A method and device for predicting public network addresses of symmetric NAT networks

Abstract

The present application provides a method and device for predicting a public network address of a symmetric NAT network, which can be used in the financial field or other fields. The method includes: receiving a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; jointly establishing a hole punching equation group according to the first hole punching message, the second hole punching message, the first public network address port mapping relationship and the second public network address port mapping relationship, and solving the hole punching equation group to obtain all feasible hole punching schemes; randomly selecting a hole punching scheme, and sending the address port information required for hole punching to the first user terminal and the second user terminal according to the selected hole punching scheme. The device is used to execute the above method. The method and device for predicting a public network address of a symmetric NAT network provided by the present application realize the prediction of the public network address of the symmetric NAT network, prevent the leakage of the intranet address, and after the hole punching is completed, a third-party server is no longer required for forwarding, which saves costs and ensures information security.

Description

Technical Field

[0001] The present application relates to the financial field, and in particular to a method and device for predicting a public network address of a symmetric NAT network. Background Art

[0002] In computer networks, Network Address Translation (NAT) is a technology that rewrites the source IP address or destination IP address when an IP data packet passes through a router or firewall. Network Address Port Translation (NATP) is one of the NAT implementation strategies. When an intranet host communicates with a public network host, the intranet IP address will be converted by the NAT device to the corresponding public network address in the NAT table. NAT can be divided into full cone NAT, restricted cone NAT, port restricted cone NAT and symmetric NAT.

[0003] In the prior art, intranet penetration is mainly achieved through P2P hole punching and relay server forwarding. Figure 1 As shown, after the IP addresses and ports of client A1 and client B1 are converted to the external network through NAT router gateway A2 and NAT router gateway B2 respectively, notification messages are sent to public network information exchange server C, and public network information exchange server C forwards the public network address of client A1 to client B1, and forwards the public network address of client B1 to client A1 to achieve hole punching. However, in symmetric NAT, any change in the IP and port of the sender and the IP and port of the receiver will cause the public network address of the sender to change, so P2P hole punching is only applicable to three types of cone NAT, and communication between symmetric NATs cannot be achieved.

[0004] The process of relay server forwarding is as follows Figure 2 As shown, it includes NAT router gateway A2 and NAT router gateway B2, public network relay server C has a fixed IP address and port, user terminal A1 and user terminal B1 actively establish a stable connection channel with public network relay server C, which are respectively denoted as α and β; public network relay server C realizes direct connection between α and β according to the corresponding forwarding rules. The data packet sent by user terminal A1 to relay server C through α will be forwarded to β, and then reach user terminal B1; the data packet sent by user terminal B1 to relay server C through β will be forwarded to α, and then reach user terminal A1, indirectly realizing P2P data transmission. However, this method requires additional fees to be paid to the relay server, which is costly, and the transmitted content may be captured and stolen by the service provider providing the relay server, causing information security risks. Summary of the invention

[0005] In response to the problems in the prior art, the present application provides a method and device for predicting a public network address in a symmetric NAT network, which can at least partially solve the problems in the prior art.

[0006] In a first aspect, the present application provides a method for predicting a public network address of a symmetric NAT network, comprising:

[0007] Receive a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; the first hole punching message includes a first estimated hole punching time and encrypted first source address data, and the second hole punching message includes a second estimated time and encrypted second source address data;

[0008] A group of puncturing equations is established according to the first puncturing message, the second puncturing message, the first public network address-port mapping relationship, and the second public network address-port mapping relationship, and all feasible puncturing schemes are obtained by solving the group of puncturing equations;

[0009] A hole punching scheme is randomly selected, and first address port information required for hole punching is sent to the first user terminal according to the selected hole punching scheme, and second address port information required for hole punching is sent to the second user terminal.

[0010] Wherein, the first source address data includes first source IP address data and first source port data, and the second source address data includes second source IP address data and second source port data;

[0011] The sending the first address port information required for hole punching to the first user terminal includes:

[0012] Sending the public IP address data and public port data of the second user terminal to the first user terminal;

[0013] The sending the second address port information required for hole punching to the second user terminal includes:

[0014] Send the public IP address data and public port data of the first user terminal to the second user terminal.

[0015] Wherein, the first source address data includes first source IP address data, and the second source address data includes second source IP address data;

[0016] The sending the first address port information required for hole punching to the first user terminal includes:

[0017] Sending the encrypted first source port data, the public network IP address data and the public network port data of the second user terminal to the first user terminal;

[0018] The sending the second address port information required for hole punching to the second user terminal includes:

[0019] The encrypted second source port data, the public IP address data and the public port data of the first user terminal are sent to the second user terminal.

[0020] Among them, it also includes:

[0021] Receiving hole punching failure information sent by the first user terminal and / or the second user terminal;

[0022] A hole punching scheme is selected again from all feasible hole punching schemes, and the third address port information required for hole punching is sent to the first user terminal according to the again selected hole punching scheme, and the fourth address port information required for hole punching is sent to the second user terminal.

[0023] Wherein, the first source address data includes first source IP address data and first source port data, and the second source address data includes second source IP address data and second source port data;

[0024] The step of obtaining the first public network address-port mapping relationship comprises:

[0025] Using different IP addresses to receive multiple first hole punching messages sent by the first user terminal;

[0026] Obtain the public network address data and destination address data corresponding to each first hole punching message from the TCP network layer, and use the message sending time, first source address data, public network address data and destination address data of a hole punching message as a set of training data;

[0027] Using the training data to perform regression analysis to obtain the first public network address-port mapping relationship, where the first public network address-port mapping relationship is a mapping relationship between the encrypted first source address data, message sending time, and destination address data and the public network address data;

[0028] The step of obtaining the second public network address-port mapping relationship comprises:

[0029] Using different IP addresses to receive multiple second hole punching messages sent by the second user end, the second hole punching messages including message sending time and encrypted second source address data;

[0030] Obtaining the public network address data and the destination address data of each second hole punching message from the TCP network layer, and using the second source address data, the public network address data, the destination address data and the message sending time of a hole punching message as a set of training data;

[0031] The second public network address-port mapping relationship is obtained by performing regression analysis using the training data. The second public network address-port mapping relationship is a mapping relationship between the encrypted second source address data, message sending time, and destination address data and the public network address data.

[0032] Wherein, before receiving the first hole punching message sent by the first user terminal and the second hole punching message sent by the second user terminal, the method further includes:

[0033] Receive the homomorphic encryption key sent by the first user terminal, and forward the homomorphic encryption key to the second user terminal.

[0034] In a second aspect, the present application provides a symmetric NAT network public address prediction device, comprising:

[0035] A hole punching message receiving unit, configured to receive a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; the first hole punching message includes a first estimated hole punching time and encrypted first source address data, and the second hole punching message includes a second estimated hole punching time and encrypted second source address data;

[0036] a hole punching scheme calculation unit, configured to simultaneously establish a hole punching equation group according to the first hole punching message, the second hole punching message, the first public network address-port mapping relationship, and the second public network address-port mapping relationship, and solve the hole punching equation group to obtain all feasible hole punching schemes;

[0037] The hole punching information sending unit is used to randomly select a hole punching scheme, and send the first address port information required for hole punching to the first user end according to the selected hole punching scheme, and send the second address port information required for hole punching to the second user end.

[0038] In a third aspect, the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in any one of the above embodiments when executing the computer program.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any of the above embodiments is implemented.

[0040] In a fifth aspect, a computer program product is provided, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the method described in any one of the above embodiments is implemented.

[0041] The present application provides a symmetric NAT network public address prediction method and device, which receive a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; obtain all feasible hole punching schemes according to the first hole punching message, the second hole punching message, the first public network address port mapping relationship and the second public network address port mapping relationship; randomly select a hole punching scheme, and send the first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and send the second address port information required for hole punching to the second user terminal, thereby realizing the prediction of the symmetric NAT network public address, and being able to adjust the size of the solution space by adjusting the content of the source address data to meet different requirements for a single hit rate and an overall hit rate. During the prediction process, the intranet address data received and predicted by the server are all encrypted data, thereby preventing the leakage of the intranet address and ensuring the security of the intranet address. After the hole punching is completed, a third-party server is no longer required to forward information, thereby saving costs and preventing information leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 Schematic diagram of the process of drilling holes for P2P;

[0044] Figure 2 A schematic diagram of the process of forwarding to a relay server;

[0045] Figure 3 It is a flow chart of a method for predicting a public network address of a symmetric NAT network provided by an embodiment of the present application;

[0046] Figure 4 It is a flow chart of a method for predicting a public network address of a symmetric NAT network provided by an embodiment of the present application;

[0047] Figure 5 This is a flowchart of obtaining a first public network address port mapping relationship provided by an embodiment of the present application;

[0048] Figure 6 This is a flowchart of obtaining a second public network address port mapping relationship provided by an embodiment of the present application;

[0049] Figure 7 It is a flow chart of a method for predicting a public network address of a symmetric NAT network provided by an embodiment of the present application;

[0050] Figure 8It is a structural diagram of a symmetric NAT network public address prediction device provided by an embodiment of the present application;

[0051] Fig. 9 It is a structural diagram of a symmetric NAT network public address prediction device provided by an embodiment of the present application;

[0052] Fig.10 It is a structural diagram of a symmetric NAT network public address prediction device provided by an embodiment of the present application;

[0053] Fig.11 It is a structural diagram of a symmetric NAT network public address prediction device provided by an embodiment of the present application;

[0054] Fig.12 It is a schematic diagram of the physical structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical scheme and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention. It should be noted that, in the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other arbitrarily.

[0056] It should be noted that the customer information mining method and device disclosed in this application can be used in the field of financial technology, and can also be used in any field other than the field of financial technology. The application field of the customer information mining method and device disclosed in this application is not limited.

[0057] The following first briefly describes the basic concepts involved in this application.

[0058] Network Address Translation (NAT): In computer networking, Network Address Translation is a technology that rewrites the source or destination IP address of an IP packet as it passes through a router or firewall.

[0059] Network address translation mainly includes Network Address Port Translation (NATP), Full Cone NAT (Full cone NAT), Restricted Cone NAT (Address-Restricted cone NAT), Port Restricted Cone NAT (Port-Restricted cone NAT) and Symmetric NAT (Symmetric NAT).

[0060] Among them, symmetric NAT means that every request from the same internal IP and port to a specific destination IP and port is mapped to a different external IP and port; if any of the internal IP, internal port, destination IP and destination port changes, the mapped external IP and port will also change; only external hosts that have received data from the internal host can send data packets back.

[0061] The following takes the server as an example of the execution subject to illustrate the specific implementation process of the symmetric NAT network public address prediction method provided by the embodiment of the present invention.

[0062] Figure 3 is a flowchart of a method for predicting a public network address of a symmetric NAT network provided by an embodiment of the present application, such as Figure 3 As shown, the symmetric NAT network public address prediction method provided by the present application includes:

[0063] S301: Receive a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; the first hole punching message includes a first estimated arrival time and encrypted first source address data, and the second hole punching message includes a second estimated arrival time and encrypted second source address data;

[0064] S302: According to the first hole punching message, the second hole punching message, the first public network address-port mapping relationship, and the second public network address-port mapping relationship, a group of hole punching equations is jointly established, and all feasible hole punching schemes are obtained by solving the group of hole punching equations;

[0065] S303: randomly selecting a hole punching scheme, and sending first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and sending second address port information required for hole punching to the second user terminal.

[0066] The present application provides a symmetric NAT network public address prediction method, which receives a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; obtains all feasible hole punching schemes according to the first hole punching message, the second hole punching message, the first public network address port mapping relationship and the second public network address port mapping relationship; randomly selects a hole punching scheme, and sends the first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and sends the second address port information required for hole punching to the second user terminal, thereby realizing the prediction of the symmetric NAT network public address, and being able to adjust the size of the solution space by adjusting the content of the source address data to meet different requirements for a single hit rate and an overall hit rate. During the prediction process, the intranet address data received and predicted by the server are all encrypted data, thereby preventing the leakage of the intranet address and ensuring the security of the intranet address. After the hole punching is completed, a third-party server is no longer required to forward information, thereby saving costs and preventing information leakage.

[0067] Each step is described in detail below.

[0068] S301: Receive a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; the first hole punching message includes a first estimated time and encrypted first source address data, and the second hole punching message includes a second estimated time and encrypted second source address data;

[0069] Specifically, the first user end homomorphically encrypts the first source address data used for communication with the second end, and generates a first hole punching message together with the first expected hole punching time and sends it to the server; the second user end homomorphically encrypts the second source address data used for communication with the first end, and generates a second hole punching message together with the second expected hole punching time and sends it to the server. The server receives the first hole punching message and the second hole punching message. The first expected hole punching time is the time when the first user end is expected to send a message to the second user end for hole punching, and the second expected hole punching time is the time when the second user end is expected to send a message to the first user end for hole punching.

[0070] S302: According to the first hole punching message, the second hole punching message, the first public network address-port mapping relationship, and the second public network address-port mapping relationship, a group of hole punching equations is jointly established, and all feasible hole punching schemes are obtained by solving the group of hole punching equations;

[0071] Specifically, the server obtains the following set of equations according to the received first hole punching message, the second hole punching message, and the pre-obtained first public network address-port mapping relationship and the second public network address-port mapping relationship:

[0072]

[0073] Among them, f is the first public network address port mapping relationship, f' is the second public network address port mapping relationship, iAddr is the first source IP address data, iport is the first source port data, i'Addr is the second source IP address data, i'port is the second source port data, t is the first estimated hole punching time, t' is the second estimated hole punching time, eAddr is the public network IP address data of the first user end, eport is the public network port data of the first user end, e'addr is the public network IP address data of the second user end, and e'port is the public network port data of the second user end. The first source address data in the first hole punching message includes the first source IP address data or the first source IP address data and the first source port data, and the second source address data in the second hole punching message includes the second source IP address data or the second source IP address data and the second source port data.

[0074] The server obtains the solution space of the equation group by solving equation group (1). Each feasible solution in the solution space is a feasible hole punching scheme.

[0075] S303: randomly selecting a hole punching scheme, and sending first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and sending second address port information required for hole punching to the second user terminal.

[0076] Specifically, the server randomly selects a hole punching scheme from all feasible hole punching schemes, sends the address port data required for the first user terminal to punch a hole in the hole punching scheme to the first user terminal, and sends the address port data required for the second user terminal to punch a hole in the hole punching scheme to the second user terminal.

[0077] In one embodiment, the first source address data includes first source IP address data and first source port data, and the second source address data includes second source IP address data and second source port data;

[0078] At this time, the first address port information required for hole punching is sent to the first user terminal, including:

[0079] Sending the public IP address data and public port data of the second user terminal to the first user terminal;

[0080] Specifically, it can be seen from equation group (1) that the known data in the equation group at this time are the first source IP address data iAddr, the first source port data iport, the first estimated hole punching time t, the second source IP address data i'Addr, the second source port data i'port, and the second estimated hole punching time t'. Therefore, each feasible solution of the equation group contains a set of possible values ​​of the first user end's public network IP address data eAddr, the first user end's public network port data eport, the second user end's public network IP address data e'Addr and the second user end's public network port data e'port.

[0081] The server sends the second client's public IP address data e'Addr and the second client's public port data e'port in the selected hole punching scheme as the first address port information to the first client. The first client sends a message from (iAddr, iport) to (e'Addr, e'port) at the first estimated hole punching time t to punch a hole.

[0082] Sending the second address port information required for hole punching to the second user terminal includes:

[0083] The public IP address data and public port data of the first user terminal are sent to the second user terminal.

[0084] Specifically, the server sends the first client's public IP address data eAddr and the first client's public port data eport in the selected hole punching scheme as the second address port information to the second client. The second client sends a message from (i'Addr, i'port) to (eAddr, eport) to punch a hole at the second estimated hole punching time t'.

[0085] At this time, the first source address data and the second source address data contain more information, the equation group (1) has fewer unknowns and more constraints, the resulting solution space is smaller, and the success rate of a single hole punching of each feasible solution in the solution space is higher. This solution is suitable for scenarios where fast hole punching is required.

[0086] In one embodiment, the first source address data includes first source IP address data, and the second source address data includes second source IP address data;

[0087] At this time, the first address port information required for hole punching is sent to the first user terminal, including:

[0088] Sending the encrypted first source port data, the public network IP address data and the public network port data of the second user terminal to the first user terminal;

[0089] Specifically, it can be known from equation group (1) that the known data in the equation group at this time are the first source IP address data iAddr, the first estimated hole punching time t, the second source IP address data i'Addr and the second estimated hole punching time t'. Therefore, each feasible solution of the equation group contains a set of possible values ​​of the first source port data iport, the public network IP address data eAddr of the first user end, the public network port data eport of the first user end, the second source port data i'port, the public network IP address data e'Addr of the second user end and the public network port data e'port of the second user end.

[0090] The server sends the second user's public IP address data e'addr, the second user's public port data e'port, and the encrypted first source port data iport in the selected hole punching scheme as the first address port information to the first user. The first user decrypts the first source port data to obtain the first source port data iport, and sends a message from (iAddr, iport) to (e'Addr, e'port) at the first estimated hole punching time t to punch a hole.

[0091] Sending the second address port information required for hole punching to the second user terminal includes:

[0092] The encrypted second source port data, the public IP address data and the public port data of the first user terminal are sent to the second user terminal.

[0093] Specifically, the server sends the first user end's public network IP address data eaddr, the first user end's public network port data eport, and the second source port data i'port in the selected hole punching scheme as the second address port information to the second user end. The second user end decrypts the second source port data to obtain the second source port data i'port, and sends a message from (i'Addr, i'port) to (eAddr, eport) at the second estimated hole punching time t' to perform hole punching.

[0094] At this time, the first source address data and the second source address data only contain the corresponding source IP address data. There are more unknowns in equation group (1) and fewer restrictions, so a larger solution space can be obtained. There are more feasible hole punching schemes to try, and the overall hole punching success rate after trying all the hole punching schemes is higher. This solution is suitable for scenarios where there is no high time limit requirement but the final hole punching success rate needs to be guaranteed.

[0095] The symmetric NAT network public address prediction method provided by the present application receives a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; obtains all feasible hole punching schemes according to the first hole punching message, the second hole punching message, the first public network address port mapping relationship and the second public network address port mapping relationship; randomly selects a hole punching scheme, and sends the first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and sends the second address port information required for hole punching to the second user terminal, thereby realizing the prediction of the symmetric NAT network public address, and being able to adjust the size of the solution space by adjusting the content of the source address data to meet different requirements for single hit rate and overall hit rate. After the hole punching is completed, a third-party server is no longer required to forward information, thereby saving costs and preventing information leakage.

[0096] Figure 4 is a flowchart of a method for predicting a public network address of a symmetric NAT network provided by an embodiment of the present application, such as Figure 4 As shown, on the basis of the above embodiments, further, when the hole punching fails, the symmetric NAT network public address prediction method provided by the present application also includes:

[0097] S401: receiving hole punching failure information sent by a first user terminal and / or a second user terminal;

[0098] Specifically, when a hole punching fails, the first user terminal and / or the second user terminal sends a hole punching failure message to the server. After receiving the hole punching failure message from any end, the server can determine that the hole punching has failed. A waiting time can be set for the server according to actual conditions such as the longest time required for hole punching. If the server does not receive the hole punching failure message within the waiting time, it is considered that the hole punching is successful.

[0099] S402: Select a hole punching scheme again from all feasible hole punching schemes, send the third address port information required for hole punching to the first user terminal according to the again selected hole punching scheme, and send the fourth address port information required for hole punching to the second user terminal.

[0100] Specifically, after the server determines that the current hole punching fails, it selects another hole punching scheme from all feasible hole punching schemes, and sends the third address port information required for hole punching to the first user terminal, and sends the fourth address port information required for hole punching to the second user terminal. The server can repeat the operations of S401-S402 multiple times until the hole punching failure information is no longer received, and the first user terminal and the second user terminal successfully punch holes.

[0101] The symmetric NAT network public address prediction method provided by the present application receives hole punching failure information sent by the first user terminal and / or the second user terminal; selects a hole punching scheme again from all feasible hole punching schemes, and sends the third address port information required for hole punching to the first user terminal according to the hole punching scheme selected again, and sends the fourth address port information required for hole punching to the second user terminal, thereby achieving full utilization of all feasible hole punching schemes and being able to quickly provide a new hole punching scheme after a hole punching failure to ensure the ultimate success of the hole punching.

[0102] Figure 5 is a flowchart of obtaining a first public network address port mapping relationship provided by an embodiment of the present application. When obtaining the first public network address port mapping relationship, the first source address data includes the first source IP address data and the first source port data, such as Figure 5 As shown, based on the above embodiments, further, the step of obtaining the first public network address port mapping relationship includes:

[0103] S501: Receive multiple first hole punching messages sent by a first user terminal using different IP addresses;

[0104] Specifically, in symmetric NAT, if any one of the intranet IP address, intranet port, destination IP address, and destination port changes, the mapping of the intranet IP address and port to the public network IP address and port will change. Therefore, the server can have multiple different IP addresses, each IP address can have multiple different ports, and the first user terminal sends the first hole punching message with the different IP addresses and ports of the server as the destination address. At the same time, the first user terminal can also send the first hole punching message to the server from different ports. The server receives multiple first hole punching messages sent by the first user terminal from different IP addresses.

[0105] S502: Obtaining public network address data and destination address data corresponding to each first hole punching message from the TCP network layer, and using the message sending time, first source address data, public network address data and destination address data of a hole punching message as a set of training data;

[0106] Specifically, after receiving each first hole punching message, the server obtains the public network address data and destination address data corresponding to the first hole punching message from the TCP network layer, and uses the message sending time, the first source address data, the obtained public network address data and the destination address data in the message as a set of training data. The public network address data includes the public network IP address data and the public network port data corresponding to the source IP address and port data of sending the first message, and the destination address data includes the destination IP address data and the destination port data.

[0107] S503: Perform regression analysis using the training data to obtain a first public network address-port mapping relationship, where the first public network address-port mapping relationship is a mapping relationship between the encrypted first source address data, message sending time, and destination address data and the public network address data.

[0108] Specifically, the server performs regression analysis on each set of training data to obtain a mapping relationship between the encrypted first source address data, message sending time, and destination address data and the public network address data. Among them, the regression analysis can be multiple linear regression, logistic regression, ridge regression, random forest, decision tree regression, etc. This application does not limit the method of performing regression analysis.

[0109] When using each regression analysis method for regression analysis, there can only be one dependent variable. When there are multiple dependent variables, regression analysis is often performed on different dependent variables to obtain the corresponding mapping relationship between each variable and different dependent variables. However, in actual situations, public IP address data and public port data are not completely unrelated. If regression analysis is performed separately to obtain the mapping relationship between the first source address data, message sending time, and destination address data to the public IP address data, and the mapping relationship between the first source address data, message sending time, and destination address data to the public port data, the mapping relationship obtained will be inaccurate due to ignoring the correlation between the public IP address data and the public port data.

[0110] To solve this problem, in one embodiment of the present application, a regression analysis can be first performed using the public IP address data as the dependent variable to obtain a first public IP address mapping relationship of the first source address data, message sending time, and destination address data to the public IP address data, and then a regression analysis can be performed on the public port data based on the first public IP address mapping relationship to obtain a first public port mapping relationship of the public IP address data, the first source address data, message sending time, and destination address data to the public port data. At this time, the first public address-port mapping relationship f can be expressed by the following formula group:

[0111]

[0112] Among them, f 1 is the mapping relationship of the first public network IP address, f 2 is the first public network port mapping relationship, Addr is the destination IP address data, port is the destination port data, and the remaining symbols have the same meanings as those in equation group (1).

[0113] Since the IP address contains four bits of address data, it may be difficult to perform operations as a numerical value during regression analysis. In one embodiment, the range of intranet IP addresses and public IP addresses can be determined, and all possible IP addresses can be digitally encoded so that different IP addresses have different codes. The digital code of each IP address is used as a feature value for regression analysis.

[0114] The symmetric NAT network public address prediction method provided by the present application uses different IP addresses to receive multiple first hole punching messages sent by the first user end; obtains the public address data and destination address data corresponding to each first hole punching message from the TCP network layer, takes the message sending time, first source address data, public address data and destination address data of a hole punching message as a group of training data, and performs regression analysis on each group of training data, so as to obtain the first public address port mapping relationship, and fits the existing NAT conversion strategies that vary greatly through regression analysis, which is not affected by the brand manufacturers of NAT equipment, and can even be used for multiple NAT networks, so that the method provided by the present application has high universality. When performing regression analysis, the correlation between the public IP address data and the public port data is fully considered, so that the first public address port mapping relationship can better describe the relationship between the variables, making the subsequent prediction of the public address data more accurate and improving the success rate of hole punching.

[0115] Figure 6 is a flowchart of obtaining a second public network address port mapping relationship provided by an embodiment of the present application. When obtaining the second public network address port mapping relationship, the second source address data includes a second source IP address data and a second source port data, such as Figure 6As shown, on the basis of the above embodiments, further, the step of obtaining the second public network address port mapping relationship includes:

[0116] S601: Receive multiple second hole punching messages sent by a second user terminal using different IP addresses, where the second hole punching messages include message sending time and encrypted second source address data;

[0117] Specifically, the second client sends the second hole punching message with different IP addresses and ports of the server as the destination address, and the second client can also send the second hole punching message to the server from different ports. The server receives multiple second hole punching messages sent by the second client from different IP addresses.

[0118] S602: Obtain public network address data and destination address data of each second hole punching message from the TCP network layer, and use the second source address data, public network address data, destination address data and message sending time of a hole punching message as a set of training data;

[0119] Specifically, each time the server receives a second hole punching message, it obtains the public network address data and destination address data corresponding to the second hole punching message from the TCP network layer, and uses the message sending time, second source address data, and the obtained public network address data and destination address data in the message as a set of training data.

[0120] S603: Perform regression analysis using the training data to obtain a second public network address-port mapping relationship, where the second public network address-port mapping relationship is a mapping relationship between the encrypted second source address data, message sending time, and destination address data and the public network address data.

[0121] Specifically, the server performs regression analysis on each set of training data to obtain a mapping relationship between the encrypted second source address data, message sending time, and destination address data and the public network address data. Among them, the regression analysis can be multiple linear regression, logistic regression, ridge regression, random forest, decision tree regression, etc. This application does not limit the method of performing regression analysis.

[0122] In one embodiment of the present application, a regression analysis can be first performed using the public IP address data as the dependent variable to obtain a second public IP address mapping relationship of the second source address data, message sending time, and destination address data to the public IP address data, and then a regression analysis can be performed on the public port data based on the second public IP address mapping relationship to obtain a second public port mapping relationship of the public IP address data, the second source address data, message sending time, and destination address data to the public port data. At this time, the second public address-port mapping relationship f′ can be expressed by the following formula group:

[0123]

[0124] Among them, f 1 ' is the second public network IP address mapping relationship, f 2 ' is the second public network port mapping relationship, Addr is the destination IP address data, port is the destination port data, and the remaining symbols have the same meanings as those in equation group (1).

[0125] The symmetric NAT network public address prediction method provided by the present application uses different IP addresses to receive multiple second hole punching messages sent by the second user end; obtains the public address data and destination address data corresponding to each second hole punching message from the TCP network layer, takes the message sending time, second source address data, public address data and destination address data of a hole punching message as a group of training data, and performs regression analysis on each group of training data, so as to obtain the second public address port mapping relationship, and fits the existing NAT conversion strategies that vary greatly through regression analysis, which is not affected by the brand manufacturers of NAT equipment, and can even be used for multiple NAT networks, so that the method provided by the present application has high universality. When performing regression analysis, the correlation between the public IP address data and the public port data is fully considered, so that the second public address port mapping relationship can better describe the relationship between the variables, making the subsequent prediction of the public address data more accurate and improving the success rate of hole punching.

[0126] On the basis of the above embodiments, further, before receiving the first hole punching message sent by the first user terminal and the second hole punching message sent by the second user terminal, the server further includes:

[0127] Receive the homomorphic encryption key sent by the first user end, and forward the homomorphic encryption key to the second user end.

[0128] Specifically, homomorphic encryption is a form of encryption that allows people to perform a specific form of algebraic operations on ciphertext to obtain a result that is still encrypted, and the result obtained by decrypting it is the same as the result of the same operation on the plaintext. The first user terminal randomly generates a homomorphic encryption key, and the server receives the homomorphic encryption key sent by the first user terminal and forwards the homomorphic encryption key to the second user terminal. Among them, the homomorphic encryption key can be in any form such as addition, subtraction, multiplication, division or a combination thereof. For example, it can be g(x)=x-7. If the source IP port number is 50, the encrypted port number is 43. This application does not limit the specific form of the homomorphic encryption key.

[0129] The symmetric NAT network public address prediction method provided in the present application realizes the encryption of the intranet address ports of the first user terminal and the second user terminal by receiving the homomorphic encryption key sent by the first user terminal and forwarding the homomorphic encryption key to the second user terminal. In the process of obtaining the mapping relationship and making predictions, the intranet address data received and predicted by the server are all encrypted data, which prevents the leakage of the intranet address and ensures that the security of the symmetric NAT is not compromised.

[0130] In the present application, the first user terminal and the second user terminal can be converted to each other.

[0131] The following will use a specific embodiment to illustrate the symmetric NAT network public address prediction method provided by this application.

[0132] Figure 7 is a flowchart of a method for predicting a public network address of a symmetric NAT network provided by an embodiment of the present application, such as Figure 7 As shown, the symmetric NAT network public address prediction method provided by the present application includes:

[0133] S701: Receive multiple first hole punching messages sent by a first user terminal using different IP addresses, where the first hole punching messages include message sending time and encrypted first source address data;

[0134] Specifically, the server may have multiple different IP addresses, each IP address may have multiple different ports, and the first client sends the first hole punching message with different IP addresses and ports of the server as the destination address. Meanwhile, the first client may also send the first hole punching message to the server from different ports. The server receives multiple first hole punching messages sent by the first client from different ports from different IP addresses.

[0135] S702: Obtain public network address data and destination address data corresponding to each first hole punching message from the TCP network layer, and use the message sending time, first source address data, public network address data and destination address data of a hole punching message as a set of training data;

[0136] Specifically, each time the server receives a first hole punching message, it obtains the public network address data and destination address data corresponding to the first hole punching message from the TCP network layer, and uses the message sending time, first source address data, and the obtained public network address data and destination address data in the message as a set of training data.

[0137] S703: Perform regression analysis using the training data to obtain a first public network address-port mapping relationship, where the first public network address-port mapping relationship is a mapping relationship between the encrypted first source address data, message sending time, and destination address data and the public network address data;

[0138] Specifically, the server performs a multivariate linear regression analysis on each set of training data to obtain a mapping relationship between the encrypted first source address data, message sending time, and destination address data and the public network address data. The first public network address port mapping relationship f can be expressed by the following formula group:

[0139]

[0140] Among them, a1, a2, a3, a4, b1, b2, b3, b4, and b5 are constants obtained by regression analysis.

[0141] S704: Receive multiple second hole punching messages sent by the second user end using different IP addresses, where the second hole punching messages include message sending time and encrypted second source address data;

[0142] Specifically, the server receives a plurality of second hole punching messages sent by the second client from different ports through different IP addresses.

[0143] S705: Obtain the public network address data and destination address data of each second hole punching message from the TCP network layer, and use the second source address data, public network address data, destination address data and message sending time of a hole punching message as a set of training data;

[0144] Specifically, each time the server receives a second hole punching message, it obtains the public network address data and destination address data corresponding to the second hole punching message from the TCP network layer, and uses the message sending time, second source address data, and the obtained public network address data and destination address data in the message as a set of training data.

[0145] S706: Perform regression analysis using the training data to obtain a second public network address-port mapping relationship, where the second public network address-port mapping relationship is a mapping relationship between the encrypted second source address data, message sending time, and destination address data and the public network address data;

[0146] Specifically, the server performs a multivariate linear regression analysis on each set of training data to obtain a mapping relationship between the encrypted second source address data, message sending time, and destination address data and the public network address data. The second public network address port mapping relationship f′ can be expressed by the following formula group:

[0147]

[0148] Among them, c1, c2, c3, c4, d1, d2, d3, d4, and d5 are constants obtained by regression analysis.

[0149] S707: Receive the homomorphic encryption key sent by the first user terminal, and forward the homomorphic encryption key to the second user terminal;

[0150] Specifically, the homomorphic encryption key is -7, that is, g(x)=x-7 is performed on each IP address and port number. If a source IP port number is 50, the encrypted port number is 43. The server receives the key and forwards it to the second user terminal.

[0151] S708: Receive a first hole punching message sent by the first user end and a second hole punching message sent by the second user end; the first hole punching message includes a first estimated time and encrypted first source address data, and the second hole punching message includes a second estimated time and encrypted second source address data;

[0152] Specifically, the first user end performs homomorphic encryption on the first source address data used for communication with the second end, and generates a first hole punching message together with the first estimated hole punching time and sends it to the server; the second user end performs homomorphic encryption on the second source address data used for communication with the first end, and generates a second hole punching message together with the second estimated hole punching time and sends it to the server. The server receives the first hole punching message and the second hole punching message.

[0153] S709: According to the first hole punching message, the second hole punching message, the first public network address-port mapping relationship, and the second public network address-port mapping relationship, a group of hole punching equations is jointly established, and all feasible hole punching schemes are obtained by solving the group of hole punching equations;

[0154] Specifically, the server obtains the following equation group based on the received first hole punching message, the second hole punching message, and equation groups (4) and (5):

[0155]

[0156] The server obtains the solution space of the equation group by solving equation group (6), and each feasible solution in the solution space is a feasible hole punching scheme.

[0157] S710: randomly selecting a hole punching scheme, and sending first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and sending second address port information required for hole punching to the second user terminal;

[0158] Specifically, the server randomly selects a hole punching scheme from all feasible hole punching schemes, sends the address port data required for the first user terminal to punch a hole in the hole punching scheme to the first user terminal, and sends the address port data required for the second user terminal to punch a hole in the hole punching scheme to the second user terminal.

[0159] S711: Determine whether hole punching failure information sent by the first user terminal and / or the second user terminal is received.

[0160] Specifically, when a hole punching fails, the first user terminal and / or the second user terminal sends a hole punching failure message to the server. If the server receives the hole punching failure message from any terminal, it determines that the hole punching has failed and re-enters S710.

[0161] The present application provides a symmetric NAT network public address prediction method, which receives a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; obtains all feasible hole punching schemes according to the first hole punching message, the second hole punching message, the first public network address port mapping relationship and the second public network address port mapping relationship; randomly selects a hole punching scheme, and sends the first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and sends the second address port information required for hole punching to the second user terminal, thereby realizing the prediction of the symmetric NAT network public address, and being able to adjust the size of the solution space by adjusting the content of the source address data to meet different requirements for a single hit rate and an overall hit rate. During the prediction process, the intranet address data received and predicted by the server are all encrypted data, thereby preventing the leakage of the intranet address and ensuring the security of the intranet address. After the hole punching is completed, a third-party server is no longer required to forward information, thereby saving costs and preventing information leakage.

[0162] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0163] Based on the same inventive concept, the embodiments of the present application also provide a symmetric NAT network public address prediction device, which can be used to implement the method described in the above embodiments, as described in the following embodiments. Since the principle of solving the problem by the symmetric NAT network public address prediction device is similar to that of the symmetric NAT network public address prediction method, the implementation of the symmetric NAT network public address prediction device can refer to the implementation of the method based on software performance benchmark determination, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements predetermined functions. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0164] Figure 8 : is a schematic diagram of the structure of a symmetric NAT network public address prediction device provided in an embodiment of the present application, such as Figure 8 As shown, the symmetric NAT network public address prediction device provided by the present application includes:

[0165] A hole punching message receiving unit 801 is configured to receive a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; the first hole punching message includes a first estimated hole punching time and encrypted first source address data, and the second hole punching message includes the first estimated time and encrypted second source address data;

[0166] Specifically, the first user end performs homomorphic encryption on the first source address data used for communication with the second end, and generates a first hole punching message together with the first estimated hole punching time and sends it to the hole punching message receiving unit 801; the second user end performs homomorphic encryption on the second source address data used for communication with the first end, and generates a second hole punching message together with the second estimated hole punching time and sends it to the hole punching message receiving unit 801. The hole punching message receiving unit 801 receives the first hole punching message and the second hole punching message.

[0167] A hole punching scheme calculation unit 802 is used to solve the hole punching equations to obtain all feasible hole punching schemes according to the first hole punching message, the second hole punching message, the first public network address-port mapping relationship and the second public network address-port mapping relationship;

[0168] Specifically, the hole punching scheme calculation unit 802 obtains the equation group (1) by jointly solving the equation group (1) according to the received first hole punching message, the second hole punching message, and the pre-obtained first public network address-port mapping relationship and the second public network address-port mapping relationship. The hole punching scheme calculation unit 802 obtains the solution space of the equation group by solving the equation group (1), and each feasible solution in the solution space is a feasible hole punching scheme.

[0169] The hole punching information sending unit 803 is used to randomly select a hole punching scheme, and send the first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and send the second address port information required for hole punching to the second user terminal.

[0170] Specifically, the hole punching information sending unit 803 randomly selects a hole punching scheme from all feasible hole punching schemes, sends the address port data required for the first user end to punch a hole in the hole punching scheme to the first user end, and sends the address port data required for the second user end to punch a hole in the hole punching scheme to the second user end.

[0171] The symmetric NAT network public address prediction device provided by the present application realizes the prediction of the symmetric NAT network public address through the hole punching message receiving unit 801, the hole punching scheme calculation unit 802 and the hole punching information sending unit 803, and can adjust the size of the solution space by adjusting the content of the source address data to meet the different requirements for the single hit rate and the overall hit rate. After the hole punching is completed, a third-party server is no longer required to forward information, which saves costs and prevents information leakage.

[0172] Fig. 9 : is a schematic diagram of the structure of a symmetric NAT network public address prediction device provided by an embodiment of the present application. When obtaining a first public address-port mapping relationship, the first source address data includes a first source IP address data and a first source port data, such as Fig. 9 As shown, on the basis of the above embodiments, further, the symmetric NAT network public address prediction device provided by the present application also includes:

[0173] A first multi-IP receiving unit 901 is used to receive multiple first hole punching messages sent by a first user terminal using different IP addresses;

[0174] Specifically, the first multi-IP receiving unit 901 may have multiple different IP addresses, each IP address may have multiple different ports, and the first user terminal sends the first hole punching message with different IP addresses and ports of the first multi-IP receiving unit 901 as the destination address. At the same time, the first user terminal may also send the first hole punching message from different ports to the first multi-IP receiving unit 901. The first multi-IP receiving unit 901 receives multiple first hole punching messages sent by the first user terminal from different IP addresses.

[0175] A first training data generating unit 902 is used to obtain the public network address data and the destination address data corresponding to each first hole punching message from the TCP network layer, and use the message sending time, the first source address data, the public network address data and the destination address data of a hole punching message as a set of training data;

[0176] Specifically, each time the first multi-IP receiving unit 901 receives a first hole-punching message, the first training data generating unit 902 obtains the public network address data and destination address data corresponding to the first hole-punching message from the TCP network layer, and uses the message sending time, the first source address data, the obtained public network address data and the destination address data in the message as a set of training data.

[0177] The first mapping relationship generating unit 903 is used to perform regression analysis using training data to obtain a first public network address-port mapping relationship, where the first public network address-port mapping relationship is a mapping relationship from encrypted first source address data, message sending time, and destination address data to public network address data.

[0178] Specifically, the first mapping relationship generating unit 903 performs regression analysis on each set of training data to obtain a mapping relationship between the encrypted first source address data, message sending time, and destination address data and the public network address data. Among them, the regression analysis can be multiple linear regression, logistic regression, ridge regression, random forest, decision tree regression, etc., and this application does not limit the method of performing regression analysis.

[0179] The symmetric NAT network public address prediction device provided by the present application can obtain the first public network address port mapping relationship through the first multi-IP receiving unit 901, the first training data generating unit 902 and the first mapping relationship generating unit 903, and fit the existing NAT conversion strategies that vary greatly through regression analysis, which is not affected by the brand manufacturers of NAT equipment and can even be used for multiple NAT networks, making the method provided by the present application have high universality. When performing regression analysis, the correlation between the public network IP address data and the public network port data is fully considered, so that the first public network address port mapping relationship can better describe the relationship between the variables, making the subsequent prediction of the public network address data more accurate and improving the success rate of hole punching.

[0180] Fig.10 : is a schematic diagram of the structure of a symmetric NAT network public address prediction device provided by an embodiment of the present application. When obtaining the second public address-port mapping relationship, the second source address data includes the second source IP address data and the second source port data, such as Fig.10 As shown, on the basis of the above embodiments, further, the symmetric NAT network public address prediction device provided by the present application also includes:

[0181] A second multi-IP receiving unit 1001 is used to receive a plurality of second hole punching messages sent by a second user terminal using different IP addresses, wherein the second hole punching messages include message sending time and encrypted second source address data;

[0182] Specifically, the second user terminal sends the second hole punching message with different IP addresses and ports of the second multi-IP receiving unit 1001 as the destination address. Meanwhile, the second user terminal may also send the second hole punching message from different ports to the second multi-IP receiving unit 1001. The second multi-IP receiving unit 1001 receives multiple second hole punching messages sent by the second user terminal from different IP addresses.

[0183] The second training data generating unit 1002 is used to obtain the public network address data and the destination address data of each second hole punching message from the TCP network layer, and use the second source address data, the public network address data, the destination address data and the message sending time of a hole punching message as a set of training data;

[0184] Specifically, each time the second multi-IP receiving unit 1001 receives a second hole punching message, the second training data generating unit 1002 obtains the public network address data and destination address data corresponding to the second hole punching message from the TCP network layer, and uses the message sending time, the second source address data, and the obtained public network address data and destination address data in the message as a set of training data.

[0185] The second mapping relationship generating unit 1003 is used to perform regression analysis using the training data to obtain a second public network address-port mapping relationship, where the second public network address-port mapping relationship is a mapping relationship from the encrypted second source address data, message sending time, and destination address data to the public network address data.

[0186] Specifically, the second mapping relationship generating unit 1003 performs regression analysis on each group of training data to obtain a mapping relationship between the encrypted second source address data, message sending time, and destination address data and the public network address data.

[0187] The symmetric NAT network public address prediction device provided by the present application can obtain the second public network address port mapping relationship through the second multi-IP receiving unit 1001, the second training data generating unit 1002 and the second mapping relationship generating unit 1003, and fit the existing NAT conversion strategies that vary greatly through regression analysis, which is not affected by the brand manufacturers of NAT equipment and can even be used for multiple NAT networks, making the method provided by the present application have high universality. When performing regression analysis, the correlation between the public network IP address data and the public network port data is fully considered, so that the second public network address port mapping relationship can better describe the relationship between the variables, making the subsequent prediction of the public network address data more accurate and improving the success rate of hole punching.

[0188] Fig.11 : is a schematic diagram of the structure of a symmetric NAT network public address prediction device provided in an embodiment of the present application, such as Fig.11 As shown, on the basis of the above embodiments, further, the symmetric NAT network public address prediction device provided by the present application also includes:

[0189] The key receiving and forwarding unit 1101 is used to receive the homomorphic encryption key sent by the first user terminal and forward the homomorphic encryption key to the second user terminal.

[0190] Specifically, the first user terminal randomly generates a homomorphic encryption key, the key receiving and forwarding unit 1101 receives the homomorphic encryption key sent by the first user terminal, and forwards the homomorphic encryption key to the second user terminal.

[0191] The symmetric NAT network public address prediction device provided in the present application realizes encryption of the intranet address ports of the first user terminal and the second user terminal through the key receiving and forwarding unit 1101. In the process of obtaining the mapping relationship and making predictions, the intranet address data received and predicted by the server are all encrypted data, which prevents the leakage of the intranet address and ensures that the security of the symmetric NAT is not destroyed.

[0192] Fig.12 is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application, such as Fig.12 As shown, the electronic device may include: a processor 1201, a communication interface 1202, a memory 1203 and a communication bus 1204, wherein the processor 1201, the communication interface 1202 and the memory 1203 complete mutual communication through the communication bus 1204. The processor 1201 may call the logic instructions in the memory 1203 to execute the following method: receiving a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; the first hole punching message includes a first estimated hole punching time and encrypted first source address data, and the second hole punching message includes a second estimated hole punching time and encrypted second source address data; obtaining all feasible hole punching schemes according to the first hole punching message, the second hole punching message, the first public network address port mapping relationship and the second public network address port mapping relationship; randomly selecting a hole punching scheme, and sending the first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and sending the second address port information required for hole punching to the second user terminal.

[0193] In addition, the logic instructions in the above-mentioned memory 1203 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0194] The present embodiment discloses a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: receiving a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; the first hole punching message includes a first estimated hole punching time and encrypted first source address data, and the second hole punching message includes a second estimated hole punching time and encrypted second source address data; all feasible hole punching schemes are obtained according to the first hole punching message, the second hole punching message, the first public network address-port mapping relationship and the second public network address-port mapping relationship; a hole punching scheme is randomly selected, and according to the selected hole punching scheme, the first address-port information required for hole punching is sent to the first user terminal, and the second address-port information required for hole punching is sent to the second user terminal.

[0195] The present embodiment provides a computer-readable storage medium, which stores a computer program, and the computer program enables the computer to execute the methods provided by the above-mentioned method embodiments, for example, including: receiving a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; the first hole punching message includes a first estimated hole punching time and encrypted first source address data, and the second hole punching message includes a second estimated hole punching time and encrypted second source address data; all feasible hole punching schemes are obtained according to the first hole punching message, the second hole punching message, the first public network address-port mapping relationship and the second public network address-port mapping relationship; randomly selecting a hole punching scheme, and sending the first address-port information required for hole punching to the first user terminal according to the selected hole punching scheme, and sending the second address-port information required for hole punching to the second user terminal.

[0196] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0197] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0198] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0199] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0200] In the description of this specification, the description with reference to the terms "one embodiment", "a specific embodiment", "some embodiments", "for example", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0201] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for predicting a public network address of a symmetric NAT network, characterized in that: include: Receive a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; wherein the first hole punching message includes a first estimated hole punching time and encrypted first source address data, and the second hole punching message includes a second estimated hole punching time and encrypted second source address data; A group of puncturing equations is established according to the first puncturing message, the second puncturing message, the first public network address-port mapping relationship, and the second public network address-port mapping relationship, and all feasible puncturing schemes are obtained by solving the group of puncturing equations; Randomly select a hole punching scheme, and send the first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and send the second address port information required for hole punching to the second user terminal; The step of obtaining the first public network address-port mapping relationship includes: Using different IP addresses to receive multiple first hole punching messages sent by the first user terminal; Obtain the public network address data and destination address data corresponding to each first hole punching message from the TCP network layer, and use the message sending time, first source address data, public network address data and destination address data of a hole punching message as a group of training data; wherein the public network address data corresponding to the first hole punching message includes the public network IP address data and public network port data corresponding to the source IP address port data for sending the first hole punching message, and the destination address data corresponding to the first hole punching message includes the destination IP address data and the destination port data; Using the training data to perform regression analysis to obtain the first public network address-port mapping relationship, where the first public network address-port mapping relationship is a mapping relationship between the encrypted first source address data, message sending time, and destination address data and the public network address data; The step of obtaining the second public network address-port mapping relationship includes: Using different IP addresses to receive multiple second hole punching messages sent by the second user terminal; Obtaining the public network address data and destination address data corresponding to each second hole punching message from the TCP network layer, and using the second source address data, public network address data, destination address data and message sending time of a hole punching message as a set of training data; wherein the public network address data corresponding to the second hole punching message includes the public network IP address data and public network port data corresponding to the source IP address port data for sending the second hole punching message, and the destination address data corresponding to the second hole punching message includes the destination IP address data and the destination port data; The second public network address-port mapping relationship is obtained by performing regression analysis using the training data. The second public network address-port mapping relationship is a mapping relationship between the encrypted second source address data, message sending time, and destination address data and the public network address data.

2. The method for predicting a public network address of a symmetric NAT network according to claim 1, wherein: The first source address data includes first source IP address data and first source port data, and the second source address data includes second source IP address data and second source port data; The sending the first address port information required for hole punching to the first user terminal includes: Sending the public IP address data and public port data of the second user terminal to the first user terminal; The sending the second address port information required for hole punching to the second user terminal includes: Send the public IP address data and public port data of the first user terminal to the second user terminal.

3. The method for predicting a public network address of a symmetric NAT network according to claim 1, wherein: The first source address data includes first source IP address data, and the second source address data includes second source IP address data; The sending the first address port information required for hole punching to the first user terminal includes: Sending the encrypted first source port data, the public network IP address data and the public network port data of the second user terminal to the first user terminal; The sending the second address port information required for hole punching to the second user terminal includes: The encrypted second source port data, the public IP address data and the public port data of the first user terminal are sent to the second user terminal.

4. The method for predicting a public network address of a symmetric NAT network according to claim 1, wherein: Also includes: Receiving hole punching failure information sent by the first user terminal and / or the second user terminal; A hole punching scheme is selected again from all feasible hole punching schemes, and the third address port information required for hole punching is sent to the first user terminal according to the again selected hole punching scheme, and the fourth address port information required for hole punching is sent to the second user terminal.

5. The method for predicting a public network address of a symmetric NAT network according to claim 1, wherein: Before receiving the first hole punching message sent by the first user terminal and the second hole punching message sent by the second user terminal, the method further includes: Receive the homomorphic encryption key sent by the first user terminal, and forward the homomorphic encryption key to the second user terminal.

6. A symmetric NAT network public network address prediction device, characterized in that: include: A hole punching message receiving unit, configured to receive a first hole punching message sent by a first user terminal and a second hole punching message sent by a second user terminal; wherein the first hole punching message includes a first estimated hole punching time and encrypted first source address data, and the second hole punching message includes a second estimated hole punching time and encrypted second source address data; a hole punching scheme calculation unit, configured to simultaneously establish a hole punching equation group according to the first hole punching message, the second hole punching message, the first public network address-port mapping relationship, and the second public network address-port mapping relationship, and solve the hole punching equation group to obtain all feasible hole punching schemes; A hole punching information sending unit, configured to randomly select a hole punching scheme, and send first address port information required for hole punching to the first user terminal according to the selected hole punching scheme, and send second address port information required for hole punching to the second user terminal; A first multi-IP receiving unit, configured to receive a plurality of first hole punching messages sent by the first user terminal using different IP addresses; A first training data generating unit is used to obtain the public network address data and the destination address data corresponding to each first hole punching message from the TCP network layer, and use the message sending time, the first source address data, the public network address data and the destination address data of a hole punching message as a group of training data; wherein the public network address data corresponding to the first hole punching message includes the public network IP address data and the public network port data corresponding to the source IP address port data for sending the first hole punching message, and the destination address data corresponding to the first hole punching message includes the destination IP address data and the destination port data; A first mapping relationship generating unit is used to perform regression analysis using training data to obtain the first public network address-port mapping relationship, where the first public network address-port mapping relationship is a mapping relationship from the encrypted first source address data, message sending time, and destination address data to the public network address data; A second multi-IP receiving unit, configured to receive a plurality of second hole punching messages sent by the second user terminal using different IP addresses; A second training data generating unit is used to obtain the public network address data and destination address data corresponding to each second hole punching message from the TCP network layer, and use the second source address data, public network address data, destination address data and message sending time of a hole punching message as a group of training data; wherein the public network address data corresponding to the second hole punching message includes the public network IP address data and public network port data corresponding to the source IP address port data of sending the second hole punching message, and the destination address data corresponding to the second hole punching message includes the destination IP address data and the destination port data; The second mapping relationship generating unit is used to perform regression analysis using training data to obtain the second public network address-port mapping relationship, wherein the second public network address-port mapping relationship is a mapping relationship between the encrypted second source address data, message sending time, and destination address data and the public network address data.

7. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

9. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images