A networking method and system based on dynamic IPv6 address

Abstract

The application discloses a networking method and system based on dynamic IPv6 addresses, wherein the system comprises terminal equipment and a VPN gateway, and the terminal equipment accesses a network through the VPN gateway. The dynamic change of the IPv6 address of the VPN gateway (if the public IPv4 address is sufficient, the method is also applicable) can effectively alleviate the network asset exposure surface and reduce the possibility of being attacked by taking advantage of the unlimited nature of the IPv6 address.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of networking technology, in particular to a networking method and system based on dynamic IPv6 address. BACKGROUND

[0002] IPv6 (Internet Protocol Version 6) is the abbreviation of Internet Protocol version 6, which is the next generation IP protocol designed by the Internet Engineering Task Force (IETF) to replace IPv4. One of the biggest advantages is that the number of addresses can be assigned to every grain of sand in the world.

[0003] VPN (Virtual Private Network) is a virtual private network, which mainly functions to establish a private network on a public network for encrypted communication. It is widely used in enterprise networks. VPN gateway realizes remote access by encrypting data packets and converting data packet target addresses.

[0004] However, the existing networking method using VPN gateway has the following problems:

[0005] 1. Device exposure risk

[0006] VPN gateways exposed to the public network are easy targets for brute force attacks. Attackers can use service vulnerabilities, security vulnerabilities, weak passwords, or default credentials to invade by scanning the VPN gateway system's service conditions. For example, devices that update firmware in a timely manner may contain known vulnerabilities (such as CVE number vulnerabilities) that can be exploited by hackers. Hackers can also use DDoS attacks to prevent VPN gateways from providing normal services externally.

[0007] 2. Key negotiation vulnerability

[0008] If the strong encryption algorithm (such as AES-256) is not correctly configured, it may be subject to man-in-the-middle attacks or brute force attacks, resulting in key leakage. The long-term fixed key of the security association (SA) is vulnerable to replay attacks.

[0009] 3. Tunnel hijacking risk

[0010] Attackers can intercept communication traffic (such as bank transactions), tamper with data or steal credentials, especially in unencrypted transmissions, which poses a high risk. SUMMARY

[0011] To this end, the technical problem to be solved by the present application is to provide a networking method and system based on dynamic IPv6 address, which takes advantage of the unlimited nature of IPv6 addresses and dynamically changes the IPv6 address of the VPN gateway (if the public IPv4 address is sufficient, it is also applicable). This can effectively reduce the exposure of network assets and reduce the likelihood of being attacked.

[0012] To solve the above technical problems, the present application provides the following technical solutions:

[0013] A networking method based on dynamic IPv6 address, comprising the following steps:

[0014] 1) presetting the pre-shared information in the VPN gateway and the terminal device, and presetting the VPN gateway IPv6 address prefix Part0 in the terminal device, wherein the VPN gateway IPv6 address prefix Part0 is 64 bits;

[0015] S2) within the time window T k , the VPN gateway first performs time synchronization by using the NTP service, then uses the standard time source Time1 and the pre-shared information as input parameters to calculate the 64-bit VPN gateway IPv6 address suffix Part k by using the hash function, and combines the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k to form the VPN gateway IPv6 address Address k , wherein the VPN gateway uses Address k as the new VPN gateway address for replacing the old VPN gateway address Address k-1 , and k is a natural number greater than or equal to 1;

[0016] S3) within the time window T k , the terminal device uses the standard time source Time2 and the pre-shared information as input parameters to calculate the 64-bit VPN gateway IPv6 address suffix Part k,n by using the hash function, and combines the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k,n to form the VPN gateway IPv6 address Address k,m , wherein n is a natural number greater than or equal to 3, and m is a natural number greater than or equal to 2;

[0017] S4) within the time window T k , the terminal device accesses the VPN gateway by using Address k-1 and Address k,m at the same time, when Address k,m is the same as Address k , the VPN gateway returns a data packet containing Address k,m , otherwise, the VPN gateway returns a data packet containing Address k-1 only, and then proceeds to the next step;

[0018] S5) The terminal device uses the NTP service to synchronize its time, and then repeats steps S3) and S4) until the terminal device uses the Address k,m Successful access to the VPN gateway completes the network setup. Use the address... k,m After the network is completed, the terminal device will be in time t 过渡 Use Address k and Address k-1 Access the VPN gateway, then disable the address. k-1 Time t 过渡 The duration is a custom duration.

[0019] In the aforementioned networking method based on dynamic IPv6 addresses, the pre-shared information consists of one or more of the following: a symmetric key, a TPM key fingerprint, or device ID information. This pre-shared information is non-public, meaning it is not publicly available on the internet.

[0020] In the above networking method based on dynamic IPv6 addresses, in step S2), the VPN gateway obtains the VPN gateway IPv6 address. k Then, the VPN gateway IPv6 address will be sent. k Configure to the network interface.

[0021] In the aforementioned networking method based on dynamic IPv6 addresses, after the terminal device completes the initial network setup, the VPN gateway generates a new VPN gateway address, signs and publishes the new VPN gateway address, and sends the signature information to the terminal device. The terminal device then decrypts and verifies the signature information to confirm the use of the address. k,m Address in the successful access message k,m A new VPN gateway address generated for the VPN gateway.

[0022] In the above networking method based on dynamic IPv6 addresses, in step S4), if within the time window T... k Address cannot be used inside k,m If the VPN gateway is successfully accessed, the terminal device will be prohibited from accessing the VPN gateway within the time window T. k End of time window T k+1 Use Address during the period between the start and end times k-1 Access the VPN gateway and allow the terminal device to access the VPN gateway within the time window T. k+1 Re-establish a connection with the VPN gateway; where k is a natural number greater than or equal to 1.

[0023] The above networking method based on dynamic IPv6 addresses, within the time window T k Internally, the VPN gateway uses Address kand Address k-1 providing services.

[0024] A system for networking using the above-mentioned networking method based on dynamic IPv6 addresses, comprising a terminal device and a VPN gateway, the terminal device accessing the network through the VPN gateway; both the terminal device and the VPN gateway are provided with a time synchronization module and an address calculation module.

[0025] The above-mentioned system, the VPN gateway is further provided with an address configuration module for dynamically adding or removing interface IPv6 addresses.

[0026] The above-mentioned system, the terminal device is further provided with a signature verification module for verifying the legitimacy of the new VPN gateway address issued by the VPN gateway.

[0027] The above-mentioned system, the VPN gateway and the terminal device are further respectively provided with a VPN connection control module.

[0028] The technical scheme of the present application achieves the following beneficial technical effects:

[0029] 1. The present application binds the IPv6 address space with time to form a dynamic, distributed and peer-to-peer negotiation communication mechanism, effectively reducing the detectability of network nodes and the problem of attack surface exposure, especially suitable for communication systems with high requirements for security and predictability such as government affairs, military industry and Internet of Things.

[0030] 2. The scheme effectively adapts to the zero-trust architecture scheme, extending the concept of "never trust, continuous verification" to the network layer IP connection. The security of the connection is guaranteed from the beginning of communication, effectively avoiding the possibility of being attacked by hackers, effectively solving the hidden danger of exposing the VPN gateway to the public network in business scenarios such as remote office access and company branch interconnection, and cooperating with digital certificate verification, SPA first packet verification and other schemes to effectively solve the problem of high hacker level and low user defense scheme security, upgrade and optimization lag.

[0031] 3. The terminal device can calculate the current address of the VPN gateway based on the current time window locally, and the terminal does not need to obtain the VPN gateway IP address information through DNS query, multicast query and other methods; the VPN gateway interface allows simultaneous binding of multiple dynamically calculated IPv6 addresses, supporting multi-address listening and connection switching with VPN application.

[0032] 4. Support smooth address replacement, through the "old address reservation + new address pre-binding" mechanism, ensure that the VPN session does not interrupt, improve system stability; optional extension mechanisms include: digitally signing the address generation result to prevent man-in-the-middle attacks; using quantum-resistant encryption algorithms to ensure future security. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 This is a schematic diagram illustrating the working principle of the networking system based on dynamic IPv6 addresses in this invention.

[0034] Figure 2 This is a flowchart of the networking based on dynamic IPv6 addresses in this invention. Detailed Implementation

[0035] The present invention will be further explained below with reference to examples.

[0036] like Figure 1 As shown, the networking system based on dynamic IPv6 addresses in this invention includes terminal devices and a VPN gateway. The terminal devices access the network through the VPN gateway. In this invention, the VPN gateway includes a time synchronization module, an address calculation module, an address configuration module, and a VPN connection control module. The terminal devices also include a time synchronization module, an address calculation module, a signature verification module, and a VPN connection control module. The VPN connection control module in the terminal devices supports multiple address attempts and connection status determination. The VPN connection control module in the VPN gateway supports binding multiple IPv6 addresses and monitoring VPN connections. The address configuration module enables the dynamic addition / removal of interface IPv6 addresses.

[0037] This embodiment uses a VPN gateway and terminal devices to form a network as an example. The terminal devices include computers, servers, and mobile phones. The specific steps for connecting multiple terminal devices using a VPN gateway to form an interconnected network are as follows:

[0038] S1) Pre-configure pre-shared information in the VPN gateway and terminal device, and pre-configure VPN gateway IPv6 address prefix Part0 in the terminal device. VPN gateway IPv6 address prefix Part0 is 64 bits. The pre-shared information is one or more of the following: symmetric key, TPM key fingerprint, or device ID information.

[0039] S2) in time window T k Internally, the VPN gateway first uses the NTP service for time synchronization, and then uses the standard time source Time1 and pre-shared information as input parameters to calculate the 64-bit VPN gateway IPv6 address suffix Part using a hash function. k And set the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part0 to... k Combined into VPN gateway IPv6 address k The VPN gateway will address k As a replacement for the old VPN gateway address k-1a new VPN gateway address, k is a natural number greater than or equal to 1;

[0040] S3) Within the time window T k , the terminal device uses a hash function to calculate a 64-bit VPN gateway IPv6 address suffix Part k,n using a standard time source Time2 and pre-shared information as input parameters, and combines the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k,n to form a VPN gateway IPv6 address Address k,m , n is a natural number greater than or equal to 3, and m is a natural number greater than or equal to 2;

[0041] S4) Within the time window T k , the terminal device accesses the VPN gateway using Address k-1 and Address k,m at the same time, when Address k,m is the same as Address k , the VPN gateway returns a data packet containing Address k,m , otherwise, the VPN gateway returns a data packet containing Address k-1 , and then goes to the next step; when the terminal device receives the data packet returned by the VPN gateway and containing Address k,m , the terminal device can determine that the predicted VPN gateway address is correct, and if the terminal device only receives the data packet returned by the VPN gateway and containing Address k-1 , the terminal device can determine that the predicted VPN gateway address is incorrect, i.e. the terminal device needs to predict a new address generated by the VPN gateway within the time window T k ;

[0042] S5) The terminal device performs time synchronization with the VPN gateway, and then repeats steps S3) and S4) until the terminal device successfully accesses the VPN gateway using Address k,m , i.e. completes networking, and uses Address k,m to complete networking, after which Address k-1 is disabled.

[0043] In steps S2) and S3), the length of the time window is a constant T, for example, 600 seconds. The standard time source Time1 of the VPN gateway and the standard time source Time2 of the terminal device are calibrated and synchronized through NTP service, and the current time window number is calculated:

[0044] t = floor(current_utc_time / T)

[0045] After the time synchronization between the VPN gateway and the terminal device, Time1 and Time2 should be the same, and the current time window number T can be taken k As a standard time source, it is used as a dynamic input of the VPN gateway address generation function, and the pre-shared information is used to form the VPN unique input, improving the address uniqueness and unpredictability of the VPN gateway.

[0046] In steps S2) and S3), the address calculation module in the VPN gateway and the address calculation module in the terminal device complete the VPN gateway IPv6 address suffix calculation through the following steps:

[0047] session_key = HMAC(PSI, t) / / Optionally use SHA-3, BLAKE3

[0048] ipv6_suffix = Truncate(Hash(session_key), 64 bits)

[0049] When entering a new time window Tk+1, and after the VPN gateway completes the calculation and splicing of the new VPN gateway address, the VPN gateway will configure the network interface with the new VPN gateway address corresponding to the time window through the following command:

[0050] ip -6 addr add 2001:db8:abcd:: <suffix>dev eth0

[0051] At the same time, the time window T k The old address of the VPN gateway used in the time window T k+1 Can continue to be used until the time window T k+ 1 is removed, thereby forming a smooth transition zone. And by the VPN gateway through the VPN connection control module listens to all the current active address, to ensure seamless terminal device connection switching. This operation can be realized by script, timing task or daemon automation.

[0052] In the process of networking, the terminal device does not need to obtain any data about the VPN gateway IPv6 address suffix from the VPN gateway, and completely calculates the IPv6 address of the VPN gateway according to the time window and the pre-shared information, and uses the calculated IPv6 address to attempt connection, the specific connection attempt process is:

[0053] Time synchronization (error control <1s) / / considering network delay, etc., this error tolerance can be NTP value program to avoid, to ensure that both take NTP value is the same.

[0054] Calculate the current and future window address

[0055] Initiate a connection request to the current address

[0056] When failed, try ±1 window address (anti-drift)

[0057] When the session is about to expire, automatically connect the next address (smooth reconnection)

[0058] Among them, "when failed, try ±1 window address" refers to judging whether to predict the VPN gateway IPv6 address of the current time window again or to predict the VPN gateway IPv6 address of the next time window according to the time window progress, and then predict the VPN gateway IPv6 address.

[0059] In step S4), the terminal device judges whether the prediction of the new address of the VPN gateway is successful according to whether the Address k,m Is contained in the received data packet, which can further improve network security.

[0060] In order to improve security, the signature mechanism is also enabled in the present application. At this time, the terminal device needs to download and verify the VPN gateway signature package first, and only after the verification is passed can the connection be performed.

[0061] And after the terminal device completes the first networking, the VPN gateway can sign and issue the VPN gateway new address after generating the VPN gateway new address and send the signature information to the terminal device, such as using the VPN gateway private key for encryption, and letting the terminal device use the public key for decryption, and the CA public key or digital certificate in the application is default in public environment. The signing process of the VPN gateway new address is:

[0062] Data = t || suffix

[0063] Sig = Sign(Data, K_priv)

[0064] The signature result can be distributed through DNS TXT record or HTTPS directory:

[0065] {

[0066] "time": "t",

[0067] "suffix": "a1b2:c3d4",

[0068] "sig": "30440220..."

[0069] }

[0070] And the terminal device uses the preset K_pub or CA certificate to verify its legitimacy, preventing third parties from forging addresses to induce connections.

[0071] After the networking method based on dynamic IPv6 address of the application is used for networking, if a hacker wants to intrude into the network through the VPN gateway, he first needs to access the VPN gateway. At this time, the hacker scans a / 64 mask IPv6 address segment (containing 2 64 host addresses) at a speed of 1 million IPv6 addresses per second through a tool. It takes about 500,000 years to traverse all possible addresses. The core reason is that the / 64 mask address segment of IPv6 contains 1.8×1019 host addresses, far exceeding the total address space of IPv4 (about 4.3×10 9 The attacker needs to traverse astronomical numbers of addresses to find valid targets. This results in high scanning costs (hardware resources, time) and low success rate, which does not match the short-term profit-making attack mode of ransomware and other attacks, and suppresses the willingness of hackers to invest.

[0072] Moreover, the VPN gateway is dynamically changing, and the network layer has strong traceability (without NAT), so the attacker has high exposure risk, which further suppresses large-scale scanning and attack behavior and increases the cost of hacker attacks.

[0073] In the application, a program is configured in the VPN gateway, the VPN gateway IPv6 address is periodically modified according to a preset strategy, the terminal device actively accesses, a VPN encryption tunnel is constructed, the terminal device can predict the changed VPN gateway IPv6 address by using the pre-shared information and the prefix of the VPN gateway IPv6 address, then the terminal device builds a VPN tunnel that can be encrypted on the public network by using the predicted changed VPN gateway IPv6 address, the data stream is protected from being decrypted, listened to and tampered with, and most importantly, the server gateway IP address is hidden, the IPv6 address is used to avoid asset exposure and attacks by using the unlimited advantage of the IPv6 address.

[0074] Obviously, the above embodiments are only examples for clearly illustrating but not limiting the embodiments. Based on the above description, other different forms of changes or variations can be made by those skilled in the art. All the embodiments do not need to be exhausted here, and the obvious changes or variations derived therefrom are still within the protection scope of the patent application claims.< / suffix>

Claims

1. A method for networking based on dynamic IPv6 addresses, characterized in that, Comprising the following steps: S1) presetting pre-shared information in the VPN gateway and the terminal device, and presetting a VPN gateway IPv6 address prefix Part0 in the terminal device, the VPN gateway IPv6 address prefix Part0 being 64 bits; S2) in the time window T k , the VPN gateway first synchronizes time by using the NTP service, then uses a hash function to calculate a 64-bit VPN gateway IPv6 address suffix Part k by using a standard time source Time1 and pre-shared information as input parameters, and combines a VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k into a VPN gateway IPv6 address Address k , and the VPN gateway uses Address k as a new VPN gateway address to replace an old VPN gateway address Address k-1 , k is a natural number greater than or equal to 1. S3) In the time window T k , the terminal device uses a hash function to calculate a 64-bit VPN gateway IPv6 address suffix Part k,n using a standard time source Time2 and pre-shared information as input parameters, and combines the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k,n into a VPN gateway IPv6 address Address k,m , where n is a natural number greater than or equal to 3, and m is a natural number greater than or equal to 2. S4) In the time window T k , the terminal device simultaneously uses Address k-1 and Address k,m to access the VPN gateway. When Address k,m is the same as Address k , the VPN gateway returns a data packet containing Address k,m ; otherwise, the VPN gateway returns a data packet containing Address k-1 , and then the process moves to the next step. S5) The terminal device synchronizes time using the NTP service, and then repeats steps S3) and S4) until the terminal device uses Address k,m successfully accesses the VPN gateway, i.e., completes networking, using Address k,m After completing networking, the terminal device uses Address 过渡 at time t k and Address k-1 accesses the VPN gateway, and then deactivates Address k-1 , time t 过渡 is a custom duration.

2. The dynamic IPv6 address based networking method according to claim 1, wherein, The pre-shared information is one or more of a symmetric key, a TPM key fingerprint, or terminal device ID information.

3. The dynamic IPv6 address based networking method of claim 1, wherein, In step S2), the VPN gateway acquires the VPN gateway IPv6 address Address k The VPN gateway IPv6 address Address k is configured to the network interface.

4. The method for networking based on dynamic IPv6 address according to claim 1, characterized in that, After the terminal device completes the first networking, the VPN gateway signs and issues the VPN gateway new address after generating the VPN gateway new address, and sends the signature information to the terminal device, which decrypts and verifies the signature information to confirm the use of Address k,m Address k,m The VPN gateway new address generated for the VPN gateway.

5. The method for networking based on dynamic IPv6 address according to claim 1, characterized in that, In step S4), if within time window T k Address cannot be used inside k,m If the VPN gateway is successfully accessed, the terminal device will be prohibited from accessing the VPN gateway within the time window T. k End of time window T k+1 Use Address during the period between the start and end times k-1 Access the VPN gateway and allow the terminal device to access the VPN gateway within the time window T. k+1 Re-establish a connection with the VPN gateway; where k is a natural number greater than or equal to 1.

6. The dynamic IPv6 address based networking method of claim 5, wherein, Within the time window T k , the VPN gateway provides services using Address k and Address k-1 .

7. A system for networking using the method for networking based on dynamic IPv6 address according to claim 1, characterized in that, The system comprises a terminal device and a VPN gateway, the terminal device accessing a network through the VPN gateway; the terminal device and the VPN gateway are each provided with a time synchronization module and an address calculation module.

8. The system of claim 7, wherein, The VPN gateway is also provided with an address configuration module for dynamically adding or removing an interface IPv6 address.

9. The system of claim 7, wherein, The terminal device is also provided with a signature verification module for verifying the legality of a new VPN gateway address issued by the VPN gateway.

10. The system of claim 7, wherein, The VPN gateway and the terminal device are each provided with a VPN connection control module.

Images