WO2023130901A1 - 一种网络节点间nat探测方法、装置、设备及存储介质 - Google Patents

一种网络节点间nat探测方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2023130901A1
WO2023130901A1 PCT/CN2022/138028 CN2022138028W WO2023130901A1 WO 2023130901 A1 WO2023130901 A1 WO 2023130901A1 CN 2022138028 W CN2022138028 W CN 2022138028W WO 2023130901 A1 WO2023130901 A1 WO 2023130901A1
Authority
WO
WIPO (PCT)
Prior art keywords
nat
node
message
detection result
nat detection
Prior art date
Application number
PCT/CN2022/138028
Other languages
English (en)
French (fr)
Inventor
郭金发
杜明
张国强
颜湘
Original Assignee
西安西电捷通无线网络通信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 西安西电捷通无线网络通信股份有限公司 filed Critical 西安西电捷通无线网络通信股份有限公司
Publication of WO2023130901A1 publication Critical patent/WO2023130901A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the invention relates to the field of communication technology, in particular to a method, device, equipment and storage medium for NAT detection between network nodes.
  • NAT Network Address Translation
  • IPsec uses the key management protocol IKE (Internet Key Exchange) for NAT detection;
  • IKE Internet Key Exchange
  • the function definition is chaotic and the boundary is blurred, which is not conducive to the expansion of the key management function of the key management protocol.
  • IPsec performs NAT detection using the "announcement payload" of the key management protocol IKE.
  • the "announcement payload” is a part of the key management protocol.
  • Embodiments of the present invention provide a NAT detection method, device, device, and storage medium between network nodes to solve the problem caused by the tight coupling between NAT detection and key management protocols when IKE is used for NAT detection similar to IPsec in the prior art It is difficult to expand the key management function and introduce security loopholes.
  • an embodiment of the present invention provides a NAT detection method between network nodes, including:
  • the requesting node obtains the first node information, and uses the obtained first node information as the payload data of the NAT detection request message or the NAT detection result request message, the first node information includes the requesting node's own IP address, and the configured response node IP address;
  • the requesting node encapsulates the NAT detection request message or the NAT detection result request message into an IP message, and sends the NAT detection request packet message obtained after the encapsulation to the response node after protection processing;
  • the responding node receives the NAT detection request packet message, and deprotects the received NAT detection request packet message;
  • the responding node obtains the NAT detection request message or the NAT detection result request message from the deprotected NAT detection request packet message, and combines the obtained NAT detection request message or the payload data in the NAT detection result request message with the NAT detection result request message.
  • the corresponding content in the first IP header of the detection request packet message is compared, and the NAT detection result is determined according to the comparison result;
  • the responding node When the responding node obtains the NAT detection request message from the deprotected NAT detection request packet message, it obtains the second node information, the second node information includes the responding node's own IP address, and the IP address from the NAT The IP address of the requesting node obtained in the first IP header of the detection request packet message, and the second node information as the payload data of the NAT detection response message, and IP packet encapsulation of the NAT detection response message, and the encapsulation After the obtained NAT detection response packet message is protected and sent to the requesting node; or, when the response node obtains the NAT detection result request message from the deprotected NAT detection request packet message, the NAT The detection result is carried in the NAT detection result response message, and the NAT detection result response message is encapsulated in an IP message, and the NAT detection response packet message obtained after the encapsulation is protected and sent to the requesting node;
  • the requesting node receives the NAT detection response packet message and performs deprotection processing, and obtains the NAT detection result response message from the NAT detection result response message when obtaining the NAT detection result response message from the NAT detection response packet message after the deprotection processing. detection result; or, when obtaining a NAT detection response message from the deprotected NAT detection response packet message, obtain the load data of the NAT detection response message, and combine the obtained load data with the NAT detection response packet The corresponding content in the second IP header of the message is compared, and the NAT detection result is determined according to the comparison result.
  • the first node information also includes the port number of the requesting node itself, and the configured port number of the responding node; or the first node information also includes the SID of the requesting node itself, and the configured SID of the responding node ;
  • the second node information also includes the port number of the responding node itself, and the port number of the requesting node obtained from the first IP header of the NAT probe request packet message; or the second node information also includes the responding node Its own SID, and the SID of the requesting node obtained from the first IP header of the NAT probe request packet.
  • the requesting node encapsulates the NAT detection request message or the NAT detection result request message in an IP packet, including:
  • the responding node encapsulates the NAT detection response message or the NAT detection result response message into an IP packet, including:
  • the NAT probe request message or the NAT probe result request message or the NAT probe response message includes an identifier indicating a message type and length information for parsing the number of IP addresses;
  • the NAT detection result response message includes an identifier indicating whether NAT exists between the requesting node and the responding node.
  • the requesting node performs protection processing on the NAT detection request packet message, including:
  • the requesting node performs at least one of encryption, data obfuscation, and integrity verification on the NAT detection request packet message;
  • the response node performs deprotection processing on the NAT detection request packet message, including:
  • the responding node performs at least one process of decryption, data restoration, and integrity check on the NAT detection request packet message.
  • the responding node performs protection processing on the NAT probe response packet message, including:
  • the responding node performs at least one of encryption, data obfuscation, and integrity verification on the NAT probe response packet message;
  • the requesting node performs deprotection processing on the NAT probe response packet message, including:
  • the requesting node performs at least one of decryption, data restoration, and integrity check on the NAT probe response packet message.
  • the response node determines the NAT detection result according to the comparison result, including any of the following steps:
  • the IP address of the requesting node in the obtained payload data is different from the IP address of the requesting node in the first IP header, or the port number of the requesting node in the payload data is different from the port number of the requesting node in the first IP header , or, when the SID of the requesting node in the payload data is different from the SID of the requesting node in the first IP header, it is determined that NAT exists between the requesting node and the network; otherwise, it is determined that there is no NAT between the requesting node and the network;
  • the port number of the responding node in the load data is different from the response node in the first IP header
  • the port numbers of the nodes are different, or, when the SID of the responding node in the payload data is different from the SID of the responding node in the first IP header, it is determined that there is NAT between the responding node and the network; otherwise, it is determined that there is no NAT between the responding node and the network. NAT exists.
  • the requesting node determines the NAT detection result according to the comparison result, including:
  • the IP address of the responding node in the acquired load data is different from the IP address of the responding node in the second IP header, or the port number of the responding node in the load data is different from the port number of the responding node in the second IP header , or, when the SID of the responding node in the payload data is different from the SID of the responding node in the second IP header, determine that there is NAT between the responding node and the network; otherwise, determine that there is no NAT between the responding node and the network;
  • the IP address of the requesting node in the obtained load data is different from the IP address of the requesting node in the second IP header, or, the port number of the requesting node in the load data is different from the port number of the requesting node in the second IP header number is different, or, when the SID of the requesting node in the payload data is different from the SID of the requesting node in the second IP header, it is determined that NAT exists between the requesting node and the network; otherwise, it is determined that there is no NAT between the requesting node and the network.
  • the NAT detection result determined by the requesting node or the responding node according to the comparison result is the second detection result
  • the detection result carried in the NAT detection result response message is the first detection result
  • the first detection result is a detection result indicating whether there is NAT between the requesting node and the responding node;
  • the second detection result includes indicating whether there is NAT between the requesting node and the responding node, and when there is NAT between the requesting node and the responding node, the distribution position of the NAT.
  • the embodiment of the present invention also provides a NAT detection device between network nodes, which is configured on the requesting node, including:
  • An acquisition module configured to acquire first node information, and use the acquired first node information as payload data of a NAT detection request message or a NAT detection result request message, the first node information including the IP address of the requesting node itself, and configuration The IP address of the responding node;
  • An encapsulation module configured to encapsulate the NAT detection request message or the NAT detection result request message into an IP packet, and perform protection processing on the NAT detection request packet obtained after encapsulation and send it to the response node;
  • a determining module configured to receive a NAT detection response packet message and perform deprotection processing, and obtain a NAT detection result response message from the NAT detection result response message from the NAT detection result response message after deprotection processing.
  • NAT detection result or, when obtaining the NAT detection response message from the NAT detection response packet message after deprotection processing, obtain the load data of the NAT detection response message, and combine the obtained load data with the NAT detection response
  • the corresponding content in the second IP header of the packet message is compared, and the NAT detection result is determined according to the comparison result.
  • the embodiment of the present invention also provides a NAT detection device between network nodes, which is configured on the responding node, including:
  • a receiving module configured to receive a NAT detection request packet message, and perform deprotection processing on the received NAT detection request packet message;
  • a determining module configured to obtain the NAT detection request message or the NAT detection result request message from the deprotected NAT detection request packet message, and combine the obtained NAT detection request message or the payload data in the NAT detection result request message with the The corresponding content in the first IP header of the NAT detection request packet message is compared, and the NAT detection result is determined according to the comparison result;
  • An obtaining module configured to obtain second node information when the NAT detection request message is obtained from the deprotected NAT detection request packet message, the second node information includes the IP address of the responding node itself, and from The IP address of the requesting node obtained in the first IP header of the NAT detection request packet message, and the second node information as the payload data of the NAT detection response message, and IP packet encapsulation of the NAT detection response message, And carry out protection processing on the NAT detection response packet message obtained after encapsulation and send it to the requesting node; or, when obtaining the NAT detection result request message from the NAT detection request packet message after deprotection processing, send The NAT detection result is carried in the NAT detection result response message, and the NAT detection result response message is encapsulated in an IP packet, and the encapsulated NAT detection response packet is protected and sent to the requesting node.
  • the embodiment of the present invention also provides a NAT detection device between network nodes, which is configured on the requesting node, and the device includes: a memory for storing program instructions; a processor for invoking the program instructions stored in the memory , executing the steps of the NAT detection method between network nodes provided by the first aspect above according to the obtained program.
  • the embodiment of the present invention also provides a NAT detection device between network nodes, which is configured in a response node, and the device includes: a memory for storing program instructions; a processor for invoking the program instructions stored in the memory , executing the steps of the NAT detection method between network nodes provided by the first aspect above according to the obtained program.
  • the embodiment of the present invention further provides a computer storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps of the NAT detection method between network nodes provided in the above-mentioned first aspect are implemented.
  • This application provides a NAT detection method that exists independently of the key management protocol, which is simple and reliable, and solves the confusion of function definitions and blurred boundaries caused by the tight coupling between NAT detection and key management protocols between network nodes.
  • the problem of difficult expansion of the key management function (for example, the NAT detection capability of this application is completed by a protocol that carries an IP address, or an IP address and a port number, or an IP address and a session identifier SID, which has nothing to do with the key management protocol, and the key Management is accomplished by a special key management protocol, and the strengthening and expansion of key management security will not be affected by the NAT detection capability); in addition, the NAT detection of this application is realized by an independent protocol, not by modifying the key The management protocol itself is implemented, and modifying the NAT detection capability will not affect the security capability of the key management protocol itself; it supports the diversity of NAT detection methods, and supports different detection methods that only determine whether there is NAT or determine the distribution location of NAT; In case of NAT, the response no
  • FIG. 1 is a schematic flow diagram of a NAT detection method between network nodes provided by an embodiment of the present invention
  • FIG. 2 is a schematic diagram of the NAT distribution position when there is NAT between the requesting node and the responding node provided by the embodiment of the present invention
  • FIG. 3 is a schematic structural diagram of a NAT detection device configured on a requesting node provided by an embodiment of the present invention
  • FIG. 4 is a schematic structural diagram of a NAT detection device configured in a response node provided by an embodiment of the present invention
  • FIG. 5 is a schematic module diagram of a NAT detection device configured on a requesting node provided by an embodiment of the present invention
  • FIG. 6 is a block diagram of a NAT detection device configured on a response node provided by an embodiment of the present invention.
  • An embodiment of the present invention provides a NAT detection method between network nodes, as shown in Figure 1, including:
  • the requesting node obtains the first node information, and uses the obtained first node information as the payload data of the NAT detection request message or the NAT detection result request message.
  • the first node information includes the requesting node's own IP address, and configured The IP address of the responding node.
  • the above NAT detection request message has the same format as the NAT detection result request message, and they belong to different message types. If the requesting node needs to determine whether there is NAT and the distribution position of NAT when NAT exists, it needs to send the NAT detection request message to the responding node. If When the requesting node only needs to determine whether there is NAT between the requesting node and the responding node, it needs to send a NAT detection result request message to the responding node.
  • the payload data of the NAT detection request message and the NAT detection result request message are the same, and the payload data content includes: the IP address of the requesting node itself, and the IP address of the responding node.
  • the address of the responding node can be configured by the administrator, because initially, the requesting node needs to be clearly informed which responding node to send to.
  • the requesting node encapsulates the NAT detection request message or the NAT detection result request message into an IP packet, and performs protection processing on the encapsulated NAT detection request packet and sends it to the response node.
  • the NAT detection request message is encapsulated in an IP packet, including:
  • the requesting node encapsulates the first node information into the first IP header of the NAT detection request packet; encapsulates the NAT detection request message into the first packet content of the NAT detection request packet.
  • the NAT detection result request message is encapsulated in an IP packet, including:
  • the requesting node encapsulates the first node information into the first IP header of the NAT detection request packet; encapsulates the NAT detection result request message into the first packet content of the NAT detection request packet.
  • the first node information of the requesting node is organized in the NAT detection request packet, it not only exists in the first IP header, but also is encapsulated in the content of the first packet.
  • the initiator is the requesting node and the receiving end is the responding node
  • the requesting node when the requesting node performs IP packet encapsulation, it needs to first organize and form the payload data of the NAT detection request message or the NAT detection result request message of the requesting node, and then wrap the NAT detection request message Or the NAT detection result request message is encapsulated into an IP message to form a NAT detection request packet message.
  • the address of the requesting node or the responding node itself is called a private address
  • the address encapsulated into the header when the requesting node or responding node transmits a message in the network is called a public address.
  • the public address and the private address are different addresses; if the network address translation is not performed to transmit the message, the public address and the private address are same address.
  • the IP address of the requesting node encapsulated in the first IP header is a private address
  • the IP address of the responding node is a public address of the responding node itself, which is also a private address.
  • the private IP address of the requesting node in the first IP header will be changed to a different public address by NAT.
  • the IP address of the requesting node encapsulated in the first IP header is the private address of the requesting node itself, and it is also a public address, and the IP address of the responding node is a public address. , the public IP address of the responding node in the first IP header will be changed to a different private address by NAT.
  • the IP address of the requesting node encapsulated in the first IP header is a private address
  • the IP address of the responding node is a public address.
  • the IP address of the requesting node encapsulated in the first IP header is private to the requesting node itself.
  • the address is also the public address used in network transmission.
  • the IP address of the responding node is the public address of the responding node itself, and it is also the public address used in network transmission.
  • the requesting node performs protection processing on the NAT detection request packet message, including:
  • the requesting node performs at least one of encryption, data obfuscation, and integrity check on the NAT detection request packet message.
  • the protection processing of the NAT detection request packet is to protect the content of the first packet in the NAT detection request packet, and not to protect the first IP header in the NAT detection request packet. .
  • the requesting node performs protection processing on the NAT detection request packet message to form a protected NAT detection request packet message. Because the NAT detection request message may contain sensitive information, protecting the NAT detection request packet message can prevent the leakage of sensitive information such as internal private IP addresses, so the privacy and integrity of the NAT detection request packet message must be protected during transmission.
  • Verification processing which can prevent attackers from launching DoS attacks by tampering with information (for example, IPsec does not protect NAT detection information, attackers can delete or add NAT Discovery (NAT-Discovery, NAT-D for short) load, In the case of launching a DoS attack), it solves the problem of bandwidth waste caused by the attacker tampering with information (for example, in IPsec, in an environment without NAT, the attacker can tamper with the NAT detection packet, causing both negotiation parties to use the user Datagram Protocol (User Datagram Protocol, referred to as UDP) encapsulation mode, resulting in a waste of bandwidth).
  • UDP User Datagram Protocol
  • the responding node receives the NAT detection request packet, and performs deprotection processing on the received NAT detection request packet.
  • the responding node performs deprotection processing on the protected NAT detection request packet message, including: the responding node correspondingly decrypts the protected NAT detection request packet message, restores data, completes At least one process in the sex check.
  • the responding node obtains a NAT detection request message or a NAT detection result request message from the deprotected NAT detection request packet message, and combines the obtained NAT detection request message or the payload data in the NAT detection result request message with the NAT
  • the corresponding content in the first IP header of the detection request packet is compared, and the NAT detection result is determined according to the comparison result.
  • the responding node determines whether the IP address of the requesting node or the responding node is addressed through NAT during network transmission. Conversion, so that the NAT detection result between the requesting node and the responding node can be parsed out.
  • the responding node obtains the NAT detection request message from the deprotected NAT detection request packet message, obtain the second node information, the second node information includes the responding node's own IP address, and The IP address of the requesting node obtained in the first IP header of the NAT detection request packet message, and the second node information as the payload data of the NAT detection response message, the NAT detection response message is encapsulated in an IP message, and The packaged NAT probe response packet is protected and then sent to the requesting node.
  • the responding node When the responding node obtains the NAT detection result request message from the deprotected NAT detection request packet message, it carries the NAT detection result in the NAT detection result response message, and sends the NAT detection result response message Perform IP message encapsulation, and perform protection processing on the NAT probe response packet obtained after encapsulation, and then send it to the requesting node.
  • the responding node encapsulates the NAT detection response message or the NAT detection result response message into an IP packet, including:
  • the responding node encapsulates the second node information into the second IP header of the NAT probe response packet message; encapsulates the NAT probe response message or the NAT probe result response message into the second message of the NAT probe response packet message content.
  • the second node information of the above-mentioned responding node not only exists in the second IP header, but also is encapsulated in the content of the second packet.
  • the responding node When the responding node performs IP message encapsulation, it is necessary to first organize and form the payload data of the NAT detection response message or the NAT detection result response message of the responding node, and then encapsulate the NAT detection response message or the NAT detection result response message into an IP message to facilitate A NAT probe response packet is formed.
  • the responding node performs protection processing on the NAT probe response packet message, including:
  • the responding node performs at least one of encryption, data obfuscation, and integrity check on the NAT detection response packet message.
  • Performing protection processing on the NAT probe response packet message refers to performing protection processing on the second packet content in the NAT probe response packet message, and not performing protection processing on the second IP header in the NAT probe response packet message.
  • protection processing is consistent with the above-mentioned protection processing performed by the requesting node on the NAT detection request packet message, which will not be repeated here.
  • the requesting node receives the NAT detection response packet message and performs deprotection processing, and when obtaining a NAT detection result response message from the deprotected NAT detection response packet message, obtains the NAT detection result response message from the NAT detection result response message Obtaining a NAT detection result; or, when a NAT detection response message is obtained from the deprotected NAT detection response packet message, obtaining the load data of the NAT detection response message, and combining the obtained load data with the NAT detection The corresponding content in the second IP header of the response packet is compared, and the NAT detection result is determined according to the comparison result.
  • the NAT detection request packet sent by the requesting node to the responding node may encapsulate a NAT detection request message or a NAT detection result request message. It only needs to execute S105 or S106, and correspondingly, the requesting node in S107 only needs to obtain the NAT detection result through one of the methods according to the actual situation.
  • the requesting node performs deprotection processing on the protected NAT probe response packet message, including: the requesting node correspondingly decrypts the protected NAT probe response packet message, restores data, completes At least one process in the sex check.
  • the first node information also includes the port number of the requesting node itself, and the configured port number of the responding node; or, the first node information also includes the SID of the requesting node itself, and The configured SID of the responding node.
  • the second node information also includes the port number of the responding node itself, and the port number of the requesting node obtained from the first IP header of the NAT detection request packet message or, the second node information also includes the SID of the responding node itself, and the SID of the requesting node obtained from the first IP header of the NAT probe request packet.
  • IP address, port number, and SID of the responding node represent addresses that can send data to the responding node.
  • NAT detection also supports non-port protocols. Some protocols have no ports, but have SIDs, such as SID (Session Identifier, session identifier) detection that supports TUE (Tunnel Universal Encapsulating, tunnel universal encapsulation) , then the responding node can judge whether there is NAT according to the carrying situation of the IP address, port and SID in the first IP header, and the change of any one of them, and the requesting node can judge whether there is NAT according to the carrying situation of the IP address, port and SID in the second IP header According to the change of any one of them, it is judged whether there is NAT.
  • SID Session Identifier, session identifier
  • This application provides a NAT detection method that exists independently of the key management protocol, which is simple and reliable, and solves the confusion of function definitions and blurred boundaries caused by the tight coupling between NAT detection and key management protocols between network nodes.
  • the problem of difficult expansion of the key management function (for example, the NAT detection capability of this embodiment is completed by a protocol that carries an IP address, or an IP address and a port number, or an IP address and a session identifier SID, which has nothing to do with the key management protocol.
  • Key management is accomplished by a special key management protocol, and the strengthening and expansion of key management security will not be affected by the NAT detection capability); in addition, the NAT detection of this embodiment is realized by an independent protocol, not by modifying The key management protocol itself is implemented, and modifying the NAT detection capability will not affect the security capability of the key management protocol itself; it supports the diversity of NAT detection methods, and supports different detection methods that only determine whether there is NAT or determine the distribution location of NAT.
  • the response node When NAT exists or not, the response node only feeds back the NAT detection result, which reduces traffic and is more suitable for traffic-sensitive network environments; supports the protection of the NAT detection process, avoids internal address leakage, and prevents attackers from modifying detection messages to cause DoS attacks or network resources Waste, strengthen the overall security of the system.
  • the NAT detection request message or the NAT detection result request message or the NAT detection response message includes an identifier indicating the message type and length information used to resolve the number of IP addresses; by The identifier of the message type can distinguish the above three messages; the NAT detection result response message includes an identifier indicating whether there is NAT between the requesting node and the responding node; according to the indicating whether there is NAT between the requesting node and the responding node, it can be It is determined that the message type is a NAT detection result response message, and it can be determined whether NAT exists.
  • the length information may include the length of the payload data, or the payload data may include the number of request node/response node addresses, or the length of the message; the number of IP addresses can be parsed out through different types of length information.
  • the format of the NAT detection request message/NAT detection response message/NAT detection result request message/NAT detection result response message includes the following fields:
  • the identification field has multiple values, and the value definitions are shown in Table 1 below:
  • the value of the indication message type in the NAT probe request message is 1, the value of the indication message type in the NAT probe response message is 2, and the value of the indication message type in the NAT detection result request message is 3 , if there is no NAT, the value of the identifier in the NAT detection result response message is 4, and if there is NAT, the value of the identifier in the NAT detection result response message is 5.
  • the length information field is an optional field, and the number of IP addresses in the payload data can be parsed out through the length field.
  • the requesting node or the responding node may have multiple active and available IP addresses at the same time, so the information of these IP addresses should be included when constructing the NAT probe request message or NAT probe response message or NAT probe result request message ;
  • the length information field used for parsing the number of IP addresses is a required field; when the value of the above-mentioned identification field is 4 or 5, the length information field is invalid.
  • the payload data field is an optional field with a variable length, indicating the payload data of the NAT detection request message/NAT detection response message/NAT detection result request message; when the value of the above identification field is 1, 2, or 3, the payload data The field is a required field. When the value of the above identification field is 4 or 5, the payload data field is invalid.
  • the payload data field is used as the payload data of the NAT detection request message or the NAT detection result request message or the NAT detection response message, and the specific format is shown in the following table.
  • DST_PORT(SID) Indicates the peer port number or peer SID in the NAT probe request message or NAT probe result request message or NAT probe response message, an optional field with a length of 2 octets; if the current environment is IPv4 , this field is mandatory; if the current environment is IPv6, this field does not exist;
  • DST_IP Indicates the peer IP address in the NAT detection request message or NAT detection result request message or NAT detection response message.
  • the length of the field depends on the IP version of the current communication. If IPv4 communication is currently used, the length is 4 octets group, 16 octets in length if IPv6 communication is currently used;
  • SRC_PORT(SID) Indicates the source port number or source SID in the NAT probe request message or NAT probe result request message or NAT probe response message, an optional field with a length of 2 octets; if the current environment is IPv4, then This field is mandatory; if the current environment is IPv6, there is no such field;
  • SRC_IPn Indicates the local IP address available for current communication. The length depends on the IP version of the current communication and the number (n) of available IP addresses. If IPv4 communication is currently used, the length is 4*n octets; if IPv6 communication is currently used, the length is 16*n octets; "
  • n is equal to 1; for the requesting node, SRC_IPn is the IP address of the requesting node itself, SRC_PORT(SID) is the port number of the requesting node or the SID of the requesting node, and DST_IP is the address of the responding node IP address, DST_PORT(SID) is the port number or SID of the responding node; for the responding node, SRC_IPn is the IP address of the responding node itself, SRC_PORT(SID) is the port number or SID of the responding node, DST_IP is the IP of the requesting node address, DST_PORT(SID) is the port number or SID of the requesting node.
  • one or more SRC_IPs cannot exist in IPv4 and IPv6 at the same time, and must be only IPv4 or only IPv6, depending on the IP version of the current communication.
  • a node may have one or more local IP addresses, but which IP address to use in the communication process is not known in advance, and can only be known after the communication is completed.
  • the sending end is a requesting node and the receiving end is a responding node
  • the number of IP addresses of the requesting node in the NAT detection request message is 1, and the response node determines the NAT detection result according to the comparison result, including any of the following steps:
  • Step A When the IP address of the requesting node in the load data obtained by the responding node is different from the IP address of the requesting node in the first IP header, or, the port number of the requesting node in the obtained load data is different from that of the requesting node in the first IP header Port numbers are different, or, when the SID of the requesting node in the obtained load data is different from the SID of the requesting node in the first IP header, it is determined that NAT exists between the requesting node and the network; otherwise, it is determined that there is no NAT between the requesting node and the network.
  • the number of IP addresses of the requesting node is 1.
  • the responding node when any of the following conditions are resolved during the comparison process, it is determined that there is NAT between the requesting node and the network:
  • the IP address of the requesting node in the payload data is different from the IP address of the requesting node in the first IP header;
  • the IP address of the requesting node in the payload data is different from the IP address of the requesting node in the first IP header, and/or, the request in the payload data
  • the port number of the node is different from the port number of the requesting node in the first IP header
  • the IP address of the requesting node in the payload data is different from the IP address of the requesting node in the first IP header, and/or, the requesting node in the payload data
  • the SID is different from the requesting node's SID in the first IP header.
  • Step B When the IP address of the responding node in the load data obtained by the responding node is different from the IP address of the responding node in the first IP header, or, the port number of the responding node in the obtained load data is different from the port number of the responding node in the first IP header If the port numbers are different, or when the SID of the responding node in the obtained load data is different from the SID of the responding node in the first IP header, it is determined that there is NAT between the responding node and the network; otherwise, it is determined that there is no NAT between the responding node and the network.
  • the number of IP addresses of the requesting node is 1.
  • the responding node when any of the following conditions are resolved during the comparison process, it is determined that there is NAT between the responding node and the network:
  • the IP address of the responding node in the payload data is different from the IP address of the responding node in the first IP header;
  • the IP address of the responding node in the payload data is different from the IP address of the responding node in the first IP header, and/or, the response node in the payload data
  • the port number of the node is different from the port number of the responding node in the first IP header
  • the IP address of the responding node in the payload data is different from the IP address of the responding node in the first IP header, and/or, the responding node in the payload data
  • the SID is different from the SID of the responding node in the first IP header.
  • the sending end is the requesting node and the receiving end is the responding node
  • the number of IP addresses of the requesting node in the NAT detection request message is greater than 1, and the response node determines the NAT detection result according to the comparison result, including any of the following steps:
  • Step A when all the IP addresses of the requesting node in the load data obtained by the responding node are different from the IP addresses of the requesting node in the first IP header, or, the port number of the requesting node in the obtained load data is different from that of the requesting node in the first IP header.
  • the port numbers of the nodes are different, or if the SID of the requesting node in the obtained payload data is different from the SID of the requesting node in the first IP header, it is determined that there is NAT between the requesting node and the network; otherwise, it is determined that there is no NAT between the requesting node and the network .
  • IP addresses of the requesting node are encapsulated in the content of the first message, and the system only adds one IP address to be used in the first IP header when sending.
  • the responding node when any of the following conditions are resolved during the comparison, it is determined that there is NAT between the requesting node and the network:
  • Step B when the IP address of the responding node in the load data obtained by the responding node is different from the IP address of the responding node in the first IP header, or, the port number of the responding node in the obtained load data is different from the port number of the responding node in the first IP header If the port numbers are different, or when the SID of the responding node in the obtained load data is different from the SID of the responding node in the first IP header, it is determined that there is NAT between the responding node and the network; otherwise, it is determined that there is no NAT between the responding node and the network.
  • method 1 when the response node feeds back a NAT detection response message to the requesting node, the requesting node determines the NAT detection result according to the comparison result; method 2, if the responding node sends the requesting node When the NAT detection result response message is fed back, the requesting node obtains the NAT detection result directly from the NAT detection result response message.
  • the sending end is the responding node and the receiving end is the requesting node
  • the number of IP addresses of the responding node in the NAT detection response message is 1, and the requesting node determines the NAT detection result according to the comparison result, including:
  • Step A When the IP address of the responding node in the load data obtained by the requesting node is different from the IP address of the responding node in the second IP header, or, the port number of the responding node in the obtained load data is different from that of the responding node in the second IP header If the port numbers are different, or if the SID of the responding node in the obtained load data is different from the SID of the responding node in the second IP header, it is determined that there is NAT between the responding node and the network; otherwise, it is determined that there is no NAT between the responding node and the network.
  • the responding node organizes the load data
  • the number of IP addresses of the responding node is 1.
  • the requesting node when any of the following conditions are resolved during the comparison process, it is determined that there is NAT between the responding node and the network:
  • the IP address of the responding node in the payload data is different from the IP address of the responding node in the second IP header;
  • the second node information as the payload data stores the IP address and port number of the responding node
  • the IP address of the responding node in the payload data is different from the IP address of the responding node in the second IP header, and/or, the response node in the payload data
  • the port number of the node is different from the port number of the responding node in the second IP header
  • the IP address of the responding node in the payload data is different from the IP address of the responding node in the second IP header, and/or, the responding node in the payload data
  • the SID is different from the SID of the responding node in the second IP header.
  • Step B When the IP address of the requesting node in the payload data obtained by the requesting node is different from the IP address of the requesting node in the second IP header, or, the port number of the requesting node in the obtained payload data is different from that of the requesting node in the second IP header If the port numbers are different, or when the SID of the requesting node in the obtained load data is different from the SID of the requesting node in the second IP header, it is determined that there is NAT between the requesting node and the network; otherwise, it is determined that there is no NAT between the requesting node and the network.
  • the responding node organizes the load data
  • the number of IP addresses of the responding node is 1.
  • the requesting node when any of the following conditions are resolved during the comparison process, it is determined that there is NAT between the requesting node and the network:
  • the IP address of the requesting node in the payload data is different from the IP address of the requesting node in the second IP header;
  • the IP address of the requesting node in the payload data is different from the IP address of the requesting node in the second IP header, and/or, the request in the payload data
  • the port number of the node is different from the port number of the requesting node in the second IP header
  • the IP address of the requesting node in the payload data is different from the IP address of the requesting node in the second IP header, and/or, the requesting node in the payload data
  • the SID is different from the requesting node's SID in the second IP header.
  • the sending end is a responding node and the receiving end is a requesting node
  • the number of IP addresses of the responding node in the NAT detection response message is greater than 1
  • the requesting node determines the NAT detection result according to the comparison result, including:
  • Step A When all the IP addresses of the responding node in the payload data obtained by the requesting node are different from the IP addresses of the responding node in the second IP header, or, the port number of the responding node in the obtained payload data is different from that in the second IP header. If the port numbers of the nodes are different, or if the SID of the responding node in the obtained load data is different from the SID of the responding node in the second IP header, it is determined that there is NAT between the responding node and the network; otherwise, it is determined that there is no NAT between the responding node and the network .
  • IP addresses of the responding node are encapsulated in the content of the second message, and when sending, the system only adds one IP address to be used in the second IP header.
  • the requesting node when any of the following conditions are resolved during the comparison, it is determined that there is NAT between the responding node and the network:
  • Step B When the IP address of the requesting node in the payload data obtained by the requesting node is different from the IP address of the requesting node in the second IP header, or, the port number of the requesting node in the obtained payload data is different from that of the requesting node in the second IP header If the port numbers are different, or when the SID of the requesting node in the obtained load data is different from the SID of the requesting node in the second IP header, it is determined that there is NAT between the requesting node and the network; otherwise, it is determined that there is no NAT between the requesting node and the network.
  • the response node can selectively save the NAT detection result information, and obtain the first The detection result or the second detection result.
  • the NAT detection result determined by the requesting node or the responding node according to the comparison result is the second detection result
  • the detection result carried in the NAT detection result response message is the first detection result.
  • the first detection result is a detection result indicating whether there is NAT between the requesting node and the responding node;
  • the second detection result is indicating whether there is NAT between the requesting node and the responding node, and the The distribution position of the NAT when there is a NAT in between.
  • the responding node when the IP address of the requesting node in the obtained payload data is different from the IP address of the requesting node in the first IP header, but the port number/SID of the requesting node in the payload data is the same as When the port number/SID of the requesting node in the first IP header is the same, the corresponding log information is generated and saved for the detection process;
  • the corresponding log information is generated and saved for the detection process.
  • an embodiment of the present invention also provides a NAT detection device between network nodes, which is configured on a requesting node, as shown in FIG. 3 , including:
  • An obtaining module 301 configured to obtain first node information, and use the obtained first node information as payload data of a NAT detection request message or a NAT detection result request message, where the first node information includes the requesting node's own IP address, and The configured IP address of the responding node;
  • An encapsulation module 302 configured to encapsulate the NAT detection request message or the NAT detection result request message into an IP packet, and perform protection processing on the NAT detection request packet obtained after encapsulation and send it to the response node;
  • the determination module 303 is configured to receive a NAT detection response packet message and perform deprotection processing, and when a NAT detection result response message is obtained from the NAT detection result response message after deprotection processing, from the NAT detection result response message Obtaining a NAT detection result; or, when a NAT detection response message is obtained from the deprotected NAT detection response packet message, obtaining the load data of the NAT detection response message, and combining the obtained load data with the NAT detection The corresponding content in the second IP header of the response packet is compared, and the NAT detection result is determined according to the comparison result.
  • the first node information also includes the port number of the requesting node itself, and the configured port number of the responding node; or the first node information also includes the SID of the requesting node itself, and the configured SID of the responding node .
  • the encapsulation module 302 encapsulates the NAT detection request message or the NAT detection result request message into an IP packet, including:
  • the NAT probe request message or the NAT probe result request message or the NAT probe response message includes an identifier indicating a message type and length information for parsing the number of IP addresses;
  • the NAT detection result response message includes an identifier indicating whether NAT exists between the requesting node and the responding node.
  • the encapsulation module 302 performs protection processing on the NAT detection request packet message, including:
  • the encapsulation module 302 performs at least one process of encryption, data obfuscation, and integrity check on the NAT detection request packet message.
  • the determining module 303 performs deprotection processing on the NAT probe response packet message, including:
  • the determining module 303 performs at least one process of decryption, data restoration, and integrity check on the NAT probe response packet message.
  • the determination module 303 determines the NAT detection result according to the comparison result, including:
  • the IP address of the responding node in the acquired load data is different from the IP address of the responding node in the second IP header, or the port number of the responding node in the load data is different from the port number of the responding node in the second IP header , or, when the SID of the responding node in the payload data is different from the SID of the responding node in the second IP header, determine that there is NAT between the responding node and the network; otherwise, determine that there is no NAT between the responding node and the network;
  • the IP address of the requesting node in the obtained load data is different from the IP address of the requesting node in the second IP header, or, the port number of the requesting node in the load data is different from the port number of the requesting node in the second IP header number is different, or, when the SID of the requesting node in the payload data is different from the SID of the requesting node in the second IP header, it is determined that NAT exists between the requesting node and the network; otherwise, it is determined that there is no NAT between the requesting node and the network.
  • the NAT detection result determined by the determining module 303 according to the comparison result is the second detection result, and the detection result carried in the NAT detection result response message is the first detection result;
  • the first detection result is a detection result indicating whether there is NAT between the requesting node and the responding node;
  • the second detection result includes indicating whether there is NAT between the requesting node and the responding node, and when there is NAT between the requesting node and the responding node, the distribution position of the NAT.
  • the embodiment of the present invention also provides a NAT detection device between network nodes, which is configured on a response node, as shown in FIG. 4 , including:
  • the receiving module 401 is configured to receive a NAT detection request packet message, and perform deprotection processing on the received NAT detection request packet message;
  • a determining module 402 configured to obtain the NAT detection request message or the NAT detection result request message from the deprotected NAT detection request packet message, and obtain the payload data in the obtained NAT detection request message or the NAT detection result request message Compared with the corresponding content in the first IP header of the NAT detection request packet message, determine the NAT detection result according to the comparison result;
  • An obtaining module 403, configured to obtain second node information when the NAT detection request message is obtained from the deprotected NAT detection request packet message, the second node information includes the IP address of the responding node itself, and Obtain the IP address of the requesting node from the first IP header of the NAT detection request packet message, and use the second node information as the payload data of the NAT detection response message, and encapsulate the NAT detection response message into an IP packet , and perform protection processing on the NAT detection response packet obtained after encapsulation, and then send it to the requesting node; or, when obtaining the NAT detection result request message from the NAT detection request packet after deprotection processing, Carrying the NAT detection result in a NAT detection result response message, encapsulating the NAT detection result response message in an IP message, and performing protection processing on the encapsulated NAT detection response packet message and sending it to the requesting node.
  • the second node information also includes the port number of the responding node itself, and the port number of the requesting node obtained from the first IP header of the NAT probe request packet; or the second node information It also includes the SID of the responding node itself, and the SID of the requesting node obtained from the first IP header of the NAT detection request packet message.
  • the obtaining module 403 encapsulates the NAT detection response message or the NAT detection result response message into an IP packet, including:
  • the receiving module 401 performs deprotection processing on the NAT detection request packet message, including:
  • the receiving module 401 performs at least one process of decryption, data restoration, and integrity check on the NAT detection request packet message.
  • the obtaining module 403 performs protection processing on the NAT probe response packet message, including:
  • the acquiring module 403 performs at least one process of encryption, data obfuscation, and integrity check on the NAT probe response packet message.
  • the determination module 402 determines the NAT detection result according to the comparison result, including any of the following steps:
  • the IP address of the requesting node in the obtained payload data is different from the IP address of the requesting node in the first IP header, or the port number of the requesting node in the payload data is different from the port number of the requesting node in the first IP header , or, when the SID of the requesting node in the payload data is different from the SID of the requesting node in the first IP header, it is determined that NAT exists between the requesting node and the network; otherwise, it is determined that there is no NAT between the requesting node and the network;
  • the port number of the responding node in the load data is different from the response node in the first IP header
  • the port numbers of the nodes are different, or, when the SID of the responding node in the payload data is different from the SID of the responding node in the first IP header, it is determined that there is NAT between the responding node and the network; otherwise, it is determined that there is no NAT between the responding node and the network. NAT exists.
  • the NAT detection result determined by the determining module 402 according to the comparison result is the second detection result, and the detection result carried in the NAT detection result response message is the first detection result;
  • the first detection result is a detection result indicating whether there is NAT between the requesting node and the responding node;
  • the second detection result includes indicating whether there is NAT between the requesting node and the responding node, and the distribution position of the NAT when there is NAT between the requesting node and the responding node.
  • an embodiment of the present invention also provides a NAT detection device between network nodes, which is configured on a requesting node.
  • the device includes: a memory 501 for storing program instructions; a processor 502 for To call the program instructions stored in the memory, perform the following process according to the obtained program:
  • the first node information includes the IP address of the requesting node itself, and the IP address of the configured response node address;
  • the first node information also includes the port number of the requesting node itself, and the configured port number of the responding node; or, the first node information also includes the requesting node’s own SID, and the configured response node’s SID.
  • Encapsulating the NAT detection request message or the NAT detection result request message into an IP packet including:
  • the NAT detection request message or the NAT detection result request message or the NAT detection response message includes an identifier indicating the message type and length information for parsing the number of IP addresses; the NAT detection result response The message includes an identifier indicating whether NAT exists between the requesting node and the responding node.
  • Protecting the NAT detection request packet includes: performing at least one of encryption, data obfuscation, and integrity check on the NAT detection request packet.
  • Deprotecting the NAT probe response packet includes: performing at least one of decryption, data restoration, and integrity check on the NAT probe response packet.
  • the IP address of the requesting node in the obtained load data is different from the IP address of the requesting node in the second IP header, or, the port number of the requesting node in the load data is different from the port number of the requesting node in the second IP header number is different, or, when the SID of the requesting node in the payload data is different from the SID of the requesting node in the second IP header, it is determined that NAT exists between the requesting node and the network; otherwise, it is determined that there is no NAT between the requesting node and the network.
  • the NAT detection result determined according to the comparison result is the second detection result, and the detection result carried in the NAT detection result response message is the first detection result;
  • the first detection result indicates whether the request node and the response node are There is a detection result of NAT;
  • the second detection result includes indicating whether there is NAT between the requesting node and the responding node, and the distribution position of the NAT when there is NAT between the requesting node and the responding node.
  • an embodiment of the present invention also provides a NAT detection device between network nodes, which is configured on a response node.
  • the device includes: a memory 601 for storing program instructions; a processor 602 for To call the program instructions stored in the memory, perform the following process according to the obtained program:
  • the second node information When the NAT detection request message is obtained from the deprotected NAT detection request packet message, the second node information is obtained, and the second node information includes the IP address of the responding node itself, and the NAT detection request from the NAT detection request
  • the IP address of the request node obtained in the first IP header of the packet message, and the second node information is used as the payload data of the NAT detection response message, and the NAT detection response message is encapsulated in an IP message, and the obtained
  • the NAT detection response packet message is sent to the requesting node after protection processing; or, when the NAT detection result request message is obtained from the NAT detection request packet message after deprotection processing, the NAT detection result carrying in the NAT detection result response message, encapsulating the NAT detection result response message in an IP packet, and performing protection processing on the NAT detection response packet obtained after encapsulation, and then sending it to the requesting node.
  • the second node information also includes the port number of the responding node itself, and the port number of the requesting node obtained from the first IP header of the NAT probe request packet; or, the second node The information also includes the SID of the responding node itself, and the SID of the requesting node obtained from the first IP header of the NAT detection request packet.
  • Encapsulating the NAT probe response message or the NAT probe result response message into an IP message includes: encapsulating the second node information into the second IP header of the NAT probe response packet message; encapsulating the NAT probe response message Or the NAT detection result response message is encapsulated into the second packet content of the NAT detection response packet packet.
  • Deprotecting the NAT detection request packet includes: performing at least one of decryption, data restoration, and integrity check on the NAT detection request packet.
  • Protecting the NAT probe response packet includes: performing at least one of encryption, data obfuscation, and integrity check on the NAT probe response packet.
  • the port number of the responding node in the load data is different from the response node in the first IP header
  • the port numbers of the nodes are different, or, when the SID of the responding node in the payload data is different from the SID of the responding node in the first IP header, it is determined that there is NAT between the responding node and the network; otherwise, it is determined that there is no NAT between the responding node and the network. NAT exists.
  • the NAT detection result determined according to the comparison result is the second detection result, and the detection result carried in the NAT detection result response message is the first detection result;
  • the first detection result indicates whether the request node and the response node are There is a detection result of NAT;
  • the second detection result includes indicating whether there is NAT between the requesting node and the responding node, and the distribution position of the NAT when there is NAT between the requesting node and the responding node.
  • an embodiment of the present invention also provides a computer storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the inter-network NAT detection method provided in the first embodiment above is realized A step of.
  • the disclosed system, device and method can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division.
  • multiple modules or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or modules may be in electrical, mechanical or other forms.
  • the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or may be distributed to multiple network modules. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional module in each embodiment of the present application may be integrated into one processing module, each module may exist separately physically, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules. If the integrated modules are realized in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server, or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • wired eg, coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless eg, infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (such as a floppy disk, a hard disk, or a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (Solid State Disk, SSD)), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种网络节点间NAT探测方法、装置、设备及存储介质，包括：请求节点获取第一节点信息，并将获取的第一节点信息作为NAT探测请求消息或NAT探测结果请求消息的载荷数据，并将NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，对封装后得到的NAT探测请求分组报文进行保护处理后发送至响应节点；响应节点对接收的NAT探测请求分组报文进行解保护处理后获取NAT探测请求消息或NAT探测结果请求消息的载荷数据，将获取的载荷数据与NAT探测请求分组报文的第一IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果。解决了网络节点间NAT探测与密钥管理协议紧耦合而造成的密钥管理功能扩展难的问题。

Description

一种网络节点间NAT探测方法、装置、设备及存储介质
相关申请的交叉引用
本申请要求在2022年01月05日提交中国专利局、申请号为202210005432.6、申请名称为“一种网络节点间NAT探测方法、装置及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信技术领域，特别涉及一种网络节点间NAT探测方法、装置、设备及存储介质。
背景技术
由于Internet网络设计之初，基本没有把安全设计在内，因此网络通信存在很大安全隐患；随着时间的推移，技术的发展，网络在人们的生活中随处可见，其安全隐患也暴露无遗，威胁着人们的财产、安全；在这种情况下就出现了诸如互联网安全协议IPsec等安全通信协议，来弥补最初网络设计时没有考虑安全需求的缺陷。但是由于在Internet上有网络地址转换(Network Address Translation，简称NAT)的存在，部署诸如IPsec等安全通信协议工程时又无法知道部署环境是否存在NAT设备(因为是否存在NAT设备决定着安全通信保障方式)，所以就需要通过NAT探测方法来确定诸如IPsec等安全通信协议如何保障安全通信。
现阶段，安全通信协议没有一个NAT探测的统一解决方案，一般使用密钥管理协议进行NAT探测，例如IPsec使用秘钥管理协议IKE(Internet Key Exchange)进行NAT探测；但是使用IKE进行NAT探测还存在如下缺陷：
功能界定混乱，边界模糊，不利于密钥管理协议对密钥管理功能的扩展。例如，IPsec进行NAT探测使用密钥管理协议IKE的“通告载荷”实现，“通告载荷”是密钥管理协议的一部分，如果进行密钥管理功能的扩展(如，进一步加强密钥管理的安全性)，由于受NAT探测功能支持的限制，存在内部IP地址的暴露风险，反而使安全性降低。
发明内容
本发明实施例提供一种网络节点间NAT探测方法、装置、设备及存储介质，用以解决现有技术中类似IPsec使用IKE进行NAT探测时，由于NAT探测与密钥管理协议紧耦合而造成的密钥管理功能扩展难且引入安全漏洞问题。
第一方面，本发明实施例提供一种网络节点间NAT探测方法，包括：
请求节点获取第一节点信息，并将获取的第一节点信息作为NAT探测请求消息或NAT探测结果请求消息的载荷数据，所述第一节点信息包括请求节点自身的IP地址，及配置的响应节点的IP地址；
请求节点将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，并对封装后得到的NAT探测请求分组报文进行保护处理后发送至响应节点；
响应节点接收所述NAT探测请求分组报文，并对接收的NAT探测请求分组报文进行解保护处理；
响应节点从解保护处理后的NAT探测请求分组报文中获取所述NAT探测请求消息或NAT探测结果请求消息，将获取的NAT探测请求消息或NAT探测结果请求消息中的载荷数据与所述NAT探测请求分组报文的第一IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果；
响应节点从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测请求消息时，获取第二节点信息，所述第二节点信息包括响应节点自身的IP地址，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的IP地址，并将第二节点信息作为NAT探测响应消息的载荷数据，将所述NAT探测响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点；或者，响应节点从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测结果请求消息时，将所述NAT探测结果携带在NAT探测结果响应消息，将所述NAT探测结果响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点；
请求节点接收所述NAT探测响应分组报文并进行解保护处理，从解保护处理后的NAT探测响应分组报文中获取到NAT探测结果响应消息时，从所述NAT探测结果响应消息中获取NAT探测结果；或者，从解保护处理后的NAT探测响应分组报文中获取到NAT探测响应消息时，获取所述NAT探测响应消息的载荷数据，并将获取的载荷数据与所述NAT探测响应分组报文的第二IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果。
可选地，所述第一节点信息还包括请求节点自身的端口号，及配置的响应节点的端口号；或者所述第一节点信息还包括请求节点自身的SID，及配置的响应节点的SID；
所述第二节点信息还包括响应节点自身的端口号，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的端口号；或者所述第二节点信息还包括响应节点自身的SID，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的SID。
可选地，所述请求节点将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，包括：
将所述第一节点信息封装到NAT探测请求分组报文的第一IP报头中；
将所述NAT探测请求消息或NAT探测结果请求消息封装到NAT探测请求分组报文的第一报文内容中；
所述响应节点将所述NAT探测响应消息或NAT探测结果响应消息进行IP报文封装，包括：
将所述第二节点信息封装到NAT探测响应分组报文的第二IP报头中；
将所述NAT探测响应消息或NAT探测结果响应消息封装到NAT探测响应分组报文的第二报文内容中。
可选地，所述NAT探测请求消息或所述NAT探测结果请求消息或所述NAT探测响应消息，包括指示消息类型的标识、用于解析IP地址个数的长度信息；
所述NAT探测结果响应消息，包括指示请求节点和响应节点间是否存在NAT的标识。
可选地，请求节点对所述NAT探测请求分组报文进行保护处理，包括：
请求节点对所述NAT探测请求分组报文进行加密、数据混淆、完整性校验中的至少一项处理；
响应节点对所述NAT探测请求分组报文进行解保护处理，包括：
响应节点对所述NAT探测请求分组报文进行解密、数据还原、完整性校验中的至少一项处理。
可选地，响应节点对所述NAT探测响应分组报文进行保护处理，包括：
响应节点对所述NAT探测响应分组报文进行加密、数据混淆、完整性校验中的至少一项处理；
请求节点对所述NAT探测响应分组报文进行解保护处理，包括：
请求节点对所述NAT探测响应分组报文进行解密、数据还原、完整性校验中的至少一项处理。
可选地，响应节点根据对比结果确定NAT探测结果，包括如下任一步骤：
当获取的载荷数据中的请求节点的IP地址与第一IP报头中的请求节点的IP地址不同，或者，所述载荷数据中请求节点的端口号与第一IP报头中请求节点的端口号不同，或者，所述载荷数据中请求 节点的SID与第一IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT；
当获取的载荷数据中的响应节点的IP地址与所述第一IP报头中的响应节点的IP地址不同，或者，所述载荷数据中响应节点的端口号与所述第一IP报头中的响应节点的端口号不同，或者，所述载荷数据中响应节点的SID与所述第一IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT。
可选地，请求节点根据对比结果确定NAT探测结果，包括：
当获取的载荷数据中的响应节点的IP地址与第二IP报头中的响应节点的IP地址不同，或者，所述载荷数据中响应节点的端口号与第二IP报头中响应节点的端口号不同，或者，所述载荷数据中响应节点的SID与第二IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT；
当获取的载荷数据中请求节点的IP地址与所述第二IP报头中请求节点的IP地址不同，或者，所述载荷数据中请求节点的端口号与所述第二IP报头中请求节点的端口号不同，或者，所述载荷数据中请求节点的SID与所述第二IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT。
可选地，所述请求节点或响应节点根据对比结果确定的NAT探测结果为第二探测结果，所述携带在NAT探测结果响应消息中的探测结果为第一探测结果；
所述第一探测结果为指示所述请求节点和响应节点间是否存在NAT的探测结果；
所述第二探测结果包括指示所述请求节点和响应节点间是否存在NAT，及所述请求节点和响应节点之间存在NAT时，所述NAT的分布位置。
第二方面，本发明实施例还提供一种网络节点间NAT探测装置，配置于请求节点，包括：
获取模块，用于获取第一节点信息，并将获取的第一节点信息作为NAT探测请求消息或NAT探测结果请求消息的载荷数据，所述第一节点信息包括请求节点自身的IP地址，及配置的响应节点的IP地址；
封装模块，用于将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，并对封装后得到的NAT探测请求分组报文进行保护处理后发送至响应节点；
确定模块，用于接收NAT探测响应分组报文并进行解保护处理，从解保护处理后的NAT探测响应分组报文中获取到NAT探测结果响应消息时，从所述NAT探测结果响应消息中获取NAT探测结果；或者，从解保护处理后的NAT探测响应分组报文中获取到NAT探测响应消息时，获取所述NAT探测响应消息的载荷数据，并将获取的载荷数据与所述NAT探测响应分组报文的第二IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果。
第三方面，本发明实施例还提供一种网络节点间NAT探测装置，配置于响应节点，包括：
接收模块，用于接收NAT探测请求分组报文，并对接收的NAT探测请求分组报文进行解保护处理；
确定模块，用于从解保护处理后的NAT探测请求分组报文中获取所述NAT探测请求消息或NAT探测结果请求消息，将获取的NAT探测请求消息或NAT探测结果请求消息中的载荷数据与所述NAT探测请求分组报文的第一IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果；
获取模块，用于从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测请求消息时，获取第二节点信息，所述第二节点信息包括响应节点自身的IP地址，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的IP地址，并将第二节点信息作为NAT探测响应消息的载荷数据， 将所述NAT探测响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点；或者，用于从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测结果请求消息时，将所述NAT探测结果携带在NAT探测结果响应消息，将所述NAT探测结果响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点。
第四方面，本发明实施例还提供一种网络节点间NAT探测设备，配置于请求节点，所述设备包括：存储器，用于存储程序指令；处理器，用于调用所述存储器存储的程序指令，按照获得的程序执行上述第一方面提供的网络节点间NAT探测方法的步骤。
第五方面，本发明实施例还提供一种网络节点间NAT探测设备，配置于响应节点，所述设备包括：存储器，用于存储程序指令；处理器，用于调用所述存储器存储的程序指令，按照获得的程序执行上述第一方面提供的网络节点间NAT探测方法的步骤。
第六方面，本发明实施例还提供一种计算机存储介质，其上存储有计算机程序，该程序被处理器执行时实现上述第一方面提供的网络节点间NAT探测方法的步骤。
本发明有益效果如下：
本申请提供了独立于密钥管理协议而单独存在的一种NAT探测方法，简单、可靠，解决了网络节点间NAT探测与密钥管理协议紧耦合而造成的功能界定混乱、边界模糊所带来的密钥管理功能扩展难的问题(例如，本申请的NAT探测能力由与密钥管理协议无关的携带IP地址、或IP地址和端口号、或IP地址和会话标识SID的协议完成，密钥管理由专门的密钥管理协议来完成，密钥管理安全性的加强及扩展，不会受NAT探测能力的影响)；此外，本申请的NAT探测是由独立的协议实现，不是通过修改密钥管理协议本身实现，修改NAT探测能力不会影响密钥管理协议本身的安全能力；支持NAT探测方法多样性，支持仅确定是否存在NAT或确定NAT分布位置的不同的探测方式；在仅确定是否存在NAT时，响应节点仅反馈NAT探测结果，减少通信量，更适应流量敏感的网络环境；支持对NAT探测过程的保护，避免内部地址泄露，避免攻击者修改探测消息导致DoS攻击或网络资源浪费，加强了系统的整体安全性。
附图说明
图1为本发明实施例提供的一种网络节点间NAT探测方法的流程示意图；
图2为本发明实施例提供的请求节点与响应节点间存在NAT时的NAT分布位置示意图；
图3为本发明实施例提供的一种配置于请求节点的NAT探测装置的结构示意图；
图4为本发明实施例提供的一种配置于响应节点的NAT探测装置的结构示意图；
图5为本发明实施例提供的一种配置于请求节点的NAT探测设备的模块示意图；
图6为本发明实施例提供的一种配置于响应节点的NAT探测设备的模块示意图。
具体实施方式
下面结合附图，对本发明实施例提供的网络节点间NAT探测方法、装置、设备及存储介质进行具体说明。
本发明实施例提供了一种网络节点间NAT探测方法，如图1所示，包括：
S101、请求节点获取第一节点信息，并将获取的第一节点信息作为NAT探测请求消息或NAT探测结果请求消息的载荷数据，所述第一节点信息包括请求节点自身的IP地址，及配置的响应节点的IP地址。
上述NAT探测请求消息与NAT探测结果请求消息的格式相同，属于不同消息类型，若请求节点 需要确定是否存在NAT，及存在NAT时NAT的分布位置，则需向响应节点发送NAT探测请求消息，若请求节点仅需要确定与响应节点间是否存在NAT时，则需向响应节点发送NAT探测结果请求消息。
上述NAT探测请求消息或NAT探测结果请求消息的载荷数据相同，载荷数据内容包括：请求节点自身的IP地址，响应节点的IP地址。但是需要注意的是，响应节点的地址可由管理员配置，因为初始情况下，需要明确告知请求节点向哪个响应节点发送。
S102、请求节点将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，并对封装后得到的NAT探测请求分组报文进行保护处理后发送至响应节点。
作为一种可选的实施方式，请求节点需向响应节点发送NAT探测请求消息时，将所述NAT探测请求消息进行IP报文封装，包括：
请求节点将第一节点信息封装到NAT探测请求分组报文的第一IP报头中；将所述NAT探测请求消息封装到NAT探测请求分组报文的第一报文内容中。
作为另一种可选的实施方式，请求节点需向响应节点发送NAT探测结果请求消息时，将所述NAT探测结果请求消息进行IP报文封装，包括：
请求节点将第一节点信息封装到NAT探测请求分组报文的第一IP报头中；将所述NAT探测结果请求消息封装到NAT探测请求分组报文的第一报文内容中。
需要说明的是，上述请求节点的第一节点信息，在组织NAT探测请求分组报文时，既存在于第一IP报头中，也会被封装在第一报文内容中。
假设发起端是请求节点，接收端是响应节点，请求节点进行IP报文封装的时候，需要首先组织形成请求节点的NAT探测请求消息或NAT探测结果请求消息的载荷数据，再将NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，便形成NAT探测请求分组报文。
需要说明的是，本申请中请求节点或响应节点自身的地址称为私有地址，将请求节点或响应节点在网络中传输报文时封装到报头中的地址称为公有地址。对于请求节点或响应节点，若经NAT进行网络地址转换传输报文时，则公有地址与私有地址为不同的地址；若未经NAT进行网络地址转换传输报文时，则公有地址与私有地址为相同的地址。
参见图2所示的请求节点与响应节点间存在NAT时，NAT的分布位置示意图，包括三种情况：
情况一，请求节点与网络间存在NAT，响应节点与网络间不存在NAT；
封装到第一IP报头中的请求节点的IP地址是私有地址，响应节点的IP地址是响应节点自身的公有地址，同时也是私有地址。上述经保护处理的NAT探测请求分组报文在经过NAT时，第一IP报头中的请求节点的私有IP地址会被NAT更改为不同的公有地址。
情况二，请求节点与网络间不存在NAT，响应节点与网络间存在NAT；
封装到第一IP报头中的请求节点的IP地址是请求节点自身的私有地址，同时也是公有地址，响应节点的IP地址是公有地址，上述经保护处理的NAT探测请求分组报文在经过NAT时，第一IP报头中的响应节点的公有IP地址会被NAT改变为不同的私有地址。
情况三，请求节点与网络间存在NAT，响应节点与网络间存在NAT；
封装到第一IP报头中的请求节点的IP地址是私有地址，响应节点的IP地址是公有地址。上述经保护处理的NAT探测请求分组报文在经过请求节点与网络间的NAT时，第一IP报头中的请求节点的私有IP地址会被NAT更改为不同的公有地址，在经过响应节点与网络间的NAT时，第一IP报头中的响应节点的公有IP地址会被NAT改变为不同的私有地址。
若请求节点与响应节点间不存在NAT，即请求节点与网络间不存在NAT、响应节点与网络间不存在NAT，则封装到第一IP报头中的请求节点的IP地址是请求节点自身的私有地址，同时也是在网络 传输中使用的公有地址，响应节点的IP地址是响应节点自身的公有地址，同时也是在网络传输中使用的公有地址。
上面仅是示例解释了IP地址的改变情况，对于端口和SID的改变规则与IP地址相同的情况，这里不再重述。
作为一种可选的实施方式，请求节点对所述NAT探测请求分组报文进行保护处理，包括：
请求节点对NAT探测请求分组报文进行加密、数据混淆、完整性校验中的至少一项处理。具体来讲，对NAT探测请求分组报文进行保护处理，是对NAT探测请求分组报文中的第一报文内容进行保护处理，不对NAT探测请求分组报文中的第一IP报头进行保护处理。
需要说明的是，请求节点对NAT探测请求分组报文进行保护处理，形成受保护的NAT探测请求分组报文。因NAT探测请求消息中可能包含敏感信息，对NAT探测请求分组报文进行保护处理可以防止内部私有IP地址等敏感信息泄露，所以NAT探测请求分组报文在传输过程中需要进行私密性和完整性校验处理，由此可以防止攻击者通过篡改信息而发起DoS攻击(例如，IPsec没有对NAT探测信息进行保护，攻击者可以通过删除或增加NAT发现(NAT-Discovery，简称NAT-D)载荷，从而发起DoS攻击)的情况，解决了攻击者篡改信息而造成带宽浪费的问题(例如，在IPsec中，在没有NAT的环境下，攻击者可以通过篡改NAT检测报文，造成协商双方都使用用户数据报协议(User Datagram Protocol，简称UDP)封装模式，从而造成带宽的浪费)。
S103、响应节点接收所述NAT探测请求分组报文，并对接收的NAT探测请求分组报文进行解保护处理。
作为一种可选的实施方式，响应节点对经保护处理的NAT探测请求分组报文进行解保护处理，包括：响应节点对经保护处理的NAT探测请求分组报文相应进行解密、数据还原、完整性校验中的至少一项处理。
S104、响应节点从解保护处理后的NAT探测请求分组报文中获取NAT探测请求消息或NAT探测结果请求消息，将获取的NAT探测请求消息或NAT探测结果请求消息中的载荷数据与所述NAT探测请求分组报文的第一IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果。
需要说明的是，响应节点通过对比第一IP报头和NAT探测请求消息或NAT探测结果请求消息的载荷数据中的IP地址，确定请求节点或响应节点的IP地址在网络传输时是否经过NAT进行地址转换，从而可以解析出请求节点和响应节点间的NAT探测结果。
S105、响应节点从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测请求消息时，获取第二节点信息，所述第二节点信息包括响应节点自身的IP地址，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的IP地址，并将第二节点信息作为NAT探测响应消息的载荷数据，将所述NAT探测响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点。
S106、响应节点从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测结果请求消息时，将所述NAT探测结果携带在NAT探测结果响应消息，将所述NAT探测结果响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点。
作为一种可选的实施方式，响应节点将所述NAT探测响应消息或NAT探测结果响应消息进行IP报文封装，包括：
响应节点将所述第二节点信息封装到NAT探测响应分组报文的第二IP报头中；将所述NAT探测响应消息或NAT探测结果响应消息封装到NAT探测响应分组报文的第二报文内容中。
需要说明的是，上述响应节点的第二节点信息，在组织NAT探测响应分组报文时，既存在于第二 IP报头中，也会被封装在第二报文内容中。
响应节点进行IP报文封装的时候，需要首先组织形成响应节点的NAT探测响应消息或NAT探测结果响应消息的载荷数据，再将NAT探测响应消息或NAT探测结果响应消息进行IP报文封装，便形成NAT探测响应分组报文。
需要说明的是，响应节点与请求节点间存在NAT时，NAT的分布位置包括三种情况，具体参见上述S102(图2)对应内容的阐述，此处不再赘述。
作为一种可选的实施方式，响应节点对所述NAT探测响应分组报文进行保护处理，包括：
响应节点对NAT探测响应分组报文进行加密、数据混淆、完整性校验中的至少一项处理。对NAT探测响应分组报文进行保护处理，指的是对NAT探测响应分组报文中的第二报文内容进行保护处理，不对NAT探测响应分组报文中的第二IP报头进行保护处理。
需要说明的是，保护处理的目的与上述请求节点对NAT探测请求分组报文进行保护处理一致，此处不再赘述。
S107、请求节点接收所述NAT探测响应分组报文并进行解保护处理，从解保护处理后的NAT探测响应分组报文中获取到NAT探测结果响应消息时，从所述NAT探测结果响应消息中获取NAT探测结果；或者，从解保护处理后的NAT探测响应分组报文中获取到NAT探测响应消息时，获取所述NAT探测响应消息的载荷数据，并将获取的载荷数据与所述NAT探测响应分组报文的第二IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果。
需要说明的是，在实际应用场景中，请求节点向响应节点发送的NAT探测请求分组报文中，封装的可以是NAT探测请求消息，也可以是NAT探测结果请求消息，因此响应节点根据实际情况只需执行S105或S106，相应的，S107中请求节点根据实际情况只需通过其中一种方式得到NAT探测结果。
作为一种可选的实施方式，请求节点对经保护处理的NAT探测响应分组报文进行解保护处理，包括：请求节点对经保护处理的NAT探测响应分组报文相应进行解密、数据还原、完整性校验中的至少一项处理。
作为一种可选的实施方式，所述第一节点信息还包括请求节点自身的端口号，及配置的响应节点的端口号；或者，所述第一节点信息还包括请求节点自身的SID，及配置的响应节点的SID。
作为一种可选的实施方式，相应的，所述第二节点信息还包括响应节点自身的端口号，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的端口号；或者，所述第二节点信息还包括响应节点自身的SID，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的SID。
需要说明的是，响应节点的IP地址、端口号和SID，表示能够将数据发到响应节点的地址。NAT探测除了支持带有PORT(端口)的协议，还支持非端口协议，有些协议没有端口，但是有SID，例如支持TUE(Tunnel Universal Encapsulating，隧道通用封装)的SID(Session Identifier，会话标识)探测，则响应节点可以根据第一IP报头中IP地址、端口和SID的携带情况，根据其中任一项的变化判定是否存在NAT，请求节点可以根据第二IP报头中IP地址、端口和SID的携带情况，根据其中任一项的变化判定是否存在NAT。
本申请提供了独立于密钥管理协议而单独存在的一种NAT探测方法，简单、可靠，解决了网络节点间NAT探测与密钥管理协议紧耦合而造成的功能界定混乱，边界模糊所带来的密钥管理功能扩展难的问题(例如，本实施例的NAT探测能力由与密钥管理协议无关的携带IP地址，或IP地址和端口号，或IP地址和会话标识SID的协议完成，密钥管理由专门的密钥管理协议来完成，密钥管理安全性的加强及扩展，不会受NAT探测能力的影响)；此外，本实施例的NAT探测是由独立的协议实现，不是通过修改密钥管理协议本身实现，修改NAT探测能力不会影响密钥管理协议本身的安全能力；支持NAT 探测方法多样性，支持仅确定是否存在NAT或确定NAT分布位置的不同的探测方式，在仅确定是否存在NAT时，响应节点仅反馈NAT探测结果，减少通信量，更适应流量敏感的网络环境；支持对NAT探测过程的保护，避免内部地址泄露，避免攻击者修改探测消息导致DoS攻击或网络资源浪费，加强了系统的整体安全性。
作为一种可选的实施方式，所述NAT探测请求消息或所述NAT探测结果请求消息或所述NAT探测响应消息，包括指示消息类型的标识、用于解析IP地址个数的长度信息；通过消息类型的标识可以对上述三种消息进行区分；所述NAT探测结果响应消息，包括指示请求节点和响应节点间是否存在NAT的标识；根据指示请求节点和响应节点间是否存在NAT的标识，可以确定消息类型为NAT探测结果响应消息，且可以确定是否存在NAT。
需要说明的是，长度信息可以包括载荷数据的长度，或者载荷数据包含请求节点/响应节点地址的个数，或者消息的长度；通过不同类型的长度信息都可以解析出IP地址的个数。
作为一种可选的实施方式，NAT探测请求消息/NAT探测响应消息/NAT探测结果请求消息/NAT探测结果响应消息的格式包括如下字段：
标识字段，具有多个取值，取值定义如下表1所示：
表1标识字段取值定义
标识字段取值 定义
1 NAT探测请求消息
2 NAT探测响应消息
3 NAT探测结果请求消息
4 NAT探测结果响应消息(无NAT)
5 NAT探测结果响应消息(有NAT)
其余 保留
其中，NAT探测请求消息中的指示消息类型的标识取值为1，NAT探测响应消息中的指示消息类型的标识取值为2，NAT探测结果请求消息中的指示消息类型的标识取值为3，若不存在NAT时，NAT探测结果响应消息中的标识取值为4，若存在NAT时，NAT探测结果响应消息中的标识取值为5。
长度信息字段，为可选字段，可以通过长度字段解析出载荷数据中IP地址个数。
如在多宿主的环境中，请求节点或响应节点可能同时有多个活动的可用IP地址，因此在构造NAT探测请求消息或NAT探测响应消息或NAT探测结果请求消息时应包含这些IP地址的信息；当上述标识字段的取值为1、2、3时，用于解析IP地址个数的长度信息字段为必需字段，当上述标识字段的取值为4或5时，该长度信息字段无效。
载荷数据字段，为长度可变的可选字段，表示NAT探测请求消息/NAT探测响应消息/NAT探测结果请求消息的载荷数据；当上述标识字段的取值为1、2、3时，载荷数据字段为必需字段，当上述标识字段的取值为4或5时，载荷数据字段无效。
示例性的，载荷数据字段作为NAT探测请求消息或NAT探测结果请求消息或NAT探测响应消息的载荷数据，具体的格式见下表。
Figure PCTCN2022138028-appb-000001
其中：
DST_PORT(SID)：表示NAT探测请求消息或NAT探测结果请求消息或NAT探测响应消息中 的对端端口号或对端SID，长度为2个八位位组的可选字段；若当前环境为IPv4，则此字段必选；若当前环境为IPv6，则无此字段；
DST_IP：表示NAT探测请求消息或NAT探测结果请求消息或NAT探测响应消息中的对端IP地址，字段长度根据当前通信的IP版本而定，如果当前使用IPv4通信，则长度为4个八位位组，如果当前使用IPv6通信，则长度为16个八位位组；
SRC_PORT(SID)：表示NAT探测请求消息或NAT探测结果请求消息或NAT探测响应消息中的源端口号或源SID，长度为2个八位位组的可选字段；若当前环境为IPv4，则此字段必选；若当前环境为IPv6，则无此字段；
SRC_IP1|SRC_IP2|…|SRC_IPn：表示当前通信可用的本地自身IP地址，长度根据当前通信的IP版本和可用IP地址的个数(n)而定，如果当前使用IPv4通信，则长度为4*n个八位位组；如果当前使用IPv6通信，则长度为16*n个八位位组；“|”：表示连接符。
例如，可用本地自身IP地址为1个时，n等于1；对于请求节点，SRC_IPn为请求节点自身的IP地址，SRC_PORT(SID)为请求节点的端口号或请求节点的SID，DST_IP为响应节点的IP地址，DST_PORT(SID)为响应节点的端口号或SID；对于响应节点，SRC_IPn为响应节点自身的IP地址，SRC_PORT(SID)为响应节点的端口号或响应节点SID，DST_IP为请求节点的IP地址，DST_PORT(SID)为请求节点的端口号或SID。需要说明的是，一个或多个SRC_IP不能同时存在IPv4和IPv6，必须是仅IPv4或仅IPv6，具体根据当前通信的IP版本而定。一个节点可能会存在1个或多个本地自身IP地址，但是通信过程中具体使用哪个IP地址是预先不可知的，等完成通信才可知。
下面结合NAT探测请求消息中源IP地址个数不同的情况，给出对应的响应节点根据对比结果确定NAT探测结果可能的实施方式。
1、当发送端为请求节点，接收端为响应节点，所述NAT探测请求消息中请求节点的IP地址个数为1，响应节点根据对比结果确定NAT探测结果，包括如下任一步骤：
步骤A：当响应节点获取的载荷数据中请求节点的IP地址与第一IP报头中请求节点的IP地址不同，或者，获取的载荷数据中请求节点的端口号与第一IP报头中请求节点的端口号不同，或者，获取的载荷数据中请求节点的SID与第一IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT。
需要说明的是，请求节点组织载荷数据时，请求节点的IP地址个数为1，对于响应节点，当在对比过程中解析出满足如下任一个条件时，确定请求节点与网络间存在NAT：
1)当作为载荷数据的第一节点信息存放请求节点的IP地址，载荷数据中请求节点的IP地址与第一IP报头中请求节点的IP地址不同；
2)当作为载荷数据的第一节点信息存放请求节点的IP地址和端口号，载荷数据中请求节点的IP地址与第一IP报头中请求节点的IP地址不同，和/或，载荷数据中请求节点的端口号与第一IP报头中请求节点的端口号不同；
3)当作为载荷数据的第一节点信息存放请求节点的IP地址和SID，载荷数据中请求节点的IP地址与第一IP报头中请求节点的IP地址不同，和/或，载荷数据中请求节点的SID与第一IP报头中请求节点的SID不同。
步骤B：当响应节点获取的载荷数据中响应节点的IP地址与第一IP报头中响应节点的IP地址不同，或者，获取的载荷数据中响应节点的端口号与第一IP报头中响应节点的端口号不同，或者，获取的载荷数据中响应节点的SID与第一IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT。
需要说明的是，请求节点组织载荷数据时，请求节点的IP地址个数为1，对于响应节点，当在对比过程中解析出满足如下任一个条件时，确定响应节点与网络间存在NAT：
1)当作为载荷数据的第一节点信息存放响应节点的IP地址，载荷数据中响应节点的IP地址与第一IP报头中响应节点的IP地址不同；
2)当作为载荷数据的第一节点信息存放响应节点的IP地址和端口号，载荷数据中响应节点的IP地址与第一IP报头中响应节点的IP地址不同，和/或，载荷数据中响应节点的端口号与第一IP报头中响应节点的端口号不同；
3)当作为载荷数据的第一节点信息存放响应节点的IP地址和SID，载荷数据中响应节点的IP地址与第一IP报头中响应节点的IP地址不同，和/或，载荷数据中响应节点的SID与第一IP报头中响应节点的SID不同。
2、当发送端为请求节点，接收端为响应节点，所述NAT探测请求消息中请求节点的IP地址个数大于1，响应节点根据对比结果确定NAT探测结果，包括如下任一步骤：
步骤A，当响应节点获取的载荷数据中请求节点的所有IP地址与第一IP报头中请求节点的IP地址都不同，或者，获取的载荷数据中请求节点的端口号与第一IP报头中请求节点的端口号不同，或者，获取的载荷数据中请求节点的SID与第一IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT。
其中，请求节点的所有的IP地址都封装在第一报文内容中，发送时系统在第一IP报头中只添加1个需要使用的IP地址。对于响应节点，当在对比过程中解析出满足如下任一个条件时，确定请求节点与网络间存在NAT：
1)当作为载荷数据的第一节点信息存放请求节点的所有IP地址，载荷数据中请求节点的所有IP地址与第一IP报头中请求节点的IP地址都不同；
2)当作为载荷数据的第一节点信息存放请求节点的所有IP地址和端口号，载荷数据中请求节点的所有IP地址与第一IP报头中请求节点的IP地址都不同，和/或，载荷数据中请求节点的端口号与第一IP报头中请求节点的端口号不同；
3)当作为载荷数据的第一节点信息存放请求节点的所有IP地址和SID，载荷数据中请求节点的所有IP地址与第一IP报头中请求节点的IP地址都不同，和/或，载荷数据中请求节点的SID与第一IP报头中请求节点的SID不同。
步骤B，当响应节点获取的载荷数据中响应节点的IP地址与第一IP报头中响应节点的IP地址不同，或者，获取的载荷数据中响应节点的端口号与第一IP报头中响应节点的端口号不同，或者，获取的载荷数据中响应节点的SID与第一IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT。
具体解释参见上述请求节点组织载荷数据时，请求节点的IP地址个数为1时，载荷数据中响应节点信息的对比过程，此处不再赘述。
请求节点获得最终的NAT探测结果包括两种方式：方式1，当响应节点向请求节点反馈的是NAT探测响应消息时，请求节点根据对比结果确定NAT探测结果；方式2，如果响应节点向请求节点反馈的是NAT探测结果响应消息时，请求节点直接从NAT探测结果响应消息中获取NAT探测结果。
下面结合NAT探测响应消息中源IP地址个数不同的情况，给出对应的请求节点根据对比结果确定NAT探测结果可能的实施方式。
1、当发送端为响应节点，接收端为请求节点，所述NAT探测响应消息中响应节点的IP地址个数为1，请求节点根据对比结果确定NAT探测结果，包括：
步骤A：当请求节点获取的载荷数据中响应节点的IP地址与第二IP报头中响应节点的IP地址不同，或者，获取的载荷数据中响应节点的端口号与第二IP报头中响应节点的端口号不同，或者，获取的载荷数据中响应节点的SID与第二IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT。
需要说明的是，响应节点组织载荷数据时，响应节点的IP地址个数为1，对于请求节点，当在对比过程中解析出满足如下任一个条件时，确定响应节点与网络间存在NAT：
1)当作为载荷数据的第二节点信息存放响应节点的IP地址，载荷数据中响应节点的IP地址与第二IP报头中响应节点的IP地址不同；
2)当作为载荷数据的第二节点信息存放响应节点的IP地址和端口号，载荷数据中响应节点的IP地址与第二IP报头中响应节点的IP地址不同，和/或，载荷数据中响应节点的端口号与第二IP报头中响应节点的端口号不同；
3)当作为载荷数据的第二节点信息存放响应节点的IP地址和SID，载荷数据中响应节点的IP地址与第二IP报头中响应节点的IP地址不同，和/或，载荷数据中响应节点的SID与第二IP报头中响应节点的SID不同。
步骤B：当请求节点获取的载荷数据中请求节点的IP地址与第二IP报头中请求节点的IP地址不同，或者，获取的载荷数据中请求节点的端口号与第二IP报头中请求节点的端口号不同，或者，获取的载荷数据中请求节点的SID与第二IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT。
需要说明的是，响应节点组织载荷数据时，响应节点的IP地址个数为1，对于请求节点，当在对比过程中解析出满足如下任一个条件时，确定请求节点与网络间存在NAT：
1)当作为载荷数据的第二节点信息存放请求节点的IP地址，载荷数据中请求节点的IP地址与第二IP报头中请求节点的IP地址不同；
2)当作为载荷数据的第二节点信息存放请求节点的IP地址和端口号，载荷数据中请求节点的IP地址与第二IP报头中请求节点的IP地址不同，和/或,载荷数据中请求节点的端口号与第二IP报头中请求节点的端口号不同；
3)当作为载荷数据的第二节点信息存放请求节点的IP地址和SID，载荷数据中请求节点的IP地址与第二IP报头中请求节点的IP地址不同，和/或，载荷数据中请求节点的SID与第二IP报头中请求节点的SID不同。
2、当发送端为响应节点，接收端为请求节点，所述NAT探测响应消息中响应节点的IP地址个数大于1，请求节点根据对比结果确定NAT探测结果，包括：
步骤A：当请求节点获取的载荷数据中响应节点的所有IP地址与第二IP报头中响应节点的IP地址都不同，或者，获取的载荷数据中响应节点的端口号与第二IP报头中响应节点的端口号不同，或者，获取的载荷数据中响应节点的SID与第二IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT。
其中，响应节点的所有的IP地址都封装在第二报文内容中，发送的时候，系统在第二IP报头中只添加1个需要使用的IP地址。对于请求节点，当在对比过程中解析出满足如下任一个条件时，确定响应节点与网络间存在NAT：
1)当作为载荷数据的第二节点信息存放响应节点的所有IP地址，载荷数据中响应节点的所有IP地址与在第二IP报头中响应节点的IP地址都不同；
2)当作为载荷数据的第二节点信息存放响应节点的所有IP地址和端口号，载荷数据中响应节点的 所有IP地址与第二IP报头中响应节点的IP地址都不同，和/或，载荷数据中响应节点的端口号与第二IP报头中响应节点的端口号不同；
3)当作为载荷数据的第二节点信息存放响应节点的所有IP地址和SID，载荷数据中响应节点的所有IP地址与第二IP报头中响应节点的IP地址都不同，和/或，载荷数据中响应节点的SID与第二IP报头中响应节点的SID不同。
步骤B：当请求节点获取的载荷数据中请求节点的IP地址与第二IP报头中请求节点的IP地址不同，或者，获取的载荷数据中请求节点的端口号与第二IP报头中请求节点的端口号不同，或者，获取的载荷数据中请求节点的SID与第二IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT。
具体解释参见上述响应节点组织载荷数据时，响应节点的IP地址个数为1时，载荷数据中请求节点信息的对比过程，此处不再赘述。
需要说明的是，NAT探测结果信息没有必要全部保存，但是为了接下来数据安全通道的封装以及通信，响应节点可以有选择的保存NAT探测结果信息，根据选择保存的不同NAT探测结果信息得到第一探测结果或第二探测结果。所述请求节点或响应节点根据对比结果确定的NAT探测结果为第二探测结果，所述携带在NAT探测结果响应消息中的探测结果为第一探测结果。
其中，所述第一探测结果为指示请求节点和响应节点间是否存在NAT的探测结果；所述第二探测结果为指示请求节点和响应节点间是否存在NAT，及所述请求节点和响应节点之间存在NAT时所述NAT的分布位置。
作为一种可选的实施方式，对于响应节点，当获取的载荷数据中的请求节点的IP地址与第一IP报头中请求节点的IP地址不同，但载荷数据中请求节点的端口号/SID与第一IP报头中请求节点的端口号/SID相同时，对探测过程产生对应的日志信息并保存；
或者，当获取的载荷数据中响应节点的IP地址与第一IP报头中响应节点的IP地址不同，但载荷数据中响应节点的端口号/SID与第一IP报头中响应节点的端口号/SID相同时，对探测过程产生对应的日志信息并保存。
需要说明的是，当响应节点从NAT探测请求分组报文中获取的载荷数据中请求节点的IP地址与第一IP报头中请求节点的IP地址不同，按常规来讲可以证明请求节点与网络间存在NAT，但当出现载荷数据中请求节点的端口号或SID与第一IP报头中请求节点的端口号或SID相同时，则可能出现NAT映射失败的情况，本申请将这种情况归为请求节点与网络间的NAT不支持穿越；请求节点在向响应节点发送消息时，请求节点与网络间的NAT会将请求节点自身的端口号或SID改成NAT的端口号或SID，但是第一IP报头中请求节点的端口号或SID没有变，即在请求节点与网络间的NAT进行地址映射时可能失败(例如，NAT不支持UDP穿越的情况)，这时需要产生对应的日志信息并保存，以便后期管理员查看日志，排查不支持NAT穿越的情况。
基于同一发明构思，本发明实施例还提供一种网络节点间NAT探测装置，配置于请求节点，如图3所示，包括：
获取模块301，用于获取第一节点信息，并将获取的第一节点信息作为NAT探测请求消息或NAT探测结果请求消息的载荷数据，所述第一节点信息包括请求节点自身的IP地址，及配置的响应节点的IP地址；
封装模块302，用于将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，并对封装后得到的NAT探测请求分组报文进行保护处理后发送至响应节点；
确定模块303，用于接收NAT探测响应分组报文并进行解保护处理，从解保护处理后的NAT探测响应分组报文中获取到NAT探测结果响应消息时，从所述NAT探测结果响应消息中获取NAT探测结果；或者，从解保护处理后的NAT探测响应分组报文中获取到NAT探测响应消息时，获取所述NAT探测响应消息的载荷数据，并将获取的载荷数据与所述NAT探测响应分组报文的第二IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果。
可选地，所述第一节点信息还包括请求节点自身的端口号，及配置的响应节点的端口号；或者所述第一节点信息还包括请求节点自身的SID，及配置的响应节点的SID。
可选地，封装模块302将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，包括：
将所述第一节点信息封装到NAT探测请求分组报文的第一IP报头中；
将所述NAT探测请求消息或NAT探测结果请求消息封装到NAT探测请求分组报文的第一报文内容中。
可选地，所述NAT探测请求消息或所述NAT探测结果请求消息或所述NAT探测响应消息，包括指示消息类型的标识、用于解析IP地址个数的长度信息；
所述NAT探测结果响应消息，包括指示请求节点和响应节点间是否存在NAT的标识。
可选地，封装模块302对所述NAT探测请求分组报文进行保护处理，包括：
封装模块302对所述NAT探测请求分组报文进行加密、数据混淆、完整性校验中的至少一项处理。
可选地，确定模块303对所述NAT探测响应分组报文进行解保护处理，包括：
确定模块303对所述NAT探测响应分组报文进行解密、数据还原、完整性校验中的至少一项处理。
可选地，确定模块303根据对比结果确定NAT探测结果，包括：
当获取的载荷数据中的响应节点的IP地址与第二IP报头中的响应节点的IP地址不同，或者，所述载荷数据中响应节点的端口号与第二IP报头中响应节点的端口号不同，或者，所述载荷数据中响应节点的SID与第二IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT；
当获取的载荷数据中请求节点的IP地址与所述第二IP报头中请求节点的IP地址不同，或者，所述载荷数据中请求节点的端口号与所述第二IP报头中请求节点的端口号不同，或者，所述载荷数据中请求节点的SID与所述第二IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT。
可选地，确定模块303根据对比结果确定的NAT探测结果为第二探测结果，所述携带在NAT探测结果响应消息中的探测结果为第一探测结果；
所述第一探测结果为指示所述请求节点和响应节点间是否存在NAT的探测结果；
所述第二探测结果包括指示所述请求节点和响应节点间是否存在NAT，及所述请求节点和响应节点之间存在NAT时，所述NAT的分布位置。
本发明实施例还提供一种网络节点间NAT探测装置，配置于响应节点，如图4所示，包括：
接收模块401，用于接收NAT探测请求分组报文，并对接收的NAT探测请求分组报文进行解保护处理；
确定模块402，用于从解保护处理后的NAT探测请求分组报文中获取所述NAT探测请求消息或NAT探测结果请求消息，将获取的NAT探测请求消息或NAT探测结果请求消息中的载荷数据与所述NAT探测请求分组报文的第一IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果；
获取模块403，用于从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测请求消息时， 获取第二节点信息，所述第二节点信息包括响应节点自身的IP地址，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的IP地址，并将第二节点信息作为NAT探测响应消息的载荷数据，将所述NAT探测响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点；或者，用于从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测结果请求消息时，将所述NAT探测结果携带在NAT探测结果响应消息，将所述NAT探测结果响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点。
可选地，所述第二节点信息还包括响应节点自身的端口号，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的端口号；或者所述第二节点信息还包括响应节点自身的SID，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的SID。
可选地，获取模块403将所述NAT探测响应消息或NAT探测结果响应消息进行IP报文封装，包括：
将所述第二节点信息封装到NAT探测响应分组报文的第二IP报头中；
将所述NAT探测响应消息或NAT探测结果响应消息封装到NAT探测响应分组报文的第二报文内容中。
可选地，接收模块401对所述NAT探测请求分组报文进行解保护处理，包括：
接收模块401对所述NAT探测请求分组报文进行解密、数据还原、完整性校验中的至少一项处理。
可选地，获取模块403对所述NAT探测响应分组报文进行保护处理，包括：
获取模块403对所述NAT探测响应分组报文进行加密、数据混淆、完整性校验中的至少一项处理。
可选地，确定模块402根据对比结果确定NAT探测结果，包括如下任一步骤：
当获取的载荷数据中的请求节点的IP地址与第一IP报头中的请求节点的IP地址不同，或者，所述载荷数据中请求节点的端口号与第一IP报头中请求节点的端口号不同，或者，所述载荷数据中请求节点的SID与第一IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT；
当获取的载荷数据中的响应节点的IP地址与所述第一IP报头中的响应节点的IP地址不同，或者，所述载荷数据中响应节点的端口号与所述第一IP报头中的响应节点的端口号不同，或者，所述载荷数据中响应节点的SID与所述第一IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT。
可选地，确定模块402根据对比结果确定的NAT探测结果为第二探测结果，所述携带在NAT探测结果响应消息中的探测结果为第一探测结果；
所述第一探测结果为指示所述请求节点和响应节点间是否存在NAT的探测结果；
所述第二探测结果包括指示所述请求节点和响应节点间是否存在NAT，及所述请求节点和响应节点之间存在NAT时所述NAT的分布位置。
基于同一发明构思，本发明实施例还提供一种网络节点间NAT探测设备，配置于请求节点，如图5所示，所述设备包括：存储器501，用于存储程序指令；处理器502，用于调用所述存储器存储的程序指令，按照获得的程序执行下列过程：
获取第一节点信息，并将获取的第一节点信息作为NAT探测请求消息或NAT探测结果请求消息的载荷数据，所述第一节点信息包括请求节点自身的IP地址，及配置的响应节点的IP地址；
将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，并对封装后得到的NAT探测请求分组报文进行保护处理后发送至响应节点；
接收NAT探测响应分组报文并进行解保护处理，从解保护处理后的NAT探测响应分组报文中获 取到NAT探测结果响应消息时，从所述NAT探测结果响应消息中获取NAT探测结果；或者，从解保护处理后的NAT探测响应分组报文中获取到NAT探测响应消息时，获取所述NAT探测响应消息的载荷数据，并将获取的载荷数据与所述NAT探测响应分组报文的第二IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果。
可选的，所述第一节点信息还包括请求节点自身的端口号，及配置的响应节点的端口号；或者，所述第一节点信息还包括请求节点自身的SID，及配置的响应节点的SID。
将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，包括：
将所述第一节点信息封装到NAT探测请求分组报文的第一IP报头中；
将所述NAT探测请求消息或NAT探测结果请求消息封装到NAT探测请求分组报文的第一报文内容中。
可选的，所述NAT探测请求消息或所述NAT探测结果请求消息或所述NAT探测响应消息，包括指示消息类型的标识、用于解析IP地址个数的长度信息；所述NAT探测结果响应消息，包括指示请求节点和响应节点间是否存在NAT的标识。
对所述NAT探测请求分组报文进行保护处理，包括：对所述NAT探测请求分组报文进行加密、数据混淆、完整性校验中的至少一项处理。
对所述NAT探测响应分组报文进行解保护处理，包括：对所述NAT探测响应分组报文进行解密、数据还原、完整性校验中的至少一项处理。
根据对比结果确定NAT探测结果，包括：当获取的载荷数据中的响应节点的IP地址与第二IP报头中的响应节点的IP地址不同，或者，所述载荷数据中响应节点的端口号与第二IP报头中响应节点的端口号不同，或者，所述载荷数据中响应节点的SID与第二IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT；
当获取的载荷数据中请求节点的IP地址与所述第二IP报头中请求节点的IP地址不同，或者，所述载荷数据中请求节点的端口号与所述第二IP报头中请求节点的端口号不同，或者，所述载荷数据中请求节点的SID与所述第二IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT。
根据对比结果确定的NAT探测结果为第二探测结果，所述携带在NAT探测结果响应消息中的探测结果为第一探测结果；所述第一探测结果为指示所述请求节点和响应节点间是否存在NAT的探测结果；所述第二探测结果包括指示所述请求节点和响应节点间是否存在NAT，及所述请求节点和响应节点之间存在NAT时所述NAT的分布位置。
基于同一发明构思，本发明实施例还提供一种网络节点间NAT探测设备，配置于响应节点，如图6所示，所述设备包括：存储器601，用于存储程序指令；处理器602，用于调用所述存储器存储的程序指令，按照获得的程序执行下列过程：
接收NAT探测请求分组报文，并对接收的NAT探测请求分组报文进行解保护处理；
从解保护处理后的NAT探测请求分组报文中获取所述NAT探测请求消息或NAT探测结果请求消息，将获取的NAT探测请求消息或NAT探测结果请求消息中的载荷数据与所述NAT探测请求分组报文的第一IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果；
从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测请求消息时，获取第二节点信息，所述第二节点信息包括响应节点自身的IP地址，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的IP地址，并将第二节点信息作为NAT探测响应消息的载荷数据，将所述NAT探测响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节 点；或者，用于从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测结果请求消息时，将所述NAT探测结果携带在NAT探测结果响应消息，将所述NAT探测结果响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点。
可选的，所述第二节点信息还包括响应节点自身的端口号，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的端口号；或者，所述第二节点信息还包括响应节点自身的SID，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的SID。
将所述NAT探测响应消息或NAT探测结果响应消息进行IP报文封装，包括：将所述第二节点信息封装到NAT探测响应分组报文的第二IP报头中；将所述NAT探测响应消息或NAT探测结果响应消息封装到NAT探测响应分组报文的第二报文内容中。
对所述NAT探测请求分组报文进行解保护处理，包括：对所述NAT探测请求分组报文进行解密、数据还原、完整性校验中的至少一项处理。对所述NAT探测响应分组报文进行保护处理，包括：对所述NAT探测响应分组报文进行加密、数据混淆、完整性校验中的至少一项处理。
根据对比结果确定NAT探测结果，包括如下任一步骤：当获取的载荷数据中的请求节点的IP地址与第一IP报头中的请求节点的IP地址不同，或者，所述载荷数据中请求节点的端口号与第一IP报头中请求节点的端口号不同，或者，所述载荷数据中请求节点的SID与第一IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT；
当获取的载荷数据中的响应节点的IP地址与所述第一IP报头中的响应节点的IP地址不同，或者，所述载荷数据中响应节点的端口号与所述第一IP报头中的响应节点的端口号不同，或者，所述载荷数据中响应节点的SID与所述第一IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT。
根据对比结果确定的NAT探测结果为第二探测结果，所述携带在NAT探测结果响应消息中的探测结果为第一探测结果；所述第一探测结果为指示所述请求节点和响应节点间是否存在NAT的探测结果；所述第二探测结果包括指示所述请求节点和响应节点间是否存在NAT，及所述请求节点和响应节点之间存在NAT时所述NAT的分布位置。
基于同一发明构思，本发明实施例还提供一种计算机存储介质，所述计算机存储介质上存储有计算机程序，该计算机程序被处理器执行时实现上述实施例一中提供的网络节点间NAT探测方法的步骤。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个模块或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或模块的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的模块可以是或者也可以不是物理上分开的，作为模块显示的部件可以是或者也可以不是物理模块，即可以位于一个地方，或者也可以分布到多个网络模块上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。所述集成的模块如果以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
以上对本申请所提供的技术方案进行了详细介绍，本申请中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本申请的限制。

Claims (27)

  1. 一种网络节点间NAT探测方法，其特征在于，所述方法包括：
    请求节点获取第一节点信息，并将获取的第一节点信息作为NAT探测请求消息或NAT探测结果请求消息的载荷数据，所述第一节点信息包括请求节点自身的IP地址，及配置的响应节点的IP地址；
    请求节点将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，并对封装后得到的NAT探测请求分组报文进行保护处理后发送至响应节点；
    响应节点接收所述NAT探测请求分组报文，并对接收的NAT探测请求分组报文进行解保护处理；
    响应节点从解保护处理后的NAT探测请求分组报文中获取所述NAT探测请求消息或NAT探测结果请求消息，将获取的NAT探测请求消息或NAT探测结果请求消息中的载荷数据与所述NAT探测请求分组报文的第一IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果；
    响应节点从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测请求消息时，获取第二节点信息，所述第二节点信息包括响应节点自身的IP地址，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的IP地址，并将第二节点信息作为NAT探测响应消息的载荷数据，将所述NAT探测响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点；或者，响应节点从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测结果请求消息时，将所述NAT探测结果携带在NAT探测结果响应消息，将所述NAT探测结果响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点；
    请求节点接收所述NAT探测响应分组报文并进行解保护处理，从解保护处理后的NAT探测响应分组报文中获取到NAT探测结果响应消息时，从所述NAT探测结果响应消息中获取NAT探测结果；或者，从解保护处理后的NAT探测响应分组报文中获取到NAT探测响应消息时，获取所述NAT探测响应消息的载荷数据，并将获取的载荷数据与所述NAT探测响应分组报文的第二IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果。
  2. 根据权利要求1所述的方法，其特征在于，所述第一节点信息还包括请求节点自身的端口号，及配置的响应节点的端口号；或者，所述第一节点信息还包括请求节点自身的SID，及配置的响应节点的SID；
    所述第二节点信息还包括响应节点自身的端口号，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的端口号；或者，所述第二节点信息还包括响应节点自身的SID，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的SID。
  3. 根据权利要求1或2所述的方法，其特征在于，所述请求节点将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，包括：
    将所述第一节点信息封装到NAT探测请求分组报文的第一IP报头中；
    将所述NAT探测请求消息或NAT探测结果请求消息封装到NAT探测请求分组报文的第一报文内容中；
    所述响应节点将所述NAT探测响应消息或NAT探测结果响应消息进行IP报文封装，包括：
    将所述第二节点信息封装到NAT探测响应分组报文的第二IP报头中；
    将所述NAT探测响应消息或NAT探测结果响应消息封装到NAT探测响应分组报文的第二报文内容中。
  4. 根据权利要求1所述的方法，其特征在于，
    所述NAT探测请求消息或所述NAT探测结果请求消息或所述NAT探测响应消息，包括指示消息 类型的标识、用于解析IP地址个数的长度信息；
    所述NAT探测结果响应消息，包括指示请求节点和响应节点间是否存在NAT的标识。
  5. 根据权利要求1所述的方法，其特征在于，请求节点对所述NAT探测请求分组报文进行保护处理，包括：
    请求节点对所述NAT探测请求分组报文进行加密、数据混淆、完整性校验中的至少一项处理；
    响应节点对所述NAT探测请求分组报文进行解保护处理，包括：
    响应节点对所述NAT探测请求分组报文进行解密、数据还原、完整性校验中的至少一项处理。
  6. 根据权利要求1所述的方法，其特征在于，响应节点对所述NAT探测响应分组报文进行保护处理，包括：
    响应节点对所述NAT探测响应分组报文进行加密、数据混淆、完整性校验中的至少一项处理；
    请求节点对所述NAT探测响应分组报文进行解保护处理，包括：
    请求节点对所述NAT探测响应分组报文进行解密、数据还原、完整性校验中的至少一项处理。
  7. 根据权利要求2所述的方法，其特征在于，响应节点根据对比结果确定NAT探测结果，包括如下任一步骤：
    当获取的载荷数据中的请求节点的IP地址与第一IP报头中的请求节点的IP地址不同，或者，所述载荷数据中请求节点的端口号与第一IP报头中请求节点的端口号不同，或者，所述载荷数据中请求节点的SID与第一IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT；
    当获取的载荷数据中的响应节点的IP地址与所述第一IP报头中的响应节点的IP地址不同，或者，所述载荷数据中响应节点的端口号与所述第一IP报头中的响应节点的端口号不同，或者，所述载荷数据中响应节点的SID与所述第一IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT。
  8. 根据权利要求2所述的方法，其特征在于，请求节点根据对比结果确定NAT探测结果，包括：
    当获取的载荷数据中的响应节点的IP地址与第二IP报头中的响应节点的IP地址不同，或者，所述载荷数据中响应节点的端口号与第二IP报头中响应节点的端口号不同，或者，所述载荷数据中响应节点的SID与第二IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT；
    当获取的载荷数据中请求节点的IP地址与所述第二IP报头中请求节点的IP地址不同，或者，所述载荷数据中请求节点的端口号与所述第二IP报头中请求节点的端口号不同，或者，所述载荷数据中请求节点的SID与所述第二IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT。
  9. 根据权利要求1或4所述的方法，其特征在于，
    所述请求节点或响应节点根据对比结果确定的NAT探测结果为第二探测结果，所述携带在NAT探测结果响应消息中的探测结果为第一探测结果；
    所述第一探测结果为指示所述请求节点和响应节点间是否存在NAT的探测结果；
    所述第二探测结果包括指示所述请求节点和响应节点间是否存在NAT，及所述请求节点和响应节点之间存在NAT时所述NAT的分布位置。
  10. 一种网络节点间NAT探测装置，配置于请求节点，其特征在于，包括：
    获取模块，用于获取第一节点信息，并将获取的第一节点信息作为NAT探测请求消息或NAT探测结果请求消息的载荷数据，所述第一节点信息包括请求节点自身的IP地址，及配置的响应节点的IP 地址；
    封装模块，用于将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，并对封装后得到的NAT探测请求分组报文进行保护处理后发送至响应节点；
    确定模块，用于接收NAT探测响应分组报文并进行解保护处理，从解保护处理后的NAT探测响应分组报文中获取到NAT探测结果响应消息时，从所述NAT探测结果响应消息中获取NAT探测结果；或者，从解保护处理后的NAT探测响应分组报文中获取到NAT探测响应消息时，获取所述NAT探测响应消息的载荷数据，并将获取的载荷数据与所述NAT探测响应分组报文的第二IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果。
  11. 根据权利要求10所述的装置，其特征在于，所述第一节点信息还包括请求节点自身的端口号，及配置的响应节点的端口号；或者，所述第一节点信息还包括请求节点自身的SID，及配置的响应节点的SID。
  12. 根据权利要求10所述的装置，其特征在于，所述封装模块将所述NAT探测请求消息或NAT探测结果请求消息进行IP报文封装，包括：
    将所述第一节点信息封装到NAT探测请求分组报文的第一IP报头中；
    将所述NAT探测请求消息或NAT探测结果请求消息封装到NAT探测请求分组报文的第一报文内容中。
  13. 根据权利要求10所述的装置，其特征在于，所述NAT探测请求消息或所述NAT探测结果请求消息或所述NAT探测响应消息，包括指示消息类型的标识、用于解析IP地址个数的长度信息；
    所述NAT探测结果响应消息，包括指示请求节点和响应节点间是否存在NAT的标识。
  14. 根据权利要求10所述的装置，其特征在于，所述封装模块对所述NAT探测请求分组报文进行保护处理，包括：
    所述封装模块对所述NAT探测请求分组报文进行加密、数据混淆、完整性校验中的至少一项处理。
  15. 根据权利要求10所述的装置，其特征在于，所述确定模块对所述NAT探测响应分组报文进行解保护处理，包括：
    所述确定模块对所述NAT探测响应分组报文进行解密、数据还原、完整性校验中的至少一项处理。
  16. 根据权利要求11所述的装置，其特征在于，所述确定模块根据对比结果确定NAT探测结果，包括：
    当获取的载荷数据中的响应节点的IP地址与第二IP报头中的响应节点的IP地址不同，或者，所述载荷数据中响应节点的端口号与第二IP报头中响应节点的端口号不同，或者，所述载荷数据中响应节点的SID与第二IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT；
    当获取的载荷数据中请求节点的IP地址与所述第二IP报头中请求节点的IP地址不同，或者，所述载荷数据中请求节点的端口号与所述第二IP报头中请求节点的端口号不同，或者，所述载荷数据中请求节点的SID与所述第二IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT。
  17. 根据权利要求10或13所述的装置，其特征在于，所述确定模块根据对比结果确定的NAT探测结果为第二探测结果，所述携带在NAT探测结果响应消息中的探测结果为第一探测结果；
    所述第一探测结果为指示所述请求节点和响应节点间是否存在NAT的探测结果；
    所述第二探测结果包括指示所述请求节点和响应节点间是否存在NAT，及所述请求节点和响应节点之间存在NAT时所述NAT的分布位置。
  18. 一种网络节点间NAT探测装置，配置于响应节点，其特征在于，包括：
    接收模块，用于接收NAT探测请求分组报文，并对接收的NAT探测请求分组报文进行解保护处理；
    确定模块，用于从解保护处理后的NAT探测请求分组报文中获取所述NAT探测请求消息或NAT探测结果请求消息，将获取的NAT探测请求消息或NAT探测结果请求消息中的载荷数据与所述NAT探测请求分组报文的第一IP报头中的对应内容进行对比，根据对比结果确定NAT探测结果；
    获取模块，用于从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测请求消息时，获取第二节点信息，所述第二节点信息包括响应节点自身的IP地址，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的IP地址，并将第二节点信息作为NAT探测响应消息的载荷数据，将所述NAT探测响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点；或者，用于从解保护处理后的NAT探测请求分组报文中获取到所述NAT探测结果请求消息时，将所述NAT探测结果携带在NAT探测结果响应消息，将所述NAT探测结果响应消息进行IP报文封装，并对封装后得到的NAT探测响应分组报文进行保护处理后发送至请求节点。
  19. 根据权利要求18所述的装置，其特征在于，所述第二节点信息还包括响应节点自身的端口号，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的端口号；或者，所述第二节点信息还包括响应节点自身的SID，及从所述NAT探测请求分组报文的第一IP报头中获取的请求节点的SID。
  20. 根据权利要求18所述的装置，其特征在于，所述获取模块将所述NAT探测响应消息或NAT探测结果响应消息进行IP报文封装，包括：
    将所述第二节点信息封装到NAT探测响应分组报文的第二IP报头中；
    将所述NAT探测响应消息或NAT探测结果响应消息封装到NAT探测响应分组报文的第二报文内容中。
  21. 根据权利要求18所述的装置，其特征在于，所述接收模块对所述NAT探测请求分组报文进行解保护处理，包括：
    所述接收模块对所述NAT探测请求分组报文进行解密、数据还原、完整性校验中的至少一项处理。
  22. 根据权利要求18所述的装置，其特征在于，所述获取模块对所述NAT探测响应分组报文进行保护处理，包括：
    所述获取模块对所述NAT探测响应分组报文进行加密、数据混淆、完整性校验中的至少一项处理。
  23. 根据权利要求19所述的装置，其特征在于，所述确定模块根据对比结果确定NAT探测结果，包括如下任一步骤：
    当获取的载荷数据中的请求节点的IP地址与第一IP报头中的请求节点的IP地址不同，或者，所述载荷数据中请求节点的端口号与第一IP报头中请求节点的端口号不同，或者，所述载荷数据中请求节点的SID与第一IP报头中请求节点的SID不同时，确定请求节点与网络间存在NAT；否则，确定请求节点与网络间不存在NAT；
    当获取的载荷数据中的响应节点的IP地址与所述第一IP报头中的响应节点的IP地址不同，或者，所述载荷数据中响应节点的端口号与所述第一IP报头中的响应节点的端口号不同，或者，所述载荷数据中响应节点的SID与所述第一IP报头中响应节点的SID不同时，确定响应节点与网络间存在NAT；否则，确定响应节点与网络间不存在NAT。
  24. 根据权利要求18或21所述的装置，其特征在于，所述确定模块根据对比结果确定的NAT探测结果为第二探测结果，所述携带在NAT探测结果响应消息中的探测结果为第一探测结果；
    所述第一探测结果为指示所述请求节点和响应节点间是否存在NAT的探测结果；
    所述第二探测结果包括指示所述请求节点和响应节点间是否存在NAT，及所述请求节点和响应节点之间存在NAT时所述NAT的分布位置。
  25. 一种网络节点间NAT探测设备，配置于请求节点，其特征在于，所述设备包括：
    存储器，用于存储程序指令；
    处理器，用于调用所述存储器存储的程序指令，按照获得的程序执行如权利要求1至9任一所述网络节点间NAT探测方法。
  26. 一种网络节点间NAT探测设备，配置于响应节点，其特征在于，所述设备包括：
    存储器，用于存储程序指令；
    处理器，用于调用所述存储器存储的程序指令，按照获得的程序执行如权利要求1至9任一所述网络节点间NAT探测方法。
  27. 一种计算机存储介质，其特征在于，其上存储有计算机程序，该程序被处理器执行时实现如权利要求1至9任一所述网络节点间NAT探测方法的步骤。
PCT/CN2022/138028 2022-01-05 2022-12-09 一种网络节点间nat探测方法、装置、设备及存储介质 WO2023130901A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210005432.6 2022-01-05
CN202210005432.6A CN116455863A (zh) 2022-01-05 2022-01-05 一种网络节点间nat探测方法、装置及存储介质

Publications (1)

Publication Number Publication Date
WO2023130901A1 true WO2023130901A1 (zh) 2023-07-13

Family

ID=87073087

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/138028 WO2023130901A1 (zh) 2022-01-05 2022-12-09 一种网络节点间nat探测方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN116455863A (zh)
WO (1) WO2023130901A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117579525A (zh) * 2023-11-20 2024-02-20 北京思存通信技术有限公司 一种网络协议特征识别系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070253417A1 (en) * 2006-04-27 2007-11-01 Nokia Corporation Address translation in a communication system
US20080071927A1 (en) * 2006-09-20 2008-03-20 Min-Kyu Lee Method and system for automatic tunneling using network address translation
CN102685262A (zh) * 2012-04-16 2012-09-19 中兴通讯股份有限公司 一种探测网络地址转换信息的方法、装置及系统
US20160234113A1 (en) * 2015-02-09 2016-08-11 Ixia Methods, systems, and computer readable media for identifying network locations associated with endpoints
CN111935014A (zh) * 2020-10-19 2020-11-13 网络通信与安全紫金山实验室 基于SRv6网络的报文转发方法、装置、存储介质及电子设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070253417A1 (en) * 2006-04-27 2007-11-01 Nokia Corporation Address translation in a communication system
US20080071927A1 (en) * 2006-09-20 2008-03-20 Min-Kyu Lee Method and system for automatic tunneling using network address translation
CN102685262A (zh) * 2012-04-16 2012-09-19 中兴通讯股份有限公司 一种探测网络地址转换信息的方法、装置及系统
US20160234113A1 (en) * 2015-02-09 2016-08-11 Ixia Methods, systems, and computer readable media for identifying network locations associated with endpoints
CN111935014A (zh) * 2020-10-19 2020-11-13 网络通信与安全紫金山实验室 基于SRv6网络的报文转发方法、装置、存储介质及电子设备

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117579525A (zh) * 2023-11-20 2024-02-20 北京思存通信技术有限公司 一种网络协议特征识别系统
CN117579525B (zh) * 2023-11-20 2024-06-11 北京思存通信技术有限公司 一种网络协议特征识别系统

Also Published As

Publication number Publication date
CN116455863A (zh) 2023-07-18

Similar Documents

Publication Publication Date Title
JP6858749B2 (ja) 負荷平衡システムにおいて接続を確立するデバイス及び方法
JP3819295B2 (ja) ユーザによって構成可能なファイアウォールを有する公衆網アクセス・サーバ
US8250658B2 (en) Syntax-based security analysis using dynamically generated test cases
JP5335886B2 (ja) ローカル・ネットワーク間でデータ・パケットを通信するための方法および装置
CN110505244B (zh) 远程隧道访问技术网关以及服务器
US10341286B2 (en) Methods and systems for updating domain name service (DNS) resource records
US11888818B2 (en) Multi-access interface for internet protocol security
New et al. Reliable Delivery for syslog
WO2023130901A1 (zh) 一种网络节点间nat探测方法、装置、设备及存储介质
EP4156626A1 (en) Ipv6 network communication method, apparatus and system
Scudder et al. Bgp monitoring protocol (bmp)
JP3296514B2 (ja) 暗号通信端末
CN115589383A (zh) 基于eBPF的虚拟机数据传输方法、装置、设备及存储介质
CN108989342B (zh) 一种数据传输的方法及装置
CN111158864B (zh) 数据处理方法、装置、系统、介质和程序
CN112565053A (zh) 识别私网用户的方法、装置、服务系统及存储介质
CN112272134A (zh) IPSec隧道建立方法及装置、分支设备、中心端设备
WO2023061158A1 (zh) 加解密方法、装置及计算机可读存储介质
CN112242943B (zh) IPSec隧道建立方法及装置、分支设备、中心端设备
WO2023284231A1 (zh) 报文处理方法和报文处理系统
Nedergaard et al. Evaluating coap, OSCORE, DTLS and HTTPS for secure device communication
JP2012527794A (ja) ホストアイデンティティタグ取得のための方法およびシステム
CN110086702B (zh) 报文转发方法、装置、电子设备及机器可读存储介质
CN115442328B (zh) 一种网络地址转换方法、装置、网关、介质和设备
CN113067908B (zh) 一种nat穿越方法、装置、电子设备和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22918351

Country of ref document: EP

Kind code of ref document: A1