TW201210287A - Network Address Translation device and communication method - Google Patents

Abstract

The invention provides a network address translation (NAT) device and a communication method thereof. The NAT device requests a network server to transmit an invitation data packet sent from a first client to a second client, and transmits an accept-invitation data packet that is sent from the second client and transmitted by the network server to the first client. Then the NAT device requests the network server to transmit a session connection data packet sent from the first client to the second client, and prevents a reply-session connection data packet directly sent from the second client to pass the NAT device. Only on condition that an aim port number in the reply-session connection data packet is the same as a source port number in the session connection data packet, the NAT device allows the reply-session connection data packet to pass the NAT device, so as to reach the first client.

Description

201210287 VI. Description of the Invention: [Technical Field] [0001] The present invention relates to a communication device and a communication method, and more particularly to a network address translation (NAT) device and a communication method. [Previous technology #ί] [0002] The Network Address Transit (NAT) protocol is widely used in networks of various types of Internet access methods. With the NAT protocol, when the internal network sends a packet through a NAT device (such as a router), the private IP address of the internal network is converted into a public IP address. An internal network can use only a small number of IP addresses to realize the communication needs of all computers in the internal network and the Internet, thereby reducing the occupation of the public network IP address. [0003] In order to prevent an external network from attacking an internal network, a NAT device (such as a router) blocks connection request packets sent by other network terminal devices from entering the internal network. However, this practice can result in the inability to establish normal communication between computers on the internal network and other network terminal devices. In order to solve this problem, computers on the internal network can use the network server as a medium to communicate with other network terminal devices. In this way, all data packets coming and going during the communication between the computers on the internal network and other network terminal devices are forwarded by the network server. The shortcoming of this communication method is that the forwarding of data packets by the network server to the terminal devices of different networks causes a time delay in the communication process. SUMMARY OF THE INVENTION [0004] In the above content, it is necessary to provide a network address translation (Network 099128196 Form No. A0101 Page 4 of 17 0992049563-0 201210287

The Address Translation (NAT) device and method can allow the request connection packets sent by other networks to traverse the NAT device during the communication process between the terminal devices establishing different networks to reduce the time delay in the communication process. [0005] Ο A NAT device, the NAT device is in communication with a first client and a network server, and the network server is also in communication with the second client. The NAT device receives the session invitation data packet sent by the first client, and requests the network server to forward the session invitation data packet to the second client, and the network server forwards the response invitation packet sent by the second client to The NAT device sends the response invitation data packet to the first user end. The NAT device receives the session connection data packet sent by the first user, and requests the network server to forward the session connection data packet to the second user end, and the NAT device receives the session response data packet sent by the second user terminal and blocks the The session response packet traverses the network address translation device to check whether the source nickname in the session connection packet is the same as the destination nickname in the session response packet. If the source nickname in the session connection f packet is the same as the destination nickname in the response packet, the NAT device allows the session response packet to traverse the NAT device. To ^ first client. If the source nickname in the session connection package is different from the destination nickname in the session response packet, the NAT device continues to prevent the session response packet from traversing the NAT device. [0006] A communication method applied to a NAT device. The method includes: (A) receiving a session invitation data packet sent by the first client, and requesting the network server to forward the session invitation data packet to the second user terminal; (B) receiving the second user forwarded by the network server The responding invitation packet is replied to, and 099128196 form number A0101 0992049563-0 201210287, the response invitation packet is sent to the first client; (c) receiving the session connection packet sent by the first client, and requesting the network servo Transmitting the session connection packet to the second client; (D) receiving the session response packet sent by the second client and preventing the session response packet from traversing the NAT device; (E) receiving the first client to send again Conversation connection packet, and checking whether the source nickname in the session connection package is the same as the destination nickname in the session response packet; and (F) if the source nickname in the session connection package is If the destination nickname in the session response packet is the same, the session response packet is allowed to traverse the NAT device to reach the first client, if the session is connected to the source in the data packet. Number and the session should return data packet purpose port numbers are different, then continue to block the session in response to data packets through the NAT device. [0007] Compared with the prior art, the NAT device and the communication method provided by the present invention can allow a request connection data packet sent by another network to traverse the NAT device during communication between terminal devices establishing different networks. , reducing the time delay in the communication process. [Embodiment] [0008] Referring to FIG. 1, an application environment diagram of a preferred embodiment of a Network Address Translation (NAT) device of the present invention is shown. The computers 10 and 40 shown in Fig. 1 are located in different networks. For example, the computer 10 (first client) may be located in one LAN 1 and the computer 40 (second client) may be located in another LAN 2. The computer 10 communicates with the computer 40 via the NAT device 20 and the network server 30. In this embodiment, the NAT device 20 is a router, and the network server 30 is a Windows Live Messenger network server. In other embodiments, the 099128196 Form No. A0101 Page 6 of 17 0992049563-0 201210287 The NAT device 20 can also be a switch conversion device. , server or other network address [0009] NAT device 20 converts the private IP address of computer 10 into a public address in the external network (such as the Internet), thereby reducing the publicity of the computer in the local area network The occupation of the IP address. [0010] 〇 099128196

In the present embodiment, as shown in Fig. 2, "client 1, representing the computer 10, "client2 represents the computer 4". Device 2 receives 10 various packets sent, such as the session request packet "client 2, session connection packet "UDP sessi〇n sre port = X" ' and requests the network word service forwarding computer to send = data Package to the electric Lin. SpreGrt=x represents the source bee number in the computer 1 ^ i, the pulse is UserDatagramPr〇tc)cc)i =. The network server 30 forwards the data sent by the computer 1——“竹^ to the computer 4〇, and forward the data packet replied by the computer 40, for example, the response request packet (Accept invitatLon) is shown to the computer. The NAT device 20 is also used to block users in other networks from concentrating on the corpse, for example, the computer 40' in the singular network 2 directly sends the request connection to the computer 1; the spoon, for example, session des=x src = y "(where the nickname is shown, SrC = y is the source nickname) to prevent the computer from being attacked by the non-package. For example, 'NAT device 20 is receiving "UDp ses_ sion des=x SrC=y" After the data package, 'generate' (7) to control the message protocol (Internet Control Message Pr_Q-tocol ' ICMP) data packet. ICMP data packet is used for devices in the network 'such as computer 10, 40, NAT device 20, network Road word service device 3〇, pass control messages between, tell the network is unreachable, the host is reachable, road.—.*Λ1 Λ1 ΛΛ n -JZ / ιΧ 1 7 S Form No. A0101 Page 7 / Total Page 201210287 A message such as whether or not the network itself is available. For example, the ICMP packet "ICMP with unreachable x" shown in Fig. 2 indicates that the computer 40 requests the connection 埠X to be unreachable. [0012] However, in this embodiment, The NAT device 20 does not send the ICMP packet to the computer 40. It is an nickname in the session connection packet sent by the analysis computer 40 to the computer 10 and the session connection package initiated by the computer 10. The nickname and the computer 10 in the request connection packet sent by the computer 40 to the computer 10 again. When the source nicknames in the initiated session connection data package are the same, the NAT device 20 allows the request connection data packet sent by the computer 40 to traverse the NAT device 20 and reach the computer 10, thereby establishing communication between the computers 10 and 40. Thereafter, the computer 10 And the communication message transmitted during the communication, for example, the message "UDP session des = y src = x with video conference payload" sent by the computer 10 to the computer 40, and the message sent by the computer 40 to the computer 10 "UDP session des = x src^y with video conference payload", can directly reach the other party, no longer need the network server 30 to transfer, so that the time delay in the communication process can be reduced. [0013] Referring to FIG. 3, the communication of the present invention is shown. [0014] Step S31, the NAT device 20 receives the session invitation data package sent by the computer 10 (the first user end) "Invite c Lient 2", and requests the network server 30 to forward the session invitation packet to the computer 40 (second client). [0015] Step S33, the NAT device 20 receives the response from the computer 40 forwarded by the network server 30. Please request the package "Accept invitation" and the 099128196 form number A0101 page 8 / page 17 0992049563-0 201210287 [0016] [0018]

Ο [0019] The response invitation packet is sent to the computer 10. In step S35, the NAT device 20 receives the session connection data packet "UDP session src port = x" sent by the computer 10, and the session connection data package includes an nickname of the computer 10 in the local area network 1, for example, src port = x indicates that the computer 10 is in the local area network. The nickname in 1 is X. In step S37, the NAT device 20 requests the network server 30 to forward the session connection packet to the computer 40. In step S39, the NAT device 20 receives the session response data packet "UDP session des=x src=y" sent by the computer 40, and the data packet includes the source nickname of the computer 40 transmitting the data packet in the local area network 2 (for example, src = y ) and the destination nickname that the package is expected to reach (eg des = x). In order to prevent the computer 10 from being attacked by an unknown packet, the NAT device 20 blocks the client devices in other networks, including the computer 40 in the local area network 2, from transmitting to the computer 10 all packets including the information requesting the connection, such as the computer. The sent session response packet "UDP session des=x src = y" ο Step S41, the NAT device 20 receives the session response packet "UDP session des = x src = y" sent by the computer 40, and generates an ICMP packet. "ICMP with unreachable X" means that the computer 40 requests the connection 埠X to be unreachable, but temporarily does not send the ICMP packet to the computer 40, but receives the session connection packet sent by the computer 10 again "UDP session src port two x ". In step S43, the NAT device 20 analyzes the session response data packet sent by the computer 40 to the computer 10 and the nickname in the session connection data packet initiated by the computer 10, and checks 099128196 Form No. A0101 Page 9/17 pages 0992049563-0 [0020] 201210287 Check if the destination nickname in the session response packet is the same as the source nickname in the session connection package. If the destination nickname in the session response packet is the same as the source nickname in the session connection package, for example, the destination nickname "des = x" in the session response packet, the source in the session connection package The number "src port=x" indicates that the computer 40 is the client device that the computer 1 desires to establish communication. The flow proceeds to step S45, and the NAT device 20 allows the session response packet "UDP session des=x src=y" to traverse the The NAT device 20 arrives at the computer 10 to establish communication between the computer 10 and the computer 40. [0022] [0023] In step S43, if the MT device 20 checks to find that the destination nickname in the session response packet is different from the source nickname in the session connection packet, it indicates that the computer 40 is not the computer 10 expectation. The client device of the communication is established, and the flow proceeds to step S47, and the NAT device 20 blocks the session response packet "UDP session des = x src = y" from being sent to the computer 10. For example, the NAT device 20 sends the generated ICMP packet "ICMP with un-reachable x" to the computer 40' to notify the computer 40 that the connection 埠X is unreachable. </ RTI> </ RTI> </ RTI> </ RTI> </ RTI> </ RTI> <RTIgt; </ RTI> <RTIgt; </ RTI> <RTIgt; A person skilled in the art should understand that the technical solutions of the present invention may be modified or equivalently substituted without departing from the spirit and scope of the technical solutions of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is an application environment diagram of a preferred embodiment of a Network Address Transition (NAT) device of the present invention. 099128196 Form No. A0101 Page 10/Total 7 Page 0992049563-0 201210287 [_] Figure 2 is a schematic diagram of establishing communication between UEs in different networks using the NAT device shown in Figure 1. _胄3 is a flow chart of an embodiment of the present invention. [Main component symbol description] [0026] Computer: 10, 40 [0027] NAT device: 20 [0028] Network server: 30

〇

099128196 Form number A0101 笫1丨 page/total page 0992049563-0

Claims (1)

201210287 VII. Patent application scope: 1. A network address conversion device, the network address conversion device is communicatively connected with a first user terminal and a network server, and the network server is also connected with the second user terminal. The network address translation device is configured to: receive a session invitation data packet sent by the first user end, and request the network server to forward the session invitation data packet to the second user end; receive the second forwarded by the network server The user replies with the response invitation packet, and sends the response invitation packet to the first client; receives the session connection packet sent by the first client, and requests the network server to forward the session connection packet to the second The client connection packet includes a source nickname of the first client; receiving a session response packet sent by the second client and preventing the session response packet from traversing the network address translation device, where the session response packet includes Source nickname and destination nickname; receive the session connection packet sent by the first client again, and check the source in the session connection packet Whether the number is the same as the destination nickname in the session response packet; and if the source nickname in the session connection packet is the same as the destination nickname in the session response packet, the session response packet is allowed Traversing the network address translation device to the first user end, if the source nickname in the session connection data packet is different from the destination nickname in the session response data packet, continuing to prevent the session response data packet from traversing the Network address translation device. 2. The network address translation device of claim 1, wherein the network address translation device generates an Internet control when the session response packet is blocked from traversing the network address translation device. Agreement Package 099128196 Form No. A0101 Page 12 of 17 0992049563-0 201210287, when the check indicates that the source nickname in the session connection package is different from the destination nickname in the session response packet, the In The ter net control protocol data packet is sent to the second client, and the second client requests the unreachable request. 3. The network address translation device of claim 1, wherein the network address translation device is a router, a switch or a server. A communication method is applied to a network address conversion device, wherein the network address conversion device is in communication with a first user end and a network server, and the network server is further connected to the second user end, The method includes: receiving a session invitation data packet sent by the first user end, and requesting the network server to forward the session invitation data package to the second user end; receiving the response invitation data of the second user end reply forwarded by the network server And sending the response invitation data packet to the first user terminal; receiving the session connection data packet sent by the first user terminal, and requesting the network server to forward the session connection data package to the second user end, the session connection data The packet includes a source nickname of the first client; receiving a session response packet sent by the second client and preventing the session from responding. The packet traverses the network address translation device, and the session response packet includes a source nickname and a destination 埠Receiving the session connection data packet sent by the first client again, and checking whether the source nickname in the session connection data package is related to the session The destination nickname in the data package is the same; and if the source nickname in the session connection package is the same as the destination nickname in the session response packet, the session response packet is allowed to traverse the network address. The conversion device arrives at the first user end, if the source nickname in the session connection data package is different from the destination nickname in the session response data package, then continue to 099128196 Form No. A0101 Page 13 / Total 17 Page 0992049563-0 201210287 The session response packet is blocked from traversing the network address translation device. 5. The communication method according to claim 4, wherein the method further comprises: generating an Internet Control Protocol packet when the session response packet is blocked from traversing the network address conversion device; When the source nickname in the session connection data packet is different from the destination nickname in the session response data packet, the Internet Control Protocol data packet is sent to the second user terminal to notify the second client that the requested 埠 is unreachable. 6. The communication method according to claim 4, wherein the network address conversion device is a router, a switch or a server. 0992049563-0 099128196 Form No. A0101 Page 14 / Total Page