WO2017219816A1

WO2017219816A1 - Data transmission method and network address translation device

Info

Publication number: WO2017219816A1
Application number: PCT/CN2017/085496
Authority: WO
Inventors: 梁一川; 胡亿芬; 戴笑来; 夷泓; 蔡磊; 孟继杰; 李红亮; 刘展; 孙月芹
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-06-22
Filing date: 2017-05-23
Publication date: 2017-12-28
Also published as: CN107528932A

Abstract

Embodiments of the present invention provide a data transmission method and a network address translation device. The method comprises: a network address translation device receives sending information of a sending end, the sending information carrying a public network identifier of a reception end; generate source identifier information according to the sending information, and store the source identifier information to an entry corresponding to the public network identifier; forward the sending information to the reception end, and receive a response message that is sent by the reception end through an internal network and that comprises the source identifier information; and obtain, by means of matching, a corresponding public network by using the source identifier information as a criteria, and forward the response message to the sending end through the public network. The problem in the prior art of failure to select a proper network for a terminal device to send information to a destination end when multiple corresponding public network addresses are configured for an internal network address of the terminal device in the internal network is resolved, and accordingly an accurate network is selected for the terminal when multiple corresponding public network addresses are configured for the internal network address of the terminal device in the internal network.

Description

Data transmission method and network address translation device

Technical field

The present disclosure relates to the field of communications, and in particular, to a data transmission method and a network address translation device.

Background technique

With the rapid development of network services, NAT (Netword Address Translation) technology has been used more and more. One use scenario is that in order to hide the real IP address of the server, this method not only protects its privacy, but also protects the machine from being discovered by IP scanning software on the Internet, reducing the possibility of the device being attacked by IP. . For the server, in order to facilitate user access, a static NAT form is usually used to assign a corresponding public network address to the server in the internal network.

In the related art, there is often a situation in which a server in an intranet is used by a NAT device to proxy the external service of the server, and an external service accesses the public network address of the server. The actual access to the NAT device is converted into a NAT device. Web address to the server. However, due to the variety of operating networks and network users, the domain name/IP that different networks resolve for the same website may be different. For example, there is a WEB server in the internal network. The server has a public network IP address in the carrier A network and a public network IP address in the carrier B network. Because the domain name/IP that the operator resolves on the same website is different, when the user of the external A network accesses the WEB server, after DNS resolution, it finds that it is the address of the A network, sends the request to the NAT device, and transfers it to the server. The packet returned by the server must also select the IP address of the public network interface of the carrier A to reach the user requesting access. However, in the related art, the intranet address and the public network address of the server are in a one-to-one correspondence, so two different WEB servers are used in the related art, and each server has its corresponding intranet address, and the NAT device The two web servers are respectively assigned a public network address corresponding to the intranet address, so that the packets of the WEB server can be returned according to the receiving path. When the corresponding public network address is set to the WEB server, the NAT device can directly forward the information to the device in the internal network, but the device in the internal network needs to forward the information to the device in the inbound network. When replying to the sending device, the information is forwarded to the NAT device to complete the conversion of the internal network address to the public network address. However, since the WEB server in the internal network has two public network addresses, that is, The NAT device can send the information through two different networks. However, if the information is to be successfully sent to the sender, only the network used by the sender to send the information can be selected. At this time, the NAT device does not know which network is. The network used by the sender before.

Therefore, there is a problem in the related art that when a plurality of corresponding public network addresses are configured for an intranet address of a terminal device in an intranet, an appropriate network cannot be selected for the terminal device to transmit information to the destination end.

Summary of the invention

The data transmission method and the network address translation device provided by the embodiments of the present disclosure mainly solve the technical problem: when a plurality of corresponding public network addresses are configured for the internal network address of the terminal device in the internal network, the related information cannot be The terminal device selects a suitable network to send information to the destination.

To solve the above technical problem, an embodiment of the present disclosure provides a data transmission method, including:

Receiving, by the sending end, the sending information, where the sending information includes a public network identifier of the receiving end;

Generating source identification information according to the sending information, and saving the source identification information to an entry corresponding to the public network identifier of the receiving end;

And transmitting, by the intranet, the sending information to the receiving end, and receiving, by the receiving end, feedback information that includes the source identification information that is fed back through the intranet;

And matching the corresponding public network according to the source identification information, and forwarding the response information to the sending end by using the public network.

The embodiment of the present disclosure further provides a network address translation device, including an information receiving module, a saving module, a processing module, and a network selection module:

The information receiving module is configured to receive sending information of the sending end, where the sending information includes a public network identifier of the receiving end;

The saving module is configured to generate source identification information according to the sending information, and save the source identification information to an entry corresponding to the public network identifier of the receiving end;

The processing module is configured to forward the sending information to the receiving end by using an intranet, and receive response information that includes the source identifier information that is sent by the receiving end through the intranet;

The network selection module is configured to match the corresponding public network according to the source identification information, and forward the response information to the sending end by using the public network.

Embodiments of the present disclosure also provide a computer storage medium having stored therein computer executable instructions for performing the aforementioned data transmission method.

The beneficial effects of the present disclosure are:

According to the data transmission method, the network address translation device, and the computer storage medium provided by the embodiment of the present disclosure, the network address translation device receives the transmission information of the transmitting end, where the transmission information carries the public network identifier of the receiving end, and generates the source identifier according to the sending information. The information is saved to the entry corresponding to the public network identifier; the sent information is forwarded to the receiving end, and the response message containing the active identification information fed back by the receiving end through the intranet is received; Based on the information, the corresponding public network is matched, and the response message is forwarded to the sender through the public network. The source identification information is generated and saved in the solution in the embodiment of the present disclosure, and is saved to the entry corresponding to the public network identifier of the receiving end. The response information at the receiving end also carries the source identification information, and the source identification information can be matched according to the source identification information. The public network, by using the public network to forward response information, can ensure that the response message is sent by the network receiving the sent message. In the related art, when a plurality of corresponding public network addresses are configured for the internal network address of the terminal device in the internal network, the problem that the appropriate network cannot be selected for the terminal device to send information to the destination end; When the internal network address of the terminal device is configured with multiple corresponding public network addresses, an accurate network is selected for the terminal, thereby eliminating the need to add additional servers and wasting financial resources and resources.

DRAWINGS

1 is a flowchart of a data transmission method according to Embodiment 1 of the present disclosure;

2 is a schematic structural diagram of a network address translation device according to Embodiment 2 of the present disclosure;

FIG. 3 is a schematic diagram of networking of a specific example in Embodiment 2 of the present disclosure.

detailed description

The embodiments of the present disclosure will be further described in detail below with reference to the accompanying drawings.

Embodiment 1:

In the related art, when a plurality of corresponding public network addresses are configured for the internal network address of the terminal device in the internal network, the problem that the terminal device cannot select a suitable network to send the information to the destination end is provided in the embodiment. For a data transmission method, please refer to FIG. 1, which includes:

S101: Receive sending information of the sending end.

S102: Generate source identification information according to the sending information, and save the source identification information to an entry corresponding to the public network identifier of the receiving end;

S103: Forward the sent information to the receiving end, and receive the response information that the receiving end feeds back through the intranet;

S104: Match the corresponding public network according to the source identification information, and forward the response information to the sending end through the public network.

In step S101, the received transmission information includes the public network identifier of the receiving end. The public network identification information is mainly used to identify the public network at the receiving end. Before that, the internal network identifier of the receiving end is obtained, and at least two public network identifiers corresponding to the internal network identifier are configured for the receiving end; and the internal network identifier and each public network identifier are correspondingly saved to different entries. Mark multiple entries for each entry.

Because the devices on the intranet cannot directly access the public network, you need to configure the corresponding IP address for different networks. The IP address used by the receiving end to access the public network can be used as the public network identifier. The internal network identifier of the receiving end can be the internal network IP address of the receiving end. The public network identifier of the receiving end includes the public network IP address of the receiving end.

The terminal in the internal network has its own internal network IP address, and uses the static network address translation mode to configure at least two public network IP addresses corresponding to the internal network IP address for the terminal in the internal network; An intranet address corresponds to multiple public network addresses. When a merchant sets up a server in the internal network, the user can access the server through multiple networks. Of course, the IP address described here mainly serves to identify the network or the terminal, and other implementation manners can be adopted. After the mapping between the internal IP address of the device and the public IP address of the device is configured, the mapping relationship is saved in multiple different entries based on the corresponding public IP addresses. In a specific embodiment, a multi-export tag is also marked for an entry whose intranet address corresponds to multiple public network addresses.

In step S102, the source identification information is generated according to the transmission information, and the source identification information is saved, so that the receiving end can use the public information used by the sending end to send the sending information after receiving the information. The network transmits the response information. Specifically, the source identifier information may be an IP address of the sending end. Generally, when the sending end sends the sending information to the receiving end, the sending end carries its own IP address in the sending information, so After the information is sent, only the transmission information needs to be parsed, and the IP address of the sender can be obtained, thereby obtaining source identification information. The use of the IP address of the sender as the source identifier is only one specific embodiment of the embodiment, and may be identified by other means. The source identification information is also saved. Specifically, the public network identifier in the sending information may be matched with the account saved by the public network identifier. After the corresponding public network identifier is matched, the source identifier information is saved under the entry.

In a specific implementation manner, when the source identifier information is saved, the corresponding entry may be matched according to the public network identifier of the receiving end, and then the entry may be determined to have multiple exit markings; if yes, the internal network address corresponding to the entry is verified. If multiple public network addresses are used, you need to save the corresponding source identification information for the entry when you want to use the inbound traffic to the same public network address. Then, determine whether the corresponding source identification information has been saved under the entry. Now, you don't have to save it again. If you don't have it, you need to save the source ID information.

In step S103, the sending information is forwarded to the receiving end through the intranet, and after receiving the sending information, the receiving end needs to generate a response message when responding to the information. Thus, a response message from the receiving end is received. The source identification information is carried in the response information. This is also the advantage of using the IP address of the sender as the source identifier information in the embodiment. In the network, if the information is to be sent, the source IP address of the sender and the destination IP address of the destination end are carried in the packet. When the receiving end sends the above-mentioned sending information, it will carry its own IP address in the sending information; when the receiving end receives the sending information and makes a feedback to send the response information, in order to ensure normal transmission, the response information itself is also in the response information. The IP address of the sender is used as the destination address. In this way, the source IP address of the sender can not only help to implement information forwarding, but also can be used for identification. Therefore, it is not necessary to add additional identifier information to add additional The transmission bandwidth is simple and convenient, and also saves resources.

Then, in step S104, the source identifier information in the response information is obtained, and the source identifier information is matched with each entry saved by the user. After the corresponding entry is matched, the public network address under the entry is obtained, and the public network address is used. The corresponding network forwards the response information.

In this embodiment, a timer may also be set for each entry. The transmission method in this embodiment is usually directed to some servers in the intranet. If the server has a large amount of access, then a large number of entries need to be saved. By setting the timer, the information in the entry or the information in the entry is periodically cleared to avoid occupying a large amount of resources.

The data transmission method in this embodiment generates source identification information after receiving the information sent by the sending end, and uses the source identification information to identify the network, and when forwarding the response information of the receiving end, according to the source identification information The corresponding public network is matched to send the response information. Compared with the related art, the intranet address of the intranet device is one-to-one corresponding to the public network address, and the two servers are used, only one service can be implemented with users in different public networks. Interaction saves costs.

Embodiment 2:

This embodiment provides a network address translation device. Referring to FIG. 2, the network address translation device includes an information receiving module 21, which is configured to receive sending information of a sending end, where the sending information includes a public network identifier of the receiving end, and the public network identifier information. It mainly identifies the public network of the receiving end, and can use the IP address used by the receiving end to access the public network. Public network identification. The network address translation device further includes a network address translation module 22, configured to acquire an internal network identifier of the receiving end, and configure at least two public network identifiers corresponding to the internal network identifier for the receiving end before receiving the sending information of the transmitting end; The intranet identifier and each public network identifier are saved to different entries, and multiple entries are marked for each entry.

Since the devices in the internal network cannot directly access the public network, the network address translation module 22 first configures corresponding IP addresses for different networks. The IP address used by the receiving end to access the public network can be used as the public network identifier. The internal network identifier of the receiving end can be the internal network IP address of the receiving end. The public network identifier of the receiving end includes the public network IP address of the receiving end. The terminal in the internal network has its own internal network IP address, and the network address translation module 22 uses the static network address translation mode to configure at least two public network IP addresses corresponding to the internal network IP address for the terminals in the internal network. Of course, the IP address described here mainly serves to identify the network or the terminal, and other implementation manners can be adopted. After the mapping between the internal IP address of the device and the public IP address of the device is configured, the mapping relationship is saved in multiple different entries based on the corresponding public IP addresses. In a specific embodiment, a multi-export tag is also marked for an entry whose intranet address corresponds to multiple public network addresses.

The network address translation device further includes a saving module 23, which generates source identification information according to the transmission information, and saves the source identification information, so that when the receiving end receives the information, the receiving end may use the sending end to send the sending information. The public network used transmits the response information. Specifically, the source identifier information may be an IP address of the sending end. Generally, when the sending end sends the sending information to the receiving end, the sending end carries its own IP address in the sending information, so after receiving the sending information, only The transmission information needs to be parsed, and the IP address of the sender can be obtained, thereby obtaining source identification information. The use of the IP address of the sender as the source identifier is only one specific embodiment of the embodiment, and may be identified by other means. The source identification information is also saved. Specifically, the saving module 23 may first match the account saved by the public network identifier in the sending information, and then, after matching the corresponding public network identifier, save the source identifier information under the entry.

In a specific implementation manner, when saving the source identification information, the saving module 23 may first match the corresponding entry according to the public network identifier of the receiving end, and then determine whether the entry has multiple exit markings; if yes, further determine whether the source has been saved. The identification information, if it has been saved, does not repeatedly save the source identification information, if not, the source identification information needs to be saved.

The network address translation device further includes a processing module 24, configured to forward the transmission information to the receiving end through the intranet, and receive response information including the active identification information fed back by the receiving end through the intranet.

The network address translation device further includes a network selection module 25, configured to match the corresponding public network according to the source identification information, and forward the response information to the sending end through the public network. Specifically, the network selection module 25 obtains the source identifier information in the response information, and matches the source identifier information with each entry that is saved by itself. After the corresponding entry is matched, the public network address under the entry is obtained, and the public network is adopted. The network corresponding to the address forwards the response information.

In this embodiment, a timer module may be further included, which is used to set a timer for each item. If the server has a large amount of access, a large number of entries need to be saved, and a timer may be used to periodically Close the entry, or clear the information in the entry to avoid taking up a lot of resources.

Each module of the network address translation device in this embodiment, the information receiving module 21, and the network address translation module 22. The functions of the save module 23, the processing module 24, and the network selection module 25 can all be implemented by a processor of the network address translation device.

The network address translation device in this embodiment is further described below with reference to a specific example. For the specific networking mode, refer to FIG. 3. The network address translation device in this embodiment is a router:

First, configure different public address pools for the A network and the B network on the router, for example:

Cgn 1

Cgn-pool Anetwork mode pat

Section 1 10.1.1.1 10.1.1.3

Cgn-pool Bnetwork mode pat

Section 1 20.1.1.1 20.1.1.3

Then, configure two static entries for the WEB server. The server addresses correspond to the two public network addresses of the A network and the B network, and put a static multi-export mark to generate an entry table. Please refer to Table 1. The configuration commands are as follows:

Static rule 1 192.168.100.1 80 10.1.1.1 80

Static rule 2 192.168.100.1 80 20.1.1.1 80

Table 1

条目号Entry number	私网地址Private network address	用户源地址User source address	公网地址Public address
11	192.168.100.1:80192.168.100.1:80		10.1.1.1 8010.1.1.1 80
22	192.168.100.1:80192.168.100.1:80		20.1.1.1 8020.1.1.1 80

A network user 60.1.1.1 accesses the server http://10.1.1.1:80, the root address (public network) + port number (10.1.1.1:80), directly converted to the private network address + port number (192.168.100.1: 80) At the same time, an entry 60.1.1.1 is generated, and the corresponding public network address is 10.1.1.1:80. For the entry list of users who have entered traffic, please refer to Table 2.

Table 2

条目号Entry number	私网地址Private network address	用户源地址User source address	公网地址Public address
11	192.168.100.1:80192.168.100.1:80		10.1.1.1:80(A网络)10.1.1.1:80 (A network)
22	192.168.100.1:80192.168.100.1:80	60.1.1.160.1.1.1	10.1.1.1:80(A网络)10.1.1.1:80 (A network)
33	192.168.100.1:80192.168.100.1:80		20.1.1.1:80(B网络)20.1.1.1:80 (B network)

The intranet server returns a packet to the A network. When it is found that NAT is to be performed, according to the private network address (192.168.100.1:80) + destination address (60.1.1.1), select the entry No. 2, and then replace the private network address with the A network. The public network address 10.1.1.1:80.

B network user 80.1.1.1 access server http://10.1.1.1:80, root address (public network) + port number (20.1.1.1:80), directly convert to the private network address + port number (192.168.100.1:80), and then generate an entry 80.1.1.1, the corresponding public network address is 20.1.1.1:80; Please refer to Table 3 for the entry list.

table 3

条目号Entry number	私网地址Private network address	用户源地址User source address	公网地址Public address
11	192.168.100.1:80192.168.100.1:80		10.1.1.1:80(A网络)10.1.1.1:80 (A network)
22	192.168.100.1:80192.168.100.1:80	60.1.1.160.1.1.1	10.1.1.1:80(A网络)10.1.1.1:80 (A network)
33	192.168.100.1:80192.168.100.1:80		20.1.1.1:80(B网络)20.1.1.1:80 (B network)
44	192.168.100.1:80192.168.100.1:80	80.1.1.180.1.1.1	20.1.1.1:80(B网络)20.1.1.1:80 (B network)

The intranet server returns a packet to the B network. When it is found that NAT is to be performed, according to the private network address (192.168.100.1:80)+destination address (80.1.1.1), select the 4th entry, and then replace the private network address with the B network. The public network address is 20.1.1.1:80.

After receiving the sending information of the sending end, the network address translation device in the embodiment generates source identification information, and uses the source identification information to identify the network. When multiple corresponding public network addresses are configured for the internal network address of the terminal device in the internal network, an accurate network is selected for the terminal.

Obviously, those skilled in the art should understand that the modules or steps of the above embodiments of the present disclosure may be implemented by a general computing device, which may be concentrated on a single computing device or distributed among multiple computing devices. On the network, optionally, they may be implemented by program code executable by the computing device, such that they may be stored in a computer storage medium (ROM/RAM, disk, optical disk) by a computing device, and at some In some cases, the steps shown or described may be performed in an order different than that herein, or they may be separately fabricated into individual integrated circuit modules, or a plurality of modules or steps may be fabricated into a single integrated circuit module. . Therefore, the present disclosure is not limited to any specific combination of hardware and software.

The above content is a further detailed description of the embodiments of the present disclosure in conjunction with the specific embodiments, and the specific implementation of the present disclosure is not limited to the description. It is to be understood by those skilled in the art that the present invention may be construed as being limited to the scope of the present disclosure.

Industrial applicability

The data transmission method provided by the embodiment of the present disclosure may be applied to a network address translation device, by generating and storing source identification information, and saving the same to an entry corresponding to the public network identifier of the receiving end; the response information at the receiving end also carries the source identifier. The information can be matched according to the source identification information to the corresponding public network, and the public network can be used to forward the response information, so that the network that receives the sent message can be sent to the response message. Effectively solve related techniques when the needle When multiple corresponding public network addresses are configured for the intranet address of the terminal device in the intranet, the problem that the terminal device cannot select a suitable network to send information to the destination end; thus, the intranet for the terminal device in the intranet When an address is configured with multiple corresponding public network addresses, an accurate network is selected for the terminal, thereby eliminating the need to add additional servers and wasting financial resources and resources.

Claims

A data transmission method includes:

Receiving, by the sending end, the sending information, where the sending information includes a public network identifier of the receiving end;

Generating source identification information according to the sending information, and saving the source identification information to an entry corresponding to the public network identifier of the receiving end;

And transmitting, by the intranet, the sending information to the receiving end, and receiving, by the receiving end, feedback information that includes the source identification information that is fed back through the intranet;

And matching the corresponding public network according to the source identification information, and forwarding the response information to the sending end by using the public network.
The data transmission method according to claim 1, wherein before receiving the transmission information of the transmitting end, the method further comprises:

Obtaining an internal network identifier of the receiving end, configuring at least two public network identifiers corresponding to the internal network identifiers for the receiving end, and saving the internal network identifier and each public network identifier to different entries, Multiple entries are marked for each entry.
The data transmission method according to claim 2, wherein the storing the source identification information to the entry corresponding to the public network identifier of the receiving end comprises:

Corresponding to the public network identifier of the receiving end, matching the corresponding entry, and determining whether the source identification information has been saved when the entry has multiple exit markings; if yes, the source identification information is not saved; otherwise, the source identifier is The information is saved to the entry.
The data transmission method according to claim 3, wherein the matching of the source identification information to the corresponding public network, the forwarding of the response information to the sending end comprises:

Obtaining the source identification information in the response information;

And matching the corresponding entry according to the source identifier information, and acquiring the public network identifier of the receiving end saved in the entry;

And selecting, according to the public network identifier, the corresponding network to send the response information to the sending end.
The data transmission method according to any one of claims 1 to 4, wherein generating source identification information according to the transmission information comprises: reading an IP address of the transmitting end carried by the sending information, and The IP address is used as the source identification information.
The data transmission method according to claim 5, wherein

The internal network identifier of the receiving end includes an internal network IP address of the receiving end;

The public network identifier of the receiving end includes a public network IP address of the receiving end.
A network address translation device includes an information receiving module, a saving module, a processing module, and a network selection module.

The information receiving module is configured to receive sending information of the sending end, where the sending information includes a public network identifier of the receiving end;

The saving module is configured to generate source identification information according to the sending information, and save the source identification information to an entry corresponding to the public network identifier of the receiving end;

The processing module is configured to forward the sending information to the receiving end by using an intranet, and receive response information that includes the source identification information that is received by the receiving end through the intranet;

The network selection module is configured to match the corresponding public network according to the source identification information, and forward the response information to the sending end by using the public network.
The network address translation device of claim 7, further comprising: a network address translation module, configured to acquire an internal network identifier of the receiving end, and configured at least two corresponding to the internal network identifier for the receiving end The public network identifier is saved; and the internal network identifier and each public network identifier are correspondingly saved to different entries, and multiple entries are marked for each entry.
The network address translation device according to claim 8, wherein the saving module is configured to match the corresponding entry according to the public network identifier of the receiving end, and determine whether the saved condition has been saved when the entry has multiple exit markings Source identification information; if so, the source identification information is not saved; otherwise the source identification information is saved to the entry.
The network address translation device according to any one of claims 7-9, wherein the saving module is configured to read an IP address of the transmitting end carried by the sending information, and use the IP address of the sending end as Source identification information.