Ip address interception method and apparatus, electronic device, and readable medium

Abstract

The present disclosure provides an IP address interception method, device, electronic equipment and readable medium, wherein the IP address interception method comprises: determining a value range of a preloaded classless inter-domain routing hash, the value range of the classless inter-domain routing hash being configured to be determined according to a blacklisted IP set of a classless inter-domain routing network segment; and intercepting an IP address based on the value range of the classless inter-domain routing hash. Through the present disclosure, the efficiency and reliability of intercepting IP addresses are improved, and the applicable scenarios and compatibility of IP address interception are also improved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of communication, and in particular, to an IP address interception method and device, an electronic device and a readable medium. BACKGROUND

[0002] Currently, IP address interception is a kind of communication security, which compares the real IP address of the user request with the IP set to be intercepted, and intercepts outside the server if the comparison is successful.

[0003] In the related art, only complete IP addresses according to IPv4 and IPv6 are supported for interception.

[0004] However, the existing IP interception scheme not only leads to low interception efficiency, but also has poor compatibility.

[0005] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0006] The purpose of the present disclosure is to provide an IP address interception method, device, electronic device and readable medium, which at least partially overcomes the problem of low IP interception efficiency caused by the limitations and defects of the related art.

[0007] According to a first aspect of an embodiment of the present disclosure, an IP address interception method is provided, comprising:

[0008] determining the value range of the preloaded classless inter-domain routing hash, wherein the value range of the classless inter-domain routing hash is configured to be determined according to the blacklist IP set of the classless inter-domain routing network segment;

[0009] intercepting IP addresses based on the value range of the classless inter-domain routing hash.

[0010] In an exemplary embodiment of the present disclosure, before determining the value range of the preloaded classless inter-domain routing hash, the method further comprises:

[0011] uploading a blacklist IP set containing a classless inter-domain routing network segment;

[0012] parsing the blacklist IP set and converting the parsing result into a value range of the classless inter-domain routing hash in json format;

[0013] loading the value range of the classless inter-domain routing hash.

[0014] In an example embodiment of the present disclosure, before determining the value range of the preloaded inter-domain routing without class hash, further comprising:

[0015] Divide any IP address of the blacklisted IP set of the IPv4 network segment into four segments, each segment including 8 bits;

[0016] Determine the key of the hash table according to the subnet mask of the IP address;

[0017] Determine the value range according to the third segment of the IP address, the first 2 bits of the third segment being a mask and the last 6 bits of the third segment being an IP range;

[0018] Determine the blacklisted IP set containing the inter-domain routing without class network segment according to the key and the value range.

[0019] In an example embodiment of the present disclosure, before determining the value range of the preloaded inter-domain routing without class hash, further comprising:

[0020] Divide any IP address of the blacklisted IP set of the IPv6 network segment into eight segments, each segment including 16 bits;

[0021] Determine the key of the hash table according to the subnet mask of the IP address;

[0022] Determine the value range according to the third segment of the IP address, the first 8 bits of the third segment being a mask and the last 8 bits of the third segment being an IP range;

[0023] Determine the blacklisted IP set containing the inter-domain routing without class network segment according to the key and the value range.

[0024] In an example embodiment of the present disclosure, further comprising:

[0025] If the keys of the inter-domain routing without class network segments are the same, arrange the value ranges in a specified order;

[0026] Combine the arranged value ranges into a value range array.

[0027] In an example embodiment of the present disclosure, parsing the blacklisted IP set and converting the parsing result into the value range of the inter-domain routing without class hash in json format comprises:

[0028] Parse the blacklisted IP set to determine the prefix segment and the value range of the IPv4 network segment or the IPv6 network segment;

[0029] Convert the prefix segment and the value range into the value range of the inter-domain routing without class hash in json format.

[0030] In an example embodiment of the present disclosure, further comprising:

[0031] In response to the IP address request, resolving the IP address request to determine a prefix segment in the IP address request, and determining the prefix segment as a key;

[0032] Looking up a value range of the Classless Inter-Domain Routing Hash according to the key;

[0033] Determining whether to intercept the IP address request according to the value range of the Classless Inter-Domain Routing Hash.

[0034] According to a second aspect of the embodiments of the present disclosure, an IP address interception apparatus is provided, comprising:

[0035] A determining module configured to determine a value range of a preloaded Classless Inter-Domain Routing Hash, the value range of the Classless Inter-Domain Routing Hash being configured to be determined according to a blacklist IP set of the Classless Inter-Domain Routing segment;

[0036] An intercepting module configured to intercept an IP address based on the value range of the Classless Inter-Domain Routing Hash.

[0037] According to a third aspect of the present disclosure, an electronic device is provided, comprising a memory and a processor coupled to the memory, the processor being configured to execute a method as described in any of the above aspects based on instructions stored in the memory.

[0038] According to a fourth aspect of the present disclosure, a computer readable storage medium is provided, having a program stored thereon, the program being executed by a processor to implement an IP address interception method as described in any of the above aspects.

[0039] The embodiments of the present disclosure improve the reliability and efficiency of IP address interception by intercepting an IP address according to a value range of a preloaded Classless Inter-Domain Routing Hash.

[0040] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present disclosure and serve to explain the principles of the present disclosure. It is apparent that the accompanying drawings described below are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor based on these drawings.

[0042] Figure 1FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied;

[0043] Figure 2 FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied;

[0044] Figure 3 FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied;

[0045] Figure 4 FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied;

[0046] Figure 5 FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied;

[0047] Figure 6 FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied;

[0048] Figure 7 FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied;

[0049] Figure 8 FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied;

[0050] Figure 9 FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied;

[0051] Figure 10 FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied;

[0052] Figure 11 FIG. 1 shows a schematic diagram of an exemplary system architecture to which an IP address interception scheme according to embodiments of the present application can be applied; DETAILED DESCRIPTION

[0053] Example implementations are now described with reference to the drawings. Example implementations can, however, be implemented in many different forms and should not be construed as limited to the examples set forth herein; rather, these implementations are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the example implementations to those skilled in the art. The described features, structures, or characteristics can be combined in one or more implementations. In the following description, numerous specific details are provided, such as examples of programming, software modules, user selections, network transactions, database queries, database structures, hardware modules, hardware- specific details and

[0054] In addition, the accompanying drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification. The drawings illustrate examples of the present disclosure and, as such, a change in the size or proportion of some of the elements in the drawings can be exaggerated to clearly show the nature and principles of the present disclosure. In the drawings:

[0055] Figure 1 A schematic diagram of an exemplary system architecture is shown, to which an IP address interception scheme according to embodiments of the present disclosure can be applied.

[0056] As Figure 1 shown, the system architecture 100 can include one or more of terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 serves as a medium to provide communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0057] It should be appreciated that the number of terminal devices, networks, and servers in Figure 1 the system architecture 100 is merely illustrative. Any number of terminal devices, networks, and servers can be present, as needed for implementation. For example, the server 105 can be a server cluster composed of multiple servers, etc.

[0058] A user can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc. The terminal devices 101, 102, 103 can be various electronic devices with display screens, including but not limited to smart phones, tablet computers, portable computers, and desktop computers, etc.

[0059] In some embodiments, the IP address interception method provided by the embodiments of the present disclosure is generally executed by the server 105, and accordingly, the IP address interception apparatus is generally arranged in the terminal device 103 (may also be the terminal device 101 or 102). In some other embodiments, some terminals can have similar functions as the server device to execute the present method.

[0060] The example embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0061] Figure 2 is a flowchart of the IP address interception method in the example embodiments of the present disclosure.

[0062] Reference Figure 2 The IP address interception method can include:

[0063] In step S202, the value range of the preloaded Classless Inter-Domain Routing Hash is determined, and the value range of the Classless Inter-Domain Routing Hash is configured to be determined according to the blacklist IP set of the Classless Inter-Domain Routing network segment.

[0064] The IP address is intercepted based on the value range of the Classless Inter-Domain Routing Hash.

[0065] In the embodiments of the present disclosure, the IP address is intercepted according to the value range of the preloaded Classless Inter-Domain Routing Hash, thereby improving the reliability and efficiency of IP address interception.

[0066] In the above embodiments, the value range of the Classless Inter-Domain Routing Hash can be denoted as CIDRHashRange. CIDR (Classless Inter-Domain Routing) is a method for creating additional addresses on the Internet, which are provided to service providers (ISPs) and then distributed to customers by ISPs. CIDR concentrates routes so that one IP address represents several thousand IP addresses of the main backbone provider service, thereby reducing the burden of Internet routers. CIDR replaces the original address structure restriction on the address network part with a 13-27 bit long prefix (the network part of the 3-class address is limited to 8 bits, 16 bits and 24 bits, respectively). In the address block that can be distributed by the administrator, the number of hosts ranges from 32 to 500,000, thereby better meeting the special needs of institutions for addresses.

[0067] In the CIDR address, a standard 32-bit IP address and information about the number of network prefix bits are included. Taking the CIDR address 222.80.18.18 / 25 as an example, “ / 25” indicates that the first 25 bits in the front address represent the network part, and the remaining bits represent the host part.

[0068] In addition, the CIDR is based on "supernetting", which is a derivative of "subnetting" and can be regarded as the reverse process of subnetting. In subnetting, bits from the host part of an address are borrowed and merged into the network part. In supernetting, however, some bits from the network part are merged into the host part. This classless supernetting technology reduces the number of routing table entries in the routing domain of the Internet by merging a group of smaller classless networks into a larger single routing table entry.

[0069] Next, each step of the IP address interception method will be described in detail.

[0070] Step S302, as shown in Figure 3 Before determining the value range of the preloaded classless inter-domain routing hash, the following steps are further included in an exemplary embodiment of the present disclosure:

[0071] Step S304, uploading a blacklist IP set containing a classless inter-domain routing network segment.

[0072] In the above embodiment, the console uploads the IPv4 (Internet Protocol Version 4) network segment and the IPv6 (Internet Protocol Version 6) network segment containing the blacklist IP set of the CIDR network segment. For example: 192.168.160.0 / 18, 192.168.240.0 / 19, 2001:db8:a0b:: / 40, etc., but not limited thereto.

[0073] Step S306, parsing the blacklist IP set and converting the parsing result into a value range of the classless inter-domain routing hash in json format.

[0074] In the above embodiment, the uploaded blacklist IP set is parsed to generate a json format compatible with the existing configuration. For example: {"192.168": [128,191,224,255],"2001:db8": [2560,2815]}. The same prefix can be appended to the array, and each 2 elements in the array form a group, representing an IP range (range). The entire configuration is HashRange (hash value range), "192.168" and "2001:db8" are keys, [128,191,224,255] and [2560,2815] are corresponding values, the value format is range, and each 2 elements form a range, 128~191, 224~255, and 2560~2815 are three value ranges.

[0075] Step S308, loading the value range of the Classless Inter-Domain Routing Hash.

[0076] In the above embodiment, by loading the value range of the Classless Inter-Domain Routing Hash into the memory, and determining whether to intercept the IP address based on the value range of the Classless Inter-Domain Routing Hash, not only the efficiency of IP address interception is improved, but also the compatibility of the IP address interception of the embodiment of the present disclosure is improved.

[0077] In an exemplary embodiment of the present disclosure, as shown in Figure 4 Before determining the value range of the preloaded Classless Inter-Domain Routing Hash, the method further includes:

[0078] Step S402, dividing any IP address of the blacklisted IP set of the IPv4 network segment into four segments, each segment including 8 bits.

[0079] Step S404, determining the key of the Hash table according to the subnet mask of the IP address.

[0080] Step S406, determining the value range according to the third segment of the IP address, the first 2 bits of the third segment being the mask, and the last 6 bits of the third segment being the IP range.

[0081] Step S408, determining the blacklisted IP set containing the Classless Inter-Domain Routing network segment according to the key and the value range.

[0082] In the above embodiment, the IPv4 network segment includes 32 bits, which is divided into four segments by the separator “.”, each segment being 8 bits, and the range of each segment being 0-255. According to the subnet mask MASK / 8 of the configured blacklisted IP network segment, the Hash table key is obtained by rounding down, for example, the above-mentioned IPv4 network segment 192.168.160.0 / 18, MASK / 8 rounding down is int(18 / 8)=2, then the first two segments “192.168” in the four segments are the Hash table key, and MASK / 8 rounding up is math.ceil(18 / 2)=3, then the third segment is the range, the first 2 bits (18%8=2) in the 8 bits of the third segment are the mask, and the last 6 bits are the IP range. The binary of 160 is 10100000, so the range is 10000000-10111111, that is, 128-191. Therefore, the above-mentioned network segment 192.168.160.0 / 18 is converted into HashRange structure, which is “192.168”:[128,191].

[0083] Further, if multiple CIDR network segments have the same prefix, the corresponding range only needs to be added to the array, and each two elements form a group, and the start value is sorted from small to large to speed up the retrieval.

[0084] In an example embodiment of the present disclosure, as shown in Figure 5 Before determining the value range of the preloaded classless inter-domain routing hash, the method further includes:

[0085] In step S502, any IP address of the blacklisted IP set of the IPv6 network segment is divided into eight segments, each segment including 16 bits.

[0086] In step S504, the key of the hash table is determined according to the subnet mask of the IP address.

[0087] In step S506, the value range is determined according to the third segment of the IP address, the first 8 bits of the third segment being the mask, and the last 8 bits of the third segment being the IP range.

[0088] In step S508, the blacklisted IP set containing the classless inter-domain routing network segment is determined according to the key and the value range.

[0089] In the above embodiment, the IPv6 network segment is 128 bits, divided into eight segments by the separator “:”, each segment being 16 bits, and the range of each segment being 0-65535. Similar to the IPv4 network segment described above, the key of the hash table is obtained by rounding down the configured subnet mask MASK / 16 of the blacklisted IP network segment, for example, the IPv6 network segment 2001:db8:a0b:: / 40, int(40 / 16)=2, then the first two segments “2001:db8” in the eight segments are the key of the hash table, and math.ceil(40 / 16)=3, then the third segment is the range, the first 8 bits (40%16=8) in the 16 bits of the third segment are the mask, and the last 8 bits are the IP range, so the range is 0x0a00-0x0aff, that is, 2560-2815. Therefore, the IPv6 network segment 2001:db8:a0b:: / 40 is converted into the HashRange structure as “db8:a0b”:[2560,2815].

[0090] Further, if multiple CIDR network segments have the same prefix, the corresponding range only needs to be added to the array, and each two elements form a group, and the start value is sorted from small to large to speed up the retrieval.

[0091] In an example embodiment of the present disclosure, as shown in Figure 6 The IP address interception method further includes:

[0092] Step S602, if the keys of the classless inter-domain routing network segments are the same, arrange the value ranges in a specified order.

[0093] Step S604, combine the arranged value ranges into a value range array.

[0094] In an exemplary embodiment of the present disclosure, as shown in Figure 7 resolving the blacklist IP set and converting the resolution result into a value range of the classless inter-domain routing hash in json format includes:

[0095] Step S702, resolve the blacklist IP set to determine the prefix segment and the value range of the IPv4 network segment or the IPv6 network segment.

[0096] Step S704, convert the prefix segment and the value range into a value range of the classless inter-domain routing hash in json format.

[0097] In the above embodiment, by resolving the blacklist IP set to determine the prefix segment and the value range of the IPv4 network segment or the IPv6 network segment, and converting the prefix segment and the value range into a value range of the classless inter-domain routing hash in json format, the compatibility and efficiency of IP retrieval are further improved.

[0098] In an exemplary embodiment of the present disclosure, as shown in Figure 8 intercepting the IP address based on the value range of the classless inter-domain routing hash includes:

[0099] Step S802, in response to an IP address request, resolving the IP address request to determine the prefix segment in the IP address request, and determining the prefix segment as a key.

[0100] Step S804, searching the value range of the classless inter-domain routing hash according to the key.

[0101] Step S806, determining whether to intercept the IP address request according to the value range of the classless inter-domain routing hash.

[0102] In the above embodiment, the IP address request of the IPv4 network segment is taken as an example for description, when the IP address request of the IPv4 network segment is received, the IP address of the IPv4 network segment is parsed, the IPv4Prefix array is traversed, the first two segments are taken as a prefix, the third segment is converted into an integer to compare whether it is in the corresponding range, in order to accelerate the search rate, the range is sorted according to the starting value, and the binary search can be used instead of the search. For example, the request IP is 192.168.176.1, the first two segments "192.168" are taken as a key to find the range [128, 191, 224, 255] in the CIDRHashRange, each two elements are a group, and the starting element (the starting element of the range is 128, 224) is found by the binary search of the element 128 less than or equal to the value of the third segment of the IP converted into an integer (176). 176 is between 128 and 191, and belongs to the network segment, so the IP address is intercepted.

[0103] As shown in Figure 9 , the IP address interception scheme of the embodiment of the disclosure includes the following core steps:

[0104] Step 902, uploading a blacklist IP set, the client uploads the blacklist IP set containing the CIDR network segment of IPv4 and IPv6 through the console, for example: 192.168.160.0 / 18, 192.168.240.0 / 19, 2001: db8: a0b: / 40.

[0105] Step S904, preprocessing to generate a json configuration, the preprocessing program parses the uploaded IP set to generate a json format compatible with the existing configuration. For example: {"192.168": [128, 191, 224, 255], "2001:db8": [2560, 2815]}. The same prefix can be appended to the array, and each two elements in the array are a group, indicating an IP interval (range), and the entire configuration is a HashRange.

[0106] Step S906, online engine matching and interception, the online engine parses the CIDRHashRange structure in the json and loads it into the memory, and according to the request IP, the matching is searched and matched and intercepted or released. For example, 192.168.176.1 will hit the 192.168.160.0 / 18 network segment and be intercepted, and 192.0.0.1 and 192.168.208.1 do not hit the blacklist and are released.

[0107] Corresponding to the above method embodiment, the disclosure also provides an IP address interception device, which can be used to execute the above method embodiment.

[0108] Figure 10is a block diagram of an IP address interception device in an example embodiment of the present disclosure.

[0109] Referring to Figure 10 , the IP address interception device 1000 can include:

[0110] a determination module 1002 configured to determine a value range of a preloaded Classless Inter-Domain Routing hash, the value range of the Classless Inter-Domain Routing hash being configured to be determined according to a blacklist IP set of the Classless Inter-Domain Routing network segment;

[0111] an interception module 1004 configured to intercept an IP address based on the value range of the Classless Inter-Domain Routing hash.

[0112] In an example embodiment of the present disclosure, the IP address interception device 1000 is further configured to:

[0113] upload a blacklist IP set containing a Classless Inter-Domain Routing network segment;

[0114] parse the blacklist IP set and convert the parsing result into a value range of a Classless Inter-Domain Routing hash in json format;

[0115] load the value range of the Classless Inter-Domain Routing hash.

[0116] In an example embodiment of the present disclosure, the IP address interception device 1000 is further configured to:

[0117] divide any IP address of a blacklist IP set of an IPv4 network segment into four segments, each segment including 8 bits;

[0118] determine a key of a hash table according to a subnet mask of the IP address;

[0119] determine the value range according to a third segment of the IP address, the first 2 bits of the third segment being a mask and the last 6 bits of the third segment being an IP range;

[0120] determine a blacklist IP set containing the Classless Inter-Domain Routing network segment according to the key and the value range.

[0121] In an example embodiment of the present disclosure, the IP address interception device 1000 is further configured to:

[0122] divide any IP address of a blacklist IP set of an IPv6 network segment into eight segments, each segment including 16 bits;

[0123] determine a key of a hash table according to a subnet mask of the IP address;

[0124] determining the value range according to the third segment of the IP address, the first 8 bits of the third segment being a mask, and the last 8 bits of the third segment being an IP range;

[0125] determining a blacklist IP set containing the Classless Inter-Domain Routing network segment according to the key and the value range.

[0126] In an exemplary embodiment of the present disclosure, the IP address interception device 1000 is further configured to:

[0127] if the keys of the Classless Inter-Domain Routing network segments are the same, arranging the value ranges in a specified order;

[0128] merging the arranged value ranges into a value range array.

[0129] In an exemplary embodiment of the present disclosure, the IP address interception device 1000 is further configured to:

[0130] parsing the blacklist IP set to determine a prefix segment and a value range of an IPv4 network segment or an IPv6 network segment;

[0131] converting the prefix segment and the value range into a value range of a Classless Inter-Domain Routing hash in json format.

[0132] In an exemplary embodiment of the present disclosure, the interception module 1004 is further configured to:

[0133] in response to an IP address request, parsing the IP address request to determine a prefix segment in the IP address request, and determining the prefix segment as a key;

[0134] looking up a value range of the Classless Inter-Domain Routing hash according to the key;

[0135] determining whether to intercept the IP address request according to the value range of the Classless Inter-Domain Routing hash.

[0136] Since the functions of the device 1000 have been described in detail in the corresponding method embodiments, the present disclosure will not be repeated here.

[0137] It should be noted that, although several modules or units of the device for action execution are mentioned in the foregoing detailed description, such a division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units for embodiment.

[0138] In the exemplary embodiments of the present disclosure, an electronic device capable of implementing the above-described method is also provided.

[0139] Those skilled in the art can understand that various aspects of the present application can be implemented as a system, a method or a program product. Therefore, various aspects of the present application can be embodied in the form of entirely hardware embodiments, entirely software embodiments (including firmware, microcode, etc.), or embodiments combining software and hardware aspects, which can be generally referred to as "circuitry", "module" or "system".

[0140] The electronic device 1100 according to this embodiment of the present application will be described below with reference to Figure 11 Figure 11 The electronic device 1100 shown is merely an example and should not limit the function and scope of use of the embodiments of the present application in any way.

[0141] As Figure 11 shown, the electronic device 1100 is in the form of a general computing device. The components of the electronic device 1100 can include, but are not limited to, the at least one processing unit 1110 described above, the at least one storage unit 1120 described above, and a bus 1130 connecting different system components, including the storage unit 1120 and the processing unit 1110.

[0142] The storage unit stores program code that can be executed by the processing unit 1110, so that the processing unit 1110 performs the steps described in the "Exemplary Method" section of the present specification according to various exemplary embodiments of the present application. For example, the processing unit 1110 can perform the method as shown in the embodiments of the present disclosure.

[0143] The storage unit 1120 can include a readable medium in the form of a volatile storage unit, such as a random access memory (RAM) 11201 and / or a cache memory unit 11202, and can further include a read-only memory (ROM) 11203.

[0144] The storage unit 1120 can also include program / utilities 11204 having a set of (at least one) program modules 11205, such as an operating system, one or more application programs, other program modules, and program data, each of which or a combination of which can include the implementation of a network environment.

[0145] The bus 1130 can represent one or more of several types of bus structures, including a storage unit bus or storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures. ​

[0146] The electronic device 1100 can also communicate with one or more external devices 1140 such as a keyboard or pointing devices, a Bluetooth device, or a database, etc.; and can communicate with one or more devices that enable a user to interact with the electronic device 1100; and / or communicate with any devices (e.g., a router, a modem, a server, etc.) that enable the electronic device 1100 to communicate with one or more other computing devices. Such communication can occur via an input / output (I / O) interface 1150. Still yet, the electronic device 1100 can communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or the Internet, through a network adapter 1160. As depicted, the network adapter 1160 communicates with the other components of the electronic device 1100 via the bus 1130. It should be appreciated that the electronic device 1100 can be a part of a larger system, and that communication can occur via the network adapter 1160 in such a larger system. It should also be appreciated that the electronic device 1100 can be connected to one or more devices that enable it to function as described herein.

[0147] From the above description of the embodiments, those skilled in the art will readily appreciate that the example embodiments described herein can be implemented by software and / or by hardware. Embodiments according to the present disclosure can therefore be realized in a software selective form, which can be stored in a non-volatile storage medium, such as a CD-ROM, a USB flash drive, a mobile hard disk, or a floppy disk, or can be stored on a network, and can include a plurality of instructions for causing a computing device (which can be a personal computer, a server, a terminal device, or a network device) to execute the methods according to the embodiments of the present disclosure.

[0148] In the example embodiments of the present disclosure, a computer-readable storage medium having stored thereon a program product capable of implementing the above-described methods of the present disclosure is also provided. In some possible embodiments, various aspects of the present disclosure can also be implemented in the form of a program product including a program code for causing an end device to perform the steps described in the above "Example Methods" section according to various example embodiments of the present disclosure when the program product is run on the end device.

[0149] The program product for implementing the above-described methods according to the embodiments of the present disclosure can take the form of a portable compact disc read-only memory (CD-ROM) and include a program code, and can be run on an end device, such as a personal computer. However, the program product of the present disclosure is not limited to this, and in this document, a readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or apparatus.

[0150] The program product can employ any combination of one or more computer-readable media. The computer-readable media can be a computer-readable storage medium or a computer-readable signal medium. The computer-readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium include the following: an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0151] The computer-readable signal medium can include a computer-readable storage medium that is propagated as a carrier wave. The computer-readable signal medium can further be any computer-readable medium that is not a storage medium. The computer-readable signal medium can be a computer-readable storage medium that is a propagated signal on a computer-readable storage medium.

[0152] The program code embodied on the computer-readable media can be transmitted using any appropriate medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0153] The program code can be executed by one or more programmable processors, which can be implemented in one or more computer systems. In this context, a computer system generally includes a plurality of these programmable processors, which work in concert to perform a task. Additionally, the program code can be downloaded from an external source, including the internet, through a computer network, or through a broadcast medium.

[0154] Furthermore, the above-described diagrams are merely schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, and are not intended to be limiting. It is readily understood that the processes shown in the above-described diagrams do not indicate or limit the time sequence of the processes. In addition, it is readily understood that the processes can be executed synchronously or asynchronously, for example, in a plurality of modules.

[0155] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the features disclosed herein. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.

Claims

1. An IP address interception method, characterized in that, include: Upload a blacklist of IP addresses containing classless inter-domain routing subnets; The blacklist IP set is parsed, and the parsing result is converted into a range of values ​​for a classless inter-domain route hash in JSON format; Load the range of values ​​for the classless inter-domain route hash; Determine the value range of the preloaded Classless Inter-Domain Route hash. The value range of the Classless Inter-Domain Route hash is configured to be determined based on the blacklist IP set of the Classless Inter-Domain Route segment. Determining the value range of the Classless Inter-Domain Route hash includes: Divide any IP address in the blacklist IP set of the IPv4 network segment into four segments, each segment consisting of 8 bits; The key of the hash table is determined based on the subnet mask of the IP address; The value range is determined based on the third segment of the IP address, where the first 2 bits of the third segment are a mask and the last 6 bits of the third segment are the IP range. Determine the blacklist IP set containing the classless inter-domain routing network segment based on the key and the value range; Alternatively, divide any IP address in the blacklist set of IPv6 network segments into eight segments, each consisting of 16 bits; The key of the hash table is determined based on the subnet mask of the IP address; The value range is determined based on the third segment of the IP address, where the first 8 bits of the third segment are a mask and the last 8 bits of the third segment are the IP range. Determine the blacklist IP set containing the classless inter-domain routing network segment based on the key and the value range; IP addresses are intercepted based on the range of values ​​for the classless inter-domain routing hash.

2. The IP address interception method as described in claim 1, characterized in that, Also includes: If the keys of the classless inter-domain routing segments are the same, the value ranges are arranged in a specified order; The sorted value ranges are merged into a single value range array.

3. The IP address interception method as described in claim 1, characterized in that, The range of values ​​for parsing the blacklist IP set and converting the parsing result into a classless inter-domain route hash in JSON format includes: The blacklist of IP addresses is parsed to determine the prefix segment and value range of the IPv4 or IPv6 network segment. Convert the prefix segment and the value range into the value range of the classless inter-domain route hash in JSON format.

4. The IP address interception method as described in any one of claims 1-3, characterized in that, Blocking IP addresses based on the range of values ​​for the classless inter-domain routing hash includes: In response to an IP address request, the IP address request is parsed to determine the prefix segment in the IP address request, and the prefix segment is identified as the key; Find the range of values ​​for the classless inter-domain routing hash based on the key; Whether to block the IP address request is determined based on the range of values ​​for the classless inter-domain routing hash.

5. An IP address interception device, characterized in that, include: The module is configured to upload a blacklist of IP addresses containing classless inter-domain routing segments; The blacklist IP set is parsed, and the parsing result is converted into a range of values ​​for a classless inter-domain route hash in JSON format; Load the range of values ​​for the classless inter-domain route hash; Determine the value range of the preloaded Classless Inter-Domain Route hash. The value range of the Classless Inter-Domain Route hash is configured to be determined based on the blacklist IP set of the Classless Inter-Domain Route segment. Determining the value range of the Classless Inter-Domain Route hash includes: Divide any IP address in the blacklist IP set of the IPv4 network segment into four segments, each segment consisting of 8 bits; The key of the hash table is determined based on the subnet mask of the IP address; The value range is determined based on the third segment of the IP address, where the first 2 bits of the third segment are a mask and the last 6 bits of the third segment are the IP range. Determine the blacklist IP set containing the classless inter-domain routing network segment based on the key and the value range; Alternatively, divide any IP address in the blacklist set of IPv6 network segments into eight segments, each consisting of 16 bits; The key of the hash table is determined based on the subnet mask of the IP address; The value range is determined based on the third segment of the IP address, where the first 8 bits of the third segment are a mask and the last 8 bits of the third segment are the IP range. Determine the blacklist IP set containing the classless inter-domain routing network segment based on the key and the value range; The interception module is configured to intercept IP addresses based on the range of values ​​for the classless inter-domain routing hash.

6. An electronic device, characterized in that, include: Memory; as well as A processor coupled to the memory, the processor being configured to execute the IP address interception method as described in any one of claims 1-4 based on instructions stored in the memory.

7. A computer-readable storage medium having a program stored thereon that, when executed by a processor, implements the IP address interception method as described in any one of claims 1-4.

Images