IPv6 vulnerability scanning method and system and computer readable storage medium

Abstract

The embodiment of the invention relates to the technical field of network data, in particular to an IPv6 vulnerability scanning method and system and a computer readable storage medium, and the IPv6 vulnerability scanning method comprises the steps: carrying out the overall address planning of an IPv6 address, and dividing a network prefix and an interface bit; performing address coloring on the interface bit; obtaining active IPv6 information in an IPv6 network; associating the colored IPv6 address with the corresponding carried service and / or asset; the active IPv6 information is synchronized; and when the active IPv6 information is updated, dynamically adjusting the vulnerability scanning target list and strategy. According to the method and the device, the colored IPv6 address is associated with the corresponding borne service and / or assets, so that the assets in the IPv6 network are accurately positioned, blind scanning is reduced, the accuracy of vulnerability detection is remarkably improved, the false alarm rate is reduced, effective utilization of scanning resources is ensured, and meanwhile, the effectiveness and the pertinence of vulnerability scanning are also improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network data technology, and in particular to an IPv6 vulnerability scanning method, system and computer-readable storage medium. Background Art

[0002] IPv6 is the next generation Internet protocol, which has made great improvements in address space, security, QOS, etc., and can effectively support new technology applications such as the Internet of Things, cloud computing, big data, and artificial intelligence. It is a general trend to use IPv6 technology to solve address shortages and cultivate innovation space. Countries around the world have fully realized the urgency of large-scale deployment of IPv6. The global communications industry and companies that develop emerging technology applications are migrating to IPv6, which is regarded by the industry and governments as the only way for the evolution of the Internet.

[0003] Currently, networks and applications in various industries are evolving from IPv4 to IPv6 on a large scale. With the popularization of IPv6, network security issues are becoming increasingly prominent. The complexity of IPv6 addresses makes it difficult for traditional network security protection measures to fully adapt, and new security strategies and technical means are needed to deal with them. Vulnerability scanning is one of the important means of IPv6 network security protection, which can timely discover and repair security vulnerabilities in IPv6 networks and improve system security. However, in the IPv6 network environment, address allocation is more flexible, and IPv6 address allocation and usage modes for different business types are different. There is a lack of effective business identification mechanism, and business identification is difficult, which makes it difficult to accurately scan vulnerability scans for specific business needs, reducing the effectiveness and pertinence of the scan. Summary of the invention

[0004] In a first aspect, an embodiment of the present application provides an IPv6 vulnerability scanning method.

[0005] The IPv6 vulnerability scanning method comprises: Perform overall address planning for IPv6 addresses, and divide network prefixes and interface bits; Address coloring for interface bits; Get active IPv6 information in the IPv6 network; Associating the colored IPv6 address with the corresponding carried services and / or assets; Synchronize active IPv6 information; Dynamically adjust vulnerability scanning target lists and policies when active IPv6 information is updated; Among them, active IPv6 information includes address information, business information and asset information.

[0006] Due to the adoption of the above-mentioned scheme, the IPv6 vulnerability scanning method described in the present application can achieve accurate matching of IPv6 addresses and services / assets by associating the colored IPv6 addresses with the corresponding carried services and / or assets, thereby providing a detailed view for asset security management; by synchronizing active IPv6 information, accurate targets and scopes are provided for IPv6 vulnerability scanning; when the active IPv6 information is updated, the vulnerability scanning target list and strategy are dynamically adjusted to ensure the timeliness and accuracy of vulnerability scanning.

[0007] That is to say, the IPv6 vulnerability scanning method of the embodiment of the present application achieves accurate positioning of assets in the IPv6 network by associating the colored IPv6 address with the corresponding carried services and / or assets, reduces blind scanning, significantly improves the accuracy of vulnerability detection, reduces the false alarm rate, ensures the effective use of scanning resources, and also improves the effectiveness and pertinence of vulnerability scanning.

[0008] In a possible implementation, the IPv6 vulnerability scanning method further includes: Identify businesses and / or assets based on IPv6 address coloring; Customize corresponding vulnerability scanning strategies based on identification results and / or security level information.

[0009] In a possible implementation, the IPv6 vulnerability scanning method further includes: According to the corresponding vulnerability scanning strategy, perform vulnerability scanning on the IPv6 network to obtain the existing IPv6 security vulnerabilities; Conduct special detection on IPv6-specific vulnerability attack methods and generate detailed scanning reports.

[0010] In a possible implementation, the overall address planning of the IPv6 address and the division of the network prefix and the interface bit include: Divide the first 64 bits of the IPv6 address into a network prefix; The last 64 bits of the IPv6 address are divided into interface bits.

[0011] In a second aspect, an embodiment of the present application further relates to an IPv6 vulnerability scanning system, comprising: The IPv6 address management platform is used to plan the overall address of IPv6 addresses, divide network prefixes and interface bits, perform address coloring on interface bits, obtain active IPv6 information in the IPv6 network, and associate the colored IPv6 addresses with the corresponding carried services and / or assets, and when the active IPv6 information is updated, push the updated active IPv6 information to the IPv6 vulnerability scanning platform; IPv6 vulnerability scanning platform, used to dynamically adjust vulnerability scanning target lists and policies based on updated active IPv6 information; Among them, IPv6 information includes address information, business information and asset information. The IPv6 address management platform and the IPv6 vulnerability scanning platform establish a linkage mechanism to synchronize active IPv6 information.

[0012] In a possible implementation, the IPv6 vulnerability scanning platform is also used to perform business and / or asset identification based on IPv6 address coloring, and customize corresponding vulnerability scanning strategies based on the identification results and / or security level information.

[0013] In a possible implementation, the IPv6 vulnerability scanning platform is also used to perform vulnerability scanning on the IPv6 network according to the corresponding vulnerability scanning strategy, obtain existing IPv6 security vulnerabilities, and perform special detection on IPv6-specific vulnerability attack methods to generate a detailed scanning report.

[0014] In a possible implementation, the IPv6 vulnerability scanning platform is also used to synchronously feed back data generated during the vulnerability scanning process to the IPv6 address management platform.

[0015] In a third aspect, an embodiment of the present application further discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed, any one of the IPv6 vulnerability scanning methods in the first aspect above is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of the flow of the IPv6 vulnerability scanning method in the first embodiment; Figure 2 A schematic diagram of identifying specific business assets based on IPv6 address coloring; Figure 3 Schematic diagram of the overall structure of the IPv6 vulnerability scanning system in the second embodiment. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described in detail by means of implementation methods with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0018] It should be noted that: in the accompanying drawings, the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions; in the description of the present application, for the convenience of describing the present application and simplifying the description, it is not to indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the scope of protection of the present application; in the description of the present application, "first", "second", etc. are only used to distinguish each other, rather than to indicate their importance and order, etc.

[0019] IPv6 is the abbreviation of "Internet Protocol Version 6" in English. It is the next-generation IP protocol designed by the Internet Engineering Task Force (IETF) to replace IPv4.

[0020] In the current IPv6 network environment, address allocation is more flexible, and IPv6 address allocation and usage modes for different service types are different. There is a lack of effective service identification mechanism, which makes service identification difficult and difficult to perform precise vulnerability scanning for specific service needs, reducing the effectiveness and pertinence of the scan. In order to perform precise vulnerability scanning for specific service needs and improve the effectiveness and pertinence of IPV6 vulnerability scanning, the first embodiment of the present application provides an IPv6 vulnerability scanning method. Figure 1 As shown, the IPv6 vulnerability scanning method includes the following steps: S1, perform overall address planning for IPv6 addresses and divide network prefixes and interface bits.

[0021] According to the IPv6 address prefix, the IPv6 address can be unicast, multicast, or anycast. Here, the IPv6 address can be planned as a whole according to the actual situation, that is, according to the business needs, to achieve refined IPv6 address planning and allocation, and thus obtain an overall IPv6 address planning solution.

[0022] Specifically, the network prefix of the IPv6 address can be planned, and semantic definitions including organizational structure, network type, and business area can be made. The interface bit of the IPv6 address can also be planned, and semantic definitions including business type, device type, system type, and security level can be made.

[0023] S2, address coloring for interface bits.

[0024] Here, the whole process of semantically identifying IPv6 addresses and identifying services and / or assets through semantic identification is called address coloring. The coloring of addresses can be associated with information such as service type, device type, system type, and security level.

[0025] S3, obtaining active IPv6 information in the IPv6 network, wherein the IPv6 information includes address information, service information, and asset information.

[0026] S4, associating the colored IPv6 address with the corresponding carried services and / or assets.

[0027] By obtaining active IPv6 information in the IPv6 network, that is, obtaining address information, business information, and asset information in the IPv6 network, and associating the colored IPv6 address with the business and / or assets it carries, it is possible to achieve accurate matching of IPv6 addresses with businesses and / or assets, providing a detailed view for asset security management.

[0028] At the same time, since the colored IPv6 address is associated with the business and / or assets it carries, when identifying IPv6 services, the IPv6 address coloring information can be used to quickly and accurately identify the current business and / or asset type, thereby further performing IPv6 vulnerability scanning on devices or applications of different business types and different security levels, thereby achieving the purpose of accurate and efficient vulnerability scanning.

[0029] S5, synchronize active IPv6 information.

[0030] Specifically, the IPv6 address management platform and the IPv6 vulnerability scanning platform establish a linkage mechanism to achieve real-time synchronization of information. The synchronized information includes active IPv6 address information, business information, and asset information in the network. By synchronizing active IPv6 information, accurate targets and scopes can be provided for IPv6 vulnerability scanning, and accurate positioning of assets in the IPv6 network can be achieved, reducing blind scanning and improving the accuracy of IPv6 network vulnerability detection. At the same time, since blind scanning of IPv6 network vulnerabilities is reduced, the false alarm rate can also be reduced, ensuring the effective use of scanning resources.

[0031] S6, when active IPv6 information is updated, dynamically adjust the vulnerability scanning target list and strategy. That is, when active IPv6 information changes, dynamically adjust the vulnerability scanning target list and strategy according to the update of active IPv6 information to ensure the timeliness and accuracy of IPv6 network vulnerability scanning, so as to perform precise scanning for specific business needs.

[0032] In addition, by synchronizing active IPv6 information and dynamically adjusting the vulnerability scanning target list and strategy when the active IPv6 information is updated, it also ensures that the vulnerability scan can respond quickly to network changes and promptly discover new vulnerabilities, shortening the time window from vulnerability discovery to repair, and effectively improving network security response speed and protection capabilities.

[0033] In summary, the IPv6 vulnerability scanning method of the embodiment of the present application can achieve accurate matching of IPv6 addresses and services / assets by associating the colored IPv6 addresses with the corresponding carried services and / or assets, providing a detailed view for asset security management; by synchronizing active IPv6 information, accurate targets and scopes are provided for IPv6 vulnerability scanning; when the active IPv6 information is updated, the vulnerability scanning target list and policy are dynamically adjusted to ensure the timeliness and accuracy of vulnerability scanning.

[0034] That is to say, the IPv6 vulnerability scanning method of the embodiment of the present application achieves accurate positioning of assets in the IPv6 network by associating the colored IPv6 address with the corresponding carried services and / or assets, reduces blind scanning, significantly improves the accuracy of vulnerability detection, reduces the false alarm rate, ensures the effective use of scanning resources, and also improves the effectiveness and pertinence of vulnerability scanning.

[0035] In addition, the huge space of IPv6 addresses makes vulnerability scanning face greater challenges. The IPv6 protocol uses a 128-bit address space. Traditional scanning methods often do not fully consider such a huge address range when designing, which makes it difficult for traditional scanning methods to efficiently traverse large-scale networks. The IPv6 vulnerability scanning method of the present application, based on the overall address planning of IPv6 addresses, associates the colored IPv6 addresses with the corresponding carried services and / or assets, thereby achieving accurate positioning of assets in the IPv6 network, reducing blind scanning, and can traverse large-scale networks more efficiently than traditional vulnerability scanning methods.

[0036] In addition, the IPv6 vulnerability scanning method of the embodiment of the present application is applicable to IPv4 / IPv6 dual-stack network environment or IPv6 single-stack network environment, and can therefore be widely used in IPv6 upgrades and transformations of networks in industries such as government, enterprise, finance, and education.

[0037] Existing vulnerability scanning systems often adopt relatively fixed and unified scanning strategies, without considering the specific characteristics or security level of the target system. In the IPv6 environment, different network areas, different business types, and different security level devices or services may require differentiated scanning strategies, such as scanning frequency, scanning depth, scanning time period, etc. A single scanning strategy cannot adapt to this complexity. In order to solve the problem that the existing vulnerability scanning system adopts a single scanning strategy and cannot adapt to the complexity of the IPv6 network environment, in one possible implementation, the IPv6 vulnerability scanning method also includes: S7, identifying the business and / or asset according to the IPv6 address coloring mark, and customizing the corresponding vulnerability scanning strategy according to the identification result and / or security level information.

[0038] After obtaining the colored address and information associated with the colored address, the business and / or asset identification is performed according to the IPv6 address coloring identifier, and then the corresponding vulnerability scanning strategy is customized according to the identification result and / or security level and other information. Customizing the corresponding vulnerability scanning strategy includes but is not limited to adjusting the scanning depth, scanning frequency, scanning time, scanning plug-in selection, etc. For businesses with higher security levels, more stringent and frequent vulnerability scanning strategies can be adopted. In actual applications, it can be flexibly configured according to different business needs and / or security levels, which will not be repeated here.

[0039] Business identification based on IPv6 address coloring is as follows: based on the IPv6 address after overall address planning, a business color is corresponded to a segment of identifier to identify a type of equipment, a type of business, or a type of service, etc., so as to plan different address allocation plans for different business needs, asset needs and / or security needs environments, and realize the identification of different business and / or asset types.

[0040] In this embodiment, the IPv6 vulnerability scanning method customizes the corresponding vulnerability scanning strategy according to the identification results and / or security level information, and can take differentiated vulnerability scanning operations according to different business needs, asset needs and / or security levels, thereby ensuring in-depth scanning of high-risk areas and avoiding excessive interference with low-risk assets. It not only improves the flexibility and efficiency of vulnerability scanning, but also improves the effective utilization of vulnerability scanning resources, and better adapts to the complexity of IPv6 networks.

[0041] Optionally, the IPv6 vulnerability scanning method further includes: S8, according to the corresponding vulnerability scanning strategy, perform vulnerability scanning on the IPv6 network to obtain the existing IPv6 security vulnerabilities; S9 conducts special detection on IPv6-specific vulnerability attack methods and generates detailed scanning reports.

[0042] Specifically, based on the customized vulnerability scanning strategy, the IPv6 network is scanned for precise vulnerabilities. By scanning active IPv6 information, such as active IPv6 address information, business information or asset information, IPv6 security vulnerabilities in the IPv6 network are discovered.

[0043] IPv6-specific vulnerability attack means can be understood as a specific type or category of network vulnerability attack means. By specifically detecting the unique network vulnerability attack means, the pertinence of the IPv6 vulnerability scanning method can be improved, and the accuracy and efficiency of vulnerability scanning can be further improved.

[0044] Optionally, the specific method for performing overall address planning on the IPv6 address and dividing the network prefix and interface bits includes the following steps: dividing the first 64 bits of the IPv6 address into the network prefix; and dividing the last 64 bits of the IPv6 address into interface bits.

[0045] Specifically, address planning is performed on the first 64 bits of the network prefix of the IPv6 address, including the definition of semantics such as organizational structure, network type, and business area. At the same time, semantic definitions are performed on the last 64 bits of the interface bit of the IPv6 address, including business type, information and communication attributes, device type, system type, and security level.

[0046] After the overall address planning of the IPv6 address, the address coloring of the interface bits in step S2 can be understood as address coloring of the last 64 bits of the IPv6 address, and the coloring mark can be associated with information such as the service type, device type, system type, and security level. The business identification according to the IPv6 address coloring mark is specifically: based on the IPv6 address after the overall address planning, the network prefix of the first 64 bits of the IPv6 address matches the existing organizational structure, network type, and business area, and the last 64 bits of the IPv6 address match the service type, device type, system type, and security level. A business color is corresponding to a segment of identifier to identify a type of device type, a type of business type, or a type of service type, so as to plan different address allocation schemes for different business needs, asset needs, and / or security needs environments, and realize the identification of different business types.

[0047] To sum up, the IPv6 vulnerability scanning method of the present application solves many challenges faced by vulnerability scanning in the IPv6 environment, such as the difficulty of traditional scanning methods to efficiently traverse large-scale networks, the inability to perform differentiated targeted vulnerability scanning, and inefficient false alarms caused by indiscriminate full-network scanning, etc. It realizes precise and efficient vulnerability scanning management, which is of great significance to promoting the security, reliability and management efficiency of IPv6 networks.

[0048] Alternatively, if Figure 2 As shown, the present application also provides a method for identifying specific business assets based on IPv6 address coloring, including address planning for the first 64 bits of the IPv6 network prefix and address planning for the last 64 bits of the IPv6 interface bits.

[0049] The network prefix address planning part identifies the organization's address planning information, including a fixed IPv6 prefix of / 32 that the organization has applied to the China Internet Network Information Center (CNNIC) or a carrier as the basic address space of the organization's network. In order to better manage and identify different services and network elements, the addresses under the IPV6 network prefix are further subdivided into the following levels: Bits 33-48: Used to identify the organization. For example, different departments or branches can be distinguished by different values.

[0050] Bits 49-56: Identify the network type, such as data center network, office network, external access network, etc.

[0051] Bits 57-64: Identify the network area and are used to distinguish geographical locations or logical areas, such as the security management area, business service area, cloud management area, and office area.

[0052] This planning allows you to quickly understand the organization, network type, and region to which a device belongs by only using the first half of the address.

[0053] The last 64 bits of the IPv6 address are carefully planned and classified to facilitate the clear identification of devices, systems and services, including: Bits 65-72: Identifies the device type, such as network equipment, security equipment, IoT terminal, office terminal, server, etc.

[0054] Bits 73-80: Identify the information technology innovation attribute, that is, whether it is an information system that uses domestically produced, independently controllable software and hardware.

[0055] Bits 81-88: Identify the operating system type, such as the operating system version, special security hardening system, etc.

[0056] Bits 89-96: Identifies the service type, such as Web service, database service, middleware service, etc.

[0057] Finally, bits 97-128 are reserved for the specific interface ID, which is used to identify each independent interface in the network and ensure the uniqueness of the IPv6 address.

[0058] Assume that an organization has deployed a middleware service running a domestic operating system in the office network business service area of ​​Sichuan. Its IPv6 address is planned as follows: the first 32 bits are the organization's fixed prefix 2002:3BBA:: / 32; bits 33-48 are 00A1, identifying the Sichuan branch; bits 49-56 are 02, identifying the office network; bits 57-64 are 02, identifying the business service area; bits 65-72 are 04, identifying the server type; bits 73-80 are 01, identifying the trusted computing platform. Device; 81-88 bits take the value 03, indicating the domestic operating system KylinOS; 89-96 bits take the value 02, indicating the middleware service; 97-128 bits take the value 0011, indicating the specific interface ID; the final generated IPv6 address may be in the form of: 2002:3BBA:00A1:0202:0401:0302::0011 / 64, where 0401:0302::0011 is the specific interface identifier, which uniquely identifies a type of service.

[0059] The second embodiment of the present application provides an IPv6 vulnerability scanning system. Figure 3 As shown, the IPv6 vulnerability scanning system includes an IPv6 address management platform and an IPv6 vulnerability scanning platform.

[0060] The IPv6 address management platform is used to perform overall address planning for IPv6 addresses, divide network prefixes and interface bits, perform address coloring on interface bits, obtain active IPv6 information in the IPv6 network, and associate the colored IPv6 addresses with the corresponding carried services and / or assets, and when the active IPv6 information is updated, push the updated active IPv6 information to the IPv6 vulnerability scanning platform.

[0061] Here, the IPv6 address management platform can carry out overall address planning for IPv6 addresses according to business needs, so as to achieve refined IPv6 address planning and allocation, thereby obtaining an overall IPv6 address planning solution. Specifically, network prefixes and interface bits can be divided according to different business needs, and refined address planning and allocation can be carried out for network prefixes and interface bits. Optionally, the first 64 bits of the IPv6 address can be divided into a network prefix, and address planning can be performed on it, with definitions including semantics such as organizational structure, network type, and service area. At the same time, the last 64 bits of the IPv6 address can be divided into interface bits, and address planning can be performed on it, with definitions including semantics such as service type, device type, system type, and security level.

[0062] The IPv6 address management platform performs address coloring on the interface bits. The address coloring identifier can be associated with information such as business type, device type, system type, and security level. When identifying IPv6 services, the current business and / or asset type can be quickly and accurately identified through the IPv6 address coloring information, thereby further performing IPv6 vulnerability scanning on devices or applications of different business types and different security levels, thereby achieving the purpose of accurate and efficient vulnerability scanning.

[0063] The IPv6 address management platform obtains active IPv6 information in the IPv6 network based on the planning information of IPv6 addresses, associates the colored IPv6 addresses with the services and / or assets they carry, and can achieve accurate matching of IPv6 addresses with services and / or assets, providing a detailed view for asset security management. Among them, active IPv6 information includes address information, service information, and asset information.

[0064] In addition, by establishing a linkage mechanism between the IPv6 address management platform and the IPv6 vulnerability scanning platform, active IPv6 information can be synchronized to achieve real-time synchronization of information, providing accurate targets and scopes for IPv6 vulnerability scanning.

[0065] When the active IPv6 information is updated, the IPv6 address management platform will immediately push the updated active IPv6 information to the IPv6 vulnerability scanning platform, so that the scanning target list and strategy can be dynamically adjusted, ensuring the timeliness and accuracy of vulnerability scanning.

[0066] Specifically, Figure 3 As shown in the figure, the IPv6 address management platform includes several modules: IPv6 address planning, IPv6 address management, asset management, application awareness, and standard interface. The IPv6 address planning module is used to plan the overall address of IPv6 addresses and divide network prefixes and interface bits. The IPv6 address management module is used to color the interface bits. The standard interface module is used to establish a communication connection with the IPv6 vulnerability scanning platform. When the active IPv6 information is updated, the updated active IPv6 information is pushed to the IPv6 vulnerability scanning platform through the standard interface. The asset management module is used to manage the assets of the IPv6 network, such as IP, Web sites, and domain names. The application awareness module is mainly used to collect and process information data.

[0067] The IPv6 vulnerability scanning platform is used to dynamically adjust the vulnerability scanning target list and strategy based on the updated active IPv6 information.

[0068] When the IPv6 vulnerability scanning platform detects changes in active IPv6 information, it dynamically adjusts the target list and strategy for vulnerability scanning based on the update of active IPv6 information to ensure the timeliness and accuracy of IPv6 network vulnerability scanning, so as to perform precise scanning for specific business and / or asset needs.

[0069] Specifically, the IPv6 vulnerability scanning platform includes modules such as asset management, asset discovery, vulnerability scanning, vulnerability management, and policy engine. The asset discovery module is used to discover and obtain assets such as gateways and servers in the IPv6 scanning platform, and the asset management platform is used to manage the assets discovered and obtained by the asset discovery module. The vulnerability scanning module is used to scan for possible vulnerabilities in the IPv6 network, and the vulnerability management module is used to manage the scanned network vulnerabilities. The policy engine module is used to dynamically adjust the target list and strategy of vulnerability scanning according to the update of active IPv6 information.

[0070] More specifically, the IPv6 address management platform makes an overall plan for the IPv6 addresses in the infrastructure to achieve refined address planning and allocation, and then performs address coloring on the interface bits in the infrastructure to discover and manage assets in the IPv6 network. The IPv6 vulnerability scanning platform obtains possible vulnerabilities in the IPv6 network by performing vulnerability scanning on the infrastructure. Here, the infrastructure includes but is not limited to security devices, network devices, office terminals, IoT terminals, servers, WEB applications, databases, and middleware.

[0071] In the IPv6 vulnerability scanning system, the IPv6 address management platform achieves accurate positioning of assets in the IPv6 network by associating the colored IPv6 addresses with the corresponding carried services and / or assets, reduces blind scanning, significantly improves the accuracy of vulnerability detection, reduces the false alarm rate, ensures the effective use of scanning resources, and also improves the effectiveness and pertinence of vulnerability scanning.

[0072] Optionally, the IPv6 vulnerability scanning platform is also used to identify services and / or assets based on IPv6 address coloring marks, and customize corresponding vulnerability scanning strategies based on identification results and / or security level information. Specifically, after obtaining the colored address and information associated with the colored address, the IPv6 vulnerability scanning platform performs business and / or asset identification based on the IPv6 address coloring mark, and then customizes the corresponding vulnerability scanning strategy based on the identification results and / or security level information. Customizing the corresponding vulnerability scanning strategy includes but is not limited to adjusting the scanning depth, scanning frequency, scanning time, scanning plug-in selection, etc. In actual applications, it can be flexibly configured according to different business needs, asset needs and / or security levels, which will not be repeated here.

[0073] The IPv6 vulnerability scanning platform customizes corresponding vulnerability scanning strategies according to the identification results and / or security level information, and can take differentiated vulnerability scanning operations according to different business needs, asset needs and / or security levels, thereby ensuring in-depth scanning of high-risk areas and avoiding excessive interference with low-risk assets. This not only improves the flexibility and efficiency of vulnerability scanning, but also improves the effective utilization of vulnerability scanning resources.

[0074] Optionally, the IPv6 vulnerability scanning platform is also used to perform vulnerability scanning on the IPv6 network according to the corresponding vulnerability scanning strategy, obtain existing IPv6 security vulnerabilities, and perform special detection on IPv6-specific vulnerability attack methods to generate a detailed scanning report.

[0075] Special detection is carried out for IPv6-specific vulnerability attack methods. It can conduct targeted detection on a certain type or category of IPv6 vulnerability attack methods. While the IPv6 vulnerability scanning resources remain unchanged, the depth of vulnerability scanning can be deepened. At the same time, more accurate and efficient vulnerability scanning can be achieved.

[0076] Optionally, the IPv6 vulnerability scanning platform is also used to synchronously feed back the data generated during the vulnerability scanning process to the IPv6 address management platform. Here, by synchronously feeding back the data generated during the vulnerability scanning process to the IPv6 address management platform, a closed loop can be formed between the IPv6 address management platform and the IPv6 vulnerability scanning platform to continuously optimize the coloring rules and scanning strategies.

[0077] A third embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed, the above-mentioned IPv6 vulnerability scanning method is implemented.

[0078] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. An IPv6 vulnerability scanning method, characterized in that: include: Perform overall address planning for IPv6 addresses, and divide network prefixes and interface bits; Address coloring for interface bits; Get active IPv6 information in the IPv6 network; Associating the colored IPv6 address with the corresponding carried services and / or assets; Synchronize active IPv6 information; Dynamically adjust vulnerability scanning target lists and policies when active IPv6 information is updated; Among them, IPv6 information includes address information, service information and asset information.

2. The IPv6 vulnerability scanning method according to claim 1, characterized in that: Also includes: Identify businesses and / or assets based on IPv6 address coloring; Customize corresponding vulnerability scanning strategies based on identification results and / or security level information.

3. The IPv6 vulnerability scanning method according to claim 2, characterized in that: Also includes: According to the corresponding vulnerability scanning strategy, perform vulnerability scanning on the IPv6 network to obtain the existing IPv6 security vulnerabilities; Conduct special detection on IPv6-specific vulnerability attack methods and generate detailed scanning reports.

4. The IPv6 vulnerability scanning method according to claim 3, characterized in that: The overall address planning of the IPv6 address and the division of the network prefix and the interface bit include: Divide the first 64 bits of the IPv6 address into a network prefix; The last 64 bits of the IPv6 address are divided into interface bits.

5. An IPv6 vulnerability scanning system, characterized in that: include: The IPv6 address management platform is used to plan the overall address of IPv6 addresses, divide network prefixes and interface bits, perform address coloring on interface bits, obtain active IPv6 information in the IPv6 network, and associate the colored IPv6 addresses with the corresponding carried services and / or assets, and when the active IPv6 information is updated, push the updated active IPv6 information to the IPv6 vulnerability scanning platform; IPv6 vulnerability scanning platform, used to dynamically adjust vulnerability scanning target lists and policies based on updated active IPv6 information; Among them, active IPv6 information includes address information, business information and asset information. The IPv6 address management platform and the IPv6 vulnerability scanning platform establish a linkage mechanism to synchronize active IPv6 information.

6. An IPv6 vulnerability scanning system as claimed in claim 5, characterized in that: The IPv6 vulnerability scanning platform is also used to identify services and / or assets based on IPv6 address coloring, and customize corresponding vulnerability scanning strategies based on the identification results and / or security level information.

7. An IPv6 vulnerability scanning system as claimed in claim 6, characterized in that: The IPv6 vulnerability scanning platform is also used to perform vulnerability scans on IPv6 networks according to corresponding vulnerability scanning strategies, obtain existing IPv6 security vulnerabilities, conduct special detection of IPv6-specific vulnerability attack methods, and generate detailed scanning reports.

8. An IPv6 vulnerability scanning system as claimed in claim 7, characterized in that: The IPv6 vulnerability scanning platform is also used to synchronously feed back the data generated during the vulnerability scanning process to the IPv6 address management platform.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, an IPv6 vulnerability scanning method as claimed in any one of claims 1 to 4 is implemented.

Images