A method for implementing NAT on a core network UPF network element

Abstract

The application relates to a method for implementing NAT on a core network UPF network element, when a user terminal establishes a 5G session, the UPF pre-allocates a public network IPv4 address and a continuous source port set for the session, the number of ports is dynamically adjusted according to a user package, and resources are bound to a session data structure; based on a private network to public network mapping relationship, a downlink packet with a public network IP as a destination address is received, a session-level hash table is located through a flow label direct indexing mechanism, a GTP-U packet header is added after reverse NAT conversion, and the packet is forwarded to a mobile phone after service processing; based on the flow label direct indexing mechanism, each session exclusively occupies an IP port pool and a hash table through a session-level resource isolation architecture, and combined with multi-core CPU parallel processing, global lock competition is avoided; based on a DPI function switch strategy, a NAT mapping table is synchronized through a UPF cluster session mirroring mechanism for node fault switching zero packet loss.

Description

Technical Field

[0001] This application relates to the field of wireless communication network technology, and specifically to a method for implementing NAT on a core network UPF element. Background Technology

[0002] Due to the scarcity of public IPv4 addresses, ISPs often use NAT technology when providing internet access services to end users. The IPv4 address assigned to the user's terminal device is a private network address within the ISP's network. This address is then translated into a public IPv4 address by the NAT device to access the internet (servers on the internet require public IPv4 addresses to communicate with each other). This allows ISPs to provide services to more users with fewer public IPv4 addresses (by reusing the same source IP address but different source ports).

[0003] The drawbacks of existing technology are: it requires a separate CGNAT device to perform address translation services, which has high requirements for performance forwarding and processing capabilities (with millions of concurrent users), and operators need to make additional investments to purchase this server and hardware resources. (Note: NAT: Address Translation Protocol; CGNAT: Carrier-Grade NAT; UPF: 5G Core Network Data Plane Functional Element; DPI: Deep Packet Inspection.)

[0004] The solution proposed by this invention to address the shortcomings of the prior art is to integrate the NAT function within the UPF of the 5G core network data plane, directly implementing the IPv4 address translation function within the UPF. This simplifies the network structure, saves operators additional CGNAT equipment investment, and fully utilizes the UPF's data plane forwarding logic, reducing the computational overhead and network relay latency required for address translation. Summary of the Invention

[0005] To address the problems existing in the prior art, this application aims to provide a method for implementing NAT on the core network UPF element.

[0006] The method for implementing NAT on a core network UPF element as described in this application includes the following steps:

[0007] Step S101: When a user terminal establishes a 5G session, the UPF pre-allocates a public IPv4 address and a set of continuous source ports for the session. The number of ports is dynamically adjusted according to the user's package, and the resources are bound to the session data structure.

[0008] Step S102: Based on the session data structure, receive the uplink data packet from the mobile phone, strip the GTP-U packet header and perform service processing. Complete DPI detection and NAT mapping through a single joint table lookup operation, specifically including: querying the session-level hash table with the data stream 5-tuple as the key; if it is a new flow, the DPI module inserts the flow record; the NAT module selects a port from the pre-allocated port pool and records the private network to public network mapping relationship; and forwards it to the Internet after performing NAT conversion.

[0009] Step S103: Based on the private network to public network mapping relationship, receive downlink packets with a destination address of public IP, locate the session-level hash table through the flow label direct indexing mechanism, add a GTP-U packet header after reverse NAT conversion, and forward to the mobile phone after service processing;

[0010] Step S104: Based on the flow label direct indexing mechanism, each session has exclusive access to the IP port pool and hash table through a session-level resource isolation architecture, combined with multi-core CPU parallel processing, to avoid global lock contention.

[0011] Step S105: Based on the session-level resource isolation architecture, the uplink packet completes the DPI record and NAT mapping through a single table lookup synchronization mechanism, and the downlink packet obtains the mapping relationship using the flow label direct index, and supports the DPI function switch strategy for flexible table lookup mode.

[0012] Step S106: Based on the DPI function switch strategy, the NAT mapping table is synchronized through the UPF cluster session mirroring mechanism to achieve zero packet loss during node failure switching.

[0013] Preferably, in step S101, when a user terminal establishes a 5G session, the UPF pre-allocates a public IPv4 address and a continuous set of source ports for the session. The number of ports is dynamically adjusted according to the user's package, and the resources are bound to the session data structure, including:

[0014] Parse the session request to obtain the user identifier and package type, determine the initial parameters and required port range. If the range exceeds the limit, process the port group in segments and update the parameters. Dynamically adjust the relationship between the public network address and the port group, generate a pre-configuration scheme, extract continuous address ports and bind them to the session, detect resource conflicts and reallocate them, and finally update and store the session state.

[0015] Preferably, in step S102, based on the session data structure, after receiving the uplink data packet from the mobile phone and stripping the GTP-U header, service processing is performed, and DPI detection and NAT mapping are completed through a single joint table lookup operation, including:

[0016] Receive and parse uplink data packets from the mobile phone; if the session is known, index the session structure.

[0017] Otherwise, create a new stream, retrieve the session configuration via a hash table, and use a support vector machine for depthwise data stream inspection.

[0018] If an error occurs, it is marked; if it is normal, it proceeds to address translation, allocates a port from the port pool, records the mapping relationship and translates the address, forwards data packets, updates the session state and synchronizes it into the database.

[0019] Preferably, in step S103, based on the private network to public network mapping relationship, a downlink packet with a destination address of public IP is received, the session-level hash table is located through the flow label direct indexing mechanism, a GTP-U packet header is added after reverse NAT translation, and the packet is forwarded to the mobile phone after service processing, including:

[0020] It receives downlink data packets from the public network and verifies their format. It matches the session hash table using the flow tag index to obtain the session context, performs reverse address translation (public network to private network), adds and verifies the GTP-U packet header to complete encapsulation, classifies and sorts the data stream, and sends it to the mobile phone via the forwarding terminal. After delivery, it updates the session status.

[0021] Preferably, in step S104, based on the flow label direct indexing mechanism, a session-level resource isolation architecture is used to ensure that each session has exclusive access to the IP port pool and hash table, combined with multi-core CPU parallel processing, to avoid global lock contention, including:

[0022] The data packet session affiliation is identified by the flow label, and the corresponding IP port pool is directed to the hash table to locate the session record. The context is extracted, and the data is allocated to an independent processing unit through resource isolation. The data stream is then processed by multi-core CPUs. After processing, the fragments are reassembled to the IP port through the pool allocation mechanism. The global lock status is checked, and if there is no conflict, the scheduling is completed.

[0023] Preferably, in step S105, based on the session-level resource isolation architecture, the uplink packet completes the DPI record and NAT mapping through a single table lookup synchronization mechanism, and the downlink packet obtains the mapping relationship using the flow label direct index, and supports a DPI function switch strategy for flexible table lookup mode, including:

[0024] Data streams are classified through a session isolation mechanism. If they meet the rules, they are assigned to isolation units. Resource allocation is directed to processing units and consistency is verified. Uplink data undergoes a single deep table lookup for detection. If features match, the mapping address is associated. Downlink data uses stream labels to quickly locate the mapping relationship. If a match is found, the lookup mode is dynamically adjusted. The detection and transformation results are integrated. Processing is complete when the data stream status is intact.

[0025] Preferably, in step S106, based on the DPI function switch policy, the NAT mapping table is synchronized through the UPF cluster session mirroring mechanism for zero packet loss during node failover, including:

[0026] The network address translation mapping table is synchronized and verified in real time through session mirroring. During node failover, the data stream is backed up and confirmed. Deep packet inspection analyzes traffic characteristics, dynamically adjusts processing paths, redirects data streams and verifies them during failover, updates the mapping table and confirms them, and monitors data streams to ensure continuous protection during failover.

[0027] The method for implementing NAT on a core network UPF element described in this application has the following advantages: It combines 5G service processing and forwarding schemes within the UPF element to achieve NAT functionality, providing more efficient processing capabilities than simply adding a NAT device or module. This also reduces network latency, optimizes the network structure, utilizes multi-core CPU concurrent processing, and ensures lock-free operation for each data packet, improving performance. Furthermore, it embeds NAT functionality data into the mobile user session data structure, pre-allocating public IP addresses and source ports for each user, reducing the size of the NAT mapping table, lowering lookup overhead, and improving performance. Finally, it embeds NAT translation functionality within the UPF data service, operating through direct function calls, reducing network forwarding overhead and latency. Attached Figure Description

[0028] Figure 1 This application describes a method for implementing NAT on a core network UPF element. Figure 1 ;

[0029] Figure 2 This application describes a method for implementing NAT on a core network UPF element. Figure 2 . Detailed Implementation

[0030] like Figures 1-2 As shown, the method for implementing NAT on a core network UPF element according to this application includes the following steps:

[0031] like Figures 1-2 As shown, in step S101, when a user terminal establishes a 5G session, the UPF pre-allocates a public IPv4 address and a set of continuous source ports for the session. The number of ports is dynamically adjusted according to the user's package, and the resources are bound to the session data structure.

[0032] Further, in step S101, when a session is initiated through the user terminal, session request information is obtained, and the user identifier and package type information contained therein are parsed to obtain preliminary session parameter configuration;

[0033] Based on the initial session parameter configuration, combined with the mapping relationship between package type and port quantity, the required source port group size is calculated using preset rules, and the range of allocated port quantity is determined.

[0034] If the calculated number of ports exceeds the preset threshold, the source port group is segmented, the segmented port set is obtained, and the session parameter configuration is updated.

[0035] Based on the updated session parameter configuration, the mapping relationship between public network addresses and source port groups is dynamically adjusted to generate an address pre-configuration scheme and obtain resource allocation results;

[0036] Extract a contiguous set of public network addresses and ports from the resource allocation results and bind it to the session data structure to form a session binding record;

[0037] Based on the session binding record, the resource occupancy status in the data structure is checked. If a resource conflict is found, the resource reallocation process is triggered to determine the final resource binding status.

[0038] By updating the user terminal's session state information based on the final resource binding state, the storage and synchronization of session data structures are completed.

[0039] Specifically, in step S101, during the process of establishing a 5G session at the user terminal, the system will realize resource allocation and management through a series of automated processes;

[0040] First, when a user terminal initiates a session request, the Session Management Function (SMF) of the core network will query the user's subscription data from the database based on the user's identifier and package information. Assuming the user's package is a premium package with 50GB of data per month, the system will automatically determine that a public IPv4 address and a large set of source ports need to be allocated, for example, the address is allocated as 203.0.113.5, and the reserved port range is 1024 to 2048, a total of 1024 ports. This range is calculated by an algorithm based on the package level. The formula is: Number of ports = Basic port 512 + Package level coefficient × 256, where the premium package level coefficient is 2. The calculation result is 512 + 2 × 256 = 1024 ports.

[0041] Next, the UPF (User Plane Function) binds the IP address and port set to the session data structure. Specifically, it uses a hash algorithm to map the user session ID (e.g., session ID 12345678) to IP and port resources. The hash function is hash(ID) = ID mod 65536, ensuring the uniqueness of resource allocation and fast retrieval. At the same time, a record is created in memory, containing the session ID, IP address, port range, and timestamp (e.g., 2023-10-01 10:00:00), so that resources can be quickly located during subsequent session management.

[0042] In addition, the system dynamically adjusts port allocation based on network load. If the current UPF load exceeds 80%, some port allocation requests are forwarded to the backup UPF through a load balancing algorithm. Assuming the primary UPF has a processing capacity of 10,000 sessions and has currently processed 8,000 sessions with a load rate of 80%, the system will automatically trigger the backup UPF to take over the resource allocation for new sessions, ensuring service continuity. The analysis shows that this dynamic adjustment mechanism can reduce the resource allocation failure rate from 5% to 1%, significantly improving system stability.

[0043] Finally, after resource binding is completed, the system will record the allocation details through logs and report the allocation results to SMF, forming a closed-loop management system to ensure the traceability of resource usage during session establishment. For example, the log recording format is "Session ID: 12345678, IP: 203.0.113.5, Port range: 1024-2048, Allocation time: 2023-10-01 10:00:00", providing data support for subsequent troubleshooting.

[0044] like Figures 1-2 As shown, in step S102, based on the session data structure, the uplink data packet from the mobile phone is received, and after stripping the GTP-U packet header, service processing is performed. DPI detection and NAT mapping are completed through a single joint table lookup operation, specifically including: querying the session-level hash table with the data flow 5-tuple as the key; if it is a new flow, the DPI module inserts the flow record; the NAT module selects a port from the pre-allocated port pool and records the private network to public network mapping relationship; and after performing NAT conversion, it forwards the data to the Internet.

[0045] Furthermore, in step S102, the uplink data receiving module of the mobile phone obtains data packets from the terminal, performs preliminary parsing on the received data packets, and obtains basic information about the data stream;

[0046] Based on the basic information of the data stream obtained from the initial parsing, the data packets are classified according to preset rules to determine whether the data packets belong to a known session. If they belong to a known session, they directly proceed to the subsequent mapping process.

[0047] If it does not belong to a known session, add a new stream record and determine the processing path of the new stream;

[0048] For basic information about data streams in new stream records or known sessions, a session-level hash table is used for fast indexing to obtain the corresponding session data structure and configuration information that matches the data stream.

[0049] Based on the obtained session data structure configuration information, perform deep packet inspection, use support vector machine algorithm to extract features from the data stream content, determine whether the data packets have abnormal features, and mark them as data streams to be processed if abnormal features are found.

[0050] If no abnormalities are found, proceed with the address translation process;

[0051] For data streams marked as pending processing or without abnormal characteristics, the network address translation module selects available ports from the pre-allocated port pool, records the mapping relationship from private network to public network, and obtains the translated address information.

[0052] Based on the converted address information, the data packet forwarding operation is performed, and the processed data packet is forwarded to the target address via the Internet to complete the data stream transmission process;

[0053] For the forwarded data stream, update the state information in the session data structure, and store the updated state information in the database through a synchronization mechanism to obtain the final session record.

[0054] Specifically, in step S102, during the processing of uplink data packets from the mobile phone, the system first receives data packets from the user terminal. Assuming the five-tuple information of the data packet is source IP address 192.168.1.10, source port 5000, destination IP address 8.8.8.8, destination port 53, and protocol type UDP, the system then automatically strips the GTP-U header and extracts the payload data. The stripping process involves parsing the GTP-U header fields, obtaining the tunnel identifier TEID value of 987654, and forwarding the payload to the service processing module.

[0055] Next, the system uses the 5-tuple as the index key and calculates the query session-level hash table using a hash algorithm. The hash function uses a simple modulo method, that is, hash(key) = source IP + source port + destination IP + destination port + protocol mod 1024. The calculation result is the index value 256. The system uses this index to look up the corresponding session record in the hash table.

[0056] If the data stream is found to be a new stream, the DPI module will automatically insert a stream record. The record includes the five-tuple information and the initial timestamp 2023-10-02 14:30:00. At the same time, the data packet content is analyzed to identify the application type as a DNS query, which occupies about 0.5KB of memory space. The identification result is stored in the stream table for subsequent fast matching.

[0057] Meanwhile, the NAT module selects an available port from the pre-allocated port pool. Assuming the port pool ranges from 3000 to 4000, and port 3001 is currently selected, a mapping relationship is established between the private IP address 192.168.1.10 and the public IP address 198.51.100.7. The port mapping is from 5000 to 3001. The mapping record is stored in the NAT table, with an entry size of 1KB. System analysis shows that a single mapping takes approximately 0.002 seconds.

[0058] Subsequently, the system performs NAT translation, replacing the source IP and source port of the data packet with the public IP and mapped port, generating a new data packet, and looking up the next hop address through the routing table. Assuming the next hop is the gateway IP address 198.51.100.1, the data packet is finally forwarded to the Internet, completing the entire processing flow.

[0059] The above process achieves seamless integration of DPI detection and NAT mapping through joint table lookup operations, ensuring the continuity of data stream processing.

[0060] like Figures 1-2 As shown, in step S103, based on the private network to public network mapping relationship, a downlink packet with a destination address of public IP is received, the session-level hash table is located through the flow label direct indexing mechanism, a GTP-U packet header is added after reverse NAT conversion, and the packet is forwarded to the mobile phone after service processing.

[0061] Further, in step S103, the downlink data packets from the public network address are captured by the data receiving module, the basic information of the data packets is parsed, and it is determined whether the data packets meet the preset format requirements. If they meet the format requirements, the subsequent positioning process is entered to obtain the preliminary parsing results.

[0062] Based on the preliminary analysis results, a flow label indexing mechanism is used to quickly match downlink data packets and locate the corresponding record in the session hash table. If the match is successful, session-related information is obtained to determine the session context of the data packet.

[0063] For the obtained session context, a reverse conversion operation is performed to restore the public network address to the private network address based on the network address mapping relationship, and obtain the converted address information;

[0064] The header addition module constructs a GTP-U header for the converted address information and appends it to the data packet. It then checks whether the header is appended correctly. If it is appended correctly, the data packet encapsulation process is completed, and the encapsulated data stream is obtained.

[0065] Based on the encapsulated data stream, execute the business processing flow, call the preset rules to classify and prioritize the data stream, and obtain the status of the processed data stream;

[0066] Based on the processed data stream status, the data packet is sent to the mobile terminal through the forwarding terminal module. It is then determined whether the data packet was successfully delivered. If it was successfully delivered, the status record in the session hash table is updated, and the downlink data packet transmission process is completed.

[0067] Specifically, in step S103, during the processing of downlink data packets, the system first receives a data packet from the Internet. Assuming the destination IP address of the data packet is a public IP 203.0.113.5, the destination port is 4500, the source IP address is 172.16.254.1, the source port is 8080, and the protocol type is TCP, the system parses the data packet header through an automated process, extracts the five-tuple information, records the receiving timestamp as 2023-11-01 09:15:30, analyzes the data packet size as 1.2KB, confirms that it is valid data, and then proceeds to the next step of processing.

[0068] Next, the system uses the flow tag direct indexing mechanism, with the destination IP and destination port as the core fields, and calculates the index value using a hash algorithm. Assuming the hash function is hash(key) = destination IP + destination port mod 2048, the calculated result is the index value 512. The system quickly locates the corresponding record in the session-level hash table based on this index. The query takes about 0.001 seconds. The mapping relationship stored in the table shows that the public IP 203.0.113.5 and port 4500 correspond to the private IP 10.0.0.15 and port 6000.

[0069] Subsequently, the system performs reverse NAT translation, replacing the destination IP and destination port of the data packet with the private network IP 10.0.0.15 and port 6000. The translation process involves verifying the integrity of the mapping table to ensure that no data is lost. Analysis shows that the translation takes about 0.003 seconds, and the size of the generated new data packet is still 1.2KB.

[0070] Next, the system adds a GTP-U header to the data packet, automatically generates a tunnel identifier TEID value of 1234567, calculates a checksum of 0x5A3F during the encapsulation process to ensure data integrity, and increases the data packet size to 1.3KB after encapsulation.

[0071] Finally, the system queries the routing information through the business processing module and determines that the next hop is the base station IP address 10.0.0.1. The data packet is sent to the mobile terminal through the internal forwarding mechanism. The sending process is logged, and the analysis shows that the forwarding delay is 0.005 seconds. The entire process is completed by an automated system to ensure seamless transmission of data packets from the public network to the private network. At the same time, the associated business module updates the traffic statistics and records that the downlink data volume this time is 1.3KB for subsequent network optimization analysis.

[0072] like Figures 1-2 As shown, in step S104, based on the flow label direct indexing mechanism, each session has exclusive access to the IP port pool and hash table through a session-level resource isolation architecture, combined with multi-core CPU parallel processing, to avoid global lock contention.

[0073] Furthermore, in step S104, the session ownership information of the data packet is obtained through the identification function of the flow tag, and it is determined whether the data packet belongs to the allocated session-level resource. If it belongs to the allocated resource, it is directed to the corresponding IP port pool to obtain the data flow of the preliminary classification.

[0074] Based on the preliminary classification of the data stream, the session record in the hash table is quickly located using a direct indexing method. If the record exists, the session-level context information is extracted to determine the processing path of the data stream.

[0075] Based on the extracted session-level context information, the data stream is allocated to an independent processing unit through a resource isolation architecture. The allocation is then determined to be successful. If successful, the resource status after allocation is obtained.

[0076] Based on the allocated resource status, the parallel processing capability of the multi-core CPU is invoked to segment the data stream, and the processing is determined to be complete. If complete, the processed data segment is obtained.

[0077] By processing the data fragments and combining them with the pool allocation mechanism, the data flow is re-integrated to the corresponding IP port. It is then determined whether the integration is consistent. If it is consistent, the direction of the integrated data flow is determined.

[0078] The system obtains the integrated data flow direction, adopts a competition avoidance strategy, detects the state of the global lock, and determines whether there is a conflict. If there is no conflict, the final scheduling of the data flow is completed.

[0079] Specifically, in step S104, in the field of network data processing, the system achieves efficient session management through the flow label direct indexing mechanism, and optimizes resource allocation and performance by combining session-level resource isolation architecture and multi-core CPU parallel processing.

[0080] The system first allocates an independent IP port pool for each session. Assuming a session is assigned a public IP of 192.168.100.10, with a port range of 5000 to 5100 and a port pool size of 100, the system calculates the port utilization rate through an automated allocation algorithm. The analysis shows that the current utilization rate is 30%, with 70 ports remaining, ensuring sufficient resources.

[0081] Subsequently, the system constructs an independent hash table for each session. Assuming the hash table has a capacity of 1024 records, the hash function hash(key) = source IP + source port mod 1024 is used to calculate the index value of a certain data stream as 256. The system automatically stores the relevant information of the data stream in the corresponding location, with a storage time of 0.002 seconds. Analysis shows that the hash collision rate is 1.5%. Collisions are resolved by chaining to ensure data accuracy.

[0082] Next, the system uses a session-level resource isolation architecture to distribute the processing tasks of different sessions to different cores of a multi-core CPU. Assuming the system has 8 CPU cores, a session is assigned to core 3, and the processing thread priority is set to high. The system detects that the load rate of core 3 is 40%, which is sufficient for processing. The system automatically adjusts the task allocation, and the analysis shows that the task switching time is 0.0015 seconds, thus improving parallel efficiency.

[0083] Finally, to avoid global lock contention, the system adopts a distributed lock mechanism, setting an independent lock for each session's hash table operations. Assuming the lock acquisition time is 0.0005 seconds and the release time is 0.0003 seconds, the system automatically monitors and finds that the lock conflict probability is 0.8%, dynamically optimizes the lock granularity, and records lock contention logs with the associated business modules for subsequent performance tuning. The entire process is completed automatically by the system, ensuring efficient and stable session processing.

[0084] like Figures 1-2 As shown, in step S105, based on the session-level resource isolation architecture, the uplink packet completes the DPI record and NAT mapping through a single table lookup synchronization mechanism, and the downlink packet obtains the mapping relationship using the flow label direct index, and supports the DPI function switch strategy for flexible table lookup mode.

[0085] Furthermore, in step S105, the uplink and downlink data are classified and processed through the session isolation mechanism to obtain the classified data flow information, and it is determined whether the data flow conforms to the preset isolation rules. If it does, the isolation unit of the data flow is determined.

[0086] Based on the classified data flow information, a resource allocation strategy is adopted to direct the data flow to the corresponding processing unit, obtain the allocated unit identifier, and determine whether the unit identifier is consistent with the preset allocation rule. If they are consistent, the allocation confirmation result is obtained.

[0087] Based on the allocation confirmation results, a single lookup table method is used to perform deep detection processing on the upstream data to obtain the content features after detection. It is then determined whether the content features meet the preset detection criteria. If they do, the feature matching status is determined.

[0088] By matching the feature status and combining the synchronization method, the address translation of the uplink data is associated and mapped to obtain the translated address identifier. It is then determined whether the address identifier is consistent with the preset mapping table entry. If they are consistent, the mapping completion information is obtained.

[0089] Based on the mapping completion information, the downlink data is quickly located using flow tagging technology to obtain the corresponding mapping relationship data. It is then determined whether the mapping relationship data matches the preset index record. If they match, the accuracy of the location is confirmed.

[0090] By accurately positioning and combining the function switch strategy, the lookup mode of the downlink data is dynamically adjusted to obtain the adjusted lookup path. It is then determined whether the lookup path conforms to the preset flexible lookup rules. If it does, the final lookup result is obtained.

[0091] Using the final lookup result, combined with the correlation information of depth detection and address translation, the data stream is integrated and processed to obtain the status of the integrated data stream. It is then determined whether the data stream status is consistent with the preset integrity standard. If they are consistent, the processing status of the data stream is determined to be complete.

[0092] Specifically, in step S105, in the field of network data processing, based on the session-level resource isolation architecture, the system uses an automated mechanism to efficiently map and identify uplink and downlink data packets.

[0093] For uplink data packets, the system adopts a single lookup table synchronization mechanism to automatically complete the mapping between deep packet inspection records and network address translation. Assuming that the source address of a certain uplink packet is 10.0.0.5 and the source port is 12345, the system locates the corresponding record in the mapping table using a preset lookup algorithm. The table has a capacity of 2048 records, and the lookup time is 0.003 seconds. Analysis shows that the hit rate is 98.2%. In case of a miss, the backup query module automatically fills in the missing record to ensure data integrity. At the same time, the mapping relationship is synchronized to the storage unit, and the synchronization time is 0.0012 seconds.

[0094] For downlink data packets, the system uses flow label direct indexing technology to quickly obtain the mapping relationship. Assuming the target address of the downlink packet is 10.0.0.8 and the target port is 54321, the system calculates the label value as 512 through the indexing algorithm, and the positioning time is 0.0025 seconds. Analysis shows that the indexing accuracy rate is 99.1%. Unmatched data packets are automatically put into the buffer queue to wait for secondary processing.

[0095] In addition, the system supports a deep packet inspection function on / off policy, flexibly adjusting the lookup mode for different business scenarios. Assuming the switch is set to "on" in a certain business scenario, the system automatically loads the deep packet inspection rule library with 500 rule entries, taking 0.004 seconds to load. Analysis shows a rule matching rate of 95.3%. Unmatched data packets are automatically supplemented by the backup rule library. At the same time, the system automatically adjusts the on / off state according to business traffic fluctuations. If the traffic peak exceeds 1 million packets per second, some inspection functions are temporarily disabled to release resources. The adjustment process takes 0.0018 seconds. The associated traffic monitoring module records the adjustment log in real time, forming a complete data processing chain to ensure the stable operation of the system under different loads.

[0096] like Figures 1-2As shown, in step S106, based on the DPI function switch strategy, the NAT mapping table is synchronized through the UPF cluster session mirroring mechanism to achieve zero packet loss during node failure switching.

[0097] Furthermore, in step S106, the network address translation mapping table is synchronized in real time using the session mirroring technology of the user plane function cluster. The synchronized mapping table data is obtained, and it is determined whether the mapping table data is consistent with the preset synchronization standard. If it is consistent, the synchronization is determined to be complete.

[0098] Based on the synchronization completion status, for node failure switching scenarios, session mirroring technology is used to back up the data transmission stream, obtain the backed-up data stream information, and determine whether the data stream information matches the preset backup rules. If they match, a backup confirmation result is obtained.

[0099] By confirming the backup results and combining them with the deep packet inspection function, the data transmission stream is analyzed to obtain the traffic characteristics after analysis. It is then determined whether the traffic characteristics meet the preset detection conditions. If they do, the traffic analysis status is determined.

[0100] Based on the traffic analysis status, the processing mode of the data transmission stream is dynamically adjusted using the function switch strategy. The adjusted processing path is obtained, and it is determined whether the processing path is consistent with the preset strategy rules. If they are consistent, the path adjustment result is obtained.

[0101] Based on the path adjustment results, for seamless data transmission during node failover, a pre-established switching support mechanism is used to redirect the data stream, obtain the redirected data stream direction, and determine whether the data stream direction matches the preset redirection standard. If they match, the redirection completion status is determined.

[0102] Based on the redirection completion status and in conjunction with the synchronization processing mechanism, the network address translation mapping table is updated, the updated mapping table content is obtained, and it is determined whether the mapping table content is consistent with the preset update rules. If they are consistent, an update confirmation message is obtained.

[0103] By updating the confirmation information, a protection mechanism that supports switching is adopted to monitor and process the data stream to ensure its continuity. The status data after monitoring is obtained, and it is determined whether the status data meets the preset continuity standard. If it does, the data stream protection status is determined.

[0104] Specifically, in step S106, in the field of network data processing, for the combined application of the DPI function switch policy and the UPF cluster session mirroring mechanism, the system uses automation technology to achieve seamless connection between NAT mapping table synchronization and node failure switching to ensure the continuity of data transmission.

[0105] First, based on the DPI function switch policy, the system automatically detects the current network load and decides whether to enable the deep inspection function. Assuming that the network traffic reaches 800,000 packets per second, the system calculates the current cluster load rate as 85.6% through the load balancing algorithm. The analysis shows that the inspection function needs to be partially enabled to balance resources. The automatically adjusted function enable ratio is 60%, and the adjustment time is 0.0021 seconds.

[0106] Subsequently, the system synchronizes the NAT mapping table to the standby node in real time through the UPF cluster session mirroring mechanism. Assuming the capacity of the primary node's mapping table is 4096 records, the synchronization algorithm adopts an incremental update method, synchronizing 512 records each time, with a time consumption of 0.0015 seconds. Analysis shows that the synchronization integrity reaches 99.5%, and the unsynchronized data is automatically completed by the standby verification module to ensure data consistency.

[0107] Next, when a primary node failure is detected, the system automatically triggers a failover mechanism, with the backup node taking over the traffic. Assuming the failover trigger time is 0.0008 seconds, the system activates the mirrored session data using a preloading algorithm, with activation taking 0.0013 seconds. Analysis shows that the data integrity during the failover process is 98.8%. Sessions that fail to complete the failover automatically enter a temporary cache queue, and the auxiliary recovery module completes the re-entry within 0.002 seconds.

[0108] Finally, to ensure business continuity, the system works in conjunction with the billing module to automatically update session status. Assuming the billing record update frequency is 5,000 records per minute and the update time is 0.0032 seconds, the analysis shows that the record accuracy rate is 99.2%. Records that are not updated are automatically processed by the background batch processing module in the next cycle, forming a complete data loop and ensuring that business logic is not affected during the failover process.

[0109] For those skilled in the art, various other corresponding changes and modifications can be made based on the technical solutions and concepts described above, and all such changes and modifications should fall within the protection scope of the claims of this application.

Claims

1. A method for implementing NAT on a core network UPF element, characterized in that, include: When a user terminal establishes a 5G session, the UPF pre-allocates a public IPv4 address and a set of continuous source ports for the session. The number of ports is dynamically adjusted according to the user's package, and the resources are bound to the session data structure. Based on the aforementioned session data structure, the uplink data packets from the mobile phone are received, and after stripping the GTP-U packet header, service processing is performed. DPI detection and NAT mapping are completed through a single joint table lookup operation, specifically including: querying the session-level hash table with the data stream 5-tuple as the key; if it is a new data stream, the DPI module inserts a stream record; the NAT module selects a port from the pre-allocated port pool and records the private network to public network mapping relationship; after performing NAT conversion, it forwards the data to the Internet. Based on the aforementioned private network to public network mapping relationship, when a downlink packet with a destination address of public IP is received, the session-level hash table is located through the flow label direct indexing mechanism, and after reverse NAT conversion, a GTP-U packet header is added. After business processing, it is forwarded to the mobile phone. Based on the aforementioned flow label direct indexing mechanism, each session has exclusive access to the IP port pool and hash table through a session-level resource isolation architecture, combined with multi-core CPU parallel processing, to avoid global lock contention. Based on the session-level resource isolation architecture, uplink packets complete the DPI record and NAT mapping through a single table lookup synchronization mechanism, and downlink packets obtain the mapping relationship using the flow label direct index, and support the DPI function switch strategy for flexible table lookup mode; Based on the DPI function switch strategy, the NAT mapping table is synchronized through the UPF cluster session mirroring mechanism to achieve zero packet loss during node failover.

2. The method for implementing NAT on a core network UPF element according to claim 1, characterized in that, The pre-allocated public IPv4 addresses and the set of consecutive source ports include: Parse the user identifier and package type in the session request to determine the initial port allocation range. When the number of ports exceeds the preset threshold, process the source port group in segments and update the session parameters. Dynamically adjust the binding relationship between public network addresses and port groups. Trigger the reallocation process when resource conflicts are detected.

3. The method for implementing NAT on a core network UPF element according to claim 1, characterized in that, The single joint table lookup operation includes: The session-level hash table is queried using the data stream quintuple as the key. DPI deep detection is performed on the new data stream. The support vector machine algorithm is used to identify traffic characteristics. Based on the detection results, available ports are selected and a mapping record from the private network to the public network is generated.

4. The method for implementing NAT on a core network UPF element according to claim 1, characterized in that, The stream label direct indexing mechanism is as follows: The destination IP and destination port of the downlink data packet are extracted as the index key. The index value is calculated by a hash function to directly locate the mapping record in the session-level hash table. The reverse NAT translation is completed in a single table lookup based on the mapping relationship.

5. The method for implementing NAT on a core network UPF element according to claim 1, characterized in that, The session-level resource isolation architecture includes: Each session is assigned an independent IP port pool and hash table, and session data streams are directed to designated processing units based on flow tags.

6. The method for implementing NAT on a core network UPF element according to claim 1, characterized in that, The UPF cluster session mirroring mechanism includes: The NAT mapping table of the primary node is copied to the standby node in real time using an incremental synchronization method, and the mirror session data of the standby node is activated during failover.

Images