Network address port translation method and device, storage medium and electronic equipment

Abstract

The application provides a network address port translation method and device, a storage medium and an electronic device, and comprises the following steps: obtaining a hash index of a message; determining a port resource of a resource node corresponding to the hash index as a target port resource, and determining a target node state bit in each node state bit of a two-level bitmap; determining a first-level bitmap corresponding to the target node state bit as a target first-level bitmap, and determining a target port state bit in each port state bit of the target first-level bitmap; and performing network address port translation processing on the message by using a network address port corresponding to the target port state bit. By using each port state bit in the first-level bitmap and each node state bit in the two-level bitmap, an unoccupied network address port is quickly determined, the network address port translation processing is performed on the message, the time spent in determining an available network address port is reduced, and the performance of network address port translation is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, in particular to a network address port translation method and device, a storage medium and an electronic device. BACKGROUND

[0002] With the development of Internet of Things devices and the increase of network applications, the problem of IP address resource scarcity is increasingly prominent. At present, network address port translation (NAPT) technology is a main and effective technical means to solve the problem of serious IP address resource scarcity. NAPT technology can not only realize IP address conversion, but also realize port conversion, allowing multiple private network addresses to be mapped to the same public network address, thereby saving network resources.

[0003] In the NAPT conversion process, a public network IP address is first selected for user traffic, and then a converted port is allocated after the address is selected. The traditional port allocation method is to form a session connection by combining the port random number and the message of the message, and then query whether the session connection exists in the session list. If it does not exist, the port random number needs to be changed and the corresponding session connection in the session list needs to be determined again until the session connection that does not exist in the session list is obtained. The port corresponding to the port random number in the session connection is determined to be available. The whole process needs to be tried for multiple rounds, which takes a lot of time, and there is a problem that no available port can be found, resulting in conversion failure and reducing the performance of network port address conversion. SUMMARY

[0004] Therefore, the embodiments of the present application provide a network address port translation method and device, a storage medium and an electronic device, which can quickly find an available network address port, shorten the time for finding an available network address port, avoid the problem that no available port can be found, resulting in conversion failure and reducing the performance of network port address conversion.

[0005] To achieve the above object, the embodiments of the present application provide the following technical solutions:

[0006] A network address port translation method comprises:

[0007] Obtaining the hash index of a message with network address port translation demand;

[0008] determine a port resource of a resource node corresponding to the hash index as a target port resource, the target port resource managing the port resource using a first-level bitmap and a second-level bitmap; the first-level bitmap containing a plurality of port state bits, each of the port state bits being used to indicate an occupation state of a network address port corresponding thereto; the second-level bitmap containing a plurality of node state bits, each of the node state bits being used to indicate an idle state of the first-level bitmap corresponding thereto;

[0009] determine a target node state bit in each node state bit of the second-level bitmap, the target node state bit indicating that the first-level bitmap corresponding thereto is in an idle state;

[0010] determine a target first-level bitmap corresponding to the target node state bit, and determine a target port state bit in each port state bit of the target first-level bitmap, the target port state bit indicating that a network address port corresponding thereto is in a non-occupied state;

[0011] determine a target network address port corresponding to the target port state bit;

[0012] perform network address port translation processing on the packet using the target network address port.

[0013] A network address port translation apparatus, comprising:

[0014] an obtaining unit configured to obtain a hash index of a packet having a network address port translation requirement;

[0015] a first determining unit configured to determine a port resource of a resource node corresponding to the hash index as a target port resource, the target port resource managing the port resource using a first-level bitmap and a second-level bitmap; the first-level bitmap containing a plurality of port state bits, each of the port state bits being used to indicate an occupation state of a network address port corresponding thereto; the second-level bitmap containing a plurality of node state bits, each of the node state bits being used to indicate an idle state of the first-level bitmap corresponding thereto;

[0016] a second determining unit configured to determine a target node state bit in each node state bit of the second-level bitmap, the target node state bit indicating that the first-level bitmap corresponding thereto is in an idle state;

[0017] a third determining unit configured to determine a target first-level bitmap corresponding to the target node state bit, and determine a target port state bit in each port state bit of the target first-level bitmap, the target port state bit indicating that a network address port corresponding thereto is in a non-occupied state;

[0018] A fourth determining unit is configured to determine a network address port corresponding to the target port state bit as a target network address port.

[0019] A conversion processing unit is configured to perform network address port conversion processing on the packet using the target network address port.

[0020] A storage medium includes stored instructions, wherein the instructions, when executed, control a device in which the storage medium is located to perform the network address port conversion method as described above.

[0021] An electronic device includes a memory and one or more instructions, wherein the one or more instructions are stored in the memory and configured to be executed by one or more processors to perform the network address port conversion method as described above.

[0022] Compared with the prior art, the present application has the following advantages:

[0023] The present application provides a network address port conversion method and device, a storage medium and an electronic device, the method comprising: obtaining a hash index of a packet requiring network address port conversion; determining a port resource of a resource node corresponding to the hash index as a target port resource, the target port resource using a primary bitmap and a secondary bitmap to manage the port resource; the primary bitmap including a plurality of port state bits, each port state bit being used to indicate an occupation state of a network address port corresponding thereto; the secondary bitmap including a plurality of node state bits, each node state bit being used to indicate an idle state of a primary bitmap corresponding thereto; determining a target node state bit in each node state bit of the secondary bitmap; determining a primary bitmap corresponding to the target node state bit as a target primary bitmap, and determining a target port state bit in each port state bit of the target primary bitmap; determining a network address port corresponding to the target port state bit as a target network address port; and performing network address port conversion processing on the packet using the target network address port. The present application uses a primary bitmap and a secondary bitmap to manage the port resource, and quickly determines an unoccupied network address port through each port state bit in the primary bitmap and each node state bit in the secondary bitmap, and then performs network address port conversion processing on the packet using the network address port, thereby reducing the time spent in determining an available network address port and improving the performance of network address port conversion. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only represent some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative effort based on the provided drawings.

[0025] Figure 1 A method flow chart of a network address port translation method provided for an embodiment of the present application;

[0026] Figure 2 A method flow chart of obtaining a hash index of a message with a network address port translation requirement provided for an embodiment of the present application;

[0027] Figure 3 A structure schematic diagram of port resources of each resource node provided for an embodiment of the present application;

[0028] Figure 4 A method flow chart of releasing a network address port provided for an embodiment of the present application;

[0029] Figure 5 Still another method flow chart of a network address port translation method provided for an embodiment of the present application;

[0030] Figure 6 A structure schematic diagram of a network address port translation device provided for an embodiment of the present application;

[0031] Figure 7 A structure schematic diagram of an electronic device provided for an embodiment of the present application. DETAILED DESCRIPTION

[0032] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments only represent some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort fall within the protection scope of the present application.

[0033] In the present application, the term “comprising”, “containing” or any other variant thereof is intended to cover non-exclusive containing, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitation, the element defined by the sentence “including a…” does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0034] At present, in the NAPT conversion process, a public network IP address is first selected for user traffic, and then a converted port is allocated after the address is selected. Wherein, how to allocate this port is particularly important, which relates to how many "multiple" in "multiple address conversion" is supported, and has a great influence on the conversion performance of the device.

[0035] There are existing problems such as low utilization rate of public network IP address resources and low port conversion performance in a large concurrent environment in the traditional mainstream NAPT implementation scheme, in order to solve the problem and the problem described in the background technology, the application provides a network address port conversion scheme using a mixed hash method and bitmap, which greatly expands the number of ports that can be used for converting private network addresses under the premise of not affecting the port address conversion performance.

[0036] The application can be used in many general or special computing device environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor devices, distributed computing environments including any of the above devices or devices, etc. The method provided by the application can be applied to network communication devices with network address port conversion requirements, and the execution subject of the application can be a processor or a server.

[0037] Reference Figure 1 A network address port conversion method provided by an embodiment of the application is provided, and the method flow chart is described as follows.

[0038] S101, obtain the hash index of the message with network address port conversion requirement.

[0039] The message with network address port conversion requirement is received, and the hash index is obtained based on the information of the message, and the hash index is used to determine the resource node.

[0040] Reference Figure 2 A method flow chart for obtaining the hash index of the message with network address port conversion requirement provided by an embodiment of the application is provided, and the specific description is as follows.

[0041] S201, obtain the private network address of the message, and perform hash processing on the private network address to obtain a public network hash index.

[0042] It should be noted that the private network address of the message can be understood as the IP address applied by the communication device sending the message.

[0043] The hash algorithm can be used to perform hash processing on the private network address, so as to obtain the public network hash index, and further, the public network hash index can be expressed as hashindex.

[0044] The public network hash index is used for searching the public network address; further, the specific hash algorithm is not exemplarily illustrated here, and the hash algorithm of the hash index can be applied to the present application.

[0045] S202, determining the public network address corresponding to the public network hash index in the preset public network address pool, and determining the public network address as the source address of the message.

[0046] The public network address pool can be represented as a NAT address pool, and the public network address pool contains multiple public network addresses; the public network address is selected in the public network address pool through the public network hash index, and the selected public network address is used as the source address of the message, in other words, the public network address is the converted source address of the message.

[0047] Preferably, different public network hash indexes correspond to different public network addresses, and further, one public network address can correspond to multiple public network hash indexes.

[0048] S203, determining the destination address, destination interface and transmission protocol of the message.

[0049] The message is parsed to obtain the destination address, destination interface and transmission protocol of the message.

[0050] The destination address is the address applied by the device receiving the message, the destination interface is the interface applied by the device receiving the message, and the transmission protocol is the protocol applied by the communication device sending the message; exemplarily, the transmission protocol can be TCP / IP protocol, HTTP protocol, ARP protocol, etc.

[0051] S204, taking the source address, destination address, destination interface and transmission protocol of the message as the hash key information of the message.

[0052] Preferably, the hash key information can be understood as hash key, and the hash key is a 4-tuple; the hash key information includes the source address, destination address, destination interface and transmission protocol of the message; the source address here is the public network address determined by the public network hash index in S202.

[0053] S205, processing the hash key information to obtain the hash index of the message.

[0054] The hash key information can be processed by using a hash algorithm to obtain the hash index; preferably, the hash index can also be represented as hash index, and the hash index is used for determining the port resource.

[0055] Further, the hash algorithm used herein can be consistent with or different from the hash algorithm used in S201. The hash algorithm used herein is preferably as discrete as possible, so that different hash key information will obtain different hash indexes, so as to obtain different port resources subsequently.

[0056] Preferably, in obtaining the hash index of the message, the hash key information of the message includes the source address, the destination address, the destination interface, and the transmission protocol, and each group of data will obtain a different hash index. In the case where the public network address does not change, any change in the destination address, the destination interface, and the transmission protocol will generate a different hash index. Different hash indexes correspond to different port resources, greatly expanding the number of private network addresses that can be used for the state of a public network address, expanding the available network address port resources of a public network address, so that different port resources can be obtained subsequently, and the situation of occupying port resources can be avoided.

[0057] S102, determine the port resources of the resource node corresponding to the hash index as target port resources, and the target port resources use a primary bitmap and a secondary bitmap to manage the port resources. The primary bitmap includes a plurality of port state bits, and each port state bit is used to indicate the occupation state of the network address port corresponding thereto. The secondary bitmap includes a plurality of node state bits, and each node state bit is used to indicate the idle state of the primary bitmap corresponding thereto.

[0058] Based on the hash index, the specific resource node can be located. The resource node herein can be a hash node, and each resource node has corresponding port resources.

[0059] The resource node corresponding to the hash index is determined, and then the port resources of the determined resource node are determined as target port resources.

[0060] It should be noted that the port resources are organized and managed using a multi-level bitmap. Specifically, the port resources include a plurality of primary bitmaps and a secondary bitmap. The primary bitmap includes a plurality of port state bits, and the port state bits correspond one-to-one to the network address ports. The port state bits are used to indicate the occupation state of the network address port corresponding thereto.

[0061] The secondary bitmap includes a plurality of node state bits, and the node state bits correspond one-to-one to the primary bitmap Figure 1 . The node state bits are used to indicate the idle state of the primary bitmap corresponding thereto.

[0062] Preferably, one primary bitmap corresponds to one primary node, and each primary node manages 256 network address ports. Therefore, the primary bitmap is a 256-bit bitmap. Furthermore, the primary bitmap has 256 port status bits. The number of primary bitmaps for each port resource is related to the size of the port resource range. The number of primary bitmaps for a port resource is equal to the size of the port resource range divided by the size of the primary bitmap. For example, if the size of the port resource range is 64KB and the size of the primary bitmap is 256 bits, then the number of primary bitmaps for the port resource is: 64KB / 256 bits = 256.

[0063] Based on the number of primary bitmaps, secondary bitmaps are allocated, with one secondary bitmap corresponding to one secondary node. If there are 256 primary bitmaps, then each secondary bitmap will have 256 bits. That is, each bit of the secondary bitmap corresponds to each primary bitmap node. Figure 1 In a one-to-one correspondence, the bits in the second-level bitmap can be understood as the node status bits of the second-level nodes.

[0064] Reference Figure 3 The diagram below illustrates the structure of port resources for each resource node in this embodiment of the invention.

[0065] like Figure 3 As shown, there are n resource nodes, which can be determined using the hash index of the message. Each resource node has port resources, which are managed using a secondary bitmap and a primary bitmap. Each resource node has a secondary bitmap with multiple node status bits. Each node status bit indicates the idle status of its corresponding primary bitmap. Specifically, when the value of a node status bit is 1, it indicates that the primary bitmap corresponding to that node's status bit is not idle; when the value of a node status bit is 0, it indicates that the primary bitmap corresponding to that node's status bit is idle. The primary bitmap contains multiple port status bits, each indicating the occupancy status of its corresponding network address port. When the value of a port status bit is 1, it indicates that the network address port corresponding to that port's status bit is occupied; when the value of a port status bit is 0, it indicates that the network address port corresponding to that port's status bit is not occupied. It should be noted that the node status bit in the second-level bitmap corresponding to the first-level bitmap can be set to 1 only when all port status bits in the first-level bitmap are 1; otherwise, the node status bit in the second-level bitmap corresponding to the first-level bitmap is 0.

[0066] By organizing port resources using multi-level bitmaps, the lookup rate for finding unoccupied network address ports for packets is improved, providing more stable lookup performance. This solution does not cause a decrease in conversion performance as the number of device session concurrency increases, thus ensuring the performance of network address port conversion.

[0067] S103, determine a target node state bit in each node state bit of the secondary bitmap.

[0068] The process of determining the target node state bit in each node state bit of the secondary bitmap is as follows: determining a node state bit in the secondary bitmap representing that the primary bitmap is in an idle state as a first node state bit; determining the order position of each first node state bit in the secondary bitmap, and determining the first node state bit with the most forward order position as the target node state bit.

[0069] S104, determine a target primary bitmap corresponding to the target node state bit, and determine a target port state bit in each port state bit of the target primary bitmap.

[0070] The process of determining the target port state bit in each port state bit of the target primary bitmap is as follows: determining a port state bit in the target primary bitmap representing that the network address port is in an unoccupied state as a first port state bit; determining the order position of each first port state bit in the target primary bitmap, and determining the first port state bit with the most forward order position as the target port state bit.

[0071] The present application selects the node state bit with the most forward order position and representing that the primary bitmap is in an idle state in the secondary bitmap, then selects the port state bit with the most forward order position and representing that the network address port is in an unoccupied state in the primary bitmap, and then determines the network address port corresponding to the port state bit as the target network address port. The present application selects the network address port from front to back, which can avoid missing the network address port in an unoccupied state, and improve the utilization rate of the port.

[0072] S105, determine the target network address port corresponding to the target port state bit.

[0073] S106, perform network address port conversion processing on the message using the target network address port.

[0074] In the method provided by the embodiment of the present application, the hash index of the message requiring network address port translation is obtained; the port resource of the resource node corresponding to the hash index is determined as target port resource, and the target port resource uses a first bitmap and a second bitmap to manage the port resource; the first bitmap contains a plurality of port state bits, and each port state bit is used to indicate the occupation state of the network address port corresponding thereto; the second bitmap contains a plurality of node state bits, and each node state bit is used to indicate the idle state of the first bitmap corresponding thereto; the target node state bit is determined in each node state bit of the second bitmap; the first bitmap corresponding to the target node state bit is determined as target first bitmap, and the target port state bit is determined in each port state bit of the target first bitmap; the network address port corresponding to the target port state bit is determined as target network address port; and the message is processed by network address port translation using the target network address port. By using the first bitmap and the second bitmap to manage the port resource, and by each port state bit in the first bitmap and each node state bit in the second bitmap, the unoccupied network address port is quickly determined, and then the message is processed by network address port translation using the network address port, so that the time spent in determining the available network address port is reduced, and the performance of network address port translation is improved.

[0075] Further, after the message is processed by network address port translation using the target network address port, the target port state bit is updated, so that the updated target port state bit indicates that the target network address port is in the occupied state. Preferably, the target port state bit is set to 1 at this time, which can be understood as setting the port state bit to indicate that the target network address port is in the occupied state.

[0076] After the target port state bit is set to 1, it can be determined whether there is a port state bit indicating that the network address port is in the unoccupied state in the target first bitmap; in other words, it is determined whether there is a port state bit not set to 1 in the target first bitmap; the port state bit not set to 1 is 0.

[0077] If there is no port state bit indicating that the network address port is in the unoccupied state in the target first bitmap, the target node state bit is updated, so that the updated target node state bit indicates that the first bitmap corresponding thereto is in the non-idle state; it should be noted that the target node state bit is set to 1, which can be understood as setting the node state bit to make the target node state bit indicate that the first bitmap corresponding thereto is in the non-idle state. Further, if there is no port state bit indicating that the network address port is in the unoccupied state in the target first bitmap, it indicates that each port state bit in the target first bitmap is 1.

[0078] When there is a port state bit of 0 in the target one-level bitmap, the target node state bit cannot be set to 1, i.e., the target node state bit remains 0.

[0079] By using the node state bit and the port state bit to represent whether there is a network address port available for use, and by using the node state bit and the port state bit to quickly determine the available network address port, the port utilization rate and the search accuracy are improved.

[0080] It should be noted that the network address port will be released when it has been occupied for a long time or the corresponding device ends the session, so as to put the network address port back into use and improve the port reuse rate.

[0081] Referring to Figure 4 The method for releasing a network address port provided by the embodiment of the application is shown in the flowchart below.

[0082] S401, when receiving a port release instruction, obtaining port resource information in the port release instruction.

[0083] It should be noted that the port resource information includes source address, destination address, destination port, transmission protocol and the like.

[0084] The port release instruction is an instruction generated for the network address port to be released, and the instruction can also include the port number of the network address port.

[0085] S402, performing hash processing on the source address, the destination address, the destination port and the transmission protocol in the port resource information to obtain a port resource index.

[0086] Preferably, the port resource index is used to determine the port resource.

[0087] Preferably, when performing hash processing on the source address, the destination address, the destination port and the transmission protocol in the port resource information, the hash algorithm applied is the same as the hash algorithm in S205 in Figure 2

[0088] S403, determining a to-be-processed port resource based on the port resource index.

[0089] The port resource corresponding to the port resource index is determined as the to-be-processed port resource, and preferably, a hash node is first determined based on the port resource index, and then the port resource of the hash node is determined as the to-be-processed port resource.

[0090] Using the port resource index can quickly and accurately determine the port resource in which the network address port to be released is located, so as to facilitate subsequent determination of the specific location of the network address port to be released. ​

[0091] S404, determining the second node state bit in the secondary bitmap of the to-be-processed port resource based on the port number in the port release instruction, and determining the second port state bit in the primary bitmap corresponding to the second node state bit.

[0092] In the process of determining the second node state bit in the secondary bitmap of the to-be-processed port resource, the port number in the port release instruction can be processed, so that the second node state bit can be determined in the secondary bitmap of the to-be-processed port resource. After the second node state bit is determined, the second port state bit needs to be determined in the primary bitmap corresponding to the second node state bit.

[0093] For example, in the process of determining the second node state bit in the secondary bitmap, the port number can be divided by a preset value, and then the quotient obtained is rounded. The value obtained by rounding is the position of the second node state bit in the secondary bitmap that needs to be determined. The port number is divided by the preset value, and then the remainder is taken. The value obtained by taking the remainder is the position of the second port state bit in the primary bitmap corresponding to the second node state bit. The preset value can be the number of network address ports that can be managed by the primary bitmap. For example, when the port number is 1084, the second node state bit: 1084 / 256=4, indicating that the fourth node state bit in the secondary bitmap is the second node state bit; the second port state bit: 1084%256=60, indicating that the sixtieth port state bit in the primary bitmap corresponding to the second node state bit is the second port state bit.

[0094] S405, updating the second port state bit, so that the updated second port state bit indicates that the network address port corresponding thereto is in an unoccupied state.

[0095] After the network address port is released, the second port state bit is updated, i.e., the second port state bit is set to 0. At this time, it can be understood that the second port state bit is reset to indicate that the network address port corresponding to the second port state bit is in an unoccupied state.

[0096] S406, determining whether the second node state bit indicates that the primary bitmap corresponding thereto is in a non-idle state; if the second node state bit indicates that the primary bitmap corresponding thereto is in a non-idle state, performing S407; if the second node state bit indicates that the primary bitmap corresponding thereto is in an idle state, performing S408.

[0097] After the second port state bit is updated, it can be determined whether the second node state bit indicates that the first level bitmap corresponding thereto is in a non-idle state; if the second node state bit indicates that the first level bitmap corresponding thereto is in a non-idle state, the second node state bit needs to be updated, because there is already a network address port in a non-occupied state in the first level bitmap after the execution of S405, which means that there is a network address port in the first level bitmap that is available and idle, and the first level bitmap should not be in a non-idle state at this time.

[0098] If the second node state bit indicates that the first level bitmap corresponding thereto is in an idle state, the second node state bit is not processed, and S408 is executed.

[0099] S407, the second node state bit is updated, and the updated second node state bit indicates that the first level bitmap corresponding thereto is in an idle state.

[0100] The second node state bit is updated, that is, the second node state bit is set to 0, and at this time, it can be understood that the second node state bit is reset to indicate that the first level bitmap corresponding thereto is in an idle state.

[0101] S408, end.

[0102] In the method provided by the embodiment of the application, the port state bit in the first level bitmap and the node state bit in the second level bitmap are set and reset, thereby marking the idle state of the network address port, greatly improving the use rate of the port, the port conversion accuracy, and avoiding waste of port resources.

[0103] Reference Figure 5 Another method flow chart of a network address port conversion method provided by the embodiment of the application is provided, and specific descriptions are as follows.

[0104] S501, a public network address is selected.

[0105] For example, the source IP (private network address) of a message is used for hash to generate a corresponding hash index, and the corresponding public network address can be selected from a NAT address pool through the hash index, and the address is used as the source address of the converted message.

[0106] S502, a corresponding port resource is selected.

[0107] The hash algorithm applied in the application should be dispersed as much as possible, so that different 4-tuples will not be hashed to the same hash node, and thus will not occupy the port resources of each other.

[0108] S503, selecting an available network address port.

[0109] The port resources under each hash node are organized in a multi-level bitmap manner, and a two-level bitmap is taken as an example for specific explanation. A first-level bitmap is allocated first, assuming that each first-level node manages 256 ports, a 256-bit bitmap corresponds to a first-level node, and the total number of first-level nodes is 64KB (the port resource range is 64KB) / 256=256.

[0110] For example, when searching for an available port, the first idle bit in the second-level bitmap is checked first, assuming that the 5th bit in the second-level bitmap is the first idle bit, then only the first idle bit in the 256 bits of the first-level node corresponding to the 5th bit needs to be searched, assuming that the 60th bit is the first idle bit at this time, and thus the available port has been searched to this point, and the available port number=(5-1)*256+60=1084.

[0111] S504, setting the position of the corresponding bitmap.

[0112] The port state bit of the first-level bitmap found in S504 is set to an occupied state, and whether the first-level node is fully occupied is checked, if so, the node state bit of the corresponding second-level node also needs to be set to an occupied state.

[0113] S505, resetting the position of the corresponding bitmap.

[0114] For example, when the 5-tuple session is aged, the 4-tuple of source IP, destination IP, destination port and transmission protocol is hashed to the corresponding port resource, and then the first and second bitmap positions are pushed out by the source port number, and the first and second bitmap positions are set to the idle state. The second bitmap position = 1084 / 256 = the 4th position, and the first bitmap position = 1084%256 = the 60th position.

[0115] Further, the 5-tuple includes the source IP, the destination IP, the destination port, the transmission protocol and the network address port for conversion.

[0116] The present application provides a network address port conversion scheme based on HASH and bitmap technology, which greatly expands the number of public network addresses that can be used to convert private network addresses without affecting the performance of port address conversion, and overcomes the problems of affecting the performance of port conversion, failing to find available ports and leading to conversion failure in the prior art.

[0117] The 4-tuple of the converted source IP (public network IP) address, destination IP address, destination port and protocol is used as a hash index to generate a hash node and manage a port resource, so that the uniqueness of the connection 5-tuple can be easily guaranteed without repeated checking in the existing session library.

[0118] The present application organizes each port resource in the form of a multi-level bitmap, improves the search efficiency and provides more stable conversion performance. The corresponding port state bit and node state bit are updated after port allocation, and the port state bit and node state bit are reset when the port is released. Through strict setting and resetting management, the accuracy of resource management is improved, and as long as there is an available port, it will be found, without wasting any port, thereby improving the utilization rate of port resources.

[0119] With Figure 1 Corresponding to the method shown in the figure, the present application also provides a network address port conversion device, which is used to support Figure 1 The specific implementation of the method, and the device can be applied to a processor or a server.

[0120] Referring to Figure 6 The structure of a network address port conversion device provided by the embodiment of the present application is shown in the figure, and the specific description is as follows.

[0121] The acquisition unit 601 is configured to acquire the hash index of the message with network address port conversion demand.

[0122] The first determining unit 602 is configured to determine a port resource of a resource node corresponding to the hash index as a target port resource, and the target port resource uses a first-level bitmap and a second-level bitmap to manage the port resource; the first-level bitmap includes a plurality of port state bits, and each port state bit is used to indicate an occupation state of a network address port corresponding to the port state bit; the second-level bitmap includes a plurality of node state bits, and each node state bit is used to indicate a free state of a first-level bitmap corresponding to the node state bit;

[0123] The second determining unit 603 is configured to determine a target node state bit in each node state bit of the second-level bitmap, and the target node state bit indicates that a first-level bitmap corresponding to the target node state bit is in a free state.

[0124] The third determining unit 604 is configured to determine a target first-level bitmap in the first-level bitmap corresponding to the target node state bit, and determine a target port state bit in each port state bit of the target first-level bitmap, and the target port state bit indicates that a network address port corresponding to the target port state bit is in a non-occupied state.

[0125] The fourth determining unit 605 is configured to determine a target network address port in the network address port corresponding to the target port state bit.

[0126] The conversion processing unit 606 is configured to perform network address port conversion processing on the message by using the target network address port.

[0127] In the device provided by the embodiment of the application, the hash index of the message with network address port conversion demand is acquired; the port resource of the resource node corresponding to the hash index is determined as a target port resource, and the target port resource uses a first-level bitmap and a second-level bitmap to manage the port resource; the first-level bitmap includes a plurality of port state bits, and each port state bit is used to indicate an occupation state of a network address port corresponding to the port state bit; the second-level bitmap includes a plurality of node state bits, and each node state bit is used to indicate a free state of a first-level bitmap corresponding to the node state bit; a target node state bit is determined in each node state bit of the second-level bitmap; a target first-level bitmap is determined in the first-level bitmap corresponding to the target node state bit, and a target port state bit is determined in each port state bit of the target first-level bitmap; a target network address port is determined in the network address port corresponding to the target port state bit; and network address port conversion processing is performed on the message by using the target network address port. By using the first-level bitmap and the second-level bitmap to manage the port resource, and by using each port state bit in the first-level bitmap and each node state bit in the second-level bitmap, an unoccupied network address port is quickly determined, and then the network address port conversion processing is performed on the message, so that the time spent in determining the available network address port is reduced, and the performance of the network address port conversion is improved.

[0128] In another embodiment of the present application, the apparatus comprises:

[0129] The obtaining unit 601 comprises:

[0130] The first determining sub-unit is configured to determine a public network address corresponding to the public network hash index in a preset public network address pool, and determine the public network address as the source address of the message.

[0131] The second determining sub-unit is configured to determine the destination address, the destination interface and the transmission protocol of the message.

[0132] The third determining sub-unit is configured to determine the source address, the destination address, the destination interface and the transmission protocol of the message as the hash key information of the message.

[0133] The processing sub-unit is configured to process the hash key information to obtain the hash index of the message.

[0134] In another embodiment of the present application, the second determining unit 603 comprises:

[0135] The fourth determining sub-unit is configured to determine the node state bit in the second-level bitmap indicating that the first-level bitmap is in an idle state as a first node state bit.

[0136] The fifth determining sub-unit is configured to determine the sorting position of each first node state bit in the second-level bitmap, and determine the first node state bit with the most forward sorting position as a target node state bit.

[0137] In another embodiment of the present application, the third determining unit 604 comprises:

[0138] The sixth determining sub-unit is configured to determine the port state bit in the target first-level bitmap indicating that the network address port is in a non-occupied state as a first port state bit.

[0139] The seventh determining sub-unit is configured to determine the sorting position of each first port state bit in the target first-level bitmap, and determine the first port state bit with the most forward sorting position as a target port state bit.

[0140] In another embodiment of the present application, the apparatus further comprises:

[0141] The first updating unit is configured to update the target port state bit, so that the updated target port state bit indicates that the target network address port is in an occupied state.

[0142] In another embodiment of the present application, the device further comprises:

[0143] The fifth determining unit is configured to determine whether there is a port state bit indicating that a network address port is in a non-occupied state in the target primary bitmap.

[0144] The second updating unit is configured to update the target node state bit, so that the updated target node state bit indicates that the primary bitmap corresponding thereto is in a non-idle state, if there is no port state bit indicating that a network address port is in a non-occupied state in the target primary bitmap.

[0145] In another embodiment of the present application, the device further comprises:

[0146] The obtaining unit is configured to obtain port resource information in the port release instruction when the port release instruction is received.

[0147] The hash processing unit is configured to perform hash processing on a source address, a destination address, a destination port and a transmission protocol in the port resource information to obtain a port resource index.

[0148] The sixth determining unit is configured to determine a to-be-processed port resource based on the port resource index.

[0149] The seventh determining unit is configured to determine a second node state bit in a secondary bitmap of the to-be-processed port resource and a second port state bit in a primary bitmap corresponding to the second node state bit based on a port number in the port release instruction.

[0150] The third updating unit is configured to update the second port state bit, so that the updated second port state bit indicates that a network address port corresponding thereto is in a non-occupied state.

[0151] The eighth determining unit is configured to determine whether the second node state bit indicates that a primary bitmap corresponding thereto is in a non-idle state.

[0152] The fourth updating unit is configured to update the second node state bit, so that the updated second node state bit indicates that a primary bitmap corresponding thereto is in an idle state, if the second node state bit indicates that a primary bitmap corresponding thereto is in a non-idle state.

[0153] The embodiment of the present application further provides a storage medium, which comprises stored instructions, wherein the instructions control a device where the storage medium is located to perform the network address port conversion method when the instructions are executed.

[0154] The embodiment of the present application further provides an electronic device, and a structure diagram thereof is as shown in Figure 7As shown, the computer device 700 specifically includes a memory 701, and one or more instructions 702, wherein the one or more instructions 702 are stored in the memory 701 and configured to be executed by the one or more processors 703 to perform the network address port translation method described above.

[0155] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0156] The specific implementation process of each of the above embodiments and its derivatives are within the protection scope of the present application.

[0157] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between each embodiment can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, it is described more simply, and the relevant part can be referred to the part of the method embodiment. The above described system and system embodiment are only illustrative, and the units described as separate components can be or can not be physically separated, and the components displayed as units can be or can not be physical units, that is, they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to the actual needs. Those skilled in the art can understand and implement without creative labor.

[0158] The professional person can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in the present text can be realized by electronic hardware, computer software or combination of both. In order to clearly show the interchangeability of hardware and software, the composition and steps of each example have been described in the above description. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical scheme. The professional person can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0159] The foregoing description of the disclosed embodiments enables a person skilled in the art to make or use the application. Modifications of these embodiments will occur to persons of skill in the art, and that the appended claims are intended to cover all such modifications that do not depart from the true spirit and scope of the application. Therefore, the application is not limited to the embodiments shown but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network address port translation method, characterized in that, include: Obtain the hash index of packets that require network address port translation; The port resources of the resource node corresponding to the hash index are determined as target port resources. The target port resources are managed using a first-level bitmap and a second-level bitmap. The first-level bitmap contains multiple port status bits, each of which is used to indicate the occupancy status of the network address port corresponding to it. The second-level bitmap contains multiple node status bits, each of which is used to indicate the idle status of the first-level bitmap corresponding to it. The target node status bit is determined from the status bits of each node in the secondary bitmap, and the target node status bit indicates that the corresponding primary bitmap is in an idle state. The first-level bitmap corresponding to the target node status bit is determined as the target first-level bitmap, and the target port status bit is determined in each port status bit of the target first-level bitmap. The target port status bit indicates that the network address port corresponding to it is in an unoccupied state. The network address port corresponding to the target port status bit is determined as the target network address port; The packet is processed using the target network address and port; The step of obtaining the hash index of a packet that requires network address port translation includes: Obtain the private network address of the message, and perform hash processing on the private network address to obtain the public network hash index; Determine the public address corresponding to the public hash index from the preset public address pool, and determine the public address as the source address of the message; Determine the destination address, destination interface, and transport protocol of the message; The source address, destination address, destination interface, and transport protocol of the message are used as the hash key information of the message; The hash key information is processed to obtain the hash index of the message.

2. The method according to claim 1, characterized in that, Determining the target node status bit from the status bits of each node in the secondary bitmap includes: The node status bit in the secondary bitmap that indicates that the primary bitmap is in an idle state is determined as the first node status bit; Determine the sorting position of each first node state bit in the secondary bitmap, and determine the first node state bit with the first sorting position as the target node state bit.

3. The method according to claim 1, characterized in that, Determining the target port status bit from each port status bit in the target first-level bitmap includes: The port status bit in the target first-level bitmap that indicates that the network address port is in an unoccupied state is determined as the first port status bit; Determine the sorting position of each first port status bit in the target first-level bitmap, and determine the first port status bit with the first sorting position as the target port status bit.

4. The method according to claim 1, characterized in that, Also includes: Update the target port status bit so that the updated target port status bit indicates that the target network address port is in use.

5. The method according to claim 4, characterized in that, Also includes: Determine whether there is a port status bit in the target first-level bitmap indicating that the network address port is in an unoccupied state; If there is no port status bit in the target first-level bitmap that indicates that the network address port is in an unoccupied state, then the target node status bit is updated so that the updated target node status bit indicates that its corresponding first-level bitmap is in a non-idle state.

6. The method according to claim 1, characterized in that, Also includes: When a port release command is received, the port resource information in the port release command is obtained; The source address, destination address, destination port, and transport protocol in the port resource information are hashed to obtain the port resource index. Based on the port resource index, determine the port resources to be processed; Based on the port number in the port release instruction, a second node status bit is determined in the secondary bitmap of the port resource to be processed, and a second port status bit is determined in the primary bitmap corresponding to the second node status bit. Update the second port status bit so that the updated second port status bit indicates that the network address port corresponding to it is in an unoccupied state; Determine whether the status bit of the second node indicates that its corresponding first-level bitmap is in a non-idle state; If the status bit of the second node indicates that its corresponding first-level bitmap is in a non-idle state, then update the status bit of the second node so that the updated status bit of the second node indicates that its corresponding first-level bitmap is in an idle state.

7. A network address port conversion device, characterized in that, include: The acquisition unit is used to acquire the hash index of packets that require network address port translation. The first determining unit is used to determine the port resources of the resource node corresponding to the hash index as the target port resources. The target port resources are managed using a first-level bitmap and a second-level bitmap. The first-level bitmap contains multiple port status bits, each of which is used to indicate the occupancy status of the network address port corresponding to it. The second-level bitmap contains multiple node status bits, each of which is used to indicate the idle status of the first-level bitmap corresponding to it. The second determining unit is used to determine the target node status bit in each node status bit of the secondary bitmap, wherein the target node status bit indicates that the corresponding primary bitmap is in an idle state. The third determining unit is used to determine the first-level bitmap corresponding to the target node status bit as the target first-level bitmap, and to determine the target port status bit in each port status bit of the target first-level bitmap, wherein the target port status bit indicates that the network address port corresponding to it is in an unoccupied state. The fourth determining unit is used to determine the network address port corresponding to the target port status bit as the target network address port; A conversion processing unit is used to perform network address port conversion processing on the packet using the target network address port. The acquisition unit is specifically configured as follows: Obtain the private network address of the message and perform hash processing on the private network address to obtain a public network hash index; determine the public network address corresponding to the public network hash index in a preset public network address pool, and determine the public network address as the source address of the message; Determine the destination address, destination interface, and transport protocol of the message; The source address, destination address, destination interface, and transport protocol of the message are used as the hash key information of the message; The hash key information is processed to obtain the hash index of the message.

8. A storage medium, characterized in that, The storage medium includes stored instructions, wherein when the instructions are executed, the device containing the storage medium is controlled to perform the network address port translation method as described in any one of claims 1-6.

9. An electronic device, characterized in that, It includes a memory, and one or more instructions, wherein one or more instructions are stored in the memory and configured to be executed by one or more processors as described in any one of claims 1-6.

Images