DE102013109884B3 - Method for establishing the connection of network terminals - Google Patents

Abstract

Method for establishing the connection of network terminals, the method being used in a network communication system (1) which includes a first network terminal (11), a first NAT router [Network Address Translation] (12) has a second network terminal (13) and a second NAT router (14). The method comprises the following steps: the first network terminal (11) sends a registration signal to a remote server (15); Determining the design of the first and second NAT routers (12, 14); Determine whether the first or the second network terminal (11, 13) is directly connected to the Internet (2) when data needs to be transmitted through the second network terminal (13). If the determination result is “yes”, the device connected to the Internet (2) is switched to a listening mode in order to wait for the connection to the opposite device to be established. If the determination result is “no”, the first network terminal (11) sends an assignment signal to the second NAT router (14) in order to set up a data transmission channel via which the second network terminal (13) sends data.

Description

The invention relates to a method for establishing the connection of network terminals, in particular a method by which, if the two network terminals are not a symmetric router whose firewall is penetrated to establish data transmission channels and thus establish the connection.

With the rapid development of communication technology, it is customary to transmit audio, video and image data via the shareable network. Therefore, the modern life of the people of the net or Internet is inseparable. The network-related products used by most households are usually a relay and a NAT router (Network Address Translation). By z. As the NAT device, Internet access is possible.

To increase the security of the known NAT router is provided with a firewall. NAT uses a method of translating IP addresses between two networks with incompatible address spaces, usually an intranet or a corporate network on one side and the Internet on the other. The intranet and the Internet are separated to control data access over the network. Regardless of whether the data comes from the Internet to the intranet or vice versa from the Internet to the intranet, the firewall confirmation process is necessary for the transmission. The verification process is performed through a series of pre-set security policies and guidelines.

It is difficult to access the data through an electronic device such as a computer. B. Smartphone to transfer when you are outside and the data on the Internet at z. For example, a webcam may be sent at home because the NAT router has a firewall and the public Internet Protocol addresses change over time when surfing the Internet. That is, the data is difficult to transmit through the device (such as a smartphone) through the NAT router when you are out there at home. An exception would be if the NAT router (such as Internet address) has already been set at home. The adjustment process can be very complicated, so it is not easy for the user to do the adjustment himself. The NAT router must normally be set up by qualified personnel. This causes the user a lot of difficulties and is therefore not considered optimal.

In the known firewall, no efficiency is achieved due to the cumbersome program execution. The penetration of the firewall takes place only with TCP (Transmission Control Protocol) and UDP (User Datagram Protocol). Therefore, the existing technology for penetrating the firewall must be improved.

• 1. Da der NAT-Router mit Firewalls versehen ist, können die Daten nicht durch ein Gerät wie z. B. Smartphone über den NAT-Router an ein Gerät z. B. Webcam zu Hause gesendet werden, wenn man draußen ist.
• 2. Die Einstellung des NAT-Routers ist kompliziert, was dem Benutzer viel Schwierigkeiten beim Gebrauch bereitet.
• 3. Aufgrund der ineffizienten Durchführung beim Durchdringen der Firewall ist die bekannte Kommunikationstechnik sehr beschränkt anwendbar und somit verbesserungsbedürftig.

In summary, the prior art has the following disadvantages:

• 1. Since the NAT router is provided with firewalls, the data can not be transmitted by a device such as a computer. B. Smartphone over the NAT router to a device z. B. Webcam to be sent at home when you're outside.
• 2. The setting of the NAT router is complicated, causing the user much trouble in use.
• 3. Due to the inefficient implementation when penetrating the firewall, the known communication technology is very limited applicable and thus in need of improvement.

From the GB 2461322 For example, a method for establishing the connection of network terminals by means of two NATs via the Internet is known. Here we connected a server. The connection is established according to the local ones 2 to 4 ,

The US 2008/0112417 A1 apparently a transmission structure with general communication phases S100-S400 until connection establishment. Communication steps are based on de there 5A and 5B explained.

The US 2013/0170471 A1 discloses a communication structure with relay unit 310 ,

The standard "Rosenberg, J. [u. a.]: STUN - Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs). Network Working Group, RFC 3489, March 2003 "discloses a provision on the type of NAT router (Figure from p. 22) which is standard"

Rosenberg, J. [u. a.]: Session Traversal Utilities for NAT (STUN). Network Working Group, RFC 5389, October 2008, p. 1-51 ".

The invention has for its object to provide a suitable method for establishing the connection of network terminals, through which the intended for the NAT router firewall is immediately penetrated to build data transmission channels, so that the data transmission is possible when you are outside.

This object is achieved by a suitable method for establishing the connection of network terminals, which has the features specified in claim 1. Further advantageous developments of the invention will become apparent from the dependent claims.

• (a) Senden eines Registrierungssignals durch das erste Netzwerk-Endgerät paketweise an den Fernserver, um die Registrierung bei dem Fernserver durchzuführen;
• (b) Feststellen, ob das erste Netzwerk-Endgerät unmittelbar an das Internet angeschlossen ist, wenn Daten durch das zweite Netzwerk-Endgerät übertragen zu werden brauchen;
• (c) Feststellen, ob ein erster Router des ersten NAT-Routers (12) bauartmäßig ein symmetrischer Router ist, wenn das Feststellungsergebnis im Schritt (b) ”nein” ist;
• (d) Feststellen, ob ein zweiter Router des zweiten NAT-Routers (14) bauartmäßig ein symmetrischer Router ist, wenn das Feststellungsergebnis im Schritt (c) ”nein” ist;
• (e) Senden eines Ermittlungssignals durch das erste Netzwerk-Endgerät paketweise an den zweiten NAT-Router, wenn das Feststellungsergebnis im Schritt (d) ”nein” ist, sodass die Anzahl von zu durchdringenden Routerschichten des ersten und des zweiten NAT-Routers ermittelt wird, um ein Ermittlungsergebnis zu erzeugen;
• (f) Senden eines Zuordnungssignals gemäß dem Ermittlungsergebnis durch das erste Netzwerk-Endgerät paketweise an den zweiten NAT-Router, um einen zweiten Übertragungsanschluss des zweiten NAT-Routers zu betätigen;
• (g) Zuordnung eines ersten Übertragungsanschlusses des ersten NAT-Routers zu dem zweiten Übertragungsanschluss des zweiten NAT-Routers, um einen ersten Datenübertragungskanal aufzubauen; und
• (h) Kommunikatives Verbinden des zweiten Netzwerk-Endgeräts durch den zweiten NAT-Router über das Internet mit dem Fernserver, um die Datenübertragung über den ersten Datenübertragungskanal durchzuführen.

According to the invention there is provided a method suitable for establishing the connection of network terminals used in a network communication system comprising a first network terminal, a first Network Address Translation (NAT) router, a second network terminal , a second NAT router ( 14 ) and a remote server, the method comprising the steps of:

• (a) sending a registration signal by the first network terminal packet by packet to the remote server to perform registration with the remote server;
• (b) determining if the first network terminal is directly connected to the Internet when data needs to be transmitted by the second network terminal;
• (c) determining if a first router of the first NAT router ( 12 ) is a symmetric router by design, if the determination result in step (b) is "no";
• (d) determining if a second router of the second NAT router ( 14 ) is a symmetric router by design, if the determination result in step (c) is "no";
• (e) sending a determination signal by the first network terminal packet by packet to the second NAT router if the determination result in step (d) is "no", so that the number of router layers to be penetrated of the first and second NAT routers is determined to generate a determination result;
• (f) sending an association signal according to the determination result by the first network terminal to the second NAT router in packets to operate a second transmission terminal of the second NAT router;
• (g) assigning a first transmission port of the first NAT router to the second transmission port of the second NAT router to establish a first communication channel; and
• (h) communicatively connecting the second network terminal through the second NAT router to the remote server via the Internet to perform the data transmission over the first communication channel.

According to the invention, a substep (b1) is performed when the determination result in section (b) is "no", wherein in the substep (b1), the first network terminal is changed to a listening mode to wait for the second network Terminal connected to the first network terminal. When the second network terminal is connected to the first network terminal, a second communication channel is established over which the second network terminal can send data.

According to the invention, a sub-step (b2) is performed when the determination result in the step (b) is "no". In sub-step (b2) it is determined whether the second network terminal is connected directly to the Internet. If the determination result in step (b2) is "yes", a substep (b3) is performed in which the second network terminal is transferred to a listening mode to wait for the first network terminal to communicate with the second network terminal. Terminal is connected. If the determination result in step (b2) is "no", step (c) is performed. When connecting the first network terminal to the second network terminal, a third data transmission channel is set up, via which the first network terminal sends data.

According to the invention, prior to step (a), there is a substep (a0) in which the design of the first router of the first NAT router and the second router of the second NAT router is determined. If the determination result in step (c) is "yes", a substep (c1) is performed in which the first network terminal is communicatively connected to a relay, the remote server causing the second network terminal to be connected to the relay to establish a fourth communication channel over which the second network terminal transmits data. If the determination result in step (d) is "yes", a substep (d1) is performed in which the first network terminal is communicatively connected to a relay, the remote server causing the second network terminal to be connected to the relay to establish a fourth communication channel over which the second network terminal transmits data.

According to the invention, the first network terminal and the second network terminal are selected from a group including a mobile phone, a tablet computer, a notebook, a webcam, an IP telephone, a network drive and a network printer, and a personal digital -Assistant has. In addition, the detection signal includes several detection packets whose TTL value (Time To Live, TTL) increases gradually. That is, the detection packets in the detection signal are repeatedly transmitted by continuously increasing the TTL value of the detection packets.

In summary, the second network terminal is assigned to the transmission port of the NAT router in order to set up a data transmission channel and thus to penetrate the firewall provided for the second NAT router. Therefore, the default setting of the firewall of the NAT router is unnecessary if the user wants to send the data from the outside to a device at home. That is, the firewall is immediately penetrated to one Connect to the device at home for data transmission.

It is determined if the network terminal is directly connected to the Internet. Thereby, a higher connection efficiency is achieved, whereby excessive cumbersome steps can be spared. In addition, the inventive method is suitable not only for TCP and UDP, but also for other protocols, whereby the applicability of the method is increased.

In the following the invention and its embodiments will be explained in more detail with reference to the drawing. In the drawing shows:

1 a schematic operating diagram I of an embodiment of a network communication system according to the invention;

1A a schematic operating diagram II of the embodiment of a network communication system according to the invention;

1B a schematic operating diagram III of the embodiment of a network communication system according to the invention; and

2 and 2A a flow chart of the method according to the invention.

Like from the 1 to 2A as can be seen, is an inventive method for establishing the connection of network terminals in a network communication system 1 used, which is a first network terminal 11 , a first NAT router [Network Address Translation] 12 , a second network terminal 13 , a second NAT router 14 and a remote server 15 having.

The first network terminal 11 and the second network terminal 13 are selected from a group including a mobile phone, a tablet computer, a notebook, a webcam, an IP phone, a network drive and a network printer, and a personal digital assistant, but the invention is not intended to be so limited. In the illustrated embodiment, the first network terminal 11 as a webcam and the second network terminal 13 running as a mobile phone, the remote server 15 as a cloud server host. According to the invention, three possibilities for communicative connection to the remote server 15 over the internet 2 available. The inventive method for establishing the connection of network terminals comprises the following steps:
Step S101: Determine the Type of the First Router of the First NAT Router 12 and the second router of the second NAT router 14 ,
Step S102: Sending a registration signal by the first network terminal 11 packet by packet to the remote server 15 ;
Step S103: Determine Whether the First Network Terminal 11 directly to the internet 2 connected;
Step S104: Determine Whether the Second Network Terminal 13 directly to the internet 2 connected;
Step S105: Determine Whether the First Router of the First NAT Router 12 a symmetric router by design;
Step S106: Determine Whether the Second Router of the Second NAT Router 14 is a symmetric router;
Step S107: transmitting a detection signal by the first network terminal 11 packet by packet to the second NAT router 14 ;
Step S108: transmitting an association signal according to the determination result by the first network terminal 11 packet by packet to the second NAT router 14 ;
Step S109: Assignment of a first transmission port of the first NAT router 12 to a second transmission port of the second NAT router 14 ;
Step S110: Communicatively connecting the second network terminal 13 through the second NAT router 14 over the internet with the remote server 15 to perform the data transmission over a first communication channel;
Step S111: Transfer the first network terminal 11 in a listening mode to wait for the second network terminal 13 with the first network terminal 11 connected is;
Step S112: Transfer the second network terminal 13 in a listening mode to wait for the first network terminal 13 with the second network terminal 11 connected is; and
Step S113: communicatively connecting the first network terminal 11 with a relay, the remote server 15 causes the second network terminal 13 is connected to the relay to establish a fourth communication channel.

In step S101, the type of the first router of the first NAT router becomes the same 12 and the second router of the second NAT router 14 determined. In the design of the first and second NAT router 12 . 14 These are a full-cone NAT router, a restricted-cone NAT router, a port-restricted cone NAT router, and a bi-directional transmission symmetric restricted cone NAT router. After determining the type of the first router of the first NAT router 12 and the second router of the second NAT router 14 becomes the determination result in the remote server 15 stored, whereupon the next step is performed.

After the step S101, the step S102 is performed in which the first network terminal 11 a registration signal packet by packet to the remote server 15 sends. That is, the first network terminal 11 sends the unspecified registration signal over the Internet 2 packet by packet to the remote server 15 , This will register with the remote server 15 so the remote server 15 via the Internet Protocol address and related information of the first network terminal 11 experiences. The information can be the model and geographic location of the first network terminal 11 include, to which the invention should not be limited. As is the first network terminal 11 In the local network, the Internet Protocol address may be a virtual Internet Protocol address.

After step S102, step S103 is performed, in which it is determined whether the first network terminal 11 directly to the internet 2 connected. That is, the second network terminal 13 sends the data to be transmitted to the remote server 15 so the remote server 15 from the Internet Protocol address of the second network terminal 13 learns by the connection packet of the second network terminal 13 is checked when the outside user data through the second network terminal 13 to the first network terminal 11 wants to send or the user wants to use his mobile phone to connect to the webcam to get the video data from the webcam. Because the remote server 15 from the Internet Protocol address of the first network terminal 13 This can be determined by the received packets and the registered data, whether the first network terminal 11 directly to the internet 2 connected. If the Internet Protocol addresses match, the connection to the Internet is detected 2 is made. Otherwise, the connection is not established.

In step S103, it is determined whether the first network terminal 11 directly communicative to the Internet 2 connected. Specifically, the first network terminal is called 11 via 3G [third generation mobile communication technology], Wi-Fi or WIMAX [Worldwide Interoperability for Microwave Access] to the Internet 2 connected.

If it is determined in step S103 that the first network terminal 11 not to the internet 2 is connected, then step S104 is performed, wherein it is determined whether the second network terminal 13 to the internet 2 connected. The step S104 essentially corresponds to the step S103 and therefore does not need to be explained further here.

If it is determined in step S104 that the second network terminal 13 not to the internet 2 is connected, then step S105 is performed, in which it is determined whether the first router of the first NAT router 12 is a symmetric router. That is, it determines if the first NAT router 12 is a symmetric NAT router.

If it is determined in step S105 that the first NAT router 12 is not a symmetric NAT router, then step S106 is performed, in which it is determined whether the second router of the second NAT router 14 is a symmetric router. That is, it determines if the second NAT router 14 is a symmetric NAT router.

If it is determined in step S106 that the second router of the second NAT router 14 is not a symmetric router, then step S107 is performed, in which the first network terminal 11 a non-illustrated detection signal packet by packet to the second NAT router 14 sends. Then, the number of router layers to be pervaded of the first and second NAT routers becomes 12 . 14 determined to generate a determination result.

The detection signal includes a plurality of detection packets whose TTL value Time To Live, TTL gradually increases. That is, the detection packets in the detection signal are repeatedly transmitted by continuously increasing the TTL value of the detection packets. This calculates the number of router layers to penetrate. In the case of the discovery packets, the calculation is done by acknowledgment and checksum algorithm.

After the step S107, the step S108 is performed in which the first network terminal 11 the allocation signal packet by packet to the second NAT router 14 sends. Specifically, the first network terminal sends 11 also packet by packet the unshown assignment signal to the second NAT router 14 to a non-illustrated second transmission port of the second NAT router 14 to press. It should be noted that the first and the second NAT router 12 . 14 each having a plurality of transmission ports, wherein the actuated transmission port is defined as the second transmission port.

After step S108, step S109 is performed, in which a second transmission port of the second NAT router 14 a first transmission port of the first NAT router 12 is assigned. Concretely speaking, the second transmission port of the second NAT router 14 the first transmission port [not shown] of the first NAT router 12 assigned after the second transmission port has been actuated. Thus, a first data transmission channel [not shown] is set up, whereby the firewalls of the first and second NAT routers 12 . 14 can be penetrated.

After step S109, step S110 is performed, in which the second network terminal 13 through the second NAT router 14 Communicating with the remote server over the Internet 15 is connected to perform the data transmission over the first communication channel. Since the firewall is penetrated and thus the first data transmission channel is established, the second network terminal can 13 through the second NAT router 14 over the internet 2 communicative with the remote server 15 be connected to perform the data transmission over the first communication channel. The connection path is in 1 shown.

After the first communication channel has been established, all data is transmitted over the first communication channel, whether it is TCP [Transmission Control Protocol] or UDP [User Datagram Protocol]. Data with further protocols are also transmitted over the first data transmission channel, so that increased applicability is ensured.

It should be noted that step S111 is performed immediately in which the first network terminal 11 is transferred to a listening mode to wait for the second network terminal 13 with the first network terminal 11 is connected, if it is determined in step S103 that the first network terminal 11 directly to the internet 2 connected. In this case, the penetration of the firewall for data transmission is unnecessary. Therefore, the first network terminal becomes 11 transferred to the listening mode to wait for the second network terminal 13 communicatively with the first network terminal 11 connected is. This improves the connection efficiency. When connecting the second network to the first network terminal 11 a second communication channel [not shown] is set up via which the second network terminal 13 sends the data. The connection path is in 1A shown.

If it is determined in step S104 that the second network terminal 13 to the internet 2 is connected, step S112 is performed, in which the second network terminal 13 is transferred to a listening mode to wait for the first network terminal 11 with the second network terminal 13 connected is. Because the second network terminal 13 is in the listening mode, the connection can be made directly without having to penetrate the firewall for data transmission. Therefore, the immediate connection of high efficiency can take place. When connecting the first network terminal 11 to the second network terminal 13 a third communication channel is established over which the first network terminal 11 Sends data. The connection path is also in 1A shown.

If it is determined in step S105 and S106 that the first router of the first NAT router 12 or the second router of the second NAT router 14 a symmetric router, it means that either the first NAT router 12 or the second NAT router 14 is a symmetric router. In this case, the connection must be made by a relay. Therefore, step S113 is performed in which the first network terminal 11 communicatively connected to a relay, the remote server 15 causes the second NAT router 14 is connected to the relay to build a fourth communication channel. In this step, the first network terminal becomes 11 communicative with the relay 16 coupled, the remote server 15 causes the second network terminal 13 also communicative with the relay 16 is coupled to result in a fourth communication channel [not shown] via which the second network terminal 13 Can send data. The connection path is in 1B shown. In other cases, the first NAT router 12 and the second NAT router 14 both be implemented as a symmetric NAT router and perform step S112.

The second network terminal is summarized 13 assigned to the transmission port of the NAT router to establish a data transmission channel and thus to penetrate the intended for the second NAT router firewall. Therefore, the default setting of the firewall of the NAT router is unnecessary if the user wants to send the data from the outside to a device at home. That is, the firewall is immediately penetrated to connect to the device at home for data transmission.

It is determined if the network terminal is directly connected to the Internet. Thereby, a higher connection efficiency is achieved, whereby excessive cumbersome steps can be spared. In addition, the inventive method is suitable not only for TCP and UDP, but also for other protocols, whereby the applicability of the method is increased.

The foregoing description illustrates the embodiments of the invention and is not intended to limit the claims. All equivalent changes and modifications that may be made by those skilled in the art in accordance with the description and drawings of the invention are within the scope of the present invention.

LIST OF REFERENCE NUMBERS

1

Network communication system

11

first network terminal

12

first NAT router

13

second network terminal

14

second NAT router

15

remote server

16

relay

2

Internet

Claims (10)

Method for establishing the connection of network terminals, the method being used in a network communication system ( 1 ), which is a first network terminal ( 11 ), a first NAT (Network Address Translation) router ( 12 ), a second network terminal ( 13 ), a second NAT router ( 14 ) and a remote server ( 15 ), the method comprising the following steps: (a) transmitting a registration signal by the first network terminal ( 11 ) packet by packet to the remote server ( 15 ) to register with the remote server ( 15 ) perform; (b) determining if the first network terminal ( 11 ) directly to the Internet ( 2 ) is connected when data through the second network terminal ( 13 ) need to be transmitted; (c) determining if a first router of the first NAT router ( 12 ) is a symmetric router by design, if the determination result in step (b) is "no"; (d) determining if a second router of the second NAT router ( 14 ) is a symmetric router by design, if the determination result in step (c) is "no"; (e) sending a detection signal by the first network terminal ( 11 ) packet by packet to the second NAT router ( 14 ) if the determination result in step (d) is "no", so that the number of router layers to be penetrated by the first and the second NAT routers ( 12 . 14 ) is determined to produce a determination result; (f) transmitting an association signal according to the determination result by the first network terminal ( 11 ) packet by packet to the second NAT router ( 14 ) to a second transmission port of the second NAT router ( 14 ) to operate; (g) Assignment of a first transmission connection of the first NAT router ( 12 ) to the second transmission port of the second NAT router ( 14 ) to establish a first communication channel; and (h) communicatively connecting the second network terminal ( 13 ) through the second NAT router ( 14 ) over the Internet to the remote server ( 15 ) to perform the data transmission over the first communication channel. A method according to claim 1, characterized in that prior to step (a) there is a substep (a0) in which the type of the first router of the first NAT router ( 12 ) and the second router of the second NAT router ( 14 ) is detected. A method according to claim 1, characterized in that, if the determination result in section (b) is "no", a substep (b1) is carried out, in which the first network terminal ( 11 ) is placed in a listening mode to wait for the second network terminal ( 13 ) with the first network terminal ( 11 ) connected is. Method according to claim 3, characterized in that when the second network terminal ( 13 ) to the first network terminal ( 11 ), a second data transmission channel is set up via which the second network terminal ( 13 ) Can send data. A method according to claim 3, characterized in that, if the determination result in step (b) is "no", a substep (b2) is carried out, in which it is determined whether the second network terminal ( 13 ) is directly connected to the Internet; If the determination result in step (b2) is "yes", a substep (b3) is carried out in which the second network terminal ( 13 ) is placed in a listening mode to wait for the first network terminal ( 11 ) with the second network terminal ( 13 ) connected is; and - if the determination result in the step (b2) is "no", the step (c) is performed. Method according to claim 5, characterized in that when the first network terminal ( 11 ) to the second network terminal ( 13 ) a third data transmission channel is set up via which the first network terminal ( 11 ) Sends data. A method according to claim 1, characterized in that, if the determination result in step (c) is "yes", a substep (c1) is carried out in which the first network terminal ( 11 ) is communicatively connected to a relay, whereby the remote server ( 15 ) causes the second network terminal ( 13 ) is connected to the relay to establish a fourth communication channel over which the second network terminal ( 13 ) Sends data. A method according to claim 1, characterized in that, if the determination result in step (d) is "yes", a substep (d1) is carried out in which the first network terminal ( 11 ) is communicatively connected to a relay, whereby the remote server ( 15 ) causes the second network terminal ( 13 ) is connected to the relay to establish a fourth communication channel over which the second network terminal ( 13 ) Sends data. Method according to claim 1, characterized in that the first network terminal ( 11 ) and the second network terminal ( 13 ) are selected from a group comprising a mobile phone, a tablet computer, a notebook, a webcam, an IP phone, a network drive and a network printer, and a personal digital assistant. A method according to claim 1, characterized in that the detection signal includes a plurality of detection packets, the TTL (Time To Live) value increases gradually.

Images