WO2011035528A1

WO2011035528A1 - Method, system and relay server for network address translation (nat) traversal by way of relay

Info

Publication number: WO2011035528A1
Application number: PCT/CN2010/000813
Authority: WO
Inventors: 黄权; 夏勇; 胡艳
Original assignee: 日电（中国）有限公司
Priority date: 2009-09-24
Filing date: 2010-06-10
Publication date: 2011-03-31
Also published as: CN102035900A; CN102035900B

Abstract

A method, a system and a relay server for network address translation (NAT) traversal by way of relay are provided. A method for processing network address translation NAT by way of relay includes: utilizing a NAT address, a first host computer sends a relay request message to the server address of a relay server through a NAT device; and the relay server returns to the first host computer a relay response message, which includes an address list containing a relay address and said NAT address.

Description

Method, system and relay server for NAT traversal by relay method

The present invention relates to computer networks, and more particularly relates to a relay through a network address translation mode (network address tr said anslation, g Jie NAT) traversal method, system and device that works to relay month (relay server) ₀ BACKGROUND technology

In computer networks, network address translation (NAT books) is a process that, when transmitting traffic through a traffic routing device, modifies the network address information in the packet header to give the given address. Space is remapped to another address space. NAT is designed to alleviate the problem of exhausting IPv4 addresses. For home and small business Internet connections, NAT has become a standard and indispensable feature in routers.

Most NAT-based systems perform NAT in order to enable multiple hosts on a private network to access the Internet using a common Internet Protocol (IP) address. A host on a private network cannot directly access its Internet using its local address in the internal private network. Packets sent and received by these hosts must be processed by NAT performed by the NAT device in the private network. In this article, these hosts are called "behind the NAT device". In addition, in the present invention, the NAT device may include a NAT-capable router, a gateway, a firewall, and the like. Those skilled in the art can select any suitable device as a NAT as needed. For example, assume that a host in a private network uses the internal private network address space 192.168.0.1/24. The private IP address of the NAT router in the private network is 192.168.0.1, and the public IP address is 83.14.137.3. When a host behind the NAT router wants to send a packet to the public network, the packet is intercepted by the NAT router, and its source address (IP-port pair) is changed to an external address, which may also be referred to as a NAT address. It includes the public 'address 83.14.137.3 of the NAT router and one port number of the NAT router. Source IP-port pair and NAT router The mapping between IP-port pairs is stored in the NAT router. When a packet from the public network arrives at the NAT router, the NAT router changes the destination IP-port pair to the IP-port pair of the internal address space according to its saved mapping, and forwards the packet to the corresponding private network host.

However, NAT undermines the model of IP end-to-end connectivity on the Internet as originally envisaged, introducing complex factors in the communication between the hosts and affecting performance. It hides the structure of the internal network: From the perspective of external entities, all traffic seems to originate from the NAT device.

Therefore, hosts behind NAT devices do not have end-to-end connectivity and therefore cannot participate in certain Internet protocols. For example, services that require a Transfer Control Protocol (TCP) connection from an external network, or a stateless protocol such as the User Datagram Protocol (UDP) may not be possible.

In a total of four NATs, namely full cone NAT, restricted cone NAT, port-restricted cone NAT, and symmetric NAT. Symmetric NAT is the most restrictive NAT. Each request from the same internal IP address and port to a specific destination IP address and port is mapped to a unique external source IP address and port. Specifically, for example, assume that a host on the private network sends a communication request to the address (IP-2, Port-2) of a host outside the private network by using an internal IP address and port pair (IP_li, Port-li). The private network's NAT device intercepts the request and maps the request to a unique external source IP address and port pair (IP_le, Port_le) and records this mapping and policy. When a packet is received later, the NAT device will check the packet against its record. The packet will be forwarded to (IP_li, Port-li) only if the source address of the packet is (IP-2, Port-2) and the destination address is (IP_le, Port-le). In other cases, the packet will not be forwarded to |J(IP— li, Port— li) (be forwarded to other matching addresses, or discarded). In other words, if the same internal host sends a packet with the same source address and port, but the packet is sent to a different destination, then a different mapping is used. Therefore, only external hosts that have received packets from the internal host can send back the packet. This type of NAT makes the problems described above even more serious.

Basically, for NAT problems, there are various solutions, such as Session Traversal Utilities for NAT (STUN), Application Layer Gateway (艮卩ALG), and NAT through relay. (Troveral Using Relay NAT, TURN). But only TURN solves the problem of symmetric NAT.

One purpose of designing the TURN protocol is to enable NAT, especially symmetric NAT or hosts behind the firewall, to receive incoming data over TCP or UDP. The basic idea is to use the TURN server in the public address space to relay incoming packets for hosts behind the NAT device.

In general, TURN's work process involves two phases. The first phase is the name binding phase. This phase binds the host behind the NAT to a public IP address and port. The second phase is the communication phase. In the second phase, the external host initiates communication. These two phases are shown in Figures 1 and 2, respectively.

As shown in Figure 1, the TURN server 63 listens on the public service address (IP_s, Port_s).

In step S601, the host behind the NAT, i.e., the first host 61, sends its TUR message to the TURN server 63 using its address (IP_li, Port_li): Packet Relay Request.

In step S602, the source address of the message is changed to (IP-le, Port-le) by the NAT device 62. Also, in the case of symmetric NAT, the NAT device 62 forms a mapping between (IP-li, Port-li) and (IP-le, Port-le) and formulates such a policy for the mapping: Allowing from (IP) — s, Port_s) Messages sent to (IP_le, Port_le) are forwarded to (IP_li, Port_li) and the entries containing the mappings and policies are logged to the mapping and policy database they maintain.

In step S603, the NAT device 62 forwards the relay request message to the TURN server.

63.

In step S604, the TUR server 63 that has received the relay request message performs relay request processing. The relay request processing here includes assigning a specific relay address (IP_lr, Port lr) to the first host 61, and recording (IP_lr,

Mapping between Port-le).

In step S605, the TUR server 63 responds to the relay request of the first host 61 by transmitting a response message to (IP_s, Port_s) by (IP_s, Port_s), in the valid data portion of the response message. Contains the assigned relay address (IP_lr, Port-lr).

In step S606, when the response message reaches the address of the NAT device 62 (IP_le, At port_le), NAT device 62 checks the response message against its mapping and policy database. In this case, the message passes the check. The NAT device 62 then changes the destination address of the response message from (IP-le, Port-le) to (IP-li, Port-li). Or, if the message fails the check, it is discarded.

In step S607, the NAT device 62 delivers the response message to the address (IP-li, Port-li) of the first host 61.

In step S608, the first host 61 obtains the address (IP_lr, Port_lr) assigned by the TURN server 63 from the response message, and constructs a binding update message. The valid data portion of the binding update message includes information on the binding between the host name of the first host 61 itself and the assigned address.

In steps S609 to S611, the first host 61 transmits the binding update message to the name server 64 via the NAT device 62. The name server 64 thereby obtains information about the binding between the host name of the first host 61 and the assigned address, and stores it in the database maintained by itself.

Figure 2 shows the communication phase. As shown in FIG. 2, another host, the second host 65, wishes to initiate communication with the first host 61. The second host 65 is not in the private network where the first host 61 is located, and may be behind another NAT device (e.g., in another private network) or not behind the NAT device (e.g., in the public network). As an example, Figure 2 shows the case where the second host 65 is not behind the NAT device.

In step S701, the second host 65 queries the name server 64 for the relay address of the first host 61.

The name server 64 searches for a relay address bound to the first host 61 in its database in step S702, and returns a relay address (IP- corresponding to the first host 61) to the second host 65 in step S703. Lr, Port—lr) reply message.

The second host 65 obtains (IP_lr, Port lr) from the reply message of the name server 64 in step S704, and by using the source address (IP_2, Port_2) to (IP-lr, Port-lr) in step S705. A request is sent to issue a communication request message to the first host 61.

In step S706, the TURN server 63 receives the communication request message on (IP-lr, Port-lr), checks the mapping of its previous record, and finds that the message is for (IP_le, Port_le). The TURN server 63 then wraps the source address (IP-2, Port-2) of the communication request into the communication request (i.e., included in the valid data portion of the communication request message), and utilizes its service address in step S707. (IP- _{s, Port-s)} forwards the request to the new communication (IP_le, Port_le

In step S708, the NAT device 62 receives the communication request forwarded from the TURN server 63 at the address (IP_le, Port_le), and by looking at the mapping and policy database, finds that the request should be forwarded to (IP_li) , Port_li). The NAT device 62 then changes the destination address of the communication request to (IP-li, Port-li) and forwards it to (IP-li, Port_li) in step S709.

In step S710, the first host 61 receives the communication request, and retrieves the content of the original request message and the original source address (IP_2, Port-2) of the message from the valid data portion of the communication request. The first host 61 creates a response message for the request, wrapping the actual destination address (IP-2, Port-2) of the response into the valid data portion of the response message. In step S711, the first host 61 transmits the response message to the service address (IP_s, Port_s) of the TUR server 63.

The NAT device 62 captures the response message in step S712, changes its source address to (IP-le, Port-le), and then forwards it to the TURN server 63 in step S713.

The TURN server 63 receives the response message at its service address (IP_s, Port_s) in step S714, extracts the actual destination (IP-2, Port-2) and the actual response message, and in step S715 The actual response message is delivered to the address of the second host 65 (IP-2, Port-2). The second host 65 thus receives a response from the first host 61 to its communication request, and can continue to communicate with the first host 61 via the TURN server 63 in this manner.

In the TURN scheme as described above, the TURN server 63 assigns an address, i.e., an IP-port pair, to each client that issues a relay request. The TURN server 63 must also maintain the assigned address (i.e., (IP-lr, Port-lr) in Figures 1 and 2) and the client's NAT address (i.e., (IP-le, Port-le) in Figures 1 and 2). The mapping between ). Address management and mapping maintenance add extra work to the TURN server 63. In addition, the port number of the TURN server 63 is a limited resource. This may limit the performance of the TURN server 63.

In addition, in P2P or similar situations, NAT poses a significant problem for network connectivity. Since there may be many hosts behind the NAT device, the TURN solution faces serious scalability issues. Therefore, it is desirable to provide a method, system, and corresponding relay server that utilizes a relay mode to traverse NAT, wherein the relay server is stateless and does not need to allocate and manage addresses for its clients. In addition, it is desirable to provide a method, system, and corresponding relay server that utilizes a relay mode to traverse NAT, which can solve the scalability problem faced by the prior art TURN solution. Summary of the invention

It is an object of the present invention to provide a method, system and corresponding relay server for traversing NAT using a relay method, wherein the relay server is stateless and does not need to allocate and manage addresses for its clients. Another object of the present invention is to provide a method, system and corresponding relay server for traversing NAT by means of a relay, which can solve the scalability problem faced by the prior art TURN scheme.

According to an aspect of the present invention, a method for network address translation NAT traversal by means of a relay is provided, including: the first host sends a relay request message to a service address of the relay server by using a NAT address by using a NAT device; Following the server returning a relay response message to the first host, the relay response message includes an address list including a relay address and the NAT address.

According to another aspect of the present invention, a system for performing network address translation NAT traversal by means of a relay is provided, including: a first host, the first host sending a relay request message to a service address of the relay server; The NAT device intercepts the relay request message, and forwards the relay request message to the service address by using a NAT address; and a relay server, and the relay server sends the first host to the first host via the NAT device Returning a relay response message, the relay response message including an address list including a relay address and the NAT address.

According to another aspect of the present invention, a relay server is provided, comprising: a messaging unit that receives a relay request message sent from a network address translation NAT address on a service address, and transmits the relay request message Returning to the relay request processing unit, and returning, by the service address, a relay response message constructed by the relay request processing unit to the NAT address; and a relay request processing unit configured to construct the relay response message, The relay response message includes A list of addresses, the address list including a relay address and the NAT address.

The above and other advantages and features of the present invention will become more apparent from the following detailed description. DRAWINGS

The same or similar reference numerals in the drawings denote the same or similar elements, in which:

1 is a diagram showing an operation procedure of a name binding phase of a NAT traversal method using a TURN server according to the related art;

2 is a diagram showing an operation procedure of a communication phase of a NAT traversal method using a TURN server according to the related art;

3 is a schematic block diagram showing a system for traversing a NAT using a relay server according to a first embodiment of the present invention;

4 is a diagram showing an operation procedure of the system shown in FIG. 3 in the name binding phase of the NAT traversal method according to the first embodiment of the present invention;

Figure 5 is a diagram showing an operation procedure of the system shown in Figure 3 in the communication phase of the NAT traversal method according to the first embodiment of the present invention;

6 is a schematic block diagram showing a system for traversing a NAT using a relay server according to a second embodiment of the present invention;

Figure 7 is a diagram showing the operational procedure of the relay node reporting and selection phase of the system of Figure 6 in the NAT traversal method according to the second embodiment of the present invention. detailed description

The present invention utilizes the principles of source routing techniques widely used in overlay networks and ad-hoc networks to solve NAT problems, especially symmetric NAT.

Source routing technology enables the sender of a packet to specify, in part or in whole, the route that the packet passes through the network. In contrast, in non-source routing protocols, the path is determined by routers in the network based on the destination of the packet.

In a typical source routing mechanism, the sender/source wraps the routing information into packets. The routing information contains the necessary path information from the source address to the destination address. Each packet received on the path The node extracts the next hop address from the packet and then forwards it to the next hop. Each node on the path repeats the process until the packet reaches its destination.

For example, suppose host A wants to send data to host B, and host A knows in advance that it can send data to host B via host C. That is, host A knows in advance the coverage path from host B to destination host B: Host A -> Host C -> Host B.

Thus, host A constructs such a packet: the address of host B is added as the overlay header before the application layer valid data (e.g., voice data) of the packet. In the TCP/IP layer, the overlay header is also part of the application layer's valid data. The address of host B can include the address and port of host B. In addition, the address of host B may also include a protocol. For example, the address of host B can be of the form: 202.1.1.1, 80, TCP.

In front of the overlay layer header, the header of the TCP/IP layer is added. The header of the TCP/IP layer includes the IP address and port of the host A as the source address, the IP address and port of the host C as the destination. address.

Host A then sends the packet to Host C. The host C receives the packet, extracts the address information portion in the TCP/IP header, and the address of the host B in the valid data portion of the application layer, and then removes the address of the host B from the packet, and will only contain the original valid data. A packet (for example, voice data) is sent to the address of Host B.

The present invention takes advantage of the idea of this source routing technique to solve the problem of NAT, especially symmetric NAT. Embodiments of the present invention are described below with reference to the accompanying drawings.

Before describing an embodiment of the present invention, the use of the terms in the present invention will be explained. In the present invention, when referring to "address", unless otherwise stated, it generally refers to a transport address formed by a combination of an IP address and a port number. In some cases, an "address" can include a combination of an IP address, a port number, and a protocol. For the sake of brevity, only a combination of both IP address and port number is used. In the present specification and the drawings, a combination of an IP address and a port number is expressed in the form of (IP, Port).

In addition, in the drawing, the source address, the destination address, and the payload (payload) portion of the corresponding message are expressed in the form of "src: (xxx, xxx) dst: (yyy, yyy) data: zzzzz". Special content.

For example, "src: below the arrow of the relay request message transmitted in step S101 in FIG. (IP_li, Port-li) dst: (IP_s, Port_s)" indicates that the source address of the relay request message is (IP_li Port_li) and the destination address is (IP_s, Port_s). "Data" indicates that the valid data portion of the relay request message is the same as the content of the normal relay request message.

For another example, "src: (IP s, Port s) dst: (IP-le, Port-le) data below the arrow of the relay response message transmitted in step S105 of FIG. 4: [(IP-r, Port- r), (IP le, Port_le)], indicates that the source address of the relay response message is (IP_s, Port_s), the destination address is (IP_le, Port-le), and In the valid data portion of the relay response message, in addition to what may be included in the usual relay response message, an address list [(IP_r, Port_r), (IP le, Port-le)] according to the present invention is also included.

Further, it is to be noted that, in the present invention, when referring to the source address or destination address of a certain message, it actually refers to the source address or the destination address recorded in the TCP/IP layer header of the packet carrying the message. When referring to the valid data portion of a message, it actually refers to the application layer payload of the packet carrying the message after the TCP/IP layer header is removed.

Fig. 3 shows a block diagram of a system 1 for NAT traversal according to a first embodiment of the present invention.

As shown in FIG. 1, the system 1 includes a first host 11, a NAT device 12, a relay server 13, a name server 14, and a second host 15.

As shown, the first host 11 is in the private network, the NAT device 12 is the NAT device of the private network, and the relay server 13, the name server 14, and the second host 15 are all outside the private network. It is assumed here that the relay server 13, the name server 14, and the second host 15 are all in the public network.

The first host 11 includes a messaging unit 101, a storage unit 102, a name binding unit 103, and a communication processing unit 104. The messaging unit 101 is configured to receive a message from another device, pass it to the name binding unit 103 or the communication processing unit 104 or the like according to the type of the received message, etc., and send the name binding unit to the desired destination. The 103 and communication processing unit 104 indicates the transmitted message. The name binding unit 103 can perform the processing at the first host 11 during the name binding phase of the method of the present invention. Communication processing unit 104 may perform the processing at first host 11 during the communication phase of the method of the present invention. The storage unit 102 can store information that may be needed to be used and stored in the operation of the first host 11. For example, the storage unit 102 can store The local address of the first host 11, and the address list received by the first host 11 from the relay server 13, and the like.

The NAT device 12 includes a messaging unit 201, a storage unit 202, and a NAT processing unit 203. The messaging unit 201 is configured to receive messages from other devices, deliver the received messages to the NAT processing unit 203, and send a message to the desired destination that the NAT processing unit 203 indicates to transmit. The NAT processing unit 203 can perform NAT processing. The storage unit 202 can store information that may be needed to be used and stored in the operation of the NAT device 12. For example, storage unit 202 can store internal addresses used by NAT device 12 in the private network, external addresses that can be assigned to hosts in the private network, and mappings and related policies between internal and external addresses, and the like.

The relay server 13 includes a messaging unit 301, a storage unit 302, a relay request processing unit 303, and a relay processing unit 304. The messaging unit 301 is configured to receive a message from another device, transfer it to the relay request processing unit 303 or the relay processing unit 304 according to the type of the received message, and the like, and send a relay request processing to the desired destination. Unit 303 and relay processing unit 304 indicate the transmitted message. The relay request processing unit 303 can perform the processing at the relay server 13 during the name binding phase of the method of the present invention. Relay processing unit 304 may perform the processing at relay server 13 during the communication phase of the method of the present invention. The storage unit 302 can store information that may be needed to be used and stored in the operation of the relay server 13. For example, storage unit 302 can store a service address and a relay address.

The name server 14 includes a messaging unit 401, a storage unit 402, a binding update processing unit 403, and a query processing unit 404. The messaging unit 401 is configured to receive a message from another device, pass it to the binding update processing unit 403 or the query processing unit 404 or the like according to the type of the received message, and the like, and send a binding update to the desired destination. Processing unit 403 and query processing unit 404 indicate the transmitted message. Binding update processing unit 403 can perform the processing at name server 14 during the name binding phase of the method of the present invention. The query processing unit 404 can perform the processing at the name server 14 during the communication phase of the method of the present invention. The storage unit 402 can store information that may need to be used and stored in the operation of the name server 14. For example, the storage unit 402 can store binding information reported by the host.

The second host 15 includes a messaging unit 501, a storage unit 502, and a communication processing unit 503. The messaging unit 501 is configured to receive messages from other devices, according to the received cancellation The type of interest or the like is passed to the communication processing unit 503 or the like, and the message transmitted by the communication processing unit 503 is instructed to the desired destination. Communication processing unit 503 can perform the processing at second host 15 during the communication phase of the method of the present invention. The storage unit 502 can store information that may be needed to be used and stored in the operation of the second host 15. For example, the storage unit 502 can store address information usable by the second host 15.

An example of the operation of the system 1 shown in Fig. 3 in the NAT traversing method according to the present invention will be described in detail below with reference to Figs. 4 and 5.

Figure 4 illustrates the operation of the name binding phase of the NAT traversal method in accordance with the present invention.

As shown in Figure 4, the relay server 13 can use two addresses to receive and send messages. That is, the relay server 13 can listen for incoming messages at these two addresses, and can use any of the two messages to send outgoing messages. These two addresses include the service address (IP_s, Port_s) and the relay address (IP_r, Port-r). The service address (IP_s, Port_s) is used for the host in the private network behind the NAT device, and the relay address (IP_r, Port is used for the host outside the private network. Note that in the present invention, the service address And the relay address can be the same.

It is assumed that a host in the private network, such as the first host 11, expects the relay server 13 to provide a relay service for the host outside the private network to initiate communication with the first host 11. As shown, the first host 11 is behind the NAT device 12. That is to say, the packets received by the first host 11 need to be processed by the NAT device 12 for NAT.

First, in step S101, the name binding unit 103 of the first host 11 constructs a relay request message and transmits it out through the messaging unit 101. The destination address of the relay request message is the service address of the relay server 13, and the source address is the local address or internal address (IP_li, Port-li) of the first host 11 in the private network.

In step S102, the messaging unit 201 of the NAT device 12 intercepts the relay request message and passes it to the NAT processing unit 203. NAT NAT processing unit 203 by performing the processing, the source address of the relay request message to a public address or the external address (IP le, Port_le) ₀ This address may also be referred to as a NAT address. In this case, the NAT processing unit 203 forms a mapping between (IP-li, Port-li) and (IP-le, Port-le), and formulates such a policy for the mapping: Allowing from (IP_s, Port_s) The message sent to (IP-le, Port-le) is forwarded to (IP_li, Port_li) o That is, if the source address of the packet of the incoming message received by the NAT device 12 later is CIP_s, and the destination address of the Port_s is (IP_le, Port_le;), then The message can be forwarded to the internal address (IP_li, Port-li) of the first host 11. The NAT processing unit 203 records the entries containing the mappings and policies in, for example, a mapping and policy database in the storage unit 202.

In step S103, the NAT device 12 forwards the source address modified relay request message to the relay server 13.

In step S104, the relay server 13 receives the relay request message forwarded from the NAT device 12 through the messaging unit 301. The relay request message is delivered to the relay request processing unit 303. The relay request processing unit 303 learns the source address (IP_le, Port_le) (NAT address) of the relay request message. The relay request processing unit 303 constructs a relay response message: the valid data portion of the relay response message includes an address list [(IP - r, Port - r), (IP - le, Port - le)]. The address list may also be referred to as routing information, including a relay address (IP_r, Port-r) and a NAT address (IP_le, Port_le) o different from the prior art, the relay address (IP-r , Port — r) may not be specifically allocated for the first host 11 . That is, the relay server 13 may be a plurality or all of the received relay request message using a common repeater address (IP- I ·, Port_r) ₀ Further, the prior art different, the relay server 13 There is also no need to store any mappings. When it receives a communication request message at the relay address (IP_r, Port-r) later, it only needs to send it to the specific address according to the address carried by the message itself using its service address (IP_s, Port_s). The destination is OK, as described in more detail below.

In step S105, the relay request processing unit 303 transmits a relay response message to the address (IP_le, Port_le) by the message transmitting and receiving unit 301 using the service address (IP_s, Port_s).

In step S106, the NAT device 12 receives the relay response message. At this time, the NAT processing unit 203 checks the relay response message against the mapping and policy database stored in the storage unit 202. In this case, since the source address of the relay response message is (IP_s, Port_s) and the destination address is (IP_le, Port-le), the message passes the check. Thus, the NAT processing unit 203 changes the destination address of the relay response message from (IP_le, Port_le) to (IP_li, Port-li). Or, if the message fails to pass the check, it is discarded (or forwarded to another matching address). In step S107, the messaging unit 201 forwards the relay response message whose destination address has been modified to the first host 11.

In step S108, the messaging unit 101 of the first host 11 delivers the received relay response message to the name binding unit 103. The name binding unit 103 extracts the address list [(IP - r, Port - r), (IP - le, Port - le)] from the valid data portion of the relay response message. The name binding unit 103 then constructs a binding update message, including binding information indicating the first host 11 (e.g., the host name of the first host 11) and the address in the valid data portion of the binding update message. The binding of the list [(IP_r, Port_r), (IP le, Port-le)].

In step S109, the messaging unit 101 of the first host 11 transmits a binding update message to the address (IP_ns, Port_ns) of the name server 14 in accordance with the instruction of the name binding unit 103. Note that the internal address used by the first host 11 to communicate with the name server 14 is generally different from the internal address used when communicating with the relay server 13. Here, to indicate such a distinction, (IP_li' and Port_Π') are used to indicate the internal address used when the first host 11 communicates with the name server 14. As is well known to those skilled in the art, it is common for IP addresses to be the same and port numbers to be different. That is to say, IP-li' and IP-li can be the same, and Port-li is usually different from Port_li. The same device typically uses a different transport address (at least a different port number) when communicating with different devices. This also applies to the internal address (IP-li", Portli") used by the first host to communicate with the relay selection server 16, as described below, and when the second host communicates with the name server and via the relay server. The addresses (IP_2 'and ΙΡ_2') and (IP_2 and IP_2) used by a host to initiate a communication request.

In step S110, similar to step S102, the messaging unit 201 of the NAT device 12 intercepts the binding update message and passes it to the NAT processing unit 203. The NAT processing unit 203 changes the source address of the binding update message to a public address or an external address (IP_le', Port_le') by performing NAT processing. Here, since (IP_li, Port_li,) is different from (IP_li, Port_li), the external address (IP_le', Port_le') to which (IP_li', Port_li') is mapped is different from (IP_li, Port-li ) The external address (IP_le, Port-le) to which it is mapped. Among them, IP-le' and IP-le can be the same, and Port-le' and Port_le are usually different. The same applies to the case of (IP_li", Port-li") and (IP-le", Port-le" described below. In this case, similar to step S102, the NAT processing unit 203 forms (IP-li, Port-li') and Mapping between (IP_le', Port-le'), and formulating a policy for this mapping: Allow messages sent from (IP_ns, Port-ns) to (IP-le, Port-le,) to be forwarded to (IP_li', Port_li') _{0 The} NAT processing unit 203 records an entry containing the mapping and policy in, for example, a mapping and policy database in the storage unit 202.

In step S111, the NAT device 12 transmits the modified binding update message of the source address to its desired destination-name server 14.

In step S112, the messaging unit 401 of the name server 14 receives the binding update message and passes it to the binding update processing unit 403. The binding update processing unit 403 extracts information indicating the binding of the host name of the first host 11 and the address list [(IP_r, Port_r), (IP_le, Port_le)] from the valid data portion of the binding update message. And storing the information in, for example, a binding database in the storage unit 402.

Figure 5 shows the operation of the communication phase of the NAT traversal method in accordance with the present invention.

As shown, the second host 15 wishes to initiate communication with the first host 11. The second host 15 is not in the private network where the first host 11 is located. The second host 15 may be in the public network or in another private network. That is, the second host 15 may not be behind the NAT device or behind another NAT device. For the sake of brevity, it is assumed here that the second host 15 is not behind the NAT device.

First, in step S201, the communication processing unit 503 of the second host 15 constructs a binding query message, which specifies the host name of the first host 11, and wishes to query the address of the first host 11. The messaging unit 501 sends the binding query message to the name server 14.

In step S202, the messaging unit 401 of the name server 14 receives the binding query message and passes it to the query processing unit 404. The query processing unit 404 searches the binding database in the storage unit 402 with the host name of the first host 11 to find the address list corresponding to the host name of the first host 11 [(IP_r, Port_r), ( IP—le, Port—le)]. The query processing unit 404 constructs a binding reply message in which the valid data portion of the message includes an address list [(IP_r, Port_r), (IP_le, Port_le)] corresponding to the host name of the first host 11.

In step S203, the messaging unit 401 of the name server 14 transmits the binding reply message to the second host 15.

In step S204, the messaging unit 501 of the second host 15 receives the binding reply. The message is passed to the communication processing unit 503. The communication processing unit 503 extracts an address list |XIP_r, Port_r), (IP_le, Port_le) corresponding to the first host 11 from the valid data portion of the binding reply message, and constructs a communication request. The message, the valid data part of the communication request message includes the original data content in the communication request message normally sent by the second host 15, and the NAT address in the extracted address list (IP_le, Port_le;) .

In step S205, under the instruction of the communication processing unit 503, the messaging unit 501 uses the source address (IP-2, Port-2) to forward the relay address in the extracted address list (IP_r, Port-r). A communication request is sent to initiate communication with the first host 11.

In step S206, the messaging unit 301 of the relay server 13 receives the communication request message on the relay address (IP_r, Port-r) and passes it to the relay processing unit 304 accordingly. The relay processing unit 304 extracts as the routing information from the communication request message (IP_le, the Port_le relay processing unit 304 then constructs a new communication request based on the communication request message, SP, and removes the original communication request message included in the IP_le, Port_le;), and includes the original source address of the communication request message, that is, the address of the second host 15 (IP_2, Port-2).

In step S207, under the instruction of the relay processing unit 304, the message transceiving unit 301 with its service address (IP- _s, Port- _s) of the new communication request is forwarded to the message (IP_le, Port_le seen bound name The routing information returned by the relay server to the first host is such that the second host can specify the path of the message in the sent communication request message by means of source routing. The relay server can thus be based on the content contained in the message. Forwards to the appropriate NAT address without itself maintaining any mapping information.

In step S208, the messaging unit 201 of the NAT device 12 receives the new communication request message at the address (IP_le, Port-le) and passes it to the NAT processing unit 203. The NAT processing unit 203 checks the message against the mapping and policy database in the storage unit 202. In this case, since the source address of the message is (IP_s, Port_s) and the destination address is (IP_le, Port_le), the message passes the check. Thus, the NAT processing unit 203 changes the destination address of the message from (IP_le, Port_le) to (IP_li, Port_li).

In step S209, the messaging unit 201 forwards the modified communication request message of the destination address to the internal address (IP_li, Port-li) of the first host 11.

In step S210, the messaging unit 101 of the first host 11 receives the slave NAT setting. The communication request message forwarded by the device 12 is passed to the communication processing unit 104. The communication processing unit 104 extracts the valid data content of the original communication request message and the original source address (IP-2, Port-2) from the valid data portion of the communication request message. The communication processing unit 104 then creates a communication response message for the communication request message, and includes, in addition to the valid data content originally included in the communication response message normally sent by the first host 11, in the valid data portion of the communication response message. The actual destination address of the communication response message (IP-2, Port_2) ₀

In step S211, the first host 11 transmits the communication response message to the service address (IP_s, Port_s) of the relay server 13 via the messaging unit 101.

In step S212, the messaging unit 201 of the NAT device 12 intercepts the communication response message and passes it to the NAT processing unit 203. In this case, since there are already entries for mappings and policies between (IP_li, Port_li), (IP_le, Port_le) and (IP_s, Port_s) in the mapping and policy database in the storage unit 202, The NAT processing unit 203 directly changes the source address of the communication response message to (IP-le, Port-le).

In step S213, the NAT device 12 forwards the modified communication response message of the source address to the relay server 13.

In step S214, the messaging unit 301 of the relay server 13 receives the communication response message on the service address (IP_s, Port_s) and passes it to the relay processing unit 304. The relay processing unit 304 extracts the actual content of the actual destination (IP-2, Port-2) and the response message from the valid data portion of the communication response message, and constructs the actual content including the actual content in the valid data portion. Communication response message.

In step S215, under the instruction of the relay processing unit 304, the messaging unit 301 transmits the actual communication response message to the address of the second host 15 (IP-2) using the relay address (IP_r, Port-1). , Port_2

The second host 15 then receives the communication response message sent from the first host 11. The communication between the first host 11 and the second host 15 can be continued by the relay server 13 in accordance with the above process.

Note that although the above describes by way of example, by the first host 11 updating the binding to the name server after acquiring the address list from the relay server 13, and then the second host 15 queries the name server, the second host 15 can acquire and Address column bound by the first host 11 Table, but the invention is not limited thereto. As will be apparent to those skilled in the art, the second host 15 can also obtain a list of addresses corresponding to the first host 11 by other means. For example, the first host 11 can inform the second host 15 of its corresponding address list by means of email or the like. In fact, as long as the first host 11 requests the address list from the relay server 13, and the second host 12 knows the address list by some suitable means, it can initiate communication with the first host 11 via the relay server 13. .

It can be seen that, unlike the prior art, the relay server according to the present invention does not need to allocate a relay address for each received relay request and record the assigned relay address and relay request source address (NAT address). The mapping between. That is, the relay server does not need to assign an address to its clients, nor does it need to maintain state information. The status information is instead carried by the packet for each message from the external host. Thus, the server of the present invention is stateless and more robust and efficient.

In addition, as mentioned earlier, in P2P or similar situations, NAT poses a significant problem for network connectivity. Since there may be many hosts behind the NAT device, the TURN solution faces serious scalability issues.

However, due to the utilization of source routing techniques by the present invention, the present invention is well suited for use in overlay networks where source routing is the routing mechanism. In the case of being used in an overlay network, each overlay node that is not behind the NAT can act as a TURN server.

That is to say, with the present invention, scalability is no longer a problem because each host in the public network can act as a relay server. In addition, the present invention alleviates the burden on the relay node because of the stateless design. Each node in the public network can report to the relay selection server. The reported information may include the service address of the node (i.e., (IP_s, Port_s) as described above), the capabilities of the node, the service provider (ISP) to which the node belongs, the location of the node, and the like.

When the host behind the NAT issues a query to the relay selection server, and wants to find one or more relay nodes to act as its relay server, the relay selection server will be based on the information about the relay node that it stores, and issue Query the primary tL information (location, ISP, etc.) to select one or more relay nodes. Then, the node following the NAT updates its binding to the name server by a name binding similar to that in the first embodiment. The other host can then initiate communication with the node behind the NAT with the selected relay node as a relay. A second embodiment of the present invention will be described in detail below with reference to Figs. 6 and 7. The second embodiment shows the case where the present invention is applied, for example, in a source-routed P2P network.

Figure 6 shows a block diagram of a system 1' for NAT traversal in accordance with a second embodiment of the present invention. A system according to a second embodiment of the present invention includes a first host 1, a NAT device 12, one or more relay nodes (one of the relay nodes 13-a is shown in FIG. 6), a name server 14, and a Two hosts 15 and a relay selection server 16, and so on.

The NAT device 12, the name server 14, and the second host 15 are the same as in the first embodiment. The description will not be repeated here.

The relay node 13-a and other relay nodes 13-b and the like not shown are located in the public network, and have the structure as shown in FIG. This structure is different from the relay server 13 of the first embodiment in that it further includes an information reporting unit 305. The information reporting unit 305 is configured to report the service address, capability, ISP, location, and the like of the own node to the relay selection server 16.

The first host 1 is different from the first host 11 of the first embodiment in that it further includes a relay determining unit 105 for requesting the relay selection server 16 to select one or more nodes as its relay node.

The relay selection server 16 includes a messaging unit 601, a storage unit 602, a report processing unit 603, and a relay selection unit 604. The messaging unit 601 is configured to receive a message from another device, transfer it to the report processing unit 603 or the relay selection unit 604 or the like according to the type of the received message, and the like, and transmit the report processing unit 603 to the desired destination. And relay selection unit 604 indicates the transmitted message. The report processing unit 603 can be configured to receive reports sent by the relay node and store information about the nodes in the storage unit 602. The relay selection unit 604 can select a relay node for it according to, for example, the request of the first host 1 。. The storage unit 602 can store information that may be needed to be used and stored in the operation of the relay selection server 16. For example, storage unit 602 can store information reported by various relay nodes.

Figure 7 shows an example of the operation of the method of the present invention at the node reporting and selection stage.

As shown in FIG. 7, in step S301, the messaging unit 301 of the relay node 13-a transmits a report message constructed by the information reporting unit 305 to the relay selection server 16. The valid data portion of the report message includes information such as the service address, capability, ISP, location, etc. of the relay node 13-a. In step S302, the message transceiving unit 601 of the relay selection server 16 receives the report message transmitted from the relay node 13-a, extracts the information recorded in the valid data portion thereof, and the node database in the storage unit 602. An entry is created for the relay node 13-a, which includes the above information of the relay node 13-a.

Similarly, in step S303 and step S304, the relay node 13-b reports its service address, capability, ISP, location, etc. to the relay selection server 16, and the relay selection server 16 records the information in the storage unit 602. In the node database.

Although only the two relay nodes report to the relay selection server 16 are shown in the figure, it should be understood that other relay nodes may also report their information to the relay selection server 16 through similar steps.

In step S305, the messaging unit 101 of the first host 1 transmits a relay selection request message constructed by the relay determining unit 105 to the relay selection server 16, and the valid data portion of the relay selection request message includes, for example, the first Host 1 Γ ISP, location, etc.

The NAT device 12 performs processing similar to that in the above-described steps S102 and S110 in the relay selection request message in step S306, and changes the source address from (IP_li", Port_li") to (IP- in step S307). The relay selection request message of le", Port_le") is forwarded to the relay selection server 16.

In step S308, the messaging unit 601 of the relay selection server 16 receives the relay selection request message and passes it to the relay selection unit 604. The relay selection unit 604 is the first host according to the ISP, location, and the like of the first host 1 包括 included in the relay selection request message, and the capability, ISP, location, and the like of the node stored in the node database in the storage unit 602. 1 Select one or more appropriate relay nodes to act as relay servers for which relay services are provided. The relay selection unit 604 constructs a relay selection response message including the service address of the selected relay node and other information that may be needed in the valid data portion of the message, and the like.

In step S309, the messaging unit 601 of the relay selection server 16 transmits the relay selection response message to (IP_le", Port-le").

Then, through the NAT processing in step S310 and the forwarding in step S311, the relay selection response message arrives at the first host 11'.

The first host 1 then knows the service address of one or more relay nodes for which relay services can be provided. The first host 1 Γ can then proceed to this via steps S101 to SU2 shown in FIG. The relay nodes send a relay request message and refer to the name server according to the obtained relay response.

14 Update the binding of its hostname to one or more address lists.

Then, the second host 15 can similarly pass through steps S201 to S215 shown in FIG. 5 to relay the selection server 16 as one of the one or more relay nodes selected by the first host 1 as a relay to initiate and Communication of the first host 1 Γ.

It can be seen that the present invention solves the scalability problem faced by the prior art TURN scheme because each host in the public network can act as a relay server. The relay selection server may select one or more relay sections for the requesting node according to the respective conditions of the requesting node and the relay node.

"Accumulate,,. °

While the invention has been described by way of the embodiments and the embodiments of the embodiments of the invention And changes.

Claims

Claim

A method for performing network address translation NAT traversal by means of a relay, comprising: transmitting, by a NAT device, a relay request message to a service address of a relay server by using a NAT address; and

The relay server returns a relay response message to the first host, the relay response message including an address list including a relay address and the NAT address.

2. The method of claim 1 further comprising:

The second host acquires the address list and initiates communication with the first host by transmitting a communication request message including the NAT address to the relay address.

3. The method of claim 2, further comprising:

The first host sends a binding update message to the name server indicating that the first host is bound to the address list, and wherein

The step of the second host acquiring the address list includes querying the name server to obtain the address list to which the first host is bound.

4. The method of claim 2, further comprising:

Receiving, by the relay server, the communication request message on the relay address, modifying the communication request message by including an address of the second host in the communication request message, and modifying the communication The request message is forwarded to the first host.

The method according to claim 4, wherein

The step of the relay server forwarding the modified communication request message to the first host includes transmitting, by using the service address, a modified communication request message to the NAT address, and

The method further includes:

Receiving, by the NAT device, the modified communication request message on the NAT address, and forwarding the modified communication message to the first host;

The first host extracts an address of the second host from the modified communication request message, and sends a communication including an address of the second host to a service address of the relay server via the NAT device. Response message; The relay server forwards the communication response message to the second host.

6. The method of claim 1 wherein

The step of the relay server returning a relay response message to the first host includes transmitting the relay response message to the NAT address by using the service address, and

The method also includes the NAT device receiving the relay response message on the NAT address and forwarding the relay response message to the first host.

7. The method of claim 1 further comprising:

Each of the one or more relay nodes transmits a report including information of the relay node to the relay selection server;

The relay selection server records the information included in the received report;

The first host sends a relay selection request to the relay selection server, and receives a relay selection response returned by the relay selection server, and wherein

One of the one or more relay nodes indicated by the relay selection response acts as the relay server.

The method of claim 1, wherein each of the service address, relay address, and NAT address comprises an IP address and a port number.

The method of claim 1, wherein the service address and the relay address are the same.

A system for performing network address translation NAT traversal by means of a relay, comprising: a first host, wherein the first host sends a relay request message to a service address of the relay server; and the NAT device intercepts the middle device Following the request message, and forwarding the relay request message to the service address using a NAT address;

a relay server that returns a relay response message to the first host via the NAT device, the relay response message including an address list including a relay address and the NAT address.

11. The system of claim 10, further comprising:

And a second host that obtains the address list and initiates communication with the first host by transmitting a communication request message including the NAT address to the relay address.

12. The system of claim 11 further comprising: a name server, which receives a binding update message sent from the first host indicating binding the first host to the address list, records the address list to which the first host is bound, and Returning, to the second host, the address list to which the first host is bound after receiving the query of the second host.

The system according to claim 11, wherein the relay server receives the communication request message on the relay address by including an address of the second host in the communication request message. Modifying the communication request message and forwarding the modified communication request message to the first host.

14. The system of claim 13 wherein

The relay server forwards the modified communication request message to the first host by transmitting the modified communication request message to the NAT address by using the service address;

Receiving, by the NAT device, the modified communication message on the NAT address, and forwarding the modified communication message to the first host;

The first host extracts an address of the second host from the modified communication request message, and sends a communication response including an address of the second host to a service address of the relay server via the NAT device. Message; and

The relay server forwards the communication response message to the second host.

15. The system of claim 10, wherein

The relay server returns the relay response message to the first host by transmitting the relay response message to the NAT address using the service address;

The NAT device receives the relay response message on the NAT address and forwards the relay response message to the first host.

16. The system of claim 10, further comprising:

a relay selection server that receives a report of information including the relay node from each of the plurality of relay nodes, records information included in the received report, and receives the information from the first host After selecting the request, selecting one or more of the plurality of relay nodes according to the recorded information, and wherein

The relay server is one of the selected relay nodes.

17. The system of claim 10, wherein the service address, relay address, Each of the NAT addresses includes an internet protocol address and a port number.

18. The system of claim 10, wherein the service address and the relay address are the same.

19. A relay server, comprising:

a messaging unit that receives a relay request message sent from a network address translation NAT address at a service address, delivers the relay request message to a relay request processing unit, and uses the service address to the NAT address Returning a relay response message constructed by the relay request processing unit;

A relay request processing unit that constructs the relay response message, the relay response message including an address list including a relay address and the NAT address.

20. The relay server of claim 19, further comprising a relay processing unit, wherein: said messaging unit further receives a communication request message including said NAT address on said relay address, and said a communication request message is delivered to the relay processing unit;

The relay processing unit extracts the NAT address from the communication request message, and modifies the communication request message by including a source address of the communication request message in the communication request message;

The messaging unit transmits the modified communication request message to the NAT address by using the service address.

21. The relay server of claim 19, further comprising:

An information reporting unit that constructs a report including information of the relay server, the information including the service address, and wherein

The messaging unit transmits the report to a relay selection server.

The relay server according to claim 19, wherein each of the service address, the relay address, and the NAT address includes an internet protocol address and a port number.

The relay server according to claim 19, wherein the service address and the relay address are the same.