Network address translation (NAT) traversal method, device and system

Abstract

The invention provides an NAT (Network Address Translation) traversal method, which is applied to a first terminal in a system, the system further comprises a second terminal, specifically, the first terminal is accessed to a network through a first NAT device, the second terminal is accessed to the network through a second NAT device, the first terminal acquires an IP (Internet Protocol) address of the second terminal in the network, and the second terminal acquires the IP address of the second terminal in the network; and then determining a destination port number of each detection message according to the sending sequence of the plurality of detection messages, and sending the plurality of detection messages through the first NAT device. The destination port numbers of the detection messages are determined according to the sending sequence of the detection messages, so that the NAT traversal success rate is improved on the premise of reducing the packet sending number of the detection messages.

Description

A method, device and system for network address translation NAT traversal

[0001] This application claims priority to the Russian Federation patent application filed with the Russian Federal Patent Office on July 29, 2022, with application number 2022120865 and application name “A method, device and system for network address translation NAT traversal”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application relates to network address translation technology in the field of communications, and in particular to a method, device and system for NAT traversal. Background Art

[0003] Network address translation (NAT) traversal is a crucial technology for real-time peer-to-peer (P2P) audio and video. NAT traversal enables direct communication between clients, reducing end-to-end latency and significantly alleviating server pressure and costs.

[0004] NAT technology refers to the technology of converting internal network addresses into external network addresses. This technology not only solves the problem of insufficient Internet protocol addresses (IP), but also effectively avoids attacks from outside the network and hides and protects terminals within the network.

[0005] NAT primarily maps addresses by modifying the source and destination addresses of data packets. Establishing peer-to-peer communication between end devices on a network constructed by two different NAT gateways requires NAT traversal. Currently, NAT traversal is implemented based on a birthday attack algorithm, where both parties send a large number of random probe packets to each other. This large number of packets triggers flow control, significantly reducing the success rate of NAT traversal. Therefore, improving the success rate of NAT traversal is a pressing issue.

[0006] Summary of the Invention

[0007] The present application provides a method, device and system for NAT traversal, which can improve the success rate of NAT traversal while reducing the number of detection messages sent.

[0008] In the first aspect, a method for NAT traversal is provided. The method can be executed by a first terminal, or can also be executed by a component of the first terminal (such as a chip or circuit). There is no limitation on this. For the sake of ease of description, the following is explained using the execution by the first terminal as an example.

[0009] Specifically, the method is applied to a first terminal in a communication system, the communication system also including a second terminal communicating with the first terminal, the first terminal accessing a network through a first NAT device, the second terminal accessing the network through a second NAT device, the first NAT device being different from the second NAT device, the NAT traversal method comprising:

[0010] The first terminal obtains the IP address of the second terminal within the network; the first terminal determines a destination port number of each of the plurality of probe messages based on a sending order of the plurality of probe messages; and the first terminal sends the plurality of probe messages through the first NAT device, where the destination address of each probe message includes a corresponding destination port number and an IP address. The available port number of the second NAT device may be a port number range commonly used by NATs in the industry.

[0011] Based on the above technical solution, the first terminal can obtain the IP address of the second terminal in the network (that is, the external IP address of the second terminal, or the public IP address of the second terminal). To establish P2P communication between the first terminal and the second terminal, NAT traversal is required, that is, the first terminal needs to traverse NAT by sending a detection message.

[0012] In this technical solution, when the first terminal determines the destination port number of each of the multiple probe messages to be sent, it determines it based on the sending order of the multiple probe messages, rather than randomly selecting a port number from the available port numbers of the second NAT device as the destination port number of a certain probe message. Since the port number allocation rule of the NAT device is not necessarily random, most NAT devices will follow a certain hash rule to allocate ports. Then, when sending a probe message, the destination port number of the probe message is determined by a certain rule, which may match or be close to the rule of the NAT device to allocate ports. Compared with randomly selecting a port number from the available port numbers of the second NAT device, the success rate of NAT traversal can be improved while reducing the number of probe messages sent. Because if a port number is randomly selected as the destination port number of the probe message, a large number of probe messages may need to be sent during the NAT traversal process, and the sending of a large number of probe messages may trigger firewall flow control, resulting in a significant reduction in the success rate of NAT traversal.

[0013] In combination with the first aspect, in certain implementations of the first aspect, before the first terminal determines the destination port number of each probe message in the multiple probe messages based on the sending order of the multiple probe messages, the method also includes: for any probe message in the multiple probe messages, the first terminal determines the port number corresponding to the probe message (hereinafter referred to as the second port number corresponding to the probe message) from the available port numbers of the second NAT device based on the sending order of the probe message in the multiple probe messages, and the second port number corresponding to the probe message is used to determine the destination port number of the probe message.

[0014] Based on the above technical solution, before determining the destination port number of the probe message, the first terminal determines the second port number corresponding to the probe message from the available port numbers of the second NAT device. That is to say, the destination port number of the probe message determined based on the second port number corresponding to the probe message is a port number related to the available port number of the second NAT device, and is most likely one of the available port numbers of the second NAT device, in order to increase the probability of successful NAT traversal.

[0015] In combination with the first aspect, in certain implementations of the first aspect, the first terminal determines the second port number corresponding to the probe message from the available port numbers of the second NAT device based on the sending order of the probe message among the multiple probe messages, including: the first terminal determines the binary tree depth corresponding to the probe message on the binary tree based on the sending order of the probe message among the multiple probe messages, the nodes of the binary tree including the available port numbers of the second NAT device; the first terminal determines the second port number corresponding to the probe message based on the binary tree depth corresponding to the probe message.

[0016] Based on the above technical solution, the first terminal can determine the destination port number of the probe message according to the binary tree algorithm, wherein the sending order of each probe message determines the depth of the destination port number of the probe message in the binary tree. That is to say, the sending order of the probe message and the depth of the binary tree can be associated in this technical solution to facilitate the determination of the destination port number of the probe message based on the binary tree algorithm, that is, the destination port number of the probe message is determined under the constraint of the binary tree algorithm. In the case where the NAT device allocates ports according to a certain hash rule, the hash rule may be similar to the binary tree constraint, thereby improving the success rate of NAT traversal while reducing the number of probe message packets.

[0017] In conjunction with the first aspect, in certain implementations of the first aspect, the order in which the probe messages are sent and the depth of the binary tree corresponding to the probe messages satisfy the following relationship: i =[log2(i+1)]

[0018] The binary tree depth corresponding to each detection message and the second port number corresponding to each detection message satisfy the following relationship: i =MiddleVal / (pow(2,Depth i ))+(i-(pow(2,Depth i )-1)*MiddleVal / (pow(2, Depth i -1))

[0019] Wherein, i indicates that the detection message is the i-th detection message sent, Depth i Indicates the depth of the binary tree corresponding to the detection message, Index i Indicates the second port number corresponding to the detection message, and MiddleVal indicates the port number of the root node of the binary tree.

[0020] In combination with the first aspect, in some implementations of the first aspect, the first terminal determines the port number as the root node of the binary tree according to the maximum port number and the minimum port number among the available port numbers of the second NAT device,

[0021] In combination with the first aspect, in some implementations of the first aspect, the value of MiddleVal is the middle port number of the available port numbers of the second NAT device, and MiddleVal=(maximum port number+minimum port number) / 2.

[0022] In combination with the first aspect, in certain implementations of the first aspect, the first terminal determines the destination port number of each probe message in the multiple probe messages based on the sending order of the multiple probe messages, including: the first terminal determines the destination port number of the probe message based on the port number corresponding to the probe message and the first port number, wherein the first port number is one of the available port numbers of the second NAT device.

[0023] In combination with the first aspect, in some implementations of the first aspect, the first terminal selects the first port number from the available port numbers of the second NAT device, including: the first terminal randomly selects a port number from the available port numbers of the second NAT device as the first port number.

[0024] Based on the above technical solution, the first terminal can randomly select a port number from the available port numbers of the second NAT device as the first port number, thereby increasing the randomness of the destination port number of the determined probe message. That is to say, in the process of determining the destination port number of the probe message, both the sending order of the probe message and a random port number are taken into consideration. Under the premise of being based on certain rules (i.e., the sending order of the probe message), randomness is retained, and the rules for allocating ports of the NAT device are better matched, thereby improving the success rate of NAT traversal.

[0025] In combination with the first aspect, in some implementations of the first aspect, the method further includes: the first terminal obtaining the external network port number of the second terminal.

[0026] In combination with the first aspect, in certain implementations of the first aspect, the first terminal selects the first port number from the available port numbers of the second NAT device, including: the first terminal selects the first port number from the available port numbers of the second NAT device based on the obtained external network port number of the second terminal.

[0027] Based on the above technical solution, the first terminal can select a port number related to the obtained external network port number of the second terminal from the available port numbers of the second NAT device as the first port number. Compared with the above-mentioned random selection of a port number as the first port number, the randomness of the destination port number of the determined detection message may be reduced, but it is also a feasible method, which improves the flexibility of the entire solution.

[0028] In combination with the first aspect, in certain implementations of the first aspect, the first terminal determines the destination port number of the detection message based on the first port number and the second port number corresponding to the detection message, including: the first terminal uses the sum of the first port number and the second port number corresponding to the detection message as the destination port number of the detection message.

[0029] In conjunction with the first aspect, in certain implementations of the first aspect, the second port number corresponding to the probe message is the destination port number of the probe message, and the method further includes:

[0030] The first terminal randomly selects a port number from the available port numbers of the second NAT device as the root node of the binary tree.

[0031] In combination with the first aspect, in some implementations of the first aspect, the depth of the binary tree is greater than or equal to [log2(M+1)], where M is the number of the plurality of detection messages.

[0032] In combination with the first aspect, in certain implementations of the first aspect, after the first terminal determines the second port number corresponding to the detection message based on the binary tree depth corresponding to the detection message, the method also includes: the first terminal determines the destination port number of the detection message based on the first port number and the second port number corresponding to the detection message.

[0033] In combination with the first aspect, in certain implementations of the first aspect, the first terminal determines the destination port number of each probe message in the multiple probe messages based on the sending order of the multiple probe messages, including: for any probe message in the multiple probe messages, the first terminal determines the increment of the destination port number of the probe message relative to the initial value of the port number based on the sending order of the probe message in the multiple probe messages and the destination port number step; the first terminal determines the destination port number of the probe message based on the initial value of the port number and the increment, wherein the initial value of the port number is one of the available port numbers of the second NAT device.

[0034] Based on the above technical solution, the first terminal can determine the destination port number of the detection message according to a fixed step size, and the NAT device will follow a certain hash rule to allocate ports. The hash rule allocation port may be similar to the fixed step size determination of the destination port number, thereby reducing the number of detection messages sent while improving the success rate of NAT traversal.

[0035] In combination with the first aspect, in some implementations of the first aspect, the sending order of the probe message and the increment corresponding to the probe message satisfy the following relationship: ADD i =L*i, where i indicates that the probe message is the i-th probe message sent, ADD i Indicates the depth of the binary tree corresponding to the detection message, and L indicates the step size of the destination port number.

[0036] In combination with the first aspect, in certain implementations of the first aspect, before the first terminal determines the destination port number of each of the multiple probe messages based on the sending order of the multiple probe messages, the method also includes: the first terminal obtains information indicating that the first NAT device is a cone NAT device and information indicating that the second NAT device is a symmetric NAT device; after determining that the first NAT device is a cone NAT device and the second NAT device is a symmetric NAT device, determining the destination port number of each of the multiple probe messages based on the sending order of the multiple probe messages.

[0037] In combination with the first aspect, in some implementations of the first aspect, the number of the multiple detection messages is less than or equal to the maximum number of packets sent per unit time allowed by the firewall flow control mechanism corresponding to the first terminal.

[0038] Based on the above technical solution, the number of probe messages sent by the first terminal during NAT traversal can be determined according to the firewall flow control mechanism deployed in the first terminal, so as to avoid sending too many probe messages, which may trigger firewall flow control and cause NAT traversal failure.

[0039] In combination with the first aspect, in some implementations of the first aspect, the available port numbers of the second NAT device include: part or all of port numbers 1025 to 65535.

[0040] In a second aspect, a communication device is provided, which is configured to execute the method provided in the first aspect. Specifically, the communication device may include units and / or modules, such as a processing unit and an acquisition unit, configured to execute the method provided in any one of the implementations of the first aspect.

[0041] In one implementation, the transceiver unit may be a transceiver or an input / output interface; the processing unit may be at least one processor. Alternatively, the transceiver may be a transceiver circuit. Alternatively, the input / output interface may be an input / output circuit.

[0042] In another implementation, the transceiver unit may be an input / output interface, interface circuit, output circuit, input circuit, pin or related circuit on the chip, chip system or circuit; the processing unit may be at least one processor, processing circuit or logic circuit.

[0043] In a third aspect, the present application provides a processor for executing the method provided in the first aspect. In the process of executing these methods, the process of sending the above-mentioned information and obtaining / receiving the above-mentioned information in the above-mentioned method can be understood as the process of the processor outputting the above-mentioned information and the process of the processor receiving the above-mentioned information input. When outputting the above-mentioned information, the processor outputs the above-mentioned information to the transceiver so that the transceiver can transmit it. After being output by the processor, the above-mentioned information may also need to undergo other processing before reaching the transceiver. Similarly, when the processor receives the above-mentioned information input, the transceiver obtains / receives the above-mentioned information and inputs it into the processor. Furthermore, after the transceiver receives the above-mentioned information, the above-mentioned information may need to undergo other processing before being input into the processor.

[0044] Based on the above principles, for example, the receiving request message mentioned in the above method can be understood as the processor receiving input information.

[0045] For the operations such as transmission, sending and acquisition / reception involved in the processor, unless otherwise specified, or if they do not conflict with their actual functions or internal logic in the relevant descriptions, they can be more generally understood as processor output, reception, input and other operations, rather than the transmission, sending and receiving operations directly performed by the RF circuit and antenna.

[0046] During implementation, the processor may be a processor specifically configured to execute these methods, or may be a processor that executes computer instructions in a memory to execute these methods, such as a general-purpose processor. The memory may be a non-transitory memory, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or disposed on separate chips. The embodiments of the present application do not limit the type of memory or the configuration of the memory and the processor.

[0047] In a fourth aspect, a computer-readable storage medium is provided, which stores program code for execution by a device, wherein the program code includes code for executing any one of the methods provided in the first aspect.

[0048] In a fifth aspect, a computer program product comprising instructions is provided, which, when run on a computer, enables the computer to execute any one of the methods provided in the first aspect.

[0049] In a sixth aspect, a chip is provided, which includes a processor and a communication interface. The processor reads instructions stored in a memory through the communication interface and executes any one of the methods provided in the first aspect.

[0050] Optionally, as an implementation method, the chip may further include a memory storing instructions, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute any one of the methods provided in the first aspect above.

[0051] In a seventh aspect, a communication system is provided, comprising the first terminal shown in the first aspect, as well as a second terminal, a first NAT device and a second NAT device. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] FIG1 is a schematic diagram of an application scenario 100 involved in this application.

[0053] FIG2 is a schematic diagram showing the working process of a NAT device.

[0054] FIG3( a ) shows a schematic diagram of the working principle of cone NAT.

[0055] FIG3( b ) shows a schematic diagram of the working principle of symmetric NAT.

[0056] FIG4 shows a schematic diagram of the NAT traversal process.

[0057] FIG5 is a schematic diagram of implementing P2P communication through relay forwarding.

[0058] FIG6 is a schematic flowchart of a NAT traversal method provided in an embodiment of the present application.

[0059] (a) in FIG7 is a schematic diagram of a binary tree provided in an embodiment of the present application.

[0060] (b) in FIG7 is a schematic flowchart of determining the destination port number of the first detection message based on a binary tree algorithm provided in an embodiment of the present application.

[0061] FIG8 is a schematic structural diagram of a terminal device provided in an embodiment of the present application.

[0062] FIG9 is a schematic diagram showing the application effect of a NAT traversal method provided in an embodiment of the present application.

[0063] FIG10 is a schematic block diagram of an apparatus 1000 provided in an embodiment of the present application.

[0064] FIG11 is a schematic block diagram of an apparatus 1100 provided in an embodiment of the present application.

[0065] FIG12 is a schematic diagram of a chip system 1200 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0067] The technical solutions of the embodiments of the present application can be applied to various communication systems, such as: global system of mobile communication (GSM) system, code division multiple access (CDMA) system, wideband code division multiple access (WCDMA) system, general packet radio service (GPRS), long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (TDD), universal mobile telecommunication system (UMTS), world-wide interoperability for microwave access (WiMAX) communication system, 5G mobile communication system or new radio access technology (NR). The technical solutions provided in the present application can also be applied to future communication systems, such as the sixth generation mobile communication system.

[0068] The embodiments of the present application can be applied to terminal devices. A terminal device can be a device that provides voice / data connectivity to a user, such as a handheld device with wireless connection function, a vehicle-mounted device, etc.; it can be a device in vehicle network communication, such as a communication terminal loaded on a vehicle, a road side unit (RSU); it can be a communication terminal loaded on a drone; it can also be a terminal device in an Internet of Things (IoT) system. A terminal device can also be called user equipment (UE), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, etc.

[0069] Exemplary terminal devices include, but are not limited to, mobile phones, tablet computers, laptop computers, PDAs, mobile internet devices (MIDs), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs), handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, wearable devices, terminal devices in 5G networks or future evolved public land mobile communication networks (PLMNs). The embodiment of the present application does not limit the specific form of the terminal device.

[0070] To facilitate understanding of the embodiments of the present application, the application scenarios applicable to the embodiments of the present application are first described using FIG1 as an example.

[0071] Figure 1 is a schematic diagram of an application scenario 100 involved in this application. As shown in Figure 1, application scenario 100 may include three components: terminal devices (such as terminal device #1, terminal device #2, terminal device #3, and terminal device #4 as shown in Figure 1), gateways (such as gateway #1 and gateway #2 as shown in Figure 1), and a public network.

[0072] Specifically, terminal devices access the public network through a gateway. For example, terminal device #1 and terminal device #2 access the public network through gateway #1. In other words, terminal device #1 and terminal device #2 are terminal devices in the network built by gateway #1. Gateway #1 manages terminal device #1 and terminal device #2 and can assign private IP addresses and port numbers to terminal device #1 and terminal device #2. This means that gateway #1 divides the Internet into an internal private network and a public network, and terminal device #1 and terminal device #2 are in the private network managed by gateway #1.

[0073] Similarly, terminal devices #3 and #4 access the public network through gateway #2. In other words, terminal devices #3 and #4 are terminal devices in the network built by gateway #2. Gateway #2 manages terminal devices #3 and #4 and can assign private IP addresses and port numbers to them. This means that gateway #2 divides the Internet into an internal private network and a public network, and terminal devices #3 and #4 are located in the private network managed by gateway #2.

[0074] For example, the above-mentioned gateway may be referred to as a gateway device or a router, etc. In addition, the public network involved in the embodiments of the present application may also be referred to as an extranet.

[0075] This application focuses on the communication between terminal devices managed by different gateways in application scenario 100. For example, one or more of terminal device #1 and terminal device #2 communicate with one or more of terminal device #3 and terminal device #4. The communication between terminal device #1 and terminal device #3 is used as an example for explanation. When terminal device #1 wants to access the network, the message it sends passes through gateway #1, which converts the <private IP address + private port number> of the message into <public IP address + public port number>. This behavior results in the need for NAT traversal to establish P2P communication between terminal devices managed by two different gateways.

[0076] It should be understood that FIG1 is merely a simplified schematic diagram for ease of understanding and does not limit the application scenarios of the present application. For example, the application scenario 100 may also include other terminal devices. For another example, the application scenario 100 may also include other gateways. Examples are not provided here one by one.

[0077] To facilitate understanding, several basic concepts involved in the embodiments of the present application are briefly explained.

[0078] 1. P2P communication: This refers to the establishment of a point-to-point communication link between two network-capable terminal devices using IP information. The transmission path is adaptively routed based on the current network topology. Since data does not need to be transferred through service servers, it can help service providers reduce operating costs. Common P2P communication services include file sharing and downloading, audio and video calls, and live streaming.

[0079] 2. NAT method: When some hosts in a private network have been assigned local IP addresses (that is, dedicated addresses used only in the private network), but want to communicate with hosts on the public network (without encryption), the NAT method can be used.

[0080] The NAT method requires the installation of NAT software on a router connecting a private network to the public network. A router equipped with NAT software is called a NAT router (or NAT gateway, NAT device, etc.). A NAT router has at least one valid external global IP address (a public IP address). Therefore, all hosts using local addresses (private IP addresses) must convert their local addresses to global IP addresses on the NAT router before they can connect to the public network.

[0081] In addition, this approach of using a small number of global IP addresses (public IP addresses) to represent a larger number of private IP addresses will help slow the depletion of available IP address space.

[0082] 3. NAT traversal: NAT gateway devices divide the Internet into countless internal private networks and public networks. NAT gateway devices assign private IP addresses and private port numbers to the terminal devices under their management. When a terminal device wants to access the network, the message it sends passes through the NAT gateway device, which converts the <private IP address + private port number> of the message into <public IP address + public port number>. This behavior requires NAT traversal to establish P2P communication between terminal devices located in networks built by two different NAT gateway devices.

[0083] For ease of understanding, the NAT technology is introduced with reference to the accompanying drawings. FIG2 is a schematic diagram showing the working process of a NAT device.

[0084] As shown in FIG2 , the NAT device maintains an address mapping table, which records the terminal's intranet IP address, intranet port number, destination IP address, destination port number, mapped external IP address, and mapped external port number. The mapping table is initially empty.

[0085] For ease of description, the terminal's intranet IP address and intranet port number are collectively referred to as the terminal's intranet address (that is, the terminal's intranet address includes the terminal's intranet IP address and intranet port number); the destination IP address and destination port number are collectively referred to as the destination address (that is, the destination address includes the destination IP address and the destination port number); and the mapped external IP address and mapped external port number are collectively referred to as the external address (that is, the external address includes the mapped external IP address and the mapped external port number). The terminal's intranet address can be understood as the source address of a data packet sent by the terminal.

[0086] Exemplarily, the address mapping table shown in Figure 2 records the intranet addresses and external network addresses of terminal 1 and terminal 2. Taking the intranet address of terminal 1 as an example, its intranet address is 192.168.0.100:10000, and the destination address for end-to-end communication is 210.15.27.166:8000. The NAT device maps the intranet address of terminal 1 to the external network address 210.21.12.140:2000. When terminal 1 communicates with the other end of the destination address, it needs to communicate through the mapped external network address. The specific communication process will be described in detail below.

[0087] Taking terminal 1 (with an intranet address of 192.168.0.100:10000) sending a data packet to server 1 (with a destination address of 210.15.27.166:8000) as an example, the NAT workflow is introduced as follows:

[0088] (1) When terminal 1 needs to send a data packet to server 1 through the NAT device, the NAT device needs to obtain a record with a source address of 192.168.0.100:10000 in the mapping table. It should be understood that if terminal 1 sends a data packet to server 1 for the first time, a record with a source address of 192.168.0.100:10000 has not yet been created in the mapping table of the NAT device. At this time, a new set of records with a source address of 192.168.0.100:10000 needs to be created in the mapping table, and an external network port number and an external network IP address need to be allocated. For example, the external network IP address and external network port number allocated by the NAT device to the data packet with a source address of 192.168.0.100:10000 sent by terminal 1 are 210.21.12.140:2000.

[0089] (2) The NAT device modifies the source address of the data packet before sending it to the external network. The NAT device modifies the source address of the data packet by changing it to the external network address, that is, changing 192.168.0.100:10000 to 210.21.12.140:2000.

[0090] Since the terminal has sent a data packet to the external network, the external network can then send data packets to the internal network terminal through the NAT device. The process is as follows:

[0091] (3) The NAT device receives the data packet sent by server 1 to the external network address (210.21.12.140:2000) via the destination address (210.15.27.166:8000). By querying the mapping table, the NAT device can obtain the internal network address 192.168.0.100:10000 that has a mapping relationship with the external network address 210.21.12.140:2000.

[0092] (4) NAT modifies the destination address of the data packet and then sends the data packet to the intranet terminal 1. The NAT device modifies the destination address of the data packet, that is, changes the external network address (210.21.12.140:2000) to the internal network address (192.168.0.100:10000) mapped to the external network address.

[0093] As can be seen from the NAT workflow described above, NAT achieves address mapping by modifying the source and destination addresses of data packets. Its working principle can be summarized as follows: internal network terminals actively send data packets to the external network, and the external network may send data packets to internal network terminals; data packets sent from the internal network to the external network have their source addresses modified, and data packets sent from the external network to the internal network have their destination addresses modified.

[0094] It should be understood that for terminals that access the network through different NAT devices, such as the first terminal and the second terminal, if they know the external network address after mapping by the other NAT device, it is possible to directly send User Datagram Protocol (UDP) packets to the other party's external network address for communication (e.g., in a cone-cone scenario), thus achieving NAT traversal.

[0095] 4. NAT Type: Based on the differences in how NAT gateways convert IP addresses, NAT is divided into four types: Full Cone NAT, Restricted Cone NAT, Port Number Restricted Cone NAT, and Symmetric NAT. Full Cone NAT, Restricted Cone NAT, and Port Number Restricted Cone NAT are collectively referred to as Cone NAT. The NAT networking types corresponding to communication between two terminal devices include Cone-Cone, Cone-Symmetric, and Symmetric-Symmetric.

[0096] For ease of understanding, the cone NAT device and the symmetric NAT device are briefly introduced with reference to FIG3 .

[0097] For example, FIG3 (a) shows a cone NAT device. As can be seen from FIG3 (a), the cone NAT device converts a fixed internal network address into an external network address, which is a one-to-one mapping. When the NAT type is cone NAT, when other types of NAT devices (such as cone NAT devices or symmetric NAT devices) communicate with the cone NAT device, it can be determined that the cone NAT device has only one external network address, and the destination address of the data packet sent to the cone NAT device can be filled in with the external network address of the cone NAT device.

[0098] For example, FIG3(b) shows a symmetric NAT device. FIG3(b) shows that the symmetric NAT device converts a single intranet address into multiple external network addresses, which is a one-to-many mapping. When the NAT type is symmetric NAT, when another type of NAT device (e.g., a cone NAT device or a symmetric NAT device) communicates with the symmetric NAT device, it can be determined that the symmetric NAT device has multiple external network addresses. In this case, the destination address of the data packet sent to the symmetric NAT device can be multiple.

[0099] 5. Birthday attack algorithm: This is a cryptographic attack method that exploits the mathematical principle of the birthday problem in probability theory. This attack method can be used to abuse the communication between two or more groups. This attack relies on a high collision probability and a fixed number of permutations in a random attack.

[0100] Exemplarily, the application of the birthday attack algorithm in NAT traversal includes:

[0101] The communicating parties send a large number of random probe messages to each other (for example, the cone NAT device sends a large number of random probe messages to the symmetric NAT device, where the destination port number of the probe message is randomly selected between 1025 and 65535. The symmetric NAT device sends a large number of random probe messages to the cone NAT device, where the destination port number of the probe message is the fixed port number of the cone NAT device). There is a certain probability of successfully achieving NAT traversal.

[0102] For example, the process of achieving NAT traversal based on the birthday attack algorithm is described by taking the "Cone NAT-Symmetric NAT" combination as an example. The cone NAT device sends a large number of random probe packets to the symmetric NAT device. Specifically, the relationship between the number of packets sent, the destination port number, and the source port number on the cone NAT device side is shown in (a) of Figure 4; the symmetric NAT device sends a large number of random probe packets to the cone NAT device. The relationship between the number of packets sent, the destination port number, and the source port number on the symmetric NAT device side is shown in (b) of Figure 4; the way in which the cone NAT device side and the symmetric NAT device side send a large number of random probe packets to each other is shown in (c) of Figure 4.

[0103] The probability of successful NAT traversal is as follows:

[0104] Among them, m and n represent the number of packets sent at both ends.

[0105] The number of packets commonly used in the industry is: m = 2048, n = 128; or m = 1024, n = 256. Therefore, the probability of successful NAT traversal is P(2048, 128) = P(1024, 256) ≈ 98%.

[0106] 6. Binary tree: This is an important type of tree structure. Many practical problems often result in data structures that take the form of binary trees. Even ordinary trees can be easily converted to binary trees. Furthermore, the storage structure and algorithms for binary trees are relatively simple, making them particularly important. A characteristic of binary trees is that each node can have at most two subtrees, one on the left and one on the right.

[0107] A binary tree is a finite set of n elements. This set is either empty or consists of an element called the root and two disjoint binary trees called the left and right subtrees. It is an ordered tree. When the set is empty, the binary tree is called an empty binary tree. In a binary tree, an element is also called a node.

[0108] 7. Firewall: A technology that helps computer networks build a relatively isolated protective barrier between their internal and external networks by combining various software and hardware devices for security management and screening to protect user data and information security.

[0109] The main function of firewall technology is to promptly detect and deal with security risks, data transmission and other problems that may exist during the operation of computer networks. The treatment measures include isolation and protection. At the same time, it can record and detect various operations in computer network security to ensure the security of computer network operation, protect the integrity of user data and information, and provide users with a better and safer computer network experience.

[0110] 8. Firewall flow control: This application mainly involves flow connection control. Connection limit refers to limiting the number of concurrent connections. Current network applications such as P2P occupy a lot of connection resources. Limiting the number of connections can achieve the purpose of flow control. Including but not limited to:

[0111] 1) Limit the number of concurrent connections per IP address: Limit the number of concurrent connections for each IP address. Connections exceeding this limit will be blocked.

[0112] 2) Overall concurrent connection limit: The total number of concurrent connections that hit the policy is limited, and connections that exceed the rule will be blocked.

[0113] 9. pow(x, y) function: used to calculate x to the power of y.

[0114] The above-mentioned NAT traversal method based on the birthday attack algorithm requires a large number of packets to achieve a high theoretical probability of NAT traversal success. However, in reality, NAT devices are often deployed with firewalls. A large number of packets will trigger flow control, which greatly reduces the success rate of traversal.

[0115] In addition, when it is detected that both communicating parties are using symmetric NAT, NAT traversal can be abandoned and server relay forwarding can be used to achieve P2P communication.

[0116] For ease of understanding, the relay forwarding method for implementing P2P communication is described in detail with reference to Figure 5. Figure 5 is a schematic diagram of implementing P2P communication through relay forwarding. As can be seen from Figure 5, a forwarding server is deployed on the public network. When client A wants to establish communication with client B, they first establish a connection with the forwarding server. Client A sends data to the forwarding server, and the server forwards the data to client B after receiving it.

[0117] The method shown in FIG5 requires deployment of a service forwarding server, which results in high communication costs.

[0118] As can be seen from the above, implementing P2P communication through relay forwarding is costly. This application primarily considers implementing P2P communication through NAT traversal. Current NAT traversal methods based on birthday attack algorithms have poor performance. To overcome these issues, this application proposes a NAT traversal method that implements P2P communication by controlling both ends of the communication based on a preset packet sending strategy. Compared to traditional birthday attack algorithms, this method achieves a higher traversal success rate with a smaller number of packets sent. The following detailed description of the NAT traversal method provided by this application is combined with the accompanying figures.

[0119] The embodiments shown below do not specifically limit the specific structure of the execution subject of the method provided in the embodiments of the present application. As long as it is possible to communicate according to the method provided in the embodiments of the present application by running a program that records the code of the method provided in the embodiments of the present application, for example, the execution subject of the method provided in the embodiments of the present application can be a transceiver device, or a functional module in the transceiver device that can call and execute the program.

[0120] In order to facilitate understanding of the embodiments of the present application, the following explanations are made.

[0121] First, in this application, "used to indicate" can include being used for direct indication and being used for indirect indication. When describing that a certain indication information is used to indicate A, it can include that the indication information directly indicates A or indirectly indicates A, but it does not mean that the indication information must carry A.

[0122] The information indicated by the indication information is called the information to be indicated. In the specific implementation process, there are many ways to indicate the information to be indicated, such as but not limited to, directly indicating the information to be indicated, such as the information to be indicated itself or the index of the information to be indicated. The information to be indicated can also be indirectly indicated by indicating other information, wherein there is an association between the other information and the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while the other parts of the information to be indicated are known or agreed in advance. For example, it is also possible to use the arrangement order of each piece of information agreed in advance (such as specified in the protocol) to achieve the indication of specific information, thereby reducing the indication overhead to a certain extent. At the same time, it is also possible to identify the common parts of each piece of information and indicate them uniformly to reduce the indication overhead caused by indicating the same information separately.

[0123] Second, "at least one" shown in the present application refers to one or more, and "a plurality of" refers to two or more. In addition, in the embodiments of the present application, "first", "second" and various digital numbers (for example, "#1", "#2", etc.) are only for the convenience of description and are not used to limit the scope of the embodiments of the present application. The size of the sequence number of each process below does not mean the order of execution. The execution order of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present application. It should be understood that the objects described in this way can be interchanged where appropriate, so that the schemes other than the embodiments of the present application can be described. In addition, in the embodiments of the present application, words such as "610", "620" are only for the convenience of description and are not used to limit the order of execution of steps.

[0124] Third, in the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0125] Fourth, the term "storage" used in the embodiments of this application may refer to storage in one or more memories. The one or more memories may be provided separately or integrated into an encoder or decoder, a processor, or a communication device. The one or more memories may also be partially provided separately and partially integrated into a decoder, a processor, or a communication device. The type of memory may be any form of storage medium, and this application is not limited thereto.

[0126] Fifth, the "protocol" involved in the embodiments of the present application may refer to a standard protocol in the communication field, for example, it may include the NR protocol and related protocols used in future communication systems, which is not limited in this application.

[0127] Sixth, in the embodiments of the present application, the terms “of”, “corresponding, relevant”, “corresponding” and “associate” can sometimes be used interchangeably. It should be noted that when the distinction between them is not emphasized, the meanings they intend to express are consistent.

[0128] Seventh, the term "and / or" in this document simply describes an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0129] Hereinafter, without loss of generality, the NAT traversal method provided in the embodiment of the present application is described in detail by taking the interaction between the first terminal and the second terminal as an example.

[0130] The first terminal and the second terminal may be the terminal devices described above. It should be understood that the specific types of the first terminal and the second terminal are not limited in the following embodiments of the present application, and they only need to be able to perform the steps performed by the first terminal and the second terminal in the following embodiments.

[0131] FIG6 is a schematic flowchart of a NAT traversal method provided in an embodiment of the present application.

[0132] It should be understood that the NAT traversal method provided in the embodiments of the present application can be applied to a system including multiple terminals, at least two of which access a network through different NAT devices. For example, it can be applied to a system in which a first terminal communicates with a second terminal, wherein the first terminal accesses the network through a first NAT device, and the second terminal accesses the network through a second NAT device, and the first NAT device and the second NAT device are different. The network accessed by the first terminal and the second terminal can be the external network (or public network) described above.

[0133] In some embodiments, the communication system includes, in addition to the two terminal devices, a network device that can obtain certain information about the two terminal devices, such as the NAT type, public IP address, and public port number described below. The embodiments of the present application do not limit the specific structure of the network device; as long as it can achieve the function of obtaining information about the two terminal devices, the network device can be used. The following description uses the network device as a detection server as an example.

[0134] As a possible implementation manner, the first NAT device is a cone NAT device, and the second NAT device is a symmetric NAT device.

[0135] As another possible implementation, the first NAT device is a symmetric NAT device, and the second NAT device is a symmetric NAT device.

[0136] For ease of description, the following description is given by taking an example where the first NAT device is a cone NAT device and the second NAT device is a symmetric NAT device.

[0137] The NAT traversal process includes the following steps.

[0138] S610: The first terminal obtains the IP address of the second terminal in the network.

[0139] Specifically, the second terminal accesses the network through the second NAT device, and the IP address of the second terminal in the network can be understood as the external IP address of the second terminal, or the public IP address of the second terminal.

[0140] Optionally, the first terminal can also obtain the port number of the second terminal in the network. From the above, it can be seen that the second terminal accesses the network through the second NAT device. The port number of the second terminal in the network can be understood as the external network port number of the second terminal, or the public network port number of the second terminal.

[0141] For example, the first terminal may also obtain the IP address and port number of the first terminal within the network, so that the IP address and port number of the first terminal within the network can be provided to the second terminal via the detection server. The IP address of the first terminal within the network can be understood as the external IP address of the first terminal, or the public IP address of the first terminal; and the port number of the first terminal within the network can be understood as the external port number of the first terminal, or the public port number of the first terminal.

[0142] For ease of description and distinction, the following uses the examples of a first terminal obtaining the IP address and port number of a second terminal within the network, and the first terminal obtaining the IP address and port number of the first terminal within the network as examples. The IP address and port number of the second terminal within the network can collectively be referred to as the public network address of the second terminal, and the IP address and port number of the first terminal within the network can collectively be referred to as the public network address of the first terminal.

[0143] The external network address of the first terminal includes: the public network IP address mapped to the first terminal's internal network IP address on the first NAT device, and the public network port number mapped to the first terminal's internal network port number on the first NAT device; similarly, the external network address of the second terminal includes: the public network IP address mapped to the second terminal's internal network IP address on the second NAT device, and the public network port number mapped to the second terminal's internal network port number on the second NAT device.

[0144] Exemplarily, the external network address of the first terminal can also be called the external network address of the first NAT device corresponding to the first terminal, and the external network address of the second terminal can also be called the external network address of the second NAT device corresponding to the second terminal, wherein the external network address can also be called a public network address, public network information or external network information, etc. This application does not impose any restrictions on the name of the information, as long as it can realize the corresponding function.

[0145] Since the first NAT device is a cone-shaped NAT device, the public network address of the first terminal is a single public network address, that is, the first NAT device converts a single private network address into a single public network address. Therefore, multiple probe messages are sent to the first terminal, and the first NAT device converts the private network addresses of the multiple probe messages into a single public network address. Since the second NAT device is a symmetric NAT device, the public network address of the second terminal is multiple public network addresses, that is, the second NAT device converts a single private network address into multiple public network addresses. Therefore, multiple probe messages are sent to the second terminal, and the second NAT device converts the private network addresses of the multiple probe messages into multiple public network addresses.

[0146] As a possible implementation manner, the first terminal may obtain the external network address of the first terminal and the external network address of the second terminal through a detection server.

[0147] In this implementation, the first terminal obtains the external network address of the first terminal and the external network address of the second terminal including the following steps:

[0148] Step 1: The first terminal sends a first query message to the detection server. Specifically, the first query message is used to query the external network address of the first terminal.

[0149] In this embodiment, the detection server interacts with the detection module of the terminal to assist the terminal in identifying the type of the currently connected NAT device, the external IP address, and the external port number. For example, the detection server interacts with the detection module of the first terminal to assist the first terminal in identifying the type of the currently connected first NAT device, the external IP address, and the external port number.

[0150] In addition, in this embodiment, the detection server can also share information such as the type of NAT device accessed by the terminal, the external IP address and the external port number with both communicating parties (for example, sharing the type of the first NAT device currently accessed by the first terminal, the external IP address and the external port number with the second terminal, and sharing the type of the second NAT device currently accessed by the second terminal, the external IP address and the external port number with the first terminal).

[0151] Illustratively, the above-mentioned functions of the detection server may be implemented using the industry Request For Comments (RFC) standard Session Traversal Utilities for NAT (STUN) protocol (eg, RFC5389).

[0152] It should be understood that in this embodiment, the first terminal accesses the network through the first NAT device, and the NAT type of the first NAT device is cone NAT.

[0153] Step 2: The detection server sends a first response message to the first terminal. Specifically, the first response message includes the external network address of the first terminal.

[0154] In one implementation, the first terminal can send a first query message to the detection server through the first NAT device. The first NAT device autonomously configures a corresponding external network address for the first terminal based on the first query message, and then the detection server sends the external network address of the first terminal to the first terminal through the first NAT device.

[0155] For example, the external network address of the first terminal includes a port number and an IP address, that is, the first NAT device is a cone-shaped NAT device, and the external network address of the first terminal is one.

[0156] For another example, the external network address of the first terminal includes an IP address and multiple port numbers, that is, the first NAT device is a symmetric NAT device, and the first terminal has multiple external network addresses, each of which consists of a port number and an IP address.

[0157] This embodiment mainly considers the case where the first NAT device is a cone-type NAT device, and the external network address of the first terminal is one.

[0158] Exemplarily, the first query message may also be used to query the type of the first NAT device. The first response message also includes information indicating the type of the first NAT device.

[0159] For example, a network device can receive multiple first query messages from a first terminal through multiple ports. When the source addresses of the multiple first query messages received by the multiple ports are the same (i.e., the external network port number in the external network address configured by the first NAT device), the network device can determine that the first NAT device is a cone NAT device, and carry information indicating that the type of the first NAT device is a cone NAT device in the first response message. The destination addresses of the multiple first query messages are all the addresses of the detection server, such as the destination IP addresses of the multiple first query messages are all the IP addresses of the detection server, the destination port numbers of the multiple first query messages are respectively the port numbers of the multiple ports of the detection server, and the first NAT device can configure multiple external network addresses for the multiple first query messages. In this example, since the first NAT device is a cone NAT device, the external network addresses of the multiple first query messages are the same.

[0160] It should be noted that this embodiment does not limit the use of the first query message to querying the type of the first NAT device. For example, the first terminal may determine that the type of the first NAT device is a cone NAT device based on the number of the first terminal's external network addresses obtained being one. For another example, the first terminal may determine that the type of the first NAT device is a cone NAT device based on historical communication data. Examples are not provided here one by one.

[0161] Through the above steps 1 and 2, the first terminal can obtain the NAT type of the first NAT device corresponding to the first terminal and the external network address of the first terminal (ie, the public IP address and public port number of the first terminal) from the detection server.

[0162] Similarly, the second terminal can also perform steps 1 and 2 similar to the above to obtain the NAT type of the second NAT device corresponding to the second terminal, and obtain the external network address of the second terminal (ie, the public IP address and public port number of the second terminal).

[0163] Step 3: The second terminal sends a second query message to the detection server. Specifically, the second query message is used to query the external network address of the second terminal.

[0164] It should be understood that in this embodiment, the second terminal accesses the network through the second NAT device, and the NAT type of the second NAT device is symmetric NAT.

[0165] Step 4: The network device sends a second response message to the second terminal. Specifically, the second response message includes the external network address of the second terminal.

[0166] In one implementation, the second terminal can send a second query message to the detection server through the second NAT device. The second NAT device autonomously configures a corresponding external network address for the second terminal based on the second query message, and then the detection server sends the external network address of the second terminal to the second terminal through the second NAT device.

[0167] For example, the external network address of the second terminal includes an IP address and multiple port numbers, that is, the second NAT device is a symmetric NAT device, and the second terminal has multiple external network addresses, each of which consists of a port number and an IP address.

[0168] Exemplarily, the second query message may also be used to query the type of the second NAT device. The second response message also includes information indicating the type of the second NAT device.

[0169] For example, the detection server can receive multiple second query messages from the second terminal through multiple ports respectively. When the source addresses of the multiple second query messages received by the multiple ports are different (i.e., the external network port numbers in the external network address configured by the second NAT device), the detection server can determine that the second NAT device is a symmetric NAT device and carry information indicating that the type of the second NAT device is a symmetric NAT device in the second response message. The destination addresses of the multiple second query messages are all the address of the detection server, such as the destination IP addresses of the multiple second query messages are all the IP address of the detection server, the destination port numbers of the multiple second query messages are respectively the port numbers of the multiple ports of the detection server, and the second NAT device can be configured with multiple external network addresses for the multiple second query messages. In this example, since the second NAT device is a symmetric NAT device, the external network addresses of the multiple second query messages are different.

[0170] It should be noted that this embodiment does not limit the use of the second query message to querying the type of the second NAT device. For example, the second terminal may determine that the type of the second NAT device is a symmetric NAT device based on the number of external network addresses of the second terminal obtained. For another example, the second terminal may determine that the type of the second NAT device is a symmetric NAT device based on historical communication data. Examples are not provided here.

[0171] Through the above steps 3 and 4, the second terminal can obtain the NAT type of the second NAT device corresponding to the second terminal from the detection server, and obtain the external network address of the second terminal (ie, the public IP address and public port number of the second terminal).

[0172] Furthermore, after the first terminal obtains the NAT type of the first NAT device corresponding to the first terminal and the external network address of the first terminal from the detection server, and the second terminal obtains the NAT type of the second NAT device corresponding to the second terminal and the external network address of the second terminal from the detection server, the first terminal and the second terminal can exchange NAT types and public network information of both parties through the detection server.

[0173] Step 5: The detection server sends a first notification message to the first terminal, wherein the first notification message includes the external network IP address of the second terminal.

[0174] Optionally, the first notification message also includes the external network port number of the second terminal.

[0175] Optionally, the first notification message also includes information indicating the type of the second NAT device.

[0176] Exemplarily, the first notification message and the above-mentioned first response message are the same message.

[0177] For example, if the detection server has received the second query message of the second terminal before sending the first response message to the first terminal and has obtained the external network address of the second terminal, the detection server can notify the external network address corresponding to the first terminal and the external network IP address corresponding to the second terminal through a message.

[0178] Step 6: The detection server sends a third notification message to the second terminal, or the second terminal receives the third notification message from the detection server.

[0179] The third notification message includes the external network address of the first terminal. Optionally, the third notification message also includes information indicating the type of the first NAT device.

[0180] Exemplarily, the third notification message and the above-mentioned second response message are the same message.

[0181] For example, if the detection server has received the first query message of the first terminal before sending the second response message to the second terminal and has obtained the external network address of the first terminal, the detection server can notify the external network address corresponding to the first terminal and the external network address corresponding to the second terminal through a message.

[0182] The above steps 1 to 6 describe in detail how the first terminal obtains the external network address of the first terminal and the external network IP address of the second terminal through the detection server. It should be understood that the first terminal can also obtain the external network address of the first terminal and the external network IP address of the second terminal through other methods.

[0183] As another possible implementation, the first terminal may obtain the external network address of the first terminal from the first NAT device, and obtain the external network IP address of the second terminal from another device (eg, a device that has established P2P communication with the second terminal).

[0184] It should be noted that this embodiment does not limit how the first terminal obtains the external network address of the first terminal and the external network IP address of the second terminal. Any method that can obtain the external network address of the first terminal and the external network IP address of the second terminal is within the scope of protection of this application.

[0185] Furthermore, after the first terminal obtains the external network address of the first terminal and the external network IP address of the second terminal, the first terminal can send a probe message (hereinafter referred to as the first probe message for distinction) to achieve NAT traversal between the first terminal and the second terminal, thereby establishing P2P communication. It should be understood that before sending each probe message, the first terminal needs to determine the destination port number of the probe message. The method flow shown in Figure 6 also includes:

[0186] S620: The first terminal determines a destination port number of each first detection message in the plurality of first detection messages according to a sending order of the plurality of first detection messages.

[0187] It should be understood that in this embodiment, the first terminal first determines the destination port number of the first probe message before sending the first probe message. Unlike the above-mentioned birthday attack algorithm, which randomly selects a port number from a preconfigured port number set (e.g., 1025-65535) as the port number of the destination address of the probe message, in this embodiment, the first terminal determines the destination port number of each first probe message based on the order in which the multiple first probe messages are sent. In other words, in this embodiment, the first terminal takes into account the order in which the multiple first probe messages are sent (or the order in which they are generated, determined, transmitted, etc.) when determining the destination port number of the first probe message, rather than making a random selection without any purpose.

[0188] As a possible implementation, before the first terminal determines the destination port number of each of the multiple first probe messages based on the order in which the multiple first probe messages are sent, the first terminal may determine the second port number corresponding to any one of the multiple first probe messages (e.g., first probe message #1) from the available port numbers of the second NAT device based on the order in which the first probe message is sent. The second port number corresponding to the first probe message #1 is used to determine the destination port number corresponding to the first probe message #1.

[0189] Exemplarily, in this implementation, the first terminal may determine the second port number corresponding to the first detection message #1 based on a binary tree algorithm.

[0190] Specifically, the first terminal determines the binary tree depth corresponding to (or mapped to) the first probe message #1 in the binary tree based on the order in which the first probe message #1 is sent among the multiple first probe messages, where the nodes of the binary tree include the available port numbers of the second NAT device. The first terminal then determines the second port number corresponding to the first probe message #1 based on the binary tree depth corresponding to the first probe message #1. In other words, the first terminal can generate a binary tree based on the available port numbers of the second NAT device, where the root node and child nodes of the binary tree are the available port numbers of the second NAT device. It can be understood that the nodes in the binary tree in this embodiment are composed of the available port numbers of the second NAT device.

[0191] For ease of understanding, the binary tree involved in this embodiment is explained with reference to (a) in FIG. 7 .

[0192] As can be seen from (a) in FIG. 7 , the binary tree involved in this embodiment includes a root node and child nodes, and the depth of the binary tree is greater than or equal to [log2(m+1)], where m is the number of the plurality of first probe messages. Specifically, a plurality of port numbers among the available port numbers of the second NAT device serve as the root node and child nodes of the binary tree.

[0193] Exemplarily, in this implementation, the order in which the first detection message #1 is sent and the depth of the binary tree corresponding to the first detection message #1 satisfy the following relationship: Depth i =[log2(i+1)]

[0194] The binary tree depth corresponding to the first detection message #1 and the second port number corresponding to the first detection message #1 satisfy the following relationship: i =MiddleVal / (pow(2,Depth i ))+(i-(pow(2,Depth i )-1)*MiddleVal / (pow(2, Depth i -1))

[0195] Wherein, i indicates that the first detection message #1 is the i-th detection message, and the Depth i Indicates the binary tree depth corresponding to the first detection message #1, the Index i Indicates the second port number corresponding to the first detection message #1, and MiddleVal indicates the port number of the root node of the binary tree.

[0196] Optionally, the first terminal determines the port number serving as the root node of the binary tree according to the maximum port number and the minimum port number among the available port numbers of the second NAT device.

[0197] For example, the value of MiddleVal can be the middle port number of the available port numbers of the second NAT device. When the maximum port number among the available port numbers of the second NAT device is 65535 and the minimum port number among the available port numbers of the second NAT device is 1025, MiddleVal = (65535+1025) / 2; or, when the index of the maximum port number among the available port numbers of the second NAT device is 64510 and the minimum port number among the available port numbers of the second NAT device is 0, MiddleVal is the port number with an index value of (64510-0) / 2.

[0198] Optionally, the first terminal may randomly select a port number from available port numbers of the second NAT device as the root node of the binary tree.

[0199] As another possible implementation method, the port number of any child node in the depth of the binary tree corresponding to the first detection message #1 can be used as the second port number corresponding to the first detection message #1. That is to say, it is only necessary to determine the depth of the binary tree corresponding to the first detection message #1. If the first detection message #2 that is sent after the first detection message #1 corresponds to the same depth of the binary tree as the first detection message #1, the port number of the child node other than the port number of the selected child node can be selected as the second port number corresponding to the first detection message #2.

[0200] Exemplarily, when the first terminal randomly selects a port number from the available port numbers of the second NAT device as the root node of the binary tree, after determining the second port number corresponding to the first detection message #1 based on the binary tree algorithm, the second port number corresponding to the first detection message #1 can be used as the destination port number of the first detection message #1.

[0201] Exemplarily, the first terminal determines the destination port number of the first detection message #1 based on the sending order of the first detection message #1 among multiple first detection messages, including: the first terminal determines the destination port number of the first detection message #1 based on the second port number corresponding to the first detection message #1 and the first port number, wherein the first port number is one of the available port numbers of the second NAT device.

[0202] As a possible implementation manner, the first port number may be a port number randomly selected from available port numbers of the second NAT device.

[0203] As another possible implementation, when the first terminal obtains the external network port number of the second terminal, the first port number may be a port number selected from available port numbers of the second NAT device and related to the external network port number of the second terminal.

[0204] For example, the first port number is a port number among the available port numbers of the second NAT device that is the same as the external network port number of the second terminal.

[0205] It should be understood that in this embodiment, there is no limitation on the selection method of the first port number. The first port number can be one of the available port numbers of the second NAT device.

[0206] Furthermore, under this implementation method, after the first terminal selects the first port number and determines the second port number corresponding to the first detection message #1 according to the above implementation method, the first terminal can determine the destination port number corresponding to the first detection message #1 based on the first port number and the second port number corresponding to the first detection message #1.

[0207] Exemplarily, the first terminal uses the sum of the first port number and the second port number corresponding to the first detection message #1 as the destination port number corresponding to the first detection message #1. For example, the destination port number corresponding to the first detection message #1 = the first port number + the second port number corresponding to the first detection message #1.

[0208] It should be noted that the calculation formulas involved in the above implementation are only examples. Other calculation formulas that have been modified and are related to the sending order of the first detection message #1 are within the protection scope of this application and will not be illustrated one by one here.

[0209] In the above two implementations, it is explained that the destination port number of each first detection message can be determined based on a binary tree algorithm. The following will be described in detail with reference to (b) in FIG7 , how the first terminal determines the destination port number corresponding to each first detection message based on the binary tree algorithm, which will not be described in detail here. This embodiment also provides another method for determining the destination port number of the first detection message, which determines the destination port numbers corresponding to different first detection messages based on the destination port number step size. The following is a detailed description:

[0210] As another possible implementation, the first terminal determines the destination port number of each first detection message (e.g., first detection message #1) in the multiple first detection messages according to the sending order of the multiple first detection messages, including:

[0211] The first terminal determines the increment of the destination port number of the first probe message #1 relative to the initial value of the port number based on the sending order of the first probe message #1 in multiple first probe messages and the destination port number step, and then the first terminal determines the destination port number of the first probe message #1 based on the initial value and the increment of the port number, wherein the initial value of the port number is one of the available port numbers of the second NAT device.

[0212] Optionally, the initial value of the port number is the first port number mentioned above, which can be the first port number randomly selected by the first terminal from the available port numbers of the second NAT device. For a detailed description, please refer to the description of the first port number mentioned above, which will not be repeated here.

[0213] Exemplarily, in this implementation, the order in which the first detection message #1 is sent and the increment corresponding to the first detection message #1 satisfy the following relationship: ADD i =L*i

[0214] Wherein, i indicates that the first detection message #1 is the i-th detection message, the ADD i It represents the increment corresponding to the first detection message #1, and L represents the step size of the destination port number.

[0215] Exemplarily, the destination port number step may be a preset value, such as a positive integer such as 1 or 2. This is not limited in this embodiment.

[0216] After determining the increment corresponding to the first detection message #1, the first terminal can determine the destination port number of the first detection message #1 based on the initial value and the increment of the port number. For example, the destination port number corresponding to the first detection message #1 = the initial value of the port number + the increment corresponding to the first detection message #1.

[0217] It is understandable that the aforementioned birthday attack algorithm randomly selects port numbers and does not follow any rules to select the port numbers of the probe message. However, the port number allocation rules of NAT devices are not necessarily random. Most NAT devices use some kind of hash rule to assign port numbers. Therefore, there is room for optimization of the birthday attack algorithm. This application uses the binary tree algorithm or fixed step size as an example to illustrate the benefits of following certain rules to select the port numbers of the probe message. Other algorithms (such as other selection algorithms related to the sending order of the first probe message, etc.) can also be used, and they are not described in detail in this application.

[0218] S630: The first terminal sends multiple first detection messages.

[0219] Specifically, after determining the detection parameters such as the destination port number of each first detection message in the plurality of first detection messages, the first terminal sends the plurality of first detection messages respectively. For example, the first terminal may continuously send m first detection messages based on the detection parameters corresponding to each first detection message.

[0220] Among them, the destination IP address of each first detection message in the m first detection messages is the external network IP address of the second terminal, and the destination port number of each first detection message in the m first detection messages is port i, i = 1, 2, 3, ..., m, port i is the destination port number of the first detection message determined in the above step S620.

[0221] The first terminal sending the first detection message includes: the first terminal sending m first detection messages to the first NAT device, wherein the source address of the first detection message is the private network address of the first terminal, that is, the private network IP address and private network port number of the first terminal. Correspondingly, the destination IP address of the first detection message is the public network IP address of the second terminal, and the destination port number of the first detection message is one of the available port numbers of the second NAT device. It should be noted that the destination port number of the first detection message is selected by the first terminal from the available port numbers of the second NAT device according to the sending order of each first detection message in the m first detection messages.

[0222] For example, assuming that the available port numbers of the NAT device are from 0 to 65535, and the port numbers from 0 to 1024 are usually reserved port numbers, then the available port numbers of the second NAT device in this embodiment are usually public network ports with port numbers from 1025 to 65535, totaling 64510 port numbers.

[0223] Specifically, after receiving the first detection message, the first NAT device establishes a mapping table locally to facilitate subsequent NAT traversal.

[0224] For example, if the mapping table of the first NAT device has not yet created records of the source addresses of the m first detection messages, then a new set of records about the source addresses of the m first detection messages needs to be created in the mapping table, specifically including: recording the source addresses of the m first detection messages in the mapping table, and recording in the mapping table the external network port number and external network IP address converted for the source address of each first detection message (i.e., the external network IP address and external network port number of the first terminal described above), and recording the destination address of the first detection message (i.e., the external network IP address of the second terminal described above and the destination port number of the first detection message). Among them, the source addresses of the m first detection messages are the same, the source external network addresses of the m first detection messages are the same, and the destination addresses of the m first detection messages are different.

[0225] It should be noted that the embodiment of the present application does not limit the process of establishing a mapping table for the first NAT device. You can refer to the description of establishing a mapping table for the NAT device in the current NAT traversal. The embodiment of the present application mainly involves how the first terminal determines the destination port number of the first detection message.

[0226] Exemplarily, m is determined based on the firewall deployed in the first terminal. It is not recommended that m be set higher than the flow control value set by the firewall of the first terminal, wherein the flow control value set by the firewall of the first terminal can be determined by conducting a preliminary test through a large number of packet transmissions. For example, m is less than or equal to the maximum number of packets transmitted per unit time allowed by the flow control mechanism of the firewall corresponding to the first terminal, wherein the maximum number of packets transmitted per unit time can be the maximum number of packets transmitted per second, or can also be the maximum number of packets transmitted per minute, without limitation.

[0227] Exemplarily, the value of m includes but is not limited to: 512, 768, etc.

[0228] Furthermore, after the first terminal sends m first detection messages, the second terminal may be notified via a second notification message. The method flow shown in FIG6 also includes:

[0229] S640: The first terminal sends a second notification message to the second terminal.

[0230] The second notification message is used to notify that the sending of multiple first detection messages has ended.

[0231] Exemplarily, the first terminal sends a second notification message to the second terminal via the network device.

[0232] Specifically, after receiving the second notification message, the second terminal starts sending the second detection message. The method flow shown in FIG6 further includes:

[0233] S650: The second terminal sends a second detection message.

[0234] Specifically, after the second terminal learns the external network address of the first terminal and receives the aforementioned second notification message, it can send n second probe messages based on the external network address of the first terminal. In this embodiment, because the first NAT device corresponding to the first terminal is a cone NAT device, the external network address of the first terminal includes an IP address and a port number. The destination address of each of the n second probe messages is set to the external network address of the first terminal.

[0235] Among them, the destination IP address of the second detection message in the n second detection messages is the external network IP address of the first terminal, and the destination port of the second detection message in the n second detection messages is port j, j=1, 2, 3, ..., n, and port j is the external network port number of the first terminal.

[0236] Optionally, the source IP address of the second detection message is the intranet IP address of the second terminal, and the source port number of the second detection message is one of the intranet port numbers of the second terminal. It should be noted that this embodiment does not limit the method for determining the source port number of the second detection message, and it can be specified by the local system of the second terminal.

[0237] Exemplarily, n is determined based on the firewall deployed in the second terminal. It is not recommended that n be set higher than the flow control value set in the second terminal's firewall. The flow control value set in the second terminal's firewall can be determined by testing a large number of packets. For example, n is less than or equal to the maximum number of packets allowed per unit time by the flow control mechanism of the firewall corresponding to the second terminal. Possible values ​​for n include, but are not limited to, 128, 256, and the like.

[0238] Specifically, after receiving the second detection message, the second NAT device establishes a mapping table locally to facilitate subsequent NAT traversal.

[0239] For example, if the mapping table of the second NAT device does not yet have records of the source addresses of the n second detection messages, then a new set of records about the source addresses of the n second detection messages needs to be created in the mapping table, specifically including: recording the source addresses of the n second detection messages in the mapping table, recording the external network port number and external network IP address converted for the source address of each second detection message in the mapping table, and recording the destination address of the second detection message (i.e., the external network address of the first terminal described above). The source addresses of the n second detection messages are different, the external network addresses of the n second detection messages are different, and the destination addresses of the n second detection messages are the same.

[0240] For example, when the second NAT device converts the source addresses of the n second probe messages into external network addresses, it can refer to the current birthday attack algorithm and randomly select an external network port number from the available port numbers of the second NAT device for the external network address of each second probe message; or it can refer to the method (e.g., the binary tree algorithm) used by the first terminal to select the destination port number of the first probe message to select an external network port number for each second probe message. Detailed description is omitted here.

[0241] S660: The first terminal sends a response message to the second terminal.

[0242] Specifically, when the first terminal receives at least one second detection message, it replies with a response message. After the second terminal receives the response message, the traversal is successful. Otherwise, the above steps S610 to S660 are retried to re-execute NAT traversal.

[0243] Illustratively, after NAT traversal is successfully established, heartbeat messages will be sent periodically to maintain the connectivity of the current link.

[0244] In the NAT traversal method shown in Figure 6, when the first terminal determines the destination port number of each first detection message in the multiple first detection messages to be sent, it determines it based on the sending order of the first detection messages, instead of randomly selecting a port number from the port set as the destination port number of the first detection message. Since the port allocation rule of the NAT device is not necessarily random, most NAT devices will follow a certain hash rule to allocate port rules. Therefore, when sending the first detection message, the destination port number of the first detection message is determined according to certain rules. Compared with randomly selecting a port number from the port set, the success rate of NAT traversal can be improved while reducing the number of detection message packets.

[0245] To facilitate understanding, the NAT traversal process shown in FIG6 is described with reference to a specific example.

[0246] Example 1:

[0247] Step 1: The first terminal obtains the external IP address of the second terminal.

[0248] For example, the external network IP address of the second terminal obtained by the first terminal is 210.15.27.166.

[0249] Step 2: The first terminal determines the destination port number of the first probe message to be sent.

[0250] For example, the number of first detection messages to be sent by the first terminal is 512. The destination port numbers of the first detection messages are respectively: x1, x2, x3 . . . xm.

[0251] Step 3: The first terminal sends m first detection messages to the first NAT device.

[0252] Step 4: The first NAT device establishes a mapping table.

[0253] For example, the mapping table established by the first NAT device is shown in the following table:

[0254] Step 5: The first terminal sends a second notification message.

[0255] Step 6: The second terminal obtains the external network address of the first terminal.

[0256] For example, the external network address of the first terminal is 210.21.12.140:2000. It should be understood that step 6 can be performed simultaneously with step 1, after step 5, or before step 3, and there is no limitation on the order of the steps.

[0257] Step 7: The second terminal sends n second detection messages.

[0258] Step 8: The second NAT device establishes a mapping table.

[0259] Specifically, the second NAT device converts the source addresses of the n second detection messages into n external network addresses.

[0260] For example, the mapping table established by the first NAT device is shown in the following table:

[0261] Step 9: The first NAT device forwards the second detection message #3 to the first terminal.

[0262] For example, the external network address of the third second detection message (eg, second detection message #3) sent by the second terminal is recorded in the mapping table of the first NAT device, and the first NAT device can forward the second detection message #3 to the first terminal.

[0263] Step 10: The first terminal replies with a response message.

[0264] After successfully receiving a second detection message, the first terminal may inform, through a response message, that the second detection message sent by the second terminal has been received.

[0265] For example, the destination address of the reply message is 210.21.12.140:x.

[0266] Step 11: The second terminal receives the response message, and NAT traversal is successful.

[0267] From the above, it can be seen that the first terminal can determine the destination port number of the first detection message from the available port number of the second NAT device based on the binary tree algorithm. The following is combined with (b) in Figure 7 to illustrate the process of the first terminal determining the destination port number of the first detection message from the available port number of the second NAT device based on the binary tree algorithm.

[0268] FIG7( b ) is a schematic flowchart of determining the destination port number of the first probe message based on a binary tree algorithm according to an embodiment of the present application, including the following steps:

[0269] S710: Randomly select a first port number from available port numbers of a second NAT device.

[0270] Exemplarily, the available port numbers of the second NAT device are (1025, 65535), where (1025, 65535) can be understood as a common port range for NAT in the industry.

[0271] It should be understood that the available port number of the second NAT device in this application is not limited and can be any known port set. If the common port range of NAT is a range other than (1025, 65535), the available port number of the second NAT device involved in the embodiment of this application can be adaptively modified.

[0272] For the convenience of description, the following description is given by taking the available port number of the second NAT device as (1025, 65535) as an example.

[0273] For example, the first terminal randomly selects a port number between (1025, 65535) as the first port number. The first port number can be denoted as C.

[0274] Furthermore, the first terminal can determine the destination port number of each first detection message in the m first detection messages based on the first port number. For the sake of convenience of description, taking the determination of the destination port number of the i-th first detection message in the m first detection messages as an example, the value of i is greater than or equal to 1 and less than or equal to m.

[0275] S720: Determine a port number serving as a root node of a binary tree according to a maximum port number and a minimum port number among the available port numbers of the second NAT device.

[0276] Specifically, MiddleVal=(65535+1025) / 2, where MiddleVal represents the root node of the binary tree.

[0277] It should be noted that the above step S720 may not be performed, and the first port number randomly selected in step S710 may be used as the root node of the binary tree.

[0278] S730: Determine the depth of the binary tree corresponding to the first detection message.

[0279] Specifically, Depth i =[log2(i+1)], where Depth i Indicates the depth of the binary tree corresponding to the i-th first detection message, or Depth i Indicates the number of binary tree layers corresponding to the i-th first detection message.

[0280] S740 , determining a starting value, an interval step, and an index value according to the depth of the binary tree and the root node.

[0281] Among them, the starting value represents the first node value in the binary tree layer (e.g., the first layer) corresponding to the i-th first detection message; the interval step represents the difference between two adjacent node values ​​in the binary tree layer corresponding to the i-th first detection message; and the index value represents the index of the first node value in the binary tree layer corresponding to the i-th first detection message.

[0282] Specifically, DepthStartPoint i =MiddleVal / (pow(2,Depth i ), where DepthStartPoint i Indicates the starting value;

[0283] DepthStepLen i =MiddleVal / (pow(2,Depth i -1)), where DepthStepLen i Indicates the interval step length;

[0284] StartLeaveInLevel i =pow(2,Depth i )-1, where StartLeaveInLevel i Indicates the index value.

[0285] S750: Determine a second port number corresponding to the first detection message according to the starting value, the sending order of the first detection message, the index value, and the interval step.

[0286] Specifically, Index i =DepthStartPoint i +(i-StartLeaveInLevel i )*DepthStepLen i , where Index i Indicates the second port number corresponding to the i-th first detection message.

[0287] Since the starting value, index value and interval step are all determined based on the sending order of the first probe message (such as i) and the root node, and the root node can be randomly selected or an intermediate port number of the available port numbers of the second NAT device, that is, the root node is the same for m first probe messages, the second port number corresponding to the first probe message can be understood as a value related to the sending order of the first probe message.

[0288] S760: Determine the destination port number of the first detection message according to the second port number and the first port number corresponding to the first detection message.

[0289] Specifically, port i = index i +C, where port i represents the destination port number of the i-th first detection message.

[0290] Alternatively, if the above-mentioned MiddleVal is the randomly selected first port number, the second port number corresponding to the first detection message is determined according to the first port number, that is, port i = index i .

[0291] It should be understood that steps S730 to S760 illustrate how to determine the destination port number of the first detection message by taking the example of determining the destination port number of the i-th first detection message. The destination port number of the i+1-th first detection message among the m first detection messages can also be determined through the above steps S730 to S760. Repeat the above steps S730 to S760 until the destination port number of each first detection message in the m first detection messages is determined.

[0292] For example, the different steps in the embodiment shown in FIG6 can be implemented by different functional modules in the terminal device. For ease of understanding, the structure of the terminal device in this embodiment is briefly described in conjunction with FIG8. For example, the structure of the first terminal and the second terminal is shown in FIG8, which is a schematic diagram of the structure of a terminal device provided in an embodiment of the present application.

[0293] As can be seen from FIG8 , the first terminal includes a detection module #1, an algorithm module #1, and a communication module #1; and the second terminal includes a detection module #2, an algorithm module #2, and a communication module #2.

[0294] Specifically, the detection module #1 of the first terminal is used to interact with the detection server, and pass the received first NAT type information of the first terminal access, the public IP and port information of the first terminal, and the second NAT type information of the second terminal access, the public IP and port information of the second terminal to the algorithm module #1.

[0295] The algorithm module #1 of the first terminal determines the number of first detection messages to be sent and calculates the destination port number of the first detection message according to the information received from the detection module #1.

[0296] The communication module #1 of the first terminal is used to receive the algorithm parameters of the algorithm module #1 and send a first detection message. At the same time, if a second detection message is received from the second terminal, a response message is sent. In addition, after the NAT traversal is successful, a heartbeat message is sent to maintain the P2P link.

[0297] Specifically, the detection module #2 of the second terminal is used to interact with the detection server, and pass the received second NAT type information accessed by the second terminal, the public IP and port information of the second terminal, and the first NAT type information accessed by the first terminal, the public IP and port information of the first terminal to the algorithm module #2.

[0298] The algorithm module #2 of the second terminal determines the number of second detection messages to be sent and the destination port number of the second detection message according to the information received from the detection module #2.

[0299] The communication module #2 of the second terminal is used to receive the parameters of the algorithm module #2, send a second detection message, and receive a response message. In addition, when the NAT traversal is successful, a heartbeat message is sent to maintain the P2P link.

[0300] For ease of understanding, the differences between the NAT traversal method shown in FIG6 and the traditional birthday attack algorithm are briefly described in conjunction with FIG9. FIG9 is a schematic diagram of the application effect of a NAT traversal method provided in an embodiment of the present application.

[0301] For cone-shaped and symmetric NAT traversal scenarios, where the number of packets sent on the symmetric side, n, is set to 128, the traversal success rates of the two algorithms are calculated by varying the number of packets sent on the cone side, m. Figure 9 shows that, with the same number of packets, m and n, the NAT traversal success rate based on the binary tree algorithm for determining the destination port number of the probe packet is significantly higher than that of the traditional birthday attack algorithm. Furthermore, the binary tree algorithm can achieve successful NAT traversal with fewer packets.

[0302] The method for determining the destination port of the detection message in the present application can be applied to communication applications (such as audio and video call APPs, APPs for large file transfers). The relevant program product can be provided by the APP itself, or provided to the APP by a third party, or called by the APP from the system (that is, the product can be deployed in the system). For example, before executing NAT traversal, the APP calls relevant program instructions from the system by obtaining signaling to achieve NAT traversal.

[0303] It should be understood that the size of the serial numbers of the above processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0304] It should also be understood that, in the various embodiments of the present application, unless otherwise specified or logically conflicting, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships. For example, the above embodiment mainly introduces that the first NAT device corresponding to the first terminal is a cone-type NAT device, and the second NAT device corresponding to the second terminal is a symmetric NAT device. When the first NAT device is also a symmetric NAT device, when the second terminal sends n second probe messages, a binary tree algorithm can also be used to determine the destination port number of the second probe message. The specific determination method is similar to the method in which the first terminal determines the destination port number of the first probe message, and will not be repeated here.

[0305] It should also be understood that in some of the above embodiments, the devices in the existing network architecture are mainly used as examples for illustrative description (such as terminal devices, etc.), and it should be understood that the embodiments of the present application are not limited to the specific form of the devices. For example, devices that can achieve the same functions in the future are applicable to the embodiments of the present application.

[0306] It is understandable that in the above-mentioned various method embodiments, the methods and operations implemented by devices (such as the first terminal, the second terminal, etc.) can also be implemented by components of the devices (such as chips or circuits).

[0307] The NAT traversal method provided in the embodiments of the present application is described in detail above, in conjunction with FIG6 . The NAT traversal method described above is primarily described from the perspective of the interaction between a first terminal and a second terminal. It is understood that, in order to implement the aforementioned functions, the first terminal and the second terminal include hardware structures and / or software modules corresponding to the respective functions.

[0308] Those skilled in the art should be aware that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is performed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0309] The following describes in detail the NAT traversal apparatus provided in the embodiments of the present application in conjunction with Figures 10 and 11. It should be understood that the description of the apparatus embodiment corresponds to the description of the method embodiment. Therefore, for matters not described in detail, please refer to the method embodiment above. For the sake of brevity, some contents will not be repeated.

[0310] In the embodiment of the present application, the functional modules of the transmitting device or the receiving device can be divided according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation. The following is an example of dividing each functional module according to each function.

[0311] Figure 10 is a schematic block diagram of an apparatus 1000 provided in an embodiment of the present application. The apparatus 1000 includes an acquisition module 1010, a processing module 1020, and a sending module 1030. The apparatus 1000 may also include a receiving module. The receiving module and the sending module 1030 are transceiver modules. The transceiver modules can implement corresponding communication functions, and the processing module 1020 is used for data processing. The transceiver module may also be referred to as a communication interface or a communication unit.

[0312] The acquisition module 1010 may be implemented by a transceiver module, or may be implemented by a processing module 1020 and a transceiver module.

[0313] Optionally, the device 1000 may further include a storage module, which may be used to store instructions and / or data. The processing module 1020 may read the instructions and / or data in the storage module so that the device implements the aforementioned method embodiment.

[0314] As a design, the device 1000 is used to execute the actions performed by the first terminal in the above method embodiment.

[0315] An acquisition module 1010 is configured to acquire an IP address of the second terminal in the network;

[0316] The processing module 1020 is configured to determine a destination port number of each of the plurality of probe messages according to a sending order of the plurality of probe messages;

[0317] The sending module 1030 is configured to send the multiple detection messages through the first NAT device, where the destination address of each of the detection messages includes a corresponding destination port number and the IP address.

[0318] The device 1000 can be used to execute the actions performed by the first terminal in the above method embodiment. In this case, the device 1000 can be a device or a component that can be configured on the first terminal. The transceiver module is used to execute the transceiver-related operations of the first terminal in the above method embodiment, and the processing module 1020 is used to execute the processing-related operations of the first terminal in the above method embodiment.

[0319] When the device 1000 is used to execute the method in FIG6 , the transceiver module can be used to execute the transceiver steps in the method, such as steps S630 , S640 , S650 , and S660 ; the processing module 1020 can be used to execute the processing steps in the method, such as step S620 .

[0320] When the apparatus 1000 is used to execute the method (b) in FIG. 7 , the transceiver module may be used to execute the transceiver steps in the method; the processing module 1020 may be used to execute the processing steps in the method, such as steps S710 to S760.

[0321] It should be understood that the specific process of each module executing the above corresponding steps has been described in detail in the above method embodiment, and for the sake of brevity, it will not be repeated here.

[0322] As shown in FIG11 , an embodiment of the present application further provides an apparatus 1100. The apparatus 1100 includes a processor 1111 and may further include one or more memories 1120. The processor 1110 is coupled to the memory 1120. The memory 1120 is configured to store computer programs, instructions, and / or data. The processor 1110 is configured to execute the computer programs, instructions, and / or data stored in the memory 1120, thereby executing the method in the above method embodiment.

[0323] Optionally, the device 1100 includes one or more processors 1110.

[0324] Optionally, the memory 1120 may be integrated with the processor 1110 or provided separately.

[0325] Optionally, as shown in Figure 11 , the apparatus 1100 may further include a transceiver 1130, which is configured to receive and / or transmit signals. For example, the processor 1110 is configured to control the transceiver 1130 to receive and / or transmit signals.

[0326] As a solution, the device 1100 is used to implement the operations performed by the first terminal in the above method embodiment.

[0327] For example, the processor 1110 is configured to execute a computer program or instruction stored in the memory 1020 to implement the relevant operations of the first terminal in each of the above method embodiments. For example, the method performed by the first terminal in the embodiment shown in FIG6 , or the method performed by the first terminal in the embodiment shown in FIG7 (b).

[0328] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0329] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory and / or a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM). For example, RAM can be used as an external cache. By way of example and not limitation, RAM includes the following forms: static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0330] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0331] It should also be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0332] As shown in FIG12 , an embodiment of the present application provides a chip system 1200 . The chip system 1200 (or also referred to as a processing system) includes a logic circuit 1210 and an input / output interface 1220 .

[0333] Logic circuit 1210 may be a processing circuit within chip system 1200. Logic circuit 1210 may be coupled to a storage unit and invoke instructions within the storage unit, enabling chip system 1200 to implement the methods and functions of various embodiments of the present application. Input / output interface 1220 may be an input / output circuit within chip system 1200, outputting information processed by chip system 1200 or inputting data or signaling information to be processed into chip system 1600 for processing.

[0334] Specifically, for example, if the chip system 1200 is installed in a terminal device, the logic circuit 1210 is coupled to the input / output interface 1220 , and the input / output interface 1220 can input the wake-up signal to the logic circuit 1210 for processing.

[0335] As a solution, the chip system 1200 is used to implement the operations performed by the first terminal in each of the above method embodiments.

[0336] For example, the logic circuit 1210 is used to implement the processing-related operations performed by the first terminal in the above method embodiments, such as the processing-related operations performed by the first terminal in the embodiment shown in FIG6 , or the operations of the first terminal in the embodiment shown in (b) of FIG7 . The input / output interface 1220 is used to implement the sending and / or receiving-related operations performed by the first terminal in the above method embodiments, such as the sending and / or receiving-related operations performed by the first terminal in the embodiment shown in FIG6 .

[0337] An embodiment of the present application further provides a computer-readable storage medium storing computer instructions for implementing the method executed by a device (such as the first terminal) in the above method embodiment.

[0338] For example, when the computer program is executed by a computer, the computer can implement the method performed by the device (such as the first terminal) in the above method embodiment.

[0339] An embodiment of the present application further provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to implement the method executed by a device (such as the first terminal) in the above method embodiment.

[0340] An embodiment of the present application further provides a communication system, which includes the first terminal, the first NAT device, the second terminal, the second NAT device and the detection server in the above embodiment.

[0341] The explanation of the relevant contents and beneficial effects of any of the above-mentioned devices can be referred to the corresponding method embodiments provided above, which will not be repeated here.

[0342] Those skilled in the art will appreciate that the units and steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel may use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of protection of this application.

[0343] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0344] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to implement the solutions provided in this application.

[0345] In addition, each functional unit in each embodiment of the present application may be integrated into one unit, each unit may exist physically separately, or two or more units may be integrated into one unit.

[0346] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. For example, the computer can be a personal computer, a server, or a network device, etc. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)). For example, the aforementioned available medium may include, but is not limited to, various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0347] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for traversing a network address translation (NAT), characterized in that: A method is applied to a first terminal in a communication system, the communication system further comprising a second terminal, the first terminal accessing a network via a first NAT device, and the second terminal accessing the network via a second NAT device, the method comprising: The first terminal obtains the IP address of the second terminal in the network; The first terminal determines the destination port number of each probe message in the multiple probe messages according to the sending order of the multiple probe messages; The first terminal sends the multiple detection messages through the first NAT device, and the destination address of each of the detection messages includes a corresponding destination port number and the IP address.

2. The method according to claim 1, characterized in that The first terminal determines, according to a sending order of the multiple probe messages, a destination port number of each probe message in the multiple probe messages, including: For any one of the multiple probe messages, the first terminal determines the port number corresponding to the probe message from the available port numbers of the second NAT device according to the sending order of the probe message in the multiple probe messages, and the port number corresponding to the probe message is used to determine the destination port number of the probe message.

3. The method according to claim 2, characterized in that The first terminal determines, according to a sending order of the probe message in the plurality of probe messages, a port number corresponding to the probe message from available port numbers of the second NAT device, including: The first terminal determines, according to a sending order of the probe message in the plurality of probe messages, a binary tree depth corresponding to the probe message on a binary tree, where the nodes of the binary tree include available port numbers of the second NAT device; The first terminal determines the port number corresponding to the detection message according to the depth of the binary tree corresponding to the detection message.

4. The method according to claim 3, characterized in that The order in which the detection messages are sent and the depth of the binary tree corresponding to the detection messages satisfy the following relationship: i =[log2(i+1)] The binary tree depth corresponding to the detection message and the port number corresponding to the detection message satisfy the following relationship: Index i =MiddleVal / (pow(2,Depth i ))+(i-(pow(2,Depth i )-1)*MiddleVal / (pow(2, Depth i -1)) Wherein, the i indicates that the detection message is the i-th detection message sent, and the Depth i Indicates the depth of the binary tree corresponding to the detection message, the Index i represents the port number corresponding to the detection message, and the MiddleVal represents the port number of the root node of the binary tree.

5. The method according to claim 3 or 4, characterized in that The method further comprises: The first terminal determines the port number serving as the root node of the binary tree according to the maximum port number and the minimum port number among the available port numbers of the second NAT device.

6. The method according to any one of claims 2 to 5, characterized in that The first terminal determines, according to a sending order of the multiple probe messages, a destination port number of each probe message in the multiple probe messages, including: The first terminal determines the destination port number of the detection message according to the port number corresponding to the detection message and the first port number, The first port number is one of the available port numbers of the second NAT device.

7. The method according to claim 6, characterized in that The first terminal determines the destination port number of the detection message according to the first port number and the port number corresponding to the detection message, including: The first terminal uses the sum of the first port number and the port number corresponding to the detection message as the destination port number of the detection message.

8. The method according to claim 6 or 7, characterized in that The method further comprises: The first terminal selects the first port number from available port numbers of the second NAT device.

9. The method according to claim 8, characterized in that The first terminal selects a first port number from available port numbers of the second NAT device, including: The first terminal randomly selects a port number from available port numbers of the second NAT device as the first port number.

10. The method according to claim 3 or 4, characterized in that The port number corresponding to the detection message is the destination port number of the detection message, and the method further includes: The first terminal randomly selects a port number from the available port numbers of the second NAT device as the root node of the binary tree.

11. The method according to claim 1, wherein The first terminal determines, according to a sending order of the multiple probe messages, a destination port number of each probe message in the multiple probe messages, including: For any one of the multiple probe messages, the first terminal determines, based on a sending order of the probe message in the multiple probe messages and a step size of the destination port number, an increment of the destination port number of the probe message relative to an initial value of the port number; The first terminal determines the destination port number of the detection message according to the initial value of the port number and the incremented value, The initial value of the port number is one of the available port numbers of the second NAT device.

12. The method according to claim 11, characterized in that The order in which the detection messages are sent and the increments corresponding to the detection messages satisfy the following relationship: ADD i =L*i Wherein, the i indicates that the detection message is the i-th detection message sent, and the ADD i represents the increment corresponding to the detection message, and L represents the step size of the destination port number.

13. The method according to any one of claims 1 to 12, characterized in that Before the first terminal determines the destination port number of each of the multiple probe messages according to the sending order of the multiple probe messages, the method further includes: The first terminal obtains information indicating that the first NAT device is a cone NAT device and information indicating that the second NAT device is a symmetric NAT device; After determining that the first NAT device is a cone NAT device and the second NAT device is a symmetric NAT device, a destination port number of each of the multiple probe messages is determined according to a sending order of the multiple probe messages.

14. The method according to any one of claims 1 to 13, characterized in that The number of the multiple detection messages is less than or equal to the maximum number of packets sent per unit time allowed by the firewall flow control mechanism corresponding to the first terminal.

15. The method according to any one of claims 1 to 14, characterized in that The available port numbers of the second NAT device include part or all of port numbers 1025 to 65535.

16. A terminal device, characterized in that: The terminal device is a first terminal in a system in which a first terminal and a second terminal communicate with each other, the first terminal accesses a network through a first NAT device, and the second terminal accesses the network through a second NAT device, and the terminal device includes: an acquisition module, configured to acquire an IP address of the second terminal in the network; A processing module, configured to determine a destination port number of each of the plurality of probe messages according to a sending order of the plurality of probe messages; The sending module is configured to send the plurality of detection messages through the first NAT device, wherein the destination address of each of the detection messages includes a corresponding destination port number and the IP address.

17. The terminal device according to claim 16, characterized in that The processing module determines the destination port number of each probe message in the multiple probe messages according to the sending order of the multiple probe messages, including: the processing module is used to determine, for any probe message in the multiple probe messages, the port number corresponding to the probe message from the available port numbers of the second NAT device according to the sending order of the probe message in the multiple probe messages, and the port number corresponding to the probe message is used to determine the destination port number of the probe message.

18. The terminal device according to claim 17, characterized in that The processing module determines, according to a sending order of the probe message in the plurality of probe messages, a port number corresponding to the probe message from available port numbers of the second NAT device, including: The processing module determines, according to the sending order of the probe message in the plurality of probe messages, a binary tree depth corresponding to the probe message on the binary tree, where the nodes of the binary tree include available port numbers of the second NAT device; The processing module determines the port number corresponding to the detection message according to the binary tree depth corresponding to the detection message.

19. The terminal device according to claim 18, characterized in that The processing module is further configured to determine a port number serving as a root node of the binary tree according to a maximum port number and a minimum port number among available port numbers of the second NAT device.

20. The terminal device according to claim 18 or 19, characterized in that: The processing module determines the destination port number of each of the plurality of probe messages according to the sending order of the plurality of probe messages, including: The processing module determines the destination port number of the detection message using the port number corresponding to the detection message and the first port number, The first port number is one of the available port numbers of the second NAT device.

21. The terminal device according to claim 20, characterized in that The processing module determines the destination port number of the detection message according to the first port number and the port number corresponding to the detection message, including: The processing module uses the sum of the first port number and the port number corresponding to the detection message as the destination port number of the detection message.

22. The terminal device according to claim 20 or 21, characterized in that: The processing module is further configured to select the first port number from available port numbers of the second NAT device.

23. The terminal device according to claim 22, characterized in that The processing module selects a first port number from available port numbers of the second NAT device, including: The processing module randomly selects a port number from available port numbers of the second NAT device as the first port number.

24. The terminal device according to claim 17 or 18, characterized in that: The port number corresponding to the detection message is the destination port number of the detection message, and the processing module is further configured to randomly select a port number from the available port numbers of the second NAT device as the root node of the binary tree.

25. The terminal device according to claim 16, characterized in that The processing module determines the destination port number of each of the plurality of probe messages according to the sending order of the plurality of probe messages, including: For any one of the multiple probe messages, the processing module determines, based on a sending order of the probe message in the multiple probe messages and a step size of the destination port number, an increment of the destination port number of the probe message relative to an initial value of the port number; The processing module determines the destination port number of the detection message according to the initial value of the port number and the incremented value. The initial value of the port number is one of the available port numbers of the second NAT device.

26. The terminal device according to any one of claims 16 to 25, characterized in that: Before the processing module determines the destination port number of each of the multiple probe messages according to the sending order of the multiple probe messages, the obtaining module is further configured to obtain information indicating that the first NAT device is a cone NAT device and information indicating that the second NAT device is a symmetric NAT device; After determining that the first NAT device is a cone NAT device and the second NAT device is a symmetric NAT device, the processing module determines a destination port number of each of the multiple probe messages according to a sending order of the multiple probe messages.

27. A communication device, characterized in that: The communication device includes at least one processor and a communication interface, where the communication interface is used for the communication device to exchange information with other communication devices. When program instructions are executed in the at least one processor, the communication device implements the method according to any one of claims 1 to 14.

28. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions. When the computer instructions are executed on a computer, the method according to any one of claims 1 to 10 is executed.

Images