A method, device and storage medium for determining a home location source address

Abstract

The present invention discloses a method, device and storage medium for determining a home source address, including: determining an IPv6 address that initiates a malicious attack; converting the IPv6 address to obtain a converted address value; determining the home source address of the IPv6 address according to the converted address value in an address home library, wherein the address home library contains a correspondence between the address value and the home source address. The present invention can be used to implement IPv6 home source address verification to prevent malicious attacks. The method is flexible and diverse, which is conducive to verification and application. The scope of promotion and application can be large or small. The implementation is simple and has a good application scenario, and large-scale promotion and expanded application can be carried out after the product is realized.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method, device and storage medium for determining a home source address. Background Art

[0002] IP (Internet Protocol) addresses are an important basic resource for the construction of communication networks. The global and Asia-Pacific IPv4 (Internet Protocol Version 4) address pool was exhausted in 2011. IPv6 (Internet Protocol Version 6) is the next generation IP protocol designed by IETF (Internet Engineering Task Force) to replace IPv4. IPv6 can effectively solve the problem of insufficient IPv4 addresses by extending the address length to 128 bits.

[0003] At present, IPv6 is in the development stage, and address allocation data and routing announcement data are updated and changed every day. Accordingly, more and more attackers use IPv6 addresses to carry out corresponding attack actions. Therefore, how to trace the source of these malicious IPv6 addresses, that is, to verify the source address of the home location, has become increasingly urgent. It is urgent to build an IPv6 home location source address verification system to prevent malicious attacks, ensure network security, and track and trace the source and obtain evidence.

[0004] The deficiency of the existing technology is that there is no effective solution for verifying the source address of the IPv6 home address for malicious attacks. Summary of the invention

[0005] The present invention provides a method, device and storage medium for determining a home address source, which are used to solve the problem that there is no effective solution for verifying the source address of an IPv6 home address against malicious attacks.

[0006] The present invention provides the following technical solutions:

[0007] A method for determining a home source address, comprising:

[0008] Identify the IPv6 address from which the malicious attack originated;

[0009] After converting the IPv6 address, a converted address value is obtained;

[0010] In the address attribution database, the attribution source address of the IPv6 address is determined according to the converted address value, wherein the address attribution database contains the corresponding relationship between the address value and the attribution source address.

[0011] In implementation, the address attribution library is composed of one or a combination of the following parameters: Start_InitIP, End_InitIP, Country, Province or State, City, District, Longitude and Latitude.

[0012] In implementation, the source address of the IPv6 address belonging location is determined according to the converted address value, and it is determined by Start_InitIP(i) < MaliciousIP < End_InitIP(i), where the converted address value is MaliciousIP.

[0013] In implementation, in the address attribution library, determining the source address of the IPv6 address belonging location according to the converted address value includes:

[0014] After obtaining the record to which the address value belongs according to the converted address value, then extract the geographical location information in the record as the source address of the belonging location.

[0015] In implementation, the reverse conversion of the IPv6 address is to perform reverse conversion on the first 64 bits of the IPv6 address.

[0016] In implementation, the reverse conversion of the IPv6 address is to convert the binary IPv6 address into a decimal value and use it as the converted address value.

[0017] In implementation, the reverse conversion of the IPv6 address includes:

[0018] Convert S 1 S 2 S 3 S 4 to the decimal value T 1 , S 5 S 6 S 7 S 8 to the decimal value T 2 , S 9 S 10 S 11 S 12 to the decimal value T 3 , S 13 S 14 S 15 S 16 to the decimal value T 4 , where the first 64 bits of the IPv6 address are composed of S 1 S 2 S 3S 4 :S 5 S 6 S 7 S 8 :S 9 S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , each S i is the hexadecimal value converted from 4 binary digits, where i is a value from 1 to 16;

[0019] Calculate T 1 *2 48 +T 2 *2 32 +T 3 *2 16 +T 4 , and use this value as the converted address value.

[0020] During implementation, the IPv6 address is reversely converted, including:

[0021] According to the segmentation of the address attribution library, the first 64 bits of the IPv6 address are divided into m sub-segments, and the number of bits in each sub-segment is C 1 , C 2 , C 3 ,……,C m , where C 1 +C 2 +C 3 +……+C m =64;

[0022] The C corresponding to the m sub-segments 1 , C 2 , C 3 ,……,C m Convert the binary value of each bit into decimal value T 1 , T 2 , T 3 ,……,T m ;

[0023] calculate And use each value as the converted address value.

[0024] A device for determining a home source address, comprising:

[0025] The processor reads the program in the memory and performs the following processes:

[0026] Identify the IPv6 address from which the malicious attack originated;

[0027] After converting the IPv6 address, a converted address value is obtained;

[0028] In the address attribution library, the source address of the attribution of the IPv6 address is determined according to the converted address value, wherein the address attribution library contains the corresponding relationship between the address value and the source address of the attribution;

[0029] A transceiver for receiving and sending data under the control of a processor.

[0030] In implementation, the address attribution library is composed of one or a combination of the following parameters: Start_InitIP, End_InitIP, Country, Province or State, City, District, Longitude and Latitude.

[0031] In implementation, determining the source address of the attribution of the IPv6 address according to the converted address value is to determine the source address of the attribution by Start_InitIP(i) < MaliciousIP < End_InitIP(i), and the converted address value is MaliciousIP.

[0032] In implementation, in the address attribution library, determining the source address of the attribution of the IPv6 address according to the converted address value includes:

[0033] After obtaining the record to which the address value belongs according to the converted address value, the geographical location information in the record is extracted as the source address of the attribution.

[0034] In implementation, performing reverse conversion on the IPv6 address is to perform reverse conversion on the first 64 bits in the IPv6 address.

[0035] In implementation, performing reverse conversion on the IPv6 address is to convert the binary IPv6 address into a decimal value and use it as the converted address value.

[0036] In implementation, performing reverse conversion on the IPv6 address includes:

[0037] Convert S 1 S 2 S 3 S 4 to a decimal value T 1 , S 5 S 6 S 7 S 8 to a decimal value T 2 , S 9 S10 S 11 S 12 Convert the value T to decimal 3 , S 13 S 14 S 15 S 16 Convert the value T to decimal 4 , where the first 64 bits of the IPv6 address are composed of S 1 S 2 S 3 S 4 :S 5 S 6 S 7 S 8 :S 9 S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , each S i is the hexadecimal value converted from 4 binary digits, where i is a value from 1 to 16;

[0038] Calculate T 1 *2 48 +T 2 *2 32 +T 3 *2 16 +T 4 , and use this value as the converted address value.

[0039] During implementation, the IPv6 address is reversely converted, including:

[0040] According to the segmentation of the address attribution library, the first 64 bits of the IPv6 address are divided into m sub-segments, and the number of bits in each sub-segment is C 1 , C 2 , C 3 ,……,C m , where C 1 +C 2 +C 3 +……+C m =64;

[0041] The C corresponding to the m sub-segments 1 , C 2 , C 3 ,……,C m Convert the binary value of each bit into decimal value T 1 , T 2 , T 3 ,……,Tm ;

[0042] Calculate and use each value as the converted address value.

[0043] A device for determining the source address of the place of origin, comprising:

[0044] An address module for determining the IPv6 address that initiates a malicious attack;

[0045] A conversion module for converting the IPv6 address to obtain a converted address value;

[0046] A determination module for determining the source address of the place of origin of the IPv6 address in an address attribution library, where the address attribution library contains the correspondence between the address value and the source address of the place of origin.

[0047] In implementation, the address attribution library is composed of one or a combination of the following parameters: Start_InitIP, End_InitIP, Country, Province or State, City, District, Longitude and Latitude.

[0048] In implementation, the determination module is further configured to determine the source address of the place of origin through Start_InitIP(i) < MaliciousIP < End_InitIP(i), where the converted address value is MaliciousIP.

[0049] In implementation, when the determination module is further configured to determine the source address of the place of origin of the IPv6 address in the address attribution library, it includes:

[0050] After obtaining the record to which the converted address value belongs according to the converted address value, then extract the geographical location information in the record as the source address of the place of origin.

[0051] In implementation, the conversion module is further configured to perform reverse conversion on the first 64 bits of the IPv6 address.

[0052] In implementation, when the conversion module is further performing reverse conversion on the IPv6 address, it converts the binary IPv6 address into a decimal value and uses it as the converted address value.

[0053] In implementation, when the conversion module is further performing reverse conversion on the IPv6 address, it includes:

[0054] Convert S 1 S 2 S 3 S4 Convert the value T to decimal 1 , S 5 S 6 S 7 S 8 Convert the value T to decimal 2 , S 9 S 10 S 11 S 12 Convert the value T to decimal 3 , S 13 S 14 S 15 S 16 Convert the value T to decimal 4 , where the first 64 bits of the IPv6 address are composed of S 1 S 2 S 3 S 4 :S 5 S 6 S 7 S 8 :S 9 S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , each S i is the hexadecimal value converted from 4 binary digits, where i is a value from 1 to 16;

[0055] Calculate T 1 *2 48 +T 2 *2 32 +T 3 *2 16 +T 4 , and use this value as the converted address value.

[0056] In implementation, the conversion module is further used to, when performing reverse conversion on the IPv6 address, include:

[0057] According to the segmentation of the address attribution library, the first 64 bits of the IPv6 address are divided into m sub-segments, and the number of bits in each sub-segment is C 1 , C 2 , C 3 ,……,C m , where C 1 +C 2 +C 3 +……+C m =64;

[0058] The C corresponding to the m sub-segments 1 , C 2 , C 3 ,……,C m Convert the binary value of each bit into decimal value T 1 , T 2 , T 3 ,……,T m ;

[0059] calculate And use each value as the converted address value.

[0060] A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program for executing the above-mentioned method for determining a home location source address.

[0061] The beneficial effects of the present invention are as follows:

[0062] In the technical solution provided by the embodiment of the present invention, after determining the IPv6 address that initiates the malicious attack, the home source address of the IPv6 address can be determined according to the pre-configured address home library. Therefore, the home source address can be determined based on the IPv6 address of the malicious attack. Further, the IPv6 home source address verification can be implemented to prevent malicious attacks.

[0063] Furthermore, since there are various ways to generate the address attribution database, and the generation is based on the size of the network, the methods are flexible and diverse, which is conducive to verification and application. The scope of promotion and application can be large or small, and can be used for an organization, an industry, a country, or multiple countries. The IPv6 attribution source address verification system for preventing malicious attacks is simple to implement and has a good application scenario, and can be widely promoted and expanded after the product is realized. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0065] Figure 1 A schematic diagram of an implementation flow of a method for determining a home location source address in an embodiment of the present invention;

[0066] Figure 2 A schematic diagram of an implementation flow of an IPv6 home location source address verification method for preventing malicious attacks in an embodiment of the present invention;

[0067] Figure 3 A schematic diagram of the structure of a device for determining a home location source address in an embodiment of the present invention;

[0068] Figure 4 The present invention is a schematic diagram of the structure of an IPv6 home source address verification system for preventing malicious attacks in an embodiment of the present invention. DETAILED DESCRIPTION

[0069] The inventors noticed during the invention process that:

[0070] A scheme discloses a potential risk IPv6 address location method and location server. It mainly includes: obtaining IPv6 monitoring data in real time, generating a record containing an address in a unified IPv6 address format, a network segment identifier and a regional identifier for each piece of IPv6 monitoring data; obtaining the daily incremental data of the IPv6 monitoring data corresponding to each preset region; comparing the daily incremental data of the monitoring data of each preset region with the set maximum daily incremental data of the corresponding region, if the daily incremental data of the IPv6 monitoring data of region A is greater than the corresponding set maximum daily incremental data, then the set maximum daily incremental data of region A is updated to the daily incremental data of the IPv6 monitoring data of the current region A, and the IPv6 address that causes the daily incremental data in the IPv6 monitoring data of region A is located as the target IPv6 address, that is, the potential risk IPv6 address; querying and returning the attribution information of the target IPv6 address, thereby improving the monitoring efficiency. However, this scheme is a scheme for discovering potential IPv6 addresses, and does not involve the problem of IPv6 attribution source address verification to prevent malicious attacks.

[0071] It can be seen that there is still a lack of effective methods for verifying the source address of the IPv6 attribution of malicious attacks; and even if there is a partial malicious IPv6 address database, the target IPv6 address system query is complex and inconvenient to operate, and the attribution information cannot be effectively located.

[0072] Based on this, an embodiment of the present invention provides a source address determination scheme for the IPv6 home location of malicious attacks. The specific implementation scheme of the present invention is described below in conjunction with the accompanying drawings.

[0073] Figure 1 A flowchart of a method for determining a home source address is shown in the figure, which may include:

[0074] Step 101: Determine the IPv6 address that initiates the malicious attack;

[0075] Step 102: After converting the IPv6 address, a converted address value is obtained;

[0076] Step 103: In the address attribution database, determine the attribution source address of the IPv6 address according to the converted address value, wherein the address attribution database contains the correspondence between the address value and the attribution source address.

[0077] In implementation, in the address attribution library, determining the source address of the attribution location of the IPv6 address according to the converted address value includes:

[0078] After obtaining the record to which the address value belongs according to the converted address value, then extracting the geographical location information in the record as the source address of the attribution location.

[0079] Specifically, the solution is based on the IPv6 attribution library. By performing reverse conversion on the maliciously attacked IPv6 address, the converted address value is obtained; then using the converted address value to perform size comparison in the attribution library, and then obtaining the record to which the address value belongs; then extracting the geographical location information in the record, thus realizing the verification of the source address of the attribution location.

[0080] In implementation, the address attribution library is composed of one or a combination of the following parameters: Start_InitIP, End_InitIP, Country, Province or State, City, District, Longitude and Latitude.

[0081] In specific implementation, determining the source address of the attribution location of the IPv6 address according to the converted address value is to determine the source address of the attribution location through Start_InitIP(i) < MaliciousIP < End_InitIP(i), and the converted address value is MaliciousIP.

[0082] Specifically, the maliciously attacked IPv6 address can be input; then call the conversion function to perform reverse conversion on the maliciously attacked IPv6 address; obtain the converted address mapping value, denoted as MaliciousIP; perform size comparison of each Start_InitIP(i) and End_InitIP(i) on the converted address mapping value MaliciousIP in the attribution library; if Start_InitIP(i) < MaliciousIP < End_InitIP(i), then obtain the record to which the maliciously attacked address mapping value belongs; extract the geographical location information in the record to obtain the source address of the attribution location.

[0083] The following is illustrated by an example.

[0084] First, the implementation of the IPv6 address attribution database is explained. The constituent elements of the IPv6 address attribution database may include 7, namely Start_InitIP ​​(starting point), End_InitIP ​​(end point), Country (country), Province or State (province or state), City (city), District (district), Longitude and Latitude (longitude and latitude). It can be seen that the seven-tuple that constitutes the IPv6 address attribution database is: [Start_InitIP|End_InitIP|Country|Province or State|City|District|Longitude and Latitude], thereby realizing the generation and construction of the IPv6 address attribution database.

[0085] A feasible generation implementation method of the IPv6 address attribution database is described below.

[0086] For IPv6 address input, the input item is any original 128-bit IPv6 address that needs to be included in the home database.

[0087] For the address generation of the IPv6 address attribution library, the input 128-bit IPv6 address is used for address conversion and generation, and the original 128-bit address is generated into an address in the attribution library that can be quickly compared and queried according to the address generation method. Thus, the values ​​corresponding to Start_InitIP ​​and End_InitIP ​​in the attribution library element are generated, or the corresponding values ​​generated by any other IPv6 address conversion between Start_InitIP ​​and End_InitIP. The specific address generation method can include at least two methods, which will be introduced below respectively.

[0088] For the geographical location generation of the IPv6 address attribution database, the geographical location information corresponding to the input 128-bit IPv6 address is used for mapping and generation. Thus, the values ​​corresponding to the Country, Province or State, City, District, Longitude and Latitude in the attribution database elements are generated. The specific generation method can be to map and extract the geographical location according to the rule method, which can be divided into at least the following two categories:

[0089] The first category is to build a database corresponding to the IPv6 address of the unit. The 128-bit address is segmented according to the encoding rules, and then the segmented original value is compared with the IPv6 encoding rules of the unit to obtain the specific country, province, city, and district information, and then the longitude and latitude information is retrieved based on the urban area information.

[0090] The second category is for constructing the attribution library corresponding to the IPv6 addresses of non-this unit. According to the large coding rules stipulated in the standard, the 128-bit original address is segmented. Coarse country, province or state, city, and district information is obtained from the previous large segmentation, and then the longitude and latitude information is retrieved based on the state, city, and district information.

[0091] Figure 2 The schematic diagram of the implementation process of the IPv6 source address verification method for preventing malicious attacks is shown in the figure. The IPv6 source address verification for preventing malicious attacks can include:

[0092] Step 201: Input the IPv6 address of the malicious attack.

[0093] Step 202: Call the conversion function to perform reverse conversion on the IPv6 address of the malicious attack.

[0094] That is, receive the output of step 201 and perform reverse conversion. The conversion method here can include two types: The first type is the IPv6 address conversion method 1; the second type is the IPv6 address conversion method 2. The specific implementation methods will be further described below.

[0095] Step 203: Obtain the converted address mapping value, denoted as MaliciousIP.

[0096] Step 204: Compare the size of the converted address mapping value MaliciousIP with each Start_InitIP(i) and End_InitIP(i) in the attribution library.

[0097] That is, receive the output of step 203 and perform size comparison. The elements of the attribution library here are composed of the following 7 elements, namely Start_InitIP, End_InitIP, Country, Province or State, City, District, Longitude and Latitude. The size comparison here can be performed in different rounds / segments according to the different conversion methods in step 202. For example, if it is the first type, the IPv6 address conversion method 1, then one round / segment is performed; if it is the second type, the IPv6 address conversion method 2, then m rounds / segments are performed.

[0098] Step 205: If Start_InitIP(i) < MaliciousIP < End_InitIP(i), then obtain the record to which the address mapping value of the malicious attack belongs.

[0099] That is, the output of step 204 is received, and the matching and positioning of the corresponding record is performed. The record matching method here performs different rounds / segments according to the different conversion methods in step 202. If it is the first method IPv6 address conversion method 1, one round / segment is performed; if it is the second method IPv6 address conversion method 2, m rounds / segments are performed. Alternatively, the record matching is performed directly according to the number of rounds / segments performed in step 204.

[0100] Step 206: Extract the geographic location information in the record to obtain the home location source address.

[0101] That is, the output of step 205 is received, the geographical location information in the record is extracted, the home source address is obtained, and the source address verification is implemented.

[0102] In implementation, the reverse conversion of the IPv6 address is to reversely convert the first 64 bits of the IPv6 address.

[0103] In a specific implementation, the reverse conversion of the IPv6 address is to convert the binary IPv6 address into a decimal value as the converted address value.

[0104] The following describes how to convert IPv6 addresses:

[0105] The first method: IPv6 address conversion method 1.

[0106] During implementation, the IPv6 address is reversely converted, including:

[0107] S 1 S 2 S 3 S 4 Convert the value T to decimal 1 , S 5 S 6 S 7 S 8 Convert the value T to decimal 2 , S 9 S 10 S 11 S 12 Convert the value T to decimal 3 , S 13 S 14 S 15 S 16 Convert the value T to decimal 4 , where the first 64 bits of the IPv6 address are composed of S 1 S 2 S 3 S 4 :S5 S 6 S 7 S 8 :S 9 S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , each S i is the hexadecimal value converted from 4 binary digits, where i is a value from 1 to 16;

[0108] Calculate T 1 *2 48 +T 2 *2 32 +T 3 *2 16 +T 4 , and use this value as the converted address value.

[0109] Specifically, in a 128-bit IPv6 address, the last 64 bits are mainly used for host identification and have little effect on information such as ownership. Therefore, the 128-bit IPv6 address can be segmented by 64 bits in the first step. The last 64 bits are directly truncated without subsequent consideration; the first 64 bits are converted and generated. This can greatly speed up the speed of address comparison, enhance the efficiency of comparison, and reduce its space complexity.

[0110] The second step is to convert the first 64 bits of the address according to the absolute value method. That is, assuming that the first 64 bits of the original IPv6 address are composed of S 1 S 2 S 3 S 4 :S 5 S 6 S 7 S 8 :S 9 S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , where each S i They are all hexadecimal values ​​converted from 4-bit binary. First, convert them into decimal values ​​S 1 S 2 S 3 S 4 T 1 , S 5 S 6 S 7S 8 T 2 , S 9 S 10 S 11 S 12 T 3 , S 13 S 14 S 15 S 16 T 4 , then calculate T 1 *2 48 +T 2 *2 32 +T 3 *2 16 +T 4 , and use this value as the address mapping value after the malicious attack IPv6 address is converted. Taking 2009:8001:FFF1:FFFF as an example, the address mapping value information after the address is converted can be calculated.

[0111] The second method is IPv6 address conversion method 2.

[0112] During implementation, the IPv6 address is reversely converted, including:

[0113] According to the segmentation of the address attribution library, the first 64 bits of the IPv6 address are divided into m sub-segments, and the number of bits in each sub-segment is C 1 , C 2 , C 3 ,……,C m , where C 1 +C 2 +C 3 +……+C m =64;

[0114] The C corresponding to the m sub-segments 1 , C 2 , C 3 ,……,C m Convert the binary value of each bit into decimal value T 1 , T 2 , T 3 ,……,T m ;

[0115] calculate And use each value as the converted address value.

[0116] Specifically, in a 128-bit IPv6 address, the last 64 bits are mainly used for host identification and have little effect on information such as ownership. Therefore, the 128-bit IPv6 address can be segmented by 64 bits in the first step. The last 64 bits are directly truncated without subsequent consideration; the first 64 bits are converted and generated. This can greatly speed up the speed of address comparison, enhance the efficiency of comparison, and reduce its space complexity.

[0117] The second step is to convert the address of the first 64 bits according to the segmentation method, and then store different numerical values ​​of different segments to facilitate subsequent comparison of sizes. It includes two steps: segmentation and evaluation.

[0118] 1 segment: Assume that the first 64 bits of the original IPv6 address are composed of S 1 S 2 S 3 S 4 :S 5 S 6 S 7 S 8 :S 9 S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , where each S i They are all hexadecimal values ​​converted from 4-bit binary. The segmentation can be determined according to the number of segments taken by the original belonging library. Assuming that it is divided into m segments, the number of bits in each segment is C 1 , C 2 , C 3 ,……,C m . C 1 +C 2 +C 3 +……+C m = 64. For example, the number is divided into 6 segments in the order of 20 bits, 4 bits, 8 bits, 8 bits, 4 bits, and 20 bits.

[0119] 2 Evaluation: Then, the address is converted according to different segments to obtain the corresponding segmented address conversion value. The solution is to convert the C corresponding to the m sub-segments 1 , C 2 , C 3 ,……,C m Convert the binary value of each bit into decimal value T 1 , T 2 , T 3 ,……,T m , then calculate Use these values as the address mapping values corresponding to different segments after the conversion of the IPv6 address.

[0120] Based on the same inventive concept, an apparatus for determining the source address of the place of attribution and a computer-readable storage medium are further provided in the embodiments of the present invention. Since the principles of these devices for solving problems are similar to those of the method for determining the source address of the place of attribution, the implementation of these devices can refer to the implementation of the method, and the repeated parts will not be described again.

[0121] When implementing the technical solutions provided in the embodiments of the present invention, it can be implemented in the following manner.

[0122] Figure 3 The structure diagram of the apparatus for determining the source address of the place of attribution is shown in the figure. The apparatus includes:

[0123] A processor 300, configured to read a program in a memory 320 and execute the following processes:

[0124] Determine the IPv6 address that initiates a malicious attack;

[0125] After converting the IPv6 address, obtain the converted address value;

[0126] In an address attribution library, determine the source address of the place of attribution of the IPv6 address according to the converted address value, where the address attribution library contains the corresponding relationship between the address value and the source address of the place of attribution;

[0127] A transceiver 310, configured to receive and send data under the control of the processor 300.

[0128] In implementation, the address attribution library is composed of one or a combination of the following parameters: Start_InitIP, End_InitIP, Country, Province or State, City, District, Longitude and Latitude.

[0129] In implementation, determining the source address of the place of attribution of the IPv6 address according to the converted address value is to determine the source address of the place of attribution by Start_InitIP(i) < MaliciousIP < End_InitIP(i), where the converted address value is MaliciousIP.

[0130] In implementation, in the address attribution library, determining the source address of the place of attribution of the IPv6 address according to the converted address value includes:

[0131] After obtaining the record to which the converted address value belongs, extract the geographical location information in the record as the source address of the place of attribution.

[0132] In implementation, the reverse conversion of the IPv6 address is to reversely convert the first 64 bits of the IPv6 address.

[0133] In implementation, the reverse conversion of the IPv6 address is to convert the binary IPv6 address into a decimal value as the converted address value.

[0134] During implementation, the IPv6 address is reversely converted, including:

[0135] S 1 S 2 S 3 S 4 Convert the value T to decimal 1 , S 5 S 6 S 7 S 8 Convert the value T to decimal 2 , S 9 S 10 S 11 S 12 Convert the value T to decimal 3 , S 13 S 14 S 15 S 16 Convert the value T to decimal 4 , where the first 64 bits of the IPv6 address are composed of S 1 S 2 S 3 S 4 :S 5 S 6 S 7 S 8 :S 9 S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , each S i is the hexadecimal value converted from 4 binary digits, where i is a value from 1 to 16;

[0136] Calculate T 1 *2 48 +T 2 *2 32 +T 3 *2 16 +T 4 , and use this value as the converted address value.

[0137] During implementation, the IPv6 address is reversely converted, including:

[0138] According to the segmentation of the address attribution library, the first 64 bits of the IPv6 address are divided into m sub-segments, and the number of bits in each sub-segment is C 1 , C 2 , C 3 ,……,C m , where C 1 +C 2 +C 3 +……+C m =64;

[0139] The C corresponding to the m sub-segments 1 , C 2 , C 3 ,……,C m Convert the binary value of each bit into decimal value T 1 , T 2 , T 3 ,……,T m ;

[0140] calculate And use each value as the converted address value.

[0141] Among them, Figure 3 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 300 and memory represented by memory 320. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 310 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 300 is responsible for managing the bus architecture and general processing, and the memory 320 may store data used by the processor 300 when performing operations.

[0142] An embodiment of the present invention further provides a device for determining a home location source address, including:

[0143] Address module, used to determine the IPv6 address from which the malicious attack originated;

[0144] A conversion module, used to convert the IPv6 address to obtain a converted address value;

[0145] The determination module is used to determine the home source address of the IPv6 address according to the converted address value in the address home library, wherein the address home library contains the corresponding relationship between the address value and the home source address.

[0146] In implementation, the address attribution library is composed of one or a combination of the following parameters: Start_InitIP, End_InitIP, Country, Province or State, City, District, Longitude and Latitude.

[0147] In implementation, the determination module is further configured to determine the source address of the attribution location through Start_InitIP(i) < MaliciousIP < End_InitIP(i), where the converted address value is MaliciousIP.

[0148] In implementation, when the determination module is further configured to determine the source address of the IPv6 address in the address attribution library according to the converted address value, it includes:

[0149] After obtaining the record to which the converted address value belongs according to the converted address value, extract the geographical location information in the record as the source address of the attribution location.

[0150] In implementation, the conversion module is further configured to perform reverse conversion on the first 64 bits of the IPv6 address.

[0151] In implementation, when the conversion module performs reverse conversion on the IPv6 address, it converts the binary IPv6 address into a decimal value and uses it as the converted address value.

[0152] In implementation, when the conversion module performs reverse conversion on the IPv6 address, it includes:

[0153] Convert S 1 S 2 S 3 S 4 to the decimal value T 1 , S 5 S 6 S 7 S 8 to the decimal value T 2 , S 9 S 10 S 11 S 12 to the decimal value T 3 , S 13 S 14 S 15 S 16 to the decimal value T 4 , where the first 64 bits of the IPv6 address are composed of S 1 S 2S 3 S 4 :S 5 S 6 S 7 S 8 :S 9 S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , each S i is the hexadecimal value converted from 4 binary digits, where i is a value from 1 to 16;

[0154] Calculate T 1 *2 48 +T 2 *2 32 +T 3 *2 16 +T 4 , and use this value as the converted address value.

[0155] In implementation, the conversion module is further used to, when performing reverse conversion on the IPv6 address, include:

[0156] According to the segmentation of the address attribution library, the first 64 bits of the IPv6 address are divided into m sub-segments, and the number of bits in each sub-segment is C 1 , C 2 , C 3 ,……,C m , where C 1 +C 2 +C 3 +……+C m =64;

[0157] The C corresponding to the m sub-segments 1 , C 2 , C 3 ,……,C m Convert the binary value of each bit into decimal value T 1 , T 2 , T 3 ,……,T m ;

[0158] calculate And use each value as the converted address value.

[0159] For the convenience of description, the various parts of the above-mentioned device are divided into various modules or units according to their functions and described separately. Of course, when implementing the present invention, the functions of each module or unit can be implemented in the same or multiple software or hardware.

[0160] A computer-readable storage medium is also provided in an embodiment of the present invention, characterized in that the computer-readable storage medium stores a computer program for executing the above-mentioned method for determining the source address of the home location.

[0161] For specific implementation, please refer to the implementation method of the above-mentioned method for determining the home source address.

[0162] In practice, other possible device structures for determining the home source address are not excluded, such as the following system.

[0163] Figure 4 To prevent malicious attacks, the IPv6 home address source address verification system structure diagram is shown in the figure, which can be as follows:

[0164] The IPv6 attribution source address verification system for preventing malicious attacks can be composed of an IPv6 address input module, an IPv6 address reverse conversion module, an IPv6 address mapping value matching module, and an IPv6 attribution source address extraction module. Thus, the IPv6 attribution source address verification of malicious attacks is realized, which can greatly speed up the speed of address comparison, enhance the efficiency of comparison, reduce its space complexity, and facilitate subsequent tracing and evidence collection.

[0165] The IPv6 home address source address verification system for preventing malicious attacks includes four functional modules: an IPv6 address input module 401, an IPv6 address reverse conversion module 402, an IPv6 address mapping value matching module 403, and an IPv6 home address source address extraction module 404. The specific functions are as follows:

[0166] The IPv6 address input module 401 is an input item of the entire system, namely, a 128-bit IPv6 address of a malicious attack.

[0167] The IPv6 address reverse conversion module 402 is used to reversely convert the input 128-bit IPv6 address, and convert the original 128-bit address into an address mapping value that can be quickly compared and queried according to the conversion method.

[0168] The IPv6 address mapping value matching module 403 is used to compare and match the converted address mapping value in the belonging database.

[0169] The IPv6 home location source address extraction module 404 is used to extract the geographical location information in the matching record, obtain the home location source address, and implement source address verification.

[0170] In summary, the technical solution provided by the embodiment of the present invention can realize IPv6 home address verification to prevent malicious attacks. The method is flexible and diverse, which is conducive to verification and application.

[0171] The scope of promotion can be large or small, and can be used for an institution, an industry, a country, or multiple countries.

[0172] The IPv6 home source address verification system for preventing malicious attacks is simple to implement and has good application scenarios, and can be widely promoted and expanded after the product is realized.

[0173] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0174] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0175] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0176] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0177] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for determining a home source address, characterized in that: Including: Determine the IPv6 address that initiates a malicious attack; After reverse-converting the IPv6 address, obtain the converted address value; In the address attribution library, determine the source address of the location to which the IPv6 address belongs according to the converted address value, where the address attribution library contains the corresponding relationship between the address value and the source address of the location; Among them, reverse-converting the IPv6 address includes: Convert S1S2S3S4 to decimal value T1, S5S6S7S8 to decimal value T2, S9S 10 S 11 S 12 Convert the decimal value T3, S 13 S 14 S 15 S 16 Converted to decimal value T4, where the first 64 bits of the IPv6 address are composed of S1S2S3S4:S5S6S7S8:S9S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , each S i is the hexadecimal value converted from 4-bit binary, i is a value from 1 to 16; calculate T1*2 48 +T2*2 32 +T3*2 16 +T4, and use this value as the converted address value; or, According to the segmentation of the address attribution library, the first 64 bits of the IPv6 address are divided into m sub-segments, and the number of bits of each sub-segment is C1, C2, C3, ..., C m , where C1+C2+C3+……+C m =64; C1, C2, C3, ..., C corresponding to m sub-segments m The binary values ​​of the bits are converted into decimal values ​​T1, T2, T3, ..., T m ; Calculate T1*2 C1 、T2*2 C2 、T3*2 C3 ,……,T m *2 Cm , and use each value as the converted address value.

2. The method according to claim 1, characterized in that The address attribution library is composed of one or a combination of the following parameters: starting point Start_InitIP, ending point End_InitIP, country Country, province or state Province orState, city City, district District, longitude and latitude Longitude and Latitude.

3. The method according to claim 2, characterized in that Determine the source address of the location to which the IPv6 address belongs according to the converted address value, and determine the source address of the location through Start_InitIP(i) < MaliciousIP < End_InitIP(i), where the converted address value is MaliciousIP.

4. The method according to claim 1, characterized in that In the address attribution library, determining the source address of the location to which the IPv6 address belongs according to the converted address value includes: After obtaining the record to which the address value belongs according to the converted address value, extract the geographical location information in the record as the source address of the location.

5. The method according to any one of claims 1 to 4, characterized in that: Reverse-converting the IPv6 address is to reverse-convert the first 64 bits in the IPv6 address.

6. The method according to claim 5, characterized in that Reverse-converting the IPv6 address is to convert the binary IPv6 address into a decimal value and use it as the converted address value.

7. A device for determining a home source address, characterized in that: Including: A processor for reading a program in a memory and performing the following processes: Determine the IPv6 address that initiates a malicious attack; After reverse-converting the IPv6 address, obtain the converted address value; In the address attribution library, determine the source address of the location to which the IPv6 address belongs according to the converted address value, where the address attribution library contains the corresponding relationship between the address value and the source address of the location; A transceiver for receiving and sending data under the control of the processor; Among them, reverse-converting the IPv6 address includes: Convert S1S2S3S4 to decimal value T1, S5S6S7S8 to decimal value T2, S9S 10 S 11 S 12 Convert the decimal value T3, S 13 S 14 S 15 S 16 Converted to decimal value T4, where the first 64 bits of the IPv6 address are composed of S1S2S3S4:S5S6S7S8:S9S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , each S i is the hexadecimal value converted from 4-bit binary, i is a value from 1 to 16; calculate T1*2 48 +T2*2 32 +T3*2 16 +T4, and use this value as the converted address value; or, According to the segmentation of the address attribution library, the first 64 bits of the IPv6 address are divided into m sub-segments, and the number of bits of each sub-segment is C1, C2, C3, ..., C m , where C1+C2+C3+……+C m =64; C1, C2, C3, ..., C corresponding to m sub-segments m The binary values ​​of the bits are converted into decimal values ​​T1, T2, T3, ..., T m ; Calculate T1*2 C1 、T2*2 C2 、T3*2 C3 ,……,T m *2 Cm , and use each value as the converted address value.

8. A device for determining a home source address, characterized in that: Including: An address module for determining the IPv6 address that initiates a malicious attack; A conversion module for reverse-converting the IPv6 address to obtain the converted address value; A determination module for determining the source address of the location to which the IPv6 address belongs in the address attribution library according to the converted address value, where the address attribution library contains the corresponding relationship between the address value and the source address of the location; The conversion module is specifically used for: Convert S1S2S3S4 to decimal value T1, S5S6S7S8 to decimal value T2, S9S 10 S 11 S 12 Convert the decimal value T3, S 13 S 14 S 15 S 16 Converted to decimal value T4, where the first 64 bits of the IPv6 address are composed of S1S2S3S4:S5S6S7S8:S9S 10 S 11 S 12 :S 13 S 14 S 15 S 16 , each S i is the hexadecimal value converted from 4-bit binary, i is a value from 1 to 16; calculate T1*2 48 +T2*2 32 +T3*2 16 +T4, and use this value as the converted address value; or, According to the segmentation of the address attribution library, the first 64 bits of the IPv6 address are divided into m sub-segments, and the number of bits of each sub-segment is C1, C2, C3, ..., C m , where C1+C2+C3+……+C m =64; C1, C2, C3, ..., C corresponding to m sub-segments m The binary values ​​of the bits are converted into decimal values ​​T1, T2, T3, ..., T m ; Calculate T1*2 C1 、T2*2 C2 、T3*2 C3 ,……,T m *2 Cm , and use each value as the converted address value.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 6.

Images