Network address translation method and device

Abstract

The invention relates to a network address translation method and device. The method comprises the following steps: a client constructs a request message; the client sends the request message to the server at regular time; the server responds to the request message to generate a return message; the client receives the return message; the client updates an address conversion range according to the return message; and the client performs network address translation according to the updated address translation range. According to the network address translation method and device, the IP address utilization rate can be improved, the network reliability and the dynamic adaptability can be enhanced, the management can be simplified, the user experience can be improved, large-scale deployment can be supported, and the security can be enhanced.

Description

Technical Field

[0001] The present application relates to the field of computer information processing, and in particular to a network address translation method and device. Background Art

[0002] NAT technology, the full name of which is "Network Address Translation", is a network technology used to convert IP addresses between different networks. This technology allows an entire organization to appear on the Internet with a public IP address, and enables internal network users to access the Internet or other IP networks by translating internal private network addresses (IP addresses) into legal network IP addresses. NAT technology was mainly proposed and standardized by IETF (Internet Engineering Task Force).

[0003] NAT devices are usually located between private networks and public networks. When a data packet from the internal network needs to be sent to the external network, the NAT device will check the source IP address and port number of the data packet and convert it to a public IP address and the corresponding port number. The NAT device will then send the converted data packet to the external network. When the data packet from the external network returns, the NAT device will convert the destination IP address and port number of the data packet back to the original private IP address and port number according to the translation table, and then send it to the internal network.

[0004] Existing technologies face a key challenge: how to effectively manage and verify the availability of each IP address in an address pool (such as the network segment 2.2.2.1 to 2.2.2.10) to ensure that addresses that are blocked or unreachable due to network policies, firewall rules or physical / logical failures are not used during the source IP address conversion process.

[0005] The above information disclosed in the Background section is only for enhancement of understanding of the background of the present application and therefore it may contain information that does not constitute the prior art that is already known to a person of ordinary skill in the art. Summary of the invention

[0006] In view of this, the present application provides a network address translation method and device, which can improve IP address utilization, enhance network reliability, dynamic adaptability, simplify management, improve user experience, and support large-scale deployment and enhance security.

[0007] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0008] According to one aspect of the present application, a network address translation method is proposed, which includes: a client constructs a request message; the client sends the request message to a server at a fixed time; the server generates a return message in response to the request message; the client receives the return message; the client updates the address translation range according to the return message; the client performs network address translation according to the updated address translation range.

[0009] In an exemplary embodiment of the present application, it also includes: modifying the socket binding function in the client kernel; creating a domain socket and setting a mark, wherein the mark is used to indicate that the address of the network address translation of the socket is not restricted; binding at least one network address through the socket binding function.

[0010] In an exemplary embodiment of the present application, modifying a socket binding function in a client kernel includes: modifying a socket binding function bing in a Linux client kernel to allow binding to a non-native interface address.

[0011] In an exemplary embodiment of the present application, a domain socket is created and a tag is set, including: a client creates a socket and sets the tag through a setsockopt function.

[0012] In an exemplary embodiment of the present application, the client constructs a request message, including: the client determines an address translation range; and constructs a request message for each address in the address translation range.

[0013] In an exemplary embodiment of the present application, a request message is constructed for each address in the address translation range, including: constructing a TCP syn request message for each address in the address translation range; and / or constructing an ICMP request message for each address in the address translation range.

[0014] In an exemplary embodiment of the present application, the server generates a return message in response to the request message, including: the server responds to the request message one by one and generates a corresponding return message; the server sends the return message according to the source address.

[0015] In an exemplary embodiment of the present application, the client updates the address translation range according to the return message, including: the client determines the valid address corresponding to the return message; and updates the address translation range according to the valid address.

[0016] In an exemplary embodiment of the present application, the client performs network address translation according to the updated address translation range, including: the client obtains a data packet; extracts a valid address from the address translation range; and performs network address translation using the valid address.

[0017] According to one aspect of the present application, a network address translation device is proposed, which includes: a construction module, used by a client to construct a request message; a sending module, used by the client to send the request message to a server at a regular interval; a response module, used by the server to generate a return message in response to the request message; a receiving module, used by the client to receive the return message; an update module, used by the client to update the address translation range according to the return message; and a conversion module, used by the client to perform network address translation according to the updated address translation range.

[0018] According to one aspect of the present application, an electronic device is proposed, which includes: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the method as described above.

[0019] According to one aspect of the present application, a computer-readable medium is provided, on which a computer program is stored. When the program is executed by a processor, the method described above is implemented.

[0020] According to the network address translation method and device of the present application, a request message is constructed by a client; the client sends the request message to a server at a fixed time; the server generates a return message in response to the request message; the client receives the return message; the client updates the address translation range according to the return message; the client performs network address translation according to the updated address translation range, which can improve IP address utilization, enhance network reliability, dynamic adaptability, simplify management, improve user experience, and support large-scale deployment and enhance security.

[0021] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and other objects, features and advantages of the present application will become more apparent by describing in detail the exemplary embodiments thereof with reference to the accompanying drawings. The accompanying drawings described below are only some embodiments of the present application, and it is clear to a person skilled in the art that other accompanying drawings can be obtained from these accompanying drawings without creative effort.

[0023] Figure 1 It is a schematic diagram of the network address translation method.

[0024] Figure 2 The present invention is a flowchart of a network address translation method according to an exemplary embodiment.

[0025] Figure 3 The present invention is a flowchart of a network address translation method according to another exemplary embodiment.

[0026] Figure 4 The present invention is a flowchart of a network address translation method according to another exemplary embodiment.

[0027] Figure 5 The present invention is a block diagram of a network address translation device according to an exemplary embodiment.

[0028] Figure 6 It is a block diagram of an electronic device according to an exemplary embodiment.

[0029] Figure 7 It is a block diagram of a computer-readable medium according to an exemplary embodiment. DETAILED DESCRIPTION

[0030] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this application will be comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted.

[0031] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0032] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0033] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0034] It should be understood that although the terms first, second, third, etc. may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one component from another component. Therefore, the first component discussed below can be referred to as the second component without departing from the teachings of the concepts of the present application. As used herein, the term "and / or" includes any one of the associated listed items and all combinations of one or more.

[0035] Those skilled in the art will appreciate that the drawings are merely schematic diagrams of example embodiments, and the modules or processes in the drawings are not necessarily necessary for implementing the present application, and therefore cannot be used to limit the scope of protection of the present application.

[0036] The technical abbreviations involved in this application are explained as follows:

[0037] Socket: In the computer field, socket exists as one of the fixed agreed ways for computers to communicate. For example, if we need to power the laptop before using it, there are two ways to power it: power supply from the power socket and battery power supply. If there is power in the power grid, the power socket is used for power supply. If there is no power in the power grid, the laptop's built-in battery is used for power supply. Then this power supply tool (battery or power socket) is the socket. Socket originated from the Linux system and exists as a file system. In Linux, everything is a file, even the process has become a data structure, and the device is also regarded as a file that can be read and written. Socket is a tool for computers to implement this mode, and the function of Socket is to implement the operation of communication to realize network communication.

[0038] Domain socket: The socket API was originally designed for network communication, but later an IPC mechanism was developed on the socket framework, namely UNIX Domain Socket. Although network sockets can also be used for inter-process communication on the same host (through the loopback address 127.0.0.1), UNIX Domain Socket is more efficient for IPC: it does not need to go through the network protocol stack, does not need to pack and unpack, calculate checksums, maintain sequence numbers and responses, etc., but only copies application layer data from one process to another. This is because the IPC mechanism is essentially reliable communication, while the network protocol is designed for unreliable communication. UNIX Domain Socket also provides two API interfaces: stream-oriented and packet-oriented, similar to TCP and UDP, but the message-oriented UNIX Domain Socket is also reliable, and messages will not be lost or out of order.

[0039] UNIX Domain Socket is full-duplex, with rich API interface semantics. It has obvious advantages over other IPC mechanisms and has become the most widely used IPC mechanism. For example, X Window server and GUI program communicate through UNIX Domain Socket.

[0040] The most obvious difference between UNIX Domain Socket and network socket programming is the address format, which is represented by the structure sockaddr_un. The socket address of network programming is the IP address plus the port number, while the address of UNIX Domain Socket is the path of a socket type file in the file system. This socket file is created by the bind() call. If the file already exists when bind() is called, bind() returns an error.

[0041] NAT: Network Address Translation NAT (Network Address Translation) is the process of converting the IP address in the IP datagram header into another IP address, while source NAT is the process of converting the source IP address of an IP message into another address.

[0042] Figure 1 This is a schematic diagram of the network address translation method. Figure 1 As described above, in actual applications, source NAT can convert the source IP address of an IP datagram header into another IP address. Usually, during the configuration process, the source IP address of a fixed IP datagram can be converted into a group of IP addresses, such as converting a message with a source IP address of 1.1.1.1 into any address in the 2.2.2.1-2.2.2.10 network segment.

[0043] The client forwards the messages after the configuration. Ideally, these messages can reach the server and the server responds.

[0044] However, in actual situations, during the forwarding path, the message may encounter some interception devices, which may intercept messages from certain IP addresses, making some messages unable to reach the server end.

[0045] So how to determine which address in 2.2.2.1-2.2.2.10 is available? In other words, which address in this network segment may be blocked by other devices in the network. How to effectively manage and verify the availability of each IP address in an address pool (such as the 2.2.2.1 to 2.2.2.10 network segment) to ensure that those addresses that are blocked or unreachable due to network policies, firewall rules or physical / logical failures are not used during the source IP address conversion process is a problem that needs to be solved in the existing technology.

[0046] In view of the technical defects in the prior art, the present application proposes a network address translation method, which actively detects the IP address segment after NAT to confirm which IP addresses are available, thereby avoiding the use of unavailable IP addresses.

[0047] The content of this application is described in detail below with the help of specific embodiments.

[0048] Figure 2 The flowchart of a network address translation method according to an exemplary embodiment is shown. The network address translation method 20 at least includes steps S202 to S212.

[0049] like Figure 2 As shown, in S202, the client constructs a request message. The client may, for example, determine an address translation range; and construct a request message for each address in the address translation range. The client may, for example, construct a request message for each internal private address (i.e., an address in the address translation range) that may be used in the NAT (network address translation) process. The purpose of doing so is to verify the reachability and validity of these addresses in the external network.

[0050] More specifically, the client needs to know which internal private IP addresses need to be translated. These addresses may be a continuous network segment, such as 192.168.1.0 / 24. For each address in the address translation range, the client needs to construct a request message separately. These messages can be TCP SYN request messages or ICMP Echo request messages (also known as ping requests).

[0051] More specifically, for example, a TCP SYN request message may be constructed for each address in the address translation range; more specifically, for example, an ICMP request message may be constructed for each address in the address translation range.

[0052] The TCP SYN request message is the first handshake in the three-way handshake process of the SYN packet in the TCP protocol to establish a connection. By sending a SYN packet and waiting for a SYN-ACK response, you can verify whether the TCP port of the target address is reachable.

[0053] The ICMP Echo request message is an Echo request (i.e., ping) in the ICMP protocol and is used to test the network connectivity between hosts. Sending an ICMP Echo request and receiving an Echo Reply response can verify the ICMP protocol reachability of the target address.

[0054] In S204, the client sends the request message to the server at a fixed time. The client sends the constructed request message to a designated server or a group of servers according to a certain time interval or strategy. These servers need to be able to respond to the corresponding TCP SYN or ICMP Echo request.

[0055] In S206, the server generates a return message in response to the request message. The server may, for example, respond to the request messages one by one and generate corresponding return messages; the server sends the return messages according to the source address.

[0056] In actual applications, after receiving the request message sent by the client, the server will respond one by one.

[0057] More specifically, for each request message, the server will generate a corresponding return message. For a TCP SYN request, the server will send a SYN-ACK as a response; for an ICMP Echo request, the server will send an ICMP Echo Reply as a response.

[0058] Send return message according to source address: The server ensures that the destination address of the return message is the source address of the request message, that is, an internal private address within the address translation range.

[0059] In S208, the client receives the return message. The client monitors and receives the return message from the server.

[0060] In S210, the client updates the address translation range according to the returned message. The client may, for example, determine a valid address corresponding to the returned message and update the address translation range according to the valid address.

[0061] The client analyzes the received return message to determine which addresses are valid (i.e., can receive a response):

[0062] Determine valid addresses: Based on the return message, the client can identify which internal private addresses are reachable, that is, external communications for these addresses are not blocked or restricted.

[0063] Update address translation scope: The client updates its address translation scope based on the valid address, ensuring that only valid addresses are used when performing NAT.

[0064] In S212, the client performs network address translation according to the updated address translation range.

[0065] In one embodiment, the client may, for example, obtain a data packet; extract a valid address from an address translation range; and perform network address translation using the valid address.

[0066] In practice, after updating the address translation range, clients can start using these valid addresses for network address translation:

[0067] More specifically, when a device in the internal network needs to send data packets to the external network, the client captures these data packets. After that, a valid address can be extracted from the updated address translation range, for example. The extracted valid address is used to replace the source IP address in the data packet, and then the translated data packet is sent to the external network.

[0068] This process ensures the accuracy and efficiency of NAT operation, while also improving the security of the internal network because unreachable or blocked addresses will not be used for NAT.

[0069] According to the network address translation method of the present application, a request message is constructed by the client; the client sends the request message to the server at a fixed time; the server generates a return message in response to the request message; the client receives the return message; the client updates the address translation range according to the return message; the client performs network address translation according to the updated address translation range, which can improve IP address utilization, enhance network reliability, dynamic adaptability, simplify management, improve user experience, and support large-scale deployment and enhance security.

[0070] It should be clearly understood that the present application describes how to form and use specific examples, but the principles of the present application are not limited to any details of these examples. On the contrary, based on the teaching of the content disclosed in the present application, these principles can be applied to many other embodiments.

[0071] Figure 3 The present invention is a flowchart of a network address translation method according to another exemplary embodiment. Figure 3 The process 30 shown is for Figure 2 Supplementary description of the process shown.

[0072] like Figure 3 As shown, in S302, the socket binding function in the client kernel is modified. For example, the socket binding function bing in the Linux client kernel can be modified to allow binding of non-native interface addresses.

[0073] Normally, socket binding is the process of associating a socket with a specific IP address and port number, which is usually an address on the local machine. However, in some advanced network configurations or special application scenarios, it may be necessary to bind a socket to an address other than the local interface, which is usually restricted in the standard kernel configuration.

[0074] Therefore, in the technical solution of the present application, it is first necessary to modify the bind function in the Linux kernel: the bind function is a standard function used in socket programming to associate a socket with a local address (IP address and port number). In this step, the bind function implementation in the kernel needs to be modified so that it can accept the address of a non-native interface as a binding parameter. This usually involves an in-depth understanding of the kernel network stack and may require substantial changes to the kernel code.

[0075] Allow binding of non-local interface addresses: The modified bind function needs to be able to check and accept the IP address of a non-local interface as valid input, and then associate it with the socket. This may require modifying the IP address validation logic to ensure that even if the address does not belong to any interface of the local machine, it can be properly processed and bound.

[0076] In S304, a domain socket is created and a flag is set, wherein the flag is used to indicate that the address of the network address translation of the socket is not restricted. The client may, for example, create a socket and set the flag through a setsockopt function.

[0077] The client creates a socket at the application level and marks it in a specific way so that it can be identified and handled specially during the subsequent Network Address Translation (NAT) process.

[0078] More specifically, the client can use a standard socket creation function (such as socket) to create a new socket. This socket can be any type of socket, but it is usually a TCP or UDP socket used for network communication.

[0079] The client can also set one or more flags for the created socket, for example, through the setsockopt function. These flags are used to indicate to the operating system kernel that the socket should use special rules or be exempted from standard restrictions during network address translation. The specific content and meaning of the flags depend on the implementation of the operating system and the configuration of the network stack.

[0080] In S306, at least one network address is bound by a socket binding function. The client uses a modified or specially configured socket binding function to bind the previously created socket to one or more network addresses (including possible non-native interface addresses).

[0081] The bind function in the kernel has been modified to support binding of non-local interface addresses. The client can, for example, directly use this modified function to bind the socket.

[0082] Figure 4 The present invention is a flowchart of a network address translation method according to another exemplary embodiment. Figure 4 The process 40 shown is for Figure 2 Detailed description of the process shown.

[0083] In a specific embodiment, the address conversion range may be: IP address segment 2.2.2.1-2.2.2.10. By using the technical solution of the present application to perform message detection, it is detected that the message 2.2.2.1 does not receive a reply message. Then, the IP address range that can be converted by the source NAT address conversion is 2.2.2.2-2.2.2.10, excluding the IP address 2.2.2.1.

[0084] In actual application, the processing steps can be as follows:

[0085] like Figure 4 As shown, in S402, the client kernel is set.

[0086] In a specific embodiment, the Linux kernel of the client modifies the restriction of the socket binding function bind() that the socket must be bound to the local interface address. For example, the judgment can be made by adding the action SOCK_NOLOCAL of the sock option. If the socket is marked with SOCK_NOLOCAL, the kernel will not judge whether the address bound to the socket is the local interface IP address (because the bound address is the address 2.2.2.1-2.2.2.10 after NAT, and this address segment is not necessarily the local interface address);

[0087] Create a domain socket, for example, set the SOCK_NOLOCAL flag on the domain socket through the setsockopt() function, and bind the domain socket through the bind() function to inform the kernel that the socket can be bound to an IP address other than the local interface address;

[0088] In S404, the client constructs a request message.

[0089] More specifically, for example, a TCP syn message or an ICMRequest message may be constructed, the source IP addresses of the messages are respectively specified as 2.2.2.1-2.2.2.10, for a total of 10 messages, and the destination IP address is specified as a server address such as 3.3.3.3.

[0090] In S406, the request message is sent regularly. The above constructed message is sent to Fuququ reliably and regularly.

[0091] In a specific real-time situation, for example, if the interval of scheduled packet transmission is 5s, that is, the message with the source IP address of 2.2.2.1-2.2.2.10->3.3.3.3 is sent once every 5s, if the server receives the message, it will reply to the message with the source IP address of 2.2.2.1-2.2.2.10 in sequence.

[0092] In S408, the intermediate device filters the request message. Now assume that the intermediate device in the figure blocks all messages with a source IP address of 2.2.2.1, that is, the server cannot receive messages with a source IP address of 2.2.2.1.

[0093] In S410, the intermediate device sends the filtered request message to the server.

[0094] In S412, the server receives the filtered request message and generates a return message.

[0095] The server receives a TCP syn message or an ICMP request message and responds with a syn-ack message for a TCP message and an ICMP reply message for an ICMP request message. The source IP address of all reply messages is 3.3.3.3, and the destination IP address is 2.2.2.2-2.2.2.10 (because the message with source IP address 2.2.2.1 is blocked by other device, the server cannot receive the message with this address).

[0096] In S414, the server sends a return message to the client.

[0097] In S416, the client updates the address translation range according to the returned message.

[0098] The client receives TCP syn-ack packets or ICM replies from destination IP addresses 2.2.2.2-2.2.2.10 and considers 2.2.2.2-2.2.2.10 in the source NAT address segment to be an available address.

[0099] Since the client did not receive the destination IP address 2.2.2.1 (because the message was blocked by other devices, the server did not receive the TCP syn message or ICMP request message), the client can, for example, resend the TCP message or ICMP message with the source IP address 2.2.2.1 after 5 seconds, up to 3 times.

[0100] If the client sends three TCP syn messages or ICMP request messages to the source IP address 2.2.2.1 and does not receive a reply message from the server, the client believes that the address 2.2.2.1 is not available. At this time, the NAT module can believe that the only available addresses are 2.2.2.2-2.2.2.10, that is, the address 2.2.2.1 is not available. Then the client can only convert the source IP address of the data message to 2.2.2.2-2.2.2.10.

[0101] The advantages of this application are mainly reflected in the following aspects:

[0102] Improve IP address utilization: By actively detecting the IP address segment after NAT, unavailable IP addresses can be discovered and excluded in real time, thus ensuring that only available IP addresses are used for NAT conversion. This greatly improves IP address utilization and avoids resource waste caused by trying to use unreachable addresses.

[0103] Enhanced network reliability: In source NAT scenarios, if unreachable IP addresses are used, communication failures or delays may occur. This solution reduces network failures caused by address problems and enhances network stability and reliability by detecting and eliminating these addresses in advance.

[0104] Dynamic adaptability: The network environment is changing dynamically, and some IP addresses may become unavailable due to network configuration changes, equipment failures, or security policy adjustments. This solution can dynamically detect and update the NAT address pool to ensure that NAT conversion always uses the latest and available IP addresses, with strong adaptability and flexibility.

[0105] Those skilled in the art will appreciate that all or part of the steps for implementing the above embodiments are implemented as a computer program executed by a CPU. When the computer program is executed by the CPU, the above functions defined by the above method provided in the present application are executed. The program may be stored in a computer-readable storage medium, which may be a read-only memory, a disk, or an optical disk, etc.

[0106] In addition, it should be noted that the above figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0107] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0108] Figure 5 FIG. 1 is a block diagram of a network address translation device according to an exemplary embodiment. Figure 5 As shown, the network address translation device 50 includes: a construction module 502, a sending module 504, a response module 506, a receiving module 508, an update module 510, and a translation module 512. The network address translation device 50 may further include: a setting module 514.

[0109] The construction module 502 is used by the client to construct a request message; the construction module 502 is also used by the client to determine an address translation range; and to construct a request message for each address in the address translation range.

[0110] The sending module 504 is used for the client to send the request message to the server at a fixed time;

[0111] The response module 506 is used by the server to respond to the request message and generate a return message; the response module 506 is also used by the server to respond to the request message one by one and generate a corresponding return message; the server sends the return message according to the source address.

[0112] The receiving module 508 is used for the client to receive the returned message;

[0113] The update module 510 is used by the client to update the address translation range according to the return message; the update module 510 is also used by the client to determine the valid address corresponding to the return message; and update the address translation range according to the valid address.

[0114] The conversion module 512 is used by the client to perform network address conversion according to the updated address conversion range. The conversion module 512 is also used by the client to obtain a data packet; extract a valid address from the address conversion range; and perform network address conversion using the valid address.

[0115] The setting module 514 is used to modify the socket binding function in the client kernel; create a domain socket and set a mark, wherein the mark is used to indicate that the address of the network address translation of the socket is not restricted; and bind at least one network address through the socket binding function.

[0116] According to the network address translation device of the present application, a request message is constructed by a client; the client sends the request message to a server at a fixed time; the server generates a return message in response to the request message; the client receives the return message; the client updates the address translation range according to the return message; the client performs network address translation according to the updated address translation range, which can improve IP address utilization, enhance network reliability, dynamic adaptability, simplify management, improve user experience, and support large-scale deployment and enhance security.

[0117] Figure 6 It is a block diagram of an electronic device according to an exemplary embodiment.

[0118] Refer to the following Figure 6 The electronic device 600 according to this embodiment of the present application is described. Figure 6 The electronic device 600 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0119] like Figure 6 As shown, the electronic device 600 is in the form of a general computing device. The components of the electronic device 600 may include, but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610), a display unit 640, etc.

[0120] The storage unit stores a program code, which can be executed by the processing unit 610, so that the processing unit 610 performs the steps described in this specification according to various exemplary embodiments of the present application. For example, the processing unit 610 can perform the following steps: Figure 2 , Figure 3 , Figure 4 Follow the steps shown in .

[0121] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 6201 and / or a cache memory unit 6202 , and may further include a read-only memory unit (ROM) 6203 .

[0122] The storage unit 620 may also include a program / utility 6204 having a set (at least one) of program modules 6205, such program modules 6205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0123] Bus 630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0124] The electronic device 600 may also communicate with one or more external devices 600' (e.g., keyboards, pointing devices, Bluetooth devices, etc.) to enable a user to communicate with the electronic device 600, and / or any device (e.g., routers, modems, etc.) that the electronic device 600 can communicate with one or more other computing devices. Such communication may be performed via an input / output (I / O) interface 650. In addition, the electronic device 600 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 660. The network adapter 660 may communicate with other modules of the electronic device 600 via a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0125] Through the above description of the implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by combining software with necessary hardware. Figure 7 As shown, the technical solution according to the implementation mode of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, or a network device, etc.) to execute the above method according to the implementation mode of the present application.

[0126] The software product may be any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0127] The computer readable storage medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The readable storage medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by an instruction execution system, an apparatus, or a device or used in combination with it. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0128] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0129] The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by a device, the computer-readable medium realizes the following functions: the client constructs a request message; the client sends the request message to the server at a regular interval; the server generates a return message in response to the request message; the client receives the return message; the client updates the address translation range according to the return message; the client performs network address translation according to the updated address translation range.

[0130] Those skilled in the art will appreciate that the above modules can be distributed in the device according to the description of the embodiment, or can be changed accordingly and only used in one or more devices different from the embodiment. The modules of the above embodiments can be combined into one module, or further divided into multiple sub-modules.

[0131] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiment of the present application.

[0132] The exemplary embodiments of the present application are specifically shown and described above. It should be understood that the present application is not limited to the detailed structures, configurations or implementations described herein; on the contrary, the present application is intended to cover various modifications and equivalent configurations included in the spirit and scope of the appended claims.

Claims

1. A network address translation method, characterized in that: include: The client constructs a request message; The client sends the request message to the server at a fixed time; The server generates a return message in response to the request message; The client receives the returned message; The client updates the address translation range according to the returned message; The client performs network address translation according to the updated address translation range.

2. The method according to claim 1, characterized in that Also includes: Modify the socket binding function in the client kernel; Create a domain socket and set a flag, wherein the flag is used to indicate that the address of the network address translation of the socket is not restricted; Bind at least one network address via the socket bind function.

3. The method according to claim 2, characterized in that Modify the socket binding function in the client kernel, including: Modify the socket binding function bing in the Linux client kernel to allow binding to non-local interface addresses.

4. The method according to claim 2, characterized in that Create a domain socket and set flags, including: The client creates a socket and sets flags via the setsockopt function.

5. The method according to claim 1, characterized in that The client constructs a request message, including: The client determines the address translation range; A request message is constructed for each address in the address translation range.

6. The method according to claim 5, characterized in that Constructing a request message for each address in the address translation range, including: Constructing a TCP syn request message for each address in the address translation range; and / or An ICMP request message is constructed for each address in the address translation range.

7. The method according to claim 1, characterized in that The server generates a return message in response to the request message, including: The server responds to the request messages one by one and generates corresponding return messages; The server sends the return message according to the source address.

8. The method according to claim 1, characterized in that The client updates the address translation range according to the returned message, including: The client determines a valid address corresponding to the returned message; The address translation range is updated according to the effective address.

9. The method according to claim 1, characterized in that The client performs network address translation according to the updated address translation range, including: The client obtains the data packet; Extract the effective address from the address translation range; Network address translation is performed using the effective address.

10. A network address translation device, characterized in that: include: A construction module, used by the client to construct a request message; A sending module, used for the client to send the request message to the server at a fixed time; Response module, used for the server to generate a return message in response to the request message; A receiving module, used for the client to receive the returned message; An updating module, used for the client to update the address translation range according to the returned message; The conversion module is used for the client to perform network address translation according to the updated address translation range.

Images