Cross-network local area network gateway penetrating method

Abstract

The invention relates to the field of computer network communication, and discloses a cross-network local area network gateway penetrating method, which comprises the following specific steps: S1, complete conical NAT (Network Address Translation) penetration: acquiring a public network I P (Internet Protocol) address and a port of a private network machine through server transfer, so that the machines of the two parties can directly communicate through the public network address; s2, restricting tapered NAT traversal: performing communication between private network machines by using a relay server and a specific communication step, notifying an opposite public network I P address through server transfer, and performing traversal through server auxiliary transmission data; and S3, symmetric NAT traversal: under the condition of symmetric NAT, communication of the private network machine is carried out by using the transit server and a port guessing method, the time difference of a plurality of mapping ports is obtained through multiple communication attempts, and a correct communication port is speculated to carry out NAT traversal. Through the NAT penetration technology, the private network machine can directly communicate with the external network machine, so that end-to-end direct data transmission is realized, and interference and delay of an intermediate node are avoided.

Description

Technical Field

[0001] The invention relates to the field of computer network communication, in particular to a method for penetrating a local area network gateway across networks. Background Art

[0002] With the popularization of the Internet and the continuous development of network technology, Network Address Translation (NAT) technology has played an important role in solving the shortage of IP address resources and improving network security. NAT technology maps private IP addresses to public IP addresses, hides the intranet structure, and protects the security of intranet devices.

[0003] However, NAT technology faces certain challenges when implementing communication between intranet devices and public network devices, especially in the scenario of penetrating the LAN gateway across the network, and it is impossible to effectively implement end-to-end direct communication. Summary of the invention

[0004] In view of the deficiencies of the prior art, the present invention provides a method for penetrating a LAN gateway across networks, which solves the problem that NAT technology cannot effectively achieve end-to-end direct communication when achieving communication between intranet devices and public network devices.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: a method for penetrating a local area network gateway across a network, comprising the following specific steps:

[0006] S1: Full cone NAT penetration: When at least one end is a full cone NAT, the communication between the private network machine and the server and other private network machines is used to obtain the public network IP address and port of the private network machine through the server, so that the two machines can communicate directly through the public network address;

[0007] S2: Restricted Cone NAT penetration: When both ends are restricted cone NAT, the private network machines communicate by using relay servers and specific communication steps, notifying the other party of the public IP address through the server, and traversing through the server-assisted data transmission;

[0008] S3: Symmetric NAT penetration: In the case of symmetric NAT, the private network machine communicates using a relay server and port guessing method. Through multiple communication attempts, the time difference of multiple mapped ports is obtained, and the correct communication port is guessed for NAT penetration.

[0009] Preferably, the method for full cone NAT penetration comprises the following specific steps:

[0010] S101: Private network machine 1 sends a message to the server. After receiving the message, the server records the public network IP address and port of private network machine 1, and creates a mapping record in the database, including the private network IP address and port of private network machine 1 and the corresponding public network IP and port;

[0011] S102: The server notifies private network machine 2 of the public network IP address and port information of private network machine 1. The notification message also includes verification information, which includes a timestamp and an encrypted check code.

[0012] S103: After receiving the notification message, private network machine 2 parses the public network IP address and port information therein, and then sends a data packet to the address and port. At this time, private network machine 1 will receive the message data sent by private network machine 2, and locally record the public network IP address and port of private network machine 2, and at the same time send a confirmation message to the server to inform it that the data packet has been received;

[0013] S104: Private network machine 1 sends a data packet back to the public IP address and port of private network machine 2. The data packet includes confirmation information and the private IP address and port information of private network machine 1. After receiving the data packet, private network machine 2 stores the information locally and sends a confirmation message to the server again.

[0014] Preferably, in the method of full cone NAT penetration, when the private network machine 1 sends an initial data packet, it simultaneously obtains its own public network IP address and port through the STUN protocol.

[0015] Preferably, the method for limiting cone NAT penetration comprises the following specific steps:

[0016] S201: Private network machine 1 sends a message to the server, and the server records the public network IP address of private network machine 1 and generates a unique session ID for identification and tracking of subsequent communications;

[0017] S202: The server sends a notification message including the public IP address of private network machine 1 and the session ID to private network machine 2, and the notification message also includes a timestamp and an encrypted signature;

[0018] S203: Private network machine 2 sends a test data packet to the public network IP address of private network machine 1. Since NAT1 is a restricted cone NAT, the data packet cannot directly reach private network machine 1. Private network machine 2 then reports the test failure information to the server.

[0019] S204: Private network machine 2 sends a request message to the server, requesting private network machine 1 to send a data packet to the public network IP address of private network machine 2 through the server relay. After receiving the request, the server associates the session ID with the public network IP address of private network machine 2;

[0020] S205: The server notifies private network machine 1 and sends the public network IP address and port information of private network machine 2. The notification message contains the encrypted session ID and verification information of private network machine 2.

[0021] S206: Private network machine 1 sends a data packet to the public network IP address of private network machine 2. Since the previous test of private network machine 2 failed, the message at this time will be regarded as a test response data packet by the router of NAT2, so it can pass through NAT2 and reach private network machine 2. After receiving the data packet, private network machine 2 reports this information to the server;

[0022] S207: Private network machine 2 sends a data packet back to private network machine 1. At this time, private network machine 1 successfully receives the data, and the entire NAT penetration process is completed; the server records the entire communication process and generates a communication log for subsequent analysis.

[0023] Preferably, in the method for limiting cone NAT penetration, the relay server adopts multi-threading or asynchronous communication technology, and in step S204 of the method for limiting cone NAT penetration, when the private network machine 2 sends a data packet to the server, it also includes a heartbeat packet.

[0024] Preferably, the method for symmetric NAT penetration comprises the following specific steps:

[0025] S301: Private network machine 1 sends a request message to the server, including request information for transparent transmission with private network machine 2. After receiving the message, the server records the public network IP address and port of private network machine 1 and generates a unique session ID.

[0026] S302: The server sends a notification message to private network machine 2, including the public network IP address and port information of private network machine 1, as well as the encrypted session ID and timestamp;

[0027] S303: Private network machine 2 sends a data packet to the public network IP address of private network machine 1. Since NAT1 is a restricted cone NAT, the data packet cannot enter the private network. At the same time, NAT2, as a symmetric NAT, will generate a new public network mapping record for this communication and allocate a new public network address and port.

[0028] S304: After completing step 3, private network machine 2 immediately sends a data packet to another port 8889 of the server. This operation generates another new mapping record. After receiving the data packet, the server records the new public network address and port information and associates it with the session ID.

[0029] S305: The server sends an update notification message to private network machine 1, including the new public network address and port generated in step 4, and the inferred port information of private network machine 2;

[0030] S306: Private network machine 1 guesses the i Port value of private network machine 2 according to the received mPort value, and sends a data packet to the public network address and port of private network machine 2. If the guess is correct, the data packet will successfully penetrate NAT2.

[0031] S307: After receiving the data packet, private network machine 2 immediately sends a confirmation message back to private network machine 1, and the entire communication process is completed. The server records the entire communication process and generates a log for subsequent analysis.

[0032] Preferably, in step S305 of the method for symmetric NAT penetration, after receiving the notification from the server, the private network machine 1 determines the most appropriate port by sending data packets multiple times.

[0033] The present invention provides a method for penetrating a local area network gateway across networks. It has the following beneficial effects:

[0034] 1. The present invention uses NAT penetration technology to enable private network machines to communicate directly with external network machines, thereby realizing end-to-end direct data transmission and avoiding interference and delay of intermediate nodes.

[0035] 2. The method of the present invention can provide corresponding penetration solutions for different types of NAT environments such as full cone NAT, restricted cone NAT and symmetric NAT, and has strong adaptability and versatility.

[0036] 3. The present invention reduces the number of data transfers during the transmission process through direct communication, thereby improving the speed of data transmission and the overall communication efficiency.

[0037] 4. The present invention adds timestamps and encryption check codes during the communication process, which can prevent replay attacks and data tampering, improve the security of communications and the integrity of data, and use encrypted communication protocols to ensure the security of all message transmissions to prevent data theft and illegal access. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a schematic diagram of the network penetration process of the present invention;

[0039] Figure 2 This is a schematic diagram of the process of penetrating a full cone NAT according to the present invention;

[0040] Figure 3 It is a schematic diagram of the penetration-limited cone NAT process of the present invention;

[0041] Figure 4 It is a schematic diagram of the process of penetrating symmetric NAT of the present invention. DETAILED DESCRIPTION

[0042] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] Please see attached Figure 1 - Attachment Figure 4 The embodiment of the present invention provides a method for penetrating a local area network gateway across networks, comprising the following specific steps:

[0044] S1: Full cone NAT penetration: When at least one end is a full cone NAT, the communication between the private network machine and the server and other private network machines is used to obtain the public network IP address and port of the private network machine through the server, so that the two machines can communicate directly through the public network address;

[0045] S2: Restricted Cone NAT penetration: When both ends are restricted cone NAT, the private network machines communicate by using relay servers and specific communication steps, notifying the other party of the public IP address through the server, and traversing through the server-assisted data transmission;

[0046] S3: Symmetric NAT penetration: In the case of symmetric NAT, the private network machine communicates using a relay server and port guessing method. Through multiple communication attempts, the time difference of multiple mapped ports is obtained, and the correct communication port is guessed for NAT penetration.

[0047] The method of full cone NAT traversal includes the following specific steps:

[0048] S101: Private network machine 1 (192.168.1.3:2341) sends a message to the server (180.93.45.46:8888). After receiving the message, the server records the public network IP address and port (112.93.14.56:43891) of private network machine 1, and creates a mapping record in the database, including the private network IP address and port of private network machine 1 and the corresponding public network IP and port;

[0049] S102: The server notifies private network machine 2 (192.168.2.6:6583) of the public network IP address and port information (112.93.14.56:43891) of private network machine 1. The notification message also includes verification information, such as timestamp and encryption checksum, to ensure the accuracy and security of the information;

[0050] S103: After receiving the notification message, private network machine 2 (192.168.2.6:6583) parses the public network IP address and port information (112.93.14.56:43891) and then sends a data packet to the address and port. At this time, private network machine 1 will receive the message data sent by private network machine 2, and record the public network IP address and port (iAddr) of private network machine 2 locally, and send a confirmation message to the server to inform it that the data packet has been received;

[0051] S104: Private network machine 1 sends a data packet back to the public network IP address and port (iAddr) of private network machine 2, and the data packet is accompanied by confirmation information and the private network IP address and port information of private network machine 1. After receiving the data packet, private network machine 2 stores the information locally and sends a confirmation message to the server again to ensure the integrity and reliability of the communication link. At this point, the penetration process ends.

[0052] In the method of full cone NAT penetration, when private network machine 1 sends the initial data packet, it also obtains its own public network IP address and port through the STUN protocol.

[0053] The method of limiting cone NAT penetration includes the following specific steps:

[0054] S201: Private network machine 1 (192.168.1.3:2341) sends a message to the server (180.93.45.46:8888). The server records the public network IP address of private network machine 1 (112.93.14.56:43891) and generates a unique session ID for identification and tracking of subsequent communications.

[0055] S202: The server sends a notification message containing the public IP address of private network machine 1 and the session ID to private network machine 2 (192.168.2.6:6583). The notification message also includes a timestamp and an encrypted signature to verify the integrity of the data;

[0056] S203: Private network machine 2 sends a test data packet to the public network IP address (112.93.14.56:43891) of private network machine 1. Since NAT1 is a restricted cone NAT, the data packet cannot directly reach private network machine 1. Private network machine 2 then reports the test failure information to the server;

[0057] S204: Private network machine 2 sends a request message to the server, requesting private network machine 1 to send a data packet to the public network IP address of private network machine 2 through the server relay. After receiving the request, the server associates the session ID with the public network IP address of private network machine 2;

[0058] S205: The server notifies private network machine 1 and sends the public network IP address and port information of private network machine 2. The notification message contains the encrypted session ID and verification information of private network machine 2;

[0059] S206: Private network machine 1 sends a data packet to the public network IP address of private network machine 2. Since the previous test of private network machine 2 failed, the message at this time will be regarded as a test response data packet by the router of NAT2, so it can pass through NAT2 and reach private network machine 2. After receiving the data packet, private network machine 2 reports this information to the server;

[0060] S207: Private network machine 2 sends a data packet back to private network machine 1. At this time, private network machine 1 successfully receives the data, and the entire NAT penetration process is completed. The server records the entire communication process and generates a communication log for subsequent analysis.

[0061] In order to improve the response speed of the relay server, multi-threading or asynchronous communication technology is used to reduce delays; in step S04, when the private network machine 2 sends a data packet to the server, it includes a heartbeat packet to maintain the validity of the connection and prevent NAT mapping from failing.

[0062] The method of symmetric NAT penetration includes the following specific steps:

[0063] S301: Private network machine 1 (192.168.1.3:2341) sends a request message to the server (180.93.45.46:8888), which contains the request information for transparent transmission with private network machine 2. After receiving the message, the server records the public network IP address and port of private network machine 1 and generates a unique session ID;

[0064] S302: The server sends a notification message to private network machine 2, including the public network IP address and port information (112.93.14.56:43891) of private network machine 1, as well as the encrypted session ID and timestamp;

[0065] S303: Private network machine 2 sends a data packet to the public network IP address of private network machine 1. Since NAT1 is a restricted cone NAT, the data packet cannot enter the private network. At the same time, NAT2, as a symmetric NAT, will generate a new public network mapping record for this communication and assign a new public network address and port (iAddr);

[0066] S304: After completing step 3, private network machine 2 immediately sends a data packet to another port 8889 of the server. This operation will generate another new mapping record (mAddr). After receiving the data packet, the server records the new public network address and port information (mAddr) and associates it with the session ID;

[0067] S305: The server sends an update notification message to private network machine 1, including the new public network address and port (mAddr) generated in step 4, and the inferred port information of private network machine 2;

[0068] S306: Private network machine 1 guesses the i Port value of private network machine 2 based on the received mPort value, and sends a data packet to the public network address and port (mAddr) of private network machine 2. If the guess is correct, the data packet will successfully penetrate NAT2;

[0069] S307: After receiving the data packet, private network machine 2 immediately sends a confirmation message back to private network machine 1, and the entire communication process is completed. The server records the entire communication process and generates a log for subsequent analysis.

[0070] In step S305, after receiving the notification from the server, the private network machine 1 can determine the most appropriate port by sending data packets multiple times to increase the penetration success rate.

[0071] Timestamp and encryption checksum: Adding timestamp and encryption checksum to the communication process can effectively prevent replay attacks and data tampering, and improve communication security and data integrity.

[0072] Unique session ID: A unique session ID is generated during the communication process to track and identify each communication, ensure the correct transmission and reception of data, and improve the reliability of communication.

[0073] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for penetrating a local area network gateway across networks, characterized in that: The specific steps include: S1: Full cone NAT penetration: When at least one end is a full cone NAT, the communication between the private network machine and the server and other private network machines is used to obtain the public network IP address and port of the private network machine through the server, so that the two machines can communicate directly through the public network address; S2: Restricted Cone NAT penetration: When both ends are restricted cone NAT, the private network machines communicate by using relay servers and specific communication steps, notifying the other party of the public IP address through the server, and traversing through the server-assisted data transmission; S3: Symmetric NAT penetration: In the case of symmetric NAT, the private network machine communicates using a relay server and port guessing method. Through multiple communication attempts, the time difference of multiple mapped ports is obtained, and the correct communication port is guessed for NAT penetration.

2. A method for penetrating a local area network gateway across networks according to claim 1, characterized in that: The method for full cone NAT penetration includes the following specific steps: S101: Private network machine 1 sends a message to the server. After receiving the message, the server records the public network IP address and port of private network machine 1, and creates a mapping record in the database, including the private network IP address and port of private network machine 1 and the corresponding public network IP and port; S102: The server notifies private network machine 2 of the public network IP address and port information of private network machine 1. The notification message also includes verification information, which includes a timestamp and an encrypted check code. S103: After receiving the notification message, private network machine 2 parses the public network IP address and port information therein, and then sends a data packet to the address and port. At this time, private network machine 1 will receive the message data sent by private network machine 2, and locally record the public network IP address and port of private network machine 2, and at the same time send a confirmation message to the server to inform it that the data packet has been received; S104: Private network machine 1 sends a data packet back to the public IP address and port of private network machine 2. The data packet includes confirmation information and the private IP address and port information of private network machine 1. After receiving the data packet, private network machine 2 stores the information locally and sends a confirmation message to the server again.

3. A method for penetrating a local area network gateway across networks according to claim 2, characterized in that: In the method of full cone NAT penetration, when private network machine 1 sends an initial data packet, it also obtains its own public network IP address and port through the STUN protocol.

4. A method for penetrating a local area network gateway across networks according to claim 1, characterized in that: The method for limiting cone NAT penetration includes the following specific steps: S201: Private network machine 1 sends a message to the server, and the server records the public network IP address of private network machine 1 and generates a unique session ID for identification and tracking of subsequent communications; S202: The server sends a notification message including the public IP address of private network machine 1 and the session ID to private network machine 2, and the notification message also includes a timestamp and an encrypted signature; S203: Private network machine 2 sends a test data packet to the public network IP address of private network machine 1. Since NAT1 is a restricted cone NAT, the data packet cannot directly reach private network machine 1. Private network machine 2 then reports the test failure information to the server. S204: Private network machine 2 sends a request message to the server, requesting private network machine 1 to send a data packet to the public network IP address of private network machine 2 through the server relay. After receiving the request, the server associates the session ID with the public network IP address of private network machine 2; S205: The server notifies private network machine 1 and sends the public network IP address and port information of private network machine 2. The notification message contains the encrypted session ID and verification information of private network machine 2. S206: Private network machine 1 sends a data packet to the public network IP address of private network machine 2. Since the previous test of private network machine 2 failed, the message at this time will be regarded as a test response data packet by the router of NAT2, so it can pass through NAT2 and reach private network machine 2. After receiving the data packet, private network machine 2 reports this information to the server; S207: Private network machine 2 sends a data packet back to private network machine 1. At this time, private network machine 1 successfully receives the data, and the entire NAT penetration process is completed; the server records the entire communication process and generates a communication log for subsequent analysis.

5. A method for penetrating a local area network gateway across networks according to claim 4, characterized in that: In the method for limiting cone NAT penetration, the relay server adopts multi-threading or asynchronous communication technology. In step S204 of the method for limiting cone NAT penetration, when the private network machine 2 sends a data packet to the server, it also includes a heartbeat packet.

6. A method for penetrating a local area network gateway across networks according to claim 1, characterized in that: The method for symmetric NAT penetration includes the following specific steps: S301: Private network machine 1 sends a request message to the server, including request information for transparent transmission with private network machine 2. After receiving the message, the server records the public network IP address and port of private network machine 1 and generates a unique session ID. S302: The server sends a notification message to private network machine 2, including the public network IP address and port information of private network machine 1, as well as the encrypted session ID and timestamp; S303: Private network machine 2 sends a data packet to the public network IP address of private network machine 1. Since NAT1 is a restricted cone NAT, the data packet cannot enter the private network. At the same time, NAT2, as a symmetric NAT, will generate a new public network mapping record for this communication and allocate a new public network address and port. S304: After completing step 3, private network machine 2 immediately sends a data packet to another port 8889 of the server. This operation generates another new mapping record. After receiving the data packet, the server records the new public network address and port information and associates it with the session ID. S305: The server sends an update notification message to private network machine 1, including the new public network address and port generated in step 4, and the inferred port information of private network machine 2; S306: Private network machine 1 guesses the iPort value of private network machine 2 according to the received mPort value, and sends a data packet to the public network address and port of private network machine 2. If the guess is correct, the data packet will successfully penetrate NAT2. S307: After receiving the data packet, private network machine 2 immediately sends a confirmation message back to private network machine 1, and the entire communication process is completed. The server records the entire communication process and generates a log for subsequent analysis.

7. A method for penetrating a local area network gateway across networks according to claim 6, characterized in that: In step S305 of the method for symmetric NAT penetration, after receiving the notification from the server, the private network machine 1 determines the most appropriate port by sending data packets multiple times.

Images