A communication method, network device, terminal and domain name system server

Abstract

A communication method comprises: receiving an uplink data packet sent by a terminal; obtaining an IP address of the terminal and a first virtual IP address of an application server from the uplink data packet when it is detected that the uplink data packet carries a high defense address identifier; obtaining a key; generating a to-be-processed IP address according to the key, the IP address of the terminal carried by the uplink data packet and the first virtual IP address; determining that the uplink data packet is illegal when the to-be-processed IP address is not an IP address of the application server; modifying a destination IP address of the uplink data packet from the first virtual IP address to the IP address of the application server and sending the modified uplink data packet to the application server when the to-be-processed IP address is the IP address of the application server. In this way, one application server corresponds to many virtual IP addresses, thereby reducing the risk of network attack on the IP address of the application server. The application further provides related equipment capable of implementing the communication method.

Description

Technical Field

[0001] This application relates to the field of communications, and more particularly to a communication method, network device, terminal, and domain name system server. Background Technology

[0002] In network attack scenarios targeting a specific objective, attackers need to obtain the target's Internet Protocol (IP) address and then launch an attack against that address. IP address spoofing, as a means of defending against network attacks, can change the IP address, preventing attackers from continuously launching network attacks against the target's IP address. IP address spoofing includes real IP address spoofing and virtual IP address spoofing.

[0003] One method for virtual IP address hopping is roughly as follows: When a terminal wants to access an application server, it requests the application server's IP address from a Domain Name System (DNS) server through a Mobile Target Defense (MTD) gateway proxy. The DNS server sends the application server's IP address to the MTD gateway proxy, which then modifies the application server's IP address in the message to a virtual IP address and sends the virtual IP address back to the terminal. After obtaining the virtual IP address, the terminal sends a data packet to the MTD gateway proxy, with the destination IP address of the data packet being the virtual IP address. Upon receiving the data packet, the MTD gateway proxy, based on the mapping table between virtual IP addresses and application server IP addresses, modifies the destination IP address of the data packet from the virtual IP address to the application server's IP address and then sends the data packet containing the application server's IP address to the application server.

[0004] When multiple terminals access the application server, they all receive the same virtual IP address within a single hop cycle. If this virtual IP address is shared or resold, it can easily allow attackers to use multiple botnet devices to launch attacks against the application server. Summary of the Invention

[0005] In view of this, this application provides a communication method that can generate multiple virtual IP addresses for each application server's IP address, thereby preventing network attackers from launching network attacks using multiple botnets with the same virtual IP address and improving network security. This application also provides terminals, network devices, and Domain Name System (DNS) servers capable of implementing the above communication method.

[0006] The first aspect provides a communication method, which includes: receiving an uplink data packet sent by a terminal; when the uplink data packet is detected to carry a high-defense address identifier, obtaining the terminal's IP address and the application server's first virtual IP address from the uplink data packet; after obtaining a key, generating a pending IP address based on the key, the terminal's IP address, and the first virtual IP address; when the pending IP address is not the application server's IP address, determining that the uplink data packet is invalid; when the pending IP address is the application server's IP address, modifying the destination IP address of the uplink data packet from the first virtual IP address to the pending IP address, and sending an uplink data packet carrying the pending IP address to the application server. The uplink data packet carries the application server's first virtual IP address and the terminal's IP address. Since the first virtual IP address is generated based on the key, the terminal's IP address, and the application server's IP address, one application server's IP address corresponds to many virtual IP addresses. This avoids the situation where network attackers use multiple botnets to launch network attacks against the application server corresponding to a single virtual IP address.

[0007] In one possible implementation, generating the IP address to be processed based on the key, the terminal's IP address, and the first virtual IP address includes: if the uplink data packet also includes a first address generation sequence, generating the IP address to be processed based on the key, the terminal's IP address, the first virtual IP address, and the first address generation sequence. Since the first address generation sequence includes the address generation time and the address lifespan of the first virtual IP address, the legitimacy of the first virtual IP address can be verified based on the first address generation sequence, thereby improving the security of the virtual IP address.

[0008] In another possible implementation, the method further includes: receiving downlink data packets sent by the application server; when a downlink data packet carrying a high-defense address identifier is detected, generating a first virtual IP address based on a key, the application server's IP address, the terminal's IP address, and a first address generation sequence; determining the address end time of the first virtual IP address based on the first address generation sequence; when the address end time is greater than the verification time, determining that the target time difference is equal to the address end time minus the verification time; when the target time difference is greater than a preset duration, generating a first downlink data packet based on the downlink data packet and the first virtual IP address, and sending the first downlink data packet to the terminal. The downlink data packet carries the application server's IP address, the terminal's IP address, the first address generation sequence, and the high-defense address identifier. Converting the application server's IP address into a virtual IP address can hide the application server's IP address. When the address end time is less than the verification time, it indicates that the first virtual IP address has expired, and the downlink data packet can be discarded, or a first downlink data packet can be generated based on the downlink data packet and the first virtual IP address, and sent to the terminal.

[0009] In another possible implementation, when the target time difference is less than or equal to a preset duration, a second address generation sequence is obtained. A second virtual IP address is generated based on the key, the application server's IP address, the terminal's IP address, and the second address generation sequence. A second downlink data packet is then generated based on the downlink data packet, the first virtual IP address, the second virtual IP address, the second address generation sequence, and an address switching identifier. This second downlink data packet is then sent to the terminal. The second downlink data packet carries the first virtual IP address, the second virtual IP address, the second address generation sequence, and the address switching identifier. The second address generation sequence includes the address generation time of the second virtual IP address and the address lifespan of the second virtual IP address. This provides a method for notifying the terminal to perform an address switch using downlink data packets.

[0010] In another possible implementation, when the target time difference is less than or equal to a preset duration, a second address generation sequence is obtained. This second address generation sequence includes the address generation time of the second virtual IP address and the address lifespan of the second virtual IP address. A second virtual IP address is generated based on the key, the application server's IP address, the terminal's IP address, and the second address generation sequence. An address switching notification carrying the second virtual IP address and the second address generation sequence is sent to the terminal. A first downlink data packet is generated based on the downlink data packet and the first virtual IP address, and this first downlink data packet is sent to the terminal. The address switching notification is a control plane message, thus providing another method for notifying the terminal to perform an address switch.

[0011] In another possible implementation, generating the IP address to be processed based on the key, the terminal's IP address, the first virtual IP address, and the first address generation sequence includes: decrypting the second part of the first virtual IP address using the key; performing a first XOR operation on the second part of the terminal's IP address and the decryption result; performing a second XOR operation on the first address generation sequence and the result of the first XOR operation; and combining the first part of the first virtual IP address with the result of the second XOR operation to form the IP address to be processed. This provides a feasible address decryption method.

[0012] In another possible implementation, before obtaining the key, the system receives the application server's IP address and the corresponding key from the key management server. This key and the application server's IP address are uniquely matched. Once the network device has this key deployed, it can perform address translation on the virtual IP address generated using that key.

[0013] In another possible implementation, before obtaining the key, the terminal's IP address and the corresponding key are received from the key management server. This key has a one-to-one correspondence with the terminal's IP address. Once the network device has this key deployed, it can perform address translation on the virtual IP address generated using that key.

[0014] In another possible implementation, a key is received from a key management server before the key is obtained. This key is used for address translation. In the above possible implementations, the key management server can periodically send new keys to improve the security of the virtual address.

[0015] The second aspect provides a communication method, which includes: sending an address request message containing a domain name to a Domain Name System (DNS) server, receiving a response message sent by the DNS server based on the address request message, generating an uplink data packet, and sending the uplink data packet to a network device. The uplink data packet carries the terminal's IP address, a first virtual IP address, and a high-security address identifier. By implementing this method, the real IP address of the application server can be hidden when sending uplink data, thereby improving communication security.

[0016] In one possible implementation, the response message further includes a first address generation sequence, and the uplink data packet also includes a first address generation sequence. The first address generation sequence includes the address generation time of the first virtual IP address and the address lifespan of the first virtual address. The address generation time of the virtual IP address can be a timestamp. Since the address generation time and address lifespan of the virtual IP address are unique, encrypting and decrypting the virtual IP address can reduce the possibility of spoofing, thus providing good security.

[0017] In another possible implementation, the method further includes: receiving a first downlink data packet sent by a network device, the first downlink data packet carrying a first virtual IP address. When the first virtual IP address has not expired, the network device sends a downlink data packet carrying the first virtual IP address.

[0018] In another possible implementation, the method further includes: receiving a second downlink data packet sent by a network device, the second downlink data packet carrying a first virtual IP address, a second virtual IP address, a second address generation sequence, and an address switching identifier; and generating an uplink data packet carrying the second virtual IP address, the second address generation sequence, and a high-defense address identifier based on the address switching identifier. The second address generation sequence includes the address generation time of the second virtual IP address and the address lifespan of the second virtual IP address. When the first virtual IP address is about to expire, the network device can send a second downlink data packet to the terminal. The terminal then generates an uplink data packet carrying the second virtual IP address and the second address generation sequence and sends the uplink data packet to the network device. Using different virtual IP addresses for communication during each address transition period further improves network security.

[0019] In another possible implementation, the method further includes: after receiving a first downlink data packet and an address switching notification from the network device, generating an uplink data packet carrying a second virtual IP address, a second address generation sequence, and a high-defense address identifier based on the address switching notification. The first downlink data packet carries the first virtual IP address. The address switching notification includes the second virtual IP address and the second address generation sequence. When the first virtual IP address is about to expire, the network device can send the first downlink data packet and the address switching notification to the terminal. After the terminal generates an uplink data packet carrying the second virtual IP address and the second address generation sequence based on the address switching notification, it can send the uplink data packet to the network device. This provides another address switching method, using different virtual IP addresses for communication during each address transition period, thereby further improving network security.

[0020] The third aspect provides a communication method, which includes: receiving an address request message sent by a terminal; when the domain name included in the address request message is a high-defense domain name, obtaining a key and a high-defense address identifier; then generating a first virtual IP address based on the key, the terminal's IP address, and the application server's IP address; and sending a response message to the terminal. The response message includes the first virtual IP address and the high-defense address identifier. This provides a virtual IP address for hiding the application server's real IP address during communication, thereby improving communication security.

[0021] In one possible implementation, generating a first virtual IP address based on a key, the terminal's IP address, and the application server's IP address includes: obtaining a first address generation sequence; and generating the first virtual IP address based on the key, the terminal's IP address, the application server's IP address, and the first address generation sequence. The first address generation sequence includes the address generation time and the address lifespan of the first virtual IP address. This provides a method for generating a virtual IP address.

[0022] In another possible implementation, generating the first virtual IP address based on the key, the terminal's IP address, the application server's IP address, and the first address generation sequence includes: performing a first XOR operation on the second part of the terminal's IP address and the second part of the application server's IP address; performing a second XOR operation on the result of the first address generation sequence and the first XOR operation; encrypting the result of the second XOR operation using the key; and combining the encrypted result with the first part of the application server's IP address to form the first virtual IP address. This provides a method for generating a virtual IP address.

[0023] A fourth aspect provides a network device having the function of implementing the communication method of the first aspect. This function can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the aforementioned function.

[0024] The fifth aspect provides a terminal having the function of implementing the communication method of the second aspect. This function can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the aforementioned function.

[0025] The sixth aspect provides a Domain Name System (DNS) server that has the functionality to implement the communication method described in the third aspect. This functionality can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the aforementioned functionality.

[0026] A seventh aspect provides a network device including a processor and a memory, the memory being used to store a program; the processor executing the program to implement the method of the first aspect.

[0027] The eighth aspect provides a terminal including a processor and a memory for storing a program; the processor executes the program to implement the method of the second aspect.

[0028] The ninth aspect provides a Domain Name System server, which includes a processor and a memory, the memory being used to store a program; the processor executing the program is used to implement the method of the third aspect.

[0029] The tenth aspect provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the methods described above.

[0030] The eleventh aspect provides a computer program product containing instructions that, when run on a computer, cause the computer to perform the methods described above.

[0031] The twelfth aspect provides a chip system including at least one processor coupled to a memory for storing computer programs or instructions, and the processor for executing the computer programs or instructions to implement the methods of the above aspects. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of an address hopping scenario in this application;

[0033] Figure 2 This is a signaling diagram of a communication method in an embodiment of this application;

[0034] Figure 3 This is another signaling diagram of the communication method in the embodiments of this application;

[0035] Figure 4 This is another signaling diagram of the communication method in the embodiments of this application;

[0036] Figure 5A This is a schematic diagram illustrating the generation of a first virtual IP address based on a key, a user IP address, an application server IP address, and a first address generation sequence in an embodiment of this application.

[0037] Figure 5B This is a schematic diagram illustrating the generation of an application server IP address based on a key, a first virtual IP address, a user IP address, and a first address generation sequence in an embodiment of this application.

[0038] Figure 6 This is another signaling diagram of the communication method in the embodiments of this application;

[0039] Figure 7 This is another signaling diagram of the communication method in the embodiments of this application;

[0040] Figure 8 This is a schematic diagram of a first downlink data packet in an embodiment of this application;

[0041] Figure 9 This is a schematic diagram of a second downlink data packet in an embodiment of this application;

[0042] Figure 10 This is a structural diagram of a network device in an embodiment of this application;

[0043] Figure 11 This is a structural diagram of a terminal in an embodiment of this application;

[0044] Figure 12 This is a structural diagram of a Domain Name System server in an embodiment of this application;

[0045] Figure 13 This is another structural diagram of the network device in this application embodiment;

[0046] Figure 14 This is another structural diagram of the terminal in an embodiment of this application;

[0047] Figure 15 This is another structural diagram of the Domain Name System server in this application embodiment. Detailed Implementation

[0048] The communication method of this application can be applied to IP network systems. In one example, the IP network system includes a terminal 10, a network device 20, a domain name system server 30, a key management server 40, and an application server 50. The data transmission process of the above devices includes:

[0049] Step S11: The key management server 40 sends the key to the domain name system server 30.

[0050] Step S12: The key management server 40 sends the key to the network device 20.

[0051] The key management server 40 stores keys. The key management server 40 can periodically send keys to the domain name system server 30 and the network device 20. After receiving the keys, the domain name system server 30 and the network device 20 can store them locally. Step S12 can be executed before step S11, or steps S11 and S12 can be executed together.

[0052] Step S13: Terminal 10 sends an address request to network device 20.

[0053] When a user enters a domain name on terminal 10, terminal 10 generates an address request carrying the domain name and sends the address request to the network device.

[0054] Step S14: Network device 20 sends an address request to Domain Name System server 30.

[0055] After receiving the address request, the Domain Name System (DNS) server 30 determines the virtual IP address and associated information of the application server 50 based on the domain name carried in the address request. The virtual IP address of the application server 50 is associated with the key, and the IP address of the terminal 10 is associated with the IP address of the application server 50.

[0056] This virtual address association information refers to information related to the virtual IP address of application server 50. For example, it includes the high-defense address identifier and the address generation sequence. The address generation sequence includes the time the virtual IP address was generated and its lifespan. The high-defense address identifier can also be understood as a virtual address identifier.

[0057] Step S15: Domain Name System server 30 sends the virtual IP address and virtual address association information of application server 50 to network device 20.

[0058] Step S16: Network device 20 sends the virtual IP address and virtual address association information of application server 50 to terminal 10.

[0059] After obtaining the virtual IP address and virtual address association information of the application server 50, the terminal 10 generates a data packet that includes the virtual IP address and virtual address association information of the application server 50.

[0060] Step S17: Terminal 10 sends a data packet to network device 20, including the virtual IP address and virtual address association information of application server 50.

[0061] After receiving the data packet, network device 20 performs address hopping on the destination address of the data packet, so that the destination address of the data packet is changed from the virtual IP address of application server 50 to the IP address of application server 50.

[0062] Step 18: Network device 20 sends a data packet containing the IP address and virtual address association information of application server 50 to application server 50.

[0063] Step 19: Application server 50 sends a data packet containing the IP address and virtual address association information of application server 50 to network device 20.

[0064] Step 20: Network device 20 sends a data packet to terminal 10, which includes the virtual IP address and virtual address association information of application server 50.

[0065] Network devices can perform address hopping between the virtual IP address and the real IP address of application server 50, thus hiding the real IP address of the application server. Since the virtual IP address of application server 50 is associated with a key, and the IP address of terminal 10 is also associated with the IP address of application server 50, when m terminals simultaneously access application server 50, there are m virtual IP addresses corresponding to application server 50. This prevents network attackers from using multiple botnets to launch network attacks against application server 50 corresponding to a single virtual IP address, thereby improving network security. m is a positive integer.

[0066] The address hopping described in this application is a Moving Target Defense (MTD) technique. It dynamically and continuously changes the attack surface (changing IP addresses, network ports, network configuration information, software, etc.), making the attack surface highly uncertain and difficult to predict and explore, thereby improving network security. In existing virtual IP address hopping methods, one application server corresponds to one virtual IP address within a single address hopping cycle. When a virtual IP address is publicly disclosed or resold, attackers can use multiple botnets to launch network attacks against that virtual IP address, such as distributed denial-of-service (DDoS) attacks. To address this problem, this application provides a communication method that allows one application server to correspond to multiple virtual IP addresses, thereby reducing the possibility of attackers using multiple botnets to launch network attacks against a single virtual IP address.

[0067] The communication method of this application is described below. (See attached document.) Figure 2 One embodiment of the communication method provided in this application includes:

[0068] Step 201: The terminal sends an address request message to the Domain Name System (DNS) server. The address request message carries the domain name.

[0069] Step 202: The Domain Name System (DNS) server determines whether the domain name carried in the address request message is a high-defense domain name. If yes, proceed to step 204; otherwise, proceed to step 203.

[0070] Step 203: The Domain Name System (DNS) server sends the IP address corresponding to the domain name to the terminal.

[0071] The terminal can access the server corresponding to the domain name based on the IP address corresponding to the domain name.

[0072] Step 204: Obtain the key and high-defense address identifier from the Domain Name System server.

[0073] There are several ways to obtain the key.

[0074] In one alternative embodiment, the Domain Name System (DNS) server retrieves the key from locally stored keys. Before retrieving the key, the DNS server periodically receives the key from a key management server and then stores it locally. Within a single key cycle, the DNS server or network device uses the key for encryption and decryption.

[0075] In another alternative embodiment, the key management server stores a mapping between terminal IP addresses and keys. The Domain Name System (DNS) server periodically receives terminal IP addresses and corresponding keys from the key management server. Alternatively, the DNS server sends a key request carrying the terminal's IP address to the key management server, and the key management server retrieves the key based on the terminal's IP address carried in the key request. In this way, each terminal's IP address corresponds to one key.

[0076] In another alternative embodiment, the key management server stores a mapping between the IP addresses of application servers and their corresponding keys. The Domain Name System (DNS) server periodically receives the IP addresses of application servers and their corresponding keys from the key management server. Alternatively, the DNS server sends a key request carrying the IP addresses of the application servers to the key management server, and the key management server retrieves the key based on the IP addresses of the application servers carried in the key request. In this way, each application server's IP address corresponds to one key.

[0077] Step 205: The Domain Name System (DNS) server generates the first virtual IP address based on the key, the terminal's IP address, and the application server's IP address.

[0078] Step 206: The Domain Name System (DNS) server sends a response message to the terminal, including the first virtual IP address and the high-defense address identifier.

[0079] Step 207: The terminal sends uplink data packets to the network device.

[0080] After receiving the response message, the terminal can generate an uplink data packet. The uplink data packet carries the terminal's IP address, the first virtual IP address, and the DDoS protected address identifier. The terminal's IP address is the source IP address of the uplink data packet, and the first virtual IP address is the destination IP address of the uplink data packet.

[0081] Step 208: When an uplink data packet is detected to carry a high-defense address identifier, obtain the terminal's IP address and the application server's first virtual IP address from the uplink data packet.

[0082] After receiving the uplink data packet from the terminal, the system checks whether the uplink data packet includes a high-defense address identifier. If the uplink data packet carries a high-defense address identifier, it indicates that the destination IP address of the uplink data packet is a virtual IP address. The system then obtains the terminal's IP address and the application server's first virtual IP address from the uplink data packet. It should be understood that if the data packet sent by the terminal does not carry a high-defense address identifier, it indicates that the server corresponding to the destination IP address of the data packet is not a high-defense server, and the data packet is forwarded directly based on the destination IP address.

[0083] Step 209: Network device obtains key.

[0084] The key obtained by the Domain Name System server in step 204 is the same as the key obtained by the network device in step 209.

[0085] In one optional embodiment, the network device retrieves the key from a locally stored key. It should be noted that before the network device retrieves the key, the key management server can periodically send the key to the network device, and the network device, upon receiving the key, stores it locally.

[0086] In another alternative embodiment, after the network device sends a request to the key management server to obtain a key, it receives the terminal IP address and the key corresponding to the terminal IP address from the key management server.

[0087] In another alternative embodiment, after the network device sends a key acquisition request to the key management server, it receives the application server's IP address and the key corresponding to that IP address from the key management server. It should be noted that the network device and the application server are in the same domain, and the prefix of the virtual IP address is used to point to that domain. Forwarding devices in the network (such as routers or switches) can send uplink data packets to the network device in the domain based on the prefix of the virtual IP address.

[0088] Step 210: The network device generates an IP address to be processed based on the key, the terminal's IP address, and the first virtual IP address.

[0089] In an optional embodiment, step 210 includes: decrypting the second part of the first virtual IP address using a key; performing an XOR operation on the second part of the terminal's IP address and the decryption result; and forming the IP address to be processed by combining the first part of the first virtual IP address with the XOR operation result. In this embodiment, the first part of the application server's IP address is the same as the first part of the first virtual IP address, while the second part of the application server's IP address is different from the second part of the first virtual IP address. In this application, the first and second parts can be truncated from the IP address according to actual conditions, and the lengths of the first and second parts can also be set according to actual conditions; this application does not impose any limitations. The decryption algorithm and the encryption algorithm use the same key. The decryption algorithm can be, but is not limited to, the International Data Encryption Algorithm (IDEA), the Data Encryption Standard (DES), Triple DES, etc.

[0090] Step 211: The network device determines whether the IP address to be processed is the IP address of the application server. If yes, proceed to step 213; otherwise, proceed to step 212.

[0091] When the IP address to be processed is the application server's IP address, it indicates that the second part of the first virtual IP address was obtained by encrypting the second part of the application server's IP address using the key. When the IP address to be processed is not the application server's IP address, it indicates that the second part of the first virtual IP address was not obtained by encrypting the second part of the application server's IP address using the key.

[0092] Step 212: The network device determines that the uplink data packet is invalid.

[0093] When an uplink data packet is invalid, the network can forward the uplink data packet to a traffic scrubbing center or honeypot server, or the network device can discard the invalid data packet.

[0094] Step 213: The network device modifies the destination IP address of the uplink data packet from the first virtual IP address to the application server's IP address. When the IP address to be processed is the application server's IP address, it indicates that the uplink data packet is valid, and the destination IP address of the data packet is translated.

[0095] Step 214: The network device sends the modified uplink data packet to the application server. In the modified uplink data packet, the destination IP address is the IP address of the application server.

[0096] In this embodiment, since the first virtual IP address is related to the key, the terminal's IP address, and the application server's IP address, when multiple terminals send uplink data packets to the same application server, the uplink data packets sent by different terminals have different virtual IP addresses. This can prevent network attackers from using multiple botnet devices and the same virtual IP address to launch network attacks against the same application server.

[0097] In this application, the application server can send downlink data packets to the terminal, and the downlink data packets can be... Figure 2 The response data packet of the modified uplink data packet in the illustrated embodiment can also be a message initiated by the application server, such as a push message.

[0098] See Figure 3 In an optional embodiment, the above method further includes:

[0099] Step 301: The network device receives a downlink data packet sent by the application server. This downlink data packet carries the application server's IP address, the terminal's IP address, and a high-defense address identifier. When the network device detects that the downlink data packet carries a high-defense address identifier, it proceeds to step 302.

[0100] Step 302: The network device generates a first virtual IP address based on the key, the application server's IP address, and the terminal's IP address.

[0101] Specifically, the network device encrypts the second part of the application server's IP address using a key; it then performs an XOR operation on the second part of the terminal's IP address and the encrypted result, and finally combines the first part of the application server's IP address with the XOR result to form a first virtual IP address. Since the second part of different terminals' IP addresses differs, different virtual IP addresses are generated based on the IP addresses of different terminals. Using key encryption improves the security of the virtual IP address.

[0102] Step 303: The network device modifies the source IP address of the downlink data packet from the application server's IP address to the first virtual IP address.

[0103] Step 304: The network device sends the modified downlink data packet to the terminal.

[0104] In this embodiment, the network device can convert the real IP address carried in the downlink data packet into a virtual IP address, which can hide the real IP address of the application server and improve network security.

[0105] In the above embodiments, when the key management server periodically changes the key, the virtual IP address generated using the key also changes. Therefore, the virtual IP address can be updated periodically, which improves its security. In addition, this application can also generate virtual IP addresses using both the key and a timestamp, further enhancing their security. See also... Figure 4 Another embodiment of the communication method provided in this application includes:

[0106] Step 401: The terminal sends an address request message to the Domain Name System (DNS) server. This address request message carries the domain name.

[0107] Step 402: The Domain Name System (DNS) server determines whether the domain name carried in the address request message is a high-defense domain name. If yes, proceed to step 404; otherwise, proceed to step 403.

[0108] Step 403: The Domain Name System (DNS) server sends the IP address corresponding to the domain name to the terminal. The terminal can then access the server corresponding to the domain name using the IP address provided.

[0109] Step 404: Obtain the key from the Domain Name System server, generate the first address sequence and the high-defense address identifier.

[0110] There are several ways to obtain the key.

[0111] In one alternative embodiment, the Domain Name System (DNS) server retrieves the key from locally stored keys. Before retrieving the key, the DNS server periodically receives keys from a key management server and then stores them locally. Within a single key cycle, the DNS server or network device uses this key for encryption and decryption. Since the keys issued in different key cycles are different, the virtual IP addresses carried by data packets sent by the same terminal in different key cycles will also be different.

[0112] In another alternative embodiment, the key management server stores a mapping between terminal IP addresses and keys. The domain name system server periodically receives terminal IP addresses and corresponding keys from the key management server. Alternatively, the domain name system server sends a key request carrying the terminal's IP address to the key management server, and the key management server obtains the key based on the terminal's IP address carried in the key request. Thus, each terminal's IP address has one key.

[0113] In another alternative embodiment, the key management server stores a mapping between the IP addresses of application servers and their corresponding keys. The Domain Name System (DNS) server periodically receives the IP addresses of application servers and their corresponding keys from the key management server. Alternatively, the DNS server sends a key request carrying the IP addresses of the application servers to the key management server, and the key management server retrieves the key based on the IP addresses of the application servers carried in the key request. In this way, each application server has one key.

[0114] Step 405: The Domain Name System (DNS) server generates a first virtual IP address based on the key, the terminal's IP address, the application server's IP address, and the first address generation sequence.

[0115] It should be noted that the relationship between the key, the terminal's IP address, the application server's IP address, the address generation sequence, and the virtual IP address can be described by the following formula:

[0116] vIP ij =F key (SrcIP i ,DstIP,Seq j )

[0117] vIP ij This represents the virtual IP address associated with the IP address of the i-th terminal and the address generation sequence of the j-th terminal. (SrcIP) i Let Seq be the IP address of the i-th terminal. j Generate a sequence for the j-th address. Both i and j are positive integers. DstIP represents the IP address of the application server. F key() represents the encryption function associated with the key, which is used to represent the IDEA algorithm, DES algorithm, or triple DES algorithm.

[0118] Step 406: The Domain Name System (DNS) server sends a response message to the terminal, including the first virtual IP address, the first address generation sequence, and the high-defense address identifier.

[0119] Step 407: The terminal sends uplink data packets to the network device.

[0120] After receiving the response message, the terminal can generate an uplink data packet. The uplink data packet carries the terminal's IP address, a first virtual IP address, a first address generation sequence, and a high-defense address identifier. The terminal's IP address is the source IP address of the uplink data packet, and the first virtual IP address is the destination IP address of the uplink data packet.

[0121] Step 408: When an uplink data packet is detected to carry a high-defense address identifier, obtain the terminal's IP address, the application server's first virtual IP address, and the first address generation sequence from the uplink data packet.

[0122] After receiving the uplink data packet from the terminal, the system checks whether the uplink data packet includes a high-defense address identifier. If the uplink data packet carries a high-defense address identifier, it indicates that the destination IP address of the uplink data packet is a virtual IP address. The system obtains the terminal's IP address, the application server's first virtual IP address, and the first address generation sequence from the uplink data packet. It should be understood that if the data packet sent by the terminal does not carry a high-defense address identifier, it indicates that the server corresponding to the destination IP address of the data packet is not a high-defense server, and the data packet can be forwarded directly based on the destination IP address.

[0123] Step 409: The network device obtains the key. The key obtained by the Domain Name System server in step 404 is the same as the key obtained by the network device in step 409.

[0124] In one optional embodiment, the network device retrieves the key from a locally stored key. It should be noted that before the network device retrieves the key, the key management server can periodically send the key to the network device, and the network device, upon receiving the key, stores it locally.

[0125] In another alternative embodiment, after the network device sends a request to the key management server to obtain a key, it receives the IP address of the terminal and the key corresponding to the IP address of the terminal from the key management server.

[0126] In another alternative embodiment, after the network device sends a key acquisition request to the key management server, it receives the application server's IP address and the key corresponding to that IP address from the key management server. It should be noted that the network device and the application server are in the same domain, and the prefix of the virtual IP address is used to point to that domain. Forwarding devices in the network (such as routers or switches) can send uplink data packets to the network device in the domain based on the prefix of the virtual IP address.

[0127] Step 410: The network device generates the IP address to be processed based on the key, the terminal's IP address, the first virtual IP address, and the first address generation sequence.

[0128] The relationship between the key, the terminal's IP address, the first virtual IP address, the first address generation sequence, and the IP address to be processed can be represented by the following formula:

[0129] IP=F key (SrcIP i ,vIP ij Seq j ).

[0130] IP represents the IP address to be processed. vIP ij This represents the virtual IP address associated with the IP address of the i-th terminal and the address generation sequence of the j-th terminal. (SrcIP) i Let Seq be the IP address of the i-th terminal. j Generate a sequence for the j-th address. F key () represents a function associated with the key.

[0131] In an optional embodiment, step 410 includes: decrypting the second part of the first virtual IP address using a key; performing a first XOR operation on the second part of the terminal's IP address and the decryption result; performing a second XOR operation on the first address generation sequence and the result of the first XOR operation; and forming the IP address to be processed by combining the first part of the first virtual IP address with the result of the second XOR operation. In this embodiment, the first part of the application server's IP address is the same as the first part of the first virtual IP address, while the second part of the application server's IP address is different from the second part of the first virtual IP address. The decryption algorithm and the encryption algorithm use the same key. The decryption algorithm may be, but is not limited to, the International Data Encryption Algorithm (IDEA), the Data Encryption Standard (DES), or the Triple DES algorithm.

[0132] Step 411: The network device determines whether the IP address to be processed is the IP address of the application server. If yes, proceed to step 413; otherwise, proceed to step 412.

[0133] When the IP address to be processed is the application server's IP address, it indicates that the second part of the first virtual IP address was obtained by encrypting the second part of the application server's IP address using the key. When the IP address to be processed is not the application server's IP address, it indicates that the second part of the first virtual IP address was not obtained by encrypting the second part of the application server's IP address using the key.

[0134] Step 412: The network device determines that the uplink data packet is invalid.

[0135] When the IP address to be processed is not the IP address of the application server, the network device determines that the uplink data packet is illegal. The network device can either forward the uplink data packet to the traffic scrubbing center or honeypot server, or discard the illegal data packet.

[0136] Step 413: The network device modifies the destination IP address of the uplink data packet from the first virtual IP address to the application server's IP address. When the IP address to be processed is the application server's IP address, it indicates that the uplink data packet is valid. The destination IP address of the data packet is then translated; this address translation is also called address hopping.

[0137] Step 414: The network device sends the modified uplink data packet to the application server.

[0138] In the modified uplink data packet, the destination IP address is the IP address of the application server.

[0139] In this embodiment, since the first virtual IP address is related to the key, the terminal's IP address, and the application server's IP address, when multiple terminals send uplink data packets to the same application server, the uplink data packets sent by different terminals have different virtual IP addresses. This can reduce the possibility of multiple botnet devices using the same virtual IP address to send network attacks on the same application server, thereby further improving network security.

[0140] Secondly, since the security of virtual IP addresses is related to the time of their generation and their lifespan, it can improve the security of virtual IP addresses.

[0141] Furthermore, the lifespan of a virtual IP address can be determined based on its generation time and lifetime. This application uses the lifetime of a virtual IP address to perform timeliness verification and determine whether it has expired. Automatically changing virtual IP addresses improves data transmission security.

[0142] The following is combined with Figure 5A This application describes the process of generating a virtual IP address based on the key, the terminal's IP address, the application server's IP address, and a first address generation sequence. (See also...) Figure 5A In one example, the terminal's IP address includes a first part 501 and a second part 502, both of which are 64 bits long. The application server's IP address includes a first part 503 and a second part 504, both of which are 64 bits long.

[0143] Two items are selected from the second part 502 of the terminal IP address, the second part 504 of the application server IP address, and the first address generation sequence 505 for a first XOR operation. Then, the remaining items are XORed with the result of the first XOR operation for a second XOR operation. The result of the second XOR operation is encrypted using key 506 to obtain the second part 508 of the first virtual IP address. The first part 503 of the application server IP address is the same as the first part 507 of the first virtual IP address. The first part 507 of the first virtual IP address and the second part 508 of the first virtual IP address are combined to form the first virtual IP address.

[0144] The following is combined with Figure 5B This application describes the process of generating the application server's IP address based on the key, the terminal's IP address, the first virtual IP address, and the first address generation sequence. (See also...) Figure 5B In one example, the terminal's IP address includes a first part 501 and a second part 502, both of which are 64 bits long. The application server's IP address includes a first part 503 and a second part 504, both of which are 64 bits long.

[0145] The second part 508 of the first virtual IP address is decrypted using key 506. From the decryption result, two items are selected from the first address generation sequence 505 and the second part 502 of the terminal IP address for a first XOR operation. The result of the first XOR operation is then XORed with the remaining items to obtain the second part 504 of the application server's IP address. The first part 503 of the application server's IP address is the same as the first part 507 of the first virtual IP address. The first part 503 of the application server's IP address and the second part 504 of the application server's IP address are combined to form the application server's IP address.

[0146] It should be understood that for three binary values ​​A, B, and C, A⊕B⊕C=B⊕C⊕A=A⊕C⊕B. ⊕ is the XOR operator.

[0147] It should be noted that the first and second parts can be extracted from the IP address according to the actual situation. For example, the first and second parts can be swapped, that is, the first part can be used for encryption and XOR operation. The length of the first and second parts is not limited to 64 bits, and can be set according to the actual situation. This application does not impose any restrictions.

[0148] After step 414, the application server can respond to the modified uplink data packet by sending a downlink data packet to the terminal. The network device can modify the destination address carried in the downlink data from the application server's IP address to the first virtual IP address, thus hiding the application server's real IP address.

[0149] See Figure 6 In an optional embodiment, the above method further includes:

[0150] Step 601: The network device receives a downlink data packet sent by the application server. The downlink data packet carries the application server's IP address, the terminal's IP address, the first address generation sequence, and the high-defense address identifier. When the network device detects that the downlink data packet carries the high-defense address identifier, it executes step 602.

[0151] Step 602: The network device generates a first virtual IP address based on the key, the terminal's IP address, the application server's IP address, and the first address generation sequence.

[0152] Specifically, the network device encrypts the second part of the application server's IP address using a key; it then performs an XOR operation on the second part of the terminal's IP address and the encrypted result, and finally combines the first part of the application server's IP address with the XOR result to form a first virtual IP address. Since the second part of different terminals' IP addresses differs, different virtual IP addresses are generated based on the IP addresses of different terminals. Using key encryption improves the security of the virtual IP address.

[0153] Step 603: The network device determines the address end time of the first virtual IP address based on the first address generation sequence.

[0154] Step 604: When the address end time is greater than the verification time, determine that the target time difference is equal to the address end time minus the verification time.

[0155] If the address end time is greater than the verification time, it indicates that the first virtual IP address has not expired. If the address end time is less than the verification time, it indicates that the first virtual IP address has expired, and step 608 can be executed or the downlink data packet can be discarded.

[0156] Step 605: The network device determines whether the target time difference is greater than the preset duration. If yes, proceed to step 606; otherwise, proceed to step 608.

[0157] The preset duration is related to the data transmission duration T between the terminal and the application server, and can be set according to the actual situation.

[0158] In one example, the preset duration is 2T. If the time difference between the verification time and the address end time is greater than 2T, it indicates that the next data transmission using the virtual IP address will not expire, therefore no change of the virtual IP address is needed. If the time difference between the verification time and the address end time is less than or equal to 2T, it indicates that the next data transmission using the virtual IP address will expire, and the virtual IP address needs to be changed. This allows for early replacement of the virtual IP address, preventing the virtual IP address of data packets from expiring.

[0159] Step 606: The network device generates a first downlink data packet based on the downlink data packet and the first virtual IP address.

[0160] Specifically, the network device modifies the source IP address of the downlink data packet from the application server's IP address to the first virtual IP address, thus obtaining the first downlink data packet. The source IP address of the downlink data packet is the application server's IP address, and the source IP address of the first downlink data packet is the first virtual IP address.

[0161] Step 607: The network device sends the first downlink data packet to the terminal.

[0162] Step 608: The network device obtains the second address generation sequence.

[0163] Step 609: The network device generates a second virtual IP address based on the key, the application server's IP address, the terminal's IP address, and the second address generation sequence.

[0164] Step 610: The network device generates a second downlink data packet based on the downlink data packet, the first virtual IP address, the second virtual IP address, and the address switching identifier.

[0165] Specifically, the network device modifies the source IP address of the downlink data packet from the application server's IP address to the first virtual IP address, and then adds a second virtual IP address, a second address generation sequence, and an address switching identifier to the downlink data packet, thus obtaining the second downlink data packet. The source IP address of the downlink data packet is the application server's IP address, and the source IP address of the second downlink data packet is the first virtual IP address. Furthermore, the second downlink data packet carries virtual address association information for the second virtual IP address, such as the second address generation sequence and the address switching identifier. The second address generation sequence includes the address generation time and the address lifespan of the second virtual IP address. The address switching identifier is used to change the destination IP address of the uplink data packet.

[0166] Step 611: The network device sends the second downlink data packet to the terminal.

[0167] After receiving the second downlink data packet, the terminal can, based on the address switching identifier, not generate an uplink data packet carrying the first virtual IP address and the first address generation sequence, but instead generate an uplink data packet carrying the second virtual IP address, the second address generation sequence, and the high-defense address identifier, and then execute step 612.

[0168] Step 612: The terminal sends uplink data packets to the network device.

[0169] After receiving the uplink data packet and detecting the high-defense address identifier, the network device executes step 613.

[0170] Step 613: The network device generates the application server's IP address based on the key, the terminal's IP address, the second virtual IP address, and the second address generation sequence.

[0171] Step 614: The network device changes the destination address of the uplink data packet from the second virtual IP address to the IP address of the application server.

[0172] Step 615: The network device sends the modified uplink data packet to the application server.

[0173] The first virtual IP address and the second virtual IP address represent virtual IP addresses for two time periods. When the second virtual IP address is about to expire, it can be replaced with another virtual IP address. The replacement process can be found in the relevant content described above.

[0174] In this embodiment, when the application server sends downlink data packets to the network device, the network device can modify the source IP address of the downlink data packets from the application server's IP address to the first virtual IP address, thereby hiding the application server's real IP address.

[0175] Secondly, since the first virtual IP address is related to the key, the terminal's IP address, the application server's IP address, and the address generation sequence, one application server can correspond to multiple virtual IP addresses. This can reduce the risk of being attacked by a large number of botnets after the virtual IP address is shared or resold in the existing communication method.

[0176] Furthermore, network devices can change virtual IP addresses based on their lifespan, thus improving their security. This method of changing virtual IP addresses does not require additional management equipment to manage and maintain them, making it simple and convenient.

[0177] In addition, this application allows for the early replacement of the virtual IP address to prevent it from expiring during data transmission. This ensures the continuity of the data flow.

[0178] See Figure 7 In another alternative embodiment, the above communication method further includes:

[0179] Step 701: The network device receives a downlink data packet sent by the application server. The downlink data packet carries the application server's IP address, the terminal's IP address, the first address generation sequence, and the high-defense address identifier. When the network device detects that the downlink data packet carries the high-defense address identifier, it executes step 702.

[0180] Step 702: The network device generates a first virtual IP address based on the key, the application server's IP address, the terminal's IP address, and the first address generation sequence.

[0181] Specifically, the network device encrypts the second part of the application server's IP address using a key; it then performs an XOR operation on the second part of the terminal's IP address and the encrypted result, and finally combines the first part of the application server's IP address with the XOR result to form a first virtual IP address. Since the second part of different terminals' IP addresses differs, different virtual IP addresses are generated based on the IP addresses of different terminals. Using key encryption improves the security of the virtual IP address.

[0182] Step 703: The network device determines the address end time of the first virtual IP address based on the first address generation sequence.

[0183] Step 704: When the address end time is greater than the verification time, determine that the target time difference is equal to the address end time minus the verification time.

[0184] If the address end time is greater than the verification time, it indicates that the first virtual IP address has not expired. If the address end time is less than the verification time, it indicates that the first virtual IP address has expired, and step 708 can be executed or the downlink data packet can be discarded.

[0185] Step 705: The network device determines whether the target time difference is greater than the preset duration. If yes, proceed to step 706; otherwise, proceed to step 708.

[0186] The preset duration is related to the data transmission duration T between the terminal and the application server, and can be set according to the actual situation.

[0187] In one example, the preset duration is 2T. If the time difference between the verification time and the address expiration time is greater than 2T, it indicates that the next data transmission using the virtual IP address will not expire, therefore the virtual IP address does not need to be changed. If the time difference between the verification time and the address expiration time is less than or equal to 2T, it indicates that the next data transmission using the virtual IP address will expire, and the virtual IP address needs to be changed.

[0188] Step 706: The network device generates a first downlink data packet based on the downlink data packet and the first virtual IP address.

[0189] Specifically, the network device modifies the source IP address of the downlink data packet from the application server's IP address to the first virtual IP address, thus obtaining the first downlink data packet. The source IP address of the downlink data packet is the application server's IP address, and the source IP address of the first downlink data packet is the first virtual IP address.

[0190] Step 707: The network device sends the first downlink data packet to the terminal.

[0191] Step 708: The network device obtains the second address generation sequence.

[0192] Step 709: The network device generates a second virtual IP address based on the key, the application server's IP address, the terminal's IP address, and the second address generation sequence.

[0193] Step 710: The network device generates an address switching notification carrying a second virtual IP address and a second address generation sequence.

[0194] Step 711: The network device sends an address switching notification to the terminal.

[0195] Address switching notifications are control plane messages. Upon receiving an address switching notification, the terminal can, based on the notification, not generate an uplink data packet carrying the first virtual IP address and the first address generation sequence, but instead generate an uplink data packet carrying the second virtual IP address, the second address generation sequence, and the high-protection address identifier, and then execute step 714. This allows for early replacement of the virtual IP address, preventing the virtual IP address of the data packet from expiring.

[0196] Step 712: The network device generates a first downlink data packet based on the downlink data packet and the first virtual IP address.

[0197] Specifically, the network device modifies the source IP address of the downlink data packet from the application server's IP address to the first virtual IP address to obtain the first downlink data packet.

[0198] Step 713: The network device sends the first downlink data packet to the terminal.

[0199] It should be noted that steps 712 to 713 are the process of sending the first downlink data packet, and steps 708 to 711 are the process of sending the address switching notification. The two processes are independent and have no fixed order.

[0200] Step 714: The terminal sends uplink data packets to the network device.

[0201] After receiving the uplink data packet and detecting the high-defense address identifier, the network device executes step 715.

[0202] Step 715: The network device generates the application server's IP address based on the key, the terminal's IP address, the second virtual IP address, and the second address generation sequence.

[0203] Step 716: The network device changes the destination address of the uplink data packet from the second virtual IP address to the IP address of the application server.

[0204] Step 717: The network device sends the modified uplink data packet to the application server.

[0205] In this embodiment, when the application server sends downlink data packets to the network device, the network device can modify the source IP address of the downlink data packets from the application server's IP address to the first virtual IP address, thereby hiding the application server's real IP address.

[0206] Secondly, since virtual IP addresses are related to keys, terminal IP addresses, application server IP addresses, and address generation sequences, one application server can correspond to multiple virtual IP addresses. This can reduce the risk of being attacked by a large number of botnets after virtual IP addresses are shared or resold in existing communication methods.

[0207] Furthermore, network devices can change virtual IP addresses based on their lifespan, thus improving their security. This method of changing virtual IP addresses does not require additional management equipment to manage and maintain them, making it simple and convenient.

[0208] In addition, this application provides a method for notifying the terminal to switch virtual IP addresses via control plane messages, which can prevent the virtual IP address from expiring during communication and make the implementation of the solution more flexible.

[0209] The first and second downlink data packets of this application are described below. (See also...) Figure 8 In one example, the first downlink data packet includes a header 81 and a payload 82. The header 81 includes a first virtual IP address 811, the terminal's IP address 812, and virtual address association information 813 for the first virtual address. The virtual address association information 813 for the first virtual address includes a high-defense address identifier, address generation sequence length, address generation sequence, address switching field, and additional fields.

[0210] See Figure 9 In one example, the second downlink data packet includes a header 91 and a payload 92. The header 91 includes a first virtual IP address 911, the terminal's IP address 912, and virtual address association information 913 for the second virtual address. The virtual address association information 913 for the second virtual address includes a high-defense address identifier, address generation sequence length, address generation sequence, address switching identifier, and the second virtual IP address.

[0211] In one example of this application, the `type` field indicates the address type. A value of 1 in the `type` field indicates a high-protection address identifier. A value of 0 in the `type` field indicates a non-high-protection address identifier.

[0212] The value of the RDLENGTH field indicates the length of the address generation sequence, which is 2 bytes.

[0213] The value of the RDATA field represents the address generation sequence, which is 128 bytes long.

[0214] The FLAG field represents the address switching field and is 1 byte long. A value of 1 in the FLAG field indicates an address switching flag. A value of 0 in the FLAG field indicates that the address is not switched.

[0215] The Additional Record field represents an additional field and is 128 bytes long. When the value of the FLAG field is 0, the value of the Additional Record field can be NULL, indicating no additional information. When the value of the FLAG field is 1, it indicates that the value of the Additional Record field is a second virtual IP address.

[0216] It should be understood that the content and length of each field in the virtual address association information are not limited to the examples above.

[0217] This application also provides an apparatus capable of implementing the above-described communication method. The network device of this application is capable of implementing the steps performed by the network device in the above embodiments. See also... Figure 10 In one embodiment, the network device 1000 of this application includes:

[0218] The receiving unit 1001 is used to receive uplink data packets sent by the terminal;

[0219] The processing unit 1002 is configured to, when detecting that an uplink data packet carries a high-defense address identifier, obtain the Internet Protocol (IP) address of the terminal and the first virtual IP address of the application server from the uplink data packet; obtain a key; generate a pending IP address based on the key, the terminal's IP address, and the first virtual IP address; determine that the uplink data packet is illegal when the pending IP address is not the application server's IP address; and modify the destination IP address of the uplink data packet from the first virtual IP address to the application server's IP address when the pending IP address is the application server's IP address.

[0220] The sending unit 1003 is used to send the modified uplink data packet to the application server.

[0221] In an optional embodiment, the uplink data packet further includes a first address generation sequence, which includes the address generation time of the first virtual IP address and the address lifespan of the first virtual address;

[0222] The processing unit 1002 is specifically used to generate an IP address to be processed based on the key, the terminal's IP address, the first virtual IP address, and the first address generation sequence.

[0223] In another alternative embodiment,

[0224] The receiving unit 1001 is also used to receive downlink data packets sent by the application server. The downlink data packets carry the IP address of the application server, the IP address of the terminal, the first address generation sequence, and the high-defense address identifier.

[0225] The processing unit 1002 is further configured to, when detecting that a downlink data packet carries a high-defense address identifier, generate a first virtual IP address based on the IP address of the application server, the IP address of the terminal, and a first address generation sequence; determine the address end time based on the address generation time and the address lifespan; when the address end time is greater than the verification time, determine that the target time difference is equal to the address end time minus the verification time; when the target time difference is greater than a preset duration, generate a first downlink data packet based on the downlink data packet and the first virtual IP address;

[0226] The sending unit 1003 is also used to send the first downlink data packet to the terminal.

[0227] In another optional embodiment, the processing unit 1002 is further configured to: obtain a second address generation sequence when the target time difference is less than or equal to a preset duration; the second address generation sequence includes the address generation time of the second virtual IP address and the address lifespan of the second virtual IP address; generate a second virtual IP address based on the key, the IP address of the application server, the IP address of the terminal, and the second address generation sequence; and generate a second downlink data packet based on the downlink data packet, the first virtual IP address, the second virtual IP address, and the address switching identifier, the second downlink data packet carrying the first virtual IP address, the second virtual IP address, and the address switching identifier, the address switching identifier being used to change the destination IP address of the uplink data packet;

[0228] The sending unit 1003 is also used to send a second downlink data packet to the terminal.

[0229] In another alternative embodiment,

[0230] The processing unit 1002 is also used to obtain a second address generation sequence, which includes the address generation time of the second virtual IP address and the address lifespan of the second virtual IP address; and to generate a second virtual IP address based on the key, the IP address of the application server, the IP address of the terminal, and the second address generation sequence.

[0231] The sending unit 1003 is also used to send an address switching notification to the terminal, which carries a second virtual IP address and a second address generation sequence. The address switching notification is used to change the destination IP address and address generation sequence of the uplink data packet.

[0232] The processing unit 1002 is also used to generate a first downlink data packet based on the downlink data packet and the first virtual IP address when the target time difference is less than or equal to a preset duration;

[0233] The sending unit 1003 is also used to send the first downlink data packet to the terminal.

[0234] In another optional embodiment, the processing unit 1002 is specifically configured to decrypt the second part of the first virtual IP address using a key; perform a first XOR operation on the second part of the terminal's IP address and the decryption result; perform a second XOR operation on the first address generation sequence and the result of the first XOR operation; and form the IP address to be processed by combining the first part of the first virtual IP address with the result of the second XOR operation.

[0235] In another alternative embodiment,

[0236] The receiving unit 1001 is also used to receive the IP address of the application server and the key corresponding to the IP address of the application server sent by the key management server.

[0237] The terminal of this application is capable of implementing the steps performed by the terminal in the above embodiments. See also... Figure 11 In one embodiment, terminal 1100 includes receiving unit 1101, processing unit 1102 and sending unit 1103.

[0238] Sending unit 1103 is used to send an address request message to a domain name system server, the address request message including a domain name;

[0239] The receiving unit 1101 is used to receive a response message sent by the Domain Name System server according to the address request message. The response message includes the first Virtual Internet Protocol IP address and the high-defense address identifier of the application server.

[0240] The processing unit 1102 generates an uplink data packet, which carries the terminal's IP address, the first virtual IP address, and the high-defense address identifier;

[0241] The sending unit 1103 is also used to send uplink data packets to network devices.

[0242] In an optional embodiment, the response message further includes a first address generation sequence, and the uplink data packet further includes a first address generation sequence, the first address generation sequence including the address generation time of the first virtual IP address and the address lifespan of the first virtual address.

[0243] In another alternative embodiment,

[0244] The receiving unit 1101 is also used to receive a first downlink data packet sent by the network device, the first downlink data packet carrying a first virtual IP address.

[0245] In another alternative embodiment,

[0246] The receiving unit 1101 is also used to receive a second downlink data packet sent by the network device. The second downlink data packet carries a first virtual IP address, a second virtual IP address, a second address generation sequence, and an address switching identifier.

[0247] Processing unit 1102 is also used to generate an uplink data packet carrying a second virtual IP address, a second address generation sequence, and a high-defense address identifier based on the address switching identifier.

[0248] In another alternative embodiment,

[0249] The receiving unit 1101 is also configured to receive a first downlink data packet and an address switching notification sent by the network device. The first downlink data packet carries a first virtual IP address, and the address switching notification includes a second virtual IP address and a second address generation sequence.

[0250] Processing unit 1102 is also used to generate an uplink data packet carrying a second virtual IP address, a second address generation sequence, and a high-defense address identifier based on the address switching notification.

[0251] The Domain Name System (DNS) server of this application can implement the steps performed by the DNS server in the above embodiments. See also... Figure 12 In one embodiment, the Domain Name System server 1200 includes:

[0252] The receiving unit 1201 is used to receive an address request message sent by the terminal, the address request message including a domain name;

[0253] Processing unit 1202 is used to obtain the key and the high-defense address identifier when the domain name is a high-defense domain name;

[0254] The processing unit 1202 is also used to generate a first virtual IP address based on the key, the terminal's IP address, and the application server's IP address;

[0255] The sending unit 1203 is used to send a response message to the terminal. The response message includes a first virtual IP address and a high-defense address identifier.

[0256] In one alternative embodiment,

[0257] The processing unit 1202 is specifically used to obtain a first address generation sequence, which includes the address generation time of the first virtual IP address and the address lifespan of the first virtual address; and to generate a first virtual IP address based on the key, the IP address of the terminal, the IP address of the application server, and the first address generation sequence.

[0258] In another alternative embodiment,

[0259] The processing unit 1202 is specifically used to perform a first XOR operation on the second part of the terminal's IP address and the second part of the application server's IP address; perform a second XOR operation on the first address generation sequence and the result of the first XOR operation; encrypt the result of the second XOR operation using a key; and form a first virtual IP address by combining the encrypted result with the first part of the application server's IP address.

[0260] The following section describes the network devices, terminals, and domain name resolution server of this application from a hardware perspective. (See also...) Figure 13 In one embodiment, the network device 1300 of this application includes a processor 1301, a memory 1302, and a communication interface 1303. The number of processors 1301, memory 1302, and communication interfaces 1303 can be one or more. The processor 1301 and memory 1302 are connected via a bus 1304, and the processor 1301 and communication interface 1303 are connected via a bus 1305.

[0261] In this embodiment, the processor 1301 may be a central processing unit (CPU) or another application-specific integrated circuit (ASIC). The processor 1301 may also be another general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0262] Memory 1302 is the main memory of network device 1300. Dynamic Random Access Memory (DRAM) is typically used as memory 1302. Processor 1301 can access memory 1302 at high speed through the memory controller, performing read and write operations on any storage unit within memory 1302. Besides DRAM, memory 1302 can also be other random access memories, such as Static Random Access Memory (SRAM). Alternatively, memory 1302 can also be read-only memory (ROM). For example, read-only memory could be programmable read-only memory (PROM) or erasable programmable read-only memory (EPROM). This embodiment does not limit the number or type of memory 1302. Furthermore, memory 1302 can be configured to have a power-saving function. The power-saving function means that when the system experiences a power outage and is then powered on again, the data stored in the memory will not be lost. The memory 1302 with power-saving function is called non-volatile memory.

[0263] Communication interface 1303 is used for communication with other devices. Communication interface 1303 can receive uplink data or send downlink data. Bus 1304 may be, but is not limited to, a double data rate (DDR) bus, and bus 1305 may be, but is not limited to, a PCIe bus.

[0264] In this embodiment, memory 1302 is used to store programs, and processor 1301 can execute the steps performed by the network device in the above embodiment by calling the programs stored in memory 1302.

[0265] See Figure 14 In another embodiment, the terminal 1400 of this application includes a processor 1401 and memory 1404. The processor 1401 is connected to the memory 1404 via a DDR bus 1403. Here, different memory modules 1404 may use different data buses to communicate with the processor 1401, therefore the DDR bus 1403 can also be replaced with other types of data buses. This embodiment of the application does not limit the type of bus. In addition, the terminal 1400 also includes various input / output devices, and the processor 1401 can access these input / output devices 1407 via a PCIe bus 1405.

[0266] Processor 1401 is the computing and control core of computing device 1400. Processor 1401 may include one or more processing cores 1402. Processor 1401 may be a very large-scale integrated circuit. An operating system and other software programs are installed in processor 1401, enabling processor 1401 to access memory 1404 and various PCIe devices. In this embodiment, the processing core 1402 in processor 1401 may be, for example, a CPU or an ASIC. Processor 1401 may also be other general-purpose processors, DSPs, ASICs, FPGAs, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. In practical applications, terminal 1400 may also include multiple processors.

[0267] The memory controller is a bus circuit controller within the terminal 1400 that controls the memory 1404 and manages and plans the data transfer between the memory 1404 and the processing core 1402. Data can be exchanged between the memory 1404 and the processing core 1402 through the memory controller. The memory controller can be a separate chip connected to the processing core 1402 via the system bus. Those skilled in the art will understand that the memory controller can also be integrated into the processor 1401, built into the northbridge, or be a separate memory controller chip. This application does not limit the specific location or form of the memory controller. In practical applications, the memory controller can control the necessary logic to write data to or read data from the memory 1404. The memory controller 1404 can be a memory controller in a processor system such as a general-purpose processor, a dedicated accelerator, a GPU, an FPGA, or an embedded processor.

[0268] Memory 1404 is the main memory of terminal 1400. Memory 1404 is typically used to store various running software, input and output data, and information exchanged with external storage in the operating system. To improve the access speed of processor 1401, memory 1404 needs to have a high access speed. In traditional computer system architectures, DRAM is typically used as memory 1404. Processor 1401 can access memory 1404 at high speed through the memory controller, performing read and write operations on any storage unit in memory 1404. In addition to DRAM, memory 1404 can also be other random access memory, such as SRAM. Alternatively, memory 1404 can also be ROM. For read-only memory, for example, it can be PROM, EPROM, etc. This embodiment does not limit the number or type of memory 1404. Furthermore, memory 1404 can be configured to have a power-saving function. The power-saving function means that when the system loses power and then regains power, the data stored in the memory will not be lost. Memory 1404 with a power-saving function is called non-volatile memory.

[0269] Input / output (I / O) devices 1407 refer to hardware capable of data transmission, or devices that interface with I / O interfaces. Common I / O devices include network cards, printers, keyboards, and mice. All external storage devices can also be used as I / O devices, such as hard drives, floppy disks, and optical discs. The processor 1401 can access each input / output 1407 via the PCIe bus 1405. It should be noted that the PCIe bus 1405 is just one example and can be replaced with other buses, such as the unified bus (UB) bus.

[0270] The Baseboard Management Controller (BMC) 1406 can perform firmware upgrades, manage the device's operating status, and troubleshoot faults. The processor 1401 can access the BMC 1406 via a PCIe bus or a bus such as USB or I2C. The BMC 1406 can also be connected to at least one sensor. The sensor acquires terminal status data, including temperature, current, and voltage data. This application does not impose specific limitations on the type of status data. The BMC 1406 communicates with the processor 1401 via a PCIe bus or other types of buses, for example, by passing the acquired status data to the processor 1401 for processing. The BMC 1406 can also maintain the program code in the memory 1404, including upgrading or restoring it. The BMC 1406 can also control the power supply circuit or clock circuit within the terminal 1400. In summary, the BMC 1406 can manage the terminal 1400 in the above ways. However, the BMC 1406 is only an optional device. In some implementations, the processor 1401 can communicate directly with the sensors, thereby enabling direct management and maintenance of the terminal.

[0271] In this embodiment, memory 1404 is used to store programs. By calling the programs stored in memory 1404, processor 1401 executes the steps performed by the terminal in the above embodiment.

[0272] This application provides a Domain Name System (DNS) server 1500 capable of performing the steps executed by the DNS server in the above embodiments. Figure 15 This is a schematic diagram of the structure of a Domain Name System server provided in an embodiment of this application. (See attached diagram.) Figure 15 The Domain Name System (DNS) server 1500 can vary significantly due to differences in configuration or performance, and may include one or more central processing units (CPUs) 1522 and memory 1532, and one or more storage media 1530 (e.g., one or more mass storage devices) for storing applications 1542 or data 1544. The memory 1532 and storage media 1530 can be temporary or persistent storage. Programs stored in the storage media 1530 may include one or more modules, each module including a series of instruction operations on the DNS server. Furthermore, the CPU 1522 may be configured to communicate with the storage media 1530 and execute the series of instruction operations in the storage media 1530 on the DNS server 1500.

[0273] The Domain Name System server 1500 may also include one or more power supplies 1526, one or more wired or wireless network interfaces 1550, one or more input / output interfaces 1558, and / or one or more operating systems 1541, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0274] It should be noted that the information interaction and execution process between the modules / units of the above-mentioned device are based on the same concept as the method embodiments of this application, and the resulting technical effects are the same as those of the method embodiments of this application. For details, please refer to the description in the foregoing method embodiments of this application, and will not be repeated here.

[0275] This application provides a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform the communication method described in the above embodiments or optional embodiments.

[0276] This application also provides a computer program product that, when run on a computer, causes the computer to perform the communication method as described in the above embodiments or alternative embodiments.

[0277] This application also provides a chip system comprising a processor and a memory coupled to each other. The memory stores computer programs or instructions, and the processing unit executes the computer programs or instructions stored in the memory to cause the device to perform the steps performed by the network device, terminal, or domain name system server in the above embodiments. Optionally, the memory is on-chip memory, such as registers, caches, etc. The memory can also be off-chip memory within a site, such as read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, random access memory (RAM), etc. The processor mentioned above can be a general-purpose central processing unit, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for implementing the above communication methods.

[0278] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided in this application, the connection relationships between modules indicate that they have communication connections, which can specifically be implemented as one or more communication buses or signal lines.

[0279] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, and of course, it can also be implemented by special hardware including application-specific integrated circuits, special CPUs, special memory, special components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of this application.

[0280] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0281] A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)).

Claims

1. A communication method, characterized in that, include: Receive uplink data packets sent by the receiving terminal; When the uplink data packet is detected to carry a high-defense address identifier, the Internet Protocol IP address of the terminal and the first virtual IP address of the application server are obtained from the uplink data packet; Obtain the key; Based on the key, the IP address of the terminal carried in the uplink data packet and the first virtual IP address are used to generate an IP address to be processed; When the IP address to be processed is not the IP address of the application server, the uplink data packet is determined to be invalid; When the IP address to be processed is the IP address of the application server, the destination IP address of the uplink data packet is modified from the first virtual IP address to the IP address of the application server, and the modified uplink data packet is sent to the application server.

2. The method according to claim 1, characterized in that, The uplink data packet also includes a first address generation sequence, which includes the address generation time of the first virtual IP address and the address lifespan of the first virtual IP address; The step of generating the IP address to be processed based on the key, the terminal's IP address, and the first virtual IP address includes: The IP address to be processed is generated based on the key, the terminal's IP address, the first virtual IP address, and the first address generation sequence.

3. The method according to claim 2, characterized in that, The method further includes: Receive downlink data packets sent by the application server, the downlink data packets carrying the IP address of the application server, the IP address of the terminal, the first address generation sequence and the high-defense address identifier; When the downlink data packet is detected to carry a high-defense address identifier, the first virtual IP address is generated based on the key, the IP address of the application server, the IP address of the terminal, and the first address generation sequence. The address end time of the first virtual IP address is determined based on the first address generation sequence; When the address end time is greater than the verification time, the target time difference is determined to be equal to the address end time minus the verification time; When the target time difference is greater than a preset duration, a first downlink data packet is generated based on the downlink data packet and the first virtual IP address, and the first downlink data packet is sent to the terminal.

4. The method according to claim 3, characterized in that, The method further includes: When the target time difference is less than or equal to a preset duration, a second address generation sequence is obtained, the second address generation sequence including the address generation time of the second virtual IP address and the address lifespan of the second virtual IP address; a second virtual IP address is generated according to the key, the IP address of the application server, the IP address of the terminal, and the second address generation sequence; a second downlink data packet is generated according to the downlink data packet, the first virtual IP address, the second virtual IP address, the second address generation sequence, and the address switching identifier, and the second downlink data packet is sent to the terminal.

5. The method according to claim 3, characterized in that, The method further includes: When the target time difference is less than or equal to a preset duration, a second address generation sequence is obtained, the second address generation sequence including the address generation time of the second virtual IP address and the address lifespan of the second virtual IP address; a second virtual IP address is generated according to the key, the IP address of the application server, the IP address of the terminal, and the second address generation sequence; an address switching notification carrying the second virtual IP address and the second address generation sequence is sent to the terminal. A first downlink data packet is generated based on the downlink data packet and the first virtual IP address, and the first downlink data packet is sent to the terminal.

6. The method according to any one of claims 2 to 5, characterized in that, The step of generating the IP address to be processed based on the key, the terminal's IP address, the first virtual IP address, and the first address generation sequence includes: Use the key to decrypt the second part of the first virtual IP address; Perform a first XOR operation on the second part of the terminal's IP address and the decryption result; Perform a second XOR operation on the sequence generated from the first address and the result of the first XOR operation. The first part of the first virtual IP address is combined with the result of the second XOR operation to form the IP address to be processed.

7. The method according to any one of claims 1 to 5, characterized in that, Prior to obtaining the key, the method further includes: The application server's IP address and the key corresponding to the application server's IP address are sent by the key management server.

8. A communication method, characterized in that, include: Send an address request message to a Domain Name System server, the address request message including a domain name; The system receives a response message sent by the Domain Name System server based on the address request message. The response message includes the application server's first virtual Internet Protocol (IP) address and a high-defense address identifier. The application server's first virtual IP address is generated based on a key, the terminal's IP address, and the application server's IP address. An uplink data packet is generated, carrying the IP address of the terminal, the first virtual IP address of the application server, and a high-defense address identifier. The key, the IP address of the terminal, and the first virtual IP address of the application server are used by the network device to generate a pending IP address. If the pending IP address is different from the IP address of the application server, the uplink data packet is determined to be invalid; if the pending IP address is the same as the IP address of the application server, the uplink data packet is determined to be valid. Send uplink data packets to network devices.

9. The method according to claim 8, characterized in that, The response message also includes a first address generation sequence, and the uplink data packet also includes a first address generation sequence, wherein the first address generation sequence includes the address generation time of the first virtual IP address and the address lifespan of the first virtual IP address.

10. The method according to claim 8 or 9, characterized in that, The method further includes: The network device receives a first downlink data packet, the first downlink data packet carrying a first virtual IP address.

11. The method according to claim 9, characterized in that, The method further includes: The network device receives a second downlink data packet, which carries a first virtual IP address, a second virtual IP address, a second address generation sequence, and an address switching identifier. The second address generation sequence includes the address generation time and address lifespan of the second virtual IP address. An uplink data packet carrying the second virtual IP address, the second address generation sequence, and the high-defense address identifier is generated based on the address switching identifier.

12. The method according to claim 9, characterized in that, The method further includes: The network device receives a first downlink data packet and an address switching notification, wherein the first downlink data packet carries a first virtual IP address and the address switching notification includes a second virtual IP address and a second address generation sequence. An uplink data packet carrying a second virtual IP address, a second address generation sequence, and a high-defense address identifier is generated based on the address switching notification.

13. A communication method, characterized in that, include: The terminal receives an address request message, which includes a domain name. When the domain name is a high-defense domain name, obtain the key and high-defense address identifier; Based on the key, the IP address of the terminal and the IP address of the application server are used to generate a first virtual Internet Protocol (IP) address; A response message is sent to the terminal, the response message including the first virtual IP address and the high-defense address identifier.

14. The method according to claim 13, characterized in that, The step of generating a first virtual IP address based on the key, the IP address of the terminal, and the IP address of the application server includes: Obtain a first address generation sequence, the first address generation sequence including the address generation time of the first virtual IP address and the address lifespan of the first virtual IP address; Based on the key, a first virtual IP address is generated by combining the terminal's IP address, the application server's IP address, and the first address generation sequence.

15. The method according to claim 14, characterized in that, The step of generating a first virtual IP address based on the key, the IP address of the terminal, the IP address of the application server, and the first address to generate a sequence includes: Perform a first XOR operation between the second part of the terminal's IP address and the second part of the application server's IP address; Perform a second XOR operation on the sequence generated from the first address and the result of the first XOR operation. The result of the second XOR operation is encrypted using the key. The encryption result is combined with the first part of the application server's IP address to form a first virtual IP address.

16. A network device, characterized in that, include: The receiving unit is used to receive uplink data packets sent by the terminal; The processing unit is configured to obtain the Internet Protocol IP address of the terminal and the first virtual IP address of the application server from the uplink data packet when the uplink data packet is detected to carry a high-defense address identifier; The processing unit is also used to obtain a key; The processing unit is further configured to generate an IP address to be processed based on the key, the IP address of the terminal, and the first virtual IP address; The processing unit is further configured to determine that the uplink data packet is invalid when the IP address to be processed is not the IP address of the application server; and to modify the destination IP address of the uplink data packet from the first virtual IP address to the IP address of the application server when the IP address to be processed is the IP address of the application server. The sending unit is used to send the modified uplink data packet to the application server.

17. The network device according to claim 16, characterized in that, The uplink data packet also includes a first address generation sequence, which includes the address generation time of the first virtual IP address and the address lifespan of the first virtual IP address; The processing unit is specifically used to generate an IP address to be processed based on the key, the IP address of the terminal, the first virtual IP address, and the first address generation sequence.

18. The network device according to claim 17, characterized in that, The receiving unit is further configured to receive downlink data packets sent by the application server, the downlink data packets carrying the IP address of the application server, the IP address of the terminal, the first address generation sequence, and the high-defense address identifier; The processing unit is further configured to generate the first virtual IP address based on the IP address of the application server, the IP address of the terminal, and the first address generation sequence when the downlink data packet is detected to carry a high-defense address identifier; The processing unit is further configured to determine the address end time based on the address generation time and the address lifetime; when the address end time is greater than the verification time, the target time difference is determined to be equal to the address end time minus the verification time. The processing unit is further configured to generate a first downlink data packet based on the downlink data packet and the first virtual IP address when the target time difference is greater than a preset duration; The sending unit is also used to send the first downlink data packet to the terminal.

19. The network device according to claim 18, characterized in that, The processing unit is further configured to obtain a second address generation sequence when the target time difference is less than or equal to a preset duration, wherein the second address generation sequence includes the address generation time of the second virtual IP address and the address lifespan of the second virtual IP address; A second virtual IP address is generated based on the key, the application server's IP address, the terminal's IP address, and the second address generation sequence; a second downlink data packet is generated based on the downlink data packet, the first virtual IP address, the second virtual IP address, and the address switching identifier. The sending unit is also used to send a second downlink data packet to the terminal.

20. The network device according to claim 18, characterized in that, The processing unit is further configured to obtain a second address generation sequence when the target time difference is less than or equal to a preset duration, wherein the second address generation sequence includes the address generation time of the second virtual IP address and the address lifespan of the second virtual IP address; A second virtual IP address is generated based on the key, the application server's IP address, the terminal's IP address, and the second address generation sequence; The sending unit is also used to send an address switching notification to the terminal, which carries a second virtual IP address and a second address generation sequence. The processing unit is further configured to generate a first downlink data packet based on the downlink data packet and the first virtual IP address; The sending unit is further configured to send the first downlink data packet to the terminal.

21. The network device according to any one of claims 17 to 20, characterized in that, The processing unit is specifically used to decrypt the second part of the first virtual IP address using the key; perform a first XOR operation on the second part of the terminal's IP address and the decryption result; and perform a second XOR operation on the first address generation sequence and the result of the first XOR operation. The first part of the first virtual IP address is combined with the result of the second XOR operation to form the IP address to be processed.

22. The network device according to any one of claims 16 to 20, characterized in that, The receiving unit is also used to receive the IP address of the application server and the key corresponding to the IP address of the application server sent by the key management server.

23. A terminal, characterized in that, include: A sending unit is configured to send an address request message to a Domain Name System server, the address request message including a domain name; A receiving unit is configured to receive a response message sent by the Domain Name System server in accordance with the address request message. The response message includes a first virtual Internet Protocol (IP) address and a high-defense address identifier of the application server. The first virtual IP address of the application server is generated based on a key, the IP address of the terminal, and the IP address of the application server. A processing unit is used to generate an uplink data packet, which carries the IP address of the terminal, the first virtual IP address of the application server, and a high-defense address identifier. The key, the IP address of the terminal, and the first virtual IP address of the application server are used by the network device to generate a pending IP address. If the pending IP address is different from the IP address of the application server, the uplink data packet is determined to be invalid; if the pending IP address is the same as the IP address of the application server, the uplink data packet is determined to be valid. The sending unit is also used to send uplink data packets to the network device.

24. The terminal according to claim 23, characterized in that, The response message also includes a first address generation sequence, and the uplink data packet also includes a first address generation sequence, wherein the first address generation sequence includes the address generation time of the first virtual IP address and the address lifespan of the first virtual IP address.

25. The terminal according to claim 23 or 24, characterized in that, The receiving unit is further configured to receive a first downlink data packet sent by the network device, the first downlink data packet carrying a first virtual IP address.

26. The terminal according to claim 24, characterized in that, The receiving unit is further configured to receive a second downlink data packet sent by the network device, the second downlink data packet carrying a first virtual IP address, a second virtual IP address, a second address generation sequence and an address switching identifier; The processing unit is further configured to generate an uplink data packet carrying the second virtual IP address, the second address generation sequence, and the high-defense address identifier based on the address switching identifier.

27. The terminal according to claim 24, characterized in that, The receiving unit is further configured to receive a first downlink data packet and an address switching notification sent by the network device, wherein the first downlink data packet carries a first virtual IP address and the address switching notification includes a second virtual IP address and a second address generation sequence; The processing unit is further configured to generate an uplink data packet carrying a second virtual IP address, a second address generation sequence, and a high-defense address identifier based on the address switching notification.

28. A Domain Name System (DNS) server, characterized in that, include: A receiving unit is configured to receive an address request message sent by a terminal, wherein the address request message includes a domain name; The processing unit is used to obtain the key and the high-defense address identifier when the domain name is a high-defense domain name; The processing unit is further configured to generate a first virtual IP address based on the key, the IP address of the terminal, and the Internet Protocol IP address of the application server; The sending unit is used to send a response message to the terminal, the response message including the first virtual IP address and the high-defense address identifier.

29. The Domain Name System server according to claim 28, characterized in that, The processing unit is specifically used to obtain a first address generation sequence, the first address generation sequence including the address generation time of the first virtual IP address and the address lifespan of the first virtual IP address; and to generate a first virtual IP address based on the key, the IP address of the terminal, the IP address of the application server, and the first address generation sequence.

30. The Domain Name System server according to claim 29, characterized in that, The processing unit is specifically used to perform a first XOR operation on the second part of the IP address of the terminal and the second part of the IP address of the application server; and to perform a second XOR operation on the first address generation sequence and the result of the first XOR operation. The key is used to encrypt the result of the second XOR operation; the encrypted result is then combined with the first part of the application server's IP address to form a first virtual IP address.

31. A computer-readable storage medium storing instructions, characterized in that, When it is run on a computer, it causes the computer to perform the method of any one of claims 1 to 15.

32. A computer program product, characterized in that, Includes instructions that, when executed on a computer, cause the computer to perform the method of any one of claims 1 to 15.

Images