Address conversion method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to an address conversion method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring traffic data sent by a target client, and determining user feature information corresponding to the target client based on the traffic data; wherein the user feature information at least comprises behavior feature information and flow feature information; determining a target NAT strategy matched with the user feature information, and generating an NAT mapping rule corresponding to the target client based on the target NAT strategy; and performing address translation processing on the traffic data based on the NAT mapping rule. By adopting the method, the IP address allocation flexibility can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an address conversion method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the rapid development of the Internet, the number of network terminals has exploded, while IPv4 address resources are becoming increasingly exhausted. In order to solve the problem of IPv4 address shortage, NAT (Network Address Translation) technology came into being. NAT technology can convert the private IP (Internet Protocol) address of the internal network into the public IP address of the external network, enabling the internal network host to access the external network, while hiding the real IP address of the internal network and improving the security of the network.

[0003] In traditional NAT technology, after receiving the traffic data sent by the client, the network device can query the pre-configured NAT mapping rules. The NAT mapping rules contain the mapping relationship between private IP addresses and public IP addresses. After the network device obtains the public IP address corresponding to the client's IP address, it modifies the source address in the traffic data to the public IP address and then forwards it.

[0004] However, the NAT mapping relationship in traditional technology is manually configured and fixed, while the actual network environment is more complex and the resource requirements of each client are different. Therefore, based on the above address conversion method, it is easy to find that the IP address allocation does not match the actual scenario, resulting in poor flexibility in IP address allocation. Summary of the invention

[0005] Based on this, it is necessary to provide an address conversion method, apparatus, computer device, computer-readable storage medium and computer program product that can improve the flexibility of IP address allocation in order to address the above technical problems.

[0006] In a first aspect, the present application provides an address conversion method, the method comprising:

[0007] Acquire the traffic data sent by the target client, and determine the user characteristic information corresponding to the target client based on the traffic data; wherein the user characteristic information at least includes behavior characteristic information and traffic characteristic information;

[0008] Determine a target network address translation NAT policy that matches the user characteristic information, and generate a NAT mapping rule corresponding to the target client based on the target NAT policy;

[0009] The traffic data is subjected to address translation processing based on the NAT mapping rule.

[0010] In one of the embodiments, determining a target NAT policy that matches the user characteristic information, and generating a NAT mapping rule corresponding to the target client based on the target NAT policy, includes:

[0011] Based on the behavior characteristic information and the traffic characteristic information, identifying a target user category corresponding to the target client;

[0012] When the target user category is identified, a target NAT policy corresponding to the target user category is determined, and a NAT mapping rule corresponding to the target client is generated based on the target NAT policy.

[0013] In one of the embodiments, determining the target NAT policy corresponding to the target user category, and generating the NAT mapping rule corresponding to the target client based on the target NAT policy, includes:

[0014] In the pre-stored correspondence between user categories and NAT policies, query whether there is a target NAT policy corresponding to the target user category;

[0015] If there is a target NAT policy corresponding to the target user category, a NAT mapping rule corresponding to the target client is generated based on the queried target NAT policy.

[0016] In one embodiment, the method further comprises:

[0017] If there is no NAT policy corresponding to the target user category, a NAT mapping rule corresponding to the target client is generated based on the current network status.

[0018] In one embodiment, performing address conversion processing on the traffic data based on the NAT mapping rule includes:

[0019] Determining whether the traffic data complies with a pre-configured security policy;

[0020] If it complies with the security policy, the traffic data is subjected to address translation processing based on the NAT mapping rule.

[0021] In one embodiment, the method further comprises:

[0022] Displaying a management interface; wherein the management interface includes a plurality of management controls, and the management controls include one or more of an address pool management control, a NAT mapping rule management control, and a configuration parameter management control;

[0023] In response to a trigger operation on a target management control among the multiple management controls, a management process corresponding to the target management control is executed.

[0024] In a second aspect, the present application provides an address conversion device, the device comprising:

[0025] A determination module, used to obtain the traffic data sent by the target client, and determine the user characteristic information corresponding to the target client based on the traffic data; wherein the user characteristic information at least includes behavior characteristic information and traffic characteristic information;

[0026] A first generating module, used to determine a target network address translation NAT policy that matches the user characteristic information, and generate a NAT mapping rule corresponding to the target client based on the target NAT policy;

[0027] The first processing module is used to perform address conversion processing on the traffic data based on the NAT mapping rule.

[0028] In one embodiment, the first generating module is specifically used to:

[0029] Based on the behavior characteristic information and the traffic characteristic information, identifying a target user category corresponding to the target client;

[0030] When the target user category is identified, a target NAT policy corresponding to the target user category is determined, and a NAT mapping rule corresponding to the target client is generated based on the target NAT policy.

[0031] In one embodiment, the first generating module is specifically used to:

[0032] In the pre-stored correspondence between user categories and NAT policies, query whether there is a target NAT policy corresponding to the target user category;

[0033] If there is a target NAT policy corresponding to the target user category, a NAT mapping rule corresponding to the target client is generated based on the queried target NAT policy.

[0034] In one embodiment, the device further comprises:

[0035] The second generating module is used to generate a NAT mapping rule corresponding to the target client based on the current network status if there is no NAT policy corresponding to the target user category.

[0036] In one embodiment, the first processing module is specifically used to:

[0037] Determining whether the traffic data complies with a pre-configured security policy;

[0038] If the security policy is met, a NAT mapping rule corresponding to the target client is generated based on the target NAT policy.

[0039] In one embodiment, the device further comprises:

[0040] A display module, used to display a management interface; wherein the management interface includes a plurality of management controls, and the management controls include one or more of an address pool management control, a NAT mapping rule management control, and a configuration parameter management control;

[0041] The second processing module is used to execute management processing corresponding to a target management control in response to a trigger operation on the target management control among the multiple management controls.

[0042] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0043] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0044] In a fifth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0045] The above-mentioned address conversion method, device, computer equipment, computer-readable storage medium and computer program product can obtain the traffic data sent by the target client, and determine the user characteristic information corresponding to the target client based on the traffic data; wherein the user characteristic information at least includes behavior characteristic information and traffic characteristic information; determine the target NAT policy that matches the user characteristic information, and generate the NAT mapping rule corresponding to the target client based on the target NAT policy; perform address conversion processing on the traffic data based on the NAT mapping rule. In the embodiment of the present application, the user characteristic information of the client can be analyzed, and then the NAT mapping rule that matches the user characteristic information can be dynamically generated according to the user characteristic information. In this way, the NAT mapping rule corresponding to the client can be dynamically generated and adjusted for different clients, so that the IP address allocation is consistent with the actual behavior characteristics and traffic characteristics of the client, more in line with the actual scenario, and the flexibility of IP address allocation is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0047] FIG1 is a schematic diagram of an application scenario in an embodiment;

[0048] Figure 2 A schematic diagram of a flow chart of an address conversion method in an embodiment;

[0049] FIG3 is a schematic diagram of a NAT system in one embodiment;

[0050] Figure 4 is a structural block diagram of an address conversion device in one embodiment;

[0051] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] The embodiment of the present application provides an address conversion method, which can be applied to a NAT system, or a network device including a NAT system, such as a NAT router or other device with a NAT conversion function, which can be a single device or implemented by multiple sub-devices. As shown in FIG1, a schematic diagram of an application scenario provided for the implementation of the present application includes a NAT system 110, a server 120, and a client 130. Among them, wireless communication can be performed between the NAT system 110, the server 120, and the client 130. Among them, the client 130 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. The Internet of Things device can be a smart speaker, a smart TV, a smart air conditioner, a smart car device, a projection device, etc. The server 120 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. Through this embodiment, it is possible to monitor the characteristics of network traffic (such as traffic size, number of device connections, etc.), thereby dynamically adjusting the NAT mapping rules to improve the flexibility of IP address allocation, thereby improving the utilization rate of IP address resources and network performance.

[0054] The address conversion method provided by this application will be described in detail below in conjunction with a specific implementation method. Figure 2 As shown, taking the method applied to a network device as an example, the method includes the following steps:

[0055] Step 202: Acquire the traffic data sent by the target client, and determine the user characteristic information corresponding to the target client based on the traffic data.

[0056] The user characteristic information at least includes behavior characteristic information and traffic characteristic information.

[0057] In the embodiment of the present application, after the network device is started, data initialization can be performed first. Specifically, the administrator can trigger the startup initialization through the management function in the user interface (such as the command line interface, the graphical interface, etc.). The network device can load the necessary configuration files and related parameters to initialize the NAT system. Among them, the configuration file can at least include an address pool configuration file and a security policy configuration file. Then, the network device can read the predefined address pool configuration file, and the address pool configuration file can contain the available public IP address range. At the same time, the network device can also verify the validity of the address pool and initialize the internal data structure, such as the address pool list, the allocated address list, etc. If the address pool is empty or incorrectly configured, an error report will be displayed. Similarly, a predefined security policy configuration file can also be loaded in the network device, which contains security settings such as access control lists and firewall rules. At the same time, the network device can verify the correctness of the syntax and logic of the configuration file, and initialize the internal security policy database or rule set. If the security policy is incorrectly configured or there is a conflict, an error report will be displayed and may need to be reconfigured. The administrator can perform corresponding processing according to the error report to complete the initialization process.

[0058] After initialization is completed, the network device can monitor the traffic in the network. The network device can obtain the traffic data sent by the target client and determine the user characteristic information corresponding to the target client based on the traffic data. Among them, the target client can be any client in the network; the user characteristic information at least includes behavior characteristic information and traffic characteristic information. The behavior characteristic information is used to describe the characteristics of the target client's access to the network, such as access frequency, access time, frequently visited website addresses, the number of visited websites, etc.; the traffic characteristic information is used to describe the traffic situation of the target client, such as traffic size, traffic peak, etc.

[0059] Optionally, extracting user characteristic information based on traffic data includes: inputting the traffic data into a pre-trained machine learning model to obtain behavioral characteristic information corresponding to the target client; analyzing the traffic data through a big data analysis strategy to obtain traffic characteristic information.

[0060] In an embodiment of the present application, the network device may input the traffic data into a pre-trained machine learning model to obtain the behavior feature information corresponding to the target client, and at the same time, the traffic data may be analyzed through a big data analysis strategy to obtain traffic feature information. Optionally, the big data analysis strategy may be an intelligent analysis algorithm, which is not limited in the embodiment of the present application. The traffic feature information is used to describe the traffic situation of the target client, and may include key information such as the size of the network traffic, the predicted change trend, the communication mode of the traffic (such as encryption / non-encryption, or the type of communication protocol), the peak value of the traffic, the connection frequency, and the number of connections. The behavior feature information is used to describe the characteristics of the target client's access to the network, such as the access frequency, the access time, the websites with high access frequency and the website type (such as the external network website or the intranet website), the number of websites visited, and whether to visit the prohibited website. The network device may generate and store a status report based on the extracted user feature information. The status report may include user feature information, and may also include information on key fields such as the source IP address of the traffic data.

[0061] Step 204: determine a target NAT policy that matches the user characteristic information, and generate a NAT mapping rule corresponding to the target client based on the target NAT policy.

[0062] In an embodiment of the present application, user characteristic information can reflect the client's demand for IP address resources. Based on this, the network device can determine a target NAT policy that matches the user characteristic information based on matching. For example, the network device can store a mapping model, which can be a pre-configured mapping relationship model or a model trained by an artificial intelligence model (such as a classification model). The network device can obtain the corresponding target NAT policy based on the mapping model and the user characteristic information contained in the status report. Among them, the NAT policy is the configuration rule of NAT mapping, and the network device can generate a NAT mapping rule corresponding to the target client based on the target NAT policy.

[0063] Step 206: Perform address translation processing on the traffic data based on the NAT mapping rule.

[0064] In an embodiment of the present application, the network can parse the data packet in the traffic data to obtain the source address and destination address of the data packet. If the source address of the data packet is the private IP address of the internal network, and the destination address is the public IP address of the external network or is not within the scope of the internal network, the data packet needs to be NAT mapped. Then, the network device queries the NAT mapping rule, which can be characterized as a NAT mapping table, which is used to record the mapping relationship between the internal private IP address and the external public IP address. The network device can query the IP address corresponding to the source address in the NAT mapping table, and then perform address conversion processing based on the query result.

[0065] Specifically, if a mapping rule corresponding to the source address of the data packet is queried in the NAT mapping table, the source address of the data packet (i.e., the internal private IP address) is replaced with the external public IP address queried in the NAT mapping table; optionally, the source port number of the data packet can also be modified based on the configuration information to match the port mapping defined in the NAT mapping rule. If a mapping rule corresponding to the source address of the data packet is not queried in the NAT mapping table, it is determined whether the dynamic NAT condition is met. The dynamic NAT condition can be determined by whether there is an available public IP address in the address pool. If the dynamic NAT condition is met (such as there is an available public IP address in the address pool), a new NAT mapping rule is generated based on the public IP address and the source address of the data packet, address translation is performed, and the new mapping relationship is added to the NAT mapping table so that subsequent data packets can be addressed based on the same mapping rule. If the dynamic NAT condition is not met (such as there is no available public IP address in the address pool), the data packet is discarded.

[0066] In this solution, the NAT mapping rules corresponding to different clients can be dynamically generated and adjusted, so that the IP address allocation is consistent with the actual behavior characteristics and traffic characteristics of the client, which is more in line with the actual scenario and improves the flexibility of IP address allocation.

[0067] Optionally, determine a target NAT policy that matches the user characteristic information, and generate NAT mapping rules corresponding to the target client based on the target NAT policy, including: identifying a target user category corresponding to the target client based on the behavior characteristic information and the traffic characteristic information; when the target user category is identified, determine a target NAT policy corresponding to the target user category, and generate NAT mapping rules corresponding to the target client based on the target NAT policy.

[0068] In an embodiment of the present application, the network device can identify the target user category corresponding to the target client based on the behavior feature information and the traffic feature information. For example, the correspondence between the behavior feature information, the traffic feature information and the user type can be established in advance, and then the target user category corresponding to the target client can be determined based on the correspondence. When the target user category is identified, the target NAT policy corresponding to the target user category is determined, and the NAT mapping rule corresponding to the target client is generated based on the target NAT policy. In one example, if the user category is a high-frequency access user, a fixed public IP address can be assigned to the client; if the user category is a low-frequency access user, the public IP address corresponding to the client can be randomly determined in the address pool. In another example, if the user category is a high-flow user, a first number of public IP addresses can be assigned to the client; if the user category is a low-flow user, a second number of public IP addresses can be assigned to the client. The first number is greater than the second number. Alternatively, the address segment described by the client can also be determined based on the user category. In addition, the number or address range of IP addresses in the address pool can also be determined according to the load situation in the current network.

[0069] In this solution, there can be multiple NAT policies. In this way, different NAT policies can be used to generate NAT mapping rules for different categories of clients, thereby realizing flexible allocation of IP addresses and making the allocated IP addresses consistent with the needs of the clients, making IP address allocation more reasonable and avoiding waste of IP address resources.

[0070] Optionally, determine the target NAT policy corresponding to the target user category, and generate NAT mapping rules corresponding to the target client based on the target NAT policy, including: querying whether there is a target NAT policy corresponding to the target user category in the pre-stored correspondence between user categories and NAT policies; if there is a target NAT policy corresponding to the target user category, generating NAT mapping rules corresponding to the target client based on the queried target NAT policy.

[0071] In an embodiment of the present application, the network device can query whether there is a target NAT policy corresponding to the target user category in the pre-stored correspondence between the user category and the NAT policy. If there is a target NAT policy corresponding to the target user category, a NAT mapping rule corresponding to the target client is generated based on the queried target NAT policy. Specifically, the NAT policy can include an IP address configuration rule (such as the number of IP addresses) and an address range. According to the IP address configuration rule, an IP address can be determined in the address range, and a NAT mapping rule corresponding to the target client is generated based on the determined IP address and the source IP address corresponding to the target client.

[0072] In this solution, different NAT strategies can be used to generate NAT mapping rules for different types of clients to achieve flexible allocation of IP addresses. The allocated IP addresses can be made consistent with the needs of the clients, making IP address allocation more reasonable and avoiding waste of IP address resources.

[0073] Optionally, the method further includes: if there is no NAT policy corresponding to the target user category, generating a NAT mapping rule corresponding to the target client based on the current network status.

[0074] In the embodiment of the present application, if there is no NAT policy corresponding to the target user category, the network device generates a NAT mapping rule corresponding to the target client based on the current network status (such as the traffic load size in the network, the availability of the public IP address, etc.) and the preset policy. The preset policy can be configured by the technician according to actual needs, and the embodiment of the present application does not limit it.

[0075] In this solution, when there is no NAT policy corresponding to the target user category, the NAT mapping rules corresponding to the target client can be generated based on the current network status, thereby improving the success rate of NAT mapping. In addition, this solution not only uses data analysis and machine learning models to identify the user behavior characteristics of the client and predict the changing trend of network traffic, but also combines these data with dynamic address translation rules to achieve smarter and more efficient NAT mapping management.

[0076] Optionally, a list or database containing public IP addresses, i.e., an address pool, can be maintained in the network device. This list or database usually includes a list of allocated and unallocated addresses, as well as the allocation time of the addresses. When an IP address needs to be allocated, it can be checked whether there are enough unallocated addresses in the address pool to meet the allocation needs. If there are enough addresses, one or more addresses will be selected from the unallocated addresses and marked as allocated; if the addresses are insufficient, they can be processed based on a pre-configured processing strategy. For example, address allocation can be rejected, addresses that have been allocated but not used for a long time (such as unused time exceeds a preset threshold) can be recycled, or the administrator can be notified to manually add more addresses to the address pool. The specific processing strategy can be configured according to actual needs.

[0077] In this way, the automatic allocation and recycling of public IP addresses can be realized, ensuring the effective use of the address pool and avoiding the waste of address resources. At the same time, through automated and intelligent management methods, the workload and operation and maintenance costs of operation and maintenance personnel are reduced, and the operation and maintenance efficiency is improved.

[0078] Optionally, performing address conversion processing on the traffic data based on the NAT mapping rules includes: determining whether the traffic data complies with a pre-configured security policy; if it complies with the security policy, performing address conversion processing on the traffic data based on the NAT mapping rules.

[0079] In an embodiment of the present application, before performing address conversion processing, the network device may first determine whether the flow data complies with a pre-configured security policy. The security policy may be an access control list, a firewall rule, etc. If the security policy is met, the flow data is subjected to address conversion processing based on the NAT mapping rule. If the security policy is met, the data packet of the flow data is discarded and the processing is terminated.

[0080] After completing the address translation, the network device can forward the modified data packet to the destination address. If the destination address is the public IP address of the external network, the data packet will be sent to the external network; if the destination address is the private IP address of the internal network, the data packet will be forwarded to the internal network.

[0081] In this solution, security considerations are integrated into the dynamic address translation and mapping process, which can ensure the compliance of NAT mapping, thereby keeping the system simple without sacrificing security. When performing NAT mapping, only data packets that comply with security rules can pass through the NAT device for address translation, greatly enhancing the security of the network and reducing potential security risks.

[0082] Optionally, the method also includes: displaying a management interface; wherein the management interface includes multiple management controls, and the management controls include one or more of an address pool management control, a NAT mapping rule management control, and a configuration parameter management control; in response to a trigger operation on a target management control among the multiple management controls, executing management processing corresponding to the target management control.

[0083] In an embodiment of the present application, a network device can display a management interface; wherein the management interface includes multiple management controls, and the management controls include one or more of an address pool management control, a NAT mapping rule management control, and a configuration parameter management control; in response to a trigger operation for a target management control among the multiple management controls, the management processing corresponding to the target management control is executed. In this way, an intuitive and easy-to-use management interface and rich management tools can be provided, allowing administrators to view network status, NAT mapping rules and other information in real time, and providing the function of manually adjusting and optimizing NAT mapping rules, so as to facilitate administrators to perform refined management of the network. Administrators can also view and modify the status of the address pool through the management interface and tool module, such as adding, deleting or modifying public IP addresses.

[0084] In this solution, the user-friendliness and functionality of NAT management can be achieved through a visual management interface, allowing administrators to view and manage network status and NAT mapping rules more intuitively. Administrators can view the status of the NAT system at any time, manually adjust NAT mapping rules, add or delete public IP addresses, etc. This improves the flexibility of management and can adapt to various complex network environments and management needs.

[0085] In one example, as shown in Figure 3, an example of a NAT system is provided, which may include a management interface and tool module, an address pool management module, a network monitoring module, a data processing and analysis module, a dynamic address translation module, a NAT mapping management module, and a security policy module. Data can be transmitted between the modules.

[0086] The management interface and tool module can provide an intuitive and easy-to-use management interface and rich management tools, allowing administrators to view network status, NAT mapping rules and other information in real time, and provide the function of manually adjusting and optimizing NAT mapping rules, so that administrators can manage the network in a refined manner. The management interface and tool module can be connected to the address pool management module. Administrators can view and modify the status of the address pool through the management interface and tool module, such as adding, deleting or modifying public IP addresses. The management interface and tool module can also be connected to the dynamic address translation module. Administrators can send instructions or adjust parameters through the interface to affect the NAT mapping rules generated by the dynamic address translation module.

[0087] The address pool management module can be used to manage the public IP address pool, allocate and recycle public IP addresses for internal network use, and ensure that unused public IP addresses can be allocated from the address pool to internal private IP addresses for mapping when needed. As described above, the address pool management module can be connected to the management interface and the tool module, provide the status information of the address pool to the management interface for display, and receive instructions from the management interface to modify the address pool. The address pool management module can also be connected to the dynamic address translation module, thereby providing the dynamic address translation module with a public IP address to create a NAT mapping.

[0088] The network monitoring module can be used to collect and analyze key data such as network traffic and device connection numbers in real time. Through the built-in network monitoring tool, the internal network traffic and device connection status are monitored in real time to ensure the accuracy and real-time nature of the data. The network monitoring module can be connected to the data processing and analysis module to send the monitored network data to the data processing and analysis module for analysis. The network monitoring module can also be connected to the dynamic address translation module: the real-time network status information provided by the network monitoring module can affect the NAT mapping rules generated by the dynamic address translation module.

[0089] The data processing and analysis module can be used to use machine learning algorithms and big data processing technology to conduct in-depth learning and analysis of the collected network data, predict the trend of future network traffic changes, and combine historical data with the current network status to predict changes in network traffic through intelligent algorithms, providing data support for dynamically adjusting NAT mapping rules. The data processing and analysis module can be connected to the network monitoring module to receive data from the network monitoring module for processing. The data processing and analysis module can also be connected to the dynamic address translation module to send the analysis results (such as traffic prediction) to the dynamic address translation module so that it can generate appropriate NAT mapping rules.

[0090] The dynamic address translation module can be used to create, modify or delete NAT mapping rules in real time and dynamically according to factors such as network status, device requirements, and security policies. It can respond to changes in network status in real time and adjust NAT mapping immediately; combine historical data and current network status to predict and adjust NAT mapping rules through intelligent algorithms to meet future network traffic needs; when creating or modifying NAT mapping rules, fully consider security factors to ensure network security. The dynamic address translation module can communicate with the management interface and tool module to receive instructions or parameter adjustments sent by the administrator through the interface. The dynamic address translation module can also communicate with the address pool management module to request a public IP address from the address pool management module when necessary. The dynamic address translation module can also communicate with the data processing and analysis module to receive the analysis results of the data processing and analysis module to guide the generation of NAT mapping rules. The dynamic address translation module can communicate with the NAT mapping management module to send the generated NAT mapping rules to the NAT mapping management module for execution.

[0091] The NAT mapping management module can be used to perform actual NAT mapping operations (such as IP address replacement) according to the NAT mapping rules provided by the dynamic address translation module. The NAT mapping management module can communicate with the dynamic address translation module to receive and execute the NAT mapping rules generated by the dynamic address translation module. The NAT mapping management module can communicate with the security policy module, so that the security rules defined by the security policy module can be applied when performing NAT mapping.

[0092] The security policy module can be used to define and manage the security policies of the NAT system, such as access control lists, firewall rules, etc. The security policy module can communicate with the NAT mapping management module, and the NAT mapping management module needs to comply with the security rules defined by the security policy module when performing NAT mapping.

[0093] By dividing each function into clear modules, higher system flexibility and scalability are achieved. The interaction between modules is carefully designed to ensure the stability and efficiency of the entire system.

[0094] Based on the NAT system shown in FIG3 , the embodiment of the present application provides an example of an address translation method, which specifically includes the following steps:

[0095] Step 1: Start the management interface and tool module, load the configuration file and parameters through the management interface and tool module, and prepare to initialize the NAT system.

[0096] Step 2: Initialize the address pool management module.

[0097] Specifically, the address pool management module reads a predefined address pool configuration file, which contains at least the available public IP address range. At the same time, it verifies the validity of the address pool and initializes internal data structures, such as the address pool list and the allocated address list. If the address pool is empty or incorrectly configured, the address pool management module reports an error to the administrator. The administrator can take corresponding actions based on the error report to complete the initialization process.

[0098] Step 3: Initialize the security policy module.

[0099] Specifically, the security policy module loads a predefined security policy configuration file, which contains security settings such as access control lists and firewall rules. At the same time, it verifies the syntax and logical correctness of the configuration file and initializes the internal security policy database or rule set. If the security policy is configured incorrectly or there is a conflict, the security policy module will report the error to the administrator. The administrator can take corresponding measures based on the error report to complete the initialization process.

[0100] Step 4: The network monitoring module captures and records the traffic data of the internal network (client traffic data), and performs preliminary processing on the traffic data to extract key data contained in the traffic data, such as the number of connections, the source of the data packet, the access target, the data packet size, the data packet transmission time, etc., and then transmits the extracted key data to the data processing and analysis module.

[0101] Step 5: The data processing and analysis module analyzes the data transmitted by the network monitoring module to obtain the user characteristic information of the client, and generates a status report based on the user characteristic information and sends it to the dynamic address translation module.

[0102] Step 6: After receiving the status report from the data processing and analysis module, the dynamic address translation module performs matching among the pre-stored NAT policies based on the status report.

[0103] If an existing policy is matched, the dynamic address translation module will directly use the matched NAT policy to generate NAT mapping rules;

[0104] If there is no matching policy, or if an instruction to dynamically adjust NAT rules is received, the dynamic address translation module generates new NAT mapping rules based on the current network status (such as traffic load and availability of public IP addresses).

[0105] Step 7: The dynamic address translation module sends an address allocation request to the address pool management module according to the generated NAT mapping rule, requesting to allocate one or more public IP addresses for NAT mapping.

[0106] Step 8: After receiving the address allocation request from the dynamic address translation module, the address pool management module checks whether there are enough unallocated addresses in the address pool to meet the address allocation requirements. If there are enough addresses, the address pool management module will select one or more addresses from the unallocated addresses and mark these addresses as allocated; if there are insufficient addresses, the address pool management module will perform corresponding processing based on the preset processing strategy, such as rejecting the request, reclaiming the allocated but long-unused addresses, or notifying the administrator to manually add more addresses to the address pool.

[0107] Step 9: The address pool management module returns the allocated public IP address list to the dynamic address translation module.

[0108] Step 10: When a data packet flows through the NAT device, the NAT mapping management module in the NAT device checks the source address and destination address of the data packet. If the source address of the data packet is a private IP address of the internal network (such as 10.0.0.1), and the destination address is a public IP address of the external network or is not within the internal network range, then the data packet needs to be NAT mapped.

[0109] Step 11: The NAT mapping management module establishes a NAT mapping table according to the NAT mapping rules sent by the dynamic address translation module, and searches the NAT mapping table based on the source address of the data packet. The NAT mapping table records the mapping relationship between the internal private IP address and the external public IP address.

[0110] If a NAT mapping rule matching the source address of the data packet is found in the NAT mapping table, the source address of the data packet (i.e., the internal private IP address) is replaced with the corresponding external public IP address in the NAT mapping table; optionally, the source port number of the data packet can also be modified to match the port mapping defined in the NAT mapping rule.

[0111] If no NAT mapping rule matching the source address of the data packet is found in the NAT mapping table, it is further determined whether the conditions for dynamic NAT are met (such as whether there is an available public IP address in the address pool). If so, the dynamic address translation module generates a new NAT mapping rule and notifies the NAT mapping management module to perform address translation.

[0112] Step 12: If a new NAT mapping rule is generated, the NAT mapping management module adds the new mapping relationship to the NAT mapping table so that subsequent data packets can perform address translation based on the same mapping rule.

[0113] Step 13: The NAT mapping management module checks whether the data packet complies with the security policy defined by the security policy module.

[0114] If the data packet does not comply with the security policy, the NAT mapping management module refuses to perform address translation or discards the data packet.

[0115] If the data packet violates the security policy, the NAT mapping management module performs address translation.

[0116] Step 14: The NAT mapping management module forwards the modified data packet to the destination address.

[0117] If the destination address is a public IP address of the external network, the data packet will be sent to the external network; if the destination address is a private IP address of the internal network, the data packet will be forwarded to the internal network.

[0118] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0119] Based on the same inventive concept, the embodiment of the present application also provides an address conversion device for implementing the address conversion method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more address conversion device embodiments provided below can refer to the limitations on the address conversion method above, and will not be repeated here.

[0120] In an exemplary embodiment, Figure 4 As shown, an address conversion device is provided, including: a determination module 410, a first generation module 420 and a first processing module 430, wherein:

[0121] The determination module 410 is used to obtain the traffic data sent by the target client, and determine the user characteristic information corresponding to the target client based on the traffic data; wherein the user characteristic information at least includes behavior characteristic information and traffic characteristic information;

[0122] A first generating module 420 is used to determine a target NAT policy that matches the user characteristic information, and generate a NAT mapping rule corresponding to the target client based on the target NAT policy;

[0123] The first processing module 430 is used to perform address conversion processing on the traffic data based on the NAT mapping rule.

[0124] In one embodiment, the first generating module 420 is specifically used to:

[0125] Based on the behavior characteristic information and the traffic characteristic information, identifying a target user category corresponding to the target client;

[0126] When the target user category is identified, a target NAT policy corresponding to the target user category is determined, and a NAT mapping rule corresponding to the target client is generated based on the target NAT policy.

[0127] In one embodiment, the first generating module 420 is specifically used to:

[0128] In the pre-stored correspondence between user categories and NAT policies, query whether there is a target NAT policy corresponding to the target user category;

[0129] If there is a target NAT policy corresponding to the target user category, a NAT mapping rule corresponding to the target client is generated based on the queried target NAT policy.

[0130] In one embodiment, the device further comprises:

[0131] The second generating module is used to generate a NAT mapping rule corresponding to the target client based on the current network status if there is no NAT policy corresponding to the target user category.

[0132] In one embodiment, the first processing module is specifically used to:

[0133] Determining whether the traffic data complies with a pre-configured security policy;

[0134] If the security policy is met, a NAT mapping rule corresponding to the target client is generated based on the target NAT policy.

[0135] In one embodiment, the device further comprises:

[0136] A display module, used to display a management interface; wherein the management interface includes a plurality of management controls, and the management controls include one or more of an address pool management control, a NAT mapping rule management control, and a configuration parameter management control;

[0137] The second processing module is used to execute management processing corresponding to a target management control in response to a trigger operation on the target management control among the multiple management controls.

[0138] Each module in the above-mentioned address conversion device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0139] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, an address conversion method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0140] Those skilled in the art will understand that Figure 5The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0141] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned address conversion method when executing the computer program.

[0142] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned address conversion method are implemented.

[0143] In one embodiment, a computer program product is provided, comprising a computer program, wherein the computer program implements the steps of the above-mentioned address conversion method when executed by a processor.

[0144] It should be noted that the user information (including but not limited to user device identification, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0145] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0146] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0147] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An address conversion method, characterized in that: The method comprises: Acquire the traffic data sent by the target client, and determine the user characteristic information corresponding to the target client based on the traffic data; wherein the user characteristic information at least includes behavior characteristic information and traffic characteristic information; Determine a target network address translation NAT policy that matches the user characteristic information, and generate a NAT mapping rule corresponding to the target client based on the target NAT policy; The traffic data is subjected to address translation processing based on the NAT mapping rule.

2. The method according to claim 1, characterized in that The determining of a target NAT policy matching the user characteristic information, and generating a NAT mapping rule corresponding to the target client based on the target NAT policy, includes: Based on the behavior characteristic information and the traffic characteristic information, identifying a target user category corresponding to the target client; When the target user category is identified, a target NAT policy corresponding to the target user category is determined, and a NAT mapping rule corresponding to the target client is generated based on the target NAT policy.

3. The method according to claim 2, characterized in that The determining of the target NAT policy corresponding to the target user category and generating the NAT mapping rule corresponding to the target client based on the target NAT policy includes: In the pre-stored correspondence between user categories and NAT policies, query whether there is a target NAT policy corresponding to the target user category; If there is a target NAT policy corresponding to the target user category, a NAT mapping rule corresponding to the target client is generated based on the queried target NAT policy.

4. The method according to claim 3, characterized in that The method further comprises: If there is no NAT policy corresponding to the target user category, a NAT mapping rule corresponding to the target client is generated based on the current network status.

5. The method according to claim 1, characterized in that The performing address conversion processing on the traffic data based on the NAT mapping rule includes: Determining whether the traffic data complies with a pre-configured security policy; If it complies with the security policy, the traffic data is subjected to address translation processing based on the NAT mapping rule.

6. The method according to claim 1, characterized in that The method further comprises: Displaying a management interface; wherein the management interface includes a plurality of management controls, and the management controls include one or more of an address pool management control, a NAT mapping rule management control, and a configuration parameter management control; In response to a trigger operation on a target management control among the multiple management controls, a management process corresponding to the target management control is executed.

7. An address conversion device, characterized in that: The device comprises: A determination module, used to obtain the traffic data sent by the target client, and determine the user characteristic information corresponding to the target client based on the traffic data; wherein the user characteristic information at least includes behavior characteristic information and traffic characteristic information; A first generating module, used to determine a target network address translation NAT policy that matches the user characteristic information, and generate a NAT mapping rule corresponding to the target client based on the target NAT policy; The first processing module is used to perform address conversion processing on the traffic data based on the NAT mapping rule.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images