A secure low-latency networking system for penetration and port mapping
By introducing session management and legitimacy verification mechanisms into the port mapping system, the problems of uncontrolled port mapping lifecycle and unauthorized access are solved, thereby achieving security and controllability of port mapping, reducing the risk of port exposure, and improving communication security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHENZHEN XINGSHENG DIGITAL TECH CO LTD
- Filing Date
- 2026-02-11
- Publication Date
- 2026-05-19
AI Technical Summary
In complex enterprise network environments spanning public networks and carriers, existing technologies suffer from issues such as uncontrolled port lifecycles, decoupling of mapping from communication sessions, lack of access legitimacy verification, and difficulty in reclaiming ports during abnormal interruptions. These issues lead to long-term port exposure and increased risks of unauthorized access.
A secure, low-latency network penetration and port mapping system is adopted, including a session management module, a NAT status detection module, a mapping application and renewal module, an access legitimacy verification module, a session status monitoring module, a mapping reclamation module, and an auditing and alarm module. Through session identifier generation, dynamic port mapping application and binding, access legitimacy verification, session status monitoring, and mapping reclamation, it ensures that port mapping is only valid during the communication session.
It effectively reduces the risk of port exposure, prevents unauthorized access, enhances the controllability of penetration, is compatible with existing penetration mechanisms, ensures that port mapping is only effective during communication sessions, shortens the mapping exposure time, and improves the overall security and controllability of the system.
Smart Images
Figure CN121691260B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of network address translation traversal, port mapping security control, and point-to-point communication connection management, and discloses a traversal and port mapping system for secure low-latency networking. Background Technology
[0002] In complex enterprise network environments spanning public and inter-carrier networks, terminal devices are often located behind NAT (Network Address Translation). To achieve point-to-point communication or network coverage, it is typically necessary to establish an external network reachable path through mechanisms such as port mapping (e.g., UPnP, NAT-PMP) or hole punching.
[0003] Typical application scenarios include, but are not limited to:
[0004] 1. Remote Operation and Maintenance and Remote Collaboration: When devices such as edge gateways, industrial control terminals, and access control cameras are located behind the enterprise intranet or carrier NAT, external devices need to establish a temporary reachable channel to the devices within a short window to complete diagnostics, upgrades, or data retrieval.
[0005] 2. Point-to-point audio, video and file transfer: Temporary session communication between mobile devices, home devices and PCs often uses port mapping or hole punching to improve the success rate of direct connection; if the mapped port is not bound to the session and is not reclaimed in time, it is easy to be exposed for a long time after the session ends.
[0006] 3. Overlay network topology: Multiple nodes build an overlay network in the public network, and some nodes obtain reachability through port mapping; if the mapped port is abused by other nodes or external scanners, it will cause resource consumption, connection hijacking or security incidents.
[0007] While existing technologies improve penetration success rates, they often present the following risks and shortcomings in engineering applications:
[0008] 1. Uncontrolled port mapping lifecycle: Once a port mapping is established, it may be retained for a long time or renewed by the backend, resulting in the mapped port remaining exposed on the public network after the business ends, forming a scanning and attack surface.
[0009] 2. Decoupling of mapping and communication sessions: Port mapping is often only bound to a device or process, lacking a binding relationship with a specific communication session, which may result in the same mapped port being reused by other sessions or accessed by unauthorized parties.
[0010] 3. Lack of access legitimacy verification: Traffic arriving at the mapped port usually only relies on simple source address judgment or is completely allowed, which makes it easy to be impersonated or injected under cross-carrier / dynamic address / NAT rewriting conditions.
[0011] 4. Difficulty in recycling under abnormal interruption: When communication is abnormally interrupted, application crashes, or network fluctuations occur, the mapping recycling mechanism is imperfect and it is difficult to ensure that the port is revoked in a timely manner.
[0012] Therefore, a secure NAT traversal method is needed. In cross-public network and complex NAT environments, this method binds port mapping to specific communication sessions and performs access legitimacy verification and lifecycle control during communication to prevent ports from being exposed for a long time or being accessed without authorization. This significantly improves the security and controllability of end-to-end communication while ensuring the success rate of NAT traversal. Summary of the Invention
[0013] To address the aforementioned problems, this invention provides a secure, low-latency network penetration and port mapping system, characterized by comprising a session management module, a NAT state detection module, a mapping application and renewal module, an access legitimacy verification module, a session state monitoring module, a mapping reclamation module, an auditing and alarm module on the end side, as well as a NAT gateway and a peer device communicating with the end-side device; the system performs the following steps:
[0014] When initiating an end-to-end communication request, the initiating end generates a unique session identifier (session_id) to identify this communication through the session management module, obtains the NAT state (nat_state) of the current network environment through the NAT state detection module, and creates a session control object (session_ctx).
[0015] The mapping application and renewal module dynamically applies for or activates port mapping resources (mapping) bound to the session based on the session_id, and records the mapping handle (mapping_handle), the public port (public_port), and the lease expiration time (lease_expire_at).
[0016] After the port mapping takes effect, the access validity verification module performs access validity verification on the inbound requests arriving at the mapped port;
[0017] The session status monitoring module updates the most recent heartbeat time last_heartbeat_at with heartbeat or traffic events, and determines session activity based on the inactive threshold inactive_threshold.
[0018] When a normal termination of communication, abnormal interruption, or failure condition is detected, the port mapping resources bound to the session are revoked through the mapping recycling module, the session_ctx is cleaned up, and the original NAT state is restored.
[0019] The audit and alarm module records session and mapping lifecycle events, verification results, and reasons for recycling, and triggers alarms when an anomaly occurs.
[0020] Preferably, the session control object session_ctx includes at least the following fields: session_id, peer_fingerprint, nat_state, mapping_handle, public_port, private_port (internal network port), lease_expire_at, last_heartbeat_at, state (session state), inactive_threshold, renewal_count (lease renewal count), and closed_reason (lease termination reason).
[0021] Preferably, the access legitimacy verification mentioned herein includes at least a consistency judgment based on session_id, session_token, or peer_fingerprint. If the verification fails, the inbound request is rejected and written to the audit log.
[0022] Preferably, the conditions for the mapping application and renewal module to perform the renewal operation are: the session is in the "establishing" or "established" state, and the lease_expire_at period has ended before the renewal window is entered; when the session meets the inactivation conditions or is explicitly closed, the renewal is stopped and the mapping is reclaimed.
[0023] Preferably, the inactivation condition includes at least one of the following: the difference between the current time and last_heartbeat_at is greater than or equal to inactive_threshold, an explicit shutdown command is detected, or the communication link is abnormally interrupted.
[0024] Preferably, the NAT state detection module continuously updates nat_state. When it detects a change in NAT type, a change in external network address, a mapping query failure, or a port being reclaimed by the gateway, it triggers a mapping reconstruction process, re-applies for new port mapping resources, and records the old and new mapping switching events.
[0025] Preferably, the audit records generated by the audit and alarm module include at least the following fields: event identifier (event_id), session_id, state, nat_state, mapping_handle, public_port, lease_expire_at, renewal_count, validation result (validation_result), closed_reason, and timestamp.
[0026] Preferably, the system evaluates security performance using quantitative indicators, which include: session-level mapping exposure ratio E=T_mapping / T_session, mapping residual duration after session end R=max(0,T_mapping_end-T_session_end), and unauthorized access rate A=N_unauth_accepted / N_total_inbound; where T_mapping is the effective duration of port mapping, T_session is the session duration, T_mapping_end is the mapping cancellation completion time, T_session_end is the session end time, N_unauth_accepted is the number of passes that failed verification, and N_total_inbound is the total number of inbound passes.
[0027] Preferably, the mapping application and renewal module obtains port mapping resources in at least one of the following ways: UPnP, NAT-PMP, gateway-side controlled API, and relay control plane distribution, and all methods satisfy the constraints of mapping and session binding, revocability, and auditability.
[0028] When the NAT gateway does not support port mapping, the system degenerates into hole punching or relay fallback paths, but still executes equivalent control processes such as session identifier generation, access legitimacy verification, session state monitoring, and mapping resource reclamation to maintain security semantic consistency.
[0029] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0030] 1. Reduce port exposure risk: Port mapping is only valid during the communication session and is reclaimed when the session ends or an error occurs, thus shortening the mapping exposure time.
[0031] 2. Prevent unauthorized access: Perform validity checks on communication requests arriving via the mapped port, and only allow requests that match the session identifier and peer characteristics to pass through.
[0032] 3. Enhance the controllability of NAT traversal: Incorporate NAT traversal behavior into session lifecycle management, support lease renewal, deactivation, reclamation and audit logging, and improve the overall controllability of the system.
[0033] 4. Compatible with existing traversal mechanisms: It can be used in conjunction with UPnP, NAT-PMP, hole punching and relay fallback mechanisms without changing existing network equipment. Attached Figure Description
[0034] Figure 1 This invention provides a session lifecycle workflow diagram for a secure low-latency networking penetration and port mapping system.
[0035] Figure 2This is a diagram showing the overall architecture of a secure, low-latency network penetration and port mapping system according to the present invention. Detailed Implementation
[0036] refer to Figures 1 to 2 This invention provides a secure NAT traversal method applicable to point-to-point communication or overlay network systems. The method is characterized by: the initiating end generating session identification information and detecting the NAT state when establishing an end-to-end communication request; dynamically requesting or activating port mapping resources bound to the communication session based on the session identification; performing access legitimacy verification on requests arriving at the mapped port after the mapping takes effect; continuously monitoring the session state during communication and triggering port mapping reclamation when the session ends, is abnormally interrupted, or exceeds the inactivation condition; and revoking the port mapping resources bound to the session and restoring the original NAT state to prevent port mapping from continuing to be exposed after communication ends.
[0037] For ease of understanding, some technical terms are defined as follows:
[0038] 1. Session ID (session_id): Identification information used to uniquely identify an end-to-end communication session.
[0039] 2. NAT state (nat_state): Used to characterize the NAT type, mapping capabilities, and external network reachability information of the current network environment.
[0040] 3. Port mapping resources (mapping): External port mapping rules applied for by the NAT device for internal network ports.
[0041] 4. Session-level port mapping (session_bound_mapping): The port mapping establishes a binding relationship with the `session_id` and allows only that session to use it.
[0042] 5. Peer Fingerprint: A set of features used to characterize the peer in a communication conversation, including at least the peer identifier, candidate address, or key negotiation digest.
[0043] 6. Access Validation: Perform a consistency check on requests arriving at the mapped port, including at least session identifier consistency or source characteristic consistency.
[0044] 7. Inactive condition: A set of conditions used to determine whether a session should end or a mapping should be reclaimed. These conditions may include timeout, lost heartbeat, explicit shutdown, or abnormal events.
[0045] The working principle is as follows:
[0046] The system of the present invention includes at least the following modules:
[0047] 1. Session Management Module: Used to create, maintain and reclaim session control objects (session_ctx), and drive the session state to transition between "establishing / established / reclaiming / ended".
[0048] 2. NAT State Detection Module: Used to detect nat_state (including NAT type, external address changes, mapping capability and reachability information), and trigger mapping reconstruction or rollback strategies when the state changes.
[0049] 3. Mapping Application and Renewal Module: Used to apply for session-level port mappings via UPnP / NAT-PMP or equivalent mechanisms, and maintain mapping_handle / public_port / lease_expire_at; renew leases according to the renewal window when the session is active, and stop renewals and trigger reclamation when the session is inactive.
[0050] 4. Access Validation Module: This module performs access validation on requests arriving at the mapped port, performs consistency checks based at least on session_id / session_token or peer_fingerprint, and writes validation failure events to the audit log.
[0051] 5. Session Status Monitoring Module: Used to update last_heartbeat_at with heartbeat or traffic events, and trigger inactive determination based on inactive_threshold.
[0052] 6. Mapping Recycling Module: Used to revoke the port mapping bound to the session and clean up the session_ctx when the session ends, is abnormally interrupted, or becomes inactive, so as to shorten the port exposure window.
[0053] 7. Audit and Alarm Module: Used to uniformly record session and mapping lifecycle events, verify results and recycling reasons, and trigger alarms in abnormal mode.
[0054] The method of the present invention includes the following steps:
[0055] 1. When initiating an end-to-end communication request, generate session identifier information session_id to identify this communication, and obtain the network address translation status nat_state under the current network environment.
[0056] 2. Based on the session identifier information session_id, dynamically apply for or activate the port mapping resource mapping corresponding to this communication, so that the port mapping is used only for the communication session.
[0057] 3. After the port mapping takes effect, perform access legality verification on communication requests arriving through the port. The access legality verification includes at least the determination of the consistency of the communication source feature peer_fingerprint or session identifier.
[0058] 4. During the communication process, continuously monitor the status of the communication session. When the communication is detected to have ended normally, been abnormally interrupted, or exceeded the preset inactivation conditions, trigger the port mapping recycling operation.
[0059] 5. Cancel the port mapping resource bound to the communication session and restore the original network address translation state to prevent the port mapping from continuing to be exposed after the communication ends.
[0060] The key constraints and outputs of the above steps include at least the following: Step 1: Output session_id and nat_state and create session_ctx; Step 2: Output the session binding mapping_handle / public_port / lease_expire_at and write the binding relationship; Step 3: Perform access_validation on inbound requests and output validation_result and audit logs; Step 4: Determine inactivity based on last_heartbeat_at / inactive_threshold and decide whether to renew or reclaim the lease; Step 5: Revoke the mapping and record closed_reason and reclamation completion time for reviewing the mapping exposure window.
[0061] To enable the "session-level port mapping + validity verification + explicit recycling" to have an implementable data structure, this invention can maintain a session control object (session_ctx) on the client side, which includes at least:
[0062] Fields meaning session_id Session ID peer_fingerprint opposite end features nat_state NAT State Snapshot mapping_handle Mapping handle / resource identifier public_port external port private_port Internal network port lease_expire_at Mapping lease expiration time last_heartbeat_at Recent heart rate state Session status (establishing / established / reclaiming / ended) inactive_threshold Inactivation threshold (seconds) renewal_count Mapping renewal count closed_reason Termination reason (normal / timeout / abnormal / verification failure, etc.)
[0063] On the client side, the session management module uses `session_ctx` as the core object to connect NAT state detection, port mapping application renewal, validity verification, and revocation processes, ensuring that the "establishment-use-renewal-revocation" of port mappings is consistent with session state changes. Its workflow includes at least the following:
[0064] 1. Session establishment and state machine progression: When the upper layer initiates a connection request, the session management module creates a session_ctx and enters the "establishing" state; when the mapping application is successful and the first valid handshake is completed, it switches to "established"; when the recycling condition is triggered, it enters "recycling" and enters "completed" after the revocation is completed.
[0065] 2. Mapping application and renewal control: The mapping application and renewal module applies for or activates mapping as needed and records lease_expire_at during the "establishing / established" stage; when the expiration time is approaching and the renewal window is entered, renewal is only performed and renewal_count is accumulated while the session is still active, thereby avoiding "port exposure caused by long-term renewal without business".
[0066] 3. Activity determination and non-renewal policy: The session status monitoring module determines session activity using last_heartbeat_at and inactive_threshold. When now-last_heartbeat_at>=inactive_threshold or an explicit closure / abnormal event is detected, recycling is triggered and renewal is stopped, so that the mapping exposure time naturally converges with the session.
[0067] 4. NAT State Change and Mapping Failure Recovery: The NAT state detection module continuously updates nat_state; when events such as NAT type change, external address change, mapping query failure, or port being reclaimed by the gateway are detected, the mapping reconstruction process is triggered: a new mapping_handle / public_port / lease_expire_at is re-applied for, and the "switching between old and new mappings" is written to the audit log; if the old mapping can be revoked, the old mapping is revoked first to shorten the exposure window.
[0068] To ensure deterministic access legitimacy verification and resistance to impersonation, this invention can include a session token (session_token) in requests arriving at the mapped port, and verify its consistency with the session_id / peer_fingerprint on the client-side. As an example, the session token can be negotiated between the initiating and peer ends during the session establishment phase and bound to key session information (e.g., session_id, peer identity digest, expiration time), carried in subsequent data packets or handshake messages; if verification fails, the request is rejected and logged for auditing. To reduce replay risk, the session token can be set with an expiration date and associated with lease_expire_at or a heartbeat window, causing it to expire naturally after the session ends or the mapping is reclaimed.
[0069] To minimize port mapping exposure time, this invention can define a session-level mapping exposure ratio (E):
[0070] [E=\frac{T{mapping}}{T{session}}]
[0071] Where (T{mapping}) is the cumulative duration of port mapping in an effective state, and (T{session}) is the session duration; through the control strategy of "on-demand application + inactive recycling + unnecessary lease renewal", (E) is made as close to 1 as possible and not significantly greater than 1, thereby reducing the risk of the port continuing to be exposed after the session ends.
[0072] To facilitate the evaluation of the benefits of "safety and controllability" in engineering projects, the present invention may also define the following quantitative indicators:
[0073] 1. Residual duration of the mapping after the session ends (R):
[0074] [R=\max(0,\T{mapping_end}-T{session_end})]
[0075] Where (T{mapping_end}) is the mapping cancellation completion time and (T{session_end}) is the session end time; by explicitly reclaiming and stopping the renewal policy, (R) is made to approach 0.
[0076] 2. Unauthorized release rate (A):
[0077] [A=\frac{N{unauth_accepted}}{N{total_inbound}}]
[0078] Where (N{unauth_accepted}) is the number of inbound connections that failed session binding verification but were allowed to pass, and (N{total_inbound}) is the total number of inbound connections; (A) is made close to 0 by verifying session credentials or peer characteristics.
[0079] To ensure reproducibility and auditability, this invention must at least meet the following implementation requirements:
[0080] 1. Deterministic constraints on session credentials: The session_token is bound to the session_id and key session information, and an expiration period is set or associated with a renewal window; the credential expires naturally after the session ends or the mapping is reclaimed, making the session boundaries clear and measurable.
[0081] 2. Renewal and non-renewal policy boundaries: Renewal is only triggered when the session is active and enters the renewal window, and the renewal_count is recorded; renewal stops and recycling is triggered when the deactivation condition is met or the session is explicitly closed, so that the exposure window is controlled.
[0082] 3. Reproducible audit logs: Key events such as session establishment, mapping application / renewal / revocation, verification pass / rejection, NAT state changes and mapping reconstruction are recorded in a unified manner, and the recording fields are kept consistent to support post-event review.
[0083] To ensure that audit records have a verifiable data scope, audit records may include at least the following set of fields (example):
[0084] Fields meaning event_id Event Identifier session_id Session ID state Session state nat_state NAT state snapshot or summary mapping_handle Mapping resource identifier public_port external port lease_expire_at Mapping lease expiration time renewal_count Number of renewals validation_result Validation result (pass / reject) closed_reason Reason for termination timestamp Event timestamp
[0085] 1. When establishing communication, the initiating end generates a session_id, checks the nat_state, and creates a session_ctx.
[0086] 2. The initiating end calls UPnP or NAT-PMP to request an external port mapping, obtains mapping_handle / public_port / lease_expire_at, and binds the mapping with session_id.
[0087] 3. When the peer sends a handshake request, it carries the session_id and session_token (or equivalent credentials); the peer performs a validity check on the inbound request to the mapped port, and rejects and audits the request if it does not match.
[0088] 4. During communication, update last_heartbeat_at with heartbeat or traffic events; trigger the recycling process when explicit shutdown, abnormal interruption, or timeout inactivation is detected.
[0089] 5. Revoke the port mapping bound to the session and clean up session_ctx, and write the session summary to the audit log.
[0090] As a preferred implementation, port mapping resources can be requested through UPnP / NAT-PMP or issued through a gateway-side controlled API or relay control plane, as long as the constraints of "mapping and session binding, revocability, and auditability" are met.
[0091] As a preferred implementation, access legitimacy verification can employ session credential consistency verification, source feature (e.g., peer address set, fingerprint digest) consistency verification, or a combination of both, as long as the traffic arriving at the mapped port is consistent with the session binding relationship.
[0092] As a preferred implementation, when the NAT environment does not support port mapping, it can degenerate into hole punching or relay fallback paths, but still perform equivalent control on "session identifier + validity verification + lifecycle recycling" to maintain security semantic consistency.
[0093] As a preferred implementation, a fixed port mapping is requested when the device or service starts up, and the mapping relationship is maintained for a long time without being bound to a specific communication session or being reclaimed based on the session state.
[0094] It can meet the requirement of "long-term external service exposure", but it cannot replace the security closed-loop goal of this invention in "session binding, legality verification, and inactive recycling".
[0095] As a preferred implementation, inbound traffic arriving at the mapped port is allowed only by the source IP / network segment or a fixed address list, without introducing session identifier or session credential verification, and without explicitly managing the mapping lifecycle.
[0096] As a preferred implementation, mechanisms such as TLS / DTLS / application layer encryption are used to protect the confidentiality and integrity of communication content. However, port mapping still exists for a long time or lacks a recycling strategy consistent with the session, and no session-level isolation control is performed on connection attempts arriving at the port.
[0097] It can significantly improve the confidentiality and anti-tampering ability of transmitted content; it requires minimal modification to upper-layer services; and it can be used in combination with various penetration mechanisms.
[0098] It can be used as a communication security enhancement of the present invention, but it cannot replace the control objectives of the present invention on the port mapping lifecycle and session binding relationship.
Claims
1. A secure, low-latency networking penetration and port mapping system, characterized in that, The system includes a session management module, a NAT state detection module, a mapping request and renewal module, an access legitimacy verification module, a session state monitoring module, a mapping reclamation module, and an auditing and alarm module on the endpoint side, as well as a NAT gateway and peer device that communicate with the endpoint device; the system performs the following steps: When initiating an end-to-end communication request, the initiating end generates a unique session identifier (session_id) to identify this communication through the session management module, obtains the NAT state (nat_state) of the current network environment through the NAT state detection module, and creates a session control object (session_ctx). The mapping application and renewal module dynamically applies for or activates port mapping resources (mapping) bound to the session based on the session_id, and records the mapping handle (mapping_handle), the public port (public_port), and the lease expiration time (lease_expire_at). After the port mapping takes effect, the access validity verification module performs access validity verification on the inbound requests arriving at the mapped port; The session status monitoring module updates the most recent heartbeat time last_heartbeat_at with heartbeat or traffic events, and determines session activity based on the inactive threshold inactive_threshold. When a normal termination of communication, abnormal interruption, or failure condition is detected, the port mapping resources bound to the session are revoked through the mapping recycling module, the session_ctx is cleaned up, and the original NAT state is restored. The audit and alarm module records session and mapping lifecycle events, verification results, and reasons for recycling, and triggers alarms when an anomaly occurs.
2. The system according to claim 1, characterized in that, The session control object session_ctx contains at least the following fields: session_id, peer_fingerprint, nat_state, mapping_handle, public_port, private_port (internal network port), lease_expire_at, last_heartbeat_at, state (session state), inactive_threshold, renewal_count (lease renewal count), and closed_reason (lease termination reason).
3. The system according to claim 2, characterized in that, The access legitimacy verification includes at least a consistency check based on session_id, session_token, or peer_fingerprint. If the verification fails, the inbound request is rejected and written to the audit log.
4. The system according to claim 3, characterized in that, The conditions for the mapping application and renewal module to perform the renewal operation are: the session is in the "establishing" or "established" state and the lease_expire_at period has ended before the renewal window is entered; when the session meets the inactivation conditions or is explicitly closed, the renewal is stopped and the mapping is reclaimed.
5. The system according to claim 4, characterized in that, The inactivation conditions include at least one of the following: the difference between the current time and last_heartbeat_at is greater than or equal to inactive_threshold, an explicit shutdown command is detected, or the communication link is abnormally interrupted.
6. The system according to claim 5, characterized in that, The NAT state detection module continuously updates nat_state. When it detects a change in NAT type, a change in external address, a failed mapping query, or a port being reclaimed by the gateway, it triggers a mapping reconstruction process, re-applies for new port mapping resources, and records the old and new mapping switching events.
7. The system according to claim 6, characterized in that, The audit logs generated by the audit and alarm module include at least the following fields: event ID (event_id), session ID (session_id), state (state), nat_state (nat_state), mapping_handle (mapping_handle), public_port (public_port), lease_expire_at (lease_expire_at), renewal_count (renewal_count), validation result (validation_result), closed_reason (closed_reason), and timestamp (timestamp).
8. The system according to claim 7, characterized in that, The system evaluates security performance using quantitative metrics, including: session-level mapping exposure ratio E = T_mapping / T_session, mapping persistence duration after session end R = max(0, T_mapping_end - T_session_end), and unauthorized access rate A = N_unauth_accepted / N_total_inbound; where T_mapping is the effective duration of port mapping, T_session is the session duration, T_mapping_end is the mapping cancellation completion time, T_session_end is the session end time, N_unauth_accepted is the number of passes that failed verification, and N_total_inbound is the total number of inbound passes.
9. The system according to claim 8, characterized in that, The mapping application and renewal module obtains port mapping resources in at least one of the following ways: UPnP, NAT-PMP, gateway-side controlled API, and relay control plane distribution. All methods satisfy the constraints of mapping and session binding, revocability, and auditability.
10. The system according to claim 9, characterized in that, When the NAT gateway does not support port mapping, the system degenerates into hole punching or relay fallback paths, but still executes equivalent control processes such as session identifier generation, access legitimacy verification, session state monitoring, and mapping resource reclamation to maintain security semantic consistency.