WO2017054429A1

WO2017054429A1 - Sopc-based nat implementation method and device

Info

Publication number: WO2017054429A1
Application number: PCT/CN2016/078029
Authority: WO
Inventors: 刘兆先
Original assignee: 北京特立信电子技术股份有限公司
Priority date: 2015-09-30
Filing date: 2016-03-31
Publication date: 2017-04-06
Also published as: CN105162901B; CN105162901A

Abstract

Disclosed are an SOPC-based NAT implementation method and device. The steps comprise: a learning/processing module judging whether it can process the information itself; if so, the learning/processing module performs processing according to contents learned previously, and then submits a processing result to an NAT processing module, otherwise, received information is submitted to a processor for processing. The device comprises a processor module, a learning/processing module, an Ethernet interface module, an extracting module, a data buffer module, an NAT processing module, and an NAT reverse processing module. The present invention implements NAT processing based on an SOPC, makes full use of the advantages of a processor and logic processing to rationally assign respective implementation functions of the processor and the logic processing, and uses a learning/processing module to make up for shortcomings of processing capability of a processor module. Moreover, the present invention also has the advantages of flexible NAT processing, fast processing, low costs and low power consumption, and has good economic and social benefits. The present invention can be widely applied to various NAT processing systems.

Description

Method and device for implementing NAT based on SOPC

Technical field

The present invention relates to the field of computer networks, and in particular, to a network address translation method.

Background technique

NAT: Network Address Translation, network address translation.

SOPC: System-on-Programmable-Chip, you can program the system on chip.

ICMP: Internet Control Message Protocol, Internet Control Message Protocol. It is a sub-protocol of the TCP/IP protocol suite for passing control messages between IP hosts and routers.

CAM: Content Addressable Memory, content addressable memory.

At present, there are three main methods for implementing NAT. The first one is pure software implementation, the carrier is usually a general-purpose CPU, the second is based on FPGA hardware, and the third is based on network processor (NP).

The method implemented by pure software is flexible in processing and mature in technology, but the disadvantages are also obvious. The processing speed is slow, the delay is large, and a large amount of CPU time is required, and the memory consumption is large.

The method implemented by the FPGA has a fast processing speed and a small delay. If only simple logic is used, it is usually only possible to implement some NAT functions with relatively simple functions, and it is not as flexible as pure software, and consumes a lot of logic resources.

The method implemented by NP is fast, but expensive, and the application is not flexible enough.

In summary, the prior art has the following problems:

1. NAT implementation through simple logic has limitations on functional complexity;

2. For specific applications, the existing implementation methods through FPGA or NP are not flexible enough;

3. For small applications, the existing implementation is bulky, high in power consumption, and high in cost.

Summary of the invention

In order to solve the above technical problem, an object of the present invention is to provide an implementation method of a NAT that can flexibly implement NAT processing, has a fast processing speed, low cost, and low power consumption.

In order to solve the above technical problem, another object of the present invention is to provide an apparatus for implementing NAT that can flexibly implement NAT processing, has high processing speed, low cost, and low power consumption.

The technical solution adopted by the invention is:

A method for implementing NAT based on SOPC, comprising the steps of: S1, extracting information from a data packet; S2, storing the data packet in a buffer, and submitting the extracted information to a learning/processing module; S3, learning/processing The module determines whether it can process the information, if it can be processed, proceeds to step S4, otherwise submits the received information to the processor and proceeds to step S5; S4, the learning/processing module processes according to the previously learned content, and then processes The result is submitted to the NAT processing module; S5, the processor processes the received information, and returns the processing result to the learning/processing module; S6, the learning/processing module learns the result of the processor, and submits the processing result to the NAT processing module. S7, the NAT processing module and the NAT inverse processing module process the data packets in the buffer according to the received processing result.

Preferably, the information in step S1 includes a source MAC address, an Ethernet protocol type, an IP protocol type, an Ethernet source IP, an Ethernet destination IP, an ICMP identifier, an ICMP sequence number, a source port number, a destination port, and an IP packet. 16-bit identifier, 3-bit flag and 13-bit slice offset for IP packets, IP header checksum, and ICMP/TCP/UDP checksum.

Preferably, the information submitted to the learning/processing module in step S2 includes source IP, destination IP, source port number (TCP, UDP), destination port (TCP, UDP), 16-bit identifier of the IP packet, and IP packet. 3-bit flag and 13-bit slice offset and protocol type.

Preferably, the step S3 specifically includes the sub-step: S31, first determining whether the data packet is an IP fragment packet by using a 3-bit flag of the data packet and a 13-bit slice offset, and if the fragment packet is a fragment packet, the information cannot be processed. Otherwise, the process proceeds to step S32; S32, the CAM query is performed by using the source IP, the source port, the destination IP, the destination port, and the protocol type in the information. If there is a valid item, the learning/processing module can process the information and proceeds to step S4. Otherwise, it means that this information cannot be processed and proceeds to step S33; S33, the received information is submitted to the processor and proceeds to step S5.

Preferably, the step S4 is specifically: obtaining an address of the matching unit from the output of the CAM, reading the content of the address unit from the storage module, returning the result to the NAT processing module as a processing result, and clearing the corresponding aging counter at the same time. .

Preferably, the information in step S5 is private network data or public network data, and the step S5 specifically includes the sub-steps: S51, processing the private network data, and returning the processing result to the learning/processing module; or S52 , processing the public network data, and returning the processing result to the learning/processing module.

Preferably, the step S51 includes the sub-step: S511, using the source port number as an index of the private network port lookup table, and taking the corresponding entry of the sequence number from the memory, determining whether the valid identifier of the entry is valid, if valid. Go to step S512, otherwise go to step S519; S512, determine whether the pointer flag is valid, if yes, go to step S517, otherwise go to step S513; S513, determine whether the protocol field, the source IP field match, if it matches Go to step S514, otherwise go to step S519; S514, replace the source port with the content of the replacement port, and determine whether the valid identifier of the external network gateway is valid, if yes, go to step S516, otherwise go to step S515; The data packet can be directly delivered or adopts the default gateway, and the process goes to step S518; in S516, the data packet needs to be forwarded by the external network gateway, and the process goes to step S518; S517, the IP lookup table is found through the IP pointer, and the valid identification bit is valid. The entry, if there is a protocol field, a source IP field match, then go to step S514, otherwise go to step S519; S518, the table is successful, go to the step S5111; S519, if the dynamic mode is set, randomly allocate an unused public network IP and port, and add the corresponding information to the NAT configuration table, and go to step S5111; S5110, the table check fails, the data packet is discarded, and the packet is discarded. Go to step S5111; S5111, return the processing result to the learning/processing module, go to step S511, and start the next lookup table; the step S52 specifically includes the sub-step: S521, using the destination port number as the index of the public network port lookup table And taking the corresponding entry of the serial number from the memory, determining whether the valid identifier of the entry is valid, if not, proceeding to step S5210, if yes, proceeding to step S522; S522, determining whether the pointer identifier is valid, if invalid Go to step S523, if yes, go to step S525; S523, determine whether the protocol field and the external network IP field match, if yes, go to step S524, otherwise go to step S5210; S524, replace the content of the port, the intranet The content of the IP is replaced by the destination port and the destination IP, and the process goes to step S529; S525, The IP lookup table is found through the IP pointer, and the valid valid identifier is used. If there is a protocol field, the external network IP field matches, and when the remote IP valid identifier is valid, the remote IP and the remote port also match the matching item. Go to step S526, if not, go to step S5210; S526, determine whether the intranet IP valid identification is valid, if yes, go to step S527, otherwise go to step S528; S527, use the replacement port in the IP lookup table, The network IP replaces the destination port and the destination IP, and the process goes to step S529; in S528, the destination port and the destination IP address are replaced by the internal port IP in the replacement port and the port lookup table in the IP lookup table, and the process goes to step S529; If the lookup table is successful, the process goes to step S5211; if the table check fails, the process goes to step S5211; S5211, the process result is returned to the learning/processing module, and the process goes to step S521 to start the next lookup table.

Preferably, the step S5 further includes the sub-step: S50, performing IP fragmentation packet processing on the received information; the step S50 specifically includes the sub-step: S501, determining whether it is an IP fragmentation packet, if it is a fragmentation packet Go to step S502; S502, determine whether it is the first packet of the IP fragmentation packet, if yes, go to step S503, otherwise go to step S504; S503, process the first packet in a non-fragmented packet processing manner, and The other fragments of the fragment packet in the buffer are also processed in this manner, and the flow proceeds to step S505; in S504, the fragmentation packet information is buffered, and the flow proceeds to step S505; S505, the processing proceeds to step S501, and the next processing is started.

Preferably, the step S7 specifically includes the sub-step: S71, according to the output of the learning/processing module, combining the output of the extraction module and the data packet content in the data buffer module to implement the private network to the public network TCP and UDP data packets. The source IP address and the source port are replaced, that is, the NAT processing is completed; S72, according to the output of the learning/processing module, combined with the output of the extraction module and the data packet content in the data buffer module, the public network to the private network TCP and UDP data packets are realized. The destination IP address and the destination port are replaced, that is, the NAT inverse processing is completed; and S73, the IP header checksum, the TCP checksum, and the UDP checksum are recalculated.

An apparatus for implementing NAT based on SOPC, which is used for implementing an implementation method of SOPC-based NAT, which comprises: a processor module, It is used to perform table lookup processing on the data packet outputted by the learning/processing module, and returns the processing result to the learning/processing module; the learning/processing module is respectively connected to the extraction module and the processor module, and has two main functions: First, the output of the extraction module is received, and whether there is a matching item in the learning content, if there is a matching item, the stored corresponding result is output to the NAT processing module, and if there is no matching item, the received data is directly submitted to the processor module, and Recording the data so as to establish a one-to-one correspondence with the processing result in the learning process; second, learning the data packet processing result output by the processor, that is, establishing a one-to-one correspondence between the data packet information input and the data packet processing result, so as to The data packets with the same input conditions in the subsequent data packets are directly processed to reduce the load of the processor module, improve the processing capability of the data packet, and then output the result to the NAT processing module; the extraction module is connected to the Ethernet interface module. Used to extract packet information; Ethernet interface, including private network ether for connecting to the private network An interface and an Ethernet interface for connecting to the public network; a data buffering module connected between the extraction module and the NAT processing module or the NAT inverse processing module for buffering the data packet; and the NAT processing module, respectively, and the extraction module and the data The buffer module, the learning/processing module and the Ethernet interface connection are used for receiving the output of the learning/processing module, and combining the output of the extraction module and the data packet content in the data buffer module to implement NAT processing from the private network to the public network; The NAT inverse processing module is respectively connected to the extraction module, the data buffer module, the learning/processing module and the Ethernet interface, and is configured to receive the output of the learning/processing module, and combine the output of the extraction module and the data packet in the data buffer module. Content, implementing NAT reverse processing from the public network to the private network.

The beneficial effects of the invention are:

The invention realizes NAT processing based on SOPC, fully utilizes the respective advantages of the processor and the logic processing, reasonably allocates respective implementation functions, and adopts a learning/processing module to compensate for the insufficiency of the processing capability of the processor module, and adopts an advanced data structure. (NAT processing table) and reasonable NAT processing flow to maximize the versatility and processing performance; also has the advantages of flexible NAT processing, fast processing speed, low cost, low power consumption, and good economic and social benefits.

The invention is widely applicable to various NAT processing systems.

DRAWINGS

The specific embodiments of the present invention are further described below in conjunction with the accompanying drawings:

1 is a flowchart of a method for implementing an SOPC-based NAT method according to an embodiment of the present invention;

2 is a structural and logical relationship diagram of an embodiment of a private network NAT processing table of the present invention;

3 is a structural and logical relationship diagram of an embodiment of a public network NAT processing table of the present invention;

4 is a block diagram showing the system structure of an embodiment of an SOPC-based NAT implementation apparatus according to the present invention.

detailed description

It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

In this embodiment, a device for implementing NAT based on SOPC uses FPGA as a carrier, and a block diagram of a design scheme is shown in FIG. 4 . The solution consists of two parts, one is that the external memory is mainly used to store and query the network address translation table and the external memory as the processor, and the other part mainly implements the NAT function, mainly including the processor module, the learning/processing module, Ethernet interface module, extraction module, data buffer module, NAT processing module, NAT inverse processing module, these functional modules are all implemented by FPGA.

This solution supports NAT processing of TCP, UDP, and ICMP protocols. The logic implementation of the storage, management, and lookup of the NAT translation table is cumbersome and resource-intensive, especially when the NAT configuration is complicated and the entries are large, so this part of the function is embedded in the FPGA core. To achieve. It includes:

Processor module

The processor module is connected to the learning/processing module and the external storage. The main functions are as follows: 1. In the static NAT mode, the data of the configured delivery channel is received, and the NAT processing table is established according to the configuration data. Second, in the dynamic NAT mode. Dynamically assigning the public network IP and port number according to the private network packet information output by the learning/processing module, and using the information to establish a NAT processing table; 3. performing a table lookup processing on the data packet information output by the learning/processing module, and The processing result is returned to the learning/processing module.

The processor module in this example uses the soft core CPU microblaze provided by xilinx. And the corresponding peripherals. The CPU uses two microblaze cores, one for NAT update table maintenance and maintenance and system management, and the other for NAT processing.

2. Learning / Processing Module

The learning/processing module is connected to the extraction module and the processor module, and has two main functions: first, receiving the output of the extraction module, checking whether there is a matching item in the learning content, and if there is a matching item, outputting the stored corresponding result to the NAT processing. The module, if there is no match, submits the received data directly to the processor module, and records the data to establish a one-to-one correspondence with the processing result in the learning process. Second, the processing result of the data packet output by the learning processor is to establish a one-to-one correspondence between the data packet information input and the data packet processing result, so as to directly process the data packet having the same input condition in the subsequent data packet to reduce the processing. Load, improve the processing power of the packet, and then output the result to the NAT processing module.

In this embodiment, the learning/processing module mainly includes a CAM module, a storage module, a management module, a counter group, and the like.

The CAM module has two implementation methods, based on the lookup table implementation and based on the BLOCKRAM implementation, which needs to be weighed according to the usage of the logical resources. The function of the CAM module is to achieve a quick match of the data and to determine whether there is a match in the learning content. The number of entries in the CAM module can be set. It can be set according to the requirements of the specific application environment. The number of entries used in this example is 32. Increasing the number of entries can greatly improve learning/processing capabilities, but the logic resources consumed grow exponentially.

There are also two implementations of storage modules, based on lookup table implementations and BLOCKRAM-based implementations, which need to be weighed against the use of logical resources. The function of the storage module is to store the learned processing result, and the number of storage units is the same as the number of entries of the CAM module, and the address relationship is in one-to-one correspondence. The number of storage units in this example is 32.

The management module mainly implements the control function of writing and querying the CAM module, the read/write control function of the storage module, the counting start and clear control functions of the counter group, and the learning control function and the processing control function.

The learning control function is as follows: First, an identification group is established according to the number of entries, each identification group unit uniquely indicates an entry, and the initial identification group unit is all invalid. When a valid result of the processor output is detected, the identification group is first Find an invalid unit, if there is no invalid unit, find the identification group unit corresponding to the counter with the largest count value in the counter group, and set the effective position of the identification group unit, and reduce the input of the result to the CAM. Corresponding to the unit, the result is stored in the corresponding unit of the storage module, and the corresponding counter in the counter group is cleared, and the counter is started. When the counter value in the counter group exceeds the threshold, the corresponding flag group unit valid bit is reset, and the counter is turned off and the count value is cleared.

The processing control function is as follows: the output of the extraction module is reduced and then the CAM query is performed. If there is a matching unit and the identification group unit corresponding to the unit is in a valid position bit, the counter of the corresponding position in the counter group is cleared, and the storage module is correspondingly The content of the location is output to the NAT processing module as a result of the processing, otherwise the output of the extraction module is submitted to the processor module, and the data is temporarily stored.

The counter group implements the aging time count of the CAM unit, and is the same as the number of entries of the CAM module and corresponds to the entries of the CAM module. The number of counter groups in this example is 32.

3. Ethernet interface

It includes a private network Ethernet interface for connecting to the private network and an Ethernet interface for connecting to the public network. The Ethernet interface module implements the Ethernet PHY and MAC functions according to actual needs.

4. Extraction module

The extraction module is connected to the Ethernet interface module, and mainly completes the extraction of the data packet information. The extracted control flow signals include source MAC address, Ethernet protocol type, IP protocol type, Ethernet source IP, Ethernet destination IP, ICMP identifier (ICMP), ICMP sequence number (ICMP), source port number (TCP, UDP). ), destination port (TCP, UDP), 16-bit identification of the IP packet, 3-bit flag of the IP packet, and 13-bit slice offset, IP header checksum , ICMP/TCP/UDP checksum, etc. Source IP, destination IP, source port number (TCP, UDP), destination port (TCP, UDP), 16-bit identifier of the IP packet, 3-bit flag of the IP packet, and 13-bit slice offset and protocol type output to the learning/ Processing module; the rest is directly output to the NAT processing module or the NAT inverse processing module.

5. Data buffer module

The data buffer module is implemented based on BLOCKRAM, which is used to implement buffering of data packets, and can also eliminate the accumulation of data packets due to delay jitter of the NAT processing process.

6.NAT processing module

The NAT module is connected to the extraction module, the data buffer module, and the learning/processing module. It has two main functions: 1. Receive the output of the extraction module, and combine the contents of the data packet in the data buffer module to implement private network NAT. IP ARP function and ICMP function and ICMP NAT function (ICMP is (Internet Control Message) Protocol) Internet Control Message Protocol. It is a sub-protocol of the TCP/IP protocol suite for passing control messages between IP hosts and routers. Second, receive the output of the learning/processing module, and combine the output of the extraction module with the contents of the data packet in the data buffer module to realize the source IP and source port replacement of the private network to the public network TCP and UDP data packets, and realize the private network. NAT processing to the public network, and recalculate the IP header checksum, TCP checksum, and UDP checksum.

7. NAT inverse processing module

The NAT inverse processing module implements NAT processing from the public network data to the private network, and has the same functions as the NAT processing module except for the following two points: 1. The NAT function without ICMP; 2. The public network to the private network TCP and UDP data packet replacement The destination IP and destination port.

In this embodiment, the Gigabit Ethernet data packet from the private network enters the FPGA through the SGMII interface in the FPGA, and the Ethernet interface module receives and buffers the data packet; then the extraction module extracts the necessary information from the data packet. , such as source IP address, destination IP address, TCP, UDP port number, protocol type, etc.; then store the data packet into the data buffer module, and submit the extracted data packet information to the learning processing module; the learning/processing module checks that it can No, this information is processed. If the information cannot be processed, the received information is submitted to the processor. If it can be processed, it is processed according to the learned content, and the processing result is submitted to the NAT processing module; the processor receives the data packet. After the information, the processing is performed according to the preset rule, and the processing result is returned to the learning/processing module; the learning/processing module learns the processing result, and submits the processing result to the NAT processing module; after receiving the processing result, the NAT processing module receives the processing result The data buffer module reads out the data packet and performs NAT processing on the data according to the processing result, and then submits to the Ethernet interface. Block; Ethernet interface module sent the packet buffer public or private network. On the contrary, the data packets coming from the public network are also inversely processed by NAT through the corresponding process.

A SOPC-based NAT implementation method can be divided into a data flow step and a control flow step.

First, the control flow step

Including steps:

P1. The processor module receives configuration data from the configuration delivery channel.

When the configuration delivery channel receives the configuration data sent from the external external, an interrupt signal will be generated. After receiving the interrupt, the processor module will read the configuration data and compare it with the locally saved configuration data, and only change the updated content. Initially, the local configuration data is the initial default configuration.

P2, the processor module updates and maintains the NAT processing table (the NAT processing table is stored in the external memory).

In the following three cases, the NAT processing table needs to be updated and maintained. First, the configuration delivery channel receives the delivered data, and there is a change in the content related to the NAT processing table; second, there is a newly allocated IP, the port occurs; and the third, the timing refresh flag is set. The NAT processing table is divided into a private network NAT processing table and a public network NAT processing table. The private network NAT processing table structure and its logical relationship are shown in FIG. 2, and the structure and logical relationship of the public network NAT processing table are shown in FIG. 3.

As shown in FIG. 2, the private network NAT processing table and the public network NAT processing table all include a port lookup table and an IP lookup table. The number of port lookup table entries is fixed to 65,536, which is the full port range. The IP lookup table entry is also fixed. The number of entries depends on the complexity of the application requirements. Usually, it takes 8, 16, 32. If it is only a simple NAT processing of a single public IP address (for example, quintuple NAT), it can be omitted. IP lookup table . The IP lookup table is dynamically allocated and reclaimed during the update and maintenance of the NAT processing table. The private IP lookup table is sorted by source IP, and the public IP lookup table is placed in remote IP order to improve the search speed.

The private network port lookup table contains 10 items, namely, the valid identifier, the pointer identifier, the replacement port/IP pointer, the protocol, the source IP, the external network IP, the external network gateway valid identifier, the external network gateway, the aging counter enable, and the aging counter. The valid identifier bit is used to identify whether the entry is valid; the pointer identifier is used to identify whether the content of the replacement port/IP pointer field is a pointer of the IP lookup table or a public network source port; and the replacement port/IP pointer field is used to store the IP lookup table. The pointer or the public network source port; the protocol is used to indicate the protocol type corresponding to the entry, 0 means valid for all protocols, 1 means TCP protocol, 2 means UDP protocol, etc., and can be extended according to the implementation; source IP field is used for Indicates that the entry corresponds to the IP address of the private network host; the external network IP field is used to indicate the public network IP address of the private network host after NAT; the external network gateway valid identifier is used to identify whether the external network gateway field is valid; the external network gateway field Used to specify a specific gateway in a network. The aging counter enable bit is used to identify whether the aging counter is valid. The aging counter field is used to set the lifetime of the entry. After the time exceeds the threshold, this entry will be set to invalid.

The IP address lookup table of the private network contains nine items, namely, the valid identifier, the replacement port, the protocol, the source IP address, the external network IP address, the external network gateway valid identifier, the external network gateway, the aging counter enable, and the aging counter. The replacement port is the same as the entry of the private network port lookup table. The replacement port is used to store the public network source port. The private network IP lookup table needs to be allocated only when there is overlap in the private network source ports.

As shown in Figure 3, the public network port lookup table contains eight items, namely, the valid identifier, the pointer identifier, the replacement port/IP pointer, the protocol, the intranet IP, the external network IP, the aging counter enable, and the aging counter. Except for the replacement port/IP pointer and the intranet IP field, the definition is the same as the entry of the private network port lookup table. The replacement port/IP pointer field is used to store the pointer of the IP lookup table or the private network destination port corresponding to the data packet; the internal network IP field is used to store the IP address of the private network destination host corresponding to the data packet.

The public IP lookup table contains 11 items, namely, valid ID, replacement port, protocol, remote IP valid ID, remote IP, remote port, intranet IP, intranet IP valid ID, external network IP, aging counter enable, aging counter. . Except for the replacement port, remote IP valid ID, remote IP, remote port, intranet IP, and intranet IP valid ID fields, the definitions are the same as those of the private network port lookup table. The replacement port field is used to store the private network destination port corresponding to the data packet; the remote IP valid identification bit is used to identify whether the remote IP and the remote port field are valid; and the remote IP field is used to store the public network remote host source IP address corresponding to the data packet; The remote port field is used to store the public network remote host source port corresponding to the data packet; the internal network IP field is used to store the IP address of the private network destination host corresponding to the data packet; the internal network IP effective identification bit is used to identify whether the internal network IP field is valid. If invalid, it means that the intranet IP in the public network port lookup table is used.

Second, the data flow step

Including steps:

S1, extracting information from the data packet;

The extracted control flow signals include source MAC address, Ethernet protocol type, IP protocol type, Ethernet source IP, Ethernet destination IP, icmp identifier (ICMP), icmp serial number (ICMP), source port number (TCP, UDP). ), destination port (TCP, UDP), 16-bit identification of the IP packet, 3-bit flag of the IP packet, and 13-bit slice offset, IP header checksum , ICMP/TCP/UDP checksum, etc.

S2, storing the data packet in a buffer, and submitting the extracted information to the learning/processing module;

The packet information submitted to the learning/processing module includes source IP, destination IP, source port number (TCP, UDP), destination port (TCP, UDP), 16-bit identifier of the IP packet, 3-bit flag of the IP packet, and 13 bits. Slice offset and protocol type.

S3, the learning / processing module determines whether it can handle this information, if it can be processed, proceeds to step S4, otherwise submits the received information to the processor and proceeds to step S5;

The specific judgment process of the learning/processing module is as follows:

S4, the learning/processing module processes according to the previously learned content, and then submits the processing result to the NAT processing module;

The step S4 is specifically: obtaining the address of the matching unit from the output of the CAM, reading the content of the address unit from the storage module, returning to the NAT processing module as a processing result, and clearing the corresponding aging counter.

S5. The processor processes the received information, and returns the processing result to the learning/processing module.

After receiving the information output by the learning/processing module, the processor module first performs IP fragmentation packet processing (step S50, performing IP fragmentation packet processing on the received information), and the processing procedure is as follows:

S501, determining whether it is an IP fragmentation packet, if it is a fragmentation packet, proceeding to step S502.

S502, determining whether it is the first packet of the IP fragmentation packet, if yes, proceeding to step S503, otherwise proceeding to step S504;

S503, the first packet is processed in a non-fragmented packet processing manner, and the other fragments of the fragmented packet in the cache are also processed in this manner, and the process proceeds to step S505;

S504, the fragmentation packet information is cached, and the process proceeds to step S505;

S505, proceeding to step S501 to start the next processing.

Then, the processor module processes the received information according to whether the received information is private network data or public network data.

The processing of private network data is as follows:

S511, using the source port number as an index of the private network port lookup table, taking the corresponding entry of the serial number from the memory, determining whether the valid identifier of the entry is valid, if yes, proceeding to step S512, otherwise proceeding to step S519;

S512, determining whether the pointer flag is valid, if it is valid, then go to step S517, otherwise go to step S513;

S513, judging whether the protocol field and the source IP field match, if yes, go to step S514, otherwise go to step S519;

S514, replacing the source port with the content of the replacement port, and determining whether the effective identifier of the external network gateway is valid, if yes, proceeding to step S516, otherwise proceeding to step S515;

S515, the data packet can be directly delivered or adopts a default gateway, and the process goes to step S518;

S516, the data packet needs to be forwarded by the external network gateway, and the process goes to step S518;

S517, the IP lookup table is found through the IP pointer, and the valid valid identifier is over the entry. If there is a protocol field and a source IP field match, the process goes to step S514, otherwise the process goes to step S519.

S518, the table is successful, and the process goes to step S5111;

S519, if the dynamic mode is set, randomly allocate an unused public network IP, port, and add the corresponding information to the NAT configuration table, and then go to step S5111;

S5110, the table check fails, the data packet is discarded, and the process goes to step S5111;

S5111, returning the processing result to the learning/processing module, and proceeding to step S511 to start the next lookup table;

The processing of public network data is as follows:

S521, using the destination port number as an index of the public network port lookup table, taking the corresponding entry of the serial number from the memory, determining whether the valid identifier of the entry is valid, if not, proceeding to step S5210, if yes, proceeding to step S522;

S522, determining whether the pointer flag is valid, if not, proceeding to step S523, if it is valid, then proceeding to step S525;

S523, determining whether the protocol field and the external network IP field match, if yes, then go to step S524, otherwise go to step S5210;

S524, replacing the destination port and the destination IP with the content of the replacement port and the content of the intranet IP, and proceeding to step S529;

S525, The IP lookup table is found through the IP pointer, and the valid valid identifier is used. If there is a protocol field, the external network IP field matches, and when the remote IP valid identifier is valid, the remote IP and the remote port also match the matching item. Go to step S526, if not, go to step S5210;

S526, determining whether the intranet IP valid identification is valid, if it is valid, then going to step S527, otherwise going to step S528;

S527, using the replacement port in the IP lookup table, the intranet IP to replace the destination port, the destination IP, and then go to step S529;

S528, using the replacement port in the IP lookup table, the intranet IP in the port lookup table to replace the destination port and the destination IP, and proceed to step S529;

S529, the table is successful, and the process goes to step S5211;

S5210, the table check fails, go to step S5211;

S5211, returning the processing result to the learning/processing module, and proceeding to step S521 to start the next table lookup.

S6. The learning/processing module learns the result of the processor, and submits the processing result to the NAT processing module.

S7, the NAT processing module and the NAT inverse processing module process the data packet in the buffer according to the received processing result;

The step S7 specifically includes the sub-step: S71, according to the output of the learning/processing module, combined with the output of the extraction module and the data packet content in the data buffer module, the source IP of the private network to the public network TCP, UDP data packet, The source port is replaced, that is, the NAT processing is completed; S72, according to the output of the learning/processing module, combined with the output of the extraction module and the data packet content in the data buffer module, the destination IP of the public network to the private network TCP, UDP data packet, The destination port is replaced, that is, the NAT inverse processing is completed; S73, the IP header checksum, the TCP checksum, and the UDP checksum are recalculated.

In summary, the advantages of the present invention include:

1. Based on the implementation of SOPC, the main functions are realized by a single FPGA, which can effectively reduce the number of chips used. In addition, many of the work that is not suitable for logic processing can be greatly reduced by the processor, thereby reducing the product size and reducing the size of the product. Power consumption, cost savings;

2, using the processor + logic implementation, can maximize the pure software implementation and pure logic to achieve their respective strengths, with a high cost performance.

3. Using the on-chip processor (soft core or hard core) provided by the FPGA manufacturer, it is highly customizable. On the one hand, it can cut off all unused functions compared with the traditional processor, thus reducing power consumption; Optimized according to the needs of NAT applications to improve processing speed and efficiency.

4. The processor and logic module are located on an FPGA chip, which can greatly improve the data interaction efficiency between the two and improve the processing speed of NAT.

5. Adding a learning module between the processor and the logic module can greatly reduce the processing load of the processor, improve the overall processing speed, and make up for the limitation of the processor frequency in the high-speed application environment.

The invention is widely applicable to various NAT processing systems.

The above is a detailed description of the preferred embodiments of the present invention, but the present invention is not limited to the embodiments, and those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the invention. Such equivalent modifications or alternatives are intended to be included within the scope of the claims.

Claims

A method for implementing NAT based on SOPC, characterized in that it comprises the steps of:

S1, extracting information from the data packet;

S2, storing the data packet in a buffer, and submitting the extracted information to the learning/processing module;

S3, the learning / processing module determines whether it can handle this information, if it can be processed, proceeds to step S4, otherwise submits the received information to the processor and proceeds to step S5;

S4, the learning/processing module processes according to the previously learned content, and then submits the processing result to the NAT processing module;

S5. The processor processes the received information, and returns the processing result to the learning/processing module.

S6. The learning/processing module learns the result of the processor, and submits the processing result to the NAT processing module.

S7. The NAT processing module and the NAT inverse processing module process the data packet in the buffer according to the received processing result.
The method for implementing SOPC-based NAT according to claim 1, wherein the information in step S1 includes a source MAC address, an Ethernet protocol type, an IP protocol type, an Ethernet source IP, an Ethernet destination IP, and an ICMP identifier. Symbol, ICMP serial number, source port number, destination port, 16-bit identifier of IP packet, 3-bit flag of IP packet and 13-bit slice offset, IP header checksum, and ICMP/TCP/UDP checksum.
The method for implementing the SOPC-based NAT according to claim 1, wherein the information submitted to the learning/processing module in step S2 includes source IP, destination IP, source port number (TCP, UDP), and destination port. (TCP, UDP), 16-bit identifier of IP packet, 3-bit flag of IP packet, 13-bit slice offset and protocol type.
The method for implementing the SOPC-based NAT according to claim 2 or 3, wherein the step S3 comprises the following sub-steps:

S31, first, through the 3-bit flag of the data packet and the 13-bit slice offset to determine whether the data packet is an IP fragment packet, if it is a fragment packet, the information cannot be processed, otherwise proceeds to step S32;

S32, performing CAM query by using source IP, source port, destination IP, destination port, and protocol type in the information. If there is a valid item, it indicates that the learning/processing module can process the information and proceeds to step S4, otherwise the information cannot be processed. And proceeds to step S33;

S33. Submit the received information to the processor and proceed to step S5.
The method for implementing the SOPC-based NAT according to claim 1, wherein the step S4 is specifically: obtaining an address of the matching unit from the output of the CAM, and reading the content of the address unit from the storage module, as The processing result is returned to the NAT processing module, and the corresponding aging counter is cleared.
The method for implementing the SOPC-based NAT according to claim 1, wherein the information in step S5 is private network data or public network data, and the step S5 specifically includes the sub-steps:

S51: processing private network data, and returning the processing result to the learning/processing module;

or

S52: Process the public network data, and return the processing result to the learning/processing module.
The method for implementing the SOPC-based NAT according to claim 6, wherein the step S51 comprises the following sub-steps:

S511, using the source port number as an index of the private network port lookup table, taking the corresponding entry of the serial number from the memory, determining whether the valid identifier of the entry is valid, if yes, proceeding to step S512, otherwise proceeding to step S519;

S512, determining whether the pointer flag is valid, if it is valid, then go to step S517, otherwise go to step S513;

S513, judging whether the protocol field and the source IP field match, if yes, go to step S514, otherwise go to step S519;

S514, replacing the source port with the content of the replacement port, and determining whether the effective identifier of the external network gateway is valid, if yes, proceeding to step S516, otherwise proceeding to step S515;

S515, the data packet can be directly delivered or adopts a default gateway, and the process goes to step S518;

S516, the data packet needs to be forwarded by the external network gateway, and the process goes to step S518;

S517, the IP lookup table is found through the IP pointer, and the valid valid identifier is over the entry. If there is a protocol field and a source IP field match, the process goes to step S514, otherwise the process goes to step S519.

S518, the table is successful, and the process goes to step S5111;

S519, if the dynamic mode is set, randomly allocate an unused public network IP, port, and add the corresponding information to the NAT configuration table, and then go to step S5111;

S5110, the table check fails, the data packet is discarded, and the process goes to step S5111;

S5111, returning the processing result to the learning/processing module, and proceeding to step S511 to start the next lookup table;

The step S52 specifically includes the sub-steps:

S521, using the destination port number as an index of the public network port lookup table, taking the corresponding entry of the serial number from the memory, determining whether the valid identifier of the entry is valid, if not, proceeding to step S5210, if yes, proceeding to step S522;

S522, determining whether the pointer flag is valid, if not, proceeding to step S523, if it is valid, then proceeding to step S525;

S523, determining whether the protocol field and the external network IP field match, if yes, then go to step S524, otherwise go to step S5210;

S524, replacing the destination port and the destination IP with the content of the replacement port and the content of the intranet IP, and proceeding to step S529;

S525, The IP lookup table is found through the IP pointer, and the valid valid identifier is used. If there is a protocol field, the external network IP field matches, and when the remote IP valid identifier is valid, the remote IP and the remote port also match the matching item. Go to step S526, if not, go to step S5210;

S526, determining whether the intranet IP valid identification is valid, if it is valid, then going to step S527, otherwise going to step S528;

S527, using the replacement port in the IP lookup table, the intranet IP to replace the destination port, the destination IP, and then go to step S529;

S528, using the replacement port in the IP lookup table, the intranet IP in the port lookup table to replace the destination port and the destination IP, and proceed to step S529;

S529, the table is successful, and the process goes to step S5211;

S5210, the table check fails, go to step S5211;

S5211, returning the processing result to the learning/processing module, and proceeding to step S521 to start the next table lookup.
The method for implementing the SOPC-based NAT according to claim 6, wherein the step S5 further comprises the substeps:

S50: Perform IP fragmentation packet processing on the received information.

The step S50 specifically includes the sub-steps:

S501, determining whether it is an IP fragmentation packet, if it is a fragmentation packet, then proceeding to step S502;

S502, determining whether it is the first packet of the IP fragmentation packet, if yes, proceeding to step S503, otherwise proceeding to step S504;

S503, the first packet is processed in a non-fragmented packet processing manner, and the other fragments of the fragmented packet in the cache are also processed in this manner, and the process proceeds to step S505;

S504, the fragmentation packet information is cached, and the process proceeds to step S505;

S505, proceeding to step S501 to start the next processing.
The method for implementing the SOPC-based NAT according to claim 1, wherein the step S7 comprises the following sub-steps:

S71, according to the output of the learning/processing module, combining the output of the extraction module and the content of the data packet in the data buffer module, realizing the source IP and source port replacement of the private network to the public network TCP and UDP data packets, that is, completing the NAT processing;

S72, according to the output of the learning/processing module, combining the output of the extraction module and the content of the data packet in the data buffer module, realizing the destination IP and destination port replacement of the public network to the private network TCP and UDP data packets, that is, completing the NAT inverse processing. ;

S73, recalculating the IP header checksum, the TCP checksum, and the UDP checksum.
An apparatus for implementing NAT based on SOPC, characterized in that it is used for implementing the method for implementing SOPC-based NAT according to any one of claims 1 to 9, which comprises:

Processor module, It is used for performing table lookup processing on the data packet output by the learning/processing module, and returning the processing result to the learning/processing module;

The learning/processing module is respectively connected to the extraction module and the processor module, and has two main functions: one is to receive the output of the extraction module, check whether there is a matching item in the learning content, and if there is a matching item, the corresponding result stored is output. Give the NAT processing module, if there is no matching item, submit the received data directly to the processor module, and record the data to establish a one-to-one correspondence with the processing result in the learning process; second, the data packet processing output by the learning processor As a result, a one-to-one correspondence is established between the input of the packet information and the result of the packet processing, so as to directly process the data packet having the same input condition in the subsequent data packet, so as to reduce the load of the processor module and improve the processing of the data packet. Capability, and then output the result to the NAT processing module;

An extraction module, which is connected to the Ethernet interface module and configured to extract data packet information;

An Ethernet interface, including a private network Ethernet interface for connecting to the private network and an Ethernet interface for connecting to the public network;

a data buffering module, which is connected between the extraction module and the NAT processing module or the NAT inverse processing module, for buffering the data packet;

a NAT processing module, which is respectively connected to the extraction module, the data buffer module, the learning/processing module, and the Ethernet interface, and is configured to receive the output of the learning/processing module, and combine the output of the extraction module and the data packet content in the data buffer module. To implement NAT processing from the private network to the public network;

The NAT inverse processing module is respectively connected to the extraction module, the data buffer module, the learning/processing module and the Ethernet interface, and is configured to receive the output of the learning/processing module, and combine the output of the extraction module and the data packet in the data buffer module. Content, implementing NAT reverse processing from the public network to the private network.