CN100525251C - A method for network address translation - Google Patents

Abstract

The invention discloses a network address conversion method, which realizes network address conversion between a public network and a private network, and adopts a processing control block during network address conversion. The network address conversion method includes converting a private network IP address to a public network IP address, And the public network IP address is converted to the private network IP address; when the private network IP address is converted to the public network IP address, a processing control block is set up in the home gateway, and after modifying the port number and the source IP address of the sent data frame, the data The frame is sent to the public network; when the public network IP address is converted to the private network IP address, the corresponding processing control block is searched in the home gateway for the received data frame, and the destination IP address of the data frame is modified according to the information in the processing control block and destination port number.

Description

A method for network address translation

technical field

The invention relates to computer network technology, in particular to the realization of network address translation.

Background technique

With the maturity of broadband technology, home networking will become an important part of the entire society's informatization. In order to meet the continuously increasing demand for broadband services, a new concept of "digital home" is proposed. Businesses in the "Digital Home" category can be divided into four types:

1. Home entertainment and communication: provide services such as digital TV, video and audio on demand, time-shift TV, online games, video telephony, and distance education through set-top boxes;

2. Home security category: provide monitoring and alarms for families, such as intrusion alarms, outdoor alarms, smoke/overflow monitoring and alarms, etc.;

3. Home automatic control: use the network to control home appliances, lighting control, door and window control, etc.;

4. Family medical care: As a long-term plan, the family medical business can conduct remote daily health checks, ECG/blood pressure/glucose/weight/spirometer measurements, implement drug treatment plans, and video consultations for family members.

One of the technical obstacles in the realization of "Digital Home" is that the existing computer network can no longer support the penetration of digital networks into home devices, and the shortage of IP addresses is an important problem encountered. IPv4, which is widely used now, is an IP protocol designed in the late 1970s. The IP address of IPv4 is only 32 bits. With the increase of global computer users, and the lack of early IP address classification and allocation methods, there is a shortage of IP addresses. Very serious. Although the newly proposed IPv6 expands the IP address from 32 bits to 128 bits, which can fundamentally solve the problem of the shortage of IP addresses, but the existing network architecture (including network hardware devices and running network protocol software, etc.) ) has a greater impact, and it is difficult to replace IPv4 in the short term.

One way to solve the shortage of IP addresses is to use Network Address Translation (NAT) technology. As long as a NAT program is run on the routing equipment connected to the private network and the Internet, the problem of shortage of IPv4 addresses can be solved at a small cost. In the "digital home", the network address translation technology can also be used to solve the shortage of IP addresses, so that the value chain of the current mature computer network technology can be extended without changing the existing computer network architecture.

In a digital home, the corresponding NAT program that implements network address translation is installed on the home gateway. The home gateway is the mouthpiece connecting the public network and the home private network. It is not only responsible for the access and interaction of the home private network to the public network, but also responsible for the user's access and control of the home network from the public network. Device interconnection, mutual control and other operations. A home gateway with practical value should have functions such as broadband access, business identification, and control information forwarding.

In order to adapt to a wide range of applicability, the existing NAT technology must well shield the differences of the hardware layer, which means increasing the complexity of the upper layer software. However, for the home gateway in the digital home, because the application environment is relatively fixed and relatively simple, it does not need to have strong flexibility, but needs to achieve simplicity and high efficiency. Therefore, providing a simple and efficient network address translation method for the home gateway is of great significance to the realization of the digital home.

Contents of the invention

The purpose of the present invention is to overcome the defects that the upper layer software of the existing routing equipment is too complicated and the network address translation efficiency is low, thereby providing a simple and efficient network address translation method.

In order to achieve the above object, the present invention provides a network address translation method, which uses a processing control block during network address translation, and the processing control block includes 6 sub-blocks, which are respectively the IP address of a certain internal network interface on the routing device, The port number of the internal network interface, the IP address of the internal terminal device connected to the internal network interface in the private network, the information used to organize the data structure, the globally unique port number and timeout information;

The described network address translation method is used to realize the conversion from the private network IP address to the public network IP address, and specifically includes the following steps:

Step 11), the internal network interface of routing device receives the data frame that private network sends;

Step 12), judge whether the data frame reception is correct, if correct, perform the next step, otherwise delete the received data frame, then perform step 18);

Step 13), according to the purpose IP address of data frame, judge whether data frame sends to external public network, if send to external public network, then carry out next step, otherwise, carry out step 18);

Step 14), comparing the source address of the data frame with the table about the processing control block stored in the routing device, if the source address is the same as the IP address of the internal terminal device recorded in a certain processing control block, the current data Forward the connection has been established, go to step 16), otherwise go to the next step;

Step 15), create a new processing control block in the table about the processing control block saved by the routing device;

Step 16), modify the port number of the internal network interface in the data frame to a globally unique port number, modify the source IP address of the data frame to the IP address of the external network interface of the routing device, and modify the checksum simultaneously;

Step 17), calling the sending processing process of the driver program of the external network interface to send the data frame;

Step 18), end this sending operation.

The present invention also provides a network address translation method, which uses a processing control block during network address translation, and the processing control block includes 6 sub-blocks, which are respectively the IP address of a certain internal network interface on the routing device, and the IP address of the internal network interface. Port number, IP address of the internal terminal device connected to the internal network interface in the private network, information for organizing data structure, globally unique port number and timeout information;

The described network address translation method is used to realize the conversion from the public network IP address to the private network IP address, and specifically includes the following steps:

Step 21), the external network interface of routing device receives the data frame that external network sends;

Step 22), judge whether the data frame reception is correct, if correct, perform the next step, otherwise delete the received data frame, then perform step 27);

Step 23), according to the purpose port number in the data frame, judge whether this data frame is sent to private network, if the purpose port number is identical with the global unique port number in the processing control block that is stored in the routing equipment, then this data frame sends To the private network, go to the next step; otherwise go to step 27);

Step 24), find the processing control block where the globally unique port number is located according to the globally unique port number found that is identical to the destination port number;

Step 25), utilize the IP address of the internal terminal equipment in the processing control block found in step 24) to modify the destination IP address in the data frame, utilize the port number of the internal network interface in the processing control block to modify the IP address in the data frame Destination port number, and also change the checksum in the data frame;

Step 26), utilize the IP address of the internal network interface in the processing control block found in step 24), call the sending process of the driver of the interface to forward the data frame;

Step 27), end operation.

In the above technical solution, before the network address translation method realizes the conversion from the public network IP address to the private network IP address, the configuration operation is performed on the processing control block, and corresponding information is added to the 6 sub-blocks of the processing control block .

The present invention also provides a network address translation method. A processing control block is used during network address translation. The processing control block includes 6 sub-blocks, which are respectively the IP address of a certain internal network interface on the routing device, the IP address of the internal network interface, and the IP address of the internal network interface. Port number, IP address of the internal terminal device connected to the internal network interface in the private network, information for organizing data structure, globally unique port number and timeout information;

The network address translation method includes converting a private network IP address to a public network IP address, and converting a public network IP address to a private network IP address;

Wherein, the conversion of the private network IP address to the public network IP address specifically includes the following steps:

Step 11), the internal network interface of routing device receives the data frame that private network sends;

Step 12), judge whether the data frame reception is correct, if correct, perform the next step, otherwise delete the received data frame, then perform step 18);

Step 13), according to the purpose IP address of data frame, judge whether data frame sends to external public network, if send to external public network, then carry out next step, otherwise, carry out step 18);

Step 14), comparing the source address of the data frame with the table about the processing control block stored in the routing device, if the source address is the same as the IP address of the internal terminal device recorded in a certain processing control block, the current data Forward the connection has been established, go to step 16), otherwise go to the next step;

Step 15), create a new processing control block in the table about the processing control block saved by the routing device;

Step 16), modify the port number of the internal network interface in the data frame to a globally unique port number, modify the source IP address of the data frame to the IP address of the external network interface of the routing device, and modify the checksum simultaneously;

Step 17), calling the sending processing process of the driver program of the external network interface to send the data frame;

Step 18), end this sending operation;

Wherein, the described public network IP address conversion to the private network IP address specifically includes the following steps:

Step 21), the external network interface of routing device receives the data frame that external network sends;

Step 22), judge whether the data frame reception is correct, if correct, perform the next step, otherwise delete the received data frame, then perform step 27);

Step 23), according to the purpose port number in the data frame, judge whether this data frame is sent to private network, if the purpose port number is identical with the global unique port number in the processing control block that is stored in the routing equipment, then this data frame sends To the private network, go to the next step; otherwise go to step 27);

Step 24), find the processing control block where the globally unique port number is located according to the globally unique port number found that is identical to the destination port number;

Step 25), utilize the IP address of the internal terminal equipment in the processing control block found in step 24) to modify the destination IP address in the data frame, utilize the port number of the internal network interface in the processing control block to modify the IP address in the data frame Destination port number, and also change the checksum in the data frame;

Step 26), utilize the IP address of the internal network interface in the processing control block found in step 24), call the sending process of the driver of the interface to forward the data frame;

Step 27), end operation.

In the above technical solution, in the step 15), when setting up a new processing control block, the IP address of the internal terminal that sends the data frame is used as the IP address of the internal terminal device connected to the internal network interface in the private network. IP address; the IP address of the internal network interface connected to the internal terminal sending the data frame is used as the IP address of a certain internal network interface on the routing device; the port of the internal network interface connected to the internal terminal sending the data frame number as the port number of the internal network interface; assign a port number that only belongs to the internal terminal that sends the data frame as the globally unique port number.

In the above technical solution, in the step 17), when the data frame is sent, the forwarding of the data frame is realized on the data link layer.

The advantages of the present invention are:

1. The network address translation method of the present invention is aimed at the specific application of the home gateway, and has a simple principle and high address translation efficiency.

2. The network address translation method of the present invention performs data forwarding operations at the link layer, which simplifies the implementation complexity of the IP layer code and improves the data forwarding efficiency.

Description of drawings

Fig. 1 is the data structure diagram of the processing control block in the network address translation method of the present invention;

Fig. 2 is the position of data flow in the network protocol in the network address translation method of the present invention;

Fig. 3 is the flow chart that private network IP address is converted to public network IP address in the network address translation method of the present invention;

FIG. 4 is a flow chart of converting a public network IP address to a private network IP address in the network address translation method of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

Example 1:

Taking a home local area network as an example, the method of the present invention is described. In a home local area network, multiple household appliances with network interfaces are connected to an internal network interface of a home gateway, and all the home appliances connected to the home gateway form a home local area network. There is also an external network interface on the home gateway, through which the home gateway is connected to the Internet, thereby realizing the connection between the home local area network and the Internet. Assume that in the home LAN in this embodiment, household appliances include an air conditioner, a washing machine, and a home computer. These appliances are all connected to the internal network interface on the home gateway.

The home appliances in the home LAN need to implement network address translation to interact with an external host in the Internet. The present invention constructs a new data structure "Processing Control Block" (Processing Control Block, hereinafter referred to as PCB) to realize network address conversion. As shown in Figure 1, the processing control block can be divided into six sub-blocks, wherein, ① represents the IP address of a certain internal network interface on the routing device; ② represents the port number of the internal network interface; ③ represents the internal network and ① represented The IP address of the internal terminal device connected to the internal network interface; ④ indicates the information used to organize the data structure, and this item is used to connect the record items ⑤ into a linked list for easy management; ⑤ indicates the globally unique port number. Different electrical appliances have different port numbers ⑤, and the same electrical appliance has the same port number ⑤ at different times; ⑥ indicates timeout information, which is used to delete a certain PCB data structure that has not been used for a long time, so as to dynamically maintain the entire address Information needed for conversion.

Next, assuming that a computer in the home local area network interacts with an external host, the network address translation method of the present invention will be further described. The interaction between the computer in the home LAN and the external host can be divided into two parts, that is, the internal network sends access requests to the external network, and the external network responds to the internal network access requests, which are explained below:

1. The internal network makes an access request to the external network, as shown in FIG. 3 , including the following steps.

Step 11, the internal network interface of the home gateway receives the data frame sent by the internal network;

Step 12, judging whether the received data frame is correct, if correct, execute the next step, otherwise delete the received data frame;

Step 13, analyze the structure of the data frame, take out the destination IP address according to the offset of the IP address from the start position of the data frame, and judge whether the frame data is sent to the external network; if the destination IP address is a certain terminal of the internal network IP, then the data frame is not sent to the external network, go to step 18; otherwise it is considered to be sent to the external network, go to the next step;

For example, after the home gateway receives the data frame sent by the computer in the home LAN, it judges the destination IP address in the data frame, and if the destination IP address is the IP address or identification of the washing machine in the home LAN, the data The frame is sent to the washing machine, otherwise the data frame is sent to the Internet through the home gateway.

Step 14. Compare the source address of the data frame with the ③ field of the PCB entry, search the PCB table to see if there is a matching PCB entry available, that is, check whether a connection has been established for this data forwarding, and if there is a matching table If the item is available, go to step 16, otherwise go to the next step;

Step 15, create a new PCB entry, and then execute the next step;

For example, suppose the network identifier of the computer in the home LAN is private_ip, the network identifier of the internal network interface connected to the home gateway of the computer is local_ip, and the IP address of the external network interface of the home gateway connected to the Internet is external_ip, the IP address is a valid IP address. When the computer sends data to the home gateway through local_ip, a port number is assigned, which is recorded as local_port. Assume that the globally unique port number of the home gateway is Ass_port, set the timeout period tmr (the use of the timeout mechanism here has nothing to do with the network address translation mechanism, in order to highlight the key points and keep it simple, it will not be considered below), and finally give the organization data The data item of the structure is assigned an effective pointer next, which is used to organize the effective PCB data structure into a linked list. When the computer in the home LAN sends data out for the first time, the PCB data table created is shown in Table 1:

entry value ① Local_ip ② Local-port ③ Private_ip ④ Next ⑤ Ass_port ⑥ Tmr

Table 1

After the PCB data table is established, modify the data frame according to the relevant content in the data table. For example, when a computer in the home LAN wants to send data to the Internet, change the source IP in the data frame to external_ip; change Local_port to ass_port, and modify the checksum.

Step 16, change the source IP address segment of the data frame into the IP address of the external network interface, change the original port number into the globally unique port number ⑤,

Step 17, calling the sending processing process of the driver of the external network interface to send the data frame; when forwarding the data frame, as shown in Figure 2, the data frame is forwarded on the data link layer. The reason why data is forwarded at the link layer is because the realization of network address translation of the present invention is embedded in the hardware driver of the network interface, and can be regarded as a part of the hardware driver, rather than calling the driver layer through the interface of the hardware driver The service provided, which means that there is no need to modify the IP layer, which improves the efficiency of data forwarding.

Step 18, end this sending operation.

2. The external network responds to the access request of the internal network, as shown in FIG. 4 , including the following steps.

Step 21, the external network interface of the home gateway receives the data frame sent by the external network;

Step 22, judging whether the received data frame is correct, if correct, execute the next step, otherwise delete the received data frame;

Step 23, parse the structure of the data frame, take out the destination port number according to the offset between the location of the destination port number and the start position of the data frame, judge whether the frame data is sent to the internal network according to the destination port number; use the destination port The number is matched with ⑤ in the entries in the PCB table one by one. If there is no matching PCB entry, the data frame is not sent to the internal network, go to step 27; otherwise, it is sent to the internal network, go to the next step;

Step 24. Find the PCB where the globally unique port number is located according to the found globally unique port number identical to the destination port number;

Step 25, change the destination IP address in the data frame according to the ③ field in the PCB entry, use ② field to change the destination port number in the data frame, and modify the corresponding check digit;

For example, when a terminal in the Internet sends a data frame to a computer in the home LAN, the destination port number in the data frame should be ass_port. By looking up the PCB table, the home gateway can know that the data frame is sent to the computer it is connected to. In the home LAN, according to the content filled in the PCB entry, modify the destination address in the data frame from external_ip to private_ip, and modify the destination port number in the data frame from ass_port to local_port.

Step 26, find out the corresponding internal network interface according to 1. of the matching PCB entry, and call the sending process of the driver of the interface to forward the data frame;

Since in the PCB entry, the network identifier of the internal network interface connected to the computer is local_ip, its driver is called to send the data frame to the computer.

Step 27, end the operation.

Example 2:

In some private networks, some internal terminals will not take the initiative to request access to the network. For example, in a "digital home", an air conditioner with networking function cannot access terminals in the public network. But the user needs to control it remotely, so it needs to be configured.

In actual implementation, some reserved globally unique port numbers are assigned to the internal terminals in the private network. For example, the port numbers in the range of 65000~65530 are used as reserved port numbers and allocated to "passive" devices such as air conditioners. The user configures the home gateway through a computer. The specific configuration content is to establish a PCB data structure for similar "passive" devices. . For example, the terminal IP address of an air conditioner is IP_aircondition; the address of the internal network interface connected to the home gateway is IP_local_air; the globally unique port number assigned to it is 65001; since this passive device does not have multiple sessions at the same time ( session), so the port number of the internal network structure can theoretically be used, but in order to maintain consistency and facilitate the calculation of the checksum, it can be set to be the same as the globally unique port number, that is, 65001; and the timeout timer tmr can be set It is infinity, that is, this PCB data structure will not be invalidated due to long-term non-use. The established PCB data structure is shown in Table 2:

entry value ① IP_local_air ② 65001 ③ IP_aircondition ④ Next ⑤ 65001 ⑥ gigantic

Table 2

After the above processing control block is established, the operation flow of data forwarding is the same as the normal processing flow described in Embodiment 1. No further description will be given in this embodiment.

The above-mentioned embodiment 1 and embodiment 2 take the home local area network as an example to illustrate the network address translation method of the present invention, but those of ordinary skill in the art should understand that in other applications involving public network IP address and private network IP address translation In the scenario, the network address translation method of the present invention is also applicable.

Claims (6)

1, a kind of network address translation method, adopt processing control block when network address translation, it is characterized in that, described processing control block comprises 6 sub-blocks, is respectively the IP address of a certain internal network interface on the routing device, the internal network interface The port number of the private network, the IP address of the internal terminal device connected to the internal network interface in the private network, the information used to organize the data structure, the globally unique port number and timeout information; The described network address translation method is used to realize the conversion from the private network IP address to the public network IP address, and specifically includes the following steps: Step 11), the internal network interface of routing device receives the data frame that private network sends; Step 12), judge whether the data frame reception is correct, if correct, perform the next step, otherwise delete the received data frame, then perform step 18); Step 13), according to the purpose IP address of data frame, judge whether data frame sends to external public network, if send to external public network, then carry out next step, otherwise, carry out step 18); Step 14), comparing the source address of the data frame with the table about the processing control block stored in the routing device, if the source address is the same as the IP address of the internal terminal device recorded in a certain processing control block, the current data Forward the connection has been established, go to step 16), otherwise go to the next step; Step 15), create a new processing control block in the table about the processing control block saved by the routing device; Step 16), modify the port number of the internal network interface in the data frame to a globally unique port number, modify the source IP address of the data frame to the IP address of the external network interface of the routing device, and modify the checksum simultaneously; Step 17), calling the sending processing process of the driver program of the external network interface to send the data frame; Step 18), end this sending operation. 2. A network address translation method, which uses a processing control block during network address translation, wherein the processing control block includes 6 sub-blocks, which are respectively the IP address of a certain internal network interface on the routing device, the internal network interface The port number of the private network, the IP address of the internal terminal device connected to the internal network interface in the private network, the information used to organize the data structure, the globally unique port number and timeout information; The described network address translation method is used to realize the conversion from the public network IP address to the private network IP address, and specifically includes the following steps: Step 21), the external network interface of routing device receives the data frame that external network sends; Step 22), judge whether the data frame reception is correct, if correct, perform the next step, otherwise delete the received data frame, then perform step 27); Step 23), according to the purpose port number in the data frame, judge whether this data frame is sent to private network, if the purpose port number is identical with the global unique port number in the processing control block that is stored in the routing equipment, then this data frame sends To the private network, go to the next step; otherwise go to step 27); Step 24), find the processing control block where the globally unique port number is located according to the globally unique port number found that is identical to the destination port number; Step 25), utilize the IP address of the internal terminal equipment in the processing control block found in step 24) to modify the destination IP address in the data frame, utilize the port number of the internal network interface in the processing control block to modify the IP address in the data frame Destination port number, and also change the checksum in the data frame; Step 26), utilize the IP address of the internal network interface in the processing control block found in step 24), call the sending process of the driver of the interface to forward the data frame; Step 27), end operation. 3. The network address translation method according to claim 2, characterized in that, before the network address translation method realizes the conversion from the public network IP address to the private network IP address, the configuration operation is performed on the processing control block, for The six sub-blocks of the processing control block add corresponding information. 4. A network address translation method, characterized in that a processing control block is used during network address translation, and the processing control block includes 6 sub-blocks, which are respectively the IP address of a certain internal network interface on the routing device, the internal network interface The port number of the private network, the IP address of the internal terminal device connected to the internal network interface in the private network, the information used to organize the data structure, the globally unique port number and timeout information; The network address translation method includes converting a private network IP address to a public network IP address, and converting a public network IP address to a private network IP address; Wherein, the conversion of the private network IP address to the public network IP address specifically includes the following steps: Step 11), the internal network interface of routing device receives the data frame that private network sends; Step 12), judge whether the data frame reception is correct, if correct, perform the next step, otherwise delete the received data frame, then perform step 18); Step 13), according to the purpose IP address of data frame, judge whether data frame sends to external public network, if send to external public network, then carry out next step, otherwise, carry out step 18); Step 14), comparing the source address of the data frame with the table about the processing control block stored in the routing device, if the source address is the same as the IP address of the internal terminal device recorded in a certain processing control block, the current data Forward the connection has been established, go to step 16), otherwise go to the next step; Step 15), create a new processing control block in the table about the processing control block saved by the routing device; Step 16), modify the port number of the internal network interface in the data frame to a globally unique port number, modify the source IP address of the data frame to the IP address of the external network interface of the routing device, and modify the checksum simultaneously; Step 17), calling the sending processing process of the driver program of the external network interface to send the data frame; Step 18), end this sending operation; Wherein, the described public network IP address conversion to the private network IP address specifically includes the following steps: Step 21), the external network interface of routing device receives the data frame that external network sends; Step 22), judge whether the data frame reception is correct, if correct, perform the next step, otherwise delete the received data frame, then perform step 27); Step 23), according to the purpose port number in the data frame, judge whether this data frame is sent to private network, if the purpose port number is identical with the global unique port number in the processing control block that is stored in the routing equipment, then this data frame sends To the private network, go to the next step; otherwise go to step 27); Step 24), find the processing control block where the globally unique port number is located according to the globally unique port number found that is identical to the destination port number; Step 25), utilize the IP address of the internal terminal equipment in the processing control block found in step 24) to modify the destination IP address in the data frame, utilize the port number of the internal network interface in the processing control block to modify the IP address in the data frame Destination port number, and also change the checksum in the data frame; Step 26), utilize the IP address of the internal network interface in the processing control block found in step 24), call the sending process of the driver of the interface to forward the data frame; Step 27), end operation. 5. The network address translation method according to claim 1 or 4, characterized in that, in said step 15), when setting up a new processing control block, the IP address of the internal terminal sending the data frame is used as said The IP address of the internal terminal device connected to the internal network interface in the private network described above; the IP address of the internal network interface connected to the internal terminal sending the data frame as the IP address of a certain internal network interface on the routing device; The port number of the internal network interface connected to the internal terminal that sends the data frame is used as the port number of the internal network interface; a port number that only belongs to the internal terminal that sends the data frame is assigned as the globally unique port Number. 6. The network address translation method according to claim 1 or 4, characterized in that, in the step 17), when sending the data frame, the forwarding of the data frame is realized on the data link layer.

Images