WO2019184804A1 - 网络地址转换 - Google Patents

网络地址转换 Download PDF

Info

Publication number
WO2019184804A1
WO2019184804A1 PCT/CN2019/079161 CN2019079161W WO2019184804A1 WO 2019184804 A1 WO2019184804 A1 WO 2019184804A1 CN 2019079161 W CN2019079161 W CN 2019079161W WO 2019184804 A1 WO2019184804 A1 WO 2019184804A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
quintuple
bit
port
state
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/079161
Other languages
English (en)
French (fr)
Inventor
安绍亮
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
New H3C Technologies Co Ltd
Original Assignee
New H3C Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by New H3C Technologies Co Ltd filed Critical New H3C Technologies Co Ltd
Priority to EP19777369.0A priority Critical patent/EP3758341A4/en
Priority to US17/041,198 priority patent/US11201852B2/en
Priority to JP2020551868A priority patent/JP6978612B2/ja
Publication of WO2019184804A1 publication Critical patent/WO2019184804A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2514—Translation of Internet protocol [IP] addresses between local and global IP addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2517—Translation of Internet protocol [IP] addresses using port numbers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/255—Maintenance or indexing of mapping tables
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2557—Translation policies or rules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC

Definitions

  • the network address translation (NAT) device After receiving the packet, the network address translation (NAT) device performs the new process if the packet needs to be processed by NAT and the packet meets the new conditions of the session information.
  • the "session information" herein includes, for example, a source IP (Internet Protocol) address, a destination address, a source port, a destination port, and a quintuple of a transport layer protocol.
  • each conflict trial can only test a new quintuple when the new quintuple
  • multiple trials are required, and since the storage medium on which the session table is read each time has an interface delay, the new performance is undoubtedly poor.
  • FIG. 1 is a schematic structural diagram of a networking system according to an exemplary embodiment of the present disclosure.
  • FIG. 2 is a flowchart of a NAT method according to an exemplary embodiment of the present disclosure.
  • FIG. 3 is a schematic diagram of determining a target quintuple of a message based on a bitmap when converting a source IP address according to an exemplary embodiment of the present disclosure.
  • FIG. 4 is a diagrammatic view of recovering bits in a bitmap when converting a source IP address, according to an exemplary embodiment of the present disclosure.
  • FIG. 5 is a schematic structural diagram of a NAT device according to an exemplary embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of a NAT device according to an exemplary embodiment of the present disclosure.
  • first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as second information without departing from the scope of the present disclosure.
  • second information may also be referred to as first information.
  • word "if” as used herein may be interpreted as "when” or “when” or “in response to a determination.”
  • NAT can be classified into PAT (Port Address Translation) and NO-PAT (Not Port Address Translation).
  • NO-PAT Port Address Translation
  • an external network IP address that is, a public network IP address
  • NO-PAT Not Port Address Translation
  • an external network IP address can only be assigned to an intranet IP address for NAT; and in the PAT mode, an external network IP address can be simultaneously allocated to multiple internal addresses.
  • the network IP address is shared.
  • the NAT that appears in the present disclosure refers to the PAT mode.
  • NAT can be divided into: inbound interface translation source IP address, inbound interface conversion destination IP address, outbound interface conversion source IP address, and outbound interface conversion destination IP address. Also, the conversion process for different addresses is similar.
  • the present disclosure provides a NAT method, apparatus, and NAT device to improve the new performance of the NAT process.
  • the NAT method provided by the present disclosure is first introduced below.
  • a NAT method provided by the present disclosure is applied to a NAT device.
  • the NAT method may be performed by a CPU in a NAT device.
  • the CPU may be executed together with some hardware, where the hardware is partially implemented.
  • It can be an Integrated Circuit ASIC (Application Specific Integrated Circuit)/FPGA (Field-Programmable Gate Array).
  • the so-called NAT device is an edge device of the network, which is used for the purpose of allowing an internal network user to access an external public network and allowing an external public network to access a part of internal resources (for example, an internal server), for example, a device of the NAT device.
  • the type can be a router, of course not limited to this.
  • a bitmap is constructed in advance, each bit in the bitmap is used to indicate a state of a quintuple, that is, a conflict state or a non-collision state, wherein the bitmap is stored in a storage medium of the NAT device.
  • the bitmap includes a plurality of entries, each of the entries includes a plurality of bits, and each bit corresponds to a binary string having the same number of bits as the first type of bits.
  • the first type of bits are the first type of bits of the five-tuple type of port (ie, the port for NAT processing and the port for which NAT processing is not performed), and the number and location of bits can be set according to actual conditions, for example:
  • the first type of bit may be the 0th bit of the port, may be the 0th bit and the 1st bit of the port, or may be the 0th bit, the 1st bit and the 2nd bit of the port, or may be the 14th bit of the port and 15th bit, and so on.
  • the difference is only in the plurality of quintuples of the first type of bits of a certain port, and can be uniquely corresponding to one bit in the same entry, that is, any entry corresponds to The difference is only in the multiple five-tuples of the first type of bits of a port.
  • Each entry in the bitmap is a row of bits.
  • each entry can be indexed by a fixed number of hashes, and the states represented by the multiple bits in each entry can be initialized to a non-conflict state.
  • the state represented by the bit corresponding to the target quintuple in the bitmap may be set to a conflict state.
  • each bit can represent a non-collision state with 0, and 1 indicates a collision state. At this time, the bits in the bitmap are all 0 at the time of initialization.
  • the present disclosure exemplarily provides a networking system suitable for the method provided by the present disclosure.
  • a schematic structural diagram of the networking system can be seen in FIG. 1.
  • the networking system includes: host A, NAT device B, and server C.
  • Host A and server C belong to different networks, that is, host A belongs to the intranet and server C belongs to the external network. Therefore, when the host A sends a packet to the server C, the NAT device needs to perform NAT processing on the packet sent by the host A, and then sends the NAT-processed packet to the server C. Similarly, when the server C sends the packet to the host A.
  • the NAT device needs to perform NAT processing on the packet sent by the server C, and then sends the NAT-processed packet to the host A.
  • the NAT device B in FIG. 1 can perform NAT processing on the packet sent by the host A to the server C and the packet sent from the server C to the host A by using a NAT method provided by the disclosure. NAT processing.
  • a NAT method provided by the present disclosure may include the following steps.
  • the NAT device When the NAT device receives the packet sent by the other device in the networking system, if the packet needs to be processed by NAT and the packet meets the new conditions of the session information, the NAT device performs a new process.
  • the target IP address and the reference port of the target IP address may be obtained from the NAT resource pool, where the reference port is one of a continuous port range of the target IP address. port.
  • the hashed value of the original quintuple of the message can be selected, randomly selected or sequentially selected, and the like.
  • the original quintuple in the packet includes: source IP address, destination IP address, source port, destination port, and transport protocol; and the NAT processing time conversion requirement may be to convert only the source IP address or To convert the destination IP address, you can also convert both the source IP address and the destination IP address. Therefore, after obtaining the target IP address and the reference port, if the source IP address needs to be converted, the target IP address is used to replace the source IP address in the original quintuple, and the reference port is used to replace the original quintuple. Source port; if the destination IP address needs to be translated, the destination IP address is used to replace the destination IP address in the original quintuple, and the reference port is used to replace the destination port in the original quintuple.
  • the target IP address described in the present disclosure is an IP address taken from the NAT resource pool, and the target IP address may be used as a source IP address or a destination IP address; and the reference port is a continuous port of the target IP address.
  • an ACL Access Control List
  • the NAT device stores multiple NAT resource pools to deal with different types of IP addresses, and each NAT resource pool includes an IP address and a corresponding port range.
  • whether the packet satisfies the new condition of the session information may include: determining whether the packet is the first packet, and if , to determine that the message meets the new conditions of the session information.
  • whether the packet satisfies the new condition of the session information may include: determining whether the packet can directly perform NAT processing based on the session table. If not, determine that the message meets the new conditions of the session information.
  • the TCP protocol and the UDP protocol are only described as an example, and are not limited. In a specific application, similar processing can be performed on a packet in a data stream using other protocols. For example, when it is determined that the packet cannot directly perform NAT processing based on the session table, it is determined that the packet satisfies the session information creation condition.
  • each bit in the bitmap is used to indicate whether the state of the quintuple is a conflicting state or a non-conflicting state.
  • S104 Set a state represented by the target bit to a conflict state, and generate a target quintual corresponding to the packet based on the target bit.
  • the NAT device may replace the source IP address or the destination IP address in the original quintuple of the packet with the target IP address based on the conversion requirement corresponding to the packet.
  • the source port or the destination port in the original quintuple is replaced by the reference port, so that the first quintuple corresponding to the packet is generated.
  • the NAT device may mask the first type of bits of the reference port in the first quintuple, that is, set to 0 to obtain the second quintuple. Specifically, when converting the source IP address, masking the first type of bits of the source port in the first quintuple, and when converting the destination IP address, the destination port in the first quintuple The first type of bits are masked.
  • the NAT device may determine a target bit indicating a non-collision state from the pre-built bitmap based on the result of the hash calculation of the second quintuple. Moreover, after obtaining the target bit, the NAT device may set the state represented by the target bit to a conflict state, and generate a target quintuple corresponding to the packet based on the target bit. Specifically, the target quintuple corresponding to the packet is generated according to the target bit, and the first type of the masked second quintuple is restored by using the binary string corresponding to the target bit, thereby obtaining the The target quintuple corresponding to the message.
  • the port is represented by 16-bit bits, that is, the source port and the destination port are both represented by 16-bit bits.
  • the number and location of the bits may be set according to actual conditions.
  • the first type of bits may be the 0th bit of the port, and may be the 0th bit and the 1st bit of the port, or may be The 0th bit, the 1st bit, and the 2nd bit of the port can also be the 14th bit and the 15th bit of the port, and so on.
  • the first type of bits is at least one consecutive bit at the end of the port, and the specific number of bits can be set according to a specific application environment.
  • the first type of bits are two consecutive bits at the end of the port, that is, the 0th bit and the 1st bit, or the first type of bits are consecutive 3 bits at the end of the port, that is, the 0th bit, the 1st bit.
  • the bit and the second bit, or the first type of bits are consecutive four bits at the end of the port, namely the 0th bit, the 1st bit, the 2nd bit, and the 3rd bit, and so on.
  • each entry includes a plurality of bits, each bit corresponding to a binary string having the same number of bits as the first type of bits, and therefore, the bits included in each entry are The number is related to the number of bits of the first type, specifically 2 N , where N is the number of bits of the first type of bits.
  • Each bit corresponds to a binary string having the same number of bits as the first type, and the correspondence may be arranged in the order of the size of the binary string.
  • the bits from the front to the back of an entry correspond to: 0000000, 0000000, 0000010, ..., 1111111, respectively; or, respectively, corresponding to: 1111111, 1111110, 1111101, 1111100... 0000001, 0000000.
  • the step of determining, according to the hash result of the second quintuple, the target bit indicating the non-conflict state from the pre-built bitmap may include:
  • Target bit corresponds to a non-conflict state
  • binary string corresponding to the target bit and the port formed by the unmasked portion of the reference port are located in the one Within the range of continuous ports.
  • the first entry is: the second quintuple and the entry corresponding to the plurality of quintuples of the first type of bits, which are different from the second quintuple.
  • the first hash algorithm may include, but is not limited to, an MD (Message Digest Algorithm) or a SHA (Secure Hash Algorithm).
  • the determined target bit satisfies the following conditions:
  • the state corresponding to the target bit is a non-conflict state, and the binary string corresponding to the target bit and the port formed by the unmasked portion of the reference port are located in the range of the one continuous port.
  • the process of determining a target bit from the first entry may include: determining, from the first entry, at least one bit that is in a non-conflict state, and then determining, from the at least one bit, the corresponding binary string and the reference A port formed by an unmasked portion of a port, a target bit located within the range of the one continuous port.
  • the process of determining the target bit from the first entry may include: determining, from the first entry, a port formed by the corresponding binary string and the unmasked portion of the reference port, located in the one continuous port range At least one bit within, and further from the determined bits, a target bit indicating a non-conflict state is determined.
  • the number of target quintuples may be multiple.
  • the target number of target bits can be determined from the bitmap.
  • the target number can be recorded in the ACL, and the target number can be obtained by querying the ACL.
  • S105 Record the target quintuple and the original quintuple in the session table, and perform NAT processing on the packet based on the target quintuple.
  • the session table is divided into two levels: a hash table and a result table.
  • the hash table is a first-level table of the session table, and is used for storing the signature information of the quintuple hash calculation and the pointer to the result table; and the result table is the second-level table of the session table, and is used for Store quintuple and other forwarding related information.
  • the NAT device can record the target quintuple and the original quintuple in the hash table and the result table. And after determining the target quintuple, the NAT device may perform NAT processing on the packet, which may include: replacing the original quintuple in the packet with the target quintuple.
  • the target quintuple is restored to an available state, and in order to ensure the validity of the bitmap, the target five in the bitmap may be The state indicated by the bit corresponding to the tuple is restored. Therefore, the NAT method provided by the present disclosure may further include the following steps.
  • step a1 when it is detected that the record content corresponding to the target quintuple is deleted from the session table, the address translation type corresponding to the target quintuple is determined.
  • step a2 a port matching the address translation type in the target quintual is determined, and the first type of bits of the determined port is masked to obtain a third quintuple.
  • the port matching the address translation type in the target quintuple is: a source port; and when the determined address translation type is a conversion destination IP address, The port in the target quintu that matches the address translation type is: destination port.
  • step a3 the second index value corresponding to the third quintuple is calculated by using the first hash algorithm, and the second index is determined from the bitmap by using the second index value.
  • Step a4 from the second entry, determining a bit corresponding to the target binary string, and setting a state represented by the determined bit to a non-conflict state, the target binary string being the target quintuple The first type of bit of the port that the address translation type matches.
  • the NAT device corresponds to an address translation type.
  • determining the address translation type corresponding to the target quintuple may be: The address translation type corresponding to the target quintuple.
  • the NAT device corresponds to the at least two address translation types.
  • the step of recording the target quintuple and the original quintuple in the session table may include:
  • the target five-tuple, the original five-tuple, and the address translation type of the current NAT are recorded in the session table.
  • determining the address translation type corresponding to the target quintual may be:
  • the address translation type may be a conversion source IP address, a conversion destination IP address, a conversion source IP address and then a destination IP address, or a destination IP address and then a source IP address.
  • the specific representation of the value of the address translation type may exist in various ways.
  • the value of the address translation type may be composed of three bits, wherein the highest bit is a conversion, and the lower two bits are a conversion mode. Specifically, when the address translation type is represented by three bits, the correspondence between the address translation type and the type value is as shown in Table 1:
  • the target quintuple is: (src_ip2, dst_ip1, src_port2, dst_port1, prot).
  • the bit is restored, take (src_ip2, dst_ip1, src_port2, dst_port1, prot) as the wait Using the quintuple (ie, the target quintuple in steps a1-a4), performing the bit recovery process given above, ie steps a1-a4;
  • the target quintuple is: (src_ip1, dst_ip2, src_port1, dst_port2, prot).
  • the bit is restored, take (src_ip1, dst_ip2, src_port1, dst_port2, prot) as the wait Using the quintuple (ie, the target quintuple in steps a1-a4), performing the bit recovery process given above, ie steps a1-a4;
  • the type value is 111 (convert the source IP address first, then convert the destination IP address), assume that the target quintuple is: (src_ip2, dst_ip2, src_port2, dst_port2, prot), when the bit is restored,
  • the target quintuple is: (src_ip2, dst_ip2, src_port2, dst_port2, prot), when bit recovery, take (src_ip1, dst_ip2, src_port1 , dst_port2, prot) as the quintuple to be utilized (ie, the target quintuple in steps a1-a4), perform the above bit recovery process, and then take (src_ip2, dst_ip2, src_port2, dst_port2, prot) as the five to be utilized.
  • the tuple i.e., the target quintuple in steps a1-a4) performs the bit recovery procedure given above, steps a1-a4.
  • a bitmap is constructed in advance, and each bit in the bitmap is used to represent the state of the quintuple; further, in the new process, the non-conflicting quintuple is determined by querying the bitmap.
  • the solution directly determines the target bit indicating the non-conflict state from the bitmap, and further determines the non-conflicting quintuple based on the target bit, thereby reducing the number of readings on the storage medium. Therefore, the new performance can be solved by the solution. The problem.
  • the networking diagram is as shown in Figure 1.
  • the networking system includes: host A, NAT device B, and server C.
  • the IP address of host A is 192.168.1.2, and the intranet IP address of NAT device B.
  • the address is 192.168.1.1 and the external network IP address is 1.1.1.1
  • the IP address of server C is 1.1.1.2.
  • a bitmap is pre-built in the DDR of the NAT device.
  • Each entry in the bitmap includes 128 bits, and each bit corresponds to a 7-bit binary string.
  • a bit value of 1 indicates a collision, and the value of the bit is a value. 0 means no conflict.
  • the bits in the initialized bitmap are all zeros.
  • a NAT method provided by the present disclosure may include the following steps.
  • step b1 after receiving the packet from the host A to the server C, the NAT device B determines that the packet needs to be processed by NAT, and the packet satisfies the new condition of the session information, and continues to perform step b2.
  • the original quintuple in the message is (192.168.1.2, 1.1.1.2, 2222, 80, tcp).
  • 192.168.1.2 is the source IP address
  • 1.1.1.2 is the destination IP address
  • 2222 is the source port
  • 80 is the destination port
  • tcp is the transmission protocol.
  • Step b2 Obtain a target IP address and a reference port of the target IP address from the NAT resource pool, where the reference port is a port in a continuous port range of the target IP address.
  • the NAT resource pool is a resource pool on which the source IP address is translated.
  • the target IP address is assumed to be 1.1.1.1 and the reference port is 2001.
  • Step b3 replacing the source IP address in the original quintuple of the packet with the destination IP address, replacing the source port in the original quintuple with the reference port, generating a quintuple G1 corresponding to the packet, and The lower 7 bits of the source port of a quintuple are masked, that is, padded with 0, and the quintuple G2 is obtained.
  • the quintuple G1 is (1.1.1.1, 1.1.1.2, 2001, 80, tcp); correspondingly, the quintuple G2 is (1.1.1.1, 1.1.1.2, P src1 , 80, tcp).
  • step b4 the index value ind corresponding to the quintuple G2 is calculated by using the SHA algorithm, and the entry M is determined from the bitmap by using the index value ind1.
  • Step b5 from the entry M, determining a target bit, wherein the target bit corresponds to a non-conflict state, and the binary string corresponding to the target bit and the port formed by the unmasked portion of the source port are located in a Within the range of continuous ports.
  • step b6 the state represented by the target bit is set to a conflict state, and the target quintuple corresponding to the message is generated based on the target bit.
  • the target quintuple is (1.1.1.1, 1.1.1.2, P src2 , 80, tcp), and the P src2 is a value obtained by restoring the lower 7 bits of P src1 with the binary string corresponding to the target bit.
  • step b7 the target quintuple and the original quintuple are recorded in the session table, and the packet is NAT-processed based on the target quintuple.
  • step b8 when it is detected that the record content corresponding to the target quintuple is deleted from the session table, it is determined that the address translation type corresponding to the target quintuple is the conversion source IP address.
  • Step b9 Determine that the port matching the address translation type in the target quintuple is the source port, and mask the lower 7 bits of the source port to obtain the quintuple G3.
  • the quintuple G3 is (1.1.1.1, 1.1.1.2, P src1 , 80, tcp).
  • step b10 the index value ind corresponding to the quintuple G3 is calculated by using the SHA algorithm, and the entry M is determined from the bitmap by using the index value ind1.
  • Step b11 from the entry M, determining a bit corresponding to the target binary string, and setting a state represented by the determined bit to a non-conflict state, the target binary string being a source port in the target quintuple The lower 7 bits of the bit.
  • the NAT process is similar to the above steps b1-b12, except that the processing of the destination port and the source port is reversed.
  • the current value of each bit is represented by X, and the current value may be 1 or 0.
  • the solution directly determines the target bit in the bitmap from the bitmap state, and determines the non-conflicting quintuple based on the target bit, thereby reducing the number of times of reading the storage medium. Therefore, the solution can be solved by the solution. New poor performance issues.
  • the present disclosure further provides a NAT device.
  • the device may include:
  • the information obtaining unit 510 is configured to obtain, from the NAT resource pool, a target IP address and a reference port of the target IP address, where the reference port is one of a continuous port range of the target IP address;
  • the information processing unit 520 is configured to generate a first quintuple corresponding to the packet based on the target IP address, the reference port, and an original quintuple of the packet, and in the first quintuple The first type of bits of the reference port are masked to obtain a second quintuple;
  • a bit determining unit 530 configured to determine, from a pre-built bitmap, a target bit indicating a non-collision state based on a hash result of the second quintual; wherein each bit in the bitmap is used to represent Whether the state of the quintuple is a conflict state or a non-conflict state;
  • a quintuple generating unit 540 configured to set a state represented by the target bit to a conflicting state, and generate a target quintuple corresponding to the packet based on the target bit;
  • the NAT processing unit 550 is configured to record the target quintuple and the original quintuple in the session table, and perform NAT processing on the packet according to the target quintuple.
  • a bitmap is constructed in advance, and each bit in the bitmap is used to represent the state of the quintuple; further, in the new process, the non-conflicting quintuple is determined by querying the bitmap.
  • the solution directly determines the target bit indicating the non-conflict state from the bitmap, and further determines the non-conflicting quintuple based on the target bit, thereby reducing the number of readings on the storage medium. Therefore, the new performance can be solved by the solution. The problem.
  • bit determining unit 530 is specifically configured to:
  • a state corresponding to the target bit is a non-conflict state, and a binary string corresponding to the target bit and a port formed by the unmasked portion of the reference port , located within the range of one continuous port.
  • the device further includes:
  • a type determining unit configured to determine an address translation type corresponding to the target quintuple when detecting that the recorded content corresponding to the target quintuple is deleted from the session table;
  • a port masking unit configured to determine a port matching the address translation type in the target quintuple, and mask the first type of the determined port to obtain a third quintuple;
  • An entry query unit configured to calculate a second index value corresponding to the third quintuple by using a first hash algorithm, and use the second index value to determine a second entry from the bitmap;
  • a conflict adjustment unit configured to determine, from the second entry, a bit corresponding to the target binary string, and set a state represented by the determined bit to a non-conflict state, where the target binary string is The first type of bit of the port in the target quintu that matches the address translation type.
  • the NAT processing unit 550 is specifically configured to:
  • the device embodiment since it basically corresponds to the method embodiment, reference may be made to the partial description of the method embodiment.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the present disclosure. Those of ordinary skill in the art can understand and implement without any creative effort.
  • the present disclosure further provides a NAT device.
  • the NAT device includes: an internal bus 610, a storage medium 620, a processor 630, and a communication interface 640.
  • the processor 630, the communication interface 640, and the storage medium 620 complete communication with each other through the internal bus 610.
  • the storage medium 620 is configured to store machine executable instructions corresponding to the NAT method.
  • the processor 630 is configured to read the machine executable instructions on the storage medium 620 to perform the NAT method provided by the present disclosure.
  • the NAT device can be a router, and is of course not limited thereto.
  • the storage medium 620 may be, for example, a non-volatile storage medium.
  • the processor 630 can invoke logic instructions that implement the NAT method in the storage medium 620 to perform the NAT method described above.
  • the functionality of the logic instructions implementing the NAT method can be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • a computer device which may be a personal computer, server, or network device, etc.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提供一种NAT方法、装置及NAT设备。根据该方法，从NAT资源池中获取目标IP地址以及目标IP地址的参考端口，参考端口为一个相应的连续端口范围中的一个端口。基于目标IP地址、参考端口和报文的原始五元组，生成第一五元组，并对第一五元组中的参考端口的第一类比特进行掩码，得到第二五元组。基于第二五元组的哈希结果，从预先构建的位图中，确定表示不冲突状态的目标比特。将目标比特所表示的状态设置为冲突状态，并基于目标比特，生成目标五元组。在会话表中记录目标五元组和原始五元组，并基于目标五元组对报文进行NAT处理。

Description

网络地址转换 背景技术
NAT(Network Address Translation，网络地址转换)设备在接收到报文后，如果该报文需进行NAT处理且该报文满足会话信息新建条件，则执行新建流程。这里的“会话信息”例如包括报文的源IP(Internet Protocol，互连网协议)地址、目的地址、源端口、目的端口和传输层协议的五元组。
以源IP地址的NAT处理为例。从NAT资源池中选取一个IP地址和该IP地址的一个端口，利用该IP地址和该端口替换该报文的原始五元组中的源IP地址和源端口，形成新的五元组；进而，查询保存于存储介质(如DDR(Double Data Rate)双倍速率同步动态随机存储器)的会话表中的哈希表；当判断出该新的五元组为不冲突的五元组时，即，计算出的该新的五元组的哈希值不会在哈希表中产生哈希冲突时，在该哈希表和对应的结果表中记录该新的五元组和该原始五元组，并基于该新的五元组对该报文进行NAT处理；否则，重新从NAT资源池中选取一个IP地址和该IP地址的一个端口进行分析。
尽管上述新建流程能够实现NAT处理，但是，存在如下问题：基于现有会话表的哈希表的数据存储方式，每次冲突试探只能测试一个新的五元组，当该新的五元组产生冲突时，需要进行多次试探，而由于每次读取会话表所在的存储介质均会存在接口延时，这样无疑导致新建性能较差。
附图说明
图1是本公开一示例性实施例示出的一种组网系统的结构示意图。
图2是本公开一示例性实施例示出的一种NAT方法的流程图。
图3是本公开一示例性实施例示出的转换源IP地址时基于位图确定报文对应目标五元组的图表示意图。
图4是本公开一示例性实施例示出的转换源IP地址时对位图中的比特进行恢复的图表示意图。
图5是本公开一示例性实施例示出的一种NAT装置的结构示意图。
图6是本公开一示例性实施例示出的一种NAT设备的结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本公开相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本公开的一些方面相一致的装置和方法的例子。
在本公开使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本公开。在本公开和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
为了便于方案理解，下面介绍关于NAT(Network Address Translation，网络地址转换)的相关内容。
从转换模式的角度而言，NAT可分为PAT(Port Address Translation，带端口的地址转换)和NO-PAT(Not Port Address Translation，不带端口的地址转换)。其中，NO-PAT模式下，一个外网IP地址(即，公网IP地址)只能分给一个内网IP地址进行NAT；而PAT模式下，一个外网IP地址可以同时分配给多个内网IP地址共用。本公开所出现的NAT指PAT模式。
另外，按照不同的组网应用，NAT可以分为：入接口转换源IP地址，入接口转换目的IP地址，出接口转换源IP地址，出接口转换目的IP地址。并且，不同地址的转换过程类似。
本公开提供了一种NAT方法、装置及NAT设备，以提高NAT过程的新建性能。
下面首先对本公开所提供的一种NAT方法进行介绍。
本公开所提供的一种NAT方法应用于NAT设备，具体的，该NAT方法可以由NAT设备中的CPU来执行，当然，也可以由CPU与某些硬件共同执行完成，其中，该某些硬件可以为集成电路ASIC(Application Specific Integrated Circuit)/FPGA(Field－Programmable Gate Array，现场可编程门阵列)。其中，所谓的NAT设备为网络的边沿设备，其用于实现允许内部网络用户访问外部公共网络以及允许外部公共网络访问部分内部资源(例如内部服务器)的目的，举例而言：该NAT设备的设备类型可以为路由器，当然并不局限于此。
另外，本公开中，预先构建位图，该位图中的每个比特用于表示五元组的状态，即冲突状态或不冲突状态，其中，该位图存储于NAT设备的存储介质中。具体的，该位图包括多个表项，每一表项包括多个比特，每一比特对应一个与第一类比特位数相同的二进制字符串。该第一类比特为五元组的两类端口(即，进行NAT处理的端口和不进行NAT处理的端口)的第一类比特，比特数量和位置可以根据实际情况设定，举例而言：第一类比特可以为端口的第0比特，可以为端口的第0比特和第1比特，也可以为端口的第0比特、第1比特和第2比特，还可以为端口的第14比特和第15比特，等等。通过利用该位图，使得区别点仅仅在于某一端口的第一类比特的多个五元组，在同一个表项中可以分别唯一对应到一个比特，也就是说，任一表项对应于：区别点仅仅在于某一端口的第一类比特的多个五元组。
位图中的每一表项为一行比特。并且，在初始化位图时，每一表项可以通过一个固定位数的哈希值作为索引，每一表项中的多个比特所表示的状态可以均初始化为不冲突状态。这样，每次新建流程确定出不冲突的目标五元组后，可以将位图中与该目标五元组对应的比特所表示的状态设置为冲突状态。并且，在具体应用中，每个比特可以用0表示不冲突状态，1表示冲突状态，此时，初始化时位图中的比特全为0。
为了便于理解方案，本公开示例性地给出一种适用于本公开所提供方法的组网系统，该组网系统的结构示意图可以参见图1。如图1所示，该组网系统中包括：主机A、NAT设备B和服务器C，由于主机A和服务器C属于不同的网络，即主机A属于内网而服务器C属于外网，因此，当主机A向服务器C发送报文时，NAT设备需要对主机A发送的报文进行NAT处理，然后将经过NAT处理后的报文发送给服务器C；类似的，当服务器C向主机A发送报文时，NAT设备需要对服务器C发送的报文进行NAT处理后，然后将经过NAT处理后的报文发送给该主机A。为了提高新建性能，图1中的NAT设备B可以利用本公开所提供的一种NAT方法，对主机A向服务器C发送的报文进行 NAT处理，以及对服务器C向主机A发送的报文进行NAT处理。
如图2所示，本公开所提供的一种NAT方法，可以包括如下步骤。
S101，从NAT资源池中获取目标IP地址以及该目标IP地址的参考端口，该参考端口为该目标IP地址的一个连续端口范围中的一个端口。
当NAT设备接收到组网系统中的其他设备发送的报文时，如果该报文需进行NAT处理且该报文满足会话信息新建条件，则该NAT设备执行新建流程。本公开所提供方案中，该NAT设备执行新建流程时，可以从NAT资源池中获取目标IP地址以及该目标IP地址的参考端口，该参考端口为该目标IP地址的一个连续端口范围中的一个端口。并且，在选择端口时，可以利用对该报文的原始五元组进行哈希计算后的值进行选择，随机选择或顺序选择，等等。
对于一个报文而言，该报文中的原始五元组包括：源IP地址、目的IP地址、源端口、目的端口和传输协议；而NAT处理时的转换需求可以为仅仅转换源IP地址或转换目的IP地址，还可以为既转换源IP地址又转换目的IP地址。因此，在获取该目标IP地址和该参考端口后，如果需要转换源IP地址，则该目标IP地址用于替换原始五元组中的源IP地址，参考端口用于替换原始五元组中的源端口；而如果需要转换目的IP地址，则该目标IP地址用于替换原始五元组中的目的IP地址，参考端口用于替换原始五元组中的目的端口。另外，本公开中所述的目标IP地址为从NAT资源池中取出的一个IP地址，该目标IP地址可以作为源IP地址或目的IP地址；而该参考端口为该目标IP地址的一个连续端口范围中的一个端口，该参考端口可以作为源端口或目的端口。
另外，可以基于ACL(Access Control List，访问控制列表)来确定报文是否需要进行NAT处理、NAT处理时的转换需求以及NAT处理时所使用的NAT资源池，等等。其中，NAT设备中存储有多个NAT资源池，以应对不同类型的IP地址，并且，每个NAT资源池均包括IP地址及对应端口范围。
举例而言：对于采用TCP(Transmission Control Protocol传输控制协议)的数据流中的报文而言，报文是否满足会话信息新建条件的具体判断方式可以包括：判断报文是否为首报文，如果是，确定报文满足会话信息新建条件。对于采用UDP(User Datagram Protocol，用户数据报协议)的数据流中的报文而言，报文是否满足会话信息新建条件的具体判断方式可以包括：判断报文是否能够基于会话表直接进行NAT处理，如果不可以，确定报文满足会话信息新建条件。这里，仅以TCP协议、UDP协议为示例进行 了描述，并不具有限制性，在具体应用中，对于采用其他协议的数据流中的报文，可以进行类似处理。例如，在判断出该报文不能基于会话表直接进行NAT处理时，确定报文满足会话信息新建条件。
S102，基于该目标IP地址、该参考端口和该报文的原始五元组，生成该报文对应的第一五元组，并对该第一五元组中的参考端口的第一类比特进行掩码，得到第二五元组。
S103，基于对该第二五元组的哈希计算的结果，从预先构建的位图中，确定表示不冲突状态的目标比特；
其中，该位图中每个比特用于表示五元组的状态为冲突状态还是不冲突状态。
S104，将该目标比特所表示的状态设置为冲突状态，并基于该目标比特，生成该报文对应的目标五元组。
在获取到该目标IP地址和该参考端口后，该NAT设备可以基于该报文对应的转换需求，以该目标IP地址替换该报文的原始五元组中的源IP地址或目的IP地址，以该参考端口替换该原始五元组中的源端口或目的端口，从而生成该报文对应的第一五元组。而在得到第一五元组后，该NAT设备可以对该第一五元组中的参考端口的第一类比特进行掩码，即置0，得到第二五元组。具体的，当转换源IP地址时，对该第一五元组中的源端口的第一类比特进行掩码，而当转换目的IP地址时，对该第一五元组中的目的端口的第一类比特进行掩码。
进而，该NAT设备可以基于对该第二五元组的哈希计算的结果，从预先构建的位图中，确定表示不冲突状态的目标比特。并且，在得到目标比特后，该NAT设备可以将该目标比特所表示的状态设置为冲突状态，并基于该目标比特，生成该报文对应的目标五元组。具体的，基于该目标比特，生成该报文对应的目标五元组具体为：以该目标比特对应的二进制字符串恢复该第二五元组中被掩码的第一类比特，从而得到该报文对应的目标五元组。
可以理解的是，端口由16位比特表示，也就是源端口和目的端口均由16位比特表示。对于第一类比特而言，比特数量和位置可以根据实际情况设定，举例而言：第一类比特可以为端口的第0比特，可以为端口的第0比特和第1比特，也可以为端口的第0比特、第1比特和第2比特，还可以端口的第14比特和第15比特，等等。为了计算简便，在具体应用中，该第一类比特为端口末尾的连续至少一位，具体的位数可以根据具体应用环境进行设定。举例而言：该第一类比特为端口的末尾的连续两位，即第0比特 和第1比特，或者，该第一类比特为端口的末尾的连续三位，即第0比特、第1比特和第2比特，或者，该第一类比特为端口的末尾的连续四位，即第0比特、第1比特、第2比特和第3比特，等等。
另外，由于该位图包括多个表项，每一表项包括多个比特，每一比特对应一个与第一类比特位数相同的二进制字符串，因此，每一表项所包括的比特的数量与第一类比特的数量相关，具体为2 N，N为第一类比特的位数。每一比特对应一个与第一类比特位数相同的二进制字符串，该对应关系可以按照二进制字符串的大小顺序进行排列。举例而言：假设N为7，则一个表项从前到后的比特分别对应于：0000000、0000001、0000010......1111111；或者，分别对应于：1111111、1111110、1111101、1111100……0000001、0000000。
具体的，在一种实现方式中，所述基于该第二五元组的哈希结果，从预先构建的位图中，确定表示不冲突状态的目标比特的步骤，可以包括：
利用第一哈希算法，计算该第二五元组对应的第一索引值，并利用该第一索引值，从预先构建的位图中确定第一表项；
从该第一表项中确定目标比特；其中，该目标比特所对应状态为不冲突状态，且该目标比特所对应的二进制字符串与该参考端口未掩码部分所形成的端口，位于该一个连续端口范围内。
其中，通过位图中的存储内容可知，该第一表项为：第二五元组以及与第二五元组区别仅仅在于第一类比特的多个五元组所对应的表项。并且，该第一哈希算法可以包括但不局限于：MD(Message Digest Algorithm，消息摘要算法)或SHA(Secure Hash Algorithm，安全哈希算法)。
有些端口属于NAT资源池中的无效端口，而第一表项中的比特所对应的二进制字符串与该参考端口未掩码部分所形成的端口，可能属于NAT资源池中的无效端口。因此，为了避免基于该目标比特所生成的目标五元组中的端口属于无效端口，所确定出的目标比特满足如下条件：
该目标比特所对应状态为不冲突状态，且该目标比特所对应的二进制字符串与该参考端口未掩码部分所形成的端口，位于该一个连续端口范围内。
从该第一表项中确定目标比特的过程可以包括：从第一表项中确定状态为不冲突状态的至少一个比特，然后，从至少一个比特中，确定出所对应的二进制字符串与该参考 端口未掩码部分所形成的端口，位于该一个连续端口范围内的目标比特。或者，从该第一表项中确定目标比特的过程可以包括：从第一表项中，确定所对应的二进制字符串与该参考端口未掩码部分所形成的端口，位于该一个连续端口范围内的至少一个比特，进而从所确定出的比特中，确定表示不冲突状态的目标比特。
另外，在具体应用中，存在对一个报文进行多次NAT处理的需求，因此，目标五元组的数量可以为多个。基于该处理思想，基于该第二五元组的哈希结果，可以从位图中确定出目标数量的目标比特。并且，ACL中可以记录该目标数量，进而可以通过查询ACL来获得该目标数量。
S105，在会话表中记录该目标五元组和该原始五元组，并基于该目标五元组对该报文进行NAT处理。
会话表分为两级表：哈希表和结果表。其中，哈希表为会话表的第一级表，用于存储五元组经过哈希计算得出的签名信息和指向结果表的指针；而结果表为会话表的第二级表，用于存储五元组和其他转发相关的信息。
因此，在确定出该目标五元组后，该NAT设备可以在哈希表和结果表中记录该目标五元组和该原始五元组。并且，在确定出该目标五元组后，该NAT设备可以对该报文进行NAT处理，具体可以包括：将该报文中的原始五元组替换为目标五元组。
更进一步的，当检测到从该会话表中删除该目标五元组对应的记录内容时，该目标五元组恢复为可用状态，为了保证位图的有效性，可以对位图中该目标五元组所对应比特所表示的状态进行恢复。因此，本公开所提供了一种NAT方法还可以包括如下步骤。
步骤a1，当检测到从该会话表中删除该目标五元组对应的记录内容时，确定该目标五元组所对应的地址转换类型。
步骤a2，确定该目标五元组中与该地址转换类型匹配的端口，并将所确定出的端口的第一类比特进行掩码，得到第三五元组。
其中，当所确定出的地址转换类型为转换源IP地址时，该目标五元组中与该地址转换类型匹配的端口为：源端口；而当所确定出的地址转换类型为转换目的IP地址时，该目标五元组中与该地址转换类型匹配的端口为：目的端口。
步骤a3，利用第一哈希算法，计算该第三五元组对应的第二索引值，并利用该第二索引值，从该位图中确定第二表项。
步骤a4，从该第二表项中，确定对应于目标二进制字符串的比特，并将所确定的比特所表示的状态设置为不冲突状态，该目标二进制字符串为该目标五元组中与该地址转换类型匹配的端口的第一类比特。
可选地，在一种具体实现方式中，NAT设备对应一种地址转换类型，此时，确定该目标五元组所对应的地址转换类型具体可以为：将NAT设备对应的地址转换类型作为该目标五元组所对应的地址转换类型。
可选地，在另一种具体实现方式中，NAT设备对应至少两种地址转换类型，此时，在该在会话表中记录该目标五元组和该原始五元组的步骤，可以包括：
在会话表中记录该目标五元组、该原始五元组和本次NAT的地址转换类型。
相应的，确定该目标五元组所对应的地址转换类型具体可以为：
从会话表中，确定该目标五元组所对应的地址转换类型。
在具体应用时，该地址转换类型可以为转换源IP地址、转换目的IP地址，先转换源IP地址再转换目的IP地址，或者，先转换目的IP地址再转换源IP地址。其中，地址转换类型的值的具体表征方式可以存在多种。可选地，在一种具体实现方式中，地址转换类型的值可以由三比特组成，其中，最高比特是是否转换，低两比特是转换方式。具体的，以三比特表征地址转换类型时，地址转换类型及类型值的对应关系，参见如下表1：
Figure PCTCN2019079161-appb-000001
表1
假设会话表中记录的原始五元组为(src_ip1,dst_ip1,src_port1,dst_port1,prot)，当删除会话表所记录的目标五元组的相关信息时，恢复位图中相应比特的过程如下：
如果类型值最高比特为0，没有地址转换，结束；
如果类型值为110(转换源IP地址)，假设目标五元组为：(src_ip2,dst_ip1,src_port2,dst_port1,prot)，在比特恢复时，取(src_ip2,dst_ip1,src_port2,dst_port1,prot)作为待 利用的五元组(即步骤a1-a4中的目标五元组)，执行上述所给出的比特恢复过程，即步骤a1-a4；
如果类型值为101(转换目的IP地址)，假设目标五元组为：(src_ip1,dst_ip2,src_port1,dst_port2,prot)，在比特恢复时，取(src_ip1,dst_ip2,src_port1,dst_port2,prot)作为待利用的五元组(即步骤a1-a4中的目标五元组)，执行上述所给出的比特恢复过程，即步骤a1-a4；
如果类型值为111(先转换源IP地址，再转换目的IP地址)，假设目标五元组为：(src_ip2,dst_ip2,src_port2,dst_port2,prot)，在比特恢复时，
取(src_ip2,dst_ip1,src_port2,dst_port1,prot)作为待利用的五元组(即步骤a1-a4中的目标五元组)，执行上述比特恢复过程，再取(src_ip2,dst_ip2,src_port2,dst_port2,prot)作为待利用的五元组(即步骤a1-a4中的目标五元组)，执行上述所给出的比特恢复过程，即步骤a1-a4；
如果类型值为100(先转换目的IP地址，再转换源IP地址)，假设目标五元组为：(src_ip2,dst_ip2,src_port2,dst_port2,prot)，在比特恢复时，取(src_ip1,dst_ip2,src_port1,dst_port2,prot)作为待利用的五元组(即步骤a1-a4中的目标五元组)，执行上述比特恢复过程，再取(src_ip2,dst_ip2,src_port2,dst_port2,prot)作为待利用的五元组(即步骤a1-a4中的目标五元组)，执行上述所给出的比特恢复过程，即步骤a1-a4。
上述给出的地址转换类型的值仅仅作为示例，并不应该构成对本公开的限定。
本公开所提供方案中，预先构建位图，该位图中每个比特用于表示五元组的状态；进而，在新建流程中，通过查询位图，确定不冲突的五元组。本方案直接从位图中确定表示不冲突状态的目标比特，进而基于目标比特确定出不冲突的五元组，减少了对存储介质的读取次数，因此，通过本方案可以解决新建性能较差的问题。
下面结合应用实例，对本公开所提供的一种NAT方法进行介绍。
该应用实例中，组网示意图如图1所示，该组网系统具体包括：主机A、NAT设备B和服务器C，其中，主机A的IP地址为192.168.1.2，NAT设备B的内网IP地址为192.168.1.1而外网IP地址为1.1.1.1，服务器C的IP地址为1.1.1.2。
在NAT设备的DDR中预先构建位图，该位图中的每个表项包括128个比特，每个比特对应一个7位的二进制字符串，比特的值为1时表示冲突，比特的值为0时表示不冲突。并且，初始化的位图中的比特为全0。
如图3和图4所示，本公开所提供的一种NAT方法，可以包括如下步骤。
步骤b1，NAT设备B接收到主机A至服务器C的报文后，判断出该报文需进行NAT处理且该报文满足会话信息新建条件，继续执行步骤b2。
其中，该报文中的原始五元组为(192.168.1.2，1.1.1.2，2222，80，tcp)。其中，该原始五元组中，192.168.1.2为源IP地址，1.1.1.2为目的IP地址，2222为源端口，80为目的端口，tcp为传输协议。
步骤b2，从NAT资源池中获取目标IP地址以及目标IP地址的参考端口，该参考端口为该目标IP地址的一个连续端口范围中的一个端口。
其中，该NAT资源池为转换源IP地址所依据的资源池。
其中，假设该目标IP地址为1.1.1.1，参考端口为2001。
步骤b3,以目标IP地址替换报文的原始五元组中的源IP地址，以参考端口替换该原始五元组中的源端口，生成该报文对应的五元组G1，并将该第一五元组的源端口的低7位进行掩码，即填充0，得到五元组G2。
其中，五元组G1为(1.1.1.1，1.1.1.2，2001，80，tcp)；相应的，五元组G2为(1.1.1.1，1.1.1.2，P src1，80，tcp)。
步骤b4，利用SHA算法，计算五元组G2对应的索引值ind1，并利用索引值ind1，从位图中确定表项M。
步骤b5，从该表项M中，确定目标比特，其中，该目标比特所对应状态为不冲突状态，且目标比特所对应的二进制字符串与源端口未掩码部分所形成的端口，位于一个连续端口范围内。
步骤b6,将目标比特所表示的状态设置为冲突状态，并基于目标比特，生成该报文对应的目标五元组。
其中，目标五元组为(1.1.1.1，1.1.1.2，P src2，80，tcp)，该P src2为以目标比特所对应二进制字符串恢复P src1中的低7位后所得的值。
步骤b7，在会话表中记录目标五元组和原始五元组，并基于目标五元组对该报文进行NAT处理。
步骤b8，当检测到从会话表中删除目标五元组对应的记录内容时，确定目标五元组所对应的地址转换类型为转换源IP地址。
步骤b9，确定目标五元组中与地址转换类型匹配的端口为源端口，并将源端口低7位进行掩码，得到五元组G3。
其中，五元组G3为(1.1.1.1，1.1.1.2，P src1，80，tcp)。
步骤b10，利用SHA算法，计算五元组G3对应的索引值ind1，并利用该索引值ind1，从该位图中确定表项M。
步骤b11，从该表项M中，确定对应于目标二进制字符串的比特，并将所确定的比特所表示的状态设置为不冲突状态，该目标二进制字符串为该目标五元组中源端口的低7位的比特。
当原始五元组所对应的地址转换类型为转换目的IP地址时，NAT流程与上述步骤b1-b12类似，区别在于把目的端口和源端口的处理对换。
另外，图3和图4所示的位图中，通过X表示各个比特的当前值，该当前值可以为1或0。
本方案直接从位图中确定所表示的状态为不冲突状态的目标比特，进而基于目标比特确定出不冲突的五元组，减少了对存储介质的读取次数，因此，通过本方案可以解决新建性能较差的问题。
相应于上述方法实施例，本公开还提供了一种NAT装置，如图5所示，所述装置可以包括：
信息获取单元510，用于从NAT资源池中获取目标IP地址以及所述目标IP地址的参考端口，所述参考端口为所述目标IP地址的一个连续端口范围中的一个端口；
信息处理单元520，用于基于所述目标IP地址、所述参考端口和报文的原始五元组，生成所述报文对应的第一五元组，并对所述第一五元组中的参考端口的第一类比特进行掩码，得到第二五元组；
比特确定单元530，用于基于所述第二五元组的哈希结果，从预先构建的位图中，确定表示不冲突状态的目标比特；其中，所述位图中每个比特用于表示五元组的状态是冲突状态还是不冲突状态；
五元组生成单元540，用于将所述目标比特所表示的状态设置为冲突状态，并基于所述目标比特，生成所述报文对应的目标五元组；
NAT处理单元550，用于在会话表中记录所述目标五元组和所述原始五元组，并基 于所述目标五元组对所述报文进行NAT处理。
本公开所提供方案中，预先构建位图，该位图中每个比特用于表示五元组的状态；进而，在新建流程中，通过查询位图，确定不冲突的五元组。本方案直接从位图中确定表示不冲突状态的目标比特，进而基于目标比特确定出不冲突的五元组，减少了对存储介质的读取次数，因此，通过本方案可以解决新建性能较差的问题。
可选地，所述比特确定单元530具体用于：
利用第一哈希算法，计算所述第二五元组对应的第一索引值，并利用所述第一索引值，从预先构建的位图中确定第一表项；其中，所述位图包括多个表项，每一表项包括多个比特，每一比特对应一个与第一类比特的位数相同的二进制字符串；
从所述第一表项中确定目标比特；其中，所述目标比特所对应状态为不冲突状态，且所述目标比特所对应的二进制字符串与所述参考端口未掩码部分所形成的端口，位于所述一个连续端口范围内。
可选地，所述装置还包括：
类型确定单元，用于当检测到从所述会话表中删除所述目标五元组对应的记录内容时，确定所述目标五元组所对应的地址转换类型；
端口掩码单元，用于确定所述目标五元组中与所述地址转换类型匹配的端口，并将所确定出的端口的第一类比特进行掩码，得到第三五元组；
表项查询单元，用于利用第一哈希算法，计算所述第三五元组对应的第二索引值，并利用所述第二索引值，从所述位图中确定第二表项；
冲突调整单元，用于从所述第二表项中，确定对应于目标二进制字符串的比特，并将所确定的比特所表示的状态设置为不冲突状态，所述目标二进制字符串为所述目标五元组中与所述地址转换类型匹配的端口的第一类比特。
可选地，所述NAT处理单元550具体用于：
在会话表中记录所述目标五元组、所述原始五元组和地址转换类型，并基于所述目标五元组对所述报文进行NAT处理。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可 以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本公开方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
另外，相应于上述方法实施例，本公开还提供了一种NAT设备，如图6所示，该NAT设备包括：内部总线610、存储介质620、处理器630和通信接口640；其中，所述处理器630、所述通信接口640、所述存储介质620通过所述内部总线610完成相互间的通信。
其中，所述存储介质620，用于存储NAT方法对应的机器可执行指令。
所述处理器630，用于读取所述存储介质620上的所述机器可执行指令，以执行本公开所提供的NAT方法。
其中关于NAT方法的具体步骤的相关描述可以参见本公开方法实施例中的描述内容，在此不做赘述。并且，需要强调的是，该NAT设备可以为路由器，当然并不局限于此。
其中，存储介质620例如可以是非易失性(non-volatile)存储介质。处理器630可以调用执行存储介质620中的实现NAT方法的逻辑指令，以执行上述NAT方法。
实现NAT方法的逻辑指令的功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本公开的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域技术人员在考虑说明书及实践这里公开后，将容易想到本公开的其它实施方案。本公开旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未记载的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和精神由下面的权利要求指出。
应当理解的是，本公开并不局限于上面已经描述并在附图中示出的精确结构，并且 可以在不脱离其范围进行各种修改和改变。本公开的范围仅由所附的权利要求来限制。
以上所述仅为本公开的实施例而已，并不用以限制本公开，凡在本公开的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本公开保护的范围之内。

Claims (15)

  1. 一种网络地址转换NAT方法，包括：
    从NAT资源池中获取目标互联网协议IP地址以及所述目标IP地址的参考端口，所述参考端口为所述目标IP地址的一个连续端口范围中的一个端口；
    基于所述目标IP地址、所述参考端口和报文的原始五元组，生成所述报文对应的第一五元组，并对所述第一五元组中的参考端口的第一类比特进行掩码，得到第二五元组；
    基于所述第二五元组的哈希结果，从预先构建的位图中确定目标比特，所述目标比特表示的状态为不冲突状态；其中，所述位图中每个比特用于表示五元组的状态是冲突状态还是不冲突状态；
    将所述目标比特所表示的状态设置为冲突状态，并基于所述目标比特，生成所述报文对应的目标五元组；
    在会话表中记录所述目标五元组和所述原始五元组，并基于所述目标五元组对所述报文进行NAT处理。
  2. 根据权利要求1所述的方法，其特征在于，所述基于所述第二五元组的哈希结果，从预先构建的位图中，确定所表示的状态为不冲突状态的目标比特，包括：
    利用第一哈希算法，计算所述第二五元组对应的第一索引值，并利用所述第一索引值，从预先构建的位图中确定第一表项；其中，所述位图包括多个表项，每一表项包括多个比特，每一比特对应一个与第一类比特的位数相同的二进制字符串；
    从所述第一表项中确定目标比特；其中，所述目标比特所对应状态为不冲突状态，且所述目标比特所对应的二进制字符串与所述参考端口未掩码部分所形成的端口，位于所述一个连续端口范围内。
  3. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    当检测到从所述会话表中删除所述目标五元组对应的记录内容时，确定所述目标五元组所对应的地址转换类型；
    确定所述目标五元组中与所述地址转换类型匹配的端口，并将所确定出的端口的第一类比特进行掩码，得到第三五元组；
    利用第一哈希算法，计算所述第三五元组对应的第二索引值，并利用所述第二索引值，从所述位图中确定第二表项；
    从所述第二表项中，确定对应于目标二进制字符串的比特，并将所确定的比特所表示的状态设置为不冲突状态，所述目标二进制字符串为所述目标五元组中与所述地址转 换类型匹配的端口的第一类比特。
  4. 根据权利要求3所述的方法，其特征在于，所述在会话表中记录所述目标五元组和所述原始五元组，包括：
    在会话表中记录所述目标五元组、所述原始五元组和地址转换类型。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述第一类比特为表示端口的比特序列的末尾的连续至少一位。
  6. 一种网络地址转换NAT装置，包括：
    信息获取单元，用于从NAT资源池中获取目标互联网协议IP地址以及所述目标IP地址的参考端口，所述参考端口为所述目标IP地址的一个连续端口范围中的一个端口；
    信息处理单元，用于基于所述目标IP地址、所述参考端口和报文的原始五元组，生成所述报文对应的第一五元组，并对所述第一五元组中的参考端口的第一类比特进行掩码，得到第二五元组；
    比特确定单元，用于基于所述第二五元组的哈希结果，从预先构建的位图中确定目标比特，所述目标比特表示的状态为不冲突状态；其中，所述位图中每个比特用于表示五元组的状态为冲突状态还是不冲突状态；
    五元组生成单元，用于将所述目标比特所表示的状态设置为冲突状态，并基于所述目标比特，生成所述报文对应的目标五元组；
    NAT处理单元，用于在会话表中记录所述目标五元组和所述原始五元组，并基于所述目标五元组对所述报文进行NAT处理。
  7. 根据权利要求6所述的装置，其特征在于，所述比特确定单元具体用于：
    利用第一哈希算法，计算所述第二五元组对应的第一索引值，并利用所述第一索引值，从预先构建的位图中确定第一表项；其中，所述位图包括多个表项，每一表项包括多个比特，每一比特对应一个与第一类比特的位数相同的二进制字符串；
    从所述第一表项中确定目标比特；其中，所述目标比特所对应状态为不冲突状态，且所述目标比特所对应的二进制字符串与所述参考端口未掩码部分所形成的端口，位于所述一个连续端口范围内。
  8. 根据权利要求6所述的装置，其特征在于，所述装置还包括：
    类型确定单元，用于当检测到从所述会话表中删除所述目标五元组对应的记录内容时，确定所述目标五元组所对应的地址转换类型；
    端口掩码单元，用于确定所述目标五元组中与所述地址转换类型匹配的端口，并将所确定出的端口的第一类比特进行掩码，得到第三五元组；
    表项查询单元，用于利用第一哈希算法，计算所述第三五元组对应的第二索引值，并利用所述第二索引值，从所述位图中确定第二表项；
    冲突调整单元，用于从所述第二表项中，确定对应于目标二进制字符串的比特，并将所确定的比特所表示的状态设置为不冲突状态，所述目标二进制字符串为所述目标五元组中与所述地址转换类型匹配的端口的第一类比特。
  9. 根据权利要求8所述的装置，其特征在于，所述NAT处理单元具体用于：
    在会话表中记录所述目标五元组、所述原始五元组和地址转换类型，并基于所述目标五元组对所述报文进行NAT处理。
  10. 根据权利要求6-9任一项所述的装置，其特征在于，所述第一类比特为表示端口的比特序列的末尾的连续至少一位。
  11. 一种网络地址转换NAT设备，包括：内部总线、存储介质、处理器和通信接口；其中，所述处理器、所述通信接口、所述存储介质通过所述内部总线完成相互间的通信；其中，所述存储介质，用于存储NAT方法对应的机器可执行指令；
    所述处理器，用于读取所述存储介质上的所述机器可读指令，以：
    从NAT资源池中获取目标互联网协议IP地址以及所述目标IP地址的参考端口，所述参考端口为所述目标IP地址的一个连续端口范围中的一个端口；
    基于所述目标IP地址、所述参考端口和报文的原始五元组，生成所述报文对应的第一五元组，并对所述第一五元组中的参考端口的第一类比特进行掩码，得到第二五元组；
    基于所述第二五元组的哈希结果，从预先构建的位图中确定目标比特，所述目标比特表示的状态为不冲突状态；其中，所述位图中每个比特用于表示五元组的状态是冲突状态还是不冲突状态；
    将所述目标比特所表示的状态设置为冲突状态，并基于所述目标比特，生成所述报文对应的目标五元组；
    在会话表中记录所述目标五元组和所述原始五元组，并基于所述目标五元组对所述报文进行NAT处理。
  12. 根据权利要求11所述的设备，其特征在于，在基于所述第二五元组的哈希结果，从预先构建的位图中，确定所表示的状态为不冲突状态的目标比特时，所述机器可执行指令还促使所述处理器：
    利用第一哈希算法，计算所述第二五元组对应的第一索引值，并利用所述第一索引值，从预先构建的位图中确定第一表项；其中，所述位图包括多个表项，每一表项包括 多个比特，每一比特对应一个与第一类比特的位数相同的二进制字符串；
    从所述第一表项中确定目标比特；其中，所述目标比特所对应状态为不冲突状态，且所述目标比特所对应的二进制字符串与所述参考端口未掩码部分所形成的端口，位于所述一个连续端口范围内。
  13. 根据权利要求11所述的设备，其特征在于，所述机器可执行指令还促使所述处理器：
    当检测到从所述会话表中删除所述目标五元组对应的记录内容时，确定所述目标五元组所对应的地址转换类型；
    确定所述目标五元组中与所述地址转换类型匹配的端口，并将所确定出的端口的第一类比特进行掩码，得到第三五元组；
    利用第一哈希算法，计算所述第三五元组对应的第二索引值，并利用所述第二索引值，从所述位图中确定第二表项；
    从所述第二表项中，确定对应于目标二进制字符串的比特，并将所确定的比特所表示的状态设置为不冲突状态，所述目标二进制字符串为所述目标五元组中与所述地址转换类型匹配的端口的第一类比特。
  14. 根据权利要求13所述的设备，其特征在于，在会话表中记录所述目标五元组和所述原始五元组时，所述机器可执行指令还促使所述处理器：
    在会话表中记录所述目标五元组、所述原始五元组和地址转换类型。
  15. 根据权利要求11-14任一项所述的设备，其特征在于，所述第一类比特为表示端口的比特序列的末尾的连续至少一位。
PCT/CN2019/079161 2018-03-26 2019-03-22 网络地址转换 Ceased WO2019184804A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP19777369.0A EP3758341A4 (en) 2018-03-26 2019-03-22 NETWORK ADDRESS TRANSLATION
US17/041,198 US11201852B2 (en) 2018-03-26 2019-03-22 Network address translation
JP2020551868A JP6978612B2 (ja) 2018-03-26 2019-03-22 ネットワークアドレス変換

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810252611.3A CN109688237B (zh) 2018-03-26 2018-03-26 一种nat转换方法、装置及nat设备
CN201810252611.3 2018-03-26

Publications (1)

Publication Number Publication Date
WO2019184804A1 true WO2019184804A1 (zh) 2019-10-03

Family

ID=66184406

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/079161 Ceased WO2019184804A1 (zh) 2018-03-26 2019-03-22 网络地址转换

Country Status (5)

Country Link
US (1) US11201852B2 (zh)
EP (1) EP3758341A4 (zh)
JP (1) JP6978612B2 (zh)
CN (1) CN109688237B (zh)
WO (1) WO2019184804A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118427408A (zh) * 2024-07-04 2024-08-02 国家计算机网络与信息安全管理中心 一种前缀掩码的五元组关键字匹配方法及装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113886384B (zh) * 2021-09-06 2025-04-25 烽火通信科技股份有限公司 Ip五元组查表方法及装置
CN114866316B (zh) * 2022-04-29 2023-08-01 中国科学院信息工程研究所 安全防护方法、装置、设备、存储介质
CN115865863B (zh) * 2022-11-23 2025-02-18 北京有竹居网络技术有限公司 源地址转换方法、装置、设备及存储介质
CN116112571B (zh) * 2022-12-27 2025-08-01 北京天融信网络安全技术有限公司 Ip报文转发方法、装置、电子设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101702657A (zh) * 2009-12-04 2010-05-05 杭州华三通信技术有限公司 一种nat业务的热备份方法和设备
CN101800690A (zh) * 2009-02-05 2010-08-11 北京启明星辰信息技术股份有限公司 一种使用地址池实现源地址转换的方法和装置
WO2010129682A1 (en) * 2009-05-05 2010-11-11 Citrix Systems, Inc. Systems and methods for packet steering in a multi-core architecture
CN104243631A (zh) * 2014-10-13 2014-12-24 北京太一星晨信息技术有限公司 一种IPv4地址与IPv6地址有状态转换的方法及设备
WO2017172183A1 (en) * 2016-04-01 2017-10-05 Intel Corporation Pipelined hash table with reduced collisions

Family Cites Families (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TWI231434B (en) * 2003-10-06 2005-04-21 Inst Information Industry Network address and port number translation system
CN100477671C (zh) * 2005-12-16 2009-04-08 中国科学院计算技术研究所 Pat模式下支持多会话应用层协议的网络地址转换方法
JP2007208693A (ja) * 2006-02-02 2007-08-16 Toshiba Corp 通信装置、通信システム、通信方法および通信プログラム
US7830905B2 (en) * 2007-04-20 2010-11-09 Cray Inc. Speculative forwarding in a high-radix router
US20090138960A1 (en) * 2007-10-26 2009-05-28 University Of Ottawa Control access rule conflict detection
CN101335770B (zh) * 2008-08-06 2011-04-20 杭州华三通信技术有限公司 一种网络地址端口转换方法和装置
JP5036752B2 (ja) * 2009-04-16 2012-09-26 アラクサラネットワークス株式会社 インタネットワーク装置、及び、ローカルアドレス及び各ローカルアドレスと共に用いられるローカルアドレス内通信ポート番号と、グローバルアドレス及び各グローバルアドレスと共に用いられるグローバルアドレス内通信ポート番号とを相互に変換する方法
WO2010141450A2 (en) * 2009-06-01 2010-12-09 The Regents Of The University Of Michigan Method for extending the use of single ipv4 addresses to multiple network end-hosts
CN102111331B (zh) * 2010-12-17 2015-04-01 曙光信息产业(北京)有限公司 一种基于hash表实现的带掩码五元组规则的匹配方法
CN102438331B (zh) * 2012-01-12 2016-04-13 惠州Tcl移动通信有限公司 一种移动终端通过手机上网的方法及系统
JP2013179421A (ja) * 2012-02-28 2013-09-09 Nippon Telegr & Teleph Corp <Ntt> エントリの登録方法及び処理装置
US8891540B2 (en) * 2012-05-14 2014-11-18 Juniper Networks, Inc. Inline network address translation within a mobile gateway router
US9185072B2 (en) * 2012-05-14 2015-11-10 Futurewei Technologies, Inc. Stateless NAT44
JP2013247389A (ja) * 2012-05-23 2013-12-09 Nippon Telegr & Teleph Corp <Ntt> ネットワーク機器、ハッシュ関数選定方法
KR20150053620A (ko) * 2013-11-08 2015-05-18 한국전자통신연구원 패킷 전송 장치 및 방법
JP2016103697A (ja) * 2014-11-27 2016-06-02 日本電気株式会社 ネットワークシステム、制御装置、通信装置、通信装置の制御方法及びプログラム
US9553806B2 (en) * 2015-02-06 2017-01-24 Telefonaktiebolaget L M Ericsson (Publ) Method and system for supporting port ranging in a software-defined networking (SDN) system
CN106534394B (zh) 2015-09-15 2020-01-07 瞻博网络公司 用于管理端口的设备、系统和方法
EP3369213B1 (en) * 2015-10-30 2020-08-05 Telecom Italia S.p.A. Performance measurement in a packet-switched communication network
US10257061B2 (en) * 2016-05-31 2019-04-09 128 Technology, Inc. Detecting source network address translation in a communication system
US10305799B2 (en) * 2016-08-17 2019-05-28 Cisco Technology, Inc. Re-configurable lookup pipeline architecture for packet forwarding
US10834085B2 (en) * 2017-04-14 2020-11-10 Nxp Usa, Inc. Method and apparatus for speeding up ACL rule lookups that include TCP/UDP port ranges in the rules
CN107547690B (zh) * 2017-09-25 2021-06-18 新华三信息安全技术有限公司 Nat中的端口分配方法、装置、nat设备及存储介质
US10681011B2 (en) * 2017-11-30 2020-06-09 International Business Machines Corporation Preemptive determination of reserved IP conflicts on VPNs
CN109688238B (zh) * 2018-03-26 2020-06-09 新华三技术有限公司 一种nat转换方法、装置及nat设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101800690A (zh) * 2009-02-05 2010-08-11 北京启明星辰信息技术股份有限公司 一种使用地址池实现源地址转换的方法和装置
WO2010129682A1 (en) * 2009-05-05 2010-11-11 Citrix Systems, Inc. Systems and methods for packet steering in a multi-core architecture
CN101702657A (zh) * 2009-12-04 2010-05-05 杭州华三通信技术有限公司 一种nat业务的热备份方法和设备
CN104243631A (zh) * 2014-10-13 2014-12-24 北京太一星晨信息技术有限公司 一种IPv4地址与IPv6地址有状态转换的方法及设备
WO2017172183A1 (en) * 2016-04-01 2017-10-05 Intel Corporation Pipelined hash table with reduced collisions

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3758341A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118427408A (zh) * 2024-07-04 2024-08-02 国家计算机网络与信息安全管理中心 一种前缀掩码的五元组关键字匹配方法及装置

Also Published As

Publication number Publication date
JP2021517414A (ja) 2021-07-15
EP3758341A1 (en) 2020-12-30
JP6978612B2 (ja) 2021-12-08
US20210036984A1 (en) 2021-02-04
CN109688237A (zh) 2019-04-26
EP3758341A4 (en) 2021-03-10
US11201852B2 (en) 2021-12-14
CN109688237B (zh) 2020-05-12

Similar Documents

Publication Publication Date Title
WO2019184804A1 (zh) 网络地址转换
AU2020307540B2 (en) Securing communications between services in a cluster using load balancing systems and methods
US10498718B2 (en) Device identification and authentication in a network
US10911406B2 (en) Accessing cloud resources using private network addresses
CN101707617B (zh) 报文过滤方法、装置及网络设备
WO2019184803A1 (zh) 网络地址转换
WO2018001269A1 (zh) 处理云资源的方法和物理节点
JP2021516923A5 (zh)
US10979542B2 (en) Flow cache support for crypto operations and offload
CN110808879A (zh) 一种协议识别方法、装置、设备及可读存储介质
CN105490995A (zh) 一种在nvo3网络中nve转发报文的方法和设备
CN110868387B (zh) 用于操作联网设备的系统和方法
US9948568B2 (en) Packet size control using maximum transmission units for facilitating packet transmission
CN110191068B (zh) 检测网络设备流缓存的陈旧存储器地址
CN111756636B (zh) 数据包处理方法、装置及设备、存储介质
CN115484228A (zh) 一种报文处理方法、装置、设备及机器可读存储介质
CN106878308B (zh) 一种icmp报文匹配系统及方法
Hu et al. DScan6: Fast IPv6 Address Scanning Technology Based on Cross-Kernel Asynchronously Sending and Receiving
CN104994186A (zh) 媒体访问控制地址的查询方法、处理器及装置
CN110868388B (zh) 用于操作联网设备的系统和方法
CA3118929A1 (en) Systems and methods to filter out noisy application signatures to improve precision of first packet application classification
JP5147769B2 (ja) 端末検出方法、端末検出プログラム、および端末検出装置
Patgiri et al. Lookup Using 3D Bloom Filter
CN108173980A (zh) 一种sdn环境中的重复地址检测方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19777369

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020551868

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019777369

Country of ref document: EP

Effective date: 20200924