Address translation method, apparatus and system

Abstract

The present application belongs to the technical field of networks. Provided are an address translation method, apparatus and system. In the solution provided in the present application, on the basis that a first message of a first user is a message of a target application, a source address of the first message can be converted from a first private network address into a target address, and then the first message is sent to a first forwarding device. Moreover, traceability information of the first user comprises not only the target address corresponding to the first private network address, but also a first public network address and a first port range which correspond to the first private network address. Since the first private network address corresponds to two different addresses in the traceability information of the first user, when network address translation is performed on a message of the first user, a source address of the message can be converted from the first private network address into different network addresses on the basis of the type of an application to which the message belongs, thereby effectively improving the flexibility of address translation.

Description

Address conversion method, device and system

[0001] This application claims priority to Chinese patent application number 202410167042.8, filed on February 4, 2024, entitled “Address Conversion Method, Device and System,” the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application relates to the field of network technology, and in particular to an address translation method, device, and system. Background Art

[0003] A broadband remote access server (BRAS) is an access gateway for broadband network applications. To implement application acceleration, a service awareness (SA) service board can be added to the BRAS. The BRAS directs user traffic to the SA service board for application identification and then to the distributed network address translation (NAT) service board for Internet Protocol (IP) address translation. The SA service board then forwards traffic from the identified application to the acceleration router.

[0004] The acceleration router performs centralized NAT processing on received traffic and forwards it to the acceleration access point, which then sends the traffic to the destination device via a dedicated acceleration channel. Furthermore, the acceleration router can publish NAT public network routes to the acceleration channel to ensure that return traffic from the destination device can also be forwarded through the acceleration router.

[0005] However, the above address conversion method has low flexibility. Summary of the Invention

[0006] The present application provides an address conversion method, device and system, which can solve the technical problem of low flexibility of the address conversion method in the related art.

[0007] In a first aspect, an address translation method is provided, comprising: based on a first message received from a first user being a message of a target application, translating the source address of the first message from a first private network address to a target address, and then sending the message to a first forwarding device, and reporting source tracing information of the first user to an authentication server. The source tracing information includes the target address corresponding to the first private network address, and a first public network address and a first port range corresponding to the first private network address. The target address is different from the first public network address.

[0008] Since the first private network address corresponds to two different addresses in the first user's traceability information, when performing network address conversion on the first user's message, the source address of the message can be converted from the first private network address to a different network address based on the type of application to which the message belongs, thereby effectively improving the flexibility of address conversion.

[0009] Optionally, the first private network address belongs to a first private network address pool. Based on the fact that the first message received from the first user is a message for a target application, the process of converting the source address of the first message from the first private network address to a target address may include: based on the fact that the first message received from the first user is a message for a target application, converting the source address of the first message from the first private network address to a target address in a second private network address pool. That is, the target address may be a private network address. The second private network address pool is different from the first private network address pool.

[0010] In the scenario where the target address is a private network address, since the target address can only represent the first user, it can ensure that the first forwarding device can use static mapping to convert the network address of the first message, and can save the resources of the public network address required for static mapping on the first forwarding device. In addition, when tracing the source of the first user, the source can be traced through the traceability information stored in the authentication server and the static mapping algorithm in the first forwarding device. Since there is no need to deploy a separate system log (syslog) server for the first forwarding device, the system structure is effectively simplified and the system cost is reduced.

[0011] Optionally, the first public network address belongs to a first public network address pool. Based on the fact that the first message received from the first user is a message of a target application, the process of converting the source address of the first message from the first private network address to the target address may include: based on the fact that the first message received from the first user is a message of a target application, converting the source address of the first message from the first private network address to a target address in a second public network address pool. That is, the target address may be a public network address. The second public network address pool is different from the first public network address pool.

[0012] In scenarios where the target address is a public network address, the first forwarding device does not need to perform network address translation on the first message because the source address of the first message has already been converted to a public network address in an independent public network address pool before being sent to the first forwarding device. Furthermore, when tracing the source of the first user, the source information stored in the authentication server can be used directly. This solution eliminates the need to deploy a separate syslog server for the first forwarding device, effectively simplifying the system structure and reducing system costs.

[0013] Optionally, for a scenario where the target address is a public network address, the method may further include: translating the source port of the first message into a port within the second port range. That is, when performing network address translation on the message of the target application sent by the first user, not only the source address but also the source port may be translated.

[0014] Optionally, for a scenario where the target address is a public network address, the method further includes: publishing the routes of the second public network address pool to the first forwarding device, so that the first forwarding device publishes the routes of the second public network address pool.

[0015] Since the source address of the target application's message is converted to a public address in the second public network address pool, the first forwarding device no longer needs to perform network address conversion on the target application's message. Therefore, in order to ensure that the return traffic of the target application can still be forwarded through the first forwarding device, the first forwarding device needs to publish the route of the second public network address pool.

[0016] Optionally, the process of reporting the first user's traceability information to the authentication server may include: reporting first information to the authentication server, and reporting second information to the authentication server. The first information includes the first public network address and the first port range corresponding to the first private network address, and the second information includes the target address corresponding to the first private network address. That is, the target address and the first public network address may be reported to the authentication server in separate steps.

[0017] The first information and the second information may both be remote authentication dial-in user service (RADIUS) information, which may also be called RADIUS interface messages.

[0018] Optionally, the process of reporting the first information to the authentication server may include: after the first user comes online, reporting a billing start message to the authentication server, the billing start message including the first information. The process of reporting the second information to the authentication server may include: based on the received first message being a message for the target application, reporting a billing update message to the authentication server, the billing update message including the second information.

[0019] It is understood that after the first user comes online, a first private network address, a corresponding first public network address, and a first port range can be allocated to the first user, and this can be reported to the authentication server via a billing start message. After receiving the first target application message sent by the first user, a target address can be newly allocated to the first user from the second private network address pool or the second public network address pool, and this can be reported to the authentication server via a billing update message.

[0020] Optionally, the method may also include: based on the fact that the second message received from the first user is not a message of the target application, converting the source address of the second message from the first private network address to the first public network address, and converting the source port of the second message to a port in the first port range and sending it to the second forwarding device.

[0021] For packets from non-target applications, network address translation can be performed based on the first public network address and first port range assigned when the first user logs online, and then sent to a second forwarding device. The first forwarding device can be used to forward traffic from the target application, and the second forwarding device can be used to forward traffic from non-target applications. In other words, traffic from the target application and traffic from non-target applications can be forwarded by different forwarding devices.

[0022] Optionally, the method may further include: based on the fact that the received third message from the second user is not a message for the target application, translating the source address of the third message from the second private network address to a second public network address, translating the source port of the third message to a port within a third port range, and then sending the message to the second forwarding device. The first private network address and the second private network address belong to the same private network address pool, and the first public network address and the second public network address belong to the same public network address pool.

[0023] It is understood that after each user comes online, a private address can be allocated to the user from the first private address pool, and a corresponding public address and port range can be allocated to the user from the first public address pool. For messages sent by the user for non-target applications, network address translation can be performed using the public address and port range allocated when the user comes online.

[0024] Optionally, the method may further include: determining, through an SA service board, that the first message of the first user is a message of a target application; or determining, through an access control list (ACL), that the first message of the first user is a message of a target application. The SA service board may parse the message using a Layer 7 protocol to detect whether the received message is a message of the target application.

[0025] Optionally, the above-mentioned address translation method may be applied to a broadband remote access server, also known as a broadband network gateway (BNG).

[0026] Optionally, the target application may be an application that deploys an acceleration service. Accordingly, the first forwarding device may be a forwarding device capable of forwarding the message to an acceleration path, such as an acceleration router.

[0027] In a second aspect, an address translation method is provided, applied to an authentication server, the method comprising: receiving traceability information of a first user. The traceability information includes a target address corresponding to a first private network address of the first user, and a first public network address and a first port range corresponding to the first private network address. The target address is different from the first public network address.

[0028] After receiving the tracing information of the first user, the authentication server may store the tracing information, that is, store the NAT log of the first user, so as to trace the source of the first user.

[0029] Optionally, the process of receiving the traceability information of the first user may include: receiving first information, which includes a first public network address and a first port range corresponding to the first private network address; and receiving second information, which includes a target address corresponding to the first private network address.

[0030] Optionally, the process of receiving the first information may include: receiving a billing start message, the billing start message including the first information. The process of receiving the second information may include: receiving a billing update message, the billing update message including the second information.

[0031] Optionally, the first private network address belongs to a first private network address pool, and the target address belongs to a second private network address pool, which is different from the first private network address pool; or the first public network address belongs to a first public network address pool, and the target address belongs to a second public network address pool, which is different from the first public network address pool. The second information may further include a second port range corresponding to the first private network address.

[0032] In a third aspect, an address conversion method is provided, which is applied to an address conversion system, the system comprising: a broadband remote access server and a first forwarding device. The method comprises: based on the first message received from the first user being a message of a target application, the broadband remote access server converts the source address of the first message from the first private network address to the target address and then sends it to the first forwarding device. The first forwarding device forwards the first message. The broadband remote access server reports the traceability information of the first user to the authentication server. The traceability information includes the target address corresponding to the first private network address, and the first public network address and first port range corresponding to the first private network address. The target address is different from the first public network address.

[0033] Optionally, the first public network address belongs to the first public network address pool. The process of the broadband remote access server converting the source address of the first message from the first private network address to the target address based on the first message received from the first user being a message of the target application may include: the broadband remote access server converting the source address of the first message from the first private network address to the target address in the second public network address pool based on the first message received from the first user being a message of the target application, and converting the source port of the first message to a port in the second port range, and the second public network address pool is different from the first public network address pool. The method may also include: the broadband remote access server publishing the route of the second public network address pool to the first forwarding device; the first forwarding device publishing the route of the second public network address pool. The source address of the first message forwarded by the first forwarding device is the target address, that is, the first forwarding device does not perform network address translation on the first message.

[0034] Optionally, the first private network address belongs to a first private network address pool. The process of the broadband remote access server converting the source address of the first message from the first private network address to the target address based on the first message received from the first user being a message of the target application may include: the broadband remote access server converting the source address of the first message from the first private network address to a target address in a second private network address pool based on the first message received from the first user being a message of the target application, the second private network address pool being different from the first private network address pool. The process of the first forwarding device forwarding the first message may include: the first forwarding device converting the target address of the first message to a public network address in a third public network address pool, and converting the source port of the first message to a port in a fourth port range before forwarding the first message.

[0035] Optionally, the method may further include: based on the fact that the second message received from the first user is not a message of the target application, the broadband remote access server converts the source address of the second message from the first private network address to the first public network address, converts the source port of the second message to a port in the first port range, and then sends it to the second forwarding device. Based on the fact that the third message received from the second user is not a message of the target application, the broadband remote access server converts the source address of the third message from the second private network address to the second public network address, converts the source port of the third message to a port in the third port range, and then sends it to the second forwarding device. The second forwarding device forwards the second and third messages. The first private network address and the second private network address belong to the same private network address pool, and the first public network address and the second public network address belong to the same public network address pool.

[0036] Optionally, the first forwarding device may be an acceleration router, configured to accelerate forwarding of messages of the target application.

[0037] In a fourth aspect, an address translation method is provided, the method comprising: based on a first message sent by a first user being a message of a target application, sending the first message to a first forwarding device, so that the first forwarding device performs network address translation on the first message; and based on a second message sent by the first user not being a message of the target application, performing network address translation on the second message and then sending it to a second forwarding device. The source address of the first message is a first private network address, and the source address of the second message after the network address translation is different from the first private network address.

[0038] Since this method can distinguish between applications that perform network address conversion or not for messages, it effectively improves the flexibility of address conversion. In addition, since the network address conversion is not performed on the first message of the target application, the source address of the message can only represent the first user. Therefore, it can be ensured that the first forwarding device can use static mapping to perform network address conversion on the first message. Accordingly, when tracing the source of the first user, it can be directly traced through the static mapping algorithm in the first forwarding device without the need to deploy a separate syslog server, thereby effectively simplifying the system structure and reducing system costs.

[0039] Optionally, the method may further include: after a first user comes online, allocating a first private network address to the first user from a first private network address pool; and after a second user comes online, allocating a second private network address to the second user from a second private network address pool. The first user is a user who has applied for the acceleration service for the target application, and the second user is a user who has not applied for the acceleration service for the target application. The first private network address pool and the second private network address pool are different.

[0040] Because the method provided in this application can plan an independent private network address pool for users applying for the target application's acceleration service, directly sending messages from these users to the first forwarding device ensures that the source addresses of the messages received by the first forwarding device are continuously distributed. Accordingly, the public network address pool planned in the first forwarding device for network address translation only needs to cover the users applying for the target application's acceleration service, effectively conserving the first forwarding device's public network address resources.

[0041] Optionally, the method may further include performing network address translation on the third message sent by the second user and then sending it to the second forwarding device. That is, for users who have not applied for the acceleration service for the target application, there is no need to distinguish whether the message sent by the user is a message for the target application, and the message can be directly forwarded after performing network address translation.

[0042] In a fifth aspect, an address conversion method is provided, which is applied to a forwarding device. The method includes: performing a first static mapping conversion on a first message of a first user sent by a broadband remote access server and then forwarding it; and performing a second static mapping conversion on a second message of a second user sent by the broadband remote access server and then forwarding it. The first static mapping conversion includes: converting the source address of the first message from a first intranet address to a first public network address, and converting the source port of the first message from a first intranet port to a first public network port within a first public network port range. The second static mapping conversion includes: converting the source address of the second message from the first intranet address to the first public network address, and converting the source port of the second message from a second intranet port to a second public network port within a second public network port range. The first intranet port belongs to the first intranet port range, and the second intranet port belongs to the second intranet port range.

[0043] The static mapping algorithm deployed in this forwarding device performs network address translation based on the intranet address and intranet port range. This means that for the same intranet address, but with different intranet port ranges, it can be translated to the same public address and different public port ranges. This ensures that users can be uniquely identified based on this static mapping algorithm, enabling static tracing of users. By eliminating the need for a separate syslog server, this effectively simplifies the system architecture, reduces system costs, and avoids increasing the space and power consumption of the operations room.

[0044] Optionally, the method also includes: based on the received tracing instructions for the first public network address and the first public network port range, determining the first intranet address and the first intranet port range corresponding to the first public network address and the first public network port range through a static mapping algorithm; and, based on the received tracing instructions for the first public network address and the second public network port range, determining the first intranet address and the second intranet port range corresponding to the first public network address and the second public network port range through a static mapping algorithm.

[0045] Based on the above analysis, we can see that when using a static mapping algorithm to trace a public address and a public port range, it is possible to determine the corresponding private address and private port range. Therefore, even if a private address represents multiple users, the private port range can still uniquely identify a single user, enabling accurate user tracing.

[0046] In a sixth aspect, an address conversion device is provided, which includes at least one module. The at least one module can be used to implement the address conversion method provided in any of the above aspects.

[0047] In the seventh aspect, an address conversion device is provided, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the address conversion method provided in any of the above aspects when executing the computer program.

[0048] In an eighth aspect, an address conversion device is provided. The address conversion device may include: a main control board and an interface board. The main control board and the interface board may be used to implement the address conversion method provided in any of the above aspects.

[0049] In a ninth aspect, a computer-readable storage medium is provided, in which instructions are stored. The instructions are executed by a processor to implement the address conversion method provided in any of the above aspects.

[0050] In a tenth aspect, a computer program product comprising instructions is provided, which, when executed on a processor, causes the processor to execute the address conversion method provided in any of the above aspects.

[0051] In an eleventh aspect, an address translation system is provided, comprising: a broadband remote access server and a first forwarding device. The broadband remote access server is configured to implement the address translation method provided in the first or fourth aspect. Alternatively, the first forwarding device is configured to implement the address translation method provided in the fifth aspect.

[0052] Optionally, for a scenario where the broadband remote access server is used to implement the address translation method provided in the first aspect, the address translation system may further include an authentication server, which may be used to implement the address translation method provided in the second aspect. The authentication server may be an authentication, authorization, and accounting (AAA) server.

[0053] In a twelfth aspect, a chip is provided, which can be used to implement the address conversion method provided in any of the above aspects.

[0054] In summary, the present application provides an address conversion method, device and system. The solution provided by the present application can convert the source address of the first message from the first private network address to the target address based on the first message of the first user being a message of the target application, and then send it to the first forwarding device. In addition, the traceability information of the first user includes not only the target address corresponding to the first private network address, but also the first public network address and the first port range corresponding to the first private network address. Since the first private network address corresponds to two different addresses in the traceability information of the first user, when performing network address conversion on the message of the first user, the source address of the message can be converted from the first private network address to a different network address based on the type of application to which the message belongs, thereby effectively improving the flexibility of address conversion. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] FIG1 is a schematic structural diagram of a broadband remote access system provided in an embodiment of the present application;

[0056] FIG2 is a schematic diagram of the structure of a NAT tracing scenario provided in an embodiment of the present application;

[0057] FIG3 is a schematic diagram of a static mapping algorithm provided in an embodiment of the present application;

[0058] FIG4 is a schematic diagram of an application scenario of an address conversion method provided in an embodiment of the present application;

[0059] FIG5 is a flow chart of an address conversion method provided in an embodiment of the present application;

[0060] FIG6 is a flow chart of another address conversion method provided in an embodiment of the present application;

[0061] 7 is a schematic diagram of a process of reporting a billing message to an authentication server according to an embodiment of the present application;

[0062] 8 is a schematic diagram of a process of forwarding a message by a broadband remote access server according to an embodiment of the present application;

[0063] FIG9 is a flow chart of another address conversion method provided in an embodiment of the present application;

[0064] 10 is a schematic diagram of another process of reporting a billing message to an authentication server according to an embodiment of the present application;

[0065] FIG11 is a flow chart of another address conversion method provided in an embodiment of the present application;

[0066] FIG12 is a flow chart of another address conversion method provided in an embodiment of the present application;

[0067] FIG13 is a flow chart of another address conversion method provided in an embodiment of the present application;

[0068] FIG14 is a schematic structural diagram of an address translation device provided in an embodiment of the present application;

[0069] FIG15 is a schematic structural diagram of another address translation device provided in an embodiment of the present application;

[0070] FIG16 is a schematic structural diagram of another address translation device provided in an embodiment of the present application;

[0071] FIG17 is a schematic structural diagram of another address translation device provided in an embodiment of the present application;

[0072] FIG18 is a schematic structural diagram of another address translation device provided in an embodiment of the present application;

[0073] FIG19 is a schematic structural diagram of another address conversion device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0074] The following describes in detail the address translation method, device, and system provided by the embodiments of the present application in conjunction with the accompanying drawings. First, the technical terms involved in the solutions provided by the embodiments of the present application are introduced.

[0075] Application acceleration: Forwards application traffic to an accelerated path (also called a dedicated acceleration channel) to ensure latency and bandwidth for clients accessing application servers, improving user experience.

[0076] Accelerated path: A forwarding path with low latency and guaranteed bandwidth.

[0077] Acceleration router: A router deployed at the front end of the acceleration path, used to introduce (i.e., direct) traffic to the acceleration path.

[0078] Static tracing: A NAT tracing technology that uses static mapping of private network addresses to public network addresses for network address translation. This is a tracing method that does not require NAT logs.

[0079] RADIUS tracing: A NAT tracing technology in which users dynamically obtain public IP addresses and port numbers, pass them to the AAA server via RADIUS accounting messages, and perform tracing on the AAA server. This tracing method does not require NAT logs.

[0080] To implement application acceleration, as shown in Figure 1, an SA service board can be added to the BRAS (also known as the BNG). The BRAS can direct end-user traffic to the SA service board for application identification, and then to the distributed NAT service board for network address translation (i.e., NAT processing). The SA service board can then forward the identified traffic of the designated application to the acceleration router. For example, the SA service board can use policy-based routing redirection to direct the traffic of the designated application to the acceleration router via a virtual private network (VPN) tunnel or an SRv6 tunnel. SRv6 refers to the Internet Protocol version 6 (IPv6) technology based on segment routing (SR). It is understood that the BRAS (or BNG) can be a physical BRAS or a BRAS with a separated control plane (CP) and user plane (UP) (also known as CU separation), also known as a virtual broadband remote access server (vBRAS) system. The SA service board can be inserted into both types of BRAS, wherein the SA service board in the vBRAS system can be inserted into the UP device.

[0081] The acceleration router can perform centralized NAT processing on the received traffic (that is, a NAT device for performing NAT processing on the traffic can be hung on the acceleration router), and forward it to the acceleration access point so that the acceleration access point sends the traffic to the destination device through a dedicated acceleration channel. Optionally, the destination device can be an overseas server. In addition, in order to ensure that the traffic returned from the destination device can also be returned to the acceleration router through a dedicated acceleration channel, the acceleration router (such as a NAT device hung on the side) must also publish the public network route to the dedicated acceleration channel. Thus, after the acceleration access point receives the traffic returned by the destination device, it can return the traffic from the dedicated acceleration channel to the acceleration router by checking the route, and then the acceleration router returns it to the BRAS.

[0082] For traffic from other applications (i.e., non-accelerated traffic), as shown in Figure 1, the BRAS can direct this traffic to the distributed NAT service board for NAT processing. This traffic can then be forwarded to backbone network routers via the core router (CR). The backbone network routers can then forward the traffic to the destination device via the Internet (i.e., non-accelerated channels).

[0083] As shown in Figure 1, end-user traffic can be forwarded to the BRAS via network devices such as optical network terminals (ONTs), optical line terminals (OLTs), and local area network switches (LSWs). Both acceleration routers and access points can be deployed in data centers (DCs).

[0084] Because NAT technology changes the IP address used to access the internet, it's often necessary to store NAT logs for home broadband users accessing the internet through NAT to facilitate network monitoring and auditing. Regulators can determine user information by querying NAT logs based on the IP address and port number of traffic to a website. Before deploying the application acceleration solution, the BRAS can implement RAIDUS source tracing. Specifically, the BRAS can use RAIDUS billing messages to report the user's private IP address, public IP address, and port range to the AAA server for storage, enabling NAT source tracing. After deploying the application acceleration solution, a NAT device is added to the acceleration router. Since the acceleration router doesn't interact with the AAA server, RAIDUS source tracing is unavailable. Therefore, as shown in Figure 2, a syslog server is required to support NAT source tracing. However, adding a syslog server increases NAT source tracing costs and increases the space and power consumption of the operator's equipment room.

[0085] Figure 3 is a schematic diagram of the principle of a static mapping algorithm provided by an embodiment of the present application. As shown in Figure 3, the static mapping algorithm can map an intranet IP address in the intranet address pool (inside pool) to a public IP address in the public address pool (global pool), as well as a port segment. For example, the port segment can include n=4023 ports. When performing NAT tracing, the intranet IP address in the intranet address pool can be retrieved through the public IP address and port segment in the public address pool, and the AAA server can query the determined user through the intranet IP address. Among them, the intranet address pool can be a private address pool or a public address pool. Based on the principle of the above-mentioned static mapping algorithm, it can be seen that in order to ensure that the user can be accurately identified by the intranet IP address, it is necessary to ensure that one intranet IP address represents only one user.

[0086] Because the BRAS uses NAT technology to translate multiple users' private IP addresses into a single public IP address, a single public IP address represents multiple users for traffic received by the acceleration router. If a NAT device is added to the acceleration router and uses a static mapping algorithm for static source tracing, the static mapping algorithm requires that a single private IP address before translation (e.g., the public IP address after BRAS translation) represents only one user. Therefore, the private address pool must be allocated to the entire home broadband address range. Consequently, the public address pool allocated to the acceleration router must also cover all home broadband users. However, after deploying an application acceleration solution, not all users will use the application to be accelerated. For example, for a particular gaming application, only 10% of all home broadband users use this application, and their private IP addresses are not fixed. Consequently, only 10% of users' traffic actually needs to be directed to the acceleration router. Consequently, most of the public addresses allocated to the acceleration router remain unused, resulting in a waste of public address resources.

[0087] Figure 4 is a schematic diagram of the structure of an address translation system provided by an embodiment of the present application. As shown in Figure 4, the system may include: BRAS 01 and a first forwarding device 02. BRAS 01 is responsible for allocating private IP addresses, public IP addresses, and port segments (also known as port ranges) when home broadband users go online. As shown in Figure 4, BRAS 01 is also deployed with an SA service board and a NAT service board. The SA service board can be used to perform application identification on the traffic received by BRAS 01 to identify the traffic of the target application. The NAT service board can perform network address translation, i.e., NAT processing, on the traffic received by BRAS 01. For the identified target application traffic, BRAS 01 can redirect the target application traffic to the first forwarding device 02 through policy routing. For example, assuming that a VPN tunnel is between BRAS 01 and the first forwarding device 02, BRAS 01 can redirect the accelerated traffic to the VPN tunnel through policy routing.

[0088] The first forwarding device 02 can be a forwarding device dedicated to forwarding traffic from the target application. For example, assuming the target application is an application that has deployed an acceleration service, the first forwarding device 02 can be an acceleration router that can forward messages through an accelerated forwarding channel. Furthermore, the first forwarding device 02 can publish an IP address from an independent public network pool through the dedicated acceleration channel to route it to the destination device (such as an overseas server) to divert the return traffic to the destination device.

[0089] Optionally, referring to Figure 4 , the address translation system may further include an authentication server 03 and a second forwarding device 04. The authentication server 03 may be an AAA server, configured to receive user tracing information reported by the BRAS 01 and store NAT logs, also known as RADIUS logs. The tracing information may include the user's private IP address, public IP address, and port range.

[0090] The second forwarding device 04 can be a forwarding device for forwarding traffic from non-target applications. For example, the second forwarding device 04 can be a backbone network router capable of forwarding packets via a public Internet channel. For example, as shown in Figure 1, the BRAS 01 can establish communication connections with the first forwarding device 02 and the second forwarding device 04 via the CR.

[0091] Optionally, the BRAS 01 or BNG may be an intelligent device, that is, the BRAS may be an iBRAS, and the BNG may be an iBNG.

[0092] FIG5 is a flow chart of an address translation method provided by an embodiment of the present application, which can be applied to an address forwarding device. Optionally, the address forwarding device can be a broadband remote access server (BRAS) such as in the system shown in FIG4 . Furthermore, the address translation method can implement NAT tracing in application acceleration scenarios without deploying a syslog server in the system, thereby effectively simplifying the system structure and reducing system power consumption and cost. Taking the address forwarding device as a broadband remote access server as an example, as shown in FIG5 , the method includes:

[0093] Step 101: Based on the received first message from the first user being a message of a target application, the broadband remote access server converts the source address of the first message from a first private network address to a target address and then sends the converted message to a first forwarding device.

[0094] In an embodiment of the present application, after receiving a first message from a first user, the broadband remote access server can identify whether the first message is a message from a target application. If the first message is a message from a target application, the broadband remote access server can convert the source address of the first message from the first private network address to the target address and send the converted first message to the first forwarding device. In other words, the broadband remote access server can perform network address translation on the first message and forward it to the first forwarding device, so that the first forwarding device can continue to forward the first message.

[0095] The target application may be an application that requires traffic forwarding by a first forwarding device. For example, the first forwarding device may be an acceleration router, and the target application may be an application deployed with an acceleration service, that is, the target application may be an accelerated application.

[0096] Step 102: The broadband remote access server reports the tracing information of the first user to the authentication server. The tracing information includes a target address corresponding to the first private network address, and a first public network address and a first port range corresponding to the first private network address.

[0097] The target address is different from the first public network address, that is, in the traceability information of the first user, the first private network address corresponds to two different IP addresses. In an embodiment of the present application, the target address can be a private network address or a public network address. The first public network address and the first port range can be used by the broadband remote access server to perform network address translation on other messages of the first user (i.e., messages that do not belong to the target application).

[0098] Optionally, the broadband remote access server may report first information and second information to the authentication server, respectively. The first information may include a first public network address and a first port range corresponding to the first private network address. The second information may include a target address corresponding to the first private network address. For example, both the first message and the second message may be RADIUS messages.

[0099] In summary, an embodiment of the present application provides an address conversion method, which can convert the source address of the first message from the first private network address to the target address based on the first message of the first user being a message of the target application, and then send it to the first forwarding device. In addition, the tracing information of the first user includes not only the target address corresponding to the first private network address, but also the first public network address and the first port range corresponding to the first private network address. Since the first private network address corresponds to two different addresses in the tracing information of the first user, when performing network address conversion on the message of the first user, the source address of the message can be converted from the first private network address to a different network address based on the type of application to which the message belongs, thereby effectively improving the flexibility of address conversion.

[0100] Among them, for the scenario where the target address is a private network address, the target address can only represent the first user, thereby ensuring that the first forwarding device can use static mapping to perform network address conversion on the first message. In addition, when tracing the source of the first user, the source can be traced through the tracing information stored in the authentication server and the static mapping algorithm in the first forwarding device. For the scenario where the target address is a public network address, since the broadband remote access server has converted the source address of the first message into a public network address in an independent public network address pool, the first forwarding device no longer needs to perform network address conversion on the first message. In addition, when tracing the source of the first user, the source can be traced directly through the tracing information stored in the authentication server. Both of the above scenarios do not require the deployment of a syslog server, which effectively simplifies the system structure, reduces system costs, and avoids the burden of increasing space and power consumption in the operation room.

[0101] The following describes the address translation method provided by the embodiment of the present application, taking the target address as a private network address as an example. As shown in FIG6 , the method includes:

[0102] Step 201: After a first user comes online, the broadband remote access server reports a billing start message to an authentication server.

[0103] Referring to Figure 7, after detecting that the first user has come online, the broadband remote access server can first authenticate the first user through an authentication server (such as an AAA server). After determining that the first user has passed the authentication, the broadband remote access server can allocate a first private network address to the first user from a pre-configured first private network address pool, and can allocate a first public network address and a corresponding first port range to the first user from a pre-configured first public network address pool. Afterwards, the broadband remote access server can report a billing start message to the authentication server, and the billing start message includes the first public network address and the first port range corresponding to the first private network address. It is understandable that the billing start message can also include the first private network address.

[0104] It can also be understood that the first private network address pool can be a general private network address pool, and the first public network address pool can be a public network address pool used to perform network address translation on traffic of non-target applications, that is, a non-accelerated traffic public network address pool.

[0105] For example, assume that the first private network address pool configured on the broadband remote access server is 172.0.0.0 / 15 and the first public network address pool is 10.0.0.0 / 19. After a first user comes online, the broadband remote access server can allocate a first private network address 172.0.0.1 from the first private network address pool to the first user, and a first public network address 10.0.0.1 and a first port range 1024-5055 from the first public network address pool to the first user.

[0106] Furthermore, as shown in FIG7 , the broadband remote access server can report an accounting request message to the authentication server. This accounting request message is of the start type and, therefore, can also be referred to as an accounting start message. The accounting start message includes the following type-length-value (TLV) fields: a NAT IP address (NAT-IP-Address) field, a NAT start port (NAT-Start-Port) field, and a NAT end port (NAT-End-Port) field. The NAT IP address field carries the first public network address 10.0.0.1, the NAT start port field carries the start port 1024 of the first port range, and the NAT end port field carries the end port 5055 of the first port range.

[0107] Step 202: The broadband remote access server converts the source address of the first message from the first private network address to a target address in the second private network address pool based on the received first message from the first user being a message of the target application.

[0108] After the broadband remote access server receives the first message from the first user, it can first detect whether the first message is a message of the target application. The target application can be an application that needs to forward traffic by the first forwarding device, for example, it can be an application that deploys an acceleration service. If the broadband remote access server determines that the first message is a message of the target application, the source address of the first message can be converted from the first private network address to the target address in the second private network address pool, that is, the target address is a private network address. The second private network address pool can be a private network address pool configured in the broadband remote access server and is specifically used to perform network address conversion on the traffic of the target application (such as accelerated traffic). It can be seen that the second private network address pool is different from the first private network address pool. For example, the second private network address pool can be 172.100.0.0 / 18.

[0109] In an embodiment of the present application, when performing network address translation on the first message, the broadband remote access server may translate only the source address of the first message without translating the source port of the first message. In other words, the broadband remote access server may perform NAT processing on the first message using a no-port address translation (no-PAT) approach.

[0110] As a possible example, as shown in FIG4 , an SA service board is deployed in the broadband remote access server, and the broadband remote access server can determine that the first message of the first user is a message of the target application through the SA service board.

[0111] As another possible example, the broadband remote access server may not need to deploy an SA service board, and the broadband remote access server may determine, through an ACL, that the first message of the first user is a message of a target application.

[0112] For example, referring to Figure 8, a plurality of line processing units (LPUs) and a plurality of versatile service units (VSUs) may be deployed in a broadband remote access server. Among them, the LPU is also called an interface board, and the VSU can serve as an SA service board or a NAT service board. Assume that the destination address of the first message received by the LPU is 201.1.1.1, the source address is 172.0.0.1, the destination port is 80, and the source port is 50001. The SA service board identifies the first message (for example, through seven-layer resolution), and after determining that the first message is a message of the target application, a tag may be added to the first message, and the tag is used to indicate that the first message is a message of the target application. For example, SA may encapsulate a message header in the outer layer of the first message and add a tag to the message header. Afterwards, the SA service board may divert the first message to the NAT service board. The NAT service board can then convert the source address of the first message from 172.0.0.1 to the destination address 172.100.0.1 in the second private network address pool 172.100.0.0 / 18 based on the tag in the first message. As can be seen from Figure 8, after the NAT service board performs NAT processing on the first message, the source port of the first message remains unchanged.

[0113] Step 203: The broadband remote access server sends the first message after network address translation to the first forwarding device.

[0114] After the broadband remote access server completes the network address translation of the first message, it can send the first message after the network address translation to the first forwarding device. For example, referring to Figure 8, the NAT service board in the broadband remote access server can forward the first message after the network address translation to the LPU, and the LPU can then forward the first message to the first forwarding device, such as the acceleration router, so that the acceleration router can forward the first message through the accelerated path.

[0115] It is understandable that, before sending the first message to the first forwarding device, the LPU may further remove the message header encapsulated by the SA service board in the outer layer of the first message to avoid affecting the normal forwarding of the first message.

[0116] Step 204: The broadband remote access server reports a billing update message to the authentication server based on the fact that the received first message is a message of the target application.

[0117] After determining that the first message is a message for the target application, the broadband remote access server can convert the source address of the first message into a target address before forwarding it. Therefore, in order to facilitate tracing the source of the first user, the broadband remote access server needs to report a billing update message to the authentication server. The billing update message includes the target address corresponding to the first private network address.

[0118] For example, as shown in FIG7 , the broadband remote access server may report an accounting request message to the authentication server, and the accounting request message is of an interim update type, and therefore may also be referred to as an accounting update message.

[0119] Optionally, the accounting update message may include a newly added TLV field: a NAT-Ext-IP-Address field. The NAT-Ext-IP-Address field may carry the target address 172.100.0.1.

[0120] Alternatively, the accounting update message can reuse existing fields to update and report the target address, the first public network address, and the first port range. For example, referring to Figure 7 , the accounting update message can include two NAT IP address fields, each carrying the first public network address 10.0.0.1 and the target address 172.100.0.1. Furthermore, the accounting update message also includes a NAT start port field and a NAT end port field to carry the first port range.

[0121] It is understandable that, after receiving the first target application message sent by the first user, the broadband remote access server may report the billing update message of the first user to the authentication server.

[0122] It is also understandable that the above-mentioned accounting start message and accounting update message can also be collectively referred to as RADIUS message, RADIUS interface message or RADIUS message. After receiving the RADIUS message, the authentication server can save the NAT log information of the first user.

[0123] Step 205: The first forwarding device performs network address translation on the first message and then forwards it.

[0124] In an embodiment of the present application, the first forwarding device may perform network address translation on the received first message using NAT static mapping and forward the first message after the network address translation. For example, referring to FIG1 , assuming that the first forwarding device is an acceleration router, the acceleration router may forward the first message to an acceleration access point, so that the acceleration access point sends the first message to the destination device via an acceleration channel.

[0125] It can be understood that in the NAT static mapping algorithm configured in the first forwarding device, the intranet IP segment is the second private network address pool (for example, 172.100.0.0 / 18), and the public network IP segment can be the third public network address pool, for example, 20.0.0.0 / 24.

[0126] It is also understandable that the NAT static mapping method used by the first forwarding device may be a PAT method, that is, when performing network address translation, both the source address and the source port are translated. For example, the first forwarding device may translate the source address of the first message from the first private network address to a public network address in the third public network address pool, and translate the source port of the first message to a port in the fourth port range.

[0127] In this embodiment of the present application, to ensure that the return traffic of the destination device can also be forwarded by the first forwarding device, the first forwarding device needs to publish the route of the third public network address pool (e.g., 20.0.0.0 / 24). For example, the first forwarding device can publish the user network route (UNR) of the third public network address pool to the acceleration access point, and the acceleration access point then publishes the UNR route to the acceleration channel.

[0128] Step 206: The broadband remote access server performs network address translation on the second message received from the first user based on the fact that the second message is not a message of the target application.

[0129] If the broadband remote access server receives the second message from the first user, it may also first detect whether the second message is a message of the target application, for example, detect whether the second message belongs to accelerated traffic. The detection method can refer to the relevant description of step 202 above and will not be repeated here. If the broadband remote access server determines that the second message is not a message of the target application, it may perform network address translation on the second message. The network address translation may include: converting the source address of the second message from the first private network address to the first public network address, and converting the source port of the second message to a port in the first port range. That is, the broadband remote access server may use PAT to perform NAT processing on the second message.

[0130] For example, referring to Figure 8 , assume that the destination address of the second message received by the LPU is 201.1.1.1, the source address is 172.0.0.1, the destination port is 80, and the source port is 50001. After the SA service board identifies the second message and determines that the second message is not a message for the target application, it can directly direct the second message to the NAT service board. The NAT service board can then translate the source address of the second message from the first private network address 172.0.0.1 to the first public network address 10.0.0.1, and translate the source port of the second message from 50001 to port 1025 in the first port range.

[0131] Step 207: The broadband remote access server sends the second message after network address translation to the second forwarding device.

[0132] After completing the network address translation of the second message, the broadband remote access server can send the second message after the network address translation to the second forwarding device. The second forwarding device can be a device for forwarding traffic of non-target applications, for example, the second forwarding device can be a backbone network router for forwarding ordinary traffic (i.e., non-accelerated traffic).

[0133] For example, referring to Figure 8, the NAT service board in the broadband remote access server can forward the second message after NAT processing to the LPU, and the LPU can then forward the second message to the backbone network router so that the backbone network router can forward the second message through a common path (such as the Internet).

[0134] Optionally, as shown in Figure 8, the message of the target application (such as the first message) and the message of the non-target application (such as the second message) can be forwarded by different LPUs in the broadband remote access server, or they can be forwarded by the same LPU. This embodiment of the present application does not limit this.

[0135] Step 208: The broadband remote access server performs network address translation on the third message received from the second user based on the fact that the third message is not a message of the target application.

[0136] If the broadband remote access server receives a third message from the second user, it may also first detect whether the third message is a message from the target application, for example, detecting whether the third message is accelerated traffic. This detection method can refer to the relevant description of step 202 above and is not repeated here. If the broadband remote access server determines that the third message is not a message from the target application, it may perform network address translation on the third message. This network address translation may include: translating the source address of the third message from the second private network address to the second public network address, and translating the source port of the third message to a port within a third port range.

[0137] The second private network address may be allocated by the broadband remote access server from the first private network address pool after the second user comes online. The second public network address and the third port range may be allocated by the broadband remote access server from the first public network address pool after the second user comes online.

[0138] Step 209: The broadband remote access server sends the third message after network address translation to the second forwarding device.

[0139] After completing the network address translation of the third message, the broadband remote access server can send the translated third message to the second forwarding device. The implementation process of step 209 can refer to the relevant description of step 207 above, which will not be repeated here.

[0140] Based on steps 201 to 209 above, after a user goes online, the broadband remote access server can first assign a private network address to the user from the first private network address pool, and then assign a public network address and port range to the user from the first public network address pool. For the user's normal traffic, the broadband remote access server can perform NAT processing using PAT according to the assigned public network address and port range, and then forward the traffic to the second forwarding device. For traffic from the target application, the broadband remote access server can perform NAT processing using the second private network address pool without PAT, and then forward the traffic to the first forwarding device.

[0141] Optionally, for messages of the target application sent by any user, the broadband remote access server can use the method shown in step 202 above to perform network address translation on the message, that is, use the second private network address pool to perform network address translation on the message. Alternatively, the broadband remote access server can also use the method shown in step 202 above to perform network address translation on the message only for messages of the target application sent by the target user. The target user may be a user who has applied for the service of the target application (such as an acceleration service). For messages of the target application sent by other users, as well as messages of non-target applications sent by the target user, network address translation can be performed using the method shown in step 206 or step 208 above.

[0142] It is understood that the order of the steps in the address translation method provided in the embodiments of the present application can be adjusted appropriately, and the number of steps can be increased or decreased depending on the circumstances. For example, step 204 can be performed before step 203; or, steps 206 and 207 can be deleted depending on the circumstances; or, steps 208 and 209 can be deleted depending on the circumstances.

[0143] In summary, the address conversion method provided in the embodiment of the present application can convert the source address of the first message from the first private network address to the target address in the second private network address pool based on the first message of the first user being the message of the target application, and then send it to the first forwarding device. In addition, the tracing information of the first user includes not only the target address corresponding to the first private network address, but also the first public network address and the first port range corresponding to the first private network address. Since the target address can only represent the first user, it can be ensured that the first forwarding device can use a static mapping method to perform network address conversion on the first message. Accordingly, when tracing the source of the first user, the source can be traced through the tracing information stored in the authentication server and the static mapping algorithm in the first forwarding device. Since there is no need to deploy a syslog server, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation room can be avoided.

[0144] Furthermore, because the source addresses of target application packets can be translated into a separate second private network address pool, the source addresses of target application packets received by the first forwarding device are continuously distributed. This saves public network address resources required for static mapping on the first forwarding device and avoids wasting public network address resources.

[0145] The following describes the address translation method provided by the embodiment of the present application, taking the target address as a public network address as an example. As shown in FIG9 , the method includes:

[0146] Step 301: After a first user comes online, the broadband remote access server reports a billing start message to an authentication server.

[0147] Referring to Figure 10, after detecting that the first user has come online, the broadband remote access server can first authenticate the first user through an authentication server (such as an AAA server). After determining that the first user has passed the authentication, the broadband remote access server can allocate a first private network address to the first user from a pre-configured first private network address pool, and can allocate a first public network address and a corresponding first port range to the first user from a pre-configured first public network address pool. Afterwards, the broadband remote access server can report a billing start message to the authentication server, and the billing start message includes the first public network address and the first port range corresponding to the first private network address. It is understandable that the billing start message can also include the first private network address.

[0148] It can also be understood that the first private network address pool can be a general private network address pool, and the first public network address pool can be an address pool used to perform network address translation on traffic of non-target applications, that is, a non-accelerated traffic public network address pool.

[0149] For example, assume that the first private network address pool configured on the broadband remote access server is 172.0.0.0 / 15 and the first public network address pool is 10.0.0.0 / 19. After the first user goes online, the broadband remote access server can allocate the first private network address 172.0.0.1, the corresponding first public network address 10.0.0.1, and the first port range 1024-5055 to the first user. As shown in Figure 10, in the billing start message submitted by the broadband remote access server to the authentication server, the NAT IP address field carries the first public network address 10.0.0.1, the NAT start port field carries the start port 1024 of the first port range, and the NAT end port field carries the end port 5055 of the first port range.

[0150] Step 302: The broadband remote access server publishes the route of the second public network address pool to the first forwarding device.

[0151] In an embodiment of the present application, the broadband remote access server is further configured with a second public network address pool. This second public network address pool can be a public network address pool dedicated to performing network address translation on target application traffic (e.g., accelerated traffic). It can be seen that this second public network address pool is different from the first public network address pool. For example, this second public network address pool can be 20.0.0.0 / 24.

[0152] It is understood that after the broadband remote access server uses the second public network address pool to perform network address translation on the target application's traffic, it forwards it to the first forwarding device. The first forwarding device no longer needs to perform network address translation on the received target application's traffic, i.e., it does not need to perform NAT processing. Therefore, the broadband remote access server must also publish routes from the second public network address pool to the first forwarding device, so that the first forwarding device can publish routes from the second public network address pool.

[0153] Step 303: The first forwarding device publishes the route of the second public network address pool.

[0154] After receiving the route of the second public network address pool published by the broadband remote access server, the first forwarding device can continue to publish the route of the second public network address pool so that the return traffic of the target application can also be forwarded through the first forwarding device.

[0155] For example, assuming a VPN tunnel is established between the broadband remote access server and the first forwarding device, the broadband remote access server can import routes from the second public network address pool (i.e., NAT public network routes) into the VPN tunnel. The first forwarding device can then cross-introduce the VPN routes to the public network and publish them to the destination device (e.g., an overseas server).

[0156] Step 304: Based on the received first message from the first user being a message of the target application, the broadband remote access server converts the source address of the first message from the first private network address to a target address in the second public network address pool.

[0157] After receiving a first message from a first user, the broadband remote access server may first detect whether the first message is a message from a target application, for example, detecting whether the first message is accelerated traffic. If the first message is determined to be a message from the target application, the server may translate the source address of the first message from the first private network address to a destination address in the second public network address pool.

[0158] Optionally, the broadband remote access server may further convert the source port of the first message into a port in the second port range. That is, the broadband remote access server may perform NAT processing on the first message in a PAT manner.

[0159] As a possible example, as shown in FIG4 , an SA service board is deployed in the broadband remote access server, and the broadband remote access server can determine that the first message of the first user is a message of the target application through the SA service board.

[0160] As another possible example, the broadband remote access server may not need to deploy an SA service board, and the broadband remote access server may determine, through an ACL, that the first message of the first user is a message of a target application.

[0161] Step 305: The broadband remote access server sends the first message after network address translation to the first forwarding device.

[0162] After completing the network address translation of the first message, the broadband remote access server can send the first message after the network address translation to the first forwarding device. The implementation process of step 305 can refer to the relevant description of step 203 above, which will not be repeated here.

[0163] Step 306: The broadband remote access server reports a billing update message to the authentication server based on the fact that the received first message is a message of the target application.

[0164] After determining that the first message is for the target application, the broadband remote access server can convert the source address of the first message to a target address in the second public network address pool before forwarding it. Therefore, to facilitate tracing the first user, the broadband remote access server must also report a billing update message to the authentication server. The billing update message includes the target address corresponding to the first private network address. Furthermore, if the broadband remote access server also converts the source port of the first message based on the second port range, the billing update message may also include the second port range.

[0165] For example, as shown in Figure 10, the accounting update message reported by the broadband remote access server to the authentication server may include newly added TLV fields: a NAT newly added IP address (Nat-Ext-IP-Address) field, a NAT newly added start port (Nat-Ext-Start-Port) field, and a NAT newly added end port (Nat-Ext-End-Port) field. The NAT newly added IP address field may carry the destination address 20.0.0.1, the NAT newly added start port field may carry the start port 1024 of the second port range, and the NAT newly added end port field may carry the end port 2047 of the second port range.

[0166] Alternatively, the billing update message can reuse existing fields to update and report the target address, the second port range, and the first public network address and first port range. For example, referring to Figure 10 , the billing update message can include two NAT IP address fields, each carrying the first public network address 10.0.0.1 and the target address 20.0.0.1. Furthermore, the billing update message can also include two NAT start port fields and two NAT end port fields, each carrying the first port range and the second port range.

[0167] It is understandable that, after receiving the first target application message sent by the first user, the broadband remote access server may report the billing update message of the first user to the authentication server.

[0168] It is also understandable that the above-mentioned accounting start message and accounting update message can also be collectively referred to as RADIUS message, RADIUS interface message or RADIUS message. After receiving the RADIUS message, the authentication server can save the NAT log information of the first user.

[0169] Step 307: The first forwarding device forwards the first message.

[0170] After receiving the first message, the first forwarding device may directly forward the first message, for example, to the acceleration access point. Furthermore, the first forwarding device does not need to perform network address translation on the first message. Accordingly, the source address of the first message forwarded by the first forwarding device remains the destination address.

[0171] Step 308: The broadband remote access server performs network address translation on the second message received from the first user based on the fact that the second message is not a message of the target application.

[0172] If the broadband remote access server receives the second message from the first user, it may also first detect whether the second message is a message of the target application, for example, detect whether the second message belongs to accelerated traffic. The detection method can refer to the relevant description of steps 202 and 304 above, which will not be repeated here. If the broadband remote access server determines that the second message is not a message of the target application, it may perform network address translation on the second message. The network address translation may include: converting the source address of the second message from the first private network address to the first public network address, and converting the source port of the second message to a port in the first port range. That is, the broadband remote access server may use PAT to perform NAT processing on the second message.

[0173] Step 309: The broadband remote access server sends the second message after network address translation to the second forwarding device.

[0174] The second forwarding device may be a device for forwarding messages of non-target applications. For example, the second forwarding device may be a backbone network router for forwarding ordinary traffic (ie, non-accelerated traffic).

[0175] Step 310: The broadband remote access server performs network address translation on the third message received from the second user based on the fact that the third message is not a message of the target application.

[0176] If the broadband remote access server receives a third message from the second user, it may also first detect whether the third message is a message from the target application, for example, detecting whether the third message is accelerated traffic. This detection method can refer to the relevant descriptions of steps 202 and 304 above and will not be repeated here. If the broadband remote access server determines that the third message is not a message from the target application, it may perform network address translation on the third message. This network address translation may include: translating the source address of the third message from the second private network address to the second public network address, and translating the source port of the third message to a port within a third port range.

[0177] The second private network address may be allocated by the broadband remote access server from the first private network address pool after the second user comes online. The second public network address and the third port range may be allocated by the broadband remote access server from the first public network address pool after the second user comes online.

[0178] Step 311: The broadband remote access server sends a third message after network address translation to the second forwarding device.

[0179] After the broadband remote access server completes NAT processing on the third message, it can send the NAT-processed third message to the second forwarding device. The implementation process of the above steps 308 to 311 can refer to the relevant description of steps 206 to 209, which will not be repeated here.

[0180] Based on steps 301 to 311 above, it can be seen that after a user goes online, the broadband remote access server can first assign a private network address to the user from the first private network address pool, and then assign a public network address and port range to the user from the first public network address pool. For the user's normal traffic, the broadband remote access server can perform PAT NAT processing on the normal traffic according to the assigned public network address and port range, and forward it to the second forwarding device. For the traffic of the target application, the broadband remote access server can re-assign a public network address and port range from the second public network address pool, and perform PAT NAT processing on the traffic of the target application using the re-assigned public network address and port range, and then forward it to the first forwarding device.

[0181] Based on the above steps 301 to 311, it can be seen that for the scenario where the target address is a target address in the second public network address pool, since the first forwarding device no longer needs to perform network address translation on the message received from the target application, there is no need to deploy a NAT device on the first forwarding device.

[0182] Optionally, for messages of the target application sent by any user, the broadband remote access server can use the method shown in step 304 above to perform network address translation on the message, that is, use the second public network address pool to perform network address translation on the message. Alternatively, the broadband remote access server can also use the method shown in step 304 above to perform network address translation on the message only for the message of the target application sent by the target user. The target user may be a user who has applied for the service of the target application (such as an acceleration service). For messages of the target application sent by other users, as well as messages of non-target applications sent by the target user, network address translation can be performed using the method shown in step 308 or step 310 above.

[0183] It is understood that the order of the steps in the address translation method provided in the embodiments of the present application can be adjusted appropriately, and the number of steps can be increased or decreased depending on the circumstances. For example, step 302 can be performed before step 301; or step 306 can be performed before step 305; or steps 308 and 309 can be deleted depending on the circumstances; or steps 310 and 311 can be deleted depending on the circumstances.

[0184] In summary, in the address conversion method provided in the embodiment of the present application, the broadband remote access server can convert the source address of the first message from the first private network address to the target address in the second public network address pool based on the first message of the first user being the message of the target application, and then send it to the first forwarding device. Moreover, the tracing information of the first user includes not only the target address corresponding to the first private network address, but also the first public network address and the first port range corresponding to the first private network address. Since the broadband remote access server has converted the source address of the first message into a public network address, the first forwarding device does not need to perform network address conversion on the first message. Moreover, when tracing the source of the first user, the tracing can be performed directly through the tracing information stored in the authentication server. The above solution does not need to deploy a syslog server, thereby effectively simplifying the system structure, reducing system costs, and avoiding the burden of increasing space and power consumption in the operation room.

[0185] Table 1 shows the differences between the method embodiments shown in Figures 6 and 9. Referring to Table 1, it can be seen that for scenarios where the target address is a private address in the second private address pool, the target application's traffic needs to undergo two NAT processes, and when tracing the user information, a combination of static tracing and RADIUS tracing is required. For scenarios where the target address is a public address in the second public address pool, the target application's traffic only needs to undergo one NAT process by the broadband remote access server, and when tracing the user information, only RADIUS tracing is required.

[0186] Table 1

[0187] FIG11 is a flow chart of another address translation method provided in an embodiment of the present application, which can be applied to an address forwarding device. Optionally, the address forwarding device can be a broadband remote access server (BRAS) such as that in the system shown in FIG4 . Taking the address forwarding device as a broadband remote access server as an example, as shown in FIG11 , the method includes:

[0188] Step 401: Based on the fact that a first message sent by a first user is a message of a target application, the first message is sent to a first forwarding device, so that the first forwarding device performs network address translation on the first message.

[0189] In an embodiment of the present application, after receiving a first message from a first user, the broadband remote access server can identify whether the first message is a message from a target application. If the first message is a message from a target application, the broadband remote access server can directly send the first message to the first forwarding device. In other words, the broadband remote access server does not need to perform network address translation (NAT) on the first message.

[0190] The source address of the first message is a first private network address. The first forwarding device is capable of performing network address translation on the received first message. The target application may be an application that requires traffic forwarding by the first forwarding device. For example, the first forwarding device may be an acceleration router, and the target application may be an application that has an acceleration service deployed, i.e., the target application may be an accelerated application.

[0191] Optionally, the first user may be a user who has applied for a service (such as an acceleration service) of the target application, and the first user may also be referred to as a subscribed user.

[0192] Step 402: Based on the fact that the second message sent by the first user is not a message of the target application, perform network address translation on the second message and then send it to the second forwarding device.

[0193] If the broadband remote access server determines that the second message sent by the first user is not a message for the target application, it may first perform network address translation (i.e., NAT processing) on ​​the second message before sending it to the second forwarding device. The source address of the second message is also the first private network address. For example, the broadband remote access server may translate the source address of the second message from the first private network address to the first public network address, and translate the source port of the second message to a port within the first public network port range.

[0194] In summary, the embodiments of the present application provide an address translation method that can directly send a first message from a target application to a first forwarding device, i.e., without performing network address translation on the first message from the target application. Furthermore, the method can perform network address translation on a second message that is not a target application before sending it to a second forwarding device. Because the method provided in the embodiments of the present application can differentiate between applications and determine whether to perform network address translation or not, the flexibility of address translation is effectively improved.

[0195] Furthermore, since the first message from the target application is not subjected to network address translation, the source address of the first message can represent only the first user. This ensures that the first forwarding device can perform network address translation on the first message using static mapping. Accordingly, when tracing the source of the first user, it can be done directly using the static mapping algorithm in the first forwarding device, without the need to deploy a separate syslog server. This effectively simplifies the system structure, reduces system costs, and avoids increasing the space and power consumption of the operations room.

[0196] FIG12 is a flow chart of another address conversion method provided by an embodiment of the present application, which can be applied to a system such as that shown in FIG4. As shown in FIG12, the method includes:

[0197] Step 501: After a first user comes online, a broadband remote access server allocates a first private network address to the first user from a first private network address pool.

[0198] In an embodiment of the present application, a first private network address pool is configured in the broadband remote access server. This first private network address pool can be an address pool dedicated to allocating private network addresses to target users. The target user can be a user who has applied for services of a target application. After a first user comes online, if the broadband remote access server determines that the first user is the target user, it can allocate a first private network address to the first user from the first private network address pool.

[0199] It is understood that the target application may be an application that requires traffic forwarding by the first forwarding device. For example, the first forwarding device may be an acceleration router, and the target application may be an application that has an acceleration service deployed, that is, the target application may be an accelerated application. Correspondingly, the target user may refer to a user who has applied for (or signed up for) the acceleration service of the target application, and the target user may also be referred to as a signed user.

[0200] It can also be understood that the broadband remote access server can also be configured with a first public network address pool, which can be used to perform address conversion on traffic of non-target applications. After the first user comes online, the broadband remote access server can also allocate a first public network address and a first port range to the first user from the first public network address pool. In addition, the broadband remote access server can also report the traceability information of the first user to the authentication server (for example, it can be reported through a billing start message), and the traceability information includes the first private network address, and the first public network address and the first port range corresponding to the first private network address.

[0201] For example, assuming that the first private network address pool is 172.100.0.0 / 18 and the first public network address pool is 10.0.0.0 / 19, the first private network address allocated by the broadband remote access server to the first user may be 172.100.0.1, the first public network address may be 10.0.0.1, and the first port range may be 1024-5055.

[0202] Step 502: After the second user comes online, the broadband remote access server allocates a second private network address to the second user from the second private network address pool.

[0203] The broadband remote access server is also configured with a second private network address pool, which is different from the first private network address pool. Furthermore, the second private network address pool can be an address pool used to allocate private network addresses to ordinary users, that is, the second private network address pool can be a general private network address pool. An ordinary user can refer to a user who has not applied for the target application service (e.g., an acceleration service), and can also be referred to as a non-contracted user. After the second user comes online, if the broadband remote access server determines that the second user is an ordinary user, it can allocate a second private network address to the second user from the second private network address pool.

[0204] It is understandable that after the second user comes online, the broadband remote access server can also allocate a second public network address and a second port range to the second user from the first public network address pool. In addition, the broadband remote access server can also report the traceability information of the second user to the authentication server (for example, it can be reported through a billing start message), and the traceability information includes the second private network address, and the second public network address and the second port range corresponding to the second private network address. Among them, the second public network address is different from the first public network address, and the second port range can be the same as or different from the first port range. This embodiment of the present application does not limit this.

[0205] For example, assuming that the second private network address pool is 172.0.0.0 / 15 and the first public network address pool is 10.0.0.0 / 19, the second private network address allocated by the broadband remote access server to the second user may be 172.0.0.1, the second public network address may be 10.0.0.2, and the second port range may be 1024-5055.

[0206] Step 503: Based on the fact that the first message sent by the first user is a message of a target application, the broadband remote access server sends the first message to the first forwarding device.

[0207] After receiving the first message sent by the first user, the broadband remote access server can detect whether the first message is a message of the target application. For example, it can detect whether the first message belongs to accelerated traffic. If it is determined that the first message is a message of the target application, the first message can be sent directly to the first forwarding device without performing network address translation on the first message. It is understandable that the source address of the first message of the first user received by the broadband remote access server is the first private network address, and the source address of the first message sent by the broadband remote access server to the first forwarding device is also the first private network address.

[0208] As a possible example, as shown in FIG4 , an SA service board is deployed in the broadband remote access server, and the broadband remote access server can determine that the first message of the first user is a message of the target application through the SA service board.

[0209] As another possible example, the broadband remote access server may not need to be deployed with an SA service board, and the broadband remote access server may determine, through an ACL, that the first message of the first user is a message of a target application.

[0210] Step 504: The first forwarding device performs network address translation on the first message and then forwards it.

[0211] In an embodiment of the present application, the first forwarding device may perform network address translation on the received first message using NAT static mapping and forward the first message after the network address translation. For example, referring to FIG1 , assuming that the first forwarding device is an acceleration router, the acceleration router may forward the first message to an acceleration access point, so that the acceleration access point sends the first message to the destination device via an acceleration channel.

[0212] It can be understood that in the NAT static mapping algorithm configured in the first forwarding device, the intranet IP segment is the first private network address pool (for example, 172.100.0.0 / 18), and the public network IP segment can be the second public network address pool, for example, 20.0.0.0 / 24.

[0213] It is also understood that the NAT static mapping method used by the first forwarding device may be a PAT method, that is, when performing network address translation, both the source address and the source port are translated. For example, the first forwarding device may translate the source address of the first message from the first private network address to a public network address in the second public network address pool, and translate the source port of the first message to a port in the third port range.

[0214] In this embodiment of the present application, to ensure that the return traffic of the destination device can also be forwarded through the first forwarding device, the first forwarding device needs to publish the route of the second public network address pool (for example, 20.0.0.0 / 24). For example, the first forwarding device can publish the UNR route of the second public network address pool to the acceleration access point, and the acceleration access point will then publish the UNR route to the acceleration channel.

[0215] Step 505: Based on the fact that the second message sent by the first user is not a message of the target application, the broadband remote access server performs network address translation on the second message.

[0216] If the broadband remote access server receives the second message from the first user, it may also first detect whether the second message is a message from the target application, for example, by detecting whether the second message is accelerated traffic. This detection method can be referred to the description of step 503 above and will not be repeated here. If the broadband remote access server determines that the second message is not a message from the target application, it may perform network address translation on the second message.

[0217] The network address translation may include: translating the source address of the second message from the first private network address to the first public network address, and translating the source port of the second message to a port within the first port range. That is, the broadband remote access server may perform NAT processing on the second message using PAT.

[0218] Step 506: The broadband remote access server sends the second message after network address translation to the second forwarding device.

[0219] The second forwarding device may be a device for forwarding messages of non-target applications. For example, the second forwarding device may be a backbone network router for forwarding ordinary traffic (ie, non-accelerated traffic).

[0220] Step 507: The broadband remote access server performs network address translation on the third message sent by the second user.

[0221] If the broadband remote access server receives a third message from the second user, since the second user has not applied for the service of the target application, the broadband remote access server may not need to determine whether the third message is a message from the target application, but may directly perform network address translation on the third message. The network address translation may include: translating a source address of the third message from the second private network address to the second public network address, and translating a source port of the third message to a port within the second port range.

[0222] Step 508: The broadband remote access server sends the third message after network address translation to the second forwarding device.

[0223] After completing the network address translation of the third message, the broadband remote access server may send the third message after the network address translation to the second forwarding device.

[0224] Based on the above steps 501 to 508, it can be seen that the solution provided by the embodiment of the present application can fix the private network address of the target user in an independent private network address pool (i.e., the first private network address pool). For the traffic of the target application of the target user (such as accelerated traffic), the broadband remote access server does not perform NAT processing, but directly redirects it to the first forwarding device (such as redirecting to VPN), and performs NAT processing on the first forwarding device. For ordinary users, there is no need to distinguish whether the message sent by the ordinary user is a message of the target application, and NAT processing in the PAT mode can be uniformly performed through the first public network address pool.

[0225] It is understood that the order of the steps in the address translation method provided in the embodiments of the present application can be adjusted appropriately, and the number of steps can be increased or decreased depending on the circumstances. For example, step 502 can be performed before step 501; or step 505 can be performed before step 503; or steps 507 and 508 can be deleted depending on the circumstances.

[0226] In summary, an embodiment of the present application provides an address conversion method, which can send a first message of a target application directly to a first forwarding device, that is, the first message of the target application is not subjected to network address conversion. Moreover, the method can perform network address conversion on a second message that is not a target application before sending it to a second forwarding device. Since the first message of the target application is not subjected to network address conversion, the source address of the message can only represent the first user. Thus, it can be ensured that the first forwarding device can perform network address conversion on the first message using a static mapping method. Accordingly, when tracing the source of the first user, the source can be directly traced through the static mapping algorithm in the first forwarding device without the need to deploy a separate syslog server. Thus, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation room can be avoided.

[0227] Furthermore, because the method provided in this embodiment of the present application can plan an independent first private network address pool for users applying for the target application's services, directly sending messages from these users to the first forwarding device ensures that the source addresses of the messages received by the first forwarding device are continuously distributed. Accordingly, the public network address pool planned in the first forwarding device for network address translation only needs to cover users applying for the target application's acceleration services, effectively conserving the first forwarding device's public network address resources.

[0228] Table 2 shows the difference between the embodiments shown in Figure 12 and Figure 6. Referring to Table 2, it can be seen that for the embodiment shown in Figure 6, the traffic of the target application needs to be processed by NAT twice, and when tracing the user information, it is necessary to use a combination of static tracing and RADIUS tracing to trace the source. For the embodiment shown in Figure 12, the traffic of the target application only needs to be processed by NAT once by the first forwarding device, and when tracing the user information, it is necessary to use a combination of static tracing and RADIUS tracing to trace the source. Among them, static tracing can determine the intranet IP address (such as the converted target address or the first private network address of the first user), and then the user information can be finally determined through RADIUS tracing.

[0229] Furthermore, in the embodiment shown in FIG6 , the broadband remote access server can convert the source address of the target application's message to a dedicated second private network address pool. In the embodiment shown in FIG12 , the broadband remote access server can directly fix the private network address of the user requesting the target application's service to an independent first private network address pool. Both of these approaches ensure that the source addresses of the target application's traffic received by the first forwarding device are continuously distributed, thereby effectively conserving the NAT public network address resources planned on the first forwarding device and avoiding waste of public network address resources.

[0230] Table 2

[0231] FIG13 is a flow chart of another address translation method provided by an embodiment of the present application, which can be applied to a forwarding device. For example, it can be applied to the first forwarding device in the system shown in FIG4. As shown in FIG13, the method includes:

[0232] Step 601: Perform a first static mapping conversion on a first message of a first user sent by a broadband remote access server and then forward the message.

[0233] In an embodiment of the present application, the forwarding device may be a forwarding device for forwarding traffic of a target application. For example, assuming that the target application is an application that deploys an acceleration service, the forwarding device may be an acceleration router. Accordingly, all messages received by the forwarding device from the broadband remote access server may be messages of the target application.

[0234] A static mapping algorithm may be deployed in the forwarding device, which can perform static mapping conversion on the received message through the static mapping algorithm. In addition, the static mapping algorithm can map an intranet IP address and a corresponding intranet port range in the intranet IP segment to a public IP address and a public port range in the public IP segment. That is, for the same intranet IP address and different intranet port ranges, the static mapping algorithm can map to the same public IP and different public port ranges. The intranet IP segment may be the first public network address pool deployed in the broadband remote access server for performing network address conversion on the target user's traffic, for example, it may be a carrier-grade network address translation technology (carrier-grade NAT, CGN) address pool. The target user may be a user who has applied for the service of the target application (such as an acceleration service), and the target user may also be referred to as a contracted user.

[0235] For a first message from a first user sent by a broadband remote access server, the forwarding device may perform a first static mapping conversion on the first message and then forward it, for example, to an acceleration access point. The first static mapping conversion may include: converting the source address of the first message from a first intranet address to a first public network address, and converting the source port of the first message from the first intranet port to a first public network port within the first public network port range.

[0236] Among them, the first intranet address can belong to the first public network address pool, and the first intranet port can belong to the first intranet port range. After the first user comes online, the broadband remote access server can allocate a first private network address to the first user, and based on the first user being the target user, can allocate a public network address (i.e., the first intranet address) and a port range (i.e., the first intranet port range) to the first user from the first public network address pool. After receiving the first message sent by the first user, the broadband remote access server can convert the source address of the first message from the first private network address to the first intranet address, and convert the source port of the first message to the first intranet port, and then send it to the forwarding device.

[0237] Step 602: Perform a second static mapping conversion on the second message of the second user sent by the broadband remote access server and then forward it.

[0238] The second static mapping conversion includes: converting the source address of the second message from the first intranet address to the first public network address, and converting the source port of the second message from the second intranet port to a second public network port within the second public network port range. The second intranet port belongs to the second intranet port range.

[0239] It is understood that after the second user comes online, the broadband remote access server can allocate a second private network address to the second user, and based on the second user being the target user, can allocate a public network address (i.e., the first intranet address) and a port range (i.e., the second intranet port range) to the second user from the first public network address pool. After receiving the second message sent by the second user, the broadband remote access server can convert the source address of the second message from the second private network address to the first intranet address, and convert the source port of the second message to the second intranet port, and then send the message to the forwarding device.

[0240] In conjunction with the above step 601, it can be seen that for different target users, the broadband remote access server can allocate different private network addresses, and can allocate public network addresses and port ranges from the first public network address pool. If the public network addresses of two target users are the same, then due to different port ranges, one public network address and one port range can indicate one target user. Since the static mapping algorithm deployed in the forwarding device can perform network address translation based on the intranet address + port range, it can be ensured that the target user can be uniquely determined based on the static mapping algorithm, thereby achieving static tracing of the target user.

[0241] It can also be understood that the broadband remote access server can also be configured with a second public network address pool, which can be used to allocate public network addresses and port ranges for non-target users. In addition, after the broadband remote access server performs network address conversion on the messages of non-target users, it can be forwarded to the second forwarding device. It can be seen that after the user comes online, the broadband remote access server can allocate public network addresses and port ranges to users from different public network address pools based on the type of user (i.e., target user or non-target user). After receiving the user's message, the message can be directly subjected to network address conversion based on the allocated public network address and port range, without the need to detect whether the message is a message of the target application. Accordingly, there is no need to deploy an SA service board in the broadband remote access server.

[0242] Continuing to refer to FIG13 , the method may further include:

[0243] Step 603: Based on the received tracing instruction for the first public network address and the first public network port range, determine the first intranet address and the first intranet port range corresponding to the first public network address and the first public network port range through a static mapping algorithm.

[0244] In an embodiment of the present application, if the forwarding device receives a tracing instruction for the first public network address and the first public network port range, it can determine the first intranet address and the first intranet port range corresponding to the first public network address and the first public network port range through a static mapping algorithm. Because the first intranet address and the first intranet port range can represent the first user, accurate tracing of the first user can be achieved.

[0245] Step 604: Based on the received tracing instruction for the first public network address and the second public network port range, determine the first intranet address and the second intranet port range corresponding to the first public network address and the second public network port range through a static mapping algorithm.

[0246] If the forwarding device receives a tracing instruction for the first public network address and the second public network port range, it can use a static mapping algorithm to determine the first intranet address and the second intranet port range corresponding to the first public network address and the second public network port range. Because the first intranet address and the second intranet port range can represent the second user, accurate tracing of the second user can be achieved.

[0247] Based on the above analysis, we can see that when using a static mapping algorithm to trace a public address and a public port range, it is possible to determine the corresponding private address and private port range. Therefore, even if a private address represents multiple users, the private port range can still uniquely identify a single user, enabling accurate user tracing.

[0248] In summary, the embodiment of the present application provides an address conversion method, and the forwarding device can use a static mapping algorithm to perform network address conversion on the received message. The static mapping algorithm can perform network address conversion based on the intranet address and the intranet port range, that is, for the same intranet address, if the intranet port range is different, it can be converted to the same public network address and different public network port ranges. Thus, it can be ensured that the user can be uniquely determined based on the static mapping algorithm, and static tracing of the user can be achieved. Since there is no need to deploy a syslog server separately, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation room can be avoided.

[0249] FIG14 is a schematic diagram of the structure of an address translation device provided in an embodiment of the present application. The address translation device can be applied to a system such as that shown in FIG4 . For example, the address translation device can be a broadband remote access server and can implement the steps performed by the broadband remote access server in the above method embodiment. As shown in FIG14 , the address translation device includes:

[0250] The conversion module 701 is configured to convert the source address of the first message from the first private network address to the target address based on the first message received from the first user being a message of the target application. The function of the conversion module 701 can be realized by referring to the description of step 101 in the above method embodiment.

[0251] The sending module 702 is configured to send the first message to a first forwarding device.

[0252] The sending module 702 is further configured to report the first user's traceability information to the authentication server. The traceability information includes the target address corresponding to the first private network address, and the first public network address and first port range corresponding to the first private network address. The target address is different from the first public network address. The implementation of the functions of the sending module 702 can be found in the description of step 102 in the above method embodiment.

[0253] Optionally, the first private network address belongs to a first private network address pool; and the conversion module 701 is configured to, based on the first message received from the first user being a message for a target application, convert the source address of the first message from the first private network address to the target address in a second private network address pool. The second private network address pool is different from the first private network address pool. The implementation of the functionality of the conversion module 701 may also refer to the description of step 202 in the above method embodiment.

[0254] Optionally, the first public network address belongs to a first public network address pool; the conversion module 701 is configured to, based on the first message received from the first user being a message for a target application, convert the source address of the first message from the first private network address to the target address in a second public network address pool. The second public network address pool is different from the first public network address pool. The implementation of the functionality of the conversion module 701 may also refer to the description of step 304 in the above method embodiment.

[0255] Optionally, the conversion module 701 may also be configured to convert the source port of the first message into a port in the second port range.

[0256] Optionally, the sending module 702 is further configured to publish the routes of the second public network address pool to the first forwarding device, so that the first forwarding device can publish the routes of the second public network address pool. The implementation of the functions of the sending module 702 can also refer to the relevant descriptions of steps 302 and 303 in the above method embodiment.

[0257] Optionally, the sending module 702 can be used to: report first information to the authentication server, the first information including the first public network address and the first port range corresponding to the first private network address; and report second information to the authentication server, the second information including the target address corresponding to the first private network address.

[0258] Optionally, the sending module 702 may be configured to: after the first user comes online, report a billing start message to the authentication server, the billing start message including the first information; and, based on the received first message being a message for the target application, report a billing update message to the authentication server, the billing update message including the second information. The implementation of the functions of the sending module 702 may also refer to the descriptions of steps 201 and 204, and steps 301 and 306 in the above method embodiment.

[0259] Optionally, the conversion module 701 may also be configured to: based on the fact that the received second message from the first user is not a message from the target application, convert the source address of the second message from the first private network address to the first public network address, and convert the source port of the second message to a port within the first port range. The functionality of the conversion module 701 may also be implemented with reference to the description of steps 206 and 308 in the above method embodiment.

[0260] The sending module 702 can also be used to send the second message after the network address translation to the second forwarding device. The implementation of the function of the sending module 702 can also refer to the relevant description of step 207 and step 309 in the above method embodiment.

[0261] Optionally, the conversion module 701 is further configured to: based on the fact that the received third message from the second user is not a message for the target application, convert the source address of the third message from the second private network address to a second public network address, and convert the source port of the third message to a port within a third port range. The first private network address and the second private network address belong to the same private network address pool, and the first public network address and the second public network address belong to the same public network address pool. The functionality of the conversion module 701 can also be implemented with reference to the description of steps 208 and 310 in the above method embodiment.

[0262] The sending module 702 can also be used to send the third message after the network address translation to the second forwarding device. The function of the sending module 702 can also refer to the relevant description of step 209 and step 311 in the above method embodiment.

[0263] Optionally, the conversion module 701 can be used to: determine that the first message of the first user is a message of the target application through the service-aware SA service board; or determine that the first message of the first user is a message of the target application through the ACL.

[0264] Optionally, the target application may be an application for deploying an acceleration service.

[0265] In summary, an embodiment of the present application provides an address translation device, which can, based on the first message of the first user being a message of the target application, convert the source address of the first message from the first private network address to the target address and then send it to the first forwarding device. In addition, the tracing information of the first user includes not only the target address corresponding to the first private network address, but also the first public network address and the first port range corresponding to the first private network address. Since the first private network address corresponds to two different addresses in the tracing information of the first user, when performing network address conversion on the message of the first user, the source address of the message can be converted from the first private network address to a different network address based on the type of application to which the message belongs, thereby effectively improving the flexibility of address conversion.

[0266] Among them, for the scenario where the target address is a private network address, the target address can only represent the first user, thereby ensuring that the first forwarding device can use static mapping to perform network address conversion on the first message. Moreover, when tracing the source of the first user, the source can be traced through the tracing information stored in the authentication server and the static mapping algorithm in the first forwarding device. For the scenario where the target address is a public network address, since the address conversion device has converted the source address of the first message into a public network address in an independent public network address pool, the first forwarding device no longer needs to perform network address conversion on the first message. Moreover, when tracing the source of the first user, the source can be traced directly through the tracing information stored in the authentication server. Both of the above scenarios do not require the deployment of a syslog server, which effectively simplifies the system structure, reduces system costs, and avoids the burden of increasing space and power consumption in the operation room.

[0267] FIG15 is a schematic diagram of the structure of another address translation device provided in an embodiment of the present application. The address translation device can be applied to a system such as that shown in FIG4 . The address translation device can be an authentication server and can implement the steps performed by the authentication server in the above method embodiment. As shown in FIG15 , the address translation device includes:

[0268] Receiving module 801 is configured to receive traceability information of a first user, including a target address corresponding to the first private network address of the first user, and a first public network address and a first port range corresponding to the first private network address. The target address is different from the first public network address. The implementation of the functionality of receiving module 801 can be found in the description of step 102 in the above method embodiment.

[0269] Optionally, the receiving module 801 can be used to: receive first information, the first information including a first public network address and a first port range corresponding to the first private network address; and receive second information, the second information including a target address corresponding to the first private network address.

[0270] Optionally, the receiving module 801 may be configured to: receive a billing start message including the first information; and receive a billing update message including the second information. The implementation of the functions of the receiving module 801 may also refer to the descriptions of steps 201 and 204, and steps 301 and 306 in the above method embodiment.

[0271] Optionally, the first private network address belongs to a first private network address pool, the target address belongs to a second private network address pool, and the second private network address pool is different from the first private network address pool. Alternatively, the first public network address belongs to a first public network address pool, the target address belongs to a second public network address pool, and the second public network address pool is different from the first public network address pool.

[0272] In summary, an embodiment of the present application provides an address translation device, wherein the traceability information of the first user received by the device includes not only the target address corresponding to the first private network address, but also the first public network address and the first port range corresponding to the first private network address. Since the first private network address in the traceability information of the first user corresponds to two different addresses, when performing network address translation on the first user's message, the source address of the message can be converted from the first private network address to a different network address, thereby effectively improving the flexibility of address translation.

[0273] FIG16 is a schematic diagram of the structure of another address translation device provided in an embodiment of the present application, which can be applied to a system such as that shown in FIG4 , and can be a broadband remote access server. As shown in FIG16 , the address translation device includes:

[0274] A sending module 901 is configured to, based on the fact that a first message sent by a first user is a message for a target application, send the first message to a first forwarding device for the first forwarding device to perform network address translation on the first message, wherein the source address of the first message is a first private network address. The implementation of the functionality of sending module 901 can be found in the description of steps 401 and 503 in the above method embodiment.

[0275] The conversion module 902 is configured to perform network address translation on the second message sent by the first user, based on the fact that the second message is not a message for the target application, so that the source address of the second message after the network address translation is different from the first private network address. The implementation of the functions of the conversion module 902 may refer to the description of steps 402 and 505 in the above method embodiment.

[0276] The sending module 901 is further configured to send the second message after network address translation to the second forwarding device. The implementation of the function of the sending module 901 can also refer to the relevant description of step 506 in the above method embodiment.

[0277] Optionally, continuing to refer to Figure 16, the address conversion device also includes an allocation module 903, which is used to: allocate the first private network address to the first user from the first private network address pool after the first user comes online; and allocate the second private network address to the second user from the second private network address pool after the second user comes online.

[0278] The first user is a user who has applied for the acceleration service for the target application, the second user is a user who has not applied for the acceleration service for the target application, and the first private network address pool is different from the second private network address pool. The functional implementation of the allocation module 903 can refer to the relevant description of steps 501 and 502 in the above method embodiment.

[0279] Optionally, the conversion module 902 is further configured to perform network address translation on the third message sent by the second user. The implementation of the function of the conversion module 902 may also refer to the description of step 507 in the above method embodiment.

[0280] The sending module 901 is further configured to send the third message after the network address translation to the second forwarding device. The implementation of the function of the sending module 901 can also refer to the description of step 508 in the above method embodiment.

[0281] In summary, an embodiment of the present application provides an address translation device, which can send the first message of the target application directly to the first forwarding device, that is, the first message of the target application is not subjected to network address translation. Moreover, the device can perform network address translation on the second message that is not the target application before sending it to the second forwarding device. Since the first message of the target application is not subjected to network address translation, the source address of the message can only represent the first user. Thus, it can be ensured that the first forwarding device can perform network address translation on the first message using static mapping. Accordingly, when tracing the source of the first user, the source can be directly traced through the static mapping algorithm in the first forwarding device without the need to deploy a syslog server separately. Thus, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation room can be avoided.

[0282] FIG17 is a schematic diagram of the structure of another address translation device provided in an embodiment of the present application, which can be applied to a system such as that shown in FIG4 , and can be a first forwarding device. As shown in FIG17 , the address translation device includes:

[0283] Conversion module 1001 is configured to perform a first static mapping conversion on a first message sent by a broadband remote access server to a first user, and to perform a second static mapping conversion on a second message sent by the broadband remote access server to a second user. The functionality of conversion module 1001 may be implemented with reference to the description of steps 601 and 602 in the above method embodiment.

[0284] The sending module 1002 is configured to forward the first message and the second message after static mapping conversion.

[0285] The first static mapping conversion includes: converting the source address of the first message from the first intranet address to the first public network address, and converting the source port of the first message from the first intranet port to the first public network port within the first public network port range;

[0286] The second static mapping conversion includes: converting the source address of the second message from the first intranet address to the first public network address, and converting the source port of the second message from the second intranet port to a second public network port within the second public network port range;

[0287] The first intranet port belongs to a first intranet port range, and the second intranet port belongs to a second intranet port range.

[0288] Optionally, with continued reference to FIG17 , the address translation device may further include:

[0289] Determination module 1003 is configured to determine, based on the received tracing instruction for the first public network address and the first public network port range, the first intranet address and the first intranet port range corresponding to the first public network address and the first public network port range using a static mapping algorithm; and to determine, based on the received tracing instruction for the first public network address and the second public network port range, the first intranet address and the second intranet port range corresponding to the first public network address and the second public network port range using a static mapping algorithm. The functional implementation of determination module 1003 may refer to the relevant description of steps 603 and 604 in the above method embodiment.

[0290] In summary, an embodiment of the present application provides an address translation device that can use a static mapping algorithm to perform network address translation on received messages. The static mapping algorithm can perform network address translation based on the intranet address and the intranet port range, that is, for the same intranet address, if the intranet port range is different, it can be converted to the same public network address and different public network port ranges. Thus, it can be ensured that the user can be uniquely identified based on the static mapping algorithm, and static tracing of the user can be achieved. Since there is no need to deploy a syslog server separately, the system structure is effectively simplified, the system cost is reduced, and the burden of increasing the space and power consumption of the operation room can be avoided.

[0291] Those skilled in the art will clearly understand that for the convenience and brevity of description, the specific working processes of the address translation device and each module described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0292] It should be understood that the address conversion device provided in the embodiments of the present application can be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD can be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. In addition, the address conversion method provided in the above method embodiment can also be implemented by software. When the address conversion method provided in the above method embodiment is implemented by software, the address conversion device can include a software module for implementing the above method.

[0293] Figure 18 is a schematic diagram of the structure of an address translation device provided in an embodiment of the present application. The address translation device can be applied to a system such as that shown in Figure 4 and can be a broadband remote access server, an authentication server, or a first forwarding device in the system. Referring to Figure 18 , the address translation device includes a processor 1101, a memory 1102, a network interface 1103, and a bus 1104.

[0294] Memory 1102 stores a computer program 11021, which is used to implement various application functions. Processor 1101 is used to execute computer program 11021 to implement the address translation method provided in the above method embodiment. For example, processor 1101 is used to execute computer program 11021 to implement the functions of each module in the address translation device shown in any of Figures 14 to 17 above.

[0295] The processor 1101 may be a central processing unit (CPU), or may be another general-purpose processor, a digital signal processor (DSP), an ASIC, an FPGA, a graphics processing unit (GPU), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0296] Memory 1102 may be volatile memory or nonvolatile memory, or may include both volatile and nonvolatile memory. Nonvolatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0297] There may be multiple network interfaces 1103, and the network interfaces 1103 are used to implement communication connections (which may be wired or wireless) with other devices. In the embodiment of the present application, the network interfaces 1103 are used to send and receive messages. The other devices may be devices such as terminals, servers, VMs, or other network devices.

[0298] Bus 1104 is used to connect processor 1101, memory 1102, and network interface 1103. In addition to a data bus, bus 1104 may also include a power bus, a control bus, and a status signal bus. However, for clarity, various buses are labeled as bus 1104 in the figure.

[0299] Among them, if the address conversion device is a broadband remote access server, then the detailed processing process of the processor 1101 please refer to the steps executed by the broadband remote access server in the above method embodiment; if the address conversion device is an authentication server, then the detailed processing process of the processor 1101 please refer to the steps executed by the authentication server in the above method embodiment; if the address conversion device is a first forwarding device, then the detailed processing process of the processor 1101 please refer to the steps executed by the first forwarding device in the above method embodiment; no further details will be given here.

[0300] FIG19 is a schematic diagram of the structure of another address translation device provided in an embodiment of the present application. The address translation device can be applied to a system such as that shown in FIG4 and can be a broadband remote access server, an authentication server, or a first forwarding device in the system. As shown in FIG19 , the address translation device may include: a main control board 1201 and at least one interface board (an interface board is also called a line card or a service board), for example, FIG19 shows an interface board 1202 and an interface board 1203. In the case of multiple interface boards, the address translation device may further include a switching network board 1204, which is used to complete data exchange between the interface boards.

[0301] The main control board 1201, also known as the main processing unit (MPU) or route processor card, is responsible for performing functions such as system management, device maintenance, and protocol processing. It primarily includes three functional units: a system management and control unit, a system clock unit, and a system maintenance unit. It also includes a central processing unit 12011 and memory 12012.

[0302] Interface boards 1202 and 1203, also known as line processing units (LPUs), line cards, or service boards, provide various service interfaces and facilitate packet forwarding. These interfaces may include packet over SONET / SDH (POS) interfaces, gigabit Ethernet (GE) interfaces, and asynchronous transfer mode (ATM) interfaces. SONET refers to synchronous optical network, and SDH refers to synchronous digital hierarchy. The main control board 1201, interface board 1202, and interface board 1203 are connected to the system backplane via a system bus for interoperability. As shown in Figure 19, interface board 1202 includes one or more central processing units (CPUs) 12021. CPUs 12021 control and manage interface board 1202 and communicate with CPU 12011 on main control board 1201. The memory 12024 on the interface board 1202 is used to store forwarding table entries, and the network processor 12022 can forward packets by searching the forwarding table entries stored in the memory 12024. The memory 12024 can also be used to store program codes.

[0303] The interface board 1202 further includes one or more physical interface cards 12023 , which are configured to receive messages sent by a previous-hop node and send processed messages to a next-hop node according to instructions from the central processor 12021 .

[0304] Furthermore, it is understood that the central processor 12021 and / or network processor 12022 in the interface board 1202 in FIG. 19 may be dedicated hardware or chips, such as an ASIC, to implement the aforementioned functions. This implementation is commonly referred to as utilizing dedicated hardware or chips for the forwarding plane. In other embodiments, the central processor 12021 and / or network processor 12022 may also be a general-purpose processor, such as a general-purpose CPU, to implement the aforementioned functions.

[0305] It should also be understood that there may be one or more main control boards 1201, and if there are multiple boards, they may include a primary main control board and a backup main control board. There may be one or more interface boards. The stronger the data processing capability of the address translation device, the more interface boards are provided. As shown in Figure 19, the address translation device includes interface board 1202 and interface board 1203. When a distributed forwarding mechanism is employed, the structure of interface board 1203 is substantially identical to that of interface board 1202, and the operations on interface board 1203 are substantially similar to those on interface board 1202. For the sake of brevity, these operations will not be described in detail. When the address translation device has multiple interface boards, these multiple interface boards can communicate with each other through one or more switching network boards 1204, and load sharing and redundant backup can be achieved to provide high-capacity data exchange and processing capabilities.

[0306] In a centralized forwarding architecture, the address translation device can eliminate the need for the switch fabric board 1204. Instead, the interface board handles the entire system's service data processing. Therefore, the data access and processing capabilities of address translation devices in a distributed architecture are superior to those in a centralized architecture. The specific architecture used depends on the specific network deployment scenario and is not specified here.

[0307] In the embodiment of the present application, the memory 12012 and the memory 12024 can be ROM or other types of static storage devices that can store static information and instructions, or RAM or other types of dynamic storage devices that can store information and instructions, or EEPROM, compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these. The memory 12024 in the interface board 1202 can be independent and connected to the central processing unit 12021 through a communication bus; or, the memory 12024 can also be integrated with the central processing unit 12021. The memory 12012 in the main control board 1201 can be independent and connected to the central processing unit 12011 through a communication bus; or, the memory 12012 can also be integrated with the central processing unit 12011.

[0308] The program code stored in memory 12024 is controlled and executed by central processing unit 12021, while the program code stored in memory 12012 is controlled and executed by central processing unit 12011. The central processing unit 12021 and / or central processing unit 12011 can implement the address conversion method provided by the above-mentioned method embodiment by executing the program code. The program code stored in memory 12024 and / or memory 12012 may include one or more software units, which may be the functional modules shown in any of Figures 14 to 17.

[0309] In the embodiment of the present application, the physical interface card 12023 can be a device using any transceiver type for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0310] Optionally, the address translation device shown in FIG. 14 to FIG. 18 may also be implemented using the structure shown in FIG. 19 .

[0311] An embodiment of the present application also provides a computer-readable storage medium, which stores instructions. When the instructions are executed by a processor, the processor executes the steps performed by the broadband remote access server, the authentication server or the first forwarding device in the above method embodiment.

[0312] An embodiment of the present application further provides a computer program product comprising instructions, which, when executed on a processor, causes the processor to execute the steps performed by the broadband remote access server, the authentication server, or the first forwarding device in the above method embodiment.

[0313] In the embodiments of the present application, the terms "first", "second" and "third" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance. In the embodiments of the present application, the term "at least one" refers to one or more, and "a plurality" refers to two or more. In the embodiments of the present application, the term "and / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the related objects before and after are in an "or" relationship.

[0314] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present application, and not to limit them. Although the embodiments of the present application are described in detail with reference to the aforementioned embodiments, ordinary technicians in this field should understand that they can still modify the technical solutions recorded in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. An address conversion method, characterized in that: The method comprises: Based on the received first message from the first user being a message of the target application, converting the source address of the first message from the first private network address to the target address and then sending the first message to the first forwarding device; Reporting the tracing information of the first user to the authentication server, the tracing information including the target address corresponding to the first private network address, and the first public network address and first port range corresponding to the first private network address; The target address is different from the first public network address.

2. The method according to claim 1, characterized in that The first private network address belongs to a first private network address pool; and the converting, based on the received first message from the first user being a message of a target application, the source address of the first message from the first private network address to the target address includes: Based on the received first message from the first user being a message of the target application, converting the source address of the first message from the first private network address to the target address in the second private network address pool; The second private network address pool is different from the first private network address pool.

3. The method according to claim 1, characterized in that The first public network address belongs to a first public network address pool; and the converting, based on the received first message from the first user being a message of a target application, the source address of the first message from the first private network address to the target address includes: Based on the received first message of the first user being a message of the target application, converting the source address of the first message from the first private network address to the target address in the second public network address pool; The second public network address pool is different from the first public network address pool.

4. The method according to claim 3, characterized in that The method further comprises: Convert the source port of the first message to a port in the second port range.

5. The method according to claim 3 or 4, characterized in that The method further comprises: Publish the routes of the second public network address pool to the first forwarding device, so that the first forwarding device can publish the routes of the second public network address pool.

6. The method according to any one of claims 1 to 5, characterized in that: The reporting of the traceability information of the first user to the authentication server includes: Reporting first information to the authentication server, the first information including the first public network address and the first port range corresponding to the first private network address; Report second information to the authentication server, where the second information includes the target address corresponding to the first private network address.

7. The method according to claim 6, characterized in that The reporting of the first information to the authentication server includes: After the first user comes online, reporting a billing start message to the authentication server, where the billing start message includes the first information; The reporting of the second information to the authentication server includes: Based on the received first message being a message of the target application, a billing update message is reported to the authentication server, where the billing update message includes the second information.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Based on the fact that the second message received from the first user is not a message of the target application, the source address of the second message is converted from the first private network address to the first public network address, and the source port of the second message is converted to a port in the first port range and then sent to the second forwarding device.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: Based on the fact that the received third message of the second user is not a message of the target application, converting the source address of the third message from the second private network address to the second public network address, and converting the source port of the third message to a port in the third port range before sending it to the second forwarding device; The first private network address and the second private network address belong to the same private network address pool, and the first public network address and the second public network address belong to the same public network address pool.

10. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: Determining, through the service-aware SA service board, that the first message of the first user is a message of a target application; Alternatively, it is determined through an access control list (ACL) that the first message of the first user is a message of a target application.

11. The method according to any one of claims 1 to 10, characterized in that: The method is applied to a broadband remote access server.

12. The method according to any one of claims 1 to 11, characterized in that: The target application is an application for which acceleration services are deployed.

13. An address conversion method, characterized in that: Applied to an authentication server, the method includes: Receive tracing information of a first user, the tracing information including a target address corresponding to a first private network address of the first user, and a first public network address and a first port range corresponding to the first private network address; The target address is different from the first public network address.

14. The method according to claim 13, wherein: The receiving the traceability information of the first user includes: Receive first information, where the first information includes the first public network address and the first port range corresponding to the first private network address; Second information is received, where the second information includes the target address corresponding to the first private network address.

15. The method according to claim 14, characterized in that The receiving the first information includes: receiving a billing start message, wherein the billing start message includes the first information; The receiving the second information includes: receiving a billing update message, wherein the billing update message includes the second information.

16. The method according to any one of claims 13 to 15, characterized in that: The first private network address belongs to a first private network address pool, the target address belongs to a second private network address pool, and the second private network address pool is different from the first private network address pool; Alternatively, the first public network address belongs to a first public network address pool, the target address belongs to a second public network address pool, and the second public network address pool is different from the first public network address pool.

17. An address conversion method, characterized in that: Applied to an address translation system, the system includes: a broadband remote access server and a first forwarding device; the method includes: The broadband remote access server converts the source address of the first message from the first private network address to the target address based on the received first message from the first user being a message of the target application, and then sends the converted message to the first forwarding device; The first forwarding device forwards the first message; The broadband remote access server reports the tracing information of the first user to the authentication server, where the tracing information includes the target address corresponding to the first private network address, and the first public network address and first port range corresponding to the first private network address; The target address is different from the first public network address.

18. The method according to claim 17, characterized in that The first public network address belongs to a first public network address pool; and the broadband remote access server converts the source address of the first message from the first private network address to the target address based on the received first message from the first user being a message of the target application, including: The broadband remote access server converts a source address of the first message from a first private network address to a target address in a second public network address pool based on the first message received from the first user being a message of a target application, wherein the second public network address pool is different from the first public network address pool; The method further comprises: The broadband remote access server publishes the route of the second public network address pool to the first forwarding device; The first forwarding device advertises routes of the second public network address pool; The source address of the first message forwarded by the first forwarding device is the destination address.

19. The method according to claim 17, wherein The first private network address belongs to a first private network address pool; and the broadband remote access server converts the source address of the first message from the first private network address to the target address based on the received first message from the first user being a message of the target application, including: The broadband remote access server converts the source address of the first message from the first private network address to a destination address in a second private network address pool based on the received first message from the first user being a message of a target application, where the second private network address pool is different from the first private network address pool; The first forwarding device forwarding the first message includes: The first forwarding device converts the destination address of the first message into a public network address in a third public network address pool, converts the source port of the first message into a port in a fourth port range, and then forwards the first message.

20. The method according to any one of claims 17 to 19, characterized in that The method further comprises: The broadband remote access server, based on the fact that the received second message from the first user is not a message of the target application, converts the source address of the second message from the first private network address to the first public network address, converts the source port of the second message to a port in the first port range, and then sends the second message to the second forwarding device; The broadband remote access server converts the source address of the third message from the second private network address to the second public network address based on the fact that the third message received from the second user is not a message of the target application, and converts the source port of the third message to a port in a third port range before sending the third message to the second forwarding device; The second forwarding device forwards the second message and the third message; The first private network address and the second private network address belong to the same private network address pool, and the first public network address and the second public network address belong to the same public network address pool.

21. The method according to any one of claims 17 to 20, characterized in that The first forwarding device is an acceleration router, which is used to accelerate the forwarding of the message of the target application.

22. An address conversion method, characterized in that: The method comprises: Based on the fact that the first message sent by the first user is a message of the target application, the first message is sent to the first forwarding device, so that the first forwarding device performs network address translation on the first message, wherein the source address of the first message is the first private network address; Based on the fact that the second message sent by the first user is not a message of the target application, the second message is network-addressed and then sent to a second forwarding device, and the source address of the second message after network-addressed translation is different from the first private network address.

23. The method according to claim 22, characterized in that The method further comprises: After the first user comes online, allocating the first private network address to the first user from the first private network address pool; After the second user comes online, allocating a second private network address to the second user from the second private network address pool; The first user is a user who applies for the acceleration service of the target application, the second user is a user who does not apply for the acceleration service of the target application, and the first private network address pool is different from the second private network address pool.

24. The method according to claim 23, wherein The method further comprises: The third message sent by the second user is subjected to network address translation and then sent to the second forwarding device.

25. An address translation device, characterized in that: The address translation device includes: a memory, a processor, and a computer program stored in the memory and capable of running on the processor. When the processor executes the computer program, it implements the method according to any one of claims 1 to 16, or the method according to any one of claims 22 to 24.

26. A computer-readable storage medium, characterized in that The computer-readable storage medium stores instructions, and when the instructions are executed on a processor, the processor executes the method according to any one of claims 1 to 16, or the method according to any one of claims 22 to 24.

27. A computer program product comprising instructions, characterized in that The instructions are executed by a processor to implement the method according to any one of claims 1 to 16, or the method according to any one of claims 22 to 24.

28. A chip, characterized in that: The chip is used to implement the method according to any one of claims 1 to 16, or the method according to any one of claims 22 to 24.

29. An address translation system, characterized in that: The system includes: a broadband remote access server and a forwarding device; The broadband remote access server is used to implement the method according to any one of claims 1 to 12, or the method according to any one of claims 22 to 24.

Images