A secure remote connection dynamic IP method and apparatus

Abstract

The application relates to the field of cloud computing and computer networks, and particularly provides a safe remote connection dynamic IP method and device, when the dynamic IP lease period of a device ends, the device sends the current IP and login key of the device to a server with a fixed domain name, stores the IP in a newly-built address server at a remote end, constructs a linked list index in the remote server, takes the IP obtained for the first time as the head of the linked list, and whenever the device obtains a new IP, the IP is recorded in the form of a chain based on the IP of the first server. Compared with the prior art, the application can perform IP transmission in the way, establish a safer IP protection mechanism, and make the dynamic IP better maintain the secrecy and security.

Description

Technical Field

[0001] This invention relates to the fields of cloud computing and computer networks, and specifically provides a secure method and apparatus for remote connection to dynamic IP addresses. Background Technology

[0002] In production environments, we often need to perform operations on multiple computers. For ease of operation, it's inevitable to connect multiple devices to the same machine. Different operating systems offer different remote connection methods: Windows uses remote connection tools, Linux uses SSH commands, and Ubuntu uses Remmina. However, different connection tools require the target's IP address. Dynamic IPs offer advantages such as automatic address allocation and no network resource consumption, leading to their increasing adoption on devices. However, this also impacts the success of remote connections.

[0003] Currently, the mainstream method for connecting to dynamic IPs is to bind a dynamic IP to a fixed domain name. This is achieved by modifying the domain name's resolution logs and updating the DNS server logs. Dynamic DNS service is a solution that maps dynamic IP addresses to fixed domain names. Users can register their dynamic IP addresses with a dynamic DNS service provider and then resolve their domain names to that dynamic IP address. When a user's dynamic IP address changes, the dynamic DNS service automatically updates the mapping between the IP address and the domain name, ensuring that the user's domain name resolution always points to the correct IP address. Alternatively, the domain name and IP mapping can be updated through DDNS client software, or the domain name mapping can be updated manually.

[0004] However, the former has certain security risks and is easily monitored by port surveillance. The latter is inconvenient to operate. Summary of the Invention

[0005] This invention addresses the shortcomings of the prior art by providing a practical and secure method for remote connection to dynamic IP addresses.

[0006] A further technical objective of this invention is to provide a reasonably designed, safe, and applicable secure remote connection dynamic IP device.

[0007] The technical solution adopted by this invention to solve its technical problem is:

[0008] A secure method for remote connection to dynamic IP addresses involves sending the device's current IP address and login key to a server with a fixed domain name within a certain period after the dynamic IP lease expires. This information is then stored on a newly established remote address server. A linked list index is constructed on the remote server, with the IP address obtained by the device for the first time serving as the head of the list. Whenever the device obtains a new IP address, it records the new IP address based on the IP address obtained from the first server.

[0009] Furthermore, when a device needs to access a target IP, the IP of the first server of the target will be redirected to a fixed domain name, the server will be connected and the corresponding IP of the second target server will be returned. The IP will be decrypted according to the key provided by the server that established the connection, and the IP of the next target server will be determined.

[0010] Furthermore, the address server is configured to connect with the DHCP server's resolution log. Whenever the target server requests an IP address, the linked list is updated and matched with the IP address and key sent by the target server. This process is repeated to form a chain-like tracking of dynamic IP addresses.

[0011] Furthermore, when forming a dynamic IP chain tracing, the specific acquisition process is as follows:

[0012] (1) When the target computer obtains a randomly assigned IP address from the DHCP server for the first time, the storage server establishes the corresponding database field, establishes a linked list relationship, stores the key, and adds a flag bit;

[0013] (2) After the target computer goes offline, the DHCP server reclaims the IP address, and the storage server calculates the flag bit based on the connection time, records it, and returns it to the connection server.

[0014] (3) When the target computer reconnects to the Internet, it starts calculating the usage time, sends the IP to the storage server, and adds the IP to the next node in the database according to the flag bit;

[0015] (4) After the first connection to the target computer, the first IP address and flag of the target computer will be stored locally. When trying to connect to the above IP address again, the system will first jump to the storage server, traverse the linked list according to the flag, obtain the latest IP address of the target computer, and complete the connection.

[0016] Furthermore, when the remote storage server uses the SHA256 asymmetric encryption algorithm, it requires 8 initial hash values ​​and 64 hash constants.

[0017] Furthermore, the eight initial hash values ​​are as follows:

[0018] h0:=0x6a09e667, h1:=0xbb67ae85, h2:=0x3c6ef372, h3:=0xa54ff53a, h4:=0x510e527f, h5:=0x9b05688c, h6:=0x1f83d9ab, h7:=0x5be0cd19.

[0019] Furthermore, after obtaining the hash value, preprocessing is performed, and additional length is added. This is done at the end of the message so that the remainder after taking the modulo of the message length of 512 is 448. After adding the first bit, it is set to 1, and the rest are filled with 0, until the length meets the modulo condition.

[0020] Furthermore, the append length value is used to add the length information of the original data to the end of the already padded message. SHA256 uses a 64-bit data to represent the length of the original message.

[0021] Furthermore, after using a 64-bit data to represent the length of the original message, SHA256 performs logical operations. All operations of the SHA256 hash function are logical bitwise operations:

[0022]

[0023] Ma(x,y,z)=(x∧y)⊕(x∧z)⊕(y∧z);

[0024] Σ0(x)=S2(x)⊕S13(x)⊕S22(x);

[0025] Σ1(x)=S6(x)⊕S11(x)⊕S25(x);

[0026] σ0(x)=S7(x)⊕S18(x)⊕R3(x);

[0027] σ1(x)=S17(x)⊕S19(x)⊕R10(x);

[0028] The message after the operation is completed is divided into multiple blocks. After multiple iterations, the final result is the hash value. Finally, 64 words are constructed to obtain the information block. The process is repeated 64 times to generate 8 words to obtain the hash string.

[0029] A secure remote connection dynamic IP device includes: at least one memory and at least one processor;

[0030] The at least one memory is used to store a machine-readable program;

[0031] The at least one processor is configured to invoke the machine-readable program to execute a secure remote connection dynamic IP method.

[0032] Compared with the prior art, the secure remote connection dynamic IP method and apparatus of the present invention have the following outstanding advantages:

[0033] (1) This invention eliminates the need to call the domain name binding method for remote connection access, preventing hacker attacks through port scanning and increasing security. By introducing a time stamp, a local copy of the stamp generated based on the dynamic IP is stored, enabling more secure access to the target computer. Through chained storage, each new IP can be retrieved based on time and the stamp, facilitating the investigation and preservation of past IPs.

[0034] (2) Configure routing table usage policies on the border router. Different routing prefixes may use different routing tables to achieve classified access of border services. For example, for critical or latency-sensitive services, static optimal path routing table or shortest path routing table can be used, while for high-volume and latency-insensitive services, dynamic optimal path routing table can be used.

[0035] By using hierarchical routing tables, network traffic can be preemptively diverted from potentially congested links, which helps reduce the risk of network congestion and improves the overall operational efficiency of the network. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Appendix Figure 1 This is a flowchart illustrating a secure method for remotely connecting to a dynamic IP address. Detailed Implementation

[0038] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to specific embodiments. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0039] The following is a preferred embodiment:

[0040] like Figure 1As shown in this embodiment, a secure remote connection method for dynamic IP addresses involves the device sending its current IP address and login key to a server with a fixed domain name within a certain period after the dynamic IP lease expires. This information is then stored on a newly established address server on the remote server. A linked list index is constructed on the remote server, with the IP address obtained by the device for the first time serving as the head of the linked list. Whenever the device obtains a new IP address, it records the new IP address based on the IP address obtained from the first server, and so on.

[0041] When a device needs to access a target IP, the IP of the first server of the target will be redirected to a fixed domain name, the server will be connected and the corresponding IP of the second target server will be returned. The IP will be decrypted according to the key provided by the server that established the connection, and the IP of the next target server will be determined.

[0042] The address server is configured to connect with the DHCP server's resolution log. Whenever a target server requests an IP address, the linked list is updated, and the IP address and key are matched against the target server's IP address. This process is repeated continuously, forming a dynamic IP address chain trace. The matching method between IP addresses and keys further enhances security.

[0043] The specific acquisition process is as follows:

[0044] (1) When the target computer obtains a randomly assigned IP address from the DHCP server for the first time, the storage server establishes the corresponding database field, establishes a linked list relationship, stores the key, and adds a flag bit.

[0045] (2) After the target computer goes offline, the DHCP server reclaims the IP address, and the storage server calculates the flag bit based on the connection time, records it, and returns it to the connection server.

[0046] (3) When the target computer reconnects to the Internet, it starts calculating the usage time, sends the IP to the storage server, and adds the IP to the next node of the database according to the flag bit.

[0047] (4) After the first connection to the target computer, the connecting computer will store the first IP address and flag of the target computer locally. When trying to connect to this IP address again, it will first jump to the storage server, traverse the linked list according to the flag address, obtain the latest IP address of the target computer, and complete the connection.

[0048] The remote storage server uses the SHA256 asymmetric encryption algorithm. This process requires 8 initial hash values ​​and 64 hash constants. The 8 initial constants are as follows:

[0049] h0:=0x6a09e667, h1:=0xbb67ae85, h2:=0x3c6ef372, h3:=0xa54ff53a, h4:=0x510e527f, h5:=0x9b05688c, h6:=0x1f83d9ab, h7:=0x5be0cd19.

[0050] These initial values ​​are derived from the first 32 bits of the fractional part of the square root of the first 8 prime numbers (2, 3, 5, 7, 11, 13, 17, 19).

[0051] 428a2f98 71374491b5c0fbcf e9b5dba5 3956c25b 59f111f1 923f82a4ab1c5ed5 d807aa98 12835b01 243185be 550c7dc3 72be5d74 80deb1fe 9bdc06a7c19bf174 e49b69c1 efbe47860fc19dc6 240ca1cc 2de92c6f 4a7484aa 5cb0a9dc76f988da983e5152 a831c66d b00327c8 bf597fc7 c6e00bf3 d5a79147 06ca635114292967 27b70a85 2e1b2138 4d2c6dfc 53380d13 650a7354 766a0abb 81c2c92e92722c85 a2bfe8a1 a81a664b c24b8b70c76c51a3 d192e819 d6990624f40e3585106aa070 19a4c116 1e376c082748774c 34b0bcb5 391c0cb3 4ed8aa4a 5b9cca4f682e6ff3 748f82ee78a5636f 84c87814 8cc70208 90befffa a4506ceb bef9a3f7c67178f2

[0052] The above constant is derived by taking the first 32 bits of the fractional part of the cube root of the first 64 prime numbers in the natural numbers (2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97…).

[0053] After obtaining the hash value, preprocessing is required. This involves padding with appended length information. Padding is performed at the end of the message so that the remainder after modulo 512 is 448. The first bit is padded with 1, and the rest with 0, until the length meets the modulo condition. Padding is mandatory. The appended length value is the length information of the original data appended to the padded message. SHA256 uses a 64-bit data to represent the length of the original message.

[0054] Then logical operations are performed; all operations in the SHA256 hash function are logical bitwise operations:

[0055]

[0056] Ma(x,y,z)=(x∧y)⊕(x∧z)⊕(y∧z);

[0057] Σ0(x)=S2(x)⊕S13(x)⊕S22(x);

[0058] Σ1(x)=S6(x)⊕S11(x)⊕S25(x);

[0059] σ0(x)=S7(x)⊕S18(x)⊕R3(x);

[0060] σ1(x)=S17(x)⊕S19(x)⊕R10(x);

[0061] The message after the operation is completed is divided into multiple blocks. After multiple iterations, the final result is the hash value. Finally, 64 words are constructed to obtain the information block. Finally, 64 loops are performed to generate 8 words, which gives the hash string.

[0062] Based on the above method, a secure remote connection dynamic IP device in this embodiment includes: at least one memory and at least one processor;

[0063] The at least one memory is used to store a machine-readable program;

[0064] The at least one processor is configured to invoke the machine-readable program to execute a secure remote connection dynamic IP method.

[0065] The specific embodiments described above are merely specific examples of the present invention. The patent protection scope of the present invention includes, but is not limited to, the specific embodiments described above. Any technical solution that conforms to the technical claims of the present invention and any appropriate changes or substitutions made by a person skilled in the art should fall within the patent protection scope of the present invention.

[0066] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A secure remote connection dynamic IP method, characterized in that, When the dynamic IP lease period of the device ends, the device sends the current device IP and login key to the server of the fixed domain name, and stores it in the newly created address server in the remote end. A linked list index is constructed in the remote server, and the IP obtained by the device for the first time is used as the head of the linked list. Whenever the device obtains a new IP, it will be recorded based on the IP of the first server. When a device needs to access the target IP, the IP of the first server of the target will jump to the fixed domain name, connect to the server and return the IP of the second target server. The next target server obtains the IP according to the key provided by the connection server for decryption. The address server is connected with the parsing log of the DHCP server, and the linked list is updated whenever the target server requests IP and the IP and key sent by the target server correspond to each other. The dynamic IP chain tracking is formed by repeating the above steps. When the dynamic IP chain tracking is formed, the specific acquisition process is as follows: (1) When the target computer obtains the random allocation IP of the DHCP server for the first time, the storage server establishes the corresponding database field, establishes the linked list relationship, stores the key and adds the flag bit. (2) After the target computer is offline, the DHCP server recovers the IP, and the storage server calculates the flag bit according to the connection time, records and returns it to the connection server. (3) When the target computer connects to the Internet again, start calculating the use time, send the IP to the storage server, and add the IP to the next node of the database according to the flag bit. (4) After the first connection of the target computer, the first IP and the flag bit of the target computer will be stored locally. When trying to connect the above IP again, it will first jump to the storage server, traverse the linked list according to the flag bit, and obtain the latest IP of the target computer to complete the connection.

2. The secure remote connection dynamic IP method of claim 1, wherein, When the remote storage server uses SHA256 asymmetric encryption algorithm, 8 hash initial values and 64 hash constants are needed.

3. The secure remote connection dynamic IP method of claim 2, wherein, The 8 hash initial values are as follows: h0 := 0x6a09e667, h1 := 0xbb67ae85, h2 := 0x3c6ef372, h3 := 0xa54ff53a, h4 := 0x510e527f, h5 := 0x9b05688c, h6 := 0x1f83d9ab, h7 := 0x5be0cd19.

4. The secure remote connection dynamic IP method of claim 3, wherein, After obtaining the hash value, pre-processing is performed, and additional length is filled. The message is padded at the end to make the message length 512 modulo 448. The first bit is filled with 1, and the rest is filled with 0 until the length meets the modulo condition.

5. The secure remote connection dynamic IP method of claim 4, wherein, The additional length value is the length information of the original data filled after the message that has been padded. SHA256 uses a 64-bit data to represent the length of the original message.

6. The secure remote connection dynamic IP method of claim 5, wherein, After SHA256 uses a 64-bit data to represent the length of the original message, logical operations are performed. All SHA256 hash function operations are logical bit operations: Ch(x,y,z)=(x∧y)⊕(¬x∧z). Ma(x, y, z) = (x A y) O (x A z) O (y A z); ∑0(x) = S2(x) O S13(x) O S22(x); ∑1(x) = S6(x) O S11(x) O S25(x); σ0(x) = S7(x) O S18(x) O R3(x); σ1(x) = S17(x) O S19(x) O R10(x); The message at the end of the operation is divided into multiple blocks, and the final result after multiple iterations is the hash value. Finally, 64 words are constructed to obtain an information block, and 64 cycles are performed to generate 8 word cycles to obtain a hash string.

7. A secure remote connection dynamic IP apparatus, characterized by, Comprise: at least one memory and at least one processor; The at least one memory is used for storing machine readable programs; The at least one processor is used for calling the machine readable programs, and executing the method in any one of claims 1 to 6.

Images