A message transmission method and device, a message transmission device and a storage medium

Abstract

The application provides a message transmission method and device, a message transmission equipment and a storage medium, relates to the technical field of information security, and is used for preventing illegal network attacks. The method comprises the following steps: obtaining a to-be-verified message sent by a sending end; the to-be-verified message comprises a first public network address of the sending end and a first label corresponding to the first public network address; performing matching verification on the first public network address and the first label according to a preset corresponding relationship to obtain a matching verification result; the preset corresponding relationship is used for indicating the corresponding relationship between the public network address and the label; the matching verification result comprises matching or non-matching; and in the case that the matching verification result is matching, the to-be-verified message is forwarded to a receiving end.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a message transmission method, apparatus, device and storage medium. Background Technology

[0002] Distributed Denial of Service (DDoS) attacks are among the most common and efficient network attack methods. A DDoS attack involves using a large number of legitimate distributed servers to send requests to a target server, preventing legitimate users from accessing the target server. DDoS attacks can not only block services provided by the target server to legitimate users, but also affect the user experience and can even cause network paralysis.

[0003] Therefore, preventing DDoS attacks is essential. Summary of the Invention

[0004] This application provides a message transmission method, apparatus, device, and storage medium, relating to the field of information security technology. By matching and verifying the public IP address and its corresponding tag in the message to be verified, the effect of preventing DDoS attacks can be achieved.

[0005] In a first aspect, this application provides a message transmission method, the method comprising: acquiring a message to be verified sent by a sender; the message to be verified includes a first public network address of the sender and a first tag corresponding to the first public network address; performing a matching verification on the first public network address and the first tag according to a preset correspondence relationship to obtain a matching verification result; the preset correspondence relationship is used to indicate the correspondence between the public network address and the tag; the matching verification result includes matching or non-matching; if the matching verification result is a match, forwarding the message to be verified to a receiver.

[0006] It should be understood that the implementation of a DDoS attack relies primarily on two conditions: first, a publicly available public IP address. A public IP address is a globally unique Internet Protocol (IP) address that can be routed on the public internet and is managed and allocated by the Internet Corporation for Assigned Services (ICAS); second, a mechanical packet forwarding process, meaning that as long as the packet format is correct, the packet can be forwarded. Attackers exploit these two characteristics, using primitive socket programming techniques or specific tools to construct attack packets and forge the source IP address of the attack packets, enabling the attack packets to be forwarded to the target server, thus completing the DDoS attack.

[0007] The technical solution provided in this application brings at least the following beneficial effects: First, when forwarding a user's pending verification message, the public IP address and the corresponding tag in the pending verification message are matched and verified. Since the correspondence between the public IP address and the tag is preset in the message transmission device and is not public, matching and verifying the public IP address and the corresponding tag can achieve the effect of encrypting the public IP address. Second, the user's pending verification message is only forwarded if the matching and verification result is a match; if the matching and verification result is a mismatch, the user's pending verification message will not be forwarded. Compared with the current scheme that forwards the pending verification message as long as the format is correct, this application uses a tag that is difficult to forge to match and verify the public IP address of the pending verification message, which can effectively prevent users from sending attack messages (or attack data packets) by forging public IP addresses and tags, thereby achieving the effect of preventing DDoS attacks.

[0008] In one possible implementation, before obtaining the message to be verified sent by the sender, the method further includes: obtaining the access request from the sender; the access request includes an account and a password; if the account and password in the access request are valid, assigning a target public IP address to the sender; selecting a tag from a preset tag pool as the target tag corresponding to the target public IP address; storing the target public IP address and the target tag in a preset correspondence, and sending the target public IP address and the target tag to the sender.

[0009] Based on this possible implementation method, when a user accesses the Internet, assigning the user a public IP address and a corresponding tag to the public IP address can achieve the effect of encrypting the public IP address and prevent DDoS attacks launched using publicly available public IP addresses.

[0010] In another possible implementation, before obtaining the message to be verified sent by the sender, the method further includes: obtaining the sender's access request; the access request includes an account and password; if the account and password in the access request are valid, assigning a target public network address to the sender; using the target public network address as input, obtaining the target tag corresponding to the target public network address output by the verifiable random function; storing the target public network address and the target tag in a preset correspondence, and sending the target public network address and the target tag to the sender.

[0011] In another possible implementation, the output of the verifiable random function also includes a generation proof corresponding to the target label; a preset correspondence is stored in multiple blocks included in the blockchain; the preset correspondence is also used to indicate the correspondence between the generation proof and the label; multiple blocks are generated by a blockchain authentication device; the method further includes: sending a generation proof to the blockchain authentication device so that the blockchain authentication device generates a block based on the generation proof and adds the block to the blockchain.

[0012] In another possible implementation, the method further includes: receiving a validity verification result sent by a blockchain authentication device; the validity verification result includes valid or invalid; the validity verification result is determined by the blockchain authentication device according to a preset blacklist; the blacklist includes tags corresponding to target users; target users include users who have logged out and / or users who have not sent messages within a preset time period; and performing matching verification on the first public network address and the first tag according to a preset correspondence, including: if the validity verification result is valid, performing matching verification on the first public network address and the first tag according to the preset correspondence.

[0013] In one possible implementation, the message to be verified further includes a first generation proof of the first tag; if the validity verification result is valid, the first public IP address and the first tag are matched and verified according to a preset correspondence, including: sending the first tag and the first generation proof to the blockchain authentication device; receiving the legality verification result sent by the blockchain authentication device; the legality verification result includes legality or illegality; the legality verification result is obtained by the blockchain authentication device based on the preset correspondence stored in multiple blocks and the first generation proof; if the validity verification result is valid, and the legality verification result is legal, then the first public IP address and the first tag are matched and verified according to the preset correspondence.

[0014] In one possible implementation, the first public IP address and the first tag are matched and verified according to a preset correspondence to obtain a matching verification result. This includes: using the first public IP address as an index to traverse and search the preset correspondence; determining the tag corresponding to the first public IP address from the preset correspondence; comparing the first tag with the tag corresponding to the first public IP address; if the first tag and the tag corresponding to the first public IP address are consistent, determining the matching verification result as a match; if the first tag and the tag corresponding to the first public IP address are inconsistent, determining the matching verification result as a mismatch.

[0015] Secondly, this application provides a message transmission apparatus, which includes an acquisition module and a processing module.

[0016] The acquisition module is used to acquire the message to be verified sent by the sender; the message to be verified includes the sender's first public IP address and the first tag corresponding to the first public IP address.

[0017] The processing module is used to match and verify the first public IP address and the first tag according to the preset correspondence, and obtain the matching verification result; the preset correspondence is used to indicate the correspondence between the public IP address and the tag; the matching verification result includes matching or non-matching; if the matching verification result is a match, the message to be verified is forwarded.

[0018] Optionally, the acquisition module is specifically used to acquire the access request from the sender; the access request includes the account and password.

[0019] Optionally, the processing module is specifically used to allocate a target public IP address to the sending end if the account and password in the access request are valid; select a tag from a preset tag pool as the target tag corresponding to the target public IP address; store the target public IP address and target tag in a preset mapping relationship between public IP addresses and tags; and send the target public IP address and target tag to the sending end.

[0020] Optionally, the processing module is specifically used to allocate a target public network address to the sending end if the account and password in the access request are valid; take the target public network address as input to obtain the target tag corresponding to the target public network address output by a verifiable random function; store the target public network address and target tag in a preset correspondence between public network addresses and tags, and send the target public network address and target tag to the sending end.

[0021] Optionally, the processing module is specifically used to send a generation certificate to the blockchain authentication device, so that the blockchain authentication device generates a block based on the generation certificate and adds it to the blockchain.

[0022] Optionally, the processing module is specifically used to receive the validity verification result sent by the blockchain authentication device; the validity verification result includes valid or invalid; the validity verification result is determined by the blockchain authentication device according to a preset blacklist; the blacklist includes the tag corresponding to the target user; the target user includes the canceled user and / or the user who has not sent a message within a preset time period; if the validity verification result is valid, the first public network address and the first tag are matched and verified according to the preset correspondence.

[0023] Optionally, the processing module is specifically used to send the first tag and the first generation proof to the blockchain authentication device; receive the legality verification result sent by the blockchain authentication device; the legality verification result includes legality or illegality; the legality verification result is obtained by the blockchain authentication device based on the preset correspondence stored in multiple blocks and the first generation proof; if the validity verification result is valid, and the legality verification result is legal, then the first public network address and the first tag are matched and verified according to the preset correspondence.

[0024] Optionally, the processing module is specifically used to use the first public IP address as an index to traverse and search a preset correspondence; determine the tag corresponding to the first public IP address from the preset correspondence; compare the first tag with the tag corresponding to the first public IP address; if the first tag and the tag corresponding to the first public IP address are consistent, determine that the matching verification result is a match; if the first tag and the tag corresponding to the first public IP address are inconsistent, determine that the matching verification result is a mismatch.

[0025] Thirdly, this application provides a message transmission device, which includes: a processor and a memory; the memory stores processor-executable instructions; when the processor is configured to execute the instructions, the message transmission device implements the message transmission method as described in the first aspect and any possible implementation thereof.

[0026] Fourthly, this application provides a computer-readable storage medium comprising: software instructions; when the software instructions are executed in a message transmission device, the message transmission device causes the message transmission device to implement the message transmission method as described in the first aspect and any possible implementation thereof.

[0027] The beneficial effects of the second to fourth aspects mentioned above can be referred to the first aspect, and will not be repeated here. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a schematic diagram of the composition of a message transmission system provided in an embodiment of this application;

[0030] Figure 2 This is a schematic diagram of the composition of a message transmission device provided in an embodiment of this application;

[0031] Figure 3 A flowchart illustrating the message transmission method provided in an embodiment of this application;

[0032] Figure 4 Another flowchart illustrating the message transmission method provided in this application embodiment;

[0033] Figure 5 This is another flowchart illustrating the message transmission method provided in an embodiment of this application;

[0034] Figure 6This is another flowchart illustrating the message transmission method provided in an embodiment of this application;

[0035] Figure 7 This is another flowchart illustrating the message transmission method provided in an embodiment of this application;

[0036] Figure 8 This is another flowchart illustrating the message transmission method provided in an embodiment of this application;

[0037] Figure 9 This is a schematic diagram of the composition of the message transmission device provided in the embodiments of this application. Detailed Implementation

[0038] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0039] It should be noted that in the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0040] Furthermore, in the description of the embodiments of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The term "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, in the description of the embodiments of this application, "multiple" refers to two or more.

[0041] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0042] Distributed Denial of Service (DDoS) attacks are among the most common and efficient network attack methods. A DDoS attack involves using a large number of legitimate distributed servers to send requests to a target server, preventing legitimate users from accessing the target server. DDoS attacks can not only block services provided by the target server to legitimate users, but also affect the user experience and can even cause network paralysis.

[0043] Therefore, preventing DDoS attacks is essential.

[0044] Based on this, embodiments of this application provide a message transmission method, apparatus, message transmission device, and storage medium. By assigning a public IP address and a corresponding tag to the user when the user accesses the Internet, and matching and verifying the public IP address and the corresponding tag in the message to be verified sent by the user, the effect of preventing DDoS attacks can be achieved.

[0045] For ease of understanding, the message transmission method provided in this application will be described in detail below with reference to the accompanying drawings.

[0046] Figure 1 This is a schematic diagram illustrating the composition of a message transmission system provided in an embodiment of this application. Figure 1 As shown, the system may include: a transmitter 100, a message transmission device 200, a receiver 300, and a blockchain authentication device 400. The transmitter 100 and the message transmission device 200, the receiver 300, and the message transmission device 200 and the blockchain authentication device 400 may be connected via wired or wireless networks.

[0047] The sending end 100 is used to generate a message to be verified and send the message to the message transmission device 200. The message to be verified may include information such as public network address and tag.

[0048] The sending end 100 can be a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, as well as cellular phone, personal digital assistant (PDA), augmented reality (AR) / virtual reality (VR) device, or a computing device with computing processing capabilities such as a computer or server. The server can be a single server or a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster. Optionally, the server can also be implemented on a cloud platform, for example, the cloud platform can include private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, inter-cloud, and multi-cloud, or any combination thereof. Figure 1 (The example shown is a mobile phone as the transmitter 100). This application does not impose any special restrictions on the specific form of the transmitter 100.

[0049] The message transmission device 200 is used to receive the message to be verified sent by the sending end 100, and to match and verify the public network address and tag in the message to be verified. If the matching and verification result is a match, the message to be verified is forwarded to the receiving end 300. The specific processing process can be referred to the processing method provided in the following method embodiment, which will not be repeated here.

[0050] The message transmission device 200 may be a broadband remote access server (BRAS) or other message transmission device with message transmission capabilities. This application embodiment does not impose any limitations on this.

[0051] Among them, BRAS is a network device for broadband network applications. It acts as a bridge between the broadband network and the backbone network, providing basic access methods and broadband access network management functions. It can forward unverified messages to the receiving end.

[0052] The receiver 300 is used to receive the message to be verified forwarded by the message transmission device 200.

[0053] The specific form of the receiver 300 can be referred to the above description of the transmitter 100, and will not be repeated here. Figure 1 (The example shown is a computer, with receiver 300 as the case study).

[0054] The blockchain authentication device 400 is used to manage tags and verify their validity and legitimacy. The specific process can be referred to the message transmission method provided in the following embodiments, and will not be repeated here.

[0055] The blockchain authentication device 400 can be a public blockchain or a consortium blockchain, and this application embodiment does not limit this. Specifically, the blockchain authentication device 400 may include node 1, node 2, and node 3. Each node can be an electronic device with computing and processing capabilities, such as a computer or server. The specific form can be referred to the above description of the sending end 100 or the receiving end 300, and will not be repeated here.

[0056] The message transmission method provided in this application embodiment is executed by the aforementioned message transmission device 200. As described above, the message transmission device 200 can be a broadband remote access server or other message transmission equipment with message transmission functionality. Optionally, the message transmission device 200 can be the processor (e.g., a central processing unit, CPU) of the aforementioned message transmission equipment; or, the message transmission device 200 can be an application (APP) with computing processing functionality installed in the aforementioned message transmission equipment; or, the message transmission device 200 can be a software system or platform deployed in the aforementioned message transmission equipment; or, the message transmission device 200 can be a functional module with message transmission functionality in the aforementioned message transmission equipment, etc. This application embodiment does not impose any limitations on these aspects.

[0057] For simplicity, the following description will use the message transmission device 200 as an example.

[0058] Figure 2 This is a schematic diagram illustrating the composition of a message transmission device provided in an embodiment of this application. Figure 2 As shown, the message transmission device may include: processor 10, memory 20, communication line 30, and communication interface 40.

[0059] The processor 10, memory 20, and communication interface 40 can be connected via communication line 30.

[0060] Processor 10 is used to execute instructions stored in memory 20 to implement the message transmission method provided in the following embodiments of this application. Processor 10 may be a CPU, a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller (MCU) / single-chip microcomputer, a programmable logic device (PLD), or any combination thereof. Processor 10 may also be any other device with processing capabilities, such as a circuit, device, or software module; this application embodiment does not limit this. In one example, processor 10 may include one or more CPUs, for example... Figure 2 CPU0 and CPU1 are included. As an optional implementation, the message transmission device may include multiple processors; for example, in addition to processor 10, it may also include processor 50. Figure 2 (The example shown is a dashed line).

[0061] The memory 20 is used to store instructions. For example, the instructions may be computer programs. Optionally, the memory 20 may be a read-only memory (ROM) or other types of static storage devices that can store static information and / or instructions; it may also be a random access memory (RAM) or other types of dynamic storage devices that can store information and / or instructions; it may also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, etc. The embodiments of this application do not limit this.

[0062] It should be noted that the memory 20 can exist independently of the processor 10, or it can be integrated with the processor 10. The memory 20 can be located inside or outside the message transmission device, and this embodiment does not impose any restrictions on this.

[0063] Communication line 30 is used to transmit information between the components included in the message transmission device.

[0064] The communication interface 40 is used to communicate with other devices (such as nodes in the aforementioned blockchain authentication device 400) or other communication networks. These other communication networks can be Ethernet, radio access network (RAN), wireless local area network (WLAN), etc. The communication interface 40 can be a module, circuit, transceiver, or any device capable of enabling communication.

[0065] It should be noted that, Figure 2 The structure shown does not constitute a limitation on the message transmission device, except Figure 2 In addition to the components shown, the message transmission device may include more or fewer components than illustrated (e.g., only processor 10 and memory 20), or combinations of certain components, or different component arrangements.

[0066] The message transmission method provided in the embodiments of this application will now be described in conjunction with the accompanying drawings.

[0067] Figure 3 This is a flowchart illustrating a message transmission method provided in an embodiment of this application. Optionally, this method can be implemented by someone with the above-described... Figure 2 The message transmission device (message transmission apparatus 200) with the hardware structure shown executes this. For example... Figure 3 As shown, the message transmission method includes:

[0068] S101. The message transmission device obtains the message to be verified sent by the sender.

[0069] The message to be verified includes the sender's first public IP address and the first tag corresponding to the first public IP address.

[0070] Optionally, as described above, the sending end 100 may send a message to be verified to the message transmission device 200, and the message transmission device (message transmission device 200) may receive the message to be verified sent by the sending end 100.

[0071] Optionally, the message to be verified may include address information, which may specifically include the public IP address of the sender and the first tag corresponding to the first public IP address.

[0072] For example, taking the address information in the form of public IP address + tag as an example, assuming the first public IP address is "192.168.1.100" and the first tag is "Token1", the address information can be specifically represented as "192.168.1.100 + Token1".

[0073] S102. The message transmission device performs matching verification on the first public network address and the first tag according to the preset correspondence, and obtains the matching verification result.

[0074] The preset mapping relationship indicates the correspondence between public IP addresses and tags, where each public IP address and tag corresponds one-to-one. The matching verification result includes either a match or a non-match.

[0075] For example, the correspondence between public IP addresses and tags can be shown in Table 1 below:

[0076] Table 1

[0077] Public IP address 1 Tag 1 Public IP address 2 Tag 2 Public IP address 3 Tag 3

[0078] As shown in Table 1, this table can include public IP address entries and tag entries. The public IP address entries include public IP address 1, public IP address 2, and public IP address 3; the tag entries include tag 1, tag 2, and tag 3. The tag corresponding to public IP address 1 is tag 1; the tag corresponding to public IP address 2 is tag 2; and the tag corresponding to public IP address 3 is tag 3.

[0079] The specific process of S102 can be described as follows: Figure 6 S1021 to S1025 and Figure 7 As described in section S1026, it will not be repeated here.

[0080] S103. If the matching verification result is a match, the message transmission device forwards the message to be verified to the receiving end.

[0081] Optionally, if the verification result is a match (the message to be verified is a valid message and can be forwarded), the message transmission device can forward the message to be verified to the receiving end 300.

[0082] Optionally, if the verification result is a mismatch (the message to be verified is an invalid message), the message transmission device will not forward the message to be verified, which can effectively prevent users from sending attack messages (or attack data packets) by forging public network addresses and labels.

[0083] It should be understood that the implementation of a DDoS attack relies primarily on two conditions: first, a publicly available public IP address. A public IP address is a globally unique Internet Protocol (IP) address that can be routed on the public internet and is managed and allocated by the Internet Corporation for Assigned Services (ICAS); second, a mechanical packet forwarding process, meaning that as long as the packet format is correct, the packet can be forwarded. Attackers exploit these two characteristics, using primitive socket programming techniques or specific tools to construct attack packets and forge the source IP address of the attack packets, enabling the attack packets to be forwarded to the target server, thus completing the DDoS attack.

[0084] In the message transmission method provided in this application embodiment, firstly, when forwarding a user's message to be verified, the message transmission device can match and verify the public IP address and the corresponding tag in the message to be verified. Since the correspondence between the public IP address and the tag is preset in the message transmission device and is not publicly available, matching and verifying the public IP address and the corresponding tag can achieve the effect of encrypting the public IP address. Secondly, the message transmission device will only forward the user's message to be verified if the matching and verification result is a match; if the matching and verification result is a mismatch, the message to be verified will not be forwarded. Compared with the current scheme that forwards the message as long as the format of the message to be verified is correct, this application uses a tag that is difficult to forge to match and verify the public IP address of the message to be verified, which can effectively prevent users from sending attack messages (or attack data packets) by forging public IP addresses and tags, thereby achieving the effect of preventing DDoS attacks.

[0085] In some possible embodiments, before the message transmission device acquires the message to be verified sent by the sender, the message transmission device can allocate a target tag to the sender from the tag pool. In this case, Figure 4 This is another flowchart illustrating the message transmission method provided in an embodiment of this application. Figure 4 As shown, prior to S101 above, the message transmission method further includes:

[0086] S201, The message transmission device obtains the access request from the sending end.

[0087] The access request includes an account and password.

[0088] Optionally, the sending end 100 can receive the account and password entered by the sending end, and generate an access request based on the account and password to send to the message transmission device. In this case, the message transmission device can receive the access request sent by the sending end 100.

[0089] S202. If the account and password in the access request are valid, the message transmission device assigns a target public network address to the sending end.

[0090] In one possible implementation, the message transmission device can authenticate the account and password in the access request, and allocate a preset public IP address corresponding to the account to the sender as the target public IP address based on the account in the access request. For details, please refer to relevant technologies, which will not be elaborated here.

[0091] It should be understood that when a user accesses the Internet, they need to request an IP address (public IP address).

[0092] S203. The message transmission device selects a tag from the preset tag pool as the target tag corresponding to the target public network address.

[0093] The tag pool can include multiple tags.

[0094] In one possible implementation, the message transmission device can randomly select a tag from the tag pool as the target tag.

[0095] In another possible implementation, multiple tags in the tag pool are arranged in a preset order, and the message transmission device selects a tag as the target tag in sequence according to the preset tag order.

[0096] For example, if the tags in the tag pool are "tag a, tag b, tag c" in sequence, the message transmission device can select the tag at the beginning (tag a) or the tag at the end (tag c) as the target tag to be selected.

[0097] S204. The message transmission device stores the target public network address and target tag in a preset correspondence and sends the target public network address and target tag to the sending end.

[0098] For example, as described above Figure 3 Taking the correspondence between public network addresses and tags in Table 1 at S102 as an example, the message transmission device can assign public network address 1 as the target public network address and tag 1 as the target tag to the sender 100.

[0099] In other possible embodiments, before the message transmission device obtains the message to be verified sent by the sender, the message transmission device may also assign a target label to the sender by generating a target label using a verifiable random function (VRF). In this case, Figure 5 This is another schematic flowchart illustrating the message transmission method provided in an embodiment of this application. Figure 5 As shown, the message transmission method also includes:

[0100] S301, The message transmission device obtains the access request from the sending end.

[0101] The access request includes an account and password.

[0102] The specific process of S301 can be found in [reference]. Figure 4 As described in section S201, it will not be repeated here.

[0103] S302. If the account and password in the access request are valid, the message transmission device assigns a target public network address to the sending end.

[0104] The specific process of S302 can be found in [reference]. Figure 4 As described in section S202, it will not be repeated here.

[0105] S303. The message transmission device takes the target public network address as input and obtains the target label corresponding to the target public network address output by the verifiable random function.

[0106] Optionally, the message transmission device can use the target public IP address as input to a verifiable random function and generate a target tag based on a preset private key. For details, please refer to relevant technologies, which will not be elaborated here.

[0107] S304. The message transmission device stores the target public network address and target tag in a preset correspondence and sends the target public network address and target tag to the sending end.

[0108] For details regarding S304, please refer to... Figure 4 As described in section S204, it will not be repeated here.

[0109] In some possible embodiments, the output of the verifiable random function also includes a generation proof corresponding to the target label. This generation proof is stored in multiple blocks generated by the blockchain authentication device 400. A preset correspondence can also be used to indicate the correspondence between the generation proof and the label. In this case, the message transmission method further includes: the message transmission device sending the generation proof to the blockchain authentication device 400, so that the blockchain authentication device 400 generates a block based on the generation proof and adds the block to the blockchain.

[0110] Each of the multiple blocks generated by the blockchain authentication device 400 contains a unique tag, a timestamp of block generation, and information such as the assigned user. Each block is linked to the previous block, forming a continuously growing chain structure to ensure the immutability of the tag and the traceability of historical records.

[0111] Optionally, the blockchain can store a preset correspondence (the correspondence between generated proofs and labels) in the multiple blocks, where the generated proofs and labels correspond one-to-one.

[0112] For example, the correspondence between generated proofs and labels can be shown in Table 2 below:

[0113] Table 2

[0114] Generate proof 1 Tag 1 Generate proof 2 Tag 2 Generate proof 3 Tag 3

[0115] As shown in Table 2, this table can include proof generation items and label items. The proof generation items include Proof 1, Proof 2, and Proof 3; the label items include Label 1, Label 2, and Label 3. The label corresponding to Proof 1 is Label 1; the label corresponding to Proof 2 is Label 2; and the label corresponding to Proof 3 is Label 3.

[0116] The following is an introduction to S102.

[0117] In some possible embodiments, Figure 6 This is another schematic flowchart illustrating the message transmission method provided in an embodiment of this application. Figure 6 As shown, S102 may specifically include S1021 to S1025.

[0118] S1021. The message transmission device uses the first public network address as an index to traverse and search the preset corresponding relationship.

[0119] For example, the correspondence between public IP addresses and tags can be as described above. Figure 3 The example at S102 is shown in Table 1.

[0120] S1022. The message transmission device determines the tag corresponding to the first public network address from the preset correspondence.

[0121] The preset mapping relationship is used to indicate the mapping relationship between public network addresses and tags.

[0122] For example, taking the first public network address as public network address 3, the message transmission device can determine that the label corresponding to public network address 3 is label 3, that is, determine that the label corresponding to the first public network address is label 3.

[0123] S1023. The message transmission device compares the first tag with the tag corresponding to the first public network address.

[0124] For example, taking public network address 2 as the first public network address and tag 3 as the first tag, the message transmission device can determine that the tag corresponding to public network address 2 is tag 2 from the correspondence between public network address and tag, and the message transmission device compares tag 3 with tag 2.

[0125] S1024. If the first tag matches the tag corresponding to the first public network address, the message transmission device determines that the matching verification result is a match.

[0126] For example, taking the first label as label 2 and the label corresponding to the first public network address as label 2, the first label (label 2) is consistent with the label (label 2) corresponding to the first public network address, and the message transmission device can determine that the matching verification result is a match.

[0127] S1025. If the first label does not match the label corresponding to the first public network address, the message transmission device determines that the matching verification result is a mismatch.

[0128] For example, taking the first label as label 3 and the label corresponding to the first public network address as label 2, if the first label (label 3) and the label corresponding to the first public network address (label 2) are inconsistent, the message transmission device can determine that the matching verification result is a mismatch.

[0129] In some possible embodiments, the message transmission device can send a first tag to the blockchain authentication device 400 and receive a validity verification result (valid or invalid) from the blockchain authentication device 400. The validity verification result can be determined by the blockchain authentication device 400 according to a preset blacklist. The blacklist includes tags corresponding to target users (users who have logged out and / or users who have not sent messages within a preset period). In this case, Figure 7 This is another schematic flowchart illustrating the message transmission method provided in an embodiment of this application. Figure 7 As shown, S102 may also specifically include S1026.

[0130] S1026. If the validity verification result is valid, the message transmission device performs matching verification on the first public network address and the first tag according to the preset correspondence.

[0131] As mentioned above, the validity verification result can be determined by the blockchain authentication device 400 based on a preset blacklist.

[0132] Optionally, if the tag is not on the blacklist, any node in the blockchain authentication device 400 can use the same VFR algorithm (as mentioned above, the message transmission device can use the target public IP address as input to a verifiable random function and generate the target tag according to a preset private key. The preset private key needs to be properly kept to ensure that it is not leaked or attacked) to verify the validity of the tag. For details, please refer to relevant technologies, which will not be elaborated here.

[0133] In one possible implementation, each node in the blockchain authentication device 400 verifies the validity of the tag. The blockchain authentication device 400 (or the master node in the blockchain authentication device 400) aggregates the validity verification results of each node. If the percentage of nodes with valid validity verification results (number of nodes with valid validity verification results / total number of nodes in the blockchain authentication device 400) is higher than a preset threshold, the blockchain authentication device 400 determines the validity verification result as valid and sends the validity verification result to the message transmission device. If the percentage of nodes with valid validity verification results is lower than the preset threshold, the blockchain authentication device 400 determines the validity verification result as invalid and sends the validity verification result to the message transmission device.

[0134] It should be noted that when the percentage of nodes with valid verification results equals a preset threshold, the blockchain authentication device 400 can determine whether the verification result is valid or invalid. This can be set according to actual needs, and this application embodiment does not impose any restrictions on it.

[0135] Optionally, the blockchain authentication device 400 can receive a list of deregistered users and / or users who have not sent messages within a preset time period sent by the message transmission device, and can determine a blacklist based on the list of deregistered users and / or users who have not sent messages within a preset time period. The blockchain authentication device 400 can determine that the validity verification result of the tag in the blacklist is invalid, and send the validity verification result to the message transmission device.

[0136] The specific process of matching verification in S1026 can be referred to in S1021 to S1025 above, and will not be repeated here.

[0137] The message transmission method provided in this application embodiment can verify the validity of tags using blockchain technology, which can ensure the accuracy and immutability of the tag validity verification results. In addition, by setting a blacklist, invalid tags are added to the blacklist, so that tags in the blacklist cannot pass the tag validity verification, which can prevent unauthorized tags from being used.

[0138] In some possible embodiments, the message to be verified also includes a first generation certificate of the first tag. If the validity verification result of the first tag is valid, the message transmission device can further verify the legitimacy of the first tag based on the correspondence between the generation certificate and the tag. If the legitimacy verification result is valid, a matching verification is performed to obtain a matching verification result. In this case, Figure 8 This is another schematic flowchart illustrating the message transmission method provided in an embodiment of this application. Figure 8 As shown, S1026 may specifically include S10261 to S10263.

[0139] S10261, The message transmission device sends the first tag and the first generation certificate to the blockchain authentication device.

[0140] The first generation proof is the generation proof corresponding to the first label.

[0141] S10262. The message transmission device receives the legality verification result sent by the blockchain authentication device.

[0142] The legality verification result includes legality or illegality; the legality verification result is obtained by the blockchain authentication device 400 based on the preset correspondence stored in multiple blocks and the first generation proof.

[0143] Optionally, each node in the blockchain authentication device 400 can use the first generated proof as an index to traverse the correspondence between generated proofs and tags (in the block), and determine the tag corresponding to the first generated proof as the target tag in the correspondence between generated proofs and tags.

[0144] For example, taking the correspondence shown in Table 2 above as an example, assuming that the first label is label 1 and the first generation proof is generation proof 1, the blockchain authentication device 400 can determine that the target label corresponding to generation proof 1 is label 1, which is consistent with the first label (label 1). Then each node in the blockchain authentication device 400 can determine that the legality verification result of the first label is valid and send the legality verification result to the message transmission device.

[0145] For example, taking the correspondence shown in Table 2 above as an example, assuming that the first label is label 2 and the first generation proof is generation proof 1, the blockchain authentication device 400 can determine that the target label corresponding to generation proof 1 is label 1, which is inconsistent with the first label (label 2). Then each node in the blockchain authentication device 400 can determine that the legality verification result of the first label is invalid and send the legality verification result to the message transmission device.

[0146] The specific process by which blockchain device 400 aggregates the legality verification results can be found in [reference needed]. Figure 7 The process for processing the validity verification results at S1026 is not described here.

[0147] Optionally, the message transmission device (message transmission unit 200) can receive the legitimacy verification result sent by the blockchain authentication device 400 through the communication interface 40.

[0148] S10263. If the validity verification result is valid, and the legality verification result is legal, the message transmission device shall perform matching verification on the first public network address and the first tag according to the preset correspondence.

[0149] The specific process of S10263 can be described as above. Figure 6 The details described in sections S1021 to S1025 are not repeated here.

[0150] The message transmission method provided in this application verifies the legitimacy of tags by generating proofs, which can ensure the accuracy and immutability of the tag legitimacy verification results, prevent attackers from forging valid tags by guessing or brute-force cracking, and thus prevent users from launching DDoS attacks using forged tags.

[0151] The foregoing primarily describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the aforementioned functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the steps of the examples described in the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0152] In an exemplary embodiment, this application also provides a message transmission device. Figure 9 This is a schematic diagram illustrating the composition of a message transmission apparatus provided in an embodiment of this application. Figure 9 As shown, the device includes an acquisition module 901 and a processing module 902.

[0153] The acquisition module 901 is used to acquire the message to be verified sent by the sender; the message to be verified includes the first public network address of the sender and the first tag corresponding to the first public network address.

[0154] The processing module 902 is used to perform matching verification on the first public network address and the first tag according to the preset correspondence relationship, and obtain the matching verification result; the preset correspondence relationship is used to indicate the correspondence between the public network address and the tag; the matching verification result includes matching or non-matching; if the matching verification result is a match, the message to be verified is forwarded to the receiving end.

[0155] In some possible embodiments, the acquisition module 901 is specifically used to acquire the access request from the sending end; the access request includes an account and a password.

[0156] In some possible embodiments, the processing module 902 is specifically used to allocate a target public network address to the sending end if the account and password in the access request are valid; select a tag from a preset tag pool as the target tag corresponding to the target public network address; store the target public network address and the target tag in a preset correspondence relationship, and send the target public network address and the target tag to the sending end.

[0157] In some possible embodiments, the processing module 902 is specifically used to allocate a target public network address to the sending end if the account and password in the access request are valid; take the target public network address as input to obtain the target tag corresponding to the target public network address output by a verifiable random function; store the target public network address and the target tag in a preset correspondence relationship, and send the target public network address and the target tag to the sending end.

[0158] In some possible embodiments, the processing module 902 is specifically used to send a generation certificate to the blockchain authentication device, so that the blockchain authentication device generates a block and adds it to the blockchain based on the generation certificate.

[0159] In some possible embodiments, the processing module 902 is specifically used to receive the validity verification result sent by the blockchain authentication device; the validity verification result includes valid or invalid; the validity verification result is determined by the blockchain authentication device according to a preset blacklist; the blacklist includes tags corresponding to the target user; the target user includes users who have cancelled their accounts and / or users who have not sent messages within a preset time period; if the validity verification result is valid, the first public network address and the first tag are matched and verified according to a preset correspondence.

[0160] In some possible embodiments, the processing module 902 is specifically used to send the first tag and the first generation proof to the blockchain authentication device; receive the legality verification result sent by the blockchain authentication device; the legality verification result includes legality or illegality; the legality verification result is obtained by the blockchain authentication device based on the preset correspondence stored in multiple blocks and the first generation proof; if the validity verification result is valid, and the legality verification result is legal, then the first public network address and the first tag are matched and verified according to the preset correspondence.

[0161] In some possible embodiments, the processing module 902 is specifically used to use the first public network address as an index to traverse and search a preset correspondence; determine the tag corresponding to the first public network address from the preset correspondence; compare the first tag with the tag corresponding to the first public network address; if the first tag and the tag corresponding to the first public network address are consistent, determine that the matching verification result is a match; if the first tag and the tag corresponding to the first public network address are inconsistent, determine that the matching verification result is a mismatch.

[0162] In an exemplary embodiment, this application also provides a computer program product that, when run on a computer, causes the computer to execute the aforementioned related method steps to implement the message transmission method in the above embodiments.

[0163] In an exemplary embodiment, this application also provides a computer-readable storage medium storing program instructions thereon; when the program instructions are executed by a message transmission device, the message transmission device performs the method described in the foregoing embodiments. The computer-readable storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0164] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer-executable instructions. When these computer-executable instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer-executable instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer-executable instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs).

[0165] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0166] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

[0167] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A message transmission method, characterized in that, The method includes: Obtain the access request from the sender; the access request includes the account and password; If the account and password in the access request are valid, a target public network address is assigned to the sending end; By taking the target public IP address as input, we can obtain the target label corresponding to the target public IP address and the generation proof corresponding to the target label, which are output by a verifiable random function. The generation proof is sent to the blockchain authentication device, enabling the device to generate a block based on the proof and add the block to the blockchain. The blockchain generated by the authentication device comprises multiple blocks, each containing a unique tag and a timestamp of its generation. Each block is linked to the previous block to form a chain structure, ensuring the immutability of the tag and the traceability of historical records. The multiple blocks store a one-to-one correspondence between the generation proof and the tag. Send the first tag to the blockchain authentication device; The system receives the validity verification result returned by the blockchain authentication device. The validity verification result is determined by the blockchain authentication device based on a preset blacklist, which includes tags corresponding to users who have cancelled their accounts and / or users who have not sent messages within a preset time period. Obtain the message to be verified sent by the sender; the message to be verified includes the first public IP address of the sender and the first tag corresponding to the first public IP address; If the validity verification result indicates that the first tag is valid, the first public IP address and the first tag are matched and verified according to a preset correspondence to obtain a matching verification result; the preset correspondence is used to indicate the correspondence between the public IP address and the tag; the matching verification result includes matching or not matching; If the verification result is a match, the message to be verified is forwarded to the receiving end.

2. The method according to claim 1, characterized in that, Before obtaining the message to be verified sent by the sender, the method further includes: Obtain the access request from the sending end; the access request includes an account and password; If the account and password in the access request are valid, a target public network address is assigned to the sending end; Select a tag from the preset tag pool as the target tag corresponding to the target public IP address; The target public IP address and the target tag are stored in the preset correspondence, and the target public IP address and the target tag are sent to the sending end.

3. The method according to claim 1, characterized in that, The method of taking the target public IP address as input to obtain the target label corresponding to the target public IP address output by a verifiable random function further includes: The target public IP address and the target tag are stored in the preset correspondence, and the target public IP address and the target tag are sent to the sending end.

4. The method according to claim 3, characterized in that, The message to be verified also includes a first generation proof of the first tag; the step of matching and verifying the first public IP address and the first tag according to a preset correspondence when the validity verification result indicates that the first tag is valid includes: Send the first tag and the first generated proof to the blockchain authentication device; The system receives a legitimacy verification result sent by the blockchain authentication device; the legitimacy verification result indicates whether the first tag is legitimate or illegitimate; the legitimacy verification result is obtained by the blockchain authentication device based on the preset correspondence stored in the multiple blocks and the first generated proof verification. If the validity verification result indicates that the first tag is valid, and the legality verification result indicates that the first tag is legal, then the first public IP address and the first tag are matched and verified according to a preset correspondence.

5. The method according to any one of claims 1-4, characterized in that, The step of matching and verifying the first public IP address and the first tag according to a preset correspondence to obtain a matching and verification result includes: Using the first public IP address as an index, the preset correspondence is traversed and searched. The tag corresponding to the first public IP address is determined from the preset correspondence; Compare the first tag with the tag corresponding to the first public IP address; If the first tag matches the tag corresponding to the first public IP address, the matching verification result is determined to be a match; If the first tag does not match the tag corresponding to the first public IP address, the matching verification result is determined to be a mismatch.

6. A message transmission device, characterized in that, The device includes: Acquisition module and processing module; The acquisition module is used to acquire the access request from the sending end; the access request includes an account and password; if the account and password in the access request are valid, a target public network address is allocated to the sending end; the target public network address is used as input to obtain the target tag corresponding to the target public network address and the generation proof corresponding to the target tag, which is output by a verifiable random function; the generation proof is sent to the blockchain authentication device so that the blockchain authentication device generates a block according to the generation proof and adds the block to the blockchain; wherein, the blockchain generated by the blockchain authentication device includes multiple blocks, each of the multiple blocks contains a unique tag and a timestamp of the block generation, and each block forms a chain structure with the previous blockchain to ensure the immutability of the tag and the traceability of the historical record; the multiple blocks store a one-to-one correspondence between the generation proof and the tag; a first tag is sent to the blockchain authentication device; the validity verification result returned by the blockchain authentication device is received; the validity verification result is determined by the blockchain authentication device according to a preset blacklist, the blacklist includes tags corresponding to users who have cancelled their accounts and / or users who have not sent messages within a preset time period. The acquisition module is further configured to acquire a message to be verified sent by the sending end; the message to be verified includes the first public network address of the sending end and a first tag corresponding to the first public network address; The processing module is used to perform matching verification on the first public network address and the first tag according to a preset correspondence when the validity verification result indicates that the first tag is valid, and obtain a matching verification result; the preset correspondence is used to indicate the correspondence between the public network address and the tag; the matching verification result includes matching or not matching; If the verification result is a match, forward the message to be verified.

7. A message transmission device, characterized in that, The message transmission device includes: a processor and a memory; The memory stores instructions that the processor can execute; When the processor is configured to execute the instructions, it causes the message transmission device to implement the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes: computer software instructions; When the computer software instructions are executed on the message transmission device, the message transmission device causes the message transmission device to implement the method as described in any one of claims 1 to 5.

Images