Cross-domain communication method and device, computer equipment, storage medium and program product

Abstract

The invention relates to a cross-domain communication method and device, computer equipment, a storage medium and a program product. The method comprises the steps of receiving a first access request sent by a terminal device corresponding to a first device, converting a first private source address in the first access request into a first public active address according to a preset relationship to obtain an update access request, and then sending the update access request to a second device. Wherein the first access request comprises a first private source address and a first public destination address, private addresses and public addresses of terminal equipment corresponding to the first equipment in the preset relation are in one-to-one correspondence, and the update access request is used for indicating the second equipment to convert the first public destination address into the first private destination address; and sending the update access request after address conversion to a terminal device corresponding to the first private destination address. By adopting the method, the communication efficiency between devices can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a cross-domain communication method, apparatus, computer equipment, storage medium and program product. Background Art

[0002] In the field of communications, Customer Premise Equipment (CPE) is a wireless terminal access device that is usually located on the client side of the network and serves as the demarcation point between the Wide Area Network (WAN) and the Local Area Network (LAN).

[0003] In the related art, when devices in two different LANs communicate across domains, the CPEs corresponding to the two devices usually use Network Address Translation (NAT) technology to convert IP addresses, thereby establishing a session between the devices and achieving communication between the two. However, the related art has the problem of low communication efficiency. Summary of the invention

[0004] Based on this, it is necessary to provide a cross-domain communication method, apparatus, computer equipment, storage medium and program product that can improve the communication efficiency between devices in response to the above technical problems.

[0005] In a first aspect, the present application provides a cross-domain communication method, which is applied to a first device; the method includes:

[0006] Receiving a first access request sent by a terminal device corresponding to the first device; the first access request includes a first private source address and a first public destination address;

[0007] Converting the first private source address in the first access request into the first public source address according to the preset relationship to obtain an update access request; wherein the private address and the public address of the terminal device corresponding to the first device in the preset relationship correspond one to one;

[0008] Send an update access request to the second device; the update access request is used to instruct the second device to convert the first public destination address to the first private destination address, and send the updated access request after the address conversion to the terminal device corresponding to the first private destination address.

[0009] In one embodiment, receiving a first access request sent by a terminal device corresponding to the first device includes:

[0010] Receiving an access request through a local area network interface of the first device, and sending the access request to a source address translation module of the first device;

[0011] Converting the first private source address in the first access request into the first public source address according to the preset relationship to obtain an update access request, including:

[0012] Converting the first private source address in the first access request into a first public source address through a source address conversion module to obtain an update access request;

[0013] Sending an update access request to the second device includes:

[0014] An update access request sent by the source address translation module is received through the wide area network interface of the first device, and the update access request is sent to the second device.

[0015] In one embodiment, the method further comprises:

[0016] Receiving a first access response sent by the second device; the first access response includes a public source address and a public destination address;

[0017] The public destination address in the first access response is converted into a private destination address according to a preset relationship, and the first access response after the address conversion is sent to a terminal device corresponding to the private destination address.

[0018] In one of the embodiments, receiving a first access response sent by a second device includes:

[0019] receiving a first access response through a wide area network interface of the first device, and sending the first access response to a destination address translation module of the first device;

[0020] The method converts a public destination address in the first access response into a private destination address according to a preset relationship, and sends the first access response after the address conversion to a terminal device corresponding to the private destination address, including:

[0021] The destination address conversion module of the first device converts the public destination address in the first access response into a private destination address according to a preset relationship, receives the updated first access response through the local area network interface of the first device, and sends the updated first access response to the terminal device corresponding to the private destination address.

[0022] In one embodiment, the method further comprises:

[0023] receiving a second access request sent by a third device, the second access request including a second public source address and a second public target address;

[0024] The second public destination address in the second access request is converted into a second private destination address according to a preset relationship, and the second access request after the address conversion is sent to a terminal device corresponding to the second private destination address.

[0025] In one embodiment, the method further comprises:

[0026] Receiving a second access response sent by a terminal device corresponding to a second private destination address; the second access response includes a private source address and a public destination address;

[0027] The private source address in the second access response is converted into a public source address according to a preset relationship, and the second access response after the address conversion is sent to the third device.

[0028] In a second aspect, the present application also provides a cross-domain communication device, including:

[0029] A request receiving module, configured to receive a first access request sent by a terminal device corresponding to the first device; the first access request includes a first private source address and a first public destination address;

[0030] An address conversion module, configured to convert a first private source address in a first access request into a first public source address according to a preset relationship, to obtain an update access request; wherein the private address and the public address of a terminal device corresponding to the first device in the preset relationship correspond one to one;

[0031] A request sending module is used to send an update access request to the second device; the update access request is used to instruct the second device to convert the first public destination address into a first private destination address, and send the updated access request after the address conversion to the terminal device corresponding to the first private destination address.

[0032] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method in any one of the embodiments of the first aspect are implemented.

[0033] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method in any one of the embodiments of the first aspect above.

[0034] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method in any one of the embodiments of the first aspect above.

[0035] The above cross-domain communication method, device, computer equipment, storage medium and program product receive a first access request sent by a terminal device corresponding to the first device, and convert the first private source address in the first access request into a first public source address according to a preset relationship, obtain an update access request, and then send the update access request to the second device. Among them, the first access request includes a first private source address and a first public destination address, and there is a one-to-one correspondence between the private address and the public address of the terminal device corresponding to the first device in the preset relationship. The update access request is used to instruct the second device to convert the first public destination address into the first private destination address, and send the updated access request after the address conversion to the terminal device corresponding to the first private destination address. In this method, when the first device converts the first private source address in the first access request into the first public source address, the conversion operation can be directly performed according to the preset one-to-one correspondence between the private address and the public address of the terminal device in the first device. The conversion basis is clear and reliable, the conversion logic is simple and easy to implement, and the speed at which the first device obtains the update access request can be improved. Furthermore, when the second device converts the first public destination address in the update access request into the first private destination address, the conversion operation can also be performed according to the preset one-to-one correspondence between the private address and the public address of the terminal device corresponding to the second device, so as to quickly obtain the first private destination address and accurately and quickly locate the terminal device corresponding to the first private address, thereby improving the speed at which the terminal device of the first device accesses the terminal device of the second device and improving communication efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 An application environment diagram of a cross-domain communication method in an embodiment;

[0038] Figure 2 A schematic diagram of a first process of a cross-domain communication method in an embodiment;

[0039] Figure 3 A schematic diagram of a path of an access request sending step in one embodiment;

[0040] Figure 4 A second flow chart of a cross-domain communication method in one embodiment;

[0041] Figure 5 A schematic diagram of a path of an access response receiving step in one embodiment;

[0042] Figure 6 A schematic diagram of a path of a cross-domain communication method in an embodiment;

[0043] Figure 7 A third flow chart of a cross-domain communication method in one embodiment;

[0044] Figure 8 Schematic diagram of a fourth process of a cross-domain communication method in one embodiment;

[0045] Fig. 9 It is a flow diagram of cross-domain communication of devices in one embodiment;

[0046] Fig.10 is a structural block diagram of a cross-domain communication device in one embodiment;

[0047] Fig.11 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] The following is a description of the specific terms used in this application.

[0050] Network Address Translation (NAT) technology refers to the technology used to use private addresses in the local network and switch to global IP addresses when connecting to the Internet.

[0051] Local Area Network (LAN) refers to a type of network that generally covers a radius of several thousand meters. It is widely used in various offices due to its convenient installation, cost-saving, and easy expansion. LAN can realize functions such as file management, application software sharing, and printer sharing. During use, by maintaining the security of the LAN network, it can effectively protect data security and ensure the normal and stable operation of the LAN network.

[0052] Software Defined Wide Area Network (SDWAN) refers to a service formed by applying SDN technology to wide area network scenarios. This service is used to connect enterprise networks, data centers, Internet applications and cloud services over a wide geographical range. The application scenarios in the embodiments of the present application appear in the SDWAN network environment, but are not limited to the SDWAN network.

[0053] Point-of-Presence (PoP) is located outside the edge of the enterprise network and is the entry point to the enterprise network. Services provided by the outside world enter through the PoP point.

[0054] Customer Premise Equipment (CPE) is a new type of access device that can receive wireless signals from wireless routers / wireless APs / wireless base stations. CPE can obtain mobile network by inserting a card like a mobile phone, directly act as a wired network interface or convert it into Wi-Fi signals, providing device connections in scenarios such as home or office.

[0055] Next, the technical background of the present application is described.

[0056] In the WAN, the same user has two or more branches connected to the SDWAN network through CPE devices. It is necessary to plan different private network address segments for the LAN side of different CPEs to achieve communication between user terminal devices corresponding to different CPE devices.

[0057] In the related art, in order to avoid routing conflicts or address conflicts when the LAN side devices of CPE communicate with each other, a large Layer 2 network is constructed based on the LAN side of the local device and the LAN side of the opposite device, which is equivalent to establishing a communication tunnel between the two devices based on the IP addresses and port numbers of the two devices to achieve communication between the devices. However, when the IP addresses of the devices are the same, the LAN side devices at both ends cannot access each other.

[0058] Based on the above problems, bidirectional network address translation technology (bidirectional NAT) can be used to maintain a public address pool through the CPE gateway device of the local area network. The public address pool includes multiple public addresses. In this way, when receiving an access request from the local device, all public addresses in the public address pool can be traversed, and an idle public address can be arbitrarily selected. The private address of the local device is converted according to the selected public address, so that the local device can access the opposite device. At the same time, the CPE device also needs to maintain the mapping relationship between the private address and the public address of the local device, so that when receiving the access response of the opposite device, based on the above mapping relationship, the public destination address of the access response is converted into a private address, and then the local device is located to realize the communication interaction between the local device and the opposite device. And when the local device and the opposite device are disconnected from communication, the public address in the mapping relationship is recycled. In summary, the bidirectional NAT technology has the following shortcomings:

[0059] (1) Increased complexity. Bidirectional NAT requires more complex configuration management of inbound and outbound network traffic. This increased complexity may lead to configuration errors and increase the difficulty of network management.

[0060] (2) Performance impact. Performing bidirectional NAT operations involves performing address translation on each data packet passing through the gateway. This process consumes additional CPU resources and memory, and may affect the performance of network devices, especially in high-traffic environments.

[0061] (3) Difficulty in tracking and log analysis. Since the source IP address is replaced, it becomes more difficult for network administrators to track network traffic and perform troubleshooting. In addition, log records may not directly reflect the real IP address of the internal host, affecting security monitoring and analysis.

[0062] (4) Address translation table capacity limit. Each device that performs NAT maintains an address translation table (NATTable) to track and manage ongoing connections. In the case of high traffic, this table may reach its capacity limit, affecting the establishment of new connections.

[0063] (5) NAT traversal problem. In scenarios where internal network resources need to be accessed from the Internet, bidirectional NAT requires additional configuration to implement NAT traversal, which may increase the complexity of the configuration and introduce additional security considerations.

[0064] In summary, in the related art, when implementing cross-domain communication, it is necessary to maintain a public address pool and an address conversion table, which makes the device address conversion speed slow, resulting in low cross-domain communication efficiency. Based on this, the embodiment of the present application provides a cross-domain communication method, through the one-to-one mapping relationship between the private address and the public address of the terminal device, the private address or the shared address of the device is linearly converted, avoiding traversing the public address pool, improving the address conversion efficiency, and thus improving the communication efficiency.

[0065] Before describing the technical solution of the embodiment of the present application, the application scenario of the embodiment of the present application is described first.

[0066] The cross-domain communication method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the first device and the second device may be gateway devices of two local area networks, communicating through an entry point. Figure 1 In the example, the first device may correspond to multiple terminal devices ( Figure 1 Taking three as an example), the second device can correspond to multiple terminal devices ( Figure 1 Taking three as an example), communication between any terminal device corresponding to the first device and any terminal device corresponding to the second device is achieved through a communication path constructed based on the first device, the POP, and the second device.

[0067] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0068] In an exemplary embodiment, Figure 2 As shown, a cross-domain communication method is provided, which is applied to a first device; the method includes:

[0069] S201, receiving a first access request sent by a terminal device corresponding to a first device; the first access request includes a first private source address and a first public destination address.

[0070] The terminal device is any user device in the local area network to which the first device belongs, including but not limited to mobile phones, smart phones, tablet computers, IoT devices and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc.

[0071] In a cross-LAN communication scenario, the terminal device corresponding to the first device needs to access the terminal devices in other LANs through the first device when the public destination address of the terminal devices in other LANs is clear. In the embodiment of the present application, the first device is an access requester, which is used to send the first access request sent by the terminal device corresponding to the first device to the second device, and the second device is a gateway device corresponding to the terminal device matching the first access request.

[0072] The first access request includes a first private source address and a first public destination address, wherein the first private source address refers to the private address of the local device (the terminal device corresponding to the first device), and the first public destination address refers to the public address of the opposite device (the terminal device corresponding to the second device).

[0073] S202, converting the first private source address in the first access request into a first public source address according to a preset relationship to obtain an update access request; wherein, in the preset relationship, there is a one-to-one correspondence between the private address and the public address of the terminal device corresponding to the first device.

[0074] The local area network to which the first device belongs includes multiple terminal devices. The preset relationship refers to the mapping relationship between the private address and the public address of each terminal device in the first device. In addition, in an embodiment of the present application, the private address of each terminal device is mapped one-to-one with the public address.

[0075] The first device searches for a mapping relationship corresponding to the first private source address in a preset relationship of the first device, then determines the public address corresponding to the first private source address as the first public source address, and replaces the first private source address in the first access request with the first public source address to obtain an update access request. In other words, the update access request includes the first public source address and the first public destination address.

[0076] S203, sending an update access request to the second device; the update access request is used to instruct the second device to convert the first public destination address to the first private destination address, and send the updated access request after the address conversion to the terminal device corresponding to the first private destination address.

[0077] After the second device receives the update access request, based on the one-to-one correspondence between the private address and the public address of each terminal device in the second device, the first public destination address in the update access request is converted into a first private target address, and the update access request after the address conversion is obtained, and the target terminal device corresponding to the first private target address is queried among the multiple terminal devices corresponding to the second device, and the update access request after the address conversion is sent to the target terminal device.

[0078] To summarize the above content, taking the terminal device corresponding to the first device as the local device and the terminal device corresponding to the second device as the opposite device as an example, the processing process and flow nodes of the first access request are explained: the local device sends a first access request to the first device, and the first access request includes the first private source address of the local device and the first public destination address of the opposite device; then, the first device converts the first private source address of the local device into the first public source address, obtains an update access request, and sends it to the second device, and the update access request includes the first public source address of the local device and the first public destination address of the opposite device; then, the second device converts the first public destination address of the opposite device in the update access request into the first private destination address, obtains the update access request after the address conversion, and sends it to the opposite device.

[0079] In an embodiment of the present application, a first device receives a first access request sent by a terminal device corresponding to the first device, and converts the first private source address in the first access request into a first public source address according to a preset relationship, obtains an update access request, and then sends the update access request to a second device. The first access request includes a first private source address and a first public destination address, and there is a one-to-one correspondence between the private address and the public address of the terminal device corresponding to the first device in the preset relationship. The update access request is used to instruct the second device to convert the first public destination address into the first private destination address, and send the updated access request after the address conversion to the terminal device corresponding to the first private destination address. In this method, when the first device converts the first private source address in the first access request into the first public source address, the conversion operation can be performed directly according to the preset one-to-one correspondence between the private address and the public address of the terminal device in the first device. The conversion basis is clear and reliable, the conversion logic is simple and easy to implement, and the speed at which the first device obtains the update access request can be improved. Furthermore, when the second device converts the first public destination address in the update access request into the first private destination address, the conversion operation can also be performed according to the preset one-to-one correspondence between the private address and the public address of the terminal device corresponding to the second device, so as to quickly obtain the first private destination address and accurately and quickly locate the terminal device corresponding to the first private address, thereby improving the speed at which the terminal device of the first device accesses the terminal device of the second device and improving communication efficiency.

[0080] In an exemplary embodiment, Figure 3 As shown, Figure 3 A schematic diagram of a path for sending an access request to a first device. Figure 3In the embodiment, the first device includes a local area network interface, a source address translation (SNAT) module and a wide area network interface. The local area network interface is a communication interface between a terminal device corresponding to the first device and the first device, and serves as an entry of the source address translation module. The wide area network interface is a communication interface between the first device and the second device, and serves as an exit of the source address translation module (SNAT).

[0081] In an exemplary embodiment, receiving a first access request sent by a terminal device corresponding to a first device includes: receiving the access request through a local area network interface of the first device, and sending the access request to a source address translation module of the first device.

[0082] Correspondingly, the first private source address in the first access request is converted into the first public source address according to the preset relationship to obtain an update access request, including: converting the first private source address in the first access request into the first public source address through a source address conversion module to obtain an update access request.

[0083] Correspondingly, sending an update access request to the second device includes: receiving the update access request sent by the source address translation module through the wide area network interface of the first device, and sending the update access request to the second device.

[0084] Figure 3 In the embodiment, the terminal device corresponding to the first device is taken as the local device and the terminal device corresponding to the second device is taken as the opposite device as an example to explain the processing process and flow nodes of the first access request: the local device sends a first access request to the first device through the local area network interface of the first device, and the first access request includes the first private source address of the local device and the first public destination address of the opposite device; then, the local area network interface of the first device sends the first access request to the source address conversion module of the first device; then, the source address conversion module of the first device replaces the first private source address in the first access request with the first public source address, obtains an update access request, and sends the update access request to the wide area network interface of the first device; finally, the wide area network interface of the first device determines the second device to the first public destination address based on the update access request, and sends the update access request to the second device.

[0085] In the embodiment of the present application, a first access request is received through the LAN interface of the first device, and the first access request is sent to the source address conversion module of the first device; the first private source address in the first access request is converted into a first public source address through the source address conversion module to obtain an update access request; the update access request sent by the source address conversion module is received through the WAN interface of the first device, and the update access request is sent to the second device. This is equivalent to constructing an access request sending path based on the LAN interface, the source address conversion module and the WAN interface. In the process of transmitting the access request on this path, the private address of the terminal device corresponding to the first device is converted into a public address through the source address conversion module, so that the terminal device corresponding to the first device can smoothly access the public network and realize cross-domain communication.

[0086] The above embodiment describes the implementation method of the first device sending the first access request to the second device. Next, the implementation method of the first device receiving the first access response returned by the second device is described. In an exemplary embodiment, Figure 4 As shown, the method also includes:

[0087] S401, receiving a first access response sent by a second device; the first access response includes a public source address and a public destination address.

[0088] It should be noted that, in the scenario where the first device sends an access request, the first device is the sender, the terminal device corresponding to the first device is the local end, the second device is the receiver, and the terminal device corresponding to the second device is the peer end. In the scenario where the first device receives an access response, the first device is the receiver, and the second device is the sender.

[0089] For the terminal device corresponding to the second device, an initial access response is generated after receiving the update access request after address conversion. The initial access response sent by the terminal device corresponding to the second device to the second device includes: the private address of the terminal device corresponding to the second device (that is, the private source address) and the public address of the terminal device corresponding to the first device (that is, the public destination address).

[0090] For the second device, after the second device receives the initial access response, according to the one-to-one mapping relationship between the private addresses and public addresses of each terminal device in the second device, the private address of the terminal device corresponding to the second device (that is, the private source address) is converted into the public address of the terminal device corresponding to the second device (that is, the public source address), and the first access response is obtained.

[0091] For the first device, the first device receives a first access response sent by the second device through an entry point. The public source address in the first access response is the public destination address in the update access request, and the public destination address in the first access response is the public source address in the update access request.

[0092] S402: Convert the public destination address in the first access response into a private destination address according to a preset relationship, and send the first access response after the address conversion to a terminal device corresponding to the private destination address.

[0093] It should be emphasized that in the communication scenario provided in the embodiment of the present application, the preset relationship maintained in the first device includes a one-to-one mapping relationship between the private address and the public address of each terminal device in the first device, and the preset relationship is a static relationship. Similarly, the preset relationship maintained by the second device includes a one-to-one mapping relationship between the private address and the public address of each terminal device in the second device, and the preset relationship is a static relationship.

[0094] After receiving the first access response, the first device queries the mapping relationship corresponding to the public destination address in the first access response in the preset relationship, and determines the private destination address corresponding to the public destination address in the mapping relationship; then replaces the public destination address with the private destination address, obtains the first access response after address conversion, and locates the terminal device in the private destination address; finally, sends the first access response after address conversion to the terminal device in the private destination address, thereby completing the communication interaction process between the first device and the second device.

[0095] In an embodiment of the present application, a first device receives a first access response sent by a second device, and the first access response includes a public source address and a public destination address. The public destination address in the first access response is converted into a private destination address by utilizing the preset relationship of one-to-one mapping between the public address and the private address in the preset relationship again, so as to connect the first access response from the wide area network to the local area network of the first device, and then send the first access response after the address conversion to the terminal device corresponding to the private destination address, so as to realize cross-domain communication between the terminal device corresponding to the first device and the terminal device corresponding to the second device.

[0096] In an exemplary embodiment, Figure 5 As shown, Figure 5 A schematic diagram of a path for a first device to receive an access response. Figure 5 In the embodiment, the first device includes a local area network interface, a destination address translation (DNAT) module and a wide area network interface. The wide area network interface is a communication interface between the first device and the second device, and is the entry of the destination address translation module. The local area network interface is a communication interface between the terminal device corresponding to the first device and the first device, and is the exit of the destination address translation module.

[0097] In an exemplary embodiment, receiving a first access response sent by a second device includes: receiving the first access response through a wide area network interface of the first device, and sending the first access response to a destination address translation module of the first device.

[0098] Correspondingly, the public destination address in the first access response is converted into a private destination address according to a preset relationship, and the first access response after address conversion is sent to a terminal device corresponding to the private destination address, including: converting the public destination address in the first access response into a private destination address according to a preset relationship by a destination address conversion module of the first device, receiving the updated first access response through the local area network interface of the first device, and sending the updated first access response to the terminal device corresponding to the private destination address.

[0099] In an embodiment of the present application, the processing process and flow nodes of the first access response are as follows: the wide area network interface of the first device receives the first access response sent by the wide area network interface of the second device, then the wide area network interface of the first device sends the first access response to the destination address conversion module of the first device, the destination address conversion module of the first device replaces the public destination address in the first access response with a private destination address, obtains an updated access response, and sends the updated access response to the local area network interface of the first device, and the local area network interface of the first device sends the updated access response to the terminal device corresponding to the private destination address.

[0100] In the embodiment of the present application, the first access response is received through the wide area network interface of the first device, and the first access response is sent to the destination address conversion module of the first device; the public destination address in the first access response is converted into a private destination address according to a preset relationship through the destination address conversion module of the first device, and the updated first access response is received through the wide area network interface of the first device, and the updated first access response is sent to the terminal device corresponding to the private destination address. This is equivalent to constructing an access response receiving path based on the local area network interface, the destination address conversion module and the wide area network interface. In the process of transmitting the access response on this path, the public destination address is converted into a private destination address through the destination address conversion module, so that the first device can accurately locate the recipient of the access response and complete the communication closed loop of the access request and response between devices.

[0101] Based on the implementation of the aforementioned embodiment for sending an access request to the first device and receiving an access response, taking the first device as CPE1, the second device as CPE2, and the terminal device 1 corresponding to the first device and the terminal device 2 corresponding to the second device performing cross-domain access as an example, a specific embodiment of communication between the first device and the second device is provided, such as Figure 6 As shown, the following steps are included:

[0102] (1) PC1 sends an ICMP request message to the public IP (40.0.0.2) mapped to PC1'.

[0103] (2) The LAN-side physical network card of CPE1 receives the ICMP request message.

[0104] (3) The physical network card on the LAN side of CPE1 sends the ICMP request to the data plane development kit (DPDK) packet receiving and sending module of the CPE1 system.

[0105] (4) The DPDK of the CPE1 system sends the received ICMP request to the communication protocol processing module, such as the EtherNet / IP processing module.

[0106] Among them, the ETH / IP processing module is a communication module used in the field of industrial automation, mainly used to realize data exchange and communication between devices. It is based on the EtherNet / IP protocol.

[0107] (5) After processing, the ETH&IP module of the CPE1 system searches for a route and sends the ICMP request to SNAT for processing.

[0108] (6) After SNAT processing is completed, the source address of the icmp request is converted from 192.168.1.2 to 20.0.0.2.

[0109] (7) After SNAT processing is completed, the ICMP request is sent to the ETH&IP module to encapsulate the second and third layer message headers, and then sent to DPDK.

[0110] (8) DPDK sends the message to the physical network card WAN of CPE1 and then to the POP.

[0111] (9) POP sends the ICMP request to the physical network card WAN of CPE2 through routing lookup.

[0112] (10) The physical network card WAN of CPE2 receives the ICMP request and sends it to the DPDK module of the CPE2 system.

[0113] (11) The DPDK module of the CPE2 system sends the ICMP request to the ETH&IP module.

[0114] (12) The ETH&IP module of the CPE2 system sends the ICMP request to the DNAT module of CPE2 for table lookup processing.

[0115] (13) The DNAT of the CPE2 system finds the corresponding address mapping table, converts the destination address 40.0.0.2 of the icmp request to 192.168.1.2, and then searches for the route.

[0116] (14) After the routing module of the CPE2 system finds the routing table, it sends the icmprequest with the destination address of 192.168.1.2 to the ETH&IP module for processing.

[0117] (15) The ETH&IP module of the CPE2 system encapsulates the layer 2 and layer 3 headers and sends the ICMP request to the DPDK module.

[0118] (16) The DPDK module of the CPE2 system sends the icmp request to the physical network card LAN and then sends it to PC1'.

[0119] Figure 6 The black solid line in represents the transmission path for the terminal device 1 to send a message to the terminal device 1 ′.

[0120] (17) PC1' receives an ICMP request with a source address of 20.0.0.2 and a destination address of 192.168.1.2. The local operating system determines that it is a valid ICMP request and sends an ICMP reply.

[0121] (18) The physical network card LAN of CPE2 receives an ICMP reply message with a destination address of 20.0.0.2 and a source address of 192.168.1.2, and sends it to the DPDK module of the CPE2 system.

[0122] (19) The DPDK module of the CPE2 system sends the icmp reply to the ETH&IP module.

[0123] (20) After the ETH&IP module of the CPE2 system completes the processing, it searches the routing table corresponding to the destination address of the message.

[0124] (21) After the CPE2 system finds the route, it sends the icmp reply to the SNAT module of CPE2 for processing.

[0125] (22) The SNAT of the CPE2 system changes the source address of the icmp reply to the corresponding 40.0.0.2 and sends it to the ETH&IP module for processing.

[0126] (23) The ETH&IP module of the CPE2 system encapsulates the layer 2 and layer 3 headers and sends the message to the DPDK module of the CPE2 system.

[0127] (24) The DPDK of the CPE2 system sends the message to the physical network card WAN of CPE2 and sends it to the POP

[0128] (25) POP sends the icmp reply to the physical network card WAN of CPE1 through routing lookup.

[0129] (26) CPE1's physical network card WAN receives the icmp reply and sends it to the DPDK module of the CPE1 system.

[0130] (27) The DPDK module of the CPE1 system sends the icmp reply to the ETH&IP module of the CPE1 system.

[0131] (28) The ETH&IP module of the CPE1 system sends the icmp reply to the DNAT module of CPE1 for table lookup.

[0132] (29) The DNAT of the CPE1 system finds the corresponding address mapping table, converts the destination address 20.0.0.2 of the icmp reply to 192.168.1.2, and then searches for the route.

[0133] (30) After the routing module of the CPE1 system finds the routing table, it sends the icmpreply with the destination address of 192.168.1.2 to the ETH&IP module of the CPE1 system for processing.

[0134] (31) The ETH&IP module of the CPE1 system encapsulates the layer 2 and layer 3 headers and sends the ICMP reply to the DPDK module.

[0135] (32) The DPDK module of the CPE1 system sends the icmp reply to the physical network card LAN of CPE1 and sends it to PC1.

[0136] (33) PC1 receives an icmp reply with a source address of 40.0.0.2 and a destination address of 192.168.1.2. The local operating system determines that it is a legal icmp reply, and the entire process ends here.

[0137] Figure 6 The black dotted line in represents the transmission path for the terminal device 1' to return the message response to the terminal device 1.

[0138] In the embodiment of the present application, in the scenario where there is a need for mutual access between LAN-side devices of cross-domain CPE, a networking method based on three-layer NAT technology is proposed to support mutual access between devices with the same IP address on the LAN side at both ends. Moreover, compared with the need for dynamic maintenance of the mapping relationship between the address pool, private address and public address in the bidirectional NAT technology, the CPE device in the embodiment of the present application only needs to maintain the one-to-one mapping relationship between the private address and the public address of the terminal device in the local area network to which it belongs, which can greatly reduce the maintenance cost. At the same time, the one-to-one address mapping relationship can enable the CPE device to complete the address conversion more quickly and accurately, improve the address conversion efficiency, and thus improve the cross-domain access efficiency of the device. In summary, based on the communication method provided in the embodiment of the present application, it not only supports mutual access between LAN-side devices of cross-domain CPE, but also does not rely on Layer 2 tunnels for networking, shielding a series of problems caused by the introduction of Layer 2 networking, such as the limitation that the private addresses of the terminal devices on both sides need to be different.

[0139] The above-mentioned embodiment has described in detail the implementation manner of the first device sending the access request and receiving the access response. Next, the implementation manner of the first device receiving the access request and sending the access response is described through two embodiments.

[0140] In an exemplary embodiment, Figure 7 As shown, the method also includes:

[0141] S701, receiving a second access request sent by a third device, where the second access request includes a second public source address and a second public target address.

[0142] Similar to the scenario where the first device receives an access response, in the scenario where the first device receives an access request, the first device is the receiver and the third device is the sender. The third device may be the second device mentioned in the aforementioned embodiment, or may be a gateway device in another local area network different from the local area network to which the first device belongs.

[0143] Optionally, the first device receives a second access request sent by the third device through the wide area network interface, and obtains the public source address (second public source address) of the sender's device (the terminal device corresponding to the third device) and the public target address (second public target address) of the receiver's device (the terminal device corresponding to the first device).

[0144] S702: Convert the second public destination address in the second access request into a second private destination address according to a preset relationship, and send the second access request after the address conversion to a terminal device corresponding to the second private destination address.

[0145] After receiving the second access request, the first device queries the mapping relationship corresponding to the second public destination address in the second access request in the preset relationship, and determines the second private destination address corresponding to the second public destination address in the mapping relationship; then replaces the second public destination address with the second private destination address to obtain the second access request after address conversion, and locates the terminal device in the second private destination address; finally, sends the second access request after address conversion to the terminal device in the private destination address, so as to realize one-way access of the terminal device corresponding to the third device to the terminal device corresponding to the first device.

[0146] Optionally, the first device receives a second access request transmitted from the wide area network interface in the first device through a destination conversion address module, and converts the second public destination address in the second access request into a second private destination address, and then sends the updated second access request to a terminal device matching the second private destination address through the local area network interface of the first device.

[0147] Obtain the public source address (second public source address) of the sender's device (the terminal device corresponding to the third device) and the public target address (second public target address) of the receiver's device (the terminal device corresponding to the first device).

[0148] In an embodiment of the present application, a first device receives a second access request sent by a third device, and converts a second public destination address in the second access request into a second private destination address according to a preset relationship, so as to access the first access response from the wide area network to the local area network of the first device, and then sends the second access request after the address conversion to the terminal device corresponding to the second private destination address, thereby realizing one-way access from the terminal device of the third device to the terminal device of the first device.

[0149] In an exemplary embodiment, Figure 8 As shown, the method also includes:

[0150] S801, receiving a second access response sent by a terminal device corresponding to a second private destination address; the second access response includes a private source address and a public destination address.

[0151] The terminal device corresponding to the second private destination address is a user device in the local area network to which the first device belongs. After the first device sends the second access request to the terminal device, the terminal device corresponding to the second private destination address can verify the legitimacy of the second access request, and if the verification passes, send a second access response to the first device.

[0152] Optionally, the first device receives the second access response through the local area network interface of the first device, and returns the second access response to the third device through the source address translation module and the wide area network interface in the first device.

[0153] It should be noted that in the scenario where the first device forwards the access response, the private source address in the second access response refers to the private address of the terminal device corresponding to the first device, and the public destination address in the second access response refers to the public address of the terminal device receiving the access response.

[0154] S802: Convert the private source address in the second access response into a public source address according to a preset relationship, and send the second access response after the address conversion to the third device.

[0155] The first device queries the mapping relationship corresponding to the private source address in the second access response in the preset relationship of the first device, and then replaces the private source address in the second access response with the public source address corresponding to the private source address to obtain the second access response after address conversion.

[0156] Optionally, the first device converts the private source address in the second access response through the source address conversion module in the first device, and then sends the second access response after address conversion to the third device through the wide area network interface in the first device, so as to instruct the third device to convert the public destination address in the second access response after address conversion into a private destination address, and send the second access response to the terminal device corresponding to the private destination address.

[0157] In an embodiment of the present application, a first device receives a second access response sent by a terminal device corresponding to a second private destination address, the second access response including a private source address and a public destination address; the private source address in the second access response is converted into a public source address according to a preset relationship, and the second access response after the address conversion is sent to a third device, thereby completing a closed loop of cross-domain communication interaction between the first device and the third device.

[0158] Based on the implementation of the first device receiving the access request and sending the access response in the above embodiments, taking the first device as CPE1 and the third device as CPE2 as an example, a specific embodiment of communication between the first device and the third device is provided, such as Fig. 9 As shown, the following steps are included:

[0159] S901, CPE2 receives an initial access request sent by a second terminal device.

[0160] The initial access request includes the private source address of the second terminal device and the public destination address of the first terminal device.

[0161] S902, CPE2 converts the private source address of the second terminal device in the initial access request into a public source address to obtain an update access request.

[0162] S903, CPE2 sends an update access request to CPE1.

[0163] S904, CPE1 converts the public destination address in the update access request into a private destination address.

[0164] S905, CPE1 sends an update access request to the first terminal device corresponding to the private destination address.

[0165] S906, CPE1 receives an initial access response sent by the first terminal device.

[0166] The initial access response includes the private source address of the first terminal device and the public destination address of the second terminal device.

[0167] S907, CPE1 converts the private source address of the first terminal device in the initial access response into a public source address, and obtains an updated access response.

[0168] S908, CPE1 sends an update access response to CPE2.

[0169] S909, CPE2 converts the public destination address in the update access response into a private destination address.

[0170] S910, CPE2 sends an update access response to the second terminal device corresponding to the private destination address.

[0171] In the embodiment of the present application, the LAN port of the CPE implements SNAT, and maps the address pool according to the number of devices on the LAN side and the one-to-one mapping of the intranet address on the LAN side; the WAN port of the CPE implements DNAT, and maps the address pool according to the number of devices on the LAN side and the one-to-one mapping of the intranet address on the LAN side. Compared with the traditional SNAT method of mapping the port address plus the port number as different source addresses on the LAN side and the traditional DNAT method of mapping the intranet address plus the port number as different destination addresses on the WAN side, the mapping information in the embodiment of the present application is simpler and more convenient for operation and maintenance and search.

[0172] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0173] Based on the same inventive concept, the embodiment of the present application also provides a cross-domain communication device for implementing the cross-domain communication method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more cross-domain communication device embodiments provided below can refer to the above limitations on the cross-domain communication method, which will not be repeated here.

[0174] In an exemplary embodiment, Fig.10 As shown, a cross-domain communication device is provided, including: a request receiving module 1001, an address conversion module 1002 and a request sending module 1003, wherein:

[0175] The request receiving module 1001 is used to receive a first access request sent by a terminal device corresponding to the first device; the first access request includes a first private source address and a first public destination address;

[0176] An address conversion module 1002 is used to convert the first private source address in the first access request into a first public source address according to a preset relationship to obtain an update access request; wherein the private address and the public address of the terminal device corresponding to the first device in the preset relationship correspond one to one;

[0177] The request sending module 1003 is used to send an update access request to the second device; the update access request is used to instruct the second device to convert the first public destination address into a first private destination address, and send the updated access request after the address conversion to the terminal device corresponding to the first private destination address.

[0178] In an exemplary embodiment, the request receiving module 1001 is further configured to receive an access request through a local area network interface of the first device, and send the access request to a source address translation module of the first device;

[0179] The address conversion module 1002 is further used to convert the first private source address in the first access request into a first public source address through the source address conversion module to obtain an update access request;

[0180] The request sending module 1003 is further configured to receive the update access request sent by the source address translation module through the wide area network interface of the first device, and send the update access request to the second device.

[0181] In an exemplary embodiment, the cross-domain communication device further includes a response receiving module and a response sending module, wherein:

[0182] A response receiving module, configured to receive a first access response sent by the second device; the first access response includes a public source address and a public destination address;

[0183] The response sending module is used to convert the public destination address in the first access response into a private destination address according to a preset relationship, and send the first access response after the address conversion to the terminal device corresponding to the private destination address.

[0184] In an exemplary embodiment, the response receiving module is also used to receive the first access response through the wide area network interface of the first device, and send the first access response to the destination address conversion module of the first device; the response sending module is also used to convert the public destination address in the first access response into a private destination address according to a preset relationship through the destination address conversion module of the first device, and receive the updated first access response through the local area network interface of the first device, and send the updated first access response to the terminal device corresponding to the private destination address.

[0185] In an exemplary embodiment, the cross-domain communication device further includes: an access receiving module and an access responding module, wherein:

[0186] An access receiving module, configured to receive a second access request sent by a third device, wherein the second access request includes a second public source address and a second public target address;

[0187] The access response module is used to convert the second public destination address in the second access request into a second private destination address according to a preset relationship, and send the second access request after the address conversion to the terminal device corresponding to the second private destination address.

[0188] In an exemplary embodiment, the cross-domain communication device further includes: a response acquisition module and a response forwarding module, wherein:

[0189] A response acquisition module, configured to receive a second access response sent by a terminal device corresponding to a second private destination address; the second access response includes a private source address and a public destination address;

[0190] The response forwarding module is used to convert the private source address in the second access response into a public source address according to a preset relationship, and send the second access response after the address conversion to the third device.

[0191] Each module in the above cross-domain communication device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0192] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig.11As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store cross-domain communication data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a cross-domain communication method is implemented.

[0193] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0194] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0195] In an exemplary embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0196] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0197] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0198] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0199] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0200] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A cross-domain communication method, characterized in that: Applied to a first device; the method comprises: Receiving a first access request sent by a terminal device corresponding to the first device; the first access request includes a first private source address and a first public destination address; Converting the first private source address in the first access request into a first public source address according to a preset relationship to obtain an update access request; wherein the private address and the public address of the terminal device corresponding to the first device in the preset relationship correspond one to one; The update access request is sent to the second device; the update access request is used to instruct the second device to convert the first public destination address into a first private destination address, and send the update access request after the address conversion to the terminal device corresponding to the first private destination address.

2. The method according to claim 1, characterized in that The receiving a first access request sent by a terminal device corresponding to the first device includes: receiving the access request through the local area network interface of the first device, and sending the access request to a source address translation module of the first device; The converting the first private source address in the first access request into a first public source address according to the preset relationship to obtain an update access request includes: Converting the first private source address in the first access request into the first public source address by the source address conversion module to obtain the update access request; The sending the update access request to the second device includes: The update access request sent by the source address translation module is received through the wide area network interface of the first device, and the update access request is sent to the second device.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: receiving a first access response sent by the second device; the first access response including a public source address and a public destination address; The public destination address in the first access response is converted into a private destination address according to the preset relationship, and the first access response after the address conversion is sent to the terminal device corresponding to the private destination address.

4. The method according to claim 3, characterized in that The receiving a first access response sent by the second device includes: receiving the first access response through the wide area network interface of the first device, and sending the first access response to a destination address translation module of the first device; The converting the public destination address in the first access response into a private destination address according to the preset relationship, and sending the first access response after the address conversion to a terminal device corresponding to the private destination address, includes: The destination address conversion module of the first device converts the public destination address in the first access response into the private destination address according to the preset relationship, receives the updated first access response through the local area network interface of the first device, and sends the updated first access response to the terminal device corresponding to the private destination address.

5. The method according to claim 1 or 2, characterized in that: The method further comprises: receiving a second access request sent by a third device, wherein the second access request includes a second public source address and a second public target address; The second public destination address in the second access request is converted into a second private destination address according to the preset relationship, and the second access request after the address conversion is sent to the terminal device corresponding to the second private destination address.

6. The method according to claim 5, characterized in that The method further comprises: Receiving a second access response sent by a terminal device corresponding to the second private destination address; the second access response includes a private source address and a public destination address; The private source address in the second access response is converted into a public source address according to the preset relationship, and the second access response after the address conversion is sent to the third device.

7. A cross-domain communication device, characterized in that: The device comprises: A request receiving module, configured to receive a first access request sent by a terminal device corresponding to a first device; the first access request includes a first private source address and a first public destination address; An address conversion module, configured to convert the first private source address in the first access request into a first public source address according to a preset relationship, to obtain an update access request; wherein the private address and the public address of the terminal device corresponding to the first device in the preset relationship correspond one to one; A request sending module is used to send the update access request to the second device; the update access request is used to instruct the second device to convert the first public destination address into a first private destination address, and send the update access request after the address conversion to the terminal device corresponding to the first private destination address.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images