IPv6 Network Flow Data Desensitization Method, Device, Electronic Device and Medium

Abstract

The present invention provides an IPv6 network flow data desensitization method, device, electronic device and medium, which relates to the technical fields of data processing and data security. The method includes: Step S1, using a traffic collection tool to collect IPv6 data packets from mirrored traffic, generating IPv6 network flow data, and storing the IPv6 network flow data in a shared platform; Step S2, when receiving a data access request initiated by a user terminal to the shared platform, the shared platform extracts specified fields from the IPv6 network flow data, performs symmetric encryption on the specified fields to obtain ciphertext data; Step S3, the shared platform obtains the public key included in the data access request, and performs asymmetric encryption on the key used in the symmetric encryption using the public key to obtain the encrypted key; Step S4, sending the ciphertext data and the encrypted key to the shared platform at the same time, and the shared platform distributes them to the user terminal.

Description

Technical Field

[0001] The present invention relates to the technical fields of data processing and data security, and particularly relates to an IPv6 network flow data desensitization method, device, electronic device and medium. Background Art

[0002] The advent of the big data era has subverted the operation mode of traditional business forms and stimulated new production potential. Data has become an important production factor and the carrier of information, and the flow of data also hides value information of a higher dimension. For data controllers and data processors, how to maximize the value of data flow is the original intention and meaning of data mining. However, the exposure of a series of information leakage incidents has made data security receive more and more extensive attention.

[0003] The symmetric encryption algorithm is an encryption algorithm that has been applied earlier and has mature technology. In the symmetric encryption algorithm, the data sender combines the plaintext (original data) and the encryption key and processes them through a special encryption algorithm to make it into a complex encrypted ciphertext and send it out. After the recipient receives the ciphertext, if it wants to interpret the original text, it needs to use the encryption key used for encryption and the inverse algorithm of the same algorithm to decrypt the ciphertext to restore it to readable plaintext. In the symmetric encryption algorithm, only one key is used, and both the sender and the recipient use this key to encrypt and decrypt the data, which requires the decryption party to know the encryption key in advance. The choice is to use the symmetric encryption algorithm to encrypt the content of the PCAP (Packet Capture) data packet without changing the data packet format.

[0004] The asymmetric encryption algorithm requires two keys: a public key (publickey, abbreviated as public key) and a private key (privatekey, abbreviated as private key). The public key and the private key are a pair. If the data is encrypted with the public key, only the corresponding private key can be used to decrypt it. Because different keys are used for encryption and decryption, this algorithm is called an asymmetric encryption algorithm. The basic process of implementing confidential information exchange by the asymmetric encryption algorithm is as follows: Party A generates a pair of keys and makes the public key public. Other parties (Party B) who need to send information to Party A use this key (the public key of Party A) to encrypt the confidential information and then send it to Party A; Party A then decrypts the encrypted information with its own private key. When Party A wants to reply to Party B, it is just the opposite, using the public key of Party B to encrypt the data. Similarly, Party B uses its own private key to decrypt it.

[0005] However, currently in the backbone network of CERNET (China Education and Research Network), how to reduce data sensitivity and reduce privacy risks such as school addresses still needs further discussion. Summary of the Invention

[0006] In view of the above problems, the present invention provides an IPv6 network flow data desensitization method, device, electronic device and medium.

[0007] According to the first aspect of the present invention, an IPv6 network flow data desensitization method is provided, including:

[0008] Step S1, using a traffic collection tool to collect IPv6 data packets from mirrored traffic, generating IPv6 network flow data, and storing the IPv6 network flow data in a shared platform;

[0009] Step S2, when receiving a data access request initiated by a user terminal to the shared platform, the shared platform extracts specified fields from the IPv6 network flow data, and performs symmetric encryption on the specified fields to obtain ciphertext data;

[0010] Step S3, the shared platform obtains the public key included in the data access request, and performs asymmetric encryption on the key used in the symmetric encryption using the public key to obtain an encrypted key;

[0011] Step S4, sending the ciphertext data and the encrypted key to the shared platform at the same time, and the shared platform distributes them to the user terminal.

[0012] The second aspect of the present invention provides an IPv6 network flow data desensitization device, including:

[0013] A data capture module, configured to use a traffic collection tool to collect IPv6 data packets from mirrored traffic, generate IPv6 network flow data, and store the IPv6 network flow data in a shared platform;

[0014] A symmetric encryption module, configured to, when receiving a data access request initiated by a user terminal to the shared platform, the shared platform extracts specified fields from the IPv6 network flow data, and performs symmetric encryption on the specified fields to obtain ciphertext data;

[0015] An asymmetric encryption module, configured to the shared platform obtains the public key included in the data access request, and performs asymmetric encryption on the key used in the symmetric encryption using the public key to obtain an encrypted key;

[0016] A data distribution module, configured to send the ciphertext data and the encrypted key to the shared platform at the same time, and the shared platform distributes them to the user terminal.

[0017] The third aspect of the present invention provides an electronic device, including: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the above IPv6 network flow data desensitization method.

[0018] The fourth aspect of the present invention further provides a computer-readable storage medium, on which executable instructions are stored, and when the instructions are executed by a processor, the processor is caused to execute the above IPv6 network flow data desensitization method.

[0019] Compared with the prior art, the IPv6 network flow data desensitization method and device provided by the present invention have at least the following beneficial effects:

[0020] (1) The present invention completes the data communication transmission of multiple universities in the education network, uses a smaller key, provides higher security, and the ECC encryption algorithm has high security and fast processing speed;

[0021] (2) On the premise of not affecting the accuracy of data analysis results, the present invention processes sensitive fields in the original data, thereby reducing data sensitivity and reducing privacy risks such as school addresses. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Through the following description of the embodiments of the present invention with reference to the drawings, the above content and other objects, features and advantages of the present invention will become clearer. In the drawings:

[0023] Figure 1 Schematically shows an application scenario suitable for the IPv6 network flow data desensitization method and device according to an embodiment of the present invention;

[0024] Figure 2 Schematically shows a flowchart of the IPv6 network flow data desensitization method according to an embodiment of the present invention;

[0025] Figure 3 Schematically shows an operation flowchart of the IPv6 network flow data desensitization method according to an embodiment of the present invention;

[0026] Figure 4 Schematically shows a schematic diagram of the DPDK acquisition process according to an embodiment of the present invention;

[0027] Figure 5 Schematically shows a format diagram of the IPv6 network flow data according to an embodiment of the present invention;

[0028] Figure 6 Schematically shows a partial diagram of the disclosed preset list according to an embodiment of the present invention;

[0029] Figure 7Schematically shows the effect diagram of symmetrically encrypting randomly selected fields based on a field index table according to an embodiment of the present invention;

[0030] Figure 8 Schematically shows the block diagram of an IPv6 network flow data desensitization device according to an embodiment of the present invention;

[0031] Figure 9 Schematically shows the block diagram of an electronic device suitable for implementing the IPv6 network flow data desensitization method according to an embodiment of the present invention. Detailed implementation manners

[0032] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. In the following detailed description, for the sake of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present invention. However, obviously, one or more embodiments can also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present invention.

[0033] The terms used herein are only for describing specific embodiments and are not intended to limit the present invention. The terms "including", "comprising", etc. used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0034] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0035] In the case of using expressions such as "at least one of A, B, and C, etc.", generally, it should be interpreted according to the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include, but is not limited to, a system having only A, only B, only C, having A and B, having A and C, having B and C, and / or having A, B, and C, etc.).

[0036] Some block diagrams and / or flowcharts are shown in the accompanying drawings. It should be understood that some blocks in the block diagrams and / or flowcharts, or combinations thereof, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when executed by the processor, these instructions can create a device for implementing the functions / operations illustrated in these block diagrams and / or flowcharts. The technology of the present invention can be implemented in the form of hardware and / or software (including firmware, microcode, etc.). Additionally, the technology of the present invention can take the form of a computer program product on a computer-readable storage medium storing instructions, which can be used by or in conjunction with an instruction execution system.

[0037] In the technical solution of the present invention, the processing of the collection, storage, use, processing, transmission, provision, disclosure, and application of the user's personal information involved all comply with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and it does not violate public order and good customs.

[0038] In the technical solution of the present invention, before obtaining or collecting the user's personal information, the authorization or consent of the user is obtained.

[0039] Figure 1 The application scenario of the IPv6 network flow data desensitization method and device according to an embodiment of the present invention is schematically shown. Figure 2 The flowchart of the IPv6 network flow data desensitization method according to an embodiment of the present invention is schematically shown. Figure 3 The operation flowchart of the IPv6 network flow data desensitization method according to an embodiment of the present invention is schematically shown.

[0040] The following will be based on Figure 1 the described application scenario, and through Figures 2 to 3 describe in detail the IPv6 network flow data desensitization method of the embodiments of the present invention. The IPv6 network flow data desensitization method provided by the embodiments of the present invention may include steps S1 to S4.

[0041] Step S1, use a traffic collection tool to collect IPv6 data packets from the mirrored traffic, generate IPv6 network flow data, and store the IPv6 network flow data in a shared platform.

[0042] In the embodiments of the present invention, the traffic collection tool includes a DPDK high-performance traffic collection tool, and the collection scenario can be, for example, the CERNET education network backbone network. Thus, based on the mirrored traffic data of the CERNET education network backbone network, the IPv6 network flow data is generated, and the IPv6 network flow data is a PCAP data packet file.

[0043] Step S2, when the sharing platform receives a data access request initiated by a user terminal, the sharing platform extracts specified fields from the IPv6 network flow data, and performs symmetric encryption on the specified fields to obtain ciphertext data.

[0044] In the CERNET education network backbone, the user terminal can be, for example, each school. When a certain school initiates a data access request to the sharing platform, the data access request indicates the need to obtain information on the IPv6 data of this school.

[0045] When the sharing platform obtains that a certain school needs to obtain its own data, it first performs symmetric encryption on the specified fields in the IPv6 network flow data. This symmetric encryption can, for example, use the AES encryption algorithm. The specified fields include the source IP address, destination IP address, and randomly selected field. Thus, the extracted source IP address, destination IP address, and randomly selected field are encrypted using the AES encryption algorithm, so that when a university obtains the ciphertext data later, it can decrypt the data according to this encryption algorithm.

[0046] The symmetric encryption process replaces the specified fields in the IPv6 network flow data with the encrypted fields to form ciphertext data. Since symmetric encryption does not change the data size, the original IPv6 network flow data remains unchanged.

[0047] When performing symmetric encryption on the specified fields in the IPv6 network flow data, the header of the IPv6 network flow data generally contains 8 fields. In addition to the source IP address and destination IP address, the randomly selected field can be subjected to AES symmetric encryption.

[0048] In the embodiment of the present invention, the method for selecting the randomly selected field includes: establishing a field index table according to a publicly available preset list; determining the randomly selected field based on the field index table. The publicly available preset list can be, for example, the list of numbers corresponding to 3013 universities issued by the Ministry of Education. A field index table is established according to this list of numbers for selecting the required fields.

[0049] Step S3, the sharing platform obtains the public key included in the data access request, and uses the public key to perform asymmetric encryption on the key used in the symmetric encryption to obtain the encrypted key.

[0050] When a certain school initiates a data access request to the sharing platform, the data access request carries a public key. Thus, the public key is used to perform asymmetric encryption on the key used in the symmetric encryption process in step S2 above. This asymmetric encryption can, for example, use the ECC encryption algorithm.

[0051] According to the sharing platform and the application scenario, the asymmetric encryption algorithm ECC is used to encrypt the key used in the AES encryption algorithm in the foregoing step S2.

[0052] It should be noted that before sending the ciphertext data and the encrypted key to the sharing platform simultaneously, it further includes: performing de-identification processing on the encrypted key.

[0053] Step S4: Send the ciphertext data and the encrypted key to the sharing platform simultaneously, and the sharing platform distributes them to the user terminals.

[0054] In the embodiment of the present invention, based on the field index table established in the above step S2, the sharing platform distributes the ciphertext data, the encrypted key, and the field index table to the user terminals simultaneously.

[0055] In the IPv6 network flow data desensitization method provided by the embodiment of the present invention, the desensitization is actually performed on the ciphertext data in the above step S2, that is, finally, the ciphertext data, the encrypted key, and the field index table are sent to the school simultaneously.

[0056] Through the above embodiments, for the present invention to realize the access of the user terminal to the software R & D environment, first, use the DPDK high-performance traffic collection tool to collect IPv6 data packets. Secondly, for the PCAP data packet file, the AES symmetric encryption is performed from three fields, including the source IP address, the destination IP address, and a randomly selected field. Finally, use the ECC encryption algorithm to encrypt the key of the AES symmetric encryption.

[0057] It can be seen that the present invention completes the data communication transmission between the education network and multiple universities, uses a smaller key, provides higher security, and the ECC encryption algorithm has high security and fast processing speed.

[0058] Figure 4 Schematically shows the schematic diagram of the DPDK collection process according to the embodiment of the present invention.

[0059] As Figure 4 shown, in the embodiment of the present invention, the DPDK high-performance traffic collection tool can use multiple receive queues, RSS combined with Flow Director flow classification to collect IPv6 data packets, thereby increasing the efficiency of collection.

[0060] Furthermore, in the above step S1, the IPv6 data packet collection further includes: at the data packet acquisition layer, acquiring IPv6 network data packets; at the data packet processing layer, processing the IPv6 network data packets to generate IPv6 network flow data. That is, when using the DPDK high-performance traffic collection tool to collect IPv6 data packets, it is mainly designed from the data packet acquisition layer and the data packet processing layer.

[0061] Specifically, at the data packet acquisition layer, the acquisition of IPv6 network data packets can be achieved by successively obtaining network device information, initializing the port, and binding the receiving thread. Among them, when initializing the port, the receiving queue and the RSS algorithm can be configured. At the data packet processing layer, the generation of IPv6 network flow data can be achieved by successively managing the task queue, implementing the data analysis logic, and transplanting the original data packet analysis program.

[0062] During the data desensitization process, RFC2460 defines the IPv6 datagram format. In terms of the overall structure, the IPv6 datagram format is the same as the IPv4 datagram format, and it is also composed of two parts: the IP header and the data (referred to as the payload in IPv6). However, the data part of the IPv6 datagram can also include zero or more IPv6 extension headers.

[0063] Figure 5 Schematically shows the format diagram of the IPv6 network flow data according to an embodiment of the present invention.

[0064] As Figure 5 shown, the length of the IPv6 header is fixed at 40 bytes, removing all optional fields in IPv4 and only including 8 necessary fields. Therefore, although the IPv6 address length is four times that of IPv4, the IPv6 header length is only twice that of the IPv4 header length.

[0065] Use the AES symmetric encryption algorithm to encrypt the source IP address, destination IP address, and a randomly selected field among them to achieve the desensitization effect. The encryption method can be: using the national college list issued by the Ministry of Education to obtain the serial number, and using the remainder of dividing the serial number by 6, that is, modulo division.

[0066] Figure 6 Schematically shows a partial diagram of the preset list disclosed according to an embodiment of the present invention. Figure 7 Schematically shows the effect diagram of symmetric encryption of the randomly selected field based on the field index table according to an embodiment of the present invention.

[0067] As Figure 6 shown, for example, Tsinghua University ranks 3 in the list, so the encrypted field of Tsinghua University can be set to 3 % 6 = 3, that is, the flow label field in the figure. Other schools can also refer to similar operations. As Figure 7 shown, it shows the effect of symmetric encryption of the randomly selected field based on the field index table.

[0068] It should also be noted that in the asymmetric encryption process of step S3 above, the ECC encryption algorithm is used to encrypt the key used in the AES encryption algorithm in step S2. The public key used is the public key sent by each school to the sharing platform. The usage process of the user of this school is as follows:

[0069] 1. When using the ECC asymmetric encryption algorithm, the university selects the elliptic curve Ep(a, b) in the ECC algorithm and takes a point on the elliptic curve as the base point G.

[0070] 2. Select a private key k and generate the public key K = kG.

[0071] 3. Transmit Ep(a, b) and points K, G to the sharing platform.

[0072] 4. After the sharing platform obtains the public key information (including information such as the elliptic curve Ep(a, b), the base point G, and the public key K) sent by the user of this school, it encodes the plaintext to be transmitted (the key of the AES encryption algorithm) onto a point M on Ep(a, b) (there are many encoding methods here, which will not be elaborated specifically), and generates a random integer r.

[0073] 5. After the sharing platform calculates the points C1 = M + rK; C2 = rG, it transmits C1 and C2 to the university.

[0074] 6. The university calculates C1 - kC2 according to its own private key k, and the result is the point M. Because C1 - kC2 = M + rK - k(rG) = M + rK - r(kG) = M.

[0075] 7. Then, by decoding the point M, the key of the symmetric encryption algorithm can be obtained.

[0076] Through the above embodiments, the present invention completes the data communication transmission between the education network and multiple universities, uses a smaller key, provides higher security, the ECC encryption algorithm has high security and fast processing speed. Moreover, the present invention processes the sensitive fields in the original data without affecting the accuracy of the data analysis results, thereby reducing the data sensitivity and reducing privacy risks such as school addresses.

[0077] Based on the above disclosed method, the present invention also provides an IPv6 network flow data desensitization device, which will be described in detail below in combination with Figure 8 This device will be described in detail.

[0078] Figure 8 The block diagram of the IPv6 network flow data desensitization device according to an embodiment of the present invention is schematically shown.

[0079] As Figure 8As shown in the figure, the IPv6 network flow data desensitization device 800 of this embodiment includes a data capture module 810, a symmetric encryption module 820, an asymmetric encryption module 830, and a data distribution module 840.

[0080] The data capture module 810 is used to collect IPv6 data packets from the mirrored traffic using a traffic capture tool, generate IPv6 network flow data, and store the IPv6 network flow data in the shared platform.

[0081] The symmetric encryption module 820 is used to, when receiving a data access request initiated by a user terminal to the shared platform, extract specified fields from the IPv6 network flow data by the shared platform, and perform symmetric encryption on the specified fields to obtain ciphertext data.

[0082] The asymmetric encryption module 830 is used to obtain the public key included in the data access request by the shared platform, and perform asymmetric encryption on the key used in the symmetric encryption using the public key to obtain the encrypted key.

[0083] The data distribution module 840 is used to send the ciphertext data and the encrypted key to the shared platform at the same time, and the shared platform distributes them to the user terminal.

[0084] It should be noted that the implementation manners of the device part are similar to those of the method part, and the achieved technical effects are also similar. For specific details, please refer to the method embodiment part above, and will not be elaborated here.

[0085] According to the embodiments of the present invention, any multiple of the data capture module 810, the symmetric encryption module 820, the asymmetric encryption module 830, and the data distribution module 840 can be combined and implemented in one module, or any one of them can be split into multiple modules. Or, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to the embodiments of the present invention, at least one of the data capture module 810, the symmetric encryption module 820, the asymmetric encryption module 830, and the data distribution module 840 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or can be implemented by any other reasonable means such as hardware or firmware by integrating or packaging circuits, or can be implemented in any one of the three implementation manners of software, hardware, and firmware, or in any appropriate combination of several of them. Or, at least one of the data capture module 810, the symmetric encryption module 820, the asymmetric encryption module 830, and the data distribution module 840 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding functions can be executed.

[0086] Figure 9 A block diagram of an electronic device suitable for implementing the IPv6 network flow data desensitization method according to an embodiment of the present invention is schematically shown.

[0087] As Figure 9 shown, the electronic device 900 according to an embodiment of the present invention includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage section 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general microprocessor (such as a CPU), an instruction set processor, and / or a related chipset, and / or a dedicated microprocessor (such as an application specific integrated circuit (ASIC)), etc. The processor 901 may also include on-board memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0088] In the RAM 903, various programs and data required for the operation of the electronic device 900 are stored. The processor 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. The processor 901 performs various operations of the method flow according to an embodiment of the present invention by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the program may also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 may also perform various operations of the method flow according to an embodiment of the present invention by executing the programs stored in the one or more memories.

[0089] According to an embodiment of the present invention, the electronic device 900 may further include an input / output (I / O) interface 905, and the input / output (I / O) interface 905 is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed so that a computer program read therefrom can be installed into the storage section 908 as needed.

[0090] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist alone without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the IPv6 network flow data desensitization method according to the embodiments of the present invention is implemented.

[0091] According to an embodiment of the present invention, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In the present invention, the computer-readable storage medium may be any tangible medium that contains or stores a program, and this program can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present invention, the computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than the ROM 902 and RAM 903.

[0092] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the above module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order from that marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, as well as the combination of blocks in the block diagram or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0093] Those skilled in the art can understand that the features recited in the various embodiments and / or claims of the present invention can be combined or combined in various ways, even if such combinations or combinations are not explicitly recited in the present invention. In particular, without departing from the spirit and teachings of the present invention, the features recited in the various embodiments and / or claims of the present invention can be combined and combined in various ways. All such combinations and / or combinations fall within the scope of the present invention.

[0094] The embodiments of the present invention have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present invention. Although the embodiments have been described separately above, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present invention is defined by the appended claims and their equivalents. Without departing from the scope of the present invention, those skilled in the art can make various substitutions and modifications, and these substitutions and modifications should all fall within the scope of the present invention.

Claims

1. An IPv6 network flow data desensitization method, comprising: Step S1, using a traffic collection tool to collect IPv6 data packets from mirrored traffic, generating IPv6 network flow data, and storing the IPv6 network flow data in a shared platform; Step S2, when receiving a data access request initiated by a user terminal to the shared platform, the shared platform extracts specified fields from the IPv6 network flow data, symmetrically encrypts the specified fields to obtain ciphertext data, the specified fields including a source IP address, a destination IP address, and a randomly selected field. Among them, according to a publicly available preset list, a field index table is established, and the serial number corresponding to the user terminal in the preset list is determined; based on the serial number and the field index table, the randomly selected field is determined; Step S3, the shared platform obtains the public key included in the data access request, and uses the public key to asymmetrically encrypt the key used in the symmetric encryption to obtain an encrypted key; Step S4, sending the ciphertext data and the encrypted key to the shared platform at the same time, and the shared platform simultaneously distributes the ciphertext data, the encrypted key, and the field index table to the user terminal.

2. The method according to claim 1, wherein, In Step S2, the symmetric encryption uses the AES encryption algorithm; in Step S3, the asymmetric encryption uses the ECC encryption algorithm.

3. The method according to claim 1, wherein In Step S4, before sending the ciphertext data and the encrypted key to the shared platform at the same time, it further includes: Performing de-identification processing on the encrypted key.

4. The method according to claim 1, wherein In Step S1, the traffic collection tool includes a DPDK high-performance traffic collection tool, and uses multiple receive queues, RSS combined with Flow Director flow classification to collect IPv6 data packets.

5. The method according to claim 4, wherein, In Step S1, the IPv6 data packet collection further includes: At the data packet acquisition layer, acquiring IPv6 network data packets; At the data packet processing layer, processing the IPv6 network data packets to generate IPv6 network flow data.

6. An IPv6 network flow data desensitization device, comprising: A data capture module, configured to use a traffic collection tool to collect IPv6 data packets from mirrored traffic, generate IPv6 network flow data, and store the IPv6 network flow data in a shared platform; A symmetric encryption module, configured to, when receiving a data access request initiated by a user terminal to the shared platform, the shared platform extracts specified fields from the IPv6 network flow data, symmetrically encrypts the specified fields to obtain ciphertext data, the specified fields including a source IP address, a destination IP address, and a randomly selected field. Among them, according to a publicly available preset list, a field index table is established, and the serial number corresponding to the user terminal in the preset list is determined; based on the serial number and the field index table, the randomly selected field is determined; An asymmetric encryption module, configured to the shared platform obtains the public key included in the data access request, and uses the public key to asymmetrically encrypt the key used in the symmetric encryption to obtain an encrypted key; A data distribution module, configured to simultaneously send the ciphertext data and the encrypted key to the sharing platform, and the sharing platform simultaneously distributes the ciphertext data, the encrypted key, and the field index table to the user terminal.

7. An electronic device, comprising: One or more processors; A storage device for storing one or more programs, wherein, when the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, having stored thereon executable instructions that, when executed by a processor, cause the processor to execute the method according to any one of claims 1 to 5.

Images