WO2016201966A1

WO2016201966A1 - Nat traversal method, apparatus and system

Info

Publication number: WO2016201966A1
Application number: PCT/CN2016/070436
Authority: WO
Inventors: 叶位彬
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-06-18
Filing date: 2016-01-07
Publication date: 2016-12-22
Also published as: CN106331187A

Abstract

Provided are an NAT traversal method, apparatus and system. The method comprises: a local area network device starts a session via a source port PORT_LAN; a gateway generates an NAT address conversion table of the local area network device; and a public network device establishes communication with the local area network device according to the NAT address conversion table. Through the implementation of the present invention, the gateway generates the NAT address conversion table and provides same for use by the public network device, so that the public network device can establish communication with the local area network device according to the NAT address conversion table. In comparison with the related art, a relay server is removed, thereby simplifying the network structure and reducing the operating cost, so that the present invention particularly applies to cost-sensitive smart home applications.

Description

NAT penetration method, device and system

Technical field

The present invention relates to the field of Internet of Things (IoT) communication, and in particular, to a NAT (Network Address Translation) network penetration method, device and system.

Background technique

The Internet of Things refers to the interconnection of ubiquitous end equipment and facilities, including mobile terminals, industrial systems, building control systems, home intelligence facilities, video surveillance systems, etc., through various wireless or wired long-distance or short-distance communication networks. Interoperability and cloud computing-based operations, in the internal network, private network and Internet environment, use appropriate information security mechanisms to provide secure and controllable real-time online monitoring, location and traceability, alarm linkage, dispatching command, remote control, Management and service functions such as security and prevention, real-time control of “everything”. The Internet of Things often involves the interconnection and intercommunication between the local area network and the public network. For example, smart home, the home network is a local area network, using a local area network address. When the smart device of the home network needs to access the Internet, it must first pass through the home gateway (usually a home router). Convert the LAN address to a public network address to communicate with the outside world. The technology used to translate a LAN address into a public network address is called Network Address Translation (NAT). Using NAT technology, LAN devices can access the Internet, but it also brings a problem. If the devices in the external network want to access devices in the LAN, they must use certain penetration techniques. Because the devices in the external network cannot communicate directly with the devices on the LAN, the devices in the external network use the public network address, each address is globally unique, and the LAN device uses the LAN address, which is valid only in the LAN, and there are global Numerous LAN devices are using the same LAN address.

In order to solve the above problem, the related technology sets up a relay server in the Internet, the domain name or IP of the relay server is fixed, and the device in the local area network is first connected to the relay server, so that the relay server grasps the address and port of the local area network device. information. When an external network device needs to connect to a LAN device, it is not a direct LAN device. Instead, it connects to the relay server first, obtains the address and port information of the LAN device from the relay server, and then uses the information to connect to the LAN device.

The above solution is a widely used NAT penetration method. For example, the currently popular instant messaging software needs to log in to the server of the service provider before establishing communication with the friend. If the server stops running, the connection cannot be established with the friend. At present, this penetration method is very good for large-scale application scenarios or for cost-insensitive scenarios. But for a small Internet of Things like smart home, the cost is too high. For example, the current webcam needs to rely on the manufacturer's server to work on the Internet. If the manufacturer shuts down the server, these cameras will lose their connection.

Therefore, how to provide a NAT penetration method that does not require a third-party server is a technical problem to be solved by those skilled in the art.

Summary of the invention

The embodiment of the invention provides a NAT penetration method, device and system, so as to at least solve the problem that the current NAT penetration technology requires a third-party server.

The embodiment of the present invention provides a NAT penetration method. The method includes: the local area network device starts a session through the source port PORT_LAN; the gateway generates a NAT address translation table of the local area network device; and the public network device establishes communication with the local area network device according to the NAT address translation table.

Optionally, the method further includes: after the public network device passes the security authentication, obtaining a NAT address translation table from the gateway.

Optionally, the NAT address translation table of the gateway generating the local area network device includes: the gateway converts the local area network IP address of the local area network device into a public network IP address, and maps the source port PORT_LAN to the public network port PORT_NAT to generate a NAT address translation table.

Optionally, the public network device establishes communication with the local area network device according to the NAT address translation table, including: the public network device queries the local area network device that uses the source port PORT_LAN from the NAT address translation table, and searches for the public network port PORT_NAT corresponding to the source port PORT_LAN, and passes the public network. The port PORT_NAT establishes communication with the LAN device.

Optionally, when the local area network device is multiple, the public network device establishes communication with the local area network device according to the NAT address translation table. The public network device queries all the local area network devices that use the source port PORT_LAN from the NAT address translation table, and searches for the source port PORT_LAN. The corresponding public network port PORT_NAT establishes a session with the local area network device through the public network port PORT_NAT, obtains the identity of the local area network device, obtains the public network port PORT_NAT of the target local area network device, and establishes with the target local area network device through the public network port PORT_NAT of the target local area network device. communication.

An embodiment of the present invention provides a NAT penetration device, including: an access module, located in a local area network device, configured to open a session through a source port PORT_LAN; and a NAT recording module located at the gateway, configured to generate a NAT address translation of the local area network device The access module, located in the public network device, is configured to establish communication with the accessed module according to the NAT address translation table.

Optionally, the access module is further configured to obtain a NAT address translation table from the NAT recording module after passing the security authentication.

Optionally, the NAT recording module is configured to convert the local area network IP address of the local area network device into a public network IP address, and map the source port PORT_LAN to the public network port PORT_NAT to generate a NAT address translation table.

Optionally, the access module is configured to query the local area network device that uses the source port PORT_LAN from the NAT address translation table, search for the public network port PORT_NAT corresponding to the source port PORT_LAN, and establish communication with the accessed module in the local area network device through the public network port PORT_NAT. .

Optionally, when there are multiple LAN devices, the access module is further configured to query all LAN devices that use the source port PORT_LAN from the NAT address translation table, and search for the public network port PORT_NAT corresponding to the source port PORT_LAN, respectively, through the public network port PORT_NAT Establish a session with the LAN device, obtain the identity of the LAN device, obtain the public network port PORT_NAT of the target LAN device, and establish communication with the accessed module in the target LAN device through the public network port PORT_NAT of the target LAN device.

Correspondingly, the embodiment of the present invention provides a NAT penetration system, which includes a LAN device, a gateway, and a public network device. And the NAT penetrating device provided by the embodiment of the present invention.

Advantageous effects of embodiments of the present invention:

The embodiment of the invention provides a new method for NAT penetration. The gateway generates a NAT address translation table and provides it to the public network device, so that the public network device can establish communication with the local area network device according to the NAT address translation table, and related technologies. Compared to the elimination of the relay server, simplifying the network structure and reducing operating costs, it is especially suitable for cost-sensitive smart home applications.

DRAWINGS

1 is a schematic structural diagram of a NAT penetrating device according to a first embodiment of the present invention;

2 is a flowchart of a NAT penetration method according to a second embodiment of the present invention;

3 is a schematic diagram of a smart home application scenario in a third embodiment of the present invention;

FIG. 4 is a flowchart of a NAT penetration method according to a third embodiment of the present invention.

detailed description

The invention will now be further illustrated by way of specific embodiments in conjunction with the accompanying drawings.

First embodiment:

FIG. 1 is a schematic structural diagram of a NAT penetrating apparatus according to a first embodiment of the present invention. As shown in FIG. 1 , in the embodiment, the NAT penetrating apparatus 1 provided by the embodiment of the present invention includes:

The access module 11, located in the local area network device, is configured to open a session through the source port PORT_LAN;

The NAT recording module 12 is located at the gateway and configured to generate a NAT address translation table of the local area network device.

The access module 13 is located on the public network device and is configured to establish communication with the accessed module according to the NAT address translation table.

In some embodiments, the access module 13 in the above embodiment is further configured to acquire a NAT address translation table from the NAT recording module 12 after passing the security authentication.

In some embodiments, the NAT recording module 12 in the above embodiment is configured to convert the local area network IP address of the local area network device into a public network IP address, and map the source port PORT_LAN to the public network port PORT_NAT to generate a NAT address translation table.

In some embodiments, the access module 13 in the above embodiment is configured to query the local area network device using the source port PORT_LAN from the NAT address translation table, and search for the public network port PORT_NAT corresponding to the source port PORT_LAN, and the public network port PORT_NAT and the local area network device. The access module within the establishment establishes communication.

In some embodiments, when there are multiple local area network devices, the access module 13 in the above embodiment is also set to be a slave NAT. The address translation table queries all LAN devices that use the source port PORT_LAN, and searches for the public network port PORT_NAT corresponding to the source port PORT_LAN. The public network port PORT_NAT establishes a session with the LAN device to obtain the identity of the LAN device and obtain the public network of the target LAN device. The port PORT_NAT establishes communication with the accessed module in the target LAN device through the public network port PORT_NAT of the target LAN device.

Correspondingly, the embodiment of the present invention provides a NAT penetration system, which includes a LAN device, a gateway, a public network device, and a NAT penetration device provided by the present invention.

Second embodiment:

FIG. 2 is a flowchart of a NAT penetration method according to a second embodiment of the present invention. As shown in FIG. 2, in the embodiment, the NAT penetration method provided by the embodiment of the present invention includes the following steps:

S201: The local area network device starts the session by using the source port PORT_LAN.

S202: The gateway generates a NAT address translation table of the local area network device.

S203: The public network device establishes communication with the local area network device according to the NAT address translation table.

In some embodiments, the foregoing embodiment further includes: after the public network device passes the security authentication, obtaining a NAT address translation table from the gateway.

In some embodiments, the gateway in the foregoing embodiment generates a NAT address translation table of the local area network device, including: the gateway converts the local area network IP address of the local area network device into a public network IP address, and maps the source port PORT_LAN to the public network port PORT_NAT to generate a NAT. Address translation table.

In some embodiments, the public network device in the foregoing embodiment establishes communication with the local area network device according to the NAT address translation table, including: the public network device queries the local area network device that uses the source port PORT_LAN from the NAT address translation table, and searches for the public port corresponding to the source port PORT_LAN. The network port PORT_NAT establishes communication with the LAN device through the public network port PORT_NAT.

In some embodiments, when the local area network device is multiple, the public network device establishes communication with the local area network device according to the NAT address translation table, and the public network device queries all the local area network devices that use the source port PORT_LAN from the NAT address translation table. Find the public port PORT_NAT corresponding to the source port PORT_LAN, establish a session with the LAN device through the public network port PORT_NAT, obtain the identity of the LAN device, obtain the public network port PORT_NAT of the target LAN device, and pass the public network port PORT_NAT of the target LAN device. Establish communication with the target LAN device.

The embodiments of the present invention will be further explained in conjunction with specific application examples.

Third embodiment:

Table 1

As shown in FIG. 3, it is assumed that a smart home application scenario includes three smart cameras, one home gateway, and one mobile phone terminal. The three smart cameras all contain the access modules, each opening a session with a source port of 333, waiting for the connection. The home gateway includes a NAT record module. After receiving the session messages of the three smart cameras, the NAT record module performs address translation and stores them in the NAT address translation table, as shown in Table 1 above. The mobile terminal is equipped with an access module, which can be a mobile APP (application). After the mobile phone is connected to the Internet, you want to view the live image of the first camera.

FIG. 4 is a flowchart of a NAT penetration method according to a third embodiment of the present invention. As shown in FIG. 4, in the embodiment, the NAT penetration method provided by the present invention includes the following steps:

S401: The local area network device starts a session and waits for a connection. The accessed module located in the first local area network device opens a session whose source port is a specific port PORT_LAN, waiting for a connection.

PORT_LAN is not unique. Sessions with the same function of different devices have the same PORT_LAN. For example, the FTP protocol port of all devices is 21.

S402: The gateway generates a NAT address translation table. The NAT record module located at the gateway converts the LAN IP address of the access module into a public network IP address, and maps the source port PORT_LAN of the access module to a public network port PORT_NAT, and saves the mapping relationship in NAT address translation. In the table.

PORT_NAT is unique. Different sessions have different PORT_NAT. PORT_NAT is set to identify a session of a LAN device. All LAN devices use the same public IP address, but PORT_NAT is different, so each message is sent. It’s separated.

S403: The public network device obtains a NAT address translation table. The access module of the public network device connects to the NAT record module by means of security authentication, and obtains its NAT address translation table from the NAT record module.

S404: The public network device obtains the public network port mapped by the local area network device. From the NAT address translation table, the access module finds all LAN devices whose source ports are PORT_LAN, and obtains the public network ports mapped by these devices.

S405: The public network device establishes communication with the local area network device. The access module uses the obtained public network ports to establish a session with the devices, and obtains the identity IDs of the devices, so as to find that the public network port of the first local area network device is PORT_NAT, so that the public network device can use PORT_NAT and the first The LAN device establishes communication.

Combined with the application scenario shown in Figure 3, first, the mobile phone connects to the home gateway through the public network IP address 101.23.65.145, and passes the security authentication using the preset username and password. Next, the home gateway sends the NAT address translation table shown in Table 1 to the mobile phone. The mobile phone searches for a session with a source port of 333, and finds that there are three, and that the converted ports are 1000, 1001, and 1002, respectively, but it is not known which is the first camera. Then, the mobile phone uses the public network source ports 1000, 1001, and 1002 to establish three sessions, respectively communicates with the three cameras to obtain the identity ID, so that the public network source port 1000 corresponds to the first camera. Therefore, the mobile phone uses the public network source port 1000 to request real-time image from the first camera hair, and the first camera sends image data to the mobile phone, so that the mobile phone successfully obtains the real-time image of the first camera.

In summary, through the implementation of the present invention, at least the following beneficial effects exist:

The forwarding device uses the identifier of the packet home service to find the identifier of the corresponding independent network port, and uses the found independent network port to forward the packet, and the service is mapped to the network port to ensure the integrity of the service packet when forwarding. The multiple independent network ports in the forwarding device can complete the service independently, and the network ports do not affect the data forwarding between each other. At the same time, before the service packet enters the protocol stack routing analysis process, the application first queries the network port according to the mapping table. After returning directly, the package is sent through the corresponding network port, and the process is simple.

The above is only a specific embodiment of the present invention, and is not intended to limit the present invention in any way. Any simple modification, equivalent change, combination or modification of the above embodiments in accordance with the technical spirit of the present invention is still in the present invention. The scope of protection of the technical solution of the invention.

Industrial applicability

As described above, the NAT penetration method, device, and system provided by the embodiments of the present invention have the following beneficial effects: The embodiment of the present invention provides a new NAT penetration method, and the gateway generates a NAT address translation table and provides It is used by public network devices, so that public network devices can establish communication with LAN devices according to the NAT address translation table. Compared with related technologies, the relay server is removed, the network structure is simplified, and the operation cost is reduced, which is particularly suitable for cost-sensitive. Smart home applications.

Claims

A network address translation NAT penetration method includes:

The LAN device opens the session through the source port PORT_LAN;

The gateway generates a NAT address translation table of the local area network device;

The public network device establishes communication with the local area network device according to the NAT address translation table.
The NAT penetration method of claim 1, further comprising: obtaining the NAT address translation table from the gateway after the public network device passes the security authentication.
The NAT penetration method according to claim 1 or 2, wherein the generating the NAT address translation table of the local area network device by the gateway comprises: converting, by the gateway, a local area network IP address of the local area network device into a public network IP address, The source port PORT_LAN is mapped to the public network port PORT_NAT, and the NAT address translation table is generated.
The NAT penetration method of claim 3, wherein the establishing, by the public network device, the communication with the local area network device according to the NAT address translation table comprises: the public network device querying a usage source from the NAT address translation table The local area network device of the port PORT_LAN searches for the public network port PORT_NAT corresponding to the source port PORT_LAN, and establishes communication with the local area network device through the public network port PORT_NAT.
The NAT penetration method of claim 4, wherein when the plurality of local area network devices are multiple, the public network device establishes communication with the local area network device according to the NAT address translation table, further comprising: the public network The device queries all the LAN devices that use the source port PORT_LAN from the NAT address translation table, and searches for the public network port PORT_NAT corresponding to the source port PORT_LAN, and establishes a session with the local area network device through the public network port PORT_NAT to obtain the identity of the local area network device. Obtain the public network port PORT_NAT of the target LAN device, and establish communication with the target LAN device through the public network port PORT_NAT of the target LAN device.
A network address translation NAT penetration device includes:

The access module, located in the local area network device, is set to open the session through the source port PORT_LAN;

a NAT recording module, located at the gateway, configured to generate a NAT address translation table of the local area network device;

The access module, located in the public network device, is configured to establish communication with the accessed module according to the NAT address translation table.
The NAT penetration device of claim 6, wherein the access module is further configured to acquire the NAT address translation table from the NAT recording module after passing the security authentication.
The NAT penetrating device according to claim 6 or 7, wherein the NAT recording module is configured to convert a local area network IP address of the local area network device into a public network IP address, and map the source port PORT_LAN to a public The network port PORT_NAT generates the NAT address translation table.
The NAT penetrating device according to claim 8, wherein the access module is configured to query a local area network device using the source port PORT_LAN from the NAT address translation table to find a public network port corresponding to the source port PORT_LAN PORT_NAT establishes communication with the accessed module in the local area network device through the public network port PORT_NAT.
The NAT penetrating device according to claim 9, wherein when the plurality of local area network devices are plural, the access module is further configured to query all the local area network devices using the source port PORT_LAN from the NAT address translation table to search The public port PORT_NAT corresponding to the source port PORT_LAN establishes a session with the local area network device through the public port PORT_NAT, obtains the identity of the local area network device, acquires the public network port PORT_NAT of the target local area network device, and passes the public network of the target local area network device. The port PORT_NAT establishes communication with the accessed module in the target local area network device.
A network address translation NAT penetration system, comprising a local area network device, a gateway, a public network device, and the NAT penetration device according to any one of claims 6 to 10.