with an IP header and a UDP header of (30.1.1.2, 30.1.1.1, 5000, 45001) according to the four-tuple, and then encapsulates four bytes of SPI of different sizes after the UDP header. For example, using SPI = 255 indicates that the type of tunnel 1 is a GRE tunnel.

[0136] Similarly, after receiving the message D1 sent by CPE2, CPE3 needs to reply to CPE2. CPE3 also encapsulates the message G1 with the IP header and UDP header (30.1.1.2, 30.1.1.1, 5000, 45002) according to the four-tuple, and then encapsulates four bytes of SPI of different sizes after the UDP header. For example, using SPI=254 indicates that the type of tunnel 2 is a 6over4 tunnel.

[0137] S1440: The first network device sends a first message to the second network device.

[0138] CPE3 sends message E1 (an example of the first message) to the NAT gateway on tunnel 1. After conversion by the NAT gateway, the destination address 30.1.1.1 in message E1 is replaced by 10.1.1.1, and the destination port 45001 is replaced by 5000. The quadruple and SPI of the converted message F1 are (30.1.1.1, 10.1.1.1, 5000, 5000, 255). The NAT gateway forwards message F1 to CPE1 according to the destination address 10.1.1.1 and the destination port 5000. CPE1 confirms that the type of tunnel 1 is a GRE tunnel based on SPI=255 in the message.

[0139] CPE3 sends message G1 (another example of the first message) to the NAT gateway on tunnel 2. After NAT conversion, the destination address 30.1.1.1 in message G1 is replaced by 20.1.1.1, and the destination port 45002 is replaced by 5000. The quadruple and SPI of the converted message G1 are (30.1.1.1, 20.1.1.1, 5000, 5000, 254). The NAT gateway forwards message H1 to CPE2 according to the destination address 20.1.1.1 and the destination port 5000. At the same time, CPE2 confirms that the type of tunnel 2 is a 6over4 tunnel based on SPI=254 in the message.

[0140] In the above technical solution, the first network device can determine which tunnel to send a message on by obtaining a tunnel identity indication identifier. At the same time, all tunnels use UDP messages with the same port number to traverse NAT, and add an SPI field after the UDP message to indicate the tunnel type. After receiving the message, the second network device can determine the type of tunnel that transmits the message based on the different values ​​of the SPI field in the message, thereby reducing the management task of the port number.

[0141] The various embodiments described in this application may be independent solutions or may be combined according to internal logic, and these solutions all fall within the protection scope of this application.

[0142] It can be understood that, in the above-mentioned various method embodiments, the methods and operations implemented by the network device can also be implemented by components (such as chips or circuits) that can be used in the network device.

[0143] The following is an introduction to the device for transmitting messages provided by the present application.

[0144] See also Fig.15 , Fig.15 1 is a schematic block diagram of a communication device 1000 provided in this application. Fig.15 As shown, the communication device 1000 includes: a processing unit 1100 and a transceiver unit 1200 .

[0145] Processing unit 1100 is used to obtain a tunnel identity indication identifier, which includes a port number corresponding to a second network device; processing unit 1100 is also used to establish a communication tunnel with the second network device according to the tunnel identity indication identifier; transceiver unit 1200 is used to send a first message to the second network device through the communication tunnel, wherein the first message includes the tunnel identity indication identifier.

[0146] Optionally, the port number corresponding to the second network device is the port number of the second network device after conversion by a network address translation NAT gateway.

[0147] Optionally, the first message includes a first User Datagram Protocol UDP message header, and the tunnel identity indication identifier is a destination port number in the first UDP message header.

[0148] Optionally, the destination port number in the first UDP message header is converted by the NAT gateway and is used to indicate the type of the communication tunnel.

[0149] Optionally, the first message also includes a type indication identifier of the communication tunnel.

[0150] Optionally, the communication tunnel identifier is carried in the security parameter index of the message.

[0151] Optionally, the communication tunnel is an IP communication tunnel.

[0152] Optionally, the transceiver unit 1200 may also be replaced by a sending unit or a receiving unit. For example, when the transceiver unit 1200 performs a sending action, it may be replaced by a sending unit. When the transceiver unit 1200 performs a receiving action, it may be replaced by a receiving unit.

[0153] Optionally, the communication apparatus 1000 may be a first network device that can be used to transmit messages, or a device, component, etc. in the first network device that can implement the functions of the first network device in the above method embodiment.

[0154] For example, the transceiver unit 1200 may be a transceiver. The transceiver may be replaced by a receiver or a transmitter. For example, when the transceiver performs a sending action, it may be replaced by a transmitter. When the transceiver performs a receiving action, it may be replaced by a receiver. The processing unit 1100 may be a processing device or a processor, which is not limited here.

[0155] Optionally, the communication device 1000 may be a circuit system installed in the first network device, for example, a chip or a system on chip (SoC). The processing unit 1100 and the transceiver unit 1200 may each be a module or unit of the circuit system, or all functions thereof may be implemented by one module or unit. In this implementation, the transceiver unit 1200 may be a communication interface. For example, the transceiver unit 1200 may be an input-output interface or an input-output circuit. The input-output interface may include an input interface and an output interface. The input-output circuit may include an input circuit and an output circuit.

[0156] The functions of the processing device in the above device embodiment may be implemented by hardware, or by hardware executing corresponding software.

[0157] For example, the processing device may include one or more memories and one or more processors, wherein the one or more memories are used to store computer programs, and the one or more processors read and execute the computer programs stored in the one or more memories, so that the communication device 1000 performs the operations and / or processing performed by the first network device in each method embodiment.

[0158] Alternatively, the processing device may only include a processor, and a memory for storing the computer program is located outside the processing device. The processor is connected to the memory through circuits / wires to read and execute the computer program stored in the memory.

[0159] Optionally, the transceiver unit 1200 may be a radio frequency device.

[0160] See also Fig.16 , Fig.16 1 is a schematic structural diagram of the communication device 10 provided in this application. Fig.16 As shown, the communication device 10 includes: one or more processors 11, one or more memories 12, and one or more communication interfaces 13. Among them, the processor 11 is used to control the communication interface 13 to send and receive signals, the memory 12 is used to store computer programs, and the processor 11 is used to call and run the computer program from the memory 12, so that the communication device 10 performs the processing and / or operation performed by the first network device in each method embodiment of the present application.

[0161] For example, the processor 11 may integrate Fig.15The function of the processing unit 1100 in the communication interface 13 may have Fig.15 The functions of the transceiver unit 1200 are shown in FIG. Fig.15 The detailed description in the section will not be repeated here.

[0162] Optionally, when the communication device 10 is a first network device, the processor 11 may be a baseband device installed in the first network device, and the communication interface 13 may be a radio frequency device.

[0163] Optionally, the memory and the processor in the above-mentioned device embodiments may be physically independent units, or the memory may be integrated with the processor.

[0164] In addition, the present application also provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the operations and / or processing performed by the first network device in the method for transmitting a message provided in the present application.

[0165] The present application also provides a computer program product, which includes a computer program code. When the computer program code runs on a computer, the computer executes the operations and / or processing performed by the first network device in the method for transmitting a message provided in the present application.

[0166] The present application also provides a communication device, including a processor and an interface circuit, wherein the interface circuit is used to receive computer code or instructions and transmit them to the processor, and the processor is used to run the computer code or instructions to execute the operations and / or processing performed by the first network device in the method for transmitting messages provided in the present application.

[0167] The present application also provides a chip, the chip comprising one or more processors. The one or more processors are used to execute a computer program stored in a memory to perform the operation and / or processing performed by the first network device in any one of the method embodiments. The memory for storing the computer program is set independently of the chip.

[0168] Furthermore, the chip may further include one or more communication interfaces. The one or more communication interfaces may be input / output interfaces, input / output circuits, and the like.

[0169] Furthermore, the chip may also include one or more memories.

[0170] The present application also provides a communication system, including the first network device, the second network device and the NAT gateway in the embodiment of the present application.

[0171] The processor in the embodiment of the present application can be an integrated circuit chip with the ability to process signals. In the implementation process, each step of the above method embodiment can be completed by the hardware integrated logic circuit or software instructions in the processor. The processor can be a general processor, a digital signal processor (digital signal processor, DSP), an application specific integrated circuit (application specific integrated circuit, ASIC), a field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware coding processor to perform, or the hardware and software modules in the coding processor are combined to perform. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, and other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0172] The memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus RAM (DRRAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0173] The terms "unit", "system", etc. used in this specification are used to represent computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, and / or a computer. By way of illustration, both applications running on a computing device and a computing device can be components. One or more components may reside in a process and / or an execution thread. A component may be located on a computer and / or distributed between two or more computers. In addition, these components may be executed from various computer-readable media having various data structures stored thereon. Components may communicate through local and / or remote processes according to signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, and / or a network, for example, the Internet interacting with other systems through signals).

[0174] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0175] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0176] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0177] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0178] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0179] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk, or an optical disk.

[0180] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for transmitting a message, characterized in that: The method is applied to traversal of a network address translation NAT gateway between a first network device and a second network device, and includes: The first network device obtains a tunnel identity indication identifier, where the tunnel identity indication identifier includes a port number corresponding to the second network device; The first network device establishes a communication tunnel with the second network device according to the tunnel identity indication identifier; The first network device sends a first message to the second network device through the communication tunnel, where the first message includes the tunnel identity indication identifier.

2. The method according to claim 1, characterized in that The port number corresponding to the second network device is the port number of the second network device after being converted by a network address translation NAT gateway.

3. The method according to claim 1, characterized in that The first message includes a first User Datagram Protocol UDP message header, and the tunnel identity indicator is a destination port number in the first UDP message header.

4. The method according to claim 3, characterized in that The port number after the destination port number in the first UDP message header is converted by the NAT gateway is used to indicate the type of the communication tunnel.

5. The method according to any one of claims 1 to 3, characterized in that: The first message also includes a type indication identifier of the communication tunnel.

6. The method according to claim 5, characterized in that The type indication identifier of the communication tunnel is carried in the security parameter index of the first message.

7. The method according to any one of claims 1 to 3, characterized in that: The communication tunnel is an IP communication tunnel.

8. A device for transmitting a message, characterized in that: The device is used for traversing a network address translation NAT gateway between a second network device, and includes: A processing unit, configured to obtain a tunnel identity indication identifier, wherein the tunnel identity indication identifier includes a port number corresponding to the second network device; The processing unit is further configured to establish a communication tunnel with the second network device according to the tunnel identity indication identifier; A transceiver unit is used to send a first message to the second network device through the communication tunnel, wherein the first message includes the tunnel identity indication identifier.

9. The device according to claim 8, characterized in that The port number corresponding to the second network device is the port number of the second network device after being converted by a network address translation NAT gateway.

10. The device according to claim 8, characterized in that The first message includes a first User Datagram Protocol UDP message header, and the tunnel identity indicator is a destination port number in the first UDP message header.

11. The device according to claim 10, characterized in that The port number after the destination port number in the first UDP message header is converted by the NAT gateway is used to indicate the type of the communication tunnel.

12. The device according to any one of claims 8 to 10, characterized in that The first message also includes a type indication identifier of the communication tunnel.

13. The device according to claim 12, characterized in that The type indication identifier of the communication tunnel is carried in the security parameter index SPI of the message.

14. The device according to any one of claims 8 to 10, characterized in that The communication tunnel is an IP communication tunnel.

15. A communication device, characterized in that: The communication device comprises at least one processor and a communication interface, wherein the at least one processor is configured to execute a computer program or instruction so that the communication device executes the method according to any one of claims 1 to 7.

16. The communication device according to claim 15, characterized in that: The apparatus further comprises at least one memory coupled to the at least one processor, the computer program or instructions being stored in the at least one memory.

17. A computer-readable storage medium, characterized in that: Used to store computer instructions, when the computer instructions are executed, the method according to any one of claims 1 to 7 is implemented.

18. A communication system, characterized in that: It comprises a communication device as described in any one of claims 8 to 16 and a network address translation NAT gateway.

Images