A method, system and computer-readable storage medium for constructing an IPv6 dedicated network

Abstract

The present application relates to a method, system and computer-readable storage medium for constructing an IPv6 private network, and belongs to the field of communication technology. Obtain a request message to be sent and a local IPv6 prefix, analyze and process the request message to obtain an IPv6 message, determine the corresponding recipient IPv6 stealth security gateway according to a preset correspondence and the target address of the request message, determine the target IPv6 prefix based on the recipient IPv6 stealth security gateway, construct an outer IPv6 message based on a preset data communication certificate, a local IPv6 prefix and a target IPv6 prefix, so that the outer IPv6 address has dynamic change characteristics and cannot be forged, and encrypt and encapsulate the IPv6 message through the outer IPv6 message to obtain an encapsulated IPv6 message, and send the encapsulated IPv6 message to the recipient IPv6 stealth security gateway. The present application can greatly improve the security of private network interconnection.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and system for constructing an IPv6 dedicated network and a computer-readable storage medium. Background Art

[0002] With the rapid development of Internet technology, IPv6 has gradually replaced IPv4 as the new generation of Internet protocol, mainly because it provides a larger address space and richer features. In this context, network security issues are particularly important, especially in the process of data transmission, how to ensure the security of data and prevent illegal users from accessing has become the focus of research. Stealth communication is an effective means of secure communication, which protects user privacy and data security by hiding the real communication address.

[0003] At present, IPv6 private network construction technology mainly relies on traditional VPN technology or SRv6 technology. The endpoint addresses are fixed IP addresses, which are vulnerable to scanning, penetration and attacks based on IP addresses on the Internet. How to use dynamic addresses for communication in private network construction, while ensuring the efficiency of legal communication, improve the security of the private network, and enhance the ability of the entire private network to resist third-party scanning, penetration and attacks has become a problem that needs to be solved urgently. Summary of the invention

[0004] In order to improve the security of private network interconnection, the present application provides an IPv6 private network construction method, system and computer-readable storage medium.

[0005] In a first aspect, the present application provides a method for constructing an IPv6 dedicated network, which adopts the following technical solution:

[0006] A method for constructing an IPv6 dedicated network, applied to an encryption party IPv6 stealth security gateway, comprising:

[0007] Obtain a request message to be sent and a local IPv6 prefix, wherein the request message is a request message sent by a terminal device of the communication encryption party, and the local IPv6 prefix is ​​an IPv6 prefix corresponding to the IPv6 stealth security gateway of the encryption party;

[0008] Analyze and process the request message to obtain an IPv6 message;

[0009] Determine the corresponding recipient IPv6 stealth security gateway according to the preset corresponding relationship and the target address of the request message;

[0010] Determine a target IPv6 prefix based on the receiver's IPv6 stealth security gateway;

[0011] Constructing an outer IPv6 message based on a preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and an unforgeable characteristic, and encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain an encapsulated IPv6 message;

[0012] The encapsulated IPv6 message is sent to the receiving IPv6 stealth security gateway.

[0013] By adopting the above technical solution, when the sender terminal device requests communication, in order to meet the requirement of stealth and confidentiality during the communication process, the request message of the sender terminal device and the local IPv6 prefix are first obtained, and then the request message is analyzed and processed to obtain an IPv6 message, thereby ensuring that the request message can meet the communication of the IPv6 network, and then the query target address of the communication encryption terminal device and the receiving IPv6 stealth security gateway corresponding to the query target address are determined according to the preset corresponding relationship and the IPv6 message, and the target IPv6 stealth security gateway is determined based on the receiving IPv6 stealth security gateway. Pv6 prefix, and then build an outer IPv6 message based on the preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix, so that the outer IPv6 address has dynamic change characteristics and cannot be forged, and encrypts and encapsulates the IPv6 message through the outer IPv6 message to obtain the encapsulated IPv6 message, so as to encrypt the IPv6 message, and send the encapsulated IPv6 message to the recipient's IPv6 stealth security gateway, thereby realizing the stealth communication requirements of the sender's terminal device and improving the confidentiality and security of access data.

[0014] In a possible implementation manner, the analyzing and processing the request message to obtain an IPv6 message includes:

[0015] Determine whether the request message is an IPv6 message. If so, use the request message as the IPv6 message to be sent. If not, determine whether the request message is an IPv4 message. If so, translate the request message into an IPv6 message to be sent through IPv4 / IPv6 translation technology.

[0016] In a possible implementation, the constructing of the outer IPv6 message based on the preset data communication certificate, the local IPv6 prefix, and the target IPv6 prefix so that the outer IPv6 address has a dynamic change characteristic and an unforgeable characteristic includes:

[0017] Calculate the source IPv6 address by random algorithm within the address range of the local IPv6 prefix;

[0018] Acquire secure communication information, where the secure communication information is secure communication protocol information between the encrypting IPv6 stealth security gateway and the receiving IPv6 stealth security gateway;

[0019] Determine a cryptographic algorithm based on the preset data communication certificate, and calculate and generate a dynamic target IPv6 address according to the cryptographic algorithm, the secure communication information and the target IPv6 prefix;

[0020] The source IPv6 address and the target IPv6 address are associated and constructed to obtain an outer IPv6 message.

[0021] In a possible implementation, the encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain the encapsulated IPv6 message also includes:

[0022] The IPv6 message is encrypted and updated based on the secure communication information to obtain an updated IPv6 message.

[0023] In a second aspect, the present application provides a method for constructing an IPv6 dedicated network, which adopts the following technical solution:

[0024] A method for constructing an IPv6 dedicated network, applied to a receiver IPv6 stealth security gateway, comprising:

[0025] Receive an IPv6 message sent from an encryption party IPv6 stealth security gateway; wherein the IPv6 message is obtained by obtaining a request message to be sent and a local IPv6 prefix, analyzing and processing the request message to obtain an IPv6 message, determining the corresponding receiving party IPv6 stealth security gateway according to a preset corresponding relationship and a target address of the request message, determining a target IPv6 prefix based on the receiving party IPv6 stealth security gateway, constructing an outer IPv6 message based on a preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and an unforgeable characteristic, and encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain an IPv6 message;

[0026] Acquire secure communication information, where the secure communication information is secure communication protocol information between the encrypting IPv6 stealth security gateway and the receiving IPv6 stealth security gateway;

[0027] Determine a cryptographic algorithm based on the preset data communication certificate, and calculate and generate a dynamic verification IPv6 address according to the cryptographic algorithm, the secure communication information and the target IPv6 prefix;

[0028] Performing a consistency check between the target IPv6 address in the outer IPv6 message and the verification IPv6 address, and if they are inconsistent, discarding the IPv6 message;

[0029] If they are consistent, the inner IPv6 message in the IPv6 message is taken out, and the inner IPv6 message is decrypted by the secure communication information to obtain the decrypted IPv6 message and the communication receiving terminal device;

[0030] The decrypted IPv6 message is sent to the communication receiving terminal device corresponding to the query target address.

[0031] By adopting the above technical solution, a verification checkpoint is designed at the receiving IPv6 stealth security gateway, and the access of illegal users is effectively prevented through the verification process of the dynamically changing IPv6 address of the outer layer and the encryption and decryption process of the message content; therefore, the present application greatly improves the security of private network interconnection.

[0032] In a possible implementation manner, the sending of the decrypted IPv6 message to a communication receiving terminal device corresponding to the query target address also includes:

[0033] Based on whether there is an IPv6 / IPv4 translation requirement for the communication receiving terminal device, if so, the decrypted IPv6 message is translated into an IPv4 message based on the IPv4 / IPv6 translation rules, and the IPv4 message is forwarded to the communication receiving terminal device corresponding to the query target address.

[0034] In a third aspect, the present application provides an IPv6 dedicated network construction system, which adopts the following technical solution:

[0035] An IPv6 dedicated network construction system, applied to an encryption party IPv6 stealth security gateway, comprises:

[0036] An acquisition module, used to acquire a request message to be sent and a local IPv6 prefix, wherein the request message is a request message sent by a communication encryption party terminal device, and the local IPv6 prefix is ​​an IPv6 prefix corresponding to the encryption party IPv6 stealth security gateway;

[0037] A processing module, used for analyzing and processing the request message to obtain an IPv6 message;

[0038] A first determination module is used to determine the corresponding recipient IPv6 stealth security gateway according to a preset corresponding relationship and a target address of the request message;

[0039] A second determination module is used to determine a target IPv6 prefix based on the recipient IPv6 stealth security gateway;

[0040] An encapsulation module is used to construct an outer IPv6 message based on a preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and cannot be forged, and encrypt and encapsulate the IPv6 message through the outer IPv6 message to obtain an encapsulated IPv6 message;

[0041] The first sending module is used to send the encapsulated IPv6 message to the receiving IPv6 stealth security gateway.

[0042] In a fourth aspect, the present application provides an IPv6 dedicated network construction system, which adopts the following technical solutions:

[0043] An IPv6 dedicated network construction system, applied to a receiving IPv6 stealth security gateway, comprises:

[0044] A receiving module, used for receiving an IPv6 message sent from an encryption party IPv6 stealth security gateway, wherein the IPv6 message is obtained by obtaining a request message to be sent and a local IPv6 prefix, analyzing and processing the request message, and obtaining an IPv6 message, determining a corresponding receiving party IPv6 stealth security gateway according to a preset corresponding relationship and a target address of the request message, determining a target IPv6 prefix based on the receiving party IPv6 stealth security gateway, constructing an outer IPv6 message based on a preset data communication certificate, the local IPv6 prefix, and the target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and an unforgeable characteristic, and encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain an IPv6 message;

[0045] An information acquisition module is used to acquire secure communication information, wherein the secure communication information is secure communication protocol information between the encrypting IPv6 stealth security gateway and the receiving IPv6 stealth security gateway;

[0046] A third determination module is used to determine a cryptographic algorithm based on the preset data communication certificate, and calculate and generate a dynamic verification IPv6 address according to the cryptographic algorithm, the secure communication information and the target IPv6 prefix;

[0047] A verification module, used for performing consistency verification between the target IPv6 address in the outer IPv6 message and the verification IPv6 address, and if they are inconsistent, discarding the IPv6 message;

[0048] A decryption module, configured to, when the target IPv6 address in the outer IPv6 message is consistent with the verification IPv6 address, take out the inner IPv6 message in the IPv6 message, and decrypt the inner IPv6 message through the secure communication information to obtain the decrypted IPv6 message and the communication receiving party terminal device;

[0049] The second sending module is used to send the decrypted IPv6 message to the communication receiving terminal device corresponding to the query target address.

[0050] In a fifth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution:

[0051] A computer-readable storage medium stores a computer program that can be loaded by a processor and executes any one of the methods in the first aspect or the second aspect.

[0052] In summary, the present application includes at least one of the following beneficial technical effects:

[0053] 1. By adopting the above technical solution, when the sender terminal device requests communication, in order to meet the requirement of privacy and confidentiality during the communication process, the request message of the sender terminal device and the local IPv6 prefix are first obtained, and then the request message is analyzed and processed to obtain the IPv6 message, thereby ensuring that the request message can meet the communication of the IPv6 network, and then the query target address of the communication encryption terminal device and the receiving IPv6 stealth security gateway corresponding to the query target address are determined according to the preset corresponding relationship and the IPv6 message, and the target IPv6 stealth security gateway is determined based on the receiving IPv6 stealth security gateway. The IPv6 prefix is ​​then used to construct an outer IPv6 message based on the preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix, so that the outer IPv6 address has dynamic change characteristics and cannot be forged, and the IPv6 message is encrypted and encapsulated through the outer IPv6 message to obtain an encapsulated IPv6 message, so as to encrypt the IPv6 message, and send the encapsulated IPv6 message to the recipient's IPv6 stealth security gateway, thereby realizing the stealth communication requirements of the sender's terminal device and improving the confidentiality and security of access data;

[0054] 2. By adopting the above technical solution, a verification checkpoint is designed at the receiving IPv6 stealth security gateway, and the access of illegal users is effectively prevented through the verification process of the dynamically changing IPv6 address of the outer layer and the encryption and decryption process of the message content; therefore, the present application greatly improves the security of private network interconnection. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1This is a first flow chart of a method for constructing an IPv6 dedicated network according to one of the embodiments of the present application.

[0056] Figure 2 This is a second flow chart of the IPv6 dedicated network construction system according to one of the embodiments of the present application.

[0057] Figure 3 It is a third flow chart of the method for establishing an IPv6 dedicated network according to one of the embodiments of the present application.

[0058] Figure 4 This is a fourth flow chart of the IPv6 dedicated network construction system according to one of the embodiments of the present application. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solutions and advantages of this application more clear, the following Figure 1-4 It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0060] First, the terms of the embodiments of the present application are explained:

[0061] Encryption party IPv6 stealth security gateway: It is an intermediate device connecting different networks or protocols, located at the initiator of the IPv6 network, that is, a device that receives request messages sent by the sender's terminal device and encrypts the request messages.

[0062] Receiving IPv6 Stealth Security Gateway: It is an intermediate device connecting different networks or protocols, located at the receiving end of the IPv6 network, that is, a device that receives IPv6 messages sent by the sending IPv6 Stealth Security Gateway through the IPv6 network, and sends the IPv6 messages to the corresponding receiving terminal device at the same time.

[0063] The embodiment of the present application discloses a method for constructing an IPv6 dedicated network based on the encryption party IPv6 stealth security gateway side.

[0064] Reference Figure 1 , a method for constructing an IPv6 dedicated network, applied to an encryption party IPv6 stealth security gateway, comprising:

[0065] Step S101, obtaining a request message to be sent and a local IPv6 prefix.

[0066] Among them, the request message is the request message sent by the terminal device of the communication encryption party, and the local IPv6 prefix is ​​the IPv6 prefix corresponding to the encryption party's IPv6 stealth security gateway.

[0067] Step S102, analyzing and processing the request message to obtain an IPv6 message;

[0068] Specifically, determine whether the request message is an IPv6 message. If so, use the request message as the IPv6 message to be sent. If not, determine whether the request message is an IPv4 message. If so, translate the request message into the IPv6 message to be sent through IPv4 / IPv6 translation technology.

[0069] For the embodiments of the present application, according to the required IPv4 / IPv6 network communication requirements, each IPv6 stealth network gateway is configured with corresponding IPv4 / IPv6 translation rules, so that through the intermediate IPv6 network, the IPv4 terminal of this site can access the IPv6 terminal of the opposite site (4-6-6), the IPv6 terminal of this site can access the IPv4 terminal of the opposite site (6-6-4), the IPv4 terminal of this site can access the IPv4 terminal of the opposite site (4-6-4), and the IPv6 terminal of this site can access the IPv6 terminal of the opposite site (6-6-6).

[0070] In the above implementation, the IPv6 stealth security gateway can intelligently process various types of data packets and convert them into a unified IPv6 format to prepare for subsequent stealth processing and transmission; by ensuring the consistency of the data format, the integrity of the network traffic is protected, and forward compatibility of the network is achieved through format conversion, which not only provides a basis for the IPv6 dedicated network construction method, but also provides flexibility and scalability for the network.

[0071] Step S103, determining the query target address of the communication encryption party terminal device and the receiving party IPv6 stealth security gateway corresponding to the query target address according to the preset corresponding relationship and the IPv6 message.

[0072] Specifically, the preset corresponding relationship is a pre-configured static configuration of the gateway, and the implementation method includes: through dynamic routing exchange, that is, each two IPv6 stealth network gateways can establish a dynamic routing relationship (such as BGP) based on the IPv6 stealth security channel, and exchange IPv4 / IPv6 routing information with each other, so that each IPv6 stealth network gateway can automatically associate the target IPv4 / IPv6 address with the corresponding IPv6 stealth network gateway, thereby realizing automatic query of the recipient IPv6 stealth security gateway. At the same time, after exchanging IPv4 / IPv6 dynamic routes, each two IPv6 stealth network gateways can continue to perform further routing distribution within the site, so that the routing between the terminals of each site is fully automated.

[0073] Step S104, determining a target IPv6 prefix based on the recipient's IPv6 stealth security gateway;

[0074] Step S105, constructing an outer IPv6 message based on the preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix, so that the outer IPv6 address has dynamic change characteristics and cannot be forged, and encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain an encapsulated IPv6 message.

[0075] Specifically, in the embodiment of the present application, the preset data communication certificate is used during the data communication process. In order to ensure the security of communication, a certificate is usually used to verify the identity of the communication party (the other party's public key and the local private key), so as to establish a mutual trust relationship with other IPv6 stealth network gateways and establish an IPv6 stealth security channel. In addition, each IPv6 stealth network gateway needs to be pre-statically configured with the peer information required for communication with other IPv6 stealth network gateways, such as the peer's public key, the peer's IPv6 prefix, etc.

[0076] Specifically, the local IPv6 prefix is ​​randomly screened to obtain the source IPv6 address, and secure communication information is obtained, wherein the secure communication information is the secure communication protocol information between the encryption party IPv6 stealth security gateway and the receiving party IPv6 stealth security gateway. The cryptographic algorithm is determined based on the preset data communication certificate, and the dynamic target IPv6 address is calculated and generated according to the cryptographic algorithm, the secure communication information and the target IPv6 prefix. The source IPv6 address and the target IPv6 address are associated and constructed to obtain the outer IPv6 message.

[0077] For the embodiment of the present application, the IPv6 address is calculated and generated by a random algorithm within the address range of the local IPv6 prefix in order to increase the security of communication (for example, if the IPv6 prefix of this gateway is / 64, an address is generated from / 64 by a random algorithm). By randomly selecting the source IPv6 address and the target IPv6 address, the encryption party can ensure that its communication address has dynamic and unforgeable characteristics, thereby fundamentally preventing potential attackers from easily tracking or intercepting communications. The secure communication information usually includes information such as encryption algorithms, keys, and certificates to ensure the security of communication between the two gateways.

[0078] Step S16, sending the encapsulated IPv6 message to the receiving IPv6 stealth security gateway.

[0079] In the above implementation mode, when the sender terminal device requests communication, in order to meet the requirement of privacy and confidentiality during the communication process, the request message of the sender terminal device and the local IPv6 prefix are first obtained, and then the request message is analyzed and processed to obtain the IPv6 message, thereby ensuring that the request message can meet the communication of the IPv6 network, and then the query target address of the communication encryption party terminal device and the receiver IPv6 stealth security gateway corresponding to the query target address are determined according to the preset corresponding relationship and the IPv6 message, and the target IPv6 prefix is ​​determined based on the receiver IPv6 stealth security gateway, and then the outer IPv6 message is constructed based on the preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix, so that the outer IPv6 address has dynamic change characteristics and cannot be forged, and the IPv6 message is encrypted and encapsulated through the outer IPv6 message to obtain the encapsulated IPv6 message, so as to encrypt the IPv6 message, and send the encapsulated IPv6 message to the receiver IPv6 stealth security gateway, thereby realizing the stealth communication requirements of the sender terminal device and improving the confidentiality and security of access data.

[0080] In a possible implementation method of the embodiment of the present application, the IPv6 message is encrypted and encapsulated through an outer IPv6 message to obtain an encapsulated IPv6 message, which also includes: encrypting and updating the IPv6 message based on secure communication information to obtain an updated IPv6 message.

[0081] Reference Figure 2 The embodiment of the present application also discloses an IPv6 dedicated network construction system 20 based on the encryption party IPv6 stealth security gateway side.

[0082] An IPv6 dedicated network construction system 20, applied to an encryption party IPv6 stealth security gateway, comprises:

[0083] The acquisition module 21 is used to acquire the request message to be sent and the local IPv6 prefix, the request message is the request message sent by the communication encryption party terminal device, and the local IPv6 prefix is ​​the IPv6 prefix corresponding to the encryption party IPv6 stealth security gateway;

[0084] The processing module 22 is used to analyze and process the request message to obtain an IPv6 message;

[0085] A first determination module 23 is used to determine the query target address of the communication encryption party terminal device and the receiving party IPv6 stealth security gateway corresponding to the query target address according to the preset corresponding relationship and the IPv6 message;

[0086] A second determination module 24 is used to determine a target IPv6 prefix based on the recipient's IPv6 stealth security gateway;

[0087] The encapsulation module 25 is used to construct an outer IPv6 message based on a preset data communication certificate, a local IPv6 prefix and a target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and cannot be forged, and encrypt and encapsulate the IPv6 message through the outer IPv6 message to obtain an encapsulated IPv6 message;

[0088] The first sending module 26 is used to send the encapsulated IPv6 message to the receiving IPv6 stealth security gateway.

[0089] The IPv6 private network construction system based on the encryption party IPv6 stealth security gateway side of the embodiment of the present application can implement any of the above-mentioned IPv6 private network construction methods based on the encryption party IPv6 stealth security gateway side, and the specific working process of each module in the IPv6 private network construction system can refer to the corresponding process in the above-mentioned method embodiment.

[0090] The embodiment of the present application also discloses a method for constructing an IPv6 dedicated network based on the receiving party's IPv6 stealth security gateway side.

[0091] Reference Figure 3 , a method for constructing an IPv6 dedicated network, applied to a receiving IPv6 stealth security gateway, comprising:

[0092] Step S301, receiving an IPv6 message sent from an encryption party IPv6 stealth security gateway.

[0093] The IPv6 message is obtained by obtaining a request message to be sent and a local IPv6 prefix, analyzing and processing the request message to obtain an IPv6 message, determining a query target address of a communication encryption party terminal device and a receiving party IPv6 stealth security gateway corresponding to the query target address according to a preset corresponding relationship and the IPv6 message, determining a target IPv6 prefix based on the receiving party IPv6 stealth security gateway, constructing an outer IPv6 message based on a preset data communication certificate, a local IPv6 prefix and a target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and an unforgeable characteristic, and encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain an IPv6 message;

[0094] Step S302, obtaining security communication information, where the security communication information is security communication protocol information between the encryption party IPv6 stealth security gateway and the receiving party IPv6 stealth security gateway;

[0095] Step S303, determining a cryptographic algorithm based on a preset data communication certificate, and calculating and generating a dynamic verification IPv6 address according to the cryptographic algorithm, the security communication information and the target IPv6 prefix.

[0096] The specific selection method is the same as the method of selecting the target IPv6 address of the sender's IPv6 stealth security gateway, so it will not be repeated here.

[0097] Step S304, performing consistency check between the target IPv6 address in the outer IPv6 message and the verification IPv6 address, if they are inconsistent, discarding the IPv6 message;

[0098] Step S305: If they are consistent, the inner IPv6 message in the IPv6 message is taken out, and the inner IPv6 message is decrypted by the secure communication information to obtain the decrypted IPv6 message and the communication receiving terminal device;

[0099] In an embodiment of the present application, the encrypting party's IPv6 stealth security gateway uses the encryption algorithm and key in the secure communication information to perform an IPv6 message encryption, so that the encrypted message will become unreadable. Only the recipient holding the correct key can decrypt and read the message content. When the receiving party's IPv6 stealth security gateway obtains the inner IPv6 message, it uses the same encryption algorithm and key in the secure communication information as when encrypted to decrypt the message. The decrypted message will be restored to its original form and can be read and processed by the recipient.

[0100] Step S306: Send the decrypted IPv6 message to the communication receiving terminal device corresponding to the query target address.

[0101] In the above implementation, a verification checkpoint is designed at the receiving IPv6 stealth security gateway, which effectively prevents access by illegal users through the verification process of the dynamically changing IPv6 address of the outer layer and the encryption and decryption process of the message content; therefore, the present application greatly improves the security of private network interconnection.

[0102] In a possible implementation method of an embodiment of the present application, the decrypted IPv6 message is sent to a communication receiving terminal device corresponding to the query target address, and the process also includes: based on whether there is an IPv6 / IPv4 translation requirement for the communication receiving terminal device, if so, translating the decrypted IPv6 message into an IPv4 message based on the IPv4 / IPv6 translation rules, and forwarding the IPv4 message to the communication receiving terminal device corresponding to the query target address.

[0103] Reference Figure 4 The embodiment of the present application also discloses an IPv6 dedicated network construction system 40 based on the receiving party's IPv6 stealth security gateway side.

[0104] An IPv6 dedicated network construction system 40, applied to a receiving IPv6 stealth security gateway, comprises:

[0105] A receiving module 41 is used to receive an IPv6 message sent from an encryption party IPv6 stealth security gateway, wherein the IPv6 message is obtained by obtaining a request message to be sent and a local IPv6 prefix, analyzing and processing the request message to obtain an IPv6 message, determining a query target address of a communication encryption party terminal device and a receiving party IPv6 stealth security gateway corresponding to the query target address according to a preset corresponding relationship and the IPv6 message, determining a target IPv6 prefix based on the receiving party IPv6 stealth security gateway, constructing an outer IPv6 message based on a preset data communication certificate, a local IPv6 prefix and a target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and an unforgeable characteristic, and encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain an IPv6 message;

[0106] The information acquisition module 42 is used to acquire the security communication information, where the security communication information is the security communication protocol information between the encryption party IPv6 stealth security gateway and the receiving party IPv6 stealth security gateway;

[0107] A third determination module 43 is used to determine a cryptographic algorithm based on a preset data communication certificate, and calculate and generate a dynamic verification IPv6 address according to the cryptographic algorithm, the security communication information and the target IPv6 prefix;

[0108] A verification module 44 is used to perform consistency verification between the target IPv6 address in the outer IPv6 message and the verification IPv6 address, and if they are inconsistent, the IPv6 message is discarded;

[0109] The decryption module 45 is used to take out the inner IPv6 message in the IPv6 message when the target IPv6 address in the outer IPv6 message is consistent with the verification IPv6 address, and decrypt the inner IPv6 message through the security communication information to obtain the decrypted IPv6 message and the communication receiving terminal device;

[0110] The second sending module 46 is used to send the decrypted IPv6 message to the communication receiving terminal device corresponding to the query target address.

[0111] In the above implementation, the security verification process is optimized and the encryption and decryption operations are simplified, while allowing the terminal to quickly process and forward legal messages, thereby improving communication security while reducing the consumption of system resources and improving the forwarding performance of the entire system.

[0112] The IPv6 private network construction system based on the receiving party's IPv6 stealth security gateway side of the embodiment of the present application can implement any of the above-mentioned IPv6 private network construction methods based on the receiving party's IPv6 stealth security gateway side, and the specific working process of each module in the IPv6 private network construction system can refer to the corresponding process in the above-mentioned method embodiment.

[0113] In the several embodiments provided in this application, it should be understood that the provided methods and systems can be implemented in other ways. For example, the system embodiments described above are only illustrative; for example, the division of a certain module is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed.

[0114] The embodiment of the present application also discloses a computer-readable storage medium.

[0115] A computer-readable storage medium stores a computer program that can be loaded by a processor and execute any one of the above-mentioned methods for constructing an IPv6 dedicated network.

[0116] Among them, computer-readable storage media can be any tangible medium that contains or stores a program, which can be used by or in conjunction with an instruction execution system, apparatus or device; the program code contained on the computer-readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0117] It should be noted that in the above embodiments, the description of each embodiment has different emphases, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0118] The above are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Any feature disclosed in this specification (including the abstract and drawings), unless otherwise stated, can be replaced by other equivalent or alternative features with similar purposes. That is, unless otherwise stated, each feature is only an example of a series of equivalent or similar features.

Claims

1. A method for constructing an IPv6 dedicated network, characterized in that: Applied to the encryption party IPv6 stealth security gateway, including: Obtain a request message to be sent and a local IPv6 prefix, wherein the request message is a request message sent by a terminal device of a communication initiator, and the local IPv6 prefix is ​​an IPv6 prefix corresponding to an IPv6 stealth security gateway of an encryption party; Analyze and process the request message to obtain an IPv6 message; Determine the corresponding recipient IPv6 stealth security gateway according to the preset corresponding relationship and the target address of the request message; Determine a target IPv6 prefix based on the receiver's IPv6 stealth security gateway; Constructing an outer IPv6 message based on a preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and an unforgeable characteristic, and encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain an encapsulated IPv6 message; The encapsulated IPv6 message is sent to the receiving IPv6 stealth security gateway.

2. The method for constructing an IPv6 dedicated network according to claim 1, characterized in that: The step of analyzing and processing the request message to obtain an IPv6 message includes: Determine whether the request message is an IPv6 message. If so, use the request message as the IPv6 message to be sent. If not, determine whether the request message is an IPv4 message. If so, translate the request message into an IPv6 message to be sent through IPv4 / IPv6 translation technology.

3. The method for constructing an IPv6 dedicated network according to claim 1, characterized in that: The method of constructing an outer IPv6 message based on the preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix so that the outer IPv6 address has a dynamic change characteristic and an unforgeable characteristic includes: Calculate the source IPv6 address by random algorithm within the address range of the local IPv6 prefix; Acquire secure communication information, where the secure communication information is secure communication protocol information between the encrypting IPv6 stealth security gateway and the receiving IPv6 stealth security gateway; Determine a cryptographic algorithm based on the preset data communication certificate, and calculate and generate a dynamic target IPv6 address according to the cryptographic algorithm, the secure communication information and the target IPv6 prefix; The source IPv6 address and the target IPv6 address are associated and constructed to obtain an outer IPv6 message.

4. The method for constructing an IPv6 dedicated network according to claim 3, characterized in that: The method of encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain an encapsulated IPv6 message also includes: The IPv6 message is encrypted based on the secure communication information to obtain an updated IPv6 message.

5. A method for constructing an IPv6 dedicated network, characterized in that: Applied to the receiving IPv6 stealth security gateway, including: Receive an IPv6 message sent from an encryption party IPv6 stealth security gateway; wherein the IPv6 message is obtained by obtaining a request message to be sent and a local IPv6 prefix, analyzing and processing the request message to obtain an IPv6 message, determining the corresponding receiving party IPv6 stealth security gateway according to a preset corresponding relationship and a target address of the request message, determining a target IPv6 prefix based on the receiving party IPv6 stealth security gateway, constructing an outer IPv6 message based on a preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and an unforgeable characteristic, and encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain an IPv6 message; Acquire secure communication information, where the secure communication information is secure communication protocol information between the encrypting IPv6 stealth security gateway and the receiving IPv6 stealth security gateway; Determine a cryptographic algorithm based on the preset data communication certificate, and calculate and generate a dynamic verification IPv6 address according to the cryptographic algorithm, the secure communication information and the target IPv6 prefix; Performing a consistency check between the target IPv6 address in the outer IPv6 message and the verification IPv6 address, and if they are inconsistent, discarding the IPv6 message; If they are consistent, the inner IPv6 message in the IPv6 message is taken out, and the inner IPv6 message is decrypted by the secure communication information to obtain the decrypted IPv6 message and the communication receiving terminal device; The decrypted IPv6 message is sent to the communication receiving terminal device corresponding to the query target address.

6. The method for constructing an IPv6 dedicated network according to claim 5, characterized in that: The step of sending the decrypted IPv6 message to a communication receiving terminal device corresponding to the query target address also includes: Based on whether there is an IPv6 / IPv4 translation requirement for the communication receiving terminal device, if so, the decrypted IPv6 message is translated into an IPv4 message based on the IPv4 / IPv6 translation rules, and the IPv4 message is forwarded to the communication receiving terminal device corresponding to the query target address.

7. An IPv6 dedicated network construction system, characterized in that: Applied to the encryption party IPv6 stealth security gateway, including: An acquisition module, used to acquire a request message to be sent and a local IPv6 prefix, wherein the request message is a request message sent by a communication encryption party terminal device, and the local IPv6 prefix is ​​an IPv6 prefix corresponding to the encryption party IPv6 stealth security gateway; A processing module, used for analyzing and processing the request message to obtain an IPv6 message; A first determination module is used to determine the corresponding recipient IPv6 stealth security gateway according to a preset corresponding relationship and a target address of the request message; A second determination module is used to determine a target IPv6 prefix based on the recipient IPv6 stealth security gateway; An encapsulation module is used to construct an outer IPv6 message based on a preset data communication certificate, the local IPv6 prefix and the target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and cannot be forged, and encrypt and encapsulate the IPv6 message through the outer IPv6 message to obtain an encapsulated IPv6 message; The first sending module is used to send the encapsulated IPv6 message to the receiving IPv6 stealth security gateway.

8. An IPv6 dedicated network construction system, characterized in that: Applied to the receiving IPv6 stealth security gateway, including: A receiving module, used for receiving an IPv6 message sent from an encryption party IPv6 stealth security gateway, wherein the IPv6 message is obtained by obtaining a request message to be sent and a local IPv6 prefix, analyzing and processing the request message, and obtaining an IPv6 message, determining a corresponding receiving party IPv6 stealth security gateway according to a preset corresponding relationship and a target address of the request message, determining a target IPv6 prefix based on the receiving party IPv6 stealth security gateway, constructing an outer IPv6 message based on a preset data communication certificate, the local IPv6 prefix, and the target IPv6 prefix, so that the outer IPv6 address has a dynamic change characteristic and an unforgeable characteristic, and encrypting and encapsulating the IPv6 message through the outer IPv6 message to obtain an IPv6 message; An information acquisition module is used to acquire secure communication information, wherein the secure communication information is secure communication protocol information between the encrypting IPv6 stealth security gateway and the receiving IPv6 stealth security gateway; A third determination module is used to determine a cryptographic algorithm based on the preset data communication certificate, and calculate and generate a dynamic verification IPv6 address according to the cryptographic algorithm, the secure communication information and the target IPv6 prefix; A verification module, used for performing consistency verification between the target IPv6 address in the outer IPv6 message and the verification IPv6 address, and if they are inconsistent, discarding the IPv6 message; A decryption module, configured to, when the target IPv6 address in the outer IPv6 message is consistent with the verification IPv6 address, take out the inner IPv6 message in the IPv6 message, and decrypt the inner IPv6 message through the secure communication information to obtain the decrypted IPv6 message and the communication receiving party terminal device; The second sending module is used to send the decrypted IPv6 message to the communication receiving terminal device corresponding to the query target address.

9. A computer-readable storage medium, characterized in that: The computer program is stored which can be loaded by a processor and executes the method for constructing an IPv6 dedicated network according to any one of claims 1 to 4 or any one of claims 5 to 6.

Images