A link dynamic change method based on IP large-scale transformation

Abstract

The application provides a link dynamic change method based on large-scale IP address conversion, which makes a network communication destination unable to track a real network address of a local network communication initiator, so as to achieve the purpose of protecting the privacy of the local network communication initiator. The method comprises the following steps: a local network communication initiator sends a real IP and a real port, an IP and a port number of a communication destination, and communication content to an independent device; the independent device generates a fake IP and a fake port of the communication initiator in a large-scale IP according to a rule, and reconfigures a data packet to realize network communication with the network communication destination. Meanwhile, the independent device captures, accurately identifies, and redirects specific network traffic data packets of the network destination outside the local network at a high speed, so as to realize normal communication with the communication initiator. In the whole process, the network address IP of the local network communication initiator is converted, and the local network communication initiator and other network communication destinations cannot perceive it.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a link dynamic change communication method based on a wide range of IP address changes. Background Technology

[0002] Due to the need for network security and user privacy protection, local network communication initiators, while wishing to maintain stable communication with other network destinations, do not expose their real network addresses. This method, by continuously replacing the local communication initiator's network address with a wide range of real IP addresses while ensuring uninterrupted communication link connections, prevents other network communication destinations from tracking and obtaining the local network communication initiator's real network address, thereby achieving the goal of protecting the privacy of the local network communication initiator. Summary of the Invention

[0003] Figure 1 The diagram shown is a schematic diagram.

[0004] The local network communication initiator uses a real IP address to initiate VPN access to an independent device, encrypting and encapsulating the network address, port, and access content outside the local network to be accessed before sending them to the independent device.

[0005] A standalone device, located at the gateway of the local network, uses the real IP address of the local network communication initiator and the hash value of the current time t as a key to generate a random number to construct the IP address to be spoofed. It then uses the real port of the local network communication initiator and the port number of a network address outside the local network to construct a spoofed port number. Finally, it reconstructs data packets using the generated spoofed IP address and spoofed port number to communicate with the communication destination outside the local network. Simultaneously, it constructs a flow table with the following format:

[0006] (Destination IP outside the local network, destination port outside the local network, spoofed IP, spoofed port, real IP, real port, t)

[0007] When an independent device receives data from outside the local network, it first checks the flow table to verify whether the data is a genuine network access. If so, it forwards the data directly to the corresponding address. Otherwise, it reconstructs the data packet based on the real IP and real port in the flow table information and performs VPN encrypted communication with the initiator of the communication on the local network.

[0008] An independent device continuously monitors each entry in the flow table. If the time difference between t and the current time exceeds a time interval T, it reconstructs the spoofed IP and a new flow table entry according to the above rules. It reconstructs the data packets based on the actual data exchange between the communicating parties. This allows for transparent and dynamic changes to the spoofed IP of the communication initiator, while maintaining the actual communication link. This makes the destination outside the local network unaware of the real IP of the communication initiator within the local network. If the independent device detects that a communication link has ended, it clears the corresponding flow table entry. Attached Figure Description

[0009] Figure 1 A schematic diagram of a system deployment based on dynamic link changes with a wide range of IP address transformations;

[0010] Figure 2 A schematic diagram of the dynamic change process of links based on a wide range of IP address changes. Detailed Implementation

[0011] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0012] like Figure 1 The diagram shows a system deployment diagram based on dynamic link changes with a wide range of IP address transformations.

[0013] In this embodiment of the invention, the system deployment diagram based on the dynamic change of links with a wide range of IP address changes includes three types of entities: the communication initiator of the local network, independent devices, and the communication destination of other networks.

[0014] The communication initiator generally refers to an entity within the local network that needs to hide its real IP address and port number from other network communication purposes, such as a PC or server.

[0015] The term "communication destination" generally refers to other entities within the network with which the local communication initiator wants to communicate.

[0016] The standalone device can generate spoofed IPs and port numbers for the communication initiator according to certain rules, and reconstruct data traffic packets, enabling the communication initiator and the communication destination to communicate normally without being aware of changes in spoofed IPs and port numbers; and the standalone device is deployed at the boundary of the local network.

[0017] like Figure 2 The diagram shows a dynamic change process of a link based on a wide range of IP address changes.

[0018] In this embodiment of the invention, the link dynamic change process based on a large-scale IP address change mainly includes:

[0019] Step 101: The communication initiator sends its own real IP address, port number, the communication destination's IP address, port number, and communication data to the independent device via a VPN connection.

[0020] In this process, all data packets sent by the communication initiator to the independent device are encrypted via VPN, which can effectively resist attacks such as eavesdropping, filtering and analysis of traffic;

[0021] Step 102: After receiving the data from the communication initiator, the independent device first decrypts it to obtain the initiator's real IP address and port number, the destination's IP address and port number, and the communication data. Then, it spoofs the initiator's IP address and port number according to certain rules, constructs corresponding data flow table entries, and reconstructs the data packets to communicate with the destination based on the data flow table. Specifically:

[0022] The method for constructing a spoofed IP for the communication initiator is to hash the real IP of the communication initiator on the local network together with the current time t, and then use this value as the key to generate a 1024-bit binary random number. Finally, bits 1-8, 9-16, 1009-1016, and 1017-1024 of this binary number, a total of 32 bits, are used to construct the spoofed IP. The construction space for this spoofed IP is approximately 2^32.

[0023] The method for constructing the spoofed port number by the communication initiator is to take the sum of the real port number and the port number of the external access address on the local network, modulo 65535. If the value is greater than 1024, then the value is taken as the spoofed port; otherwise, the sum of the value and 1024 is taken as the spoofed port.

[0024] A data flow table is a flow table that creates a corresponding entry when an independent device constructs a spoofed IP and spoofed port number for the network initiator to communicate with the communication destination. The entry is cleared after the communication ends. The format is as follows: (Destination IP outside the local network, Destination port outside the local network, Spoofed IP, Spoofed port, Real IP, Real port, t), where t is the time when the communication was initiated.

[0025] Meanwhile, when an independent device detects that the time difference between the entry t in the flow table and the current time exceeds a time interval T, it reconstructs the fake IP and fake port according to the construction rules and updates the corresponding entries.

[0026] Step 103: The independent device captures specific network traffic data packets of the network destination outside the local network at high speed, and accurately identifies and redirects them according to the data flow table to achieve normal communication with the communication initiator.

[0027] in:

[0028] When an independent device detects data traffic originating from outside the local network, it checks the data flow table based on the communication IP and port information of the data packets. If no match is found, the traffic is considered normal and is allowed to pass and forwarded. Otherwise, if the data traffic originates from a response traffic originating from outside the local network, the device searches for the actual communication IP and port number based on the corresponding data flow table entry, reconstructs the data traffic packet, and initiates VPN encrypted communication with the communication initiator on the local network to complete the communication.

[0029] When an independent device detects that a communication connection is complete, it removes the corresponding entry from the data flow table.

[0030] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for dynamic link change based on large-range transformation, characterized in that, The method includes: The communication initiator sends its real IP address, real port number, destination IP address, destination port number, and communication data to an independent device via VPN encryption; wherein, the independent device is located at the gateway of the local network. The independent device decrypts the data of the communication initiator to obtain the real IP of the communication initiator, the real port number of the communication initiator, the IP of the communication destination, the port number of the communication destination, and the communication data; The real IP address of the communication initiator and the current time are hashed together. The hash value is then used as the key to generate a 1024-bit binary random number. Finally, this binary random number is used... Bit, Bit, Position and A total of 32 bits are used to construct a fake IP address; The sum of the real port number of the communication initiator and the port number of the communication destination is modulo 65535. If the value is greater than 1024, then the value is taken as the spoofed port; otherwise, the sum of the value and 1024 is taken as the spoofed port. Based on the destination IP address, destination port number, spoofed IP address, spoofed port number, and communication data, the data stream is reconstructed to communicate with the destination.

2. The method according to claim 1, characterized in that, Each independent device needs to maintain a flow table. When a network initiator in the local network initiates communication, a corresponding entry is created and the entry is cleared after the communication ends. The format is as follows: (Destination IP outside the local network, Destination port outside the local network, Spoofed IP, Spoofed port, Real IP, Real port, t), where t is the time when the communication was initiated.

3. The method according to claim 2, characterized in that, When an independent device detects that the time difference between entry t in the flow table and the current time exceeds a time interval T, it reconstructs the spoofed IP and spoofed port.

4. The method according to claim 2, characterized in that, When an independent device detects a data stream from outside the local network, it first checks the flow table to verify whether the data is a genuine network access. If so, it forwards the data directly to the corresponding address. Otherwise, it reconstructs the data packet based on the real IP and port information in the flow table and performs VPN encrypted communication with the initiator of the communication on the local network.

Images