WO2012109865A1

WO2012109865A1 - Nat processing method, device and system for calls between clients of private network and clients out of network

Info

Publication number: WO2012109865A1
Application number: PCT/CN2011/077828
Authority: WO
Inventors: 简其平; 金龙
Original assignee: 华为技术有限公司
Priority date: 2011-07-30
Filing date: 2011-07-30
Publication date: 2012-08-23
Also published as: CN102318323B; CN102318323A

Abstract

The present invention relates to the technical field of communications. Disclosed in an embodiment of the present invention are an NAT processing method, device and system for calls between clients of a private network and clients out of network, solving the technical problem of unable to pass through NAT and FW when a proxy server and a private network client are in the same private network. The processing method for the NAT device comprises: allocating an idle public network address and port for the private network address and port of the private network client in the SDP portion of an SIP packet sent by a server, and storing the mapping relation; performing NAT ALG processing to the SIP packet, and converting the private network address and port in the SDP portion of the SIP packet into the public network address and port according to the mapping relation. The NAT device comprises a processor and a storage device for realizing the above functions. The calling system comprises the NAT device and the proxy server. The present invention is applicable for implementing network telephone call.

Description

NAT processing method, device and system for calling between private network and extra-network client

The present invention belongs to the field of communication technologies, and specifically relates to a NAT processing method, a NAT device, and a calling system for calling between a private network client and an out-of-network client.

Background technique

With the rapid development of voice and video services, Voice over Internet Protocol (VoIP) may be established between the private network and the public network, or between the private network and the private network. There are different types of networks on the VoIP path, and there may be one or more Network Address Translation (NAT) and firewall (Fire Wall, FW) in the middle. Considering security, NAT and FW are common at the same time. These NATs and FWs prohibit communication or one-way release for most ports, while VoIP data streams are multi-path data streams. Dynamic port, so in the flow of data with NAT, FW can't predict the port that VoIP needs to use beforehand, unless most ports are open, thus losing the meaning of firewall. Therefore, the NAT and FW traversal problem in the Session Initiation Protocol (SIP) has become the biggest obstacle for SIP-based VoIP technology to be promoted in metropolitan area networks and enterprise networks with NAT and FW.

In a typical SIP network system, the proxy server (Proxy Server) is mostly located on the public network, and the client can register with the server on the public network, and the client can only talk to the called client through the proxy server on the public network.

Generally, the technologies for solving SIP traversal of NAT and FW are mainly classified into two types. For the symmetric NAT, the tunnel penetration technology is adopted. For the asymmetric NAT, the User Datagram Protocol (UDP) of the NAT is simply traversed (Simple Traversal of UDP over NATs, STUN) technology. However, the above two methods can only be used when the proxy server is on the public network, and cannot be used on the private network side of the proxy server on the NAT and FW.

Summary of the invention The embodiment of the invention provides a call between a private network client and an external network client.

The NAT processing method, the NAT device, and the call system enable the proxy server and the private network client to traverse NAT and FW on the same private network.

In order to achieve the above objectives, embodiments of the present invention adopt the following technical solutions:

A network address translation device processing method for a private network client and an out-of-network client call, including:

Assigning a public network address and port to the private network address and port of the private network client in the SDP part of the SIP packet sent by the proxy server, and saving the private network address and port, and the public network address and port. a mapping relationship, where the SIP message is a SIP message sent to the client outside the network;

The SIP packet is processed by the network address translation application layer gateway, and according to the mapping relationship, the private network address and port of the SDP part of the SIP packet are converted into a public network address and port.

A network address translation device for calling between a private network client and an off-net client, comprising a processor and a memory; wherein the processor is configured to: the private network client in the SDP part of the SIP certificate sent by the proxy server The private network address and port of the terminal, the public network address and the port are allocated, and the storage is instructed to store the private network address and the port, and the mapping relationship between the public network address and the port, where the SIP packet is sent to The SIP packet of the out-of-network client; and the network address translation application layer gateway processing of the SIP packet, and converting the private network address and port of the SDP part of the SIP packet into a public network according to the mapping relationship Address and port; the memory is used to save the mapping relationship.

A call system between a private network client and an out-of-network client, including the network address translation device and the proxy server; and the proxy server, after receiving the SIP message of the private network client, passing through the network The address translation device sends a SIP packet to the client outside the network.

Compared with the prior art, any technical solution provided by the present invention has the following advantages: The NAT device is a private network client in a Session Description Protocol (SDP) part of a SIP message sent by a proxy server. End The private network address and port are assigned an idle public network address and port, and the mapping relationship is saved, so that subsequent media streams can traverse NAT and FW according to the mapping relationship, thereby solving the problem that the proxy server and the private network client are in the same private network. , unable to traverse the technical problems of NAT and FW.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

FIG. 1 is a schematic flowchart of a method for processing a NAT device of a private network client calling an out-of-network client according to an embodiment of the present invention;

2 is a schematic flowchart of a method for processing a NAT device for a private network client and an out-of-network client to provide a call according to an embodiment of the present invention;

3 is a schematic diagram of a data flow of a private network client calling an off-net client provided by an embodiment of the present invention;

4 is a schematic flowchart of a method for processing a NAT device of an off-net client calling a private network client according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a data flow of an off-network client calling a private network client according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of a calling system of a private network client and an out-of-network client according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without departing from the scope of the invention are within the scope of the present invention.

Example 1: The method for processing the network address translation device of the private network client and the external network client provided by the embodiment of the present invention implements the traversal of the NAT and the FW when the proxy server and the private network client are on the same private network, as shown in FIG. 1 , including The following steps:

S101: The NAT device is a private network address and port of the private network client in the SDP part of the SIP message sent by the proxy server, allocates a public network address and port, and saves the private network address and port, and the public network address and port. , the mapping relationship between . The SIP packet is a SIP packet sent by the proxy server after receiving the SIP packet of the private network client. The SIP message can be a call request message or a response message. The source IP address of the SIP packet is the address of the proxy server, and the address and port in the SDP part are the private network address and port of the private network client. The SIP 4 message is a SIP message sent to the client outside the network.

Specifically, because the source IP address of the SIP 4 and the address in the SDP part are different, the NAT device cannot perform NAT ALG on the SDP part of the SIP packet according to the application level gateway (ALG). Therefore, the NAT device obtains the private network address and port of the private network client in the SDP part of the SIP 4 file, allocates an idle public network address and port to the private network client, and saves the private network address and port of the private network client. And the mapping relationship between the public network address and the port assigned to the private network client. When the media stream is transmitted between the private network client and the external network client, the NAT device also performs NAT processing on the media stream according to the mapping relationship.

S102: performing NAT ALG processing on the SIP packet, and according to the mapping between the private network address and the port, and the public network address and the port, the private network address and port of the SDP part of the SIP packet Convert to public network address and port.

Specifically, the NAT device performs NAT on the SIP packet sent by the proxy server. The private network address and port of the private network client in the SDP part of the SIP 4 are translated into the public network address and port according to the above mapping relationship. The NAT device can also perform ALG processing on the from, to, and other fields in the SIP packet.

The NAT device allocates an idle public network address and port to the private network address and port of the private network client in the SDP part of the SIP packet sent by the proxy server, and saves the mapping relationship so that the subsequent media stream can traverse the NAT according to the mapping relationship. And FW, thus solving When the proxy server and the private network client are on the same private network, the technical problems of NAT and FW cannot be traversed.

Example 2:

The embodiment of the present invention is a detailed description of a specific application scenario of the embodiment 1. As shown in FIG. 2 and FIG. 3, when the private network client calls the out-of-network client, the SIP 4 message is a call request message. The NAT device processing method includes the following steps:

Usually before the call is initiated, the private network client, such as client A, and the off-net client, such as client B, are each registered with the proxy server first. The out-of-network client can be a public network client or a private network client behind another NAT device.

The data part of the registration message sent by the private network client carries the address and port of the private network client when the call is initiated, so the proxy server can obtain the address and port from the registration message. The data part of the registration message sent by the out-of-network client carries the address and port when the out-of-network client initiates the call, so the proxy server can obtain the address and port from the registration.

S201: The NAT device sends a call request to the proxy server, for example, the private network address and port of the private network client in the SDP part of the Invite, and the public network address and port are allocated, and the private network address and port are saved. , and the mapping between public network addresses and ports. The Invite message is sent by the proxy server after receiving the Invite message from the private network client, and the source IP address of the Invite packet is the address of the proxy server, in the SDP part. The address and port are private network addresses and ports of the private network client.

Specifically, the source IP address of the Invite packet is different from the address in the SDP part, and the NAT device cannot perform NAT ALG on the SDP part of the Invite packet according to the normal ALG mode. Therefore, the NAT device obtains the private network address and port of the private network client in the SDP part of the Invite packet, allocates an idle public network address and port to the private network client, and saves the private network address and port of the private network client, and The mapping between the public network address and port assigned to the private network client. When the media stream is transmitted between the private network client and the external network client, the NAT device also pairs the mapping according to the mapping relationship. The media stream is NAT processed.

S202: Perform NAT ALG processing on the Invite packet, and convert the private network address and port of the SDP part of the Invite packet to the private network address and the port and the mapping between the public network address and the port. Public network address and port.

Specifically, the NAT device performs NAT on the Invite packet sent by the proxy server. Convert the private network address and port of the private network client in the SDP part of the Invite 4 to the public network address and port according to the above mapping relationship. The NAT device can also perform ALG processing on the from, to, and other fields in the Invite packet.

S203: After the Invite packet is received by the client, the response packet sent by the client is subjected to NAT processing.

Specifically, the response message may be a 200 OK message.

The NAT device allocates an idle public network address and port to the private network address and port of the private network client in the SDP part of the Invite packet sent by the proxy server, and saves the mapping relationship so that the subsequent media stream can traverse the NAT according to the mapping relationship. And FW, which solves the technical problem that the proxy server and the private network client cannot traverse NAT and FW when they are on the same private network.

Example 3:

The embodiment of the present invention is a specific description of another specific application scenario of the first embodiment. As shown in FIG. 4 and FIG. 5, when the client outside the network calls the private network client, the SIP 4 message is a response message, and the NAT is used. The device processing method includes the following steps:

Usually, before the call is initiated, the private network client, such as client A, and the extranet client, such as client B, are each registered with the proxy server first. The specific registration process is the same as the registration process described in embodiment 2. .

S301: The NAT device performs NAT processing on the call request message sent by the out-of-network client to the proxy server.

Specifically, the call request can be Invite 4.

S302: The private network address and port of the private network client in the SDP part of the response packet sent by the proxy server, the public network address and the port are allocated, and the private network address and port, and the public network address and the port are saved. Mapping relations. Where the response is 4 After receiving the response packet from the private network client in response to the call request packet, the proxy server sends a response packet, the source IP address of the response packet is the address of the proxy server, and the address and port in the SDP part are private networks. The private address and port of the client.

Specifically, the response message may be a 200 OK message. Because the source IP address of the 200 OK packet is different from the address in the SDP part, the NAT device cannot perform NAT ALG on the SDP part of the 200 OK packet according to the normal ALG mode. Therefore, the NAT device obtains the private network address and port of the private network client in the SDP part of the 200 OK packet, allocates an idle public network address and port to the private network client, and saves the private network address and port of the private network client, and The mapping between the public network address and port assigned to the private network client. When the media stream is transmitted between the private network client and the external network client, the NAT device also performs NAT processing on the media stream according to the mapping relationship.

S303: Perform NAT ALG processing on the 200 OK packet, and convert the private network address and port of the SDP part of the 200 OK packet according to the mapping relationship between the private network address and the port and the public network address and the port. It is the public network address and port.

Specifically, the NAT device performs NAT on the 200 OK sent by the proxy server. Convert the private network address and port of the private network client in the SDP part of the 200 OK file to the public network address and port according to the above mapping relationship. The NAT device can also perform ALG processing on the from, to, and other fields in the 200 OK message.

The NAT device allocates an idle public network address and port to the private network address and port of the private network client in the SDP part of the 200 ΟΚ · 3⁄4 text sent by the proxy server, and saves the mapping relationship so that the subsequent media stream can traverse according to the mapping relationship. NAT and FW solve the technical problem that the proxy server and the private network client cannot traverse NAT and FW when they are on the same private network.

Example 4:

A network address translation device for calling between a private network client and an out-of-network client provided by the embodiment of the present invention includes a processor and a memory. As a preferred solution, the NAT device provided by the embodiment of the present invention is a router or a switch.

The processor is a private network address and port of the private network client in the SDP part of the SIP message sent by the proxy server, allocates a public network address and a port, and instructs the memory to save the above The mapping between the private network address and port, and the public network address and port. The processor is further configured to perform NAT processing on the media stream according to a mapping relationship saved by the memory when receiving the media stream between the private network client and the external network client. The SIP packet is a SIP packet sent by the proxy server after receiving the SIP packet of the private network client. The source IP address of the SIP packet is the address of the proxy server, and the address and port in the SDP part are private. The private network address and port of the network client. The SIP 4 message is a SIP message sent to the client outside the network.

Then, the processor performs NAT ALG processing on the SIP packet, and converts the private network address and port of the SDP part of the SIP packet into a public network address and port according to the mapping relationship stored in the memory.

The processor of the NAT device allocates an idle public network address and port to the private network address and port of the private network client in the SDP part of the SIP packet sent by the proxy server, and saves the mapping relationship in the memory to make the subsequent media stream. The NAT and FW can be traversed according to the mapping relationship in the memory, thereby solving the technical problem that the proxy server and the private network client cannot traverse NAT and FW when they are on the same private network.

Example 5

As shown in FIG. 6, the calling system of the private network client and the out-of-network client provided by the embodiment of the present invention includes the NAT device and the proxy server in the foregoing Embodiment 4; and the proxy server is configured to receive the SIP of the private network client. After the packet is sent, the NAT device sends a SIP packet to the client outside the network.

The NAT device allocates a public network address and port to the private network address and port of the private network client in the SDP part of the SIP packet sent by the proxy server, and saves the private network address and port, and the public network address and port. Mapping relations. The SIP 4 message is a SIP message sent by the proxy server after receiving the SIP message of the private network client. The SIP message can be a call request message or a response message. The source IP address of the SIP "3⁄4" is the address of the proxy server, and the address and port in the SDP part are the private network address and port of the private network client.

Specifically, because the source IP address of the SIP 4 and the address in the SDP part are different, the NAT device cannot perform the SDP part of the SIP packet according to the normal ALG mode. NAT ALG. Therefore, the NAT device obtains the private network address and port of the private network client in the SDP part of the SIP packet, allocates an idle public network address and port to the private network client, and saves the private network address and port of the private network client, and The mapping between the public network address and port assigned to the private network client. When the media stream is transmitted between the private network client and the external network client, the NAT device also performs NAT processing on the media stream according to the mapping relationship.

Then, the NAT device performs NAT ALG processing on the SIP message, and according to the mapping relationship between the private network address and the port, and the public network address and the port, the private network address and port of the SDP part of the SIP message. Convert to public network address and port.

The NAT device allocates an idle public network address and port to the private network address and port of the private network client in the SDP part of the SIP packet sent by the proxy server, and saves the mapping relationship so that the subsequent media stream can traverse the NAT according to the mapping relationship. And FW, which solves the technical problem that the proxy server and the private network client cannot traverse NAT and FW when they are on the same private network.

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any change or replacement that can be easily conceived by those skilled in the art within the technical scope of the present invention is All should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Claim

A network address translation method for a private network client and an out-of-network client call, characterized in that:

The SIP packet is processed by the network address translation application layer gateway, and according to the mapping relationship, the private network address and port of the SDP part of the SIP packet are converted into a public network address and a port.

The processing method according to claim 1, further comprising: when receiving the media stream between the private network client and the external network client, according to the mapping relationship The media stream is NAT processed.

The processing method according to claim 1 or 2, wherein the SIP message is a call request message or a response message.

A network address translation device for calling between a private network client and an external network client, comprising: a processor and a memory;

The processor is configured to: assign a public network address and a port to the private network address and port of the private network client in the SDP part of the SIP packet sent by the proxy server, and instruct the memory to save the private network address and port, And the mapping between the public network address and the port, where the SIP packet is a SIP packet sent to the client outside the network;

And performing the network address translation application layer gateway processing on the SIP packet, and converting the private network address and port of the SDP part of the SIP packet into a public network address and a port according to the mapping relationship;

The memory is configured to save the mapping relationship.

The network address translation device according to claim 4, wherein: the processor is further configured to: when receiving the media stream between the private network client and the external network client, according to The mapping relationship saved by the memory performs NAT processing on the media stream.

6. A call system between a private network client and an off-net client, comprising: the network address translation device and the proxy server according to claim 4 or 5;

The proxy server is configured to send a SIP packet to the client outside the network after receiving the SIP packet of the private network client through the network address translation device.