NAT gateway building method based on SDN and DPU

Abstract

The invention relates to the technical field of NAT gateways, and discloses an NAT gateway building method based on an SDN and a DPU, and the method comprises the steps: transmitting a starting instruction signal to an SDN controller, configuring an NAT mapping address pool, generating data plane topological relation information, issuing an initialization flow table to an SDN switch based on the topological information, and requesting to create a new NAT mapping rule. And generating and issuing an NAT (Network Address Translation) table and a message forwarding flow table, and executing NAT address translation. Compared with the technical problem that in the prior art, the NAT gateway performance is limited, and especially under the condition that the flow of a data center is increased sharply, a traditional CPU-based software NAT gateway cannot efficiently process the network flow, by combining the SDN controller with hardware acceleration of the DPU, the performance and expansibility of the NAT gateway are improved, and the network flow processing efficiency is improved. Therefore, the problem of performance reduction caused by CPU bottleneck is avoided, the network flow processing efficiency is improved, and the delay is reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of NAT gateways, and in particular relates to a method for building a NAT gateway based on SDN and DPU. Background Art

[0002] At present, the traditional NAT gateway technology has insufficient performance when dealing with the growing traffic demand of data centers. For example, the existing technology mainly relies on the CPU to perform NAT address conversion and data packet processing, but with the rapid development of technologies such as cloud computing, Internet of Things, artificial intelligence and 5G, the network traffic in the data center has shown an exponential growth. The traditional CPU-based software NAT gateway faces a processing performance bottleneck in a high-traffic environment and cannot fully meet the demand for efficient network forwarding and address conversion in a large-scale distributed network architecture. Therefore, under the condition of excessive load or high concurrency, the existing NAT gateway technology is difficult to guarantee the stability and efficiency of the data center network. Therefore, there is an urgent need for a new NAT gateway method that can utilize hardware acceleration, distributed deployment, and combine centralized management technology. In the case of continuous growth of cloud data center traffic, efficient NAT conversion and traffic scheduling can still be achieved to improve network processing performance, reduce latency, and simplify the complexity of network management. Summary of the invention

[0003] In view of the above-mentioned technical deficiencies, the purpose of the present invention is to propose a NAT gateway construction method based on SDN and DPU, aiming to solve the technical problem that the performance of NAT gateway in the prior art is limited, especially under the condition of surging traffic in data center, the traditional CPU-based software NAT gateway cannot realize efficient processing of network traffic.

[0004] In order to solve the above technical problems, the present invention adopts the following technical solution: The present invention provides a NAT gateway construction method based on SDN and DPU.

[0005] The NAT gateway construction method based on SDN and DPU includes:

[0006] Step S10: Send a startup instruction signal to the SDN controller, and the SDN controller configures the NAT mapping address pool after startup;

[0007] Step S20: After completing the configuration of the NAT mapping address pool, the SDN controller receives the status information of the DPU network card from the NAT gateway through the API interface;

[0008] Step S30: the SDN controller obtains network topology information from the SDN switch, the network topology information including connection information between the intranet device and the extranet, and generates data plane topology relationship information in combination with the state information of the DPU network card;

[0009] Step S40: the SDN controller sends an initialization flow table to the SDN switch based on the generated data plane topology relationship information;

[0010] Step S50: When the message arrives at the SDN switch, the SDN switch identifies the unknown message by searching the initialization flow table, extracts the source address, destination address, source port number and destination port number, and sends the information to the SDN controller to request the creation of a new NAT mapping rule;

[0011] Step S60: After receiving the new NAT mapping rule creation request, the SDN controller allocates a unique external network address and port number and a DPU network card for processing NAT conversion to the request by random allocation according to the available external network addresses and port numbers in the NAT mapping address pool, and generates a NAT conversion table and a message forwarding flow table;

[0012] Step S70: The SDN controller sends the generated message forwarding flow table to the SDN switch to ensure that the switch can identify bidirectional messages with the same flow identifier, and sends the generated messages to the same DPU network card for processing to avoid delays caused by message transmission back and forth between multiple DPUs;

[0013] Step S80: The SDN controller sends the generated NAT translation table to the specified DPU network card through the NAT control. The DPU network card performs NAT address translation on the transmitted bidirectional traffic according to the translation table. After receiving the NAT translation table, the DPU network card converts the private address to the public network address of the message sent from the intranet to the extranet according to the rules in the table.

[0014] Preferably, the step S80 further includes: when the NAT conversion rule has no traffic for a long time, performing NAT rule aging, deleting the expired NAT rule, and sending the NAT conversion table and the packet forwarding flow table to be deleted to the NAT control and the SDN switch respectively.

[0015] Preferably, after the step of sending the NAT translation table and the message forwarding flow table to be deleted to the NAT control and the SDN switch respectively, the step further includes:

[0016] The SDN switch receives the packet forwarding flow table deletion instruction and deletes the corresponding packet forwarding flow table;

[0017] The NAT control sends a deletion instruction to the DPU network card, and the DPU network card deletes the corresponding packet forwarding flow table.

[0018] Preferably, the method further comprises: when a DPU disconnection is detected, performing the following steps:

[0019] When the SDN switch detects that the DPU network card is disconnected, it sends the MAC address of the DPU network card and the disconnection information to the SDN controller;

[0020] After receiving the DPU network card disconnection information, the SDN controller queries the current network topology relationship and selects a spare DPU network card to replace the failed DPU network card;

[0021] The SDN controller deletes the message forwarding flow table related to the faulty DPU network card, generates a new NAT translation table and message forwarding flow table suitable for the standby DPU network card, and sends the NAT translation table and message forwarding flow table to the SDN switch and the standby DPU network card;

[0022] After receiving the new message forwarding flow table, the SDN switch updates the message forwarding flow table and forwards the traffic to the standby DPU network card;

[0023] After receiving the new NAT conversion table, the standby DPU network card performs NAT conversion processing on the received traffic based on the NAT conversion table to complete the failover operation.

[0024] Preferably, in step S80, the NAT control runs on the gateway server and is composed of an OVS plug-in and a NAT agent, which are used to connect to the SDN controller and the DPU network card respectively.

[0025] Preferably, the OVS plug-in is used to connect to the SDN controller, accept the NAT conversion table sent by the SDN switch, transparently transmit it to the DPU network card through the NAT proxy, and send the MAC address of the DPU network card.

[0026] Preferably, the NAT proxy is used to connect to the DPU network card, responsible for sending the NAT conversion table, sending the running status of the DPU network card, and sending the address of the DPU network card.

[0027] The present invention also provides a NAT gateway construction device based on SDN and DPU, including:

[0028] A startup module is used to send a startup instruction signal to the SDN controller, and the SDN controller configures the NAT mapping address pool after startup;

[0029] The status information acquisition module is used to complete the configuration of the NAT mapping address pool, and the SDN controller receives the status information of the DPU network card from the NAT gateway through the API interface;

[0030] A topology information acquisition module is used for the SDN controller to obtain network topology information from the SDN switch, where the network topology information includes connection information between the intranet device and the extranet, and generates data plane topology relationship information in combination with the state information of the DPU network card;

[0031] The initialization flow table configuration module is used by the SDN controller to send the initialization flow table to the SDN switch based on the generated data plane topology relationship information;

[0032] A message identification module is used for, when a message arrives at the SDN switch, the SDN switch identifies the unknown message by searching the initialization flow table, extracting the source address, destination address, source port number and destination port number therein, and sending this information to the SDN controller to request the creation of a new NAT mapping rule;

[0033] The NAT rule generation module is used for the SDN controller to allocate a unique external network address and port number and a DPU network card for processing NAT conversion to the request by random allocation according to the available external network addresses and port numbers in the NAT mapping address pool after receiving a new NAT mapping rule creation request, and to generate a NAT conversion table and a message forwarding flow table;

[0034] The message forwarding flow table sending module is used for the SDN controller to send the generated message forwarding flow table to the SDN switch to ensure that the switch can identify the bidirectional messages with the same flow identifier and send the generated messages to the same DPU network card for processing, so as to avoid the delay caused by the message transmission back and forth between multiple DPUs;

[0035] The NAT conversion execution module is used for the SDN controller to send the generated NAT conversion table to the specified DPU network card through the NAT control. The DPU network card performs NAT address conversion on the transmitted bidirectional traffic according to the conversion table. After receiving the NAT conversion table, the DPU network card converts the private address to the public network address of the message sent from the intranet to the extranet according to the rules in the table.

[0036] The present invention also provides a NAT gateway construction device based on SDN and DPU, including:

[0037] A memory, a processor, and a NAT gateway construction program based on SDN and DPU stored in the memory and executable on the processor. When the NAT gateway construction program based on SDN and DPU is executed by the processor, the NAT gateway construction method based on SDN and DPU is implemented.

[0038] The present invention also provides a computer program product, including a NAT gateway construction program based on SDN and DPU, wherein the NAT gateway construction program based on SDN and DPU implements the NAT gateway construction method based on SDN and DPU when executed by a processor.

[0039] The beneficial effect of the present invention is that compared with the NAT gateway in the prior art, which has limited performance, especially under the condition of a surge in data center traffic, the traditional CPU-based software NAT gateway cannot achieve the technical problem of efficiently processing network traffic. The present invention improves the performance and scalability of the NAT gateway by combining the hardware acceleration of the SDN controller and the DPU, thereby avoiding the performance degradation problem caused by the CPU bottleneck, improving the efficiency of network traffic processing and reducing latency. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 The present invention is a flowchart of a first embodiment of a method for building a NAT gateway based on SDN and DPU.

[0042] Figure 2 The present invention is a schematic diagram of a device for a method for building a NAT gateway based on SDN and DPU. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] Embodiment 1: Figure 1 As shown, it is a flow chart of the first embodiment of the method for building a NAT gateway based on SDN and DPU of the present invention, and the first embodiment of the method for building a NAT gateway based on SDN and DPU of the present invention is proposed.

[0045] Step S10: Send a startup instruction signal to the SDN controller, and the SDN controller configures the NAT mapping address pool after startup;

[0046] It should be noted that the configuration of the NAT mapping address pool is based on the current network architecture of the data center and its mapping requirements for private IP addresses and public IP addresses. The address pool includes multiple optional external public IP addresses and intranet IP addresses, which can support independent IP address allocation in a multi-tenant environment.

[0047] Step S20: After completing the configuration of the NAT mapping address pool, the SDN controller receives the status information of the DPU network card from the NAT gateway through the API interface, including the physical status of the network port, bandwidth usage, load information, and the number of NAT rules currently processed by the DPU;

[0048] It should be noted that the status information of the DPU network card is more important for the performance optimization of the NAT gateway. By regularly obtaining this status information, the SDN controller can understand the operating status of the DPU network card in real time, including whether the network port is normal, the current bandwidth usage ratio, the load of processing NAT conversion, and the number of NAT rules currently processed on each DPU network card. This information will provide a key basis for the dynamic scheduling of the SDN controller. The SDN controller uses this information to distribute and adjust network traffic more intelligently. For example, when a DPU network card has a high load, the SDN controller can assign new NAT tasks to other DPU network cards with lower loads, thereby achieving load balancing and avoiding overloading of certain nodes and affecting the network performance of the entire data center.

[0049] It should be understood that through this automated monitoring and scheduling mechanism, the SDN controller can not only optimize the use of DPU resources, but also reduce network latency and ensure the rapid response of NAT rules. The status information feedback of the DPU network card is also the basis of the NAT rule aging mechanism. When the load drops to a certain threshold, expired or no longer used NAT rules can be automatically cleared to release system resources.

[0050] For example, if there are multiple DPU network cards in a data center processing NAT tasks, and the SDN controller detects that the bandwidth usage of a DPU network card has reached 80%, while the load of other DPU network cards is only 50%, the SDN controller will automatically adjust the subsequent NAT conversion tasks and assign them to the DPU network card with lower load. In this way, the traffic processing of the entire network will be more balanced, improving the overall stability and efficiency of the system.

[0051] Step S30: the SDN controller obtains network topology information from the SDN switch, the network topology information including connection information between the intranet device and the extranet, and generates data plane topology relationship information in combination with the state information of the DPU network card;

[0052] It should be noted that network topology information refers to the physical and logical connection relationship between various devices in the data center, especially how the internal network devices interact with the external network through the NAT gateway. By obtaining this topology information from the SDN switch, the SDN controller can fully understand the network structure of the data center, including key information such as the connection status between devices, link bandwidth, and communication path.

[0053] It is understandable that, combined with the status information of the DPU network card (such as bandwidth usage and load information), the SDN controller can generate more accurate and real-time data plane topology relationship information. This information can help the SDN controller better optimize traffic scheduling and resource allocation, ensure that NAT conversion tasks can be transmitted along the optimal path, and reduce network bottlenecks and delays.

[0054] It should be understood that the dynamic generation mechanism of the data plane topology relationship enables the SDN controller to quickly adjust the traffic forwarding path when the network environment changes (such as a link interruption, equipment failure or load surge), ensuring high availability and reliability of the network. In addition, the topology information generated by the SDN controller based on the real-time status of the DPU network card helps to identify and allocate the best DPU network card to perform NAT tasks, thereby improving network performance.

[0055] Through this comprehensive scheduling based on network topology and DPU status, the SDN controller can effectively avoid traffic congestion and improve the efficiency and flexibility of the internal network of the data center.

[0056] Step S40: the SDN controller sends an initialization flow table to the SDN switch based on the generated data plane topology relationship information;

[0057] It should be noted that the initialization flow table is a set of basic rules generated by the SDN controller for the SDN switch based on the current data plane topology, which is used to process unknown message flows in the initial state. The initialization flow table contains how to process traffic from intranet devices to the external network, including key operations such as routing selection, forwarding path, and NAT conversion rules.

[0058] The role of initializing the flow table is not limited to processing the initial traffic, but also provides a basis for the subsequent SDN controller to update and optimize the flow table according to the real-time network status. As the network environment changes (such as the increase in traffic, the addition or failure of equipment), the SDN controller can dynamically adjust the message forwarding path and traffic scheduling strategy based on these initial rules to ensure the efficient operation of the data center network.

[0059] For example, suppose that after a new tenant joins the data center, the SDN switch receives the initial traffic from the tenant, but there are no existing NAT rules to handle this traffic. At this time, the initialization flow table will guide these packets to be sent to the SDN controller for further parsing and processing. The SDN controller will then generate new NAT rules based on the tenant's traffic requirements and the current network topology, and send the optimized flow table to the SDN switch to ensure that the tenant's traffic can be quickly processed and correctly forwarded to the external network.

[0060] Step S50: When the message arrives at the SDN switch, the SDN switch identifies the unknown message by searching the initialization flow table, extracts the source address, destination address, source port number and destination port number, and sends the information to the SDN controller to request the creation of a new NAT mapping rule;

[0061] It should be understood that the source address and destination address in the message refer to the IP addresses of the intranet device and the extranet server respectively, while the source port number and the destination port number are used to identify the specific communication session. By sending this information to the SDN controller, the SDN controller can generate a unique NAT rule for the communication session based on the available resources in the current NAT mapping address pool to ensure the correct conversion and forwarding of traffic. The initial flow table of the SDN switch not only processes the first traffic request of the message, but also ensures that in the absence of preset rules, the SDN controller can dynamically create new NAT mapping rules through a fast reporting mechanism, thereby avoiding traffic loss or delay. At the same time, this mechanism makes the NAT management of the data center more flexible, and can adjust NAT rules and routing policies in real time according to traffic changes.

[0062] Step S60: After receiving the new NAT mapping rule creation request, the SDN controller allocates a unique external network address and port number and a DPU network card for processing NAT conversion to the request by random allocation according to the available external network addresses and port numbers in the NAT mapping address pool, and generates a NAT conversion table and a message forwarding flow table;

[0063] It should be understood that the random allocation of external network addresses and port numbers can avoid resource conflicts and improve the utilization of IPs and ports in the address pool. The selection of DPU network cards is based on their current load conditions. The SDN controller monitors the working status of each DPU in real time and selects the DPU network card with a lighter load to handle the new NAT conversion task, thereby achieving load balancing.

[0064] It should be understood that the generated NAT translation table and packet forwarding flow table contain detailed translation rules and traffic paths to ensure that the bidirectional transmission of data packets between the internal and external networks can proceed smoothly. The NAT translation table is used to manage the mapping relationship between the internal network address and the external network address, while the packet forwarding flow table instructs the SDN switch on how to correctly forward the bidirectional data flow of the session to the specified DPU network card.

[0065] For example, suppose an intranet device requests to access an external server. The SDN controller randomly assigns an external IP address (such as 203.0.113.5) and port number (such as 8080) from the NAT mapping address pool for the device's communication, and selects the DPU network card with the smallest load for processing. At this time, the SDN controller generates the corresponding NAT translation table, mapping the intranet IP address (such as 192.168.1.100) to the external IP address 203.0.113.5. Subsequently, the SDN controller generates a packet forwarding flow table, instructing the SDN switch to forward the data packets between the internal and external networks along this path to ensure the smoothness and reliability of communication.

[0066] Step S70: The SDN controller sends the generated message forwarding flow table to the SDN switch to ensure that the switch can identify bidirectional messages with the same flow identifier, and sends the generated messages to the same DPU network card for processing to avoid delays caused by message transmission back and forth between multiple DPUs;

[0067] It should be understood that the message forwarding flow table contains unique identifiers for bidirectional communication flows, which are used to ensure that data flows remain consistent in bidirectional transmission between the internal and external networks. The SDN switch can quickly identify bidirectional messages by looking up the flow identifiers in the flow table and always send them to the designated DPU network card for processing. This avoids the switching of messages between different DPU network cards, thereby reducing latency and improving processing efficiency. The SDN controller achieves intelligent scheduling and optimization of network traffic within the data center through precise control of the message forwarding flow table. This mechanism ensures that bidirectional messages can be processed through a consistent path, avoiding repeated processing or path switching under high load conditions, thereby reducing the complexity of the system and improving overall performance.

[0068] For example, suppose a client device accesses an external server through a NAT gateway. The first request has been processed by DPU NIC A and a NAT mapping rule has been established. When the subsequent response message is returned, the SDN switch queries the forwarding flow table, identifies that the message belongs to the previous session, and sends it directly to DPU NIC A for processing instead of forwarding it to other DPU NICs. This mechanism ensures the continuity of communication and avoids unnecessary delays and performance losses caused by switching between DPUs.

[0069] Step S80: The SDN controller sends the generated NAT translation table to the specified DPU network card through the NAT control. The DPU network card performs NAT address translation on the transmitted bidirectional traffic according to the translation table. After receiving the NAT translation table, the DPU network card converts the private address to the public network address of the message sent from the intranet to the extranet according to the rules in the table.

[0070] It should be noted that the NAT translation table contains the mapping rules between private addresses in the intranet and public addresses in the extranet, and specifically defines how to convert messages from the intranet into a format that can be transmitted on the public network while maintaining the consistency of the conversion of bidirectional traffic. This table is generated by the SDN controller and ensures that messages can be processed efficiently based on the current state of the network and the load of the DPU. After being sent to the DPU network card, the DPU network card will be responsible for performing the actual address translation operation.

[0071] It is understandable that the DPU network card will maintain the status of the communication session in real time during the NAT conversion process to ensure that the data flow of each session follows the same address mapping rules. In this way, the DPU network card can always keep the traffic consistent in two-way communication, ensuring that the internal network devices can communicate with the external network transparently without leaking the real network structure and address information of the internal network.

[0072] It should be understood that the hardware acceleration capability of the DPU network card enables it to perform well in processing a large number of NAT conversions, greatly reducing the performance bottleneck caused by traditional NAT conversions that rely on the CPU. Through hardware acceleration, the processing speed of NAT conversion has been significantly improved, and the delay of data packets transmitted back and forth between the intranet and the Internet has also been reduced.

[0073] For example, when an intranet device (such as 192.168.1.100) sends a request to an external network server, the DPU network card will convert the intranet address 192.168.1.100 to the assigned external network address (such as 203.0.113.5) according to the NAT translation table sent by the SDN controller. When the external network server responds, the DPU network card will perform the address translation in reverse and remap the external network address 203.0.113.5 back to 192.168.1.100 to ensure the correctness and consistency of the two-way traffic. In this way, the intranet device can communicate with the external network transparently while protecting the security of the intranet.

[0074] In addition, the present invention also provides a NAT gateway construction device based on SDN and DPU, and the NAT gateway construction device based on SDN and DPU includes:

[0075] A startup module is used to send a startup instruction signal to the SDN controller, and the SDN controller configures the NAT mapping address pool after startup;

[0076] The status information acquisition module is used to complete the configuration of the NAT mapping address pool, and the SDN controller receives the status information of the DPU network card from the NAT gateway through the API interface;

[0077] A topology information acquisition module is used for the SDN controller to obtain network topology information from the SDN switch, where the network topology information includes connection information between the intranet device and the extranet, and generates data plane topology relationship information in combination with the state information of the DPU network card;

[0078] The initialization flow table configuration module is used by the SDN controller to send the initialization flow table to the SDN switch based on the generated data plane topology relationship information;

[0079] A message identification module is used for, when a message arrives at the SDN switch, the SDN switch identifies the unknown message by searching the initialization flow table, extracting the source address, destination address, source port number and destination port number therein, and sending this information to the SDN controller to request the creation of a new NAT mapping rule;

[0080] The NAT rule generation module is used for the SDN controller to allocate a unique external network address and port number and a DPU network card for processing NAT conversion to the request by random allocation according to the available external network addresses and port numbers in the NAT mapping address pool after receiving a new NAT mapping rule creation request, and to generate a NAT conversion table and a message forwarding flow table;

[0081] The message forwarding flow table sending module is used for the SDN controller to send the generated message forwarding flow table to the SDN switch to ensure that the switch can identify the bidirectional messages with the same flow identifier and send the generated messages to the same DPU network card for processing, so as to avoid the delay caused by the message transmission back and forth between multiple DPUs;

[0082] The NAT conversion execution module is used for the SDN controller to send the generated NAT conversion table to the specified DPU network card through the NAT control. The DPU network card performs NAT address conversion on the transmitted bidirectional traffic according to the conversion table. After receiving the NAT conversion table, the DPU network card converts the private address to the public network address of the message sent from the intranet to the extranet according to the rules in the table.

[0083] The present invention provides a NAT gateway construction device based on SDN and DPU, which adopts a NAT gateway construction method based on SDN and DPU in the above embodiment, and can solve the technical problem of NAT gateway construction based on SDN and DPU. Compared with the prior art, the beneficial effects of the NAT gateway construction device based on SDN and DPU provided by the present invention are the same as the beneficial effects of the NAT gateway construction method based on SDN and DPU provided in the above embodiment, and other technical features in the NAT gateway construction device based on SDN and DPU are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0084] The present invention provides a NAT gateway construction device based on SDN and DPU, please refer to Figure 2, a NAT gateway construction device based on SDN and DPU includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor so that at least one processor can execute a NAT gateway construction method based on SDN and DPU in the above-mentioned embodiment 1. A NAT gateway construction device based on SDN and DPU in the embodiment of the present invention may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. A NAT gateway construction device based on SDN and DPU is only an example and should not bring any limitations to the functions and scope of use of the embodiments of the present invention. A NAT gateway construction device based on SDN and DPU may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: ReadOnly Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: RandomAccess Memory) 1004. In RAM1004, various programs and data required for the operation of a NAT gateway construction device based on SDN and DPU are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow a NAT gateway construction device based on SDN and DPU to communicate wirelessly or wired with other devices to exchange data. Although a NAT gateway construction device based on SDN and DPU with various systems is shown in the figure, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0085] The present invention also provides a computer program product, including a computer program, which implements the steps of the above-mentioned method for building a NAT gateway based on SDN and DPU when executed by a processor. The computer program product provided by the present invention can solve the technical problem of building a NAT gateway based on SDN and DPU. Compared with the prior art, the beneficial effects of the computer program product provided by the present invention are the same as the beneficial effects of the method for building a NAT gateway based on SDN and DPU provided in the above embodiment, which will not be repeated here.

[0086] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through a communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present invention are executed.

[0087] It should be understood that the various parts disclosed in the present invention can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0088] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for building a NAT gateway based on SDN and DPU, characterized in that: The NAT gateway construction method based on SDN and DPU includes: Step S10: Send a startup instruction signal to the SDN controller, and the SDN controller configures the NAT mapping address pool after startup; Step S20: After completing the configuration of the NAT mapping address pool, the SDN controller receives the status information of the DPU network card from the NAT gateway through the API interface; Step S30: the SDN controller obtains network topology information from the SDN switch, the network topology information including connection information between the intranet device and the extranet, and generates data plane topology relationship information in combination with the state information of the DPU network card; Step S40: the SDN controller sends an initialization flow table to the SDN switch based on the generated data plane topology relationship information; Step S50: When the message arrives at the SDN switch, the SDN switch identifies the unknown message by searching the initialization flow table, extracts the source address, destination address, source port number and destination port number, and sends the information to the SDN controller to request the creation of a new NAT mapping rule; Step S60: After receiving the new NAT mapping rule creation request, the SDN controller allocates a unique external network address and port number and a DPU network card for processing NAT conversion to the request by random allocation according to the available external network addresses and port numbers in the NAT mapping address pool, and generates a NAT conversion table and a message forwarding flow table; Step S70: The SDN controller sends the generated message forwarding flow table to the SDN switch to ensure that the switch can identify bidirectional messages with the same flow identifier, and sends the generated messages to the same DPU network card for processing to avoid delays caused by message transmission back and forth between multiple DPUs; Step S80: The SDN controller sends the generated NAT translation table to the specified DPU network card through the NAT control. The DPU network card performs NAT address translation on the transmitted bidirectional traffic according to the translation table. After receiving the NAT translation table, the DPU network card converts the private address to the public network address of the message sent from the intranet to the extranet according to the rules in the table.

2. A method for building a NAT gateway based on SDN and DPU as described in claim 1, characterized in that: Step S80 also includes: when the NAT conversion rule has no traffic for a long time, executing NAT rule aging, deleting expired NAT rules, and sending the NAT conversion table and message forwarding flow table to be deleted to the NAT control and SDN switch respectively.

3. A method for building a NAT gateway based on SDN and DPU as described in claim 2, characterized in that: After the step of sending the NAT translation table and the message forwarding flow table to be deleted to the NAT control and the SDN switch respectively, the following steps are further included: The SDN switch receives the packet forwarding flow table deletion instruction and deletes the corresponding packet forwarding flow table; The NAT control sends a deletion instruction to the DPU network card, and the DPU network card deletes the corresponding packet forwarding flow table.

4. A method for building a NAT gateway based on SDN and DPU as claimed in claim 1, characterized in that: In step S70, when the generated message is sent to the same DPU network card for processing, if a DPU network card disconnection is detected, the following steps are performed: Send the MAC address and disconnection information of the DPU network card to the SDN controller; After receiving the DPU network card disconnection information, the SDN controller queries the current network topology relationship and selects a spare DPU network card to replace the failed DPU network card; The SDN controller deletes the message forwarding flow table related to the faulty DPU network card, generates a new NAT translation table and message forwarding flow table suitable for the standby DPU network card, and sends the NAT translation table and message forwarding flow table to the SDN switch and the standby DPU network card; After receiving the new message forwarding flow table, the SDN switch updates the message forwarding flow table and forwards the traffic to the standby DPU network card; After receiving the new NAT conversion table, the standby DPU network card performs NAT conversion processing on the received traffic based on the NAT conversion table to complete the failover operation.

5. A method for building a NAT gateway based on SDN and DPU as claimed in claim 1, characterized in that: In step S80, the NAT control runs on the gateway server and is composed of an OVS plug-in and a NAT agent, which are used to connect to the SDN controller and the DPU network card respectively.

6. A method for building a NAT gateway based on SDN and DPU as described in claim 5, characterized in that: The OVS plug-in is used to connect to the SDN controller, accept the NAT conversion table sent by the SDN switch, transparently transmit it to the DPU network card through the NAT proxy, and send the MAC address of the DPU network card.

7. A method for building a NAT gateway based on SDN and DPU as described in claim 5, characterized in that: The NAT agent is used to connect to the DPU network card and is responsible for sending the NAT conversion table, sending the running status of the DPU network card, and sending the address of the DPU network card.

8. A NAT gateway construction device based on SDN and DPU, characterized in that: The NAT gateway construction device based on SDN and DPU includes: A startup module is used to send a startup instruction signal to the SDN controller, and the SDN controller configures the NAT mapping address pool after startup; The status information acquisition module is used to complete the configuration of the NAT mapping address pool, and the SDN controller receives the status information of the DPU network card from the NAT gateway through the API interface; A topology information acquisition module is used for the SDN controller to obtain network topology information from the SDN switch, where the network topology information includes connection information between the intranet device and the extranet, and generates data plane topology relationship information in combination with the state information of the DPU network card; The initialization flow table configuration module is used by the SDN controller to send the initialization flow table to the SDN switch based on the generated data plane topology relationship information; A message identification module is used for, when a message arrives at the SDN switch, the SDN switch identifies the unknown message by searching the initialization flow table, extracting the source address, destination address, source port number and destination port number therein, and sending this information to the SDN controller to request the creation of a new NAT mapping rule; The NAT rule generation module is used for the SDN controller to allocate a unique external network address and port number and a DPU network card for processing NAT conversion to the request by random allocation according to the available external network addresses and port numbers in the NAT mapping address pool after receiving a new NAT mapping rule creation request, and to generate a NAT conversion table and a message forwarding flow table; The message forwarding flow table sending module is used for the SDN controller to send the generated message forwarding flow table to the SDN switch to ensure that the switch can identify the bidirectional messages with the same flow identifier and send the generated messages to the same DPU network card for processing, so as to avoid the delay caused by the message transmission back and forth between multiple DPUs; The NAT conversion execution module is used for the SDN controller to send the generated NAT conversion table to the specified DPU network card through the NAT control. The DPU network card performs NAT address conversion on the transmitted bidirectional traffic according to the conversion table. After receiving the NAT conversion table, the DPU network card converts the private address to the public network address of the message sent from the intranet to the extranet according to the rules in the table.

9. A NAT gateway construction device based on SDN and DPU, characterized in that: The NAT gateway construction equipment based on SDN and DPU includes: A memory, a processor, and a NAT gateway construction program based on SDN and DPU stored in the memory and executable on the processor. When the NAT gateway construction program based on SDN and DPU is executed by the processor, the NAT gateway construction method based on SDN and DPU described in any one of Claims 1 to 7 is implemented.

10. A computer program product, characterized in that The computer program product includes a NAT gateway construction program based on SDN and DPU, and when the NAT gateway construction program based on SDN and DPU is executed by a processor, the NAT gateway construction method based on SDN and DPU described in any one of Claims 1 to 7 is implemented.

Images