Address translation method and apparatus, host computer and computer readable storage medium

Abstract

The application provides an address conversion method, device, host computer and computer readable storage medium. A first address mapping table and a second address mapping table are preconfigured in a virtual router of a virtual inner network, so that when the virtual router receives a request message sent by a virtual node to a physical outer network, the virtual router can forward the request message to a destination physical node after address mapping based on the two tables, and when the virtual router receives a response message returned by the destination physical node, the virtual router can forward the response message to the virtual node after address mapping based on the two tables. Since the first address mapping table is used to realize IP address mapping from the virtual inner network to the physical outer network, and the second address mapping table is used to realize IP address mapping from the physical outer network to the virtual inner network, the two address mapping tables can be used to map the physical network to the virtual network, so that the virtual node of the virtual network can actively access the physical node. Moreover, the mapping between the two mapping tables is the mapping between IP addresses, so that the mappable physical network is not limited to a layer 2 network.

Description

Technical Field

[0001] This invention relates to the field of communications, and more specifically, to an address translation method, apparatus, host machine, and computer-readable storage medium. Background Technology

[0002] When using virtualization technology to build network test ranges or applying virtualization technology in the field of cloud computing, there is usually a communication requirement between virtual network devices and physical network devices. In existing technologies, to meet this communication requirement, the physical network needs to be mapped to a virtual network, involving the following network architecture:

[0003] Virtual network devices (such as virtual machines) in a virtual network form communication links between virtual network devices and physical network devices through their connected virtual switches and the physical switches to which physical network devices are connected. The ARP (Address Resolution Protocol) table in the virtual switch binds the virtual IP address of the virtual network device to the MAC (Media Access Control Address, also known as the physical address or hardware address) address of the physical network device. The port table of the physical switch to which the physical network device is connected records the MAC address of the physical network device and the port it is connected to. This allows communication requests from virtual network devices to physical network devices.

[0004] However, since virtual switches use a scheme that binds virtual IP addresses to physical device MAC addresses, they can only map the physical network of the Layer 2 network topology where the physical switch is located to the virtual network topology, which greatly limits the physical network topologies that can be mapped. Summary of the Invention

[0005] The purpose of this invention is to provide an address translation method, apparatus, host machine, and computer-readable storage medium to improve the problems existing in the prior art.

[0006] The embodiments of the present invention can be implemented as follows:

[0007] In a first aspect, the present invention provides an address translation method applied to a virtual router in a virtual intranet, wherein the virtual router is communicatively connected to multiple virtual nodes of the virtual intranet and at least one physical node of a physical extranet; the virtual router is pre-configured with a first address mapping table and a second address mapping table; the first address mapping table is used to implement IP address mapping from the virtual intranet to the physical extranet; the second address mapping table is used to implement IP address mapping from the physical extranet to the virtual intranet; the method includes:

[0008] When a first request message sent by any of the virtual nodes to the physical external network is received, the first request message is processed by address mapping based on the first address mapping table and the second address mapping table to obtain a first target request message.

[0009] Forward the first target request message to the destination physical node;

[0010] Receive a first response message sent by the destination physical node; the first response message is generated by the destination physical node when it receives the first target request message;

[0011] Based on the first address mapping table and the second address mapping table, the first response message is processed by address mapping to obtain the first target response message;

[0012] The first target response message is forwarded to the virtual node.

[0013] In an optional implementation, the first address mapping table includes the mapping relationship between the actual identification information of the virtual node and the mapping identification information displayed by the virtual node on the physical external network. The actual identification information includes the actual virtual IP address and the actual port number, and the mapping identification information includes the host IP address and the host port number. The second address mapping table includes the mapping relationship between the actual physical IP address of the physical node and the mapping virtual IP address displayed by it on the virtual internal network.

[0014] The step of performing address mapping processing on the first request message based on the first address mapping table and the second address mapping table to obtain the first target request message includes:

[0015] The first request message is parsed to obtain the source address field, destination address field, and source port field of the first request message; wherein, the source address field is the actual virtual IP address of the virtual node, the destination address field is the mapped virtual IP address of the destination physical node in the virtual intranet, and the source port field is the actual port number of the virtual node;

[0016] Find the host machine IP address and host machine port number that match the actual virtual IP address and actual port number of the virtual node from the first address mapping table;

[0017] Find the actual physical IP address of the target physical node that matches the mapped virtual IP address of the target physical node in the virtual intranet from the second address mapping table;

[0018] Based on the host IP address and host port number corresponding to the virtual node and the actual physical IP address of the target physical node, the first request message is re-encapsulated to obtain the first target request message.

[0019] In an optional implementation, the first address mapping table includes the mapping relationship between the actual identification information of the virtual node and the mapping identification information displayed by the virtual node on the physical external network. The actual identification information includes the actual virtual IP address and the actual port number, and the mapping identification information includes the host IP address and the host port number. The second address mapping table includes the mapping relationship between the actual physical IP address of the physical node and the mapping virtual IP address displayed by it on the virtual internal network.

[0020] The step of performing address mapping processing on the first response message based on the first address mapping table and the second address mapping table to obtain the first target response message includes:

[0021] The first response message is parsed to obtain the source address field, destination address field, and destination port field of the first response message; wherein, the source address field is the actual physical IP address of the destination physical node, the destination address field is the host IP address corresponding to the virtual node, and the destination port field is the host port number corresponding to the virtual node.

[0022] Find the actual virtual IP address and actual port number of the virtual node that match the host machine IP address and the host machine port number from the first address mapping table;

[0023] Find the mapped virtual IP address of the target physical node in the virtual intranet that matches the actual physical IP address of the target physical node from the second address mapping table;

[0024] Based on the mapped virtual IP address of the target physical node in the virtual intranet, as well as the actual virtual IP address and actual port number of the virtual node, the first response message is re-encapsulated to obtain the first target response message.

[0025] In an optional implementation, the virtual router is further pre-configured with a third address mapping table, which includes the mapping relationship between the actual virtual IP address of the virtual node and its mapped physical IP address displayed on the physical external network; the method further includes:

[0026] When a second request message is received from any of the physical nodes for the virtual intranet, the destination address field of the second request message is converted based on the third address mapping table to obtain a second target request message.

[0027] Forward the second target request message to the destination virtual node;

[0028] Receive a second response message sent by the destination virtual node; the second response message is generated by the destination virtual node when it receives the second target request message;

[0029] The source address field of the second response message is converted based on the third address mapping table to obtain the second target response message;

[0030] The second target response message is forwarded to the physical node.

[0031] In an optional implementation, the step of converting the destination address field of the second request message based on the third address mapping table to obtain the second target request message includes:

[0032] The second request message is parsed to obtain the destination address field of the second request message; the destination address field is the mapped physical IP address of the destination virtual node on the physical external network;

[0033] Find the actual virtual IP address that matches the mapped physical IP address of the target virtual node on the physical external network from the third address mapping table;

[0034] Based on the actual virtual IP address of the destination virtual node, the second request message is re-encapsulated to obtain the second target request message.

[0035] In an optional implementation, the step of converting the source address field of the second response message based on the third address mapping table to obtain the second target response message includes:

[0036] The second response message is parsed to obtain the source address field of the second response message; the source address field is the actual virtual IP address of the destination virtual node;

[0037] Find the mapped physical IP address of the target virtual node on the physical external network that matches the actual virtual IP address of the target virtual node from the third address mapping table;

[0038] Based on the mapped physical IP address of the destination virtual node on the physical external network, the second response message is re-encapsulated to obtain the second target response message.

[0039] Secondly, the present invention provides an address translation device applied to a virtual router in a virtual intranet, wherein the virtual router is communicatively connected to multiple virtual nodes of the virtual intranet and at least one physical node of a physical extranet; the virtual router is pre-configured with a first address mapping table and a second address mapping table; the first address mapping table is used to implement IP address mapping from the virtual intranet to the physical extranet; the second address mapping table is used to implement IP address mapping from the physical extranet to the virtual intranet; the device includes:

[0040] The first processing module is used for:

[0041] When a first request message sent by any of the virtual nodes to the physical external network is received, the first request message is processed by address mapping based on the first address mapping table and the second address mapping table to obtain a first target request message.

[0042] Forward the first target request message to the destination physical node;

[0043] The second processing module is used for:

[0044] Receive a first response message sent by the destination physical node; the first response message is generated by the destination physical node when it receives the first target request message;

[0045] Based on the first address mapping table and the second address mapping table, the first response message is processed by address mapping to obtain the first target response message;

[0046] The first target response message is forwarded to the virtual node.

[0047] In an optional implementation, the virtual router is further pre-configured with a third address mapping table, which includes the mapping relationship between the actual virtual IP address of the virtual node and its mapped physical IP address displayed on the physical external network; the device further includes:

[0048] The third processing module is used for:

[0049] When a second request message is received from any of the physical nodes for the virtual intranet, the destination address field of the second request message is converted based on the third address mapping table to obtain a second target request message.

[0050] Forward the second target request message to the destination virtual node;

[0051] The fourth processing module is used for:

[0052] Receive a second response message sent by the destination virtual node; the second response message is generated by the destination virtual node when it receives the second target request message;

[0053] The source address field of the second response message is converted based on the third address mapping table to obtain the second target response message;

[0054] The second target response message is forwarded to the physical node.

[0055] Thirdly, the present invention provides a host machine, wherein the virtual intranet constructed by the host machine includes a virtual router and multiple virtual nodes that are communicatively connected to the virtual router, and the virtual router is used to implement the address translation method as described in the first aspect above.

[0056] Fourthly, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the address translation method described in the first aspect.

[0057] Compared with existing technologies, embodiments of the present invention provide an address translation method, apparatus, host machine, and computer-readable storage medium. The virtual router of the virtual intranet is pre-configured with a first address mapping table and a second address mapping table. When the virtual router receives a first request packet sent by a virtual node to the physical external network, it can perform address mapping processing on the packet based on the two tables before forwarding it to the destination physical node. Similarly, when it receives a first response packet returned by the destination physical node, it performs address mapping processing on the packet based on the two tables before forwarding it to the virtual node. Since the first address mapping table is used to implement IP address mapping from the virtual intranet to the physical external network, and the second address mapping table is used to implement IP address mapping from the physical external network to the virtual intranet, the two address mapping tables can map the physical network to the virtual network, enabling virtual nodes in the virtual network to actively access physical nodes. Furthermore, since the two mapping tables represent mappings between IP addresses, the mappable physical networks are not limited to Layer 2 networks. Attached Figure Description

[0058] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 This is a schematic diagram of a scenario in the prior art where a virtual network requests physical network services based on SNAT technology.

[0060] Figure 2 This is a schematic diagram of a scenario in the prior art where virtual network services are exposed to a physical network based on DNAT technology.

[0061] Figure 3 This is a schematic diagram of a scenario in the prior art where a physical network is mapped to a virtual network.

[0062] Figure 4 This is an application scenario architecture diagram provided by an embodiment of the present invention.

[0063] Figure 5 This is one of the flowcharts illustrating an address translation method provided in an embodiment of the present invention.

[0064] Figure 6 This is a schematic diagram of an address translation device provided in an embodiment of the present invention. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0066] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0067] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0068] Furthermore, the terms "first" and "second" are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0069] It should be noted that, where there is no conflict, the features in the embodiments of the present invention can be combined with each other.

[0070] Here, we will first introduce the keywords or key terms involved in this invention:

[0071] 1. SDN (Software Defined Network): SDN is a new network architecture with a logically centralized control plane and an abstract data plane. The data plane and control plane are separated, and there is a unified open interface, OpenFlow, between the control plane and the data plane. This unified and open southbound interface enables direct programmable control of the network.

[0072] 2. Open vSwitch: It is a multi-layer virtual switch developed in C language, abbreviated as OVS. It uses the Apcahe2 (a web server software) open source license and has now become the de facto standard for open source SDN infrastructure layer.

[0073] 3. NAT technology: Network Address Translator. NAT technology can translate private addresses into public addresses, allowing hosts in a private network to access the Internet through a limited number of public addresses.

[0074] NAT is a technology used to use private addresses on a local network and switch to global IP addresses when connecting to the Internet. NAT was actually developed to address the shortage of IPv4 addresses.

[0075] 4. DNAT: DNAT Destination Network Address Translation, which translates the destination address of an IP data packet into another address.

[0076] 5. SNAT: Source Network Address Translation, which translates the source address of an IP packet into another address.

[0077] 6. PAT: Port Address Translation. Addresses are reloaded using port numbers. Since port numbers can range from 0 to 65536, a public IP address can be reloaded 65536 times. When translating internal local addresses, PAT adds a unique source port number to the internal global address. Port numbers are used to distinguish traffic; when the destination host returns a response, the port number determines which device the router forwards the packet to.

[0078] In existing technologies, based on SNAT technology, it is possible to enable virtual network devices in a virtual intranet to request access to services provided by physical network devices in the physical extranet. For example, please refer to [link to relevant documentation]. Figure 1 , Figure 1In this scenario, suppose a virtual network device (192.168.1.2) in a virtual network needs to request services from a physical network device (172.168.1.2) in the physical network. Then, the request message sent by the virtual network device will reach the fixed router (i.e.,...) Figure 1 When the OVS router is in the network, the source address in the request message will be changed from 192.168.1.2 to 192.168.1.10, and then forwarded to the physical network device.

[0079] Meanwhile, in existing technologies, DNAT technology can enable physical network devices in the physical external network to request access to services provided by virtual network devices in the virtual internal network. For example, please refer to... Figure 2 , Figure 3 In this scenario, assuming a physical network device (172.168.1.2) in the physical network needs to request services from a virtual network device (192.168.1.2) in the virtual network, the physical network device (172.168.1.2) only needs to send a request message with 192.168.1.20 as the destination address. This request message will reach the fixed router of the virtual intranet (i.e., the fixed router). Figure 2 In the case of an OVS router, the fixed router will change the destination address in the request message from 192.168.1.20 to 192.168.1.2, and then forward it to the virtual network device.

[0080] However, when building complex network environments such as network ranges or cloud computing, there is a need to map physical network topologies to existing virtual network topologies to ensure that physical network devices and virtual network devices can communicate with each other.

[0081] The aforementioned existing technologies can only enable virtual networks to request services from physical networks or expose virtual network services to physical networks; they cannot achieve the goal of mapping physical networks into virtual network topologies. Therefore, network engineers or developers must modify existing virtual or physical network environments to achieve virtual-physical network integration, which is time-consuming and labor-intensive. For example, please refer to... Figure 3 The existing technologies that can map a physical network to a virtual network are as follows:

[0082] Virtual network devices (such as virtual machines) in a virtual network form communication links between virtual network devices and physical network devices through the virtual switches they are connected to and the physical switches to which the physical network devices are connected. Figure 3In this architecture, the ARP table in the virtual switch (OVS) of a virtual network stores the binding relationship between the virtual IP addresses of virtual network devices and the MAC addresses of physical network devices. The port table of the physical switch (SDN switch) to which the physical network devices are connected records the MAC addresses of the physical network devices and the ports they are connected to. Thus, OVS and the SDN switch can be used to perform mapping and conversion between virtual IP addresses, physical network device MAC addresses, and SDN switch port numbers, thereby achieving the goal of converting the MAC addresses of physical network devices into virtual IP addresses in the virtual network topology. However, this approach has the following shortcomings:

[0083] First, because OVS uses a scheme that binds virtual IP addresses to physical network device MAC addresses, it can only map the physical network of the Layer 2 network topology where the DNS switch is located to the virtual network topology, which greatly limits the physical network topologies that can be mapped.

[0084] Second, since SDN switches are used to connect physical network devices to the virtual network, the number of physical network devices that can be connected is limited by the number of ports on the SDN switch. Increasing the number of connected devices would greatly increase the equipment cost of the SDN switch.

[0085] Third, because the SDN switch binds the MAC address of the physical network device to the port number of the SDN switch, all physical network devices must be connected to the designated SDN switch port during later operation and maintenance, which greatly reduces the flexibility and fault tolerance of operation and maintenance.

[0086] Based on the discovery of the aforementioned technical problems, the inventors, through creative labor, proposed the following technical solutions to solve or improve these problems. It should be noted that the deficiencies in the solutions of the prior art are all results derived by the inventors after practical experience and careful research. Therefore, the discovery process of the aforementioned problems and the solutions proposed in the embodiments of this application below should be considered contributions made by the inventors to this application during the inventive process, and should not be construed as technical content known to those skilled in the art.

[0087] In view of this, embodiments of the present invention provide an address translation method. Building upon existing technologies that utilize SNAT to enable virtual networks to request physical network services and DNAT to expose virtual network services to the physical network, this method combines and supplements these two approaches. It pre-maps the virtual network to a first address mapping table and a second address mapping table in the router within the virtual network. This maintains the original communication and security functions of NAT, and allows the physical network (external network) to be mapped as part of the virtual network (internal network) topology in a customized manner, or vice versa. This significantly reduces the operational costs when achieving compatibility between the virtual and physical networks. The following detailed description, through embodiments and accompanying drawings, further illustrates this method.

[0088] The application scenarios of this invention will be introduced first.

[0089] Please see Figure 4 , Figure 4 This is an application scenario architecture diagram provided by an embodiment of the present invention. The virtual intranet includes a virtual router, multiple virtual nodes (virtual nodes 1 to n) connected to the virtual router, and an OVS, which bridges the physical network card of the host machine; the physical extranet includes a physical switch and multiple physical nodes (physical nodes 1 to n) connected to the physical switch.

[0090] OVS is an Open vSwitch gateway switch, with one end bridged to the host machine's physical network interface card (NIC) and the other end connected to a virtual router. A virtual router is an Open vSwitch fixed router that can be configured with specific routing rules, such as SNAT and DNAT, through an SDN controller. The physical external network can access the virtualized network through the host machine's physical NIC corresponding to the virtual internal network.

[0091] Therefore, communication between a virtual node and a physical node can be achieved sequentially through the virtual router, OVS and the physical network card of the host machine it bridges, and the physical switch.

[0092] In this context, a virtual intranet can be built using virtualization technology on a host machine, which can be, but is not limited to, physical servers, personal computers, laptops, and other physical devices. A virtual node can be a virtual machine, a deployed container, or a deployed service within the host machine.

[0093] A physical switch can be any type of switch in the existing network architecture, such as any switch in a Layer 3 network architecture, not just a Layer 2 switch. A physical node can be, but is not limited to, physical servers, smartphones, personal computers, laptops, and other physical devices.

[0094] The address translation method provided in this invention can be applied to virtual routers in a virtual intranet. The following embodiments use SSS as an example for illustration.

[0095] Please refer to Figure 5 , Figure 5 This is a flowchart illustrating an address translation method provided in an embodiment of the present invention. The executing entity of this method can be a virtual router in a virtual intranet. The virtual router is communicatively connected to multiple virtual nodes in the virtual intranet and at least one physical node in the physical extranet. The virtual router is pre-configured with a first address mapping table and a second address mapping table. The first address mapping table is used to implement IP address mapping from the virtual intranet to the physical extranet, and the second address mapping table is used to implement IP address mapping from the physical extranet to the virtual intranet. The address translation method includes the following steps S101 to S105:

[0096] S101. When a first request message sent by any virtual node to the physical external network is received, the first request message is processed by address mapping based on the first address mapping table and the second address mapping table to obtain the first target request message.

[0097] S102. Forward the first target request message to the destination physical node.

[0098] In this embodiment, during the address mapping process, the source address field of the first request packet can be converted using the first address mapping table, and the destination address field of the first request packet can be converted using the second address mapping table. After obtaining the first target request packet, the routing table can be looked up to forward the first target request packet through the virtual switch that bridges the host machine's physical network card.

[0099] S103. Receive the first response message sent by the destination physical node.

[0100] In this embodiment, if the destination physical node receives the first target request message, it can generate a first response message based on the information in the first target request message, and then return it to the virtual router along the same path.

[0101] S104. Based on the first address mapping table and the second address mapping table, the first response message is processed by address mapping to obtain the first target response message.

[0102] S105. Forward the first target response message to the virtual node.

[0103] In this embodiment, during the address mapping process, the destination address field of the first response message can be converted using the first address mapping table, and the source address field of the first response message can be converted using the second address mapping table. After obtaining the first target response message, the routing table can be looked up to return the first response request to the virtual node that initiated the request.

[0104] The address translation method provided in this embodiment of the invention uses a mapping between IP addresses in the pre-configured first address translation table and the second address translation table. Therefore, it allows virtual nodes in the virtual intranet to access physical nodes in the physical extranet, and can also map the topology of the physical extranet to the virtual intranet.

[0105] In one optional implementation, the first address mapping table may include the mapping relationship between the actual virtual IP address and the mapped physical IP address of each virtual node. The mapped physical IP address is the address presented by the virtual node to the physical external network, and different virtual nodes have different mapped physical IP addresses. The second address mapping table may include the mapping relationship between the actual physical IP address and the mapped virtual IP address of each physical node. The mapped virtual IP address is the address presented by the physical node to the virtual internal network, and different physical nodes have different mapped virtual IP addresses.

[0106] In another alternative implementation, the virtual IP addresses of all virtual nodes can be mapped to a unified host IP address, and then the different virtual nodes can be distinguished by port numbers.

[0107] Therefore, the first address mapping table can include the mapping relationship between the actual identification information of the virtual node and the mapped identification information displayed by the virtual node on the physical external network. The actual identification information includes the actual virtual IP address and the actual port number, and the mapped identification information includes the host IP address and the host port number. The second address mapping table can include the mapping relationship between the actual physical IP address of the physical node and the mapped virtual IP address displayed by it on the virtual internal network.

[0108] Therefore, the process of performing address mapping processing on the first request message based on the first address mapping table and the second address mapping table in step S101 above to obtain the first target request message may include the following sub-steps S1011 to S1014:

[0109] S1011. Parse the first request message to obtain the source address field, destination address field, and source port field of the first request message.

[0110] In this embodiment, in the first request message, the source address field is the actual virtual IP address of the virtual node that initiated the request, the destination address field is the mapped virtual IP address of the destination physical node that is the request recipient in the virtual intranet, and the source port field is the actual port number used to characterize the traffic belonging to the virtual node.

[0111] S1012. Find the host IP address and host port number that match the actual virtual IP address and actual port number of the virtual node from the first address mapping table.

[0112] S1013. Find the actual physical IP address of the target physical node that matches the mapped virtual IP address of the target physical node in the virtual intranet from the second address mapping table.

[0113] S1014. Based on the host IP address and host port number corresponding to the virtual node and the actual physical IP address of the target physical node, the first request message is re-encapsulated to obtain the first target request message.

[0114] In this embodiment, after re-encapsulation, in the first target request message: the source address field can be the host IP address, the destination address field can be the actual physical IP address of the target physical node, and the source port field can be the host port number.

[0115] Therefore, the process of performing address mapping processing on the first response message based on the first address mapping table and the second address mapping table to obtain the first target response message in step S104 above may include the following sub-steps S1041 to S1044:

[0116] S1041. Parse the first response message to obtain the source address field, destination address field, and destination port field of the first response message.

[0117] In this embodiment, in the first response message, the source address field is the actual physical IP address of the destination physical node that is the request recipient, the destination address field is the host IP address corresponding to the virtual node that initiated the request, and the destination port field is the host port number corresponding to the virtual node.

[0118] S1042. Find the actual virtual IP address and actual port number of the virtual node that match the host machine IP address and host machine port number from the first address mapping table.

[0119] S1043. Find the mapped virtual IP address of the target physical node in the virtual intranet that matches the actual physical IP address of the target physical node from the second address mapping table.

[0120] S1044. Based on the mapped virtual IP address of the destination physical node in the virtual intranet and the actual virtual IP address and actual port number of the virtual node, the first response message is re-encapsulated to obtain the first target response message.

[0121] In this embodiment, after re-encapsulation, the first target response message contains: the source address field is the mapped virtual IP address of the target physical node as the request recipient in the virtual intranet, the destination address field is the actual virtual IP address of the virtual node initiating the request, and the destination port number field is the actual port number of the virtual node.

[0122] In this invention, while mapping the network topology of the physical external network to the network topology of the virtual internal network, it ensures that the actual virtual IP addresses of each virtual node in the virtual internal network are not exposed to the external network, thus avoiding network attacks on the virtual internal network.

[0123] The following is an example of a possible scenario where a virtual node in a virtual intranet initiates an access request to a physical node in a physical extranet.

[0124] If the virtual router in the virtual intranet connects to 7 virtual nodes (virtual nodes 1-7), and the physical switch also connects to 7 physical nodes (physical nodes 1-7), assuming the first address mapping table and the second address mapping table are Table 1 and Table 2 as follows:

[0125] Table 1 First Address Mapping Table

[0126] Virtual node sequence number Actual virtual IP address: Actual port number Host IP address: Host port number 1 192.168.1.2:21 172.168.1.10:22221 2 192.168.1.3:22 172.168.1.10:22222 3 192.168.1.4:23 172.168.1.10:22223 4 192.168.1.5:225 172.168.1.10:22224 5 192.168.1.6:443 172.168.1.10:22225 6 192.168.1.7:445 172.168.1.10:22226 7 192.168.1.8:80 172.168.1.10:22227

[0127] Table 2 Second Address Mapping Table

[0128] Physical node number Actual physical IP address Mapping virtual IP addresses 1 172.168.1.101 192.168.2.101 2 172.168.1.102 192.168.2.102 3 172.168.1.103 192.168.2.103 4 172.168.1.104 192.168.2.104 5 172.168.1.105 192.168.2.105 6 172.168.1.106 192.168.2.106 7 172.168.1.107 192.168.2.107

[0129] Based on Tables 1 and 2, if virtual node 3 (192.168.1.4) needs to access the services of physical node 1 (172.168.1.101), the following process applies:

[0130] 1. Virtual node 3 then generates a first request message (source address 192.168.1.4, source port 23, destination address 192.168.2.101) and sends the first request message to the virtual router;

[0131] 2. Based on Table 1 above, the virtual router determines that "192.168.1.4:23" corresponds to "172.168.1.10:22223", and based on Table 2 above, determines that "192.168.2.101" corresponds to "172.168.1.101". Therefore, the virtual router can re-encapsulate the first request packet into a first destination request packet (source address 172.168.1.10, source port 22223, destination address 172.168.1.101).

[0132] 3. The virtual router forwards the first target request packet to physical node 1 (172.168.1.101) through the host physical network card and physical switch bridged by OVS;

[0133] 4. After receiving the first target request message, physical node 1 (172.168.1.101) can generate a first response message (source address 172.168.1.101, destination address 172.168.1.10, destination port 22223), and then forward the first response message to the virtual router through the physical switch and the host machine's physical network card;

[0134] 5. Based on Table 2 above, the virtual router determines that "172.168.1.101" corresponds to "192.168.2.101", and based on Table 1 above, determines that "172.168.1.10:22223" corresponds to "192.168.1.4:23". Then, the virtual router can re-encapsulate the first response packet into a first destination response packet (source address is 192.168.2.101, destination address is 192.168.1.4, and destination port is 23).

[0135] 6. The virtual router sends the first target response message to virtual node 3 (192.168.1.4).

[0136] It should be noted that the above examples are for illustrative purposes only. The number of nodes and the IP addresses of the nodes in the virtual intranet and physical extranet should be determined based on the actual application and are not limited here.

[0137] In an optional implementation, physical nodes on the physical external network can also initiate access requests to virtual nodes on the virtual internal network. To meet this requirement, a third address mapping table can be pre-configured in the virtual router. This third address mapping table can include the mapping relationship between the actual virtual IP address of the virtual node and its mapped physical IP address on the physical external network. The mapped physical IP addresses of different virtual nodes are different.

[0138] Correspondingly, the address translation method may also include the following steps S106 to S109:

[0139] S106. When a second request message sent by any physical node to the virtual intranet is received, the destination address field of the second request message is converted based on the third address mapping table to obtain the second target request message.

[0140] In this embodiment, the destination address field of the second request message can be converted using a third address mapping table during address translation.

[0141] Optionally, the sub-steps of step S106 may include S1061 to S1063:

[0142] S1061. Parse the second request message to obtain the destination address field of the second request message;

[0143] S1062. Find the actual virtual IP address that matches the mapped physical IP address of the destination virtual node on the physical external network from the third address mapping table;

[0144] S1063. Based on the actual virtual IP address of the destination virtual node, re-encapsulate the second request message to obtain the second target request message.

[0145] In this embodiment, the destination address field in the second request message is the mapped physical IP address of the destination virtual node, which is the request recipient, on the physical external network. After address translation, the destination address field in the second target request message is the actual virtual IP address of the destination virtual node, which is the request recipient. S107: Forward the second target request message to the destination virtual node.

[0146] S1068. Receive the second response message sent by the destination virtual node.

[0147] It is understandable that the destination virtual node, as the recipient of the request, can generate a second response message based on the second target request message when it receives the second target request message, and then return the second response message to the virtual router along the same path.

[0148] S109. Based on the third address mapping table, the source address field of the second response message is converted to obtain the second target response message, and the second target response message is forwarded to the physical node.

[0149] In this embodiment, the source address field of the second response message can be converted using a third address mapping table during address translation.

[0150] Optionally, the sub-steps of step S109 may include S1091 to S1093:

[0151] S1091. Parse the second response message to obtain the source address field of the second response message;

[0152] S1092. Find the physical IP address of the destination virtual node on the physical external network that matches the actual virtual IP address of the destination virtual node from the third address mapping table;

[0153] S1093. Based on the mapped physical IP address of the destination virtual node on the physical external network, the second response message is re-encapsulated to obtain the second target response message.

[0154] In this embodiment, in the second response message, the source address field is the actual virtual IP address of the destination virtual node, which is the request recipient. In the second target response message after address translation, the source address field is the mapped physical IP address of the destination virtual node, which is the request recipient, on the physical external network.

[0155] It should be noted that the execution order of each step in the above method embodiments is not limited to that shown in the attached figures, and the execution order of each step shall be subject to the actual application situation.

[0156] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0157] First, in this invention, because the virtual router is pre-configured with a first address translation table and a second address translation table, SNAT and DNAT can be combined during the process of virtual nodes in the virtual intranet accessing services provided by physical nodes in the physical extranet. This allows the physical extranet to be mapped to the virtual intranet in a customized manner. Furthermore, this technical solution is also applicable to other application scenarios where different IP network topologies are compatible, and is not limited to virtual-physical hybrid application scenarios.

[0158] Secondly, since it uses the NAT (Network Address Translation) method, there are no restrictions on the network topology of the two sides when the virtual external network and the physical internal network are compatible. It is even possible to map physical nodes in different locations to the topology of the virtual internal network through the Internet, VPN, etc.

[0159] Third, in this invention, the virtual network host and each physical node can be connected to each other in any way (direct connection, Layer 2 switch, Layer 3 switch, router, etc. are all possible). Therefore, compared with the prior art, this invention can reduce the dependence on physical hardware switching equipment and save the cost of hardware equipment.

[0160] Fourth, in this invention, physical nodes can be located in a three-layer network. Therefore, during deployment and subsequent maintenance, it is only necessary to ensure network connectivity between the virtual intranet host and the physical nodes. There are no specific requirements for the network connection process, which greatly increases the flexibility and fault tolerance of deployment and maintenance, improves efficiency, and saves manpower costs.

[0161] In order to perform the corresponding steps in the above method embodiments and various possible implementations, an implementation of an address translation device is given below.

[0162] Please see Figure 6 , Figure 6 A schematic diagram of the address translation device provided in an embodiment of the present invention is shown. The address translation device 200 is applied to a virtual router in a virtual intranet. The virtual router is communicatively connected to multiple virtual nodes in the virtual intranet and at least one physical node in the physical extranet. The virtual router is pre-configured with a first address mapping table and a second address mapping table. The first address mapping table is used to implement IP address mapping from the virtual intranet to the physical extranet; the second address mapping table is used to implement IP address mapping from the physical extranet to the virtual intranet.

[0163] The address translation device 200 includes: a first processing module 210 and a second processing module 220.

[0164] The first processing module 210 is configured to: when receiving a first request message sent by any virtual node to the physical external network, perform address mapping processing on the first request message based on the first address mapping table and the second address mapping table to obtain a first target request message; and forward the first target request message to the destination physical node.

[0165] The second processing module 220 is configured to: receive a first response message sent by a destination physical node; the first response message is generated when the destination physical node receives a first target request message; perform address mapping processing on the first response message based on a first address mapping table and a second address mapping table to obtain a first target response message; and forward the first target response message to a virtual node.

[0166] Optionally, the virtual router may also be pre-configured with a third address mapping table, which includes the mapping relationship between the actual virtual IP address of the virtual node and its mapped physical IP address on the external physical network. The address translation device 200 may further include:

[0167] The third processing module 230 is configured to: when receiving a second request message sent by any physical node to the virtual intranet, convert the destination address field of the second request message based on the third address mapping table to obtain a second target request message; and forward the second target request message to the destination virtual node.

[0168] The fourth processing module 240 is used to: receive a second response message sent by the destination virtual node; the second response message is generated when the destination virtual node receives the second target request message; convert the source address field of the second response message based on the third address mapping table to obtain the second target response message; and forward the second target response message to the physical node.

[0169] Those skilled in the art will clearly understand that the first processing module 210 can be used to implement the above-described steps S101, S102 and their respective sub-steps; the second processing module 220 can be used to implement the above-described steps S103-S105 and their respective sub-steps; the third processing module 230 can be used to implement the above-described steps S106, S107 and their respective sub-steps; and the fourth processing module 240 can be used to implement the above-described steps S108, S109 and their respective sub-steps. For the sake of convenience and brevity, the specific working process of the address conversion device 200 described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0170] This invention also provides a host machine, the virtual intranet constructed by the host machine including a virtual router and multiple virtual nodes communicatively connected to the virtual router. The virtual router is used to implement the address translation method described above. The host machine may also include more or fewer components, which will not be elaborated here.

[0171] The memory 320 may be, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0172] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the address translation method disclosed in the above embodiments. The computer-readable storage medium may be, but is not limited to, a USB flash drive, a portable hard drive, random access memory (RAM), read-only memory (ROM), flash memory, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), a magnetic disk, or an optical disk, or any other medium capable of storing program code.

[0173] In summary, this invention provides an address translation method, apparatus, host machine, and computer-readable storage medium. The virtual router of the virtual intranet is pre-configured with a first address mapping table and a second address mapping table. When the virtual router receives a first request packet from a virtual node targeting the physical external network, it can perform address mapping processing on the packet based on the two tables before forwarding it to the destination physical node. Similarly, when it receives a first response packet from the destination physical node, it performs address mapping processing on the packet based on the two tables before forwarding it to the virtual node. Since the first address mapping table is used to implement IP address mapping from the virtual intranet to the physical external network, and the second address mapping table is used to implement IP address mapping from the physical external network to the virtual intranet, the two address mapping tables can map the physical network to the virtual network, enabling virtual nodes in the virtual network to actively access physical nodes. Furthermore, since the two mapping tables represent mappings between IP addresses, the mappable physical networks are not limited to Layer 2 networks.

[0174] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An address translation method, characterized in that, A virtual router applied to a virtual intranet, the virtual router being communicatively connected to multiple virtual nodes in the virtual intranet and at least one physical node in the physical extranet; the virtual router is pre-configured with a first address mapping table and a second address mapping table; the first address mapping table includes the mapping relationship between the actual identification information of the virtual node and the mapped identification information of the virtual node displayed in the physical extranet, the actual identification information including the actual virtual IP address and the actual port number, and the mapped identification information including the host IP address and the host port number; the second address mapping table includes the mapping relationship between the actual physical IP address of the physical node and the mapped virtual IP address displayed in the virtual intranet; the method includes: When a first request message sent by any of the virtual nodes to the physical external network is received, the source address field and source port field of the first request message are mapped based on the first address mapping table and the second address mapping table, respectively, and the destination address field is mapped to obtain the first target request message. Forward the first target request message to the destination physical node; Receive a first response message sent by the destination physical node; the first response message is generated by the destination physical node when it receives the first target request message; Based on the first address mapping table and the second address mapping table respectively, the destination address field and destination port field of the first response message are mapped, and the source address field is mapped to obtain the first target response message; The first target response message is forwarded to the virtual node.

2. The method according to claim 1, characterized in that, The steps of mapping the source address field and source port field of the first request message and mapping the destination address field based on the first address mapping table and the second address mapping table, respectively, to obtain the first target request message, include: The first request message is parsed to obtain the source address field, destination address field, and source port field of the first request message; wherein, the source address field is the actual virtual IP address of the virtual node, the destination address field is the mapped virtual IP address of the destination physical node in the virtual intranet, and the source port field is the actual port number of the virtual node; Find the host machine IP address and host machine port number that match the actual virtual IP address and actual port number of the virtual node from the first address mapping table; Find the actual physical IP address of the target physical node that matches the mapped virtual IP address of the target physical node in the virtual intranet from the second address mapping table; Based on the host IP address and host port number corresponding to the virtual node and the actual physical IP address of the target physical node, the first request message is re-encapsulated to obtain the first target request message.

3. The method according to claim 1, characterized in that, The steps of mapping the destination address field and destination port field of the first response message based on the first address mapping table and the second address mapping table, respectively, and mapping the source address field to obtain the first target response message, include: The first response message is parsed to obtain the source address field, destination address field, and destination port field of the first response message; wherein, the source address field is the actual physical IP address of the destination physical node, the destination address field is the host IP address corresponding to the virtual node, and the destination port field is the host port number corresponding to the virtual node. Find the actual virtual IP address and actual port number of the virtual node that match the host machine IP address and the host machine port number from the first address mapping table; Find the mapped virtual IP address of the target physical node in the virtual intranet that matches the actual physical IP address of the target physical node from the second address mapping table; Based on the mapped virtual IP address of the target physical node in the virtual intranet, as well as the actual virtual IP address and actual port number of the virtual node, the first response message is re-encapsulated to obtain the first target response message.

4. The method according to claim 1, characterized in that, The virtual router is also pre-configured with a third address mapping table, which includes the mapping relationship between the actual virtual IP address of the virtual node and its mapped physical IP address displayed on the physical external network; the method further includes: When a second request message is received from any of the physical nodes for the virtual intranet, the destination address field of the second request message is converted based on the third address mapping table to obtain a second target request message. Forward the second target request message to the destination virtual node; Receive a second response message sent by the destination virtual node; the second response message is generated by the destination virtual node when it receives the second target request message; The source address field of the second response message is converted based on the third address mapping table to obtain the second target response message; The second target response message is forwarded to the physical node.

5. The method according to claim 4, characterized in that, The step of converting the destination address field of the second request message based on the third address mapping table to obtain the second target request message includes: The second request message is parsed to obtain the destination address field of the second request message; the destination address field is the mapped physical IP address of the destination virtual node on the physical external network; Find the actual virtual IP address that matches the mapped physical IP address of the target virtual node on the physical external network from the third address mapping table; Based on the actual virtual IP address of the destination virtual node, the second request message is re-encapsulated to obtain the second target request message.

6. The method according to claim 4, characterized in that, The step of converting the source address field of the second response message based on the third address mapping table to obtain the second target response message includes: The second response message is parsed to obtain the source address field of the second response message; the source address field is the actual virtual IP address of the destination virtual node; Find the mapped physical IP address of the target virtual node on the physical external network that matches the actual virtual IP address of the target virtual node from the third address mapping table; Based on the mapped physical IP address of the destination virtual node on the physical external network, the second response message is re-encapsulated to obtain the second target response message.

7. An address translation device, characterized in that, A virtual router for use in a virtual intranet, the virtual router being communicatively connected to multiple virtual nodes in the virtual intranet and at least one physical node in the physical extranet; the virtual router is pre-configured with a first address mapping table and a second address mapping table; the first address mapping table includes the mapping relationship between the actual identification information of the virtual node and the mapped identification information of the virtual node displayed in the physical extranet, the actual identification information including the actual virtual IP address and the actual port number, and the mapped identification information including the host IP address and the host port number; the second address mapping table includes the mapping relationship between the actual physical IP address of the physical node and the mapped virtual IP address displayed in the virtual intranet; the device includes: The first processing module is used for: When a first request message is received from any of the virtual nodes targeting the physical external network, the source address field and source port field of the first request message are mapped based on the first address mapping table and the second address mapping table, respectively, and the destination address field is mapped to obtain the first target request message. Forward the first target request message to the destination physical node; The second processing module is used for: Receive a first response message sent by the destination physical node; the first response message is generated by the destination physical node when it receives the first target request message; Based on the first address mapping table and the second address mapping table respectively, the destination address field and destination port field of the first response message are mapped, and the source address field is mapped to obtain the first target response message; The first target response message is forwarded to the virtual node.

8. The apparatus according to claim 7, characterized in that, The virtual router is also pre-configured with a third address mapping table, which includes the mapping relationship between the actual virtual IP address of the virtual node and its mapped physical IP address displayed on the physical external network; the device also includes: The third processing module is used for: When a second request message is received from any of the physical nodes for the virtual intranet, the destination address field of the second request message is converted based on the third address mapping table to obtain a second target request message. Forward the second target request message to the destination virtual node; The fourth processing module is used for: Receive a second response message sent by the destination virtual node; the second response message is generated by the destination virtual node when it receives the second target request message; The source address field of the second response message is converted based on the third address mapping table to obtain the second target response message; The second target response message is forwarded to the physical node.

9. A host machine, characterized in that, The virtual intranet constructed by the host machine includes a virtual router and multiple virtual nodes that are communicatively connected to the virtual router. The virtual router is used to implement the address translation method as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the address translation method according to any one of claims 1-6.

Images