IP address retrieval method and apparatus, and storage medium

Abstract

The application discloses an IP address retrieval method and device and a storage medium, and relates to the field of computer networks. The method specifically comprises the following steps: an electronic device acquires a first information set, wherein the first information set is a set of strings obtained by encrypting each segment of a target IP address after segmenting the target IP address, N encrypted strings are obtained after segmenting the target IP address, and N is a positive integer greater than 1. The electronic device performs retrieval in an IP address library according to N-1 encrypted strings of the first information set, and obtains a plurality of second information sets, wherein one second information set is a set of strings obtained by encrypting each segment of one IP address after segmenting the one IP address, and IP addresses corresponding to the plurality of second information sets are IP addresses of the same network segment as the target IP address. The electronic device determines that the target IP address exists in the IP address library according to the plurality of second information sets. The method can improve the retrieval efficiency of IP addresses.

Description

Technical Field

[0001] This invention relates to the field of computer networks, and in particular to an IP address retrieval method, apparatus, and storage medium. Background Technology

[0002] Internet Protocol (IP) addresses are used to represent the logical addresses of hosts and servers on the Internet. Servers provide network services to hosts, and users can access servers on the Internet through their hosts. Servers can use IP addresses to determine the geographical location information of a host, such as its home location and latitude / longitude. To ensure service security, servers can use the host's geographical location information to determine whether a host's access constitutes a network attack; if so, they can block it.

[0003] When determining whether a host access constitutes a network attack, the IP address obtained from the server can be searched in a pre-built IP address database. The geographical location information of the retrieved IP address can then be determined. However, because IP addresses are typically encrypted during the pre-built IP address database construction to prevent information leakage, the current retrieval process primarily relies on polling for decryption, resulting in low retrieval efficiency. Summary of the Invention

[0004] This application provides an IP address retrieval method, apparatus, and storage medium to improve the efficiency of IP address retrieval.

[0005] Firstly, this application provides an IP address retrieval method. This method can be applied to electronic devices with processing capabilities. Specifically, the method includes: the electronic device acquiring a first information set, wherein the first information set is a set of strings obtained by encrypting each segment after segmenting a target IP address, and N encrypted strings are obtained after segmenting the target IP address, where N is a positive integer greater than 1. The electronic device searches an IP address database based on the N-1 encrypted strings of the first information set to obtain multiple second information sets, wherein each second information set is a set of strings obtained by encrypting each segment after segmenting an IP address, and the IP addresses corresponding to the multiple second information sets are IP addresses in the same network segment as the target IP address. The electronic device determines that the target IP address exists in the IP address database based on the multiple second information sets.

[0006] In this embodiment, since multiple IP addresses from different network segments are obtained when constructing the IP address database, the first few bits of IP addresses within the same network segment are identical. These IP addresses can be segmented and encrypted. Segmentation allows for the separation and encryption of the network and host numbers of the IP address. When retrieving a target IP address from this IP address database, the same segmented encryption process is applied to the target IP address, and the search is performed based on the N-1 encrypted strings obtained from the first information set, i.e., by the network number of the target IP address. In this way, the electronic device can quickly retrieve IP addresses within the same network segment as the target IP address and determine whether the target IP address exists in the IP address database for that network segment. By segmenting and encrypting the IP address, only N-1 encrypted strings need to be obtained for retrieval, which is more efficient than the traditional method of polling the IP address database for decryption and comparison.

[0007] Optionally, before obtaining the first information set, the method further includes: the electronic device obtaining the target IP address, dividing the target IP address into N segments according to the delimiter of the target IP address, and encrypting each of the N segments to obtain N encrypted strings. The electronic device determines the first information set based on the N encrypted strings, wherein the order of the N encrypted strings in the first information set is the same as the order of the N segments in the target IP address.

[0008] Optionally, before obtaining the first information set, the method further includes: the electronic device marking the first information set as a first type according to the type of the target IP address, wherein the number of delimiters is different for different types of IP addresses.

[0009] In this embodiment of the application, the type of the target IP address can be marked before retrieving it. Since there are different types of IP addresses in the IP address database, marking the type of IP address can distinguish between them.

[0010] Optionally, the electronic device performs a search in an IP address database based on the N-1 encrypted strings of the first information set, including: the electronic device searching the IP address database for a first type of information set to obtain at least one second information set; and the electronic device retrieving a second information set including the first N-1 strings from at least one second information set based on the first information set.

[0011] In this embodiment, when the electronic device performs a search based on the first information set, it can first perform a preliminary search based on the type of the first information set, i.e., the type of the target IP address, to obtain at least one second information set. The electronic device then searches for the at least one second information set based on the first N-1 strings of the first information set, which can improve search efficiency.

[0012] Optionally, the electronic device determines that the target IP address exists in the IP address database based on multiple sets of second information, including: the electronic device decrypts the multiple sets of second information to obtain multiple IP addresses corresponding to the multiple sets of second information. The electronic device determines that the target IP address exists among the multiple IP addresses.

[0013] In this embodiment, the electronic device decrypts multiple sets of second information retrieved to obtain multiple IP addresses corresponding to the multiple sets of second information, thus determining whether a target IP address exists among the multiple IP addresses. By decrypting only the retrieved sets of second information, decryption of all information sets in the IP address database is avoided, thereby improving the efficiency of IP address retrieval.

[0014] Optionally, if the target IP address does not exist in the IP address database, the method further includes: the electronic device outputting a prompt message indicating that the target IP address does not exist in the IP address database.

[0015] Optionally, after determining that a target IP address exists in the IP address database based on multiple sets of IP address information, the method further includes: the electronic device determining whether the target IP address corresponds to an attack source based on the geographical location information associated with the target IP address in the IP address database. If the target IP address corresponds to an attack source, the target IP address is marked.

[0016] Secondly, this application provides an IP address retrieval device. The device includes an acquisition module, a retrieval module, and a determination module. The acquisition module acquires a first information set, which is a set of strings obtained by encrypting each segment after segmenting a target IP address. N encrypted strings are obtained after segmenting the target IP address, where N is a positive integer greater than 1. The retrieval module searches an IP address database based on the N-1 encrypted strings in the first information set to obtain multiple second information sets. Each second information set is a set of strings obtained by encrypting each segment after segmenting an IP address. The IP addresses corresponding to the multiple second information sets are IP addresses in the same network segment as the target IP address. The determination module determines that the target IP address exists in the IP address database based on the multiple second information sets.

[0017] Optionally, the acquisition module is further configured to: acquire the target IP address, divide the target IP address into N segments according to the delimiter of the target IP address, and encrypt each of the N segments to obtain N encrypted strings. A first information set is determined based on the N encrypted strings, wherein the order of the N encrypted strings in the first information set is the same as the order of the N segments in the target IP address.

[0018] Optionally, the acquisition module is also used to: mark the first information set as a first type according to the type of the target IP address, wherein the number of delimiters is different for different types of IP addresses.

[0019] Optionally, the retrieval module is specifically used to: retrieve a first type of information set from the IP address database to obtain at least one second information set; and retrieve a second information set including the first N-1 strings from at least one second information set based on the first information set.

[0020] Optionally, the determining module is specifically used to: decrypt multiple sets of second information to obtain multiple IP addresses corresponding to the multiple sets of second information; and determine that the target IP address exists among the multiple IP addresses.

[0021] Optionally, the determination module is also used to: output a prompt message indicating that the target IP address does not exist in the IP address database.

[0022] Optionally, the determination module is also used to: determine whether the target IP address corresponds to an attack source based on the geographical location information associated with the target IP address in the IP address database. If the target IP address corresponds to an attack source, the target IP address is marked.

[0023] Thirdly, embodiments of this application provide an electronic device including a processor and a memory communicatively connected to the processor. The memory stores computer-executable instructions, which are executed by the processor to enable the processor to perform the method described in any one of the first aspects above.

[0024] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, cause the processor to perform the method described in any one of the first aspects.

[0025] Fifthly, embodiments of this application provide a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor can read the computer program from the computer-readable storage medium, and when the processor executes the computer program, it can implement the method described in any one of the first aspects above. Attached Figure Description

[0026] Figure 1 A schematic diagram of the system architecture for the IP address retrieval method provided in the embodiments of this application;

[0027] Figure 2 A flowchart illustrating the IP address retrieval method provided in this application embodiment;

[0028] Figure 3Another flowchart illustrating the IP address retrieval method provided in this application embodiment;

[0029] Figure 4 This is a schematic diagram of the structure of the IP address retrieval device provided in the embodiments of this application;

[0030] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0031] This application relates to IP address retrieval. To facilitate understanding of the solutions provided in the embodiments of this application, some technical concepts involved in the embodiments of this application are first introduced. It should be noted that in the technical solutions of this application, the collection, dissemination, and use of data all comply with the requirements of relevant national laws and regulations.

[0032] 1) IP address types can include IPv4 and IPv6. IPv4 typically uses decimal dotted notation to divide the address into four segments, for example, 192.18.18.1. IPv6 includes compressed, extended, and standard formats. An IP address can be set to the standard format, such as 240e:f7:4f00:2000:0:0:0:3a / 56.

[0033] 2) A subnet mask, also known as a network mask or address mask, is typically used in conjunction with an IP address. The subnet mask is the same length as the IP address, including network bits and host bits. The network bits are all 1s, and the host bits are all 0s. The subnet mask divides an IP address into two parts: the network address and the host address. The network address identifies the subnet to which the IP address belongs, and the host address identifies the host to which the IP address belongs. The network address can be called the network number of the subnet to which the IP address belongs, and the host address can be called the host number of the host to which the IP address belongs.

[0034] Subnet masks are used to determine whether different hosts are on the same network segment (within the same Ethernet broadcast domain), enabling different routing. When one host sends an IP packet to another, the packet header contains a probe IP address and a destination IP address. A network address is obtained by bitwise ANDing the probe IP address with the subnet mask, and another network address is obtained by bitwise ANDing the destination IP address with the subnet mask. If the two network addresses are the same, it indicates that the two hosts are on the same network segment, and the IP packet does not need to be forwarded through a gateway. If the two network addresses are different, it indicates that the two hosts are not on the same network segment, and the IP packet needs to be sent to a gateway for forwarding.

[0035] 3) Network segment, which includes a group of IP addresses with the same network address. For example, in the IP address "192.18.18.1 / 24", "24" represents the subnet mask. From this subnet mask, we can determine the first 24 bits of the binary number corresponding to "192.18.18.1 / 24", which identifies the network address, i.e., "192.18.18". Therefore, IP addresses whose first three bits are "192.18.18" share the same network address as "192.18.18.1 / 24", meaning they belong to the same network segment. The range of usable IP addresses in this segment is 192.18.18.1 to 192.18.18.254.

[0036] 4) Geographic location information includes the latitude and longitude of the IP address, country, province, city, time zone, ISP, ASN, whether it is a high-risk IP, attack methods, system to which it belongs, open ports, malicious behavior, etc.

[0037] As mentioned earlier, a large number of hosts can access the server via the Internet. Correspondingly, the server can determine the geographical location of a host based on its IP address. To ensure the secure operation of the server, it is necessary to identify and block attack sources from among these hosts. Typically, this can be done by searching a pre-built IP address database on the server using a host's IP address (the target IP address). Since the IP address database pre-stores the mapping relationship between IP addresses and geographical location information, if the target IP address exists in the database, its geographical location information can be determined based on this mapping. Furthermore, this geographical location information can be used to determine whether the host corresponds to the attack source. When pre-building the IP address database, the server needs to encrypt the IP addresses to prevent information leakage. Typically, the entire IP address is encrypted and stored during database construction. Because the IP addresses used in the database construction include a subnet mask to identify the network number of the IP address, the encrypted string obtained after encrypting the stored IP address is different from the encrypted string of the actual IP address. For example, the IP address used to build the IP address database might be "192.18.18.1 / 24," but the encrypted result of the actual IP address "192.18.18.1" is different. This means that when the server searches for the target IP address "192.18.18.1," it cannot directly retrieve the corresponding IP address using the encrypted string of the target IP address. Instead, it needs to poll the encrypted IP addresses in the database, decrypt each retrieved IP address, and then determine whether the target IP address exists in the database based on the decrypted IP address. Because this search is done by comparing each address one by one, the search efficiency is low.

[0038] Therefore, this application provides an IP address retrieval method. When constructing an IP address database, IP addresses are segmented and encrypted, and multiple sets of information obtained are stored. The target IP address is also segmented to obtain N encrypted strings. During retrieval, the N-1 encrypted strings are used to search the IP address database, and the presence of the IP address in the database is determined based on the retrieved sets of information. Segmenting the IP address improves retrieval efficiency.

[0039] Please see Figure 1 This diagram illustrates the system architecture applicable to the IP address retrieval method provided in this application. Hosts 1, 2, ..., n establish connections with the server via a network, and can initiate access requests to the server through the network. For example, hosts 1, 2, ..., n can request access to a web page running on the server. Hosts 1, 2, ..., n have different IP addresses. The server can retrieve these IP addresses from an IP address database based on their IP addresses. It can also determine the geographical location information of hosts 1, 2, ..., n based on the pre-stored mapping relationship between IP addresses and geographical location information in the IP address database, and determine whether an attack source exists among hosts 1, 2, ..., n based on this geographical location information. If an attack source exists among hosts 1, 2, ..., n, the server can block the attack source. For example, if host 1 is determined to be an attack source, it can be blocked, prohibiting it from accessing the web page.

[0040] based on Figure 1 For the system architecture shown, please refer to [link / reference]. Figure 2 The diagram shows a flowchart of the IP address retrieval method provided in an embodiment of this application. Figure 2 The illustrated process uses an electronic device to perform IP address retrieval as an example, specifically, the IP address retrieval method provided in this application embodiment is executed by an electronic device. The electronic device can be... Figure 1 The server shown can also be a series of terminals, such as smartphones, tablets, and desktop computers.

[0041] IP addresses are typically stored encrypted as a whole. This application's embodiment considers segmenting and encrypting IP addresses before storing them in an IP address database. During retrieval, the IP address to be retrieved is similarly segmented and encrypted, and the retrieval is performed based on the processed IP address. For ease of description, in the following description, the IP address to be retrieved is referred to as the target IP address, the information set obtained after segmenting and encrypting the target IP address is referred to as the first information set, and the retrieved IP address is referred to as the second information set. The terms "first" and "second" mentioned here are only used to distinguish the target IP address from the IP addresses in the IP address database and are not used to limit the size, content, order, timing, priority, or importance of the sets.

[0042] S201. The electronic device acquires a first information set, wherein the first information set is a set of strings obtained by encrypting each segment after segmenting the target IP address, and N encrypted strings are obtained by encrypting each segment after segmenting the target IP address, where N is a positive integer greater than 1.

[0043] In related technologies, electronic devices need to acquire a large number of known IP addresses and their geographical location information when building an IP address database. IP addresses within the same network segment generally share similar geographical location information. Therefore, when storing IP addresses, the network address can be identified by its subnet mask. For a group of IP addresses with the same network address, a mapping relationship can be established between that group of IP addresses and a specific geographical location. Taking the IP address "192.18.18.1" as an example, when building the IP address database, the subnet mask identifies the network address of the network segment to which the IP address belongs. If the subnet mask is "255.255.255.0", its stored form in the IP address database is "192.18.18.1 / 24". Therefore, the network address of "192.18.18.1 / 24" is "192.18.18", and a mapping relationship with the same geographical location information can be established for IP addresses within the same network segment as "192.18.18.1 / 24".

[0044] In this embodiment, when constructing the IP address database, the IP addresses can be segmented and each segment can be encrypted separately. A mapping relationship between the encrypted IP addresses and geographical location information is then established. The following section details how to construct the IP address database.

[0045] The electronic device segments the obtained IP address into N segments based on a delimiter, where N is a positive integer greater than 1. The electronic device can divide the IP address into 2, 3, or 4 segments, etc., based on the delimiter. The specific number of segments N can be determined according to actual needs, and this embodiment does not impose a specific limitation. Taking the IP address "192.18.18.1 / 24" into 4 segments as an example, "192.18.18.1 / 24" is divided into 4 segments based on the delimiter, including "192", "18", "18", and "1 / 24". Each segment of the IP address can be represented by C, i.e., C1 = "192", C2 = "18", C3 = "18", C4 = "1 / 24". The values ​​of each segment are combined into an information set C, i.e., C = {C1, C2, C3, C4}.

[0046] The electronic device encrypts each element in the obtained information set C individually. The electronic device can use symmetric encryption algorithms, such as AES, DES, and SM4. The electronic device encrypts each element in the information set C individually to obtain the encrypted information set C'. For example, C' obtained after encryption using the AES algorithm is {C1', C2', C3', C4'}, where C1' = 2zzKnOk59iWAPGxCuqMIEw, C2' = 4i6H5kRvJ+u62uUSaL9g7A, C3' = 4i6H5kRvJ+u62uUSaL9g7A, and C4' = bZ3ZRQQvDsTVv1EkmHMpKA. Furthermore, to prevent information leakage when encrypting each element in the information set C, a leading zero can be added to each element for encryption. For example, changing C2 = "18" to "018" and then encrypting it to get C2' makes it difficult to obtain C2 from the encrypted C2', thus preventing information leakage.

[0047] The encrypted information set C' is stored in the IP address database. Since the geographical location information corresponding to the IP address is also obtained when acquiring the IP address, a mapping relationship can be established between the information set C' and the geographical location information corresponding to the IP address. The electronic device can store the geographical location information corresponding to the IP address separately in column O of the information set C'. Column O is used to store geographical location information and can be distinguished from other elements in the information set C'. After storing the mapping relationship between the information set C' and the geographical location information corresponding to the IP address in the IP address database, the electronic device can retrieve the information set C' and obtain the geographical location information in column O. The electronic device encrypts the acquired IP address in segments using the same method and stores them in the IP address database, thus completing the construction of the IP address database. The specific process will not be detailed here.

[0048] When an electronic device receives a web page request from host 1, host 2, ..., host n via the network, the server can obtain the target IP address of host 1, host 2, ..., host n. When the electronic device performs a search based on the target IP address, it needs to perform similar segmentation processing on the target IP address. Since the IP address database is constructed by dividing IP addresses into N segments, the target IP address can also be divided into N segments based on its delimiter. For example, if the target IP address is "192.18.18.1" and N = 4, then the target IP address can be divided into "192", "18", "18", and "1". We can use S to represent the set of information obtained after segmenting the IP address: S = {S1, S2, S3, S4}, where S1 = "192", S2 = "18", S3 = "18", and S4 = "1".

[0049] Since the information set in the IP address database is encrypted, when searching the database based on the segmented target IP address, the information set S obtained after segmenting the IP address needs to be encrypted using the same encryption algorithm used to construct the IP address database. The electronic device obtains N encrypted strings by encrypting each of the N segments, and determines the first information set based on these N encrypted strings. The order of the N encrypted strings in the first information set is the same as the order of the N segments in the target IP address. For example, if the AES algorithm is used when constructing the IP address database, the same AES algorithm can be used when encrypting the information set S to obtain the encrypted information set S'. S'={S1', S2', S3', S4'}, where, S1'=2zzKnOk59iWAPGxCuqMIEw==, S2'=4i6H5kRvJ+u62uUSaL9g7A==, S=3'=4i6H5kRvJ+u62uUSaL9g7A==, S4'=X.

[0050] Electronic devices can search the IP address database using an information set S', which can be called the first information set. The first information set is the set of strings obtained by encrypting each segment after dividing the target IP address into segments. Correspondingly, the information set stored in the IP address database can be called the second information set. Electronic devices can search the IP address database for the second information set based on the first information set, and determine whether the target IP address exists in the database based on the retrieved second information set.

[0051] S202. The electronic device searches the IP address database based on the N-1 encrypted strings of the first information set to obtain multiple second information sets. Each second information set is a set of strings obtained by encrypting each segment after segmenting an IP address. The IP addresses corresponding to the multiple second information sets are IP addresses in the same network segment as the target IP address.

[0052] Since IP addresses can be of types including IPv4 and IPv6, and IPv4 and IPv6 have different formats (for example, they have different numbers of separators), to improve the efficiency of searching in the IP address database, the IP address types can be pre-labeled as 't'. IPv4 can be labeled as type 1, and IPv6 as type 2. After obtaining the target IP address, the electronic device can label the first information set corresponding to the target IP address based on its type. If the target IP address is IPv4, the first information set is labeled as type 1; if the target IP address is IPv6, the first information set is labeled as type 2.

[0053] When an electronic device searches the IP address database based on a first set of information, it can first search for information sets of the same type in the IP address database according to the type of the first set of information. For example, if the first set of information is of type 1, it can search for information sets marked as type 1 in the IP address database. The electronic device can then retrieve at least one second set of information in the IP address database based on the first type.

[0054] Furthermore, the electronic device can perform a further search on at least one second information set retrieved based on the first information set. Since the IP address database stores a large number of IP addresses within the same network segment as the target IP address, the first N-1 segments of an IP address within the same network segment are identical to the target IP address. The results obtained after encrypting these segments using the same encryption algorithm are also identical. In other words, the information set of IP addresses within the same network segment as the target IP address has the same N-1 encrypted strings. Therefore, a search can be performed based on the first N-1 segments of the target IP address, which is equivalent to a search based on the first N-1 strings of the first information set. The electronic device can obtain multiple second information sets from at least one second information set. These multiple second information sets have the same N-1 strings as the first information set, meaning the IP addresses corresponding to these multiple second information sets are IP addresses within the same network segment as the target IP address.

[0055] S203. The electronic device determines that the target IP address exists in the IP address database based on the plurality of second information sets.

[0056] Since the retrieved multiple sets of second information are encrypted, and the first set of information is also encrypted based on the target IP address, the electronic device decrypts both the first set and the multiple sets of second information. The electronic device decrypts the information sets using an algorithm corresponding to the encryption algorithm, obtaining the target IP address corresponding to the first set of information and the multiple IP addresses corresponding to the multiple sets of second information. Because the multiple IP addresses are in the same network segment as the target IP address, the last digit of each IP address can be directly compared to determine if the target IP address exists among the multiple IP addresses. If it exists, the retrieval is successful. If it does not exist, it indicates that the target IP address does not exist in the IP address database, and the geographical location information of the target IP address cannot be determined through the mapping relationship between IP addresses and geographical location information in the IP address database. At this time, the electronic device outputs a prompt message indicating that the target IP address does not exist in the IP address database.

[0057] Electronic devices can determine whether a target IP address corresponds to an attack source based on the retrieved geographic location information. Since the IP address database stores geographic location information for target IP addresses, including latitude and longitude, country, province, city, time zone, ISP, ASN, whether it is a high-risk IP, attack methods, system, open ports, and malicious behavior, this information can be used to determine if a target IP address corresponds to an attack source. If the target IP address corresponds to an attack source, the electronic device can mark it. When the electronic device receives a packet carrying the target IP address to access a web service, it can block the target IP address, preventing it from accessing the web service normally.

[0058] In this embodiment, by segmenting and encrypting the IP addresses and the target IP address in the IP address database to generate an information set, and then searching the second information set in the IP address database based on the first information set of the target IP address, IP addresses in the same network segment as the target IP address can be retrieved. The information set is then decrypted to determine whether the target IP address exists among the IP addresses in the same network segment. This method is more efficient than simply polling the IP address database.

[0059] Please see Figure 3 This diagram illustrates another flowchart of the IP address retrieval method provided in this application. The electronic device acquires the original IP address data (i.e., the target IP address) and processes it using the IP standard format. This IP standard format processing mainly includes marking the IP address type and grouping the IP addresses. After encrypting the IP address groups, a first information set S' = {S1', S2', S3', ..., Sn'} is obtained, and the type t of the first information set is marked. Then, the type t of the first information set and the first information set S' are matched in the IP address database. If t, C1', C2', C3', ..., Cn-1' can be completely matched, meaning that the first n-1 encrypted strings of the first information set can match multiple second information sets in the IP address database, then the matched second information sets are decrypted. The decrypted information set and type t can be concatenated to obtain an IP address segment, i.e., all IP addresses in that network segment stored in the IP address database. If the target IP address is within the specified IP address range, then based on the geographical location information in column O of the pre-stored information set C', the corresponding geographical location information D is retrieved, and the result R = D(O) is returned. If R is empty, then the target IP address has not been stored in the database, and an empty value is returned.

[0060] Please see Figure 4Based on the same inventive concept, this application provides an IP address retrieval device 400. The device 400 includes an acquisition module 401, a retrieval module 402, and a determination module 403. The acquisition module 401 acquires a first information set, which is a set of strings obtained by encrypting each segment after segmenting a target IP address. N encrypted strings are obtained after segmenting the target IP address, where N is a positive integer greater than 1. The retrieval module 402 searches an IP address database based on the N-1 encrypted strings in the first information set to obtain multiple second information sets. Each second information set is a set of strings obtained by encrypting each segment after segmenting an IP address. The IP addresses corresponding to the multiple second information sets are IP addresses in the same network segment as the target IP address. The determination module 403 determines that the target IP address exists in the IP address database based on the multiple second information sets.

[0061] Optionally, the acquisition module 401 is further configured to: acquire the target IP address, divide the target IP address into N segments according to the delimiter of the target IP address, and encrypt each of the N segments to obtain N encrypted strings. A first information set is determined based on the N encrypted strings, wherein the order of the N encrypted strings in the first information set is the same as the order of the N segments in the target IP address.

[0062] Optionally, the acquisition module 401 is also used to: mark the first information set as a first type according to the type of the target IP address, wherein the number of delimiters is different for different types of IP addresses.

[0063] Optionally, the retrieval module 402 is specifically used to: retrieve a first type of information set from the IP address database to obtain at least one second information set; and retrieve a second information set including the first N-1 strings from at least one second information set based on the first information set.

[0064] Optionally, module 403 is specifically used to: decrypt multiple sets of second information to obtain multiple IP addresses corresponding to the multiple sets of second information; and determine that the target IP address exists among the multiple IP addresses.

[0065] Optionally, the determining module 403 is also used to: output a prompt message indicating that the target IP address does not exist in the IP address database.

[0066] Optionally, the determining module 403 is further configured to: determine whether the target IP address corresponds to an attack source based on the geographical location information associated with the target IP address in the IP address database. If the target IP address corresponds to an attack source, the target IP address is marked.

[0067] Please see Figure 5Based on the same inventive concept, this application provides an electronic device 500, which includes at least one processor 501, at least one memory 502, and computer program instructions stored in the memory. When the computer program instructions are executed by the processor, the IP address retrieval method described above is implemented.

[0068] Optionally, the processor 501 may be a central processing unit, an application-specific integrated circuit (ASIC), one or more integrated circuits for controlling program execution, a hardware circuit developed using a field-programmable gate array (FPGA), or a baseband processor.

[0069] Optionally, the read-write lock operating device further includes a memory 502 connected to at least one processor 501. The memory 502 may include read-only memory (ROM), random access memory (RAM), and disk storage. The memory 502 is used to store data required for the processor 501 to run. There may be one or more memories 502. The memory 502 is used in… Figure 5 It is shown together, but it should be noted that memory 502 is not a mandatory functional module, therefore in Figure 5 It is shown in dashed lines.

[0070] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the IP address retrieval method as described above.

[0071] In specific implementation, computer-readable storage media include: Universal Serial Bus flash drive (USB), portable hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other storage media that can store program code.

[0072] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0073] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0074] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0075] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0076] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes: Universal Serial Bus flash disks, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0077] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for retrieving Internet Protocol (IP) addresses, characterized in that, include: Obtain a first information set, wherein the first information set is a set of strings obtained by encrypting each segment after segmenting the target IP address, and N encrypted strings are obtained by encrypting each segment after segmenting the target IP address, where N is a positive integer greater than 1; Based on the N-1 encrypted strings of the first information set, a search is performed in the IP address database to obtain multiple second information sets. Each second information set is a set of strings obtained by encrypting each segment after segmenting an IP address. The IP addresses corresponding to the multiple second information sets are IP addresses in the same network segment as the target IP address. Based on the plurality of second information sets, it is determined that the target IP address exists in the IP address database; The step of determining that the target IP address exists in the IP address database based on the plurality of second information sets includes: The first information set and the plurality of second information sets are decrypted to obtain the target IP address corresponding to the first information set and the plurality of IP addresses corresponding to the plurality of second information sets. Based on the last digit of the plurality of IP addresses and the last digit of the target IP address, it is determined that the target IP address exists in the IP address database.

2. The method as described in claim 1, characterized in that, Before acquiring the first information set, the method further includes: Obtain the target IP address; The target IP address is divided into N segments based on the delimiter of the target IP address, and each of the N segments is encrypted to obtain N encrypted strings; The first information set is determined based on the N encrypted strings, and the order of the N encrypted strings in the first information set is the same as the order of the N segments in the target IP address.

3. The method as described in claim 1, characterized in that, Before acquiring the first information set, the method further includes: The first information set is marked as a first type according to the type of the target IP address, and the number of separators is different for different types of IP addresses.

4. The method as described in claim 3, characterized in that, Based on the N-1 encrypted strings in the first information set, a search is performed in the IP address database, including: Search the IP address database for the first type of information set to obtain at least one second information set; Based on the first N-1 encrypted strings of the first information set, a second information set including the first N-1 encrypted strings is retrieved from the at least one second information set.

5. The method as described in claim 1, characterized in that, Determining the existence of the target IP address in the IP address database based on the plurality of second information sets includes: Decrypt the plurality of second information sets to obtain the plurality of IP addresses corresponding to the plurality of second information sets; It is determined that the target IP address exists among the plurality of IP addresses.

6. The method as described in claim 1, characterized in that, If the target IP address does not exist in the IP address database, the method further includes: Output a prompt message, which indicates that the target IP address does not exist in the IP address database.

7. The method as described in claim 1, characterized in that, After determining that the target IP address exists in the IP address database based on the multiple sets of IP address information, the method further includes: Determine whether the target IP address corresponds to an attack source based on the geographical location information associated with the target IP address in the IP address database; If the target IP address corresponds to an attack source, the target IP address is marked.

8. An IP address retrieval device, characterized in that, include: The acquisition module is used to acquire a first information set, wherein the first information set is a set of strings obtained by encrypting each segment after segmenting the target IP address, and N encrypted strings are obtained by encrypting each segment after segmenting the target IP address, where N is a positive integer greater than 1; The retrieval module is used to search the IP address database based on the N-1 encrypted strings of the first information set to obtain multiple second information sets. Each second information set is a set of strings obtained by encrypting each segment after segmenting an IP address. The IP addresses corresponding to the multiple second information sets are IP addresses in the same network segment as the target IP address. The determining module is used to determine, based on the plurality of second information sets, that the target IP address exists in the IP address database; The determining module, when determining that the target IP address exists in the IP address database based on the plurality of second information sets, specifically performs the following steps: decrypts the first information set and the plurality of second information sets to obtain the target IP address corresponding to the first information set and the plurality of IP addresses corresponding to the plurality of second information sets; and determines that the target IP address exists in the IP address database based on the last digit of the plurality of IP addresses and the last digit of the target IP address.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-7.

Images