Equipment object identifier generation method for multi-dimensional identifier fusion network

Abstract

The invention discloses an equipment object identifier generation method for a multi-dimensional identifier fusion network. The method comprises the following steps: S1, accessing network equipment to the multi-dimensional identifier fusion network; s2, analyzing attribute information provided by a mapping server based on a network layer of the multi-dimensional identification fusion network deployed in the controller to generate a complete private key of the network equipment; and S3, dynamically generating a unique device object identifier with a variable length through the network layer analysis mapping server according to the multi-dimensional attribute information of the network device in combination with the private key, and sending the unique device object identifier to the corresponding network device. According to the invention, the unique device object identifier is generated to identify and characterize the user identity related information, so that the user identity related information is independent of the position of the user, and the identity information is separated from the position of the user, thereby realizing natural support for mobility and endogenous guarantee for security.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a method for generating device object identifiers for a multi-dimensional identifier fusion network. Background Art

[0002] In recent years, the rapid popularization of the Internet and related technological advances have made network services gradually move towards ubiquity, multimedia, and mobility. The Internet's infrastructure and working mode all rely on network identification. At this stage, the technical system built on the basis of IP network identification has fundamental problems such as rigid network structure, single bearer, and difficulty in suppressing unknown threats. It is difficult to ensure the security and reliability of the network, unable to cope with the changing communication modes of various communication peers in complex military scenarios, and has low efficiency in mobility support.

[0003] In response to the above problems, the multi-dimensional identification fusion network system covers multiple network objects such as devices, content, services, specific groups, etc., maintains the mapping relationship between the three types of information: multi-dimensional unified identification, multi-dimensional attribute description, and network connection identification, separates the static inherent attributes and dynamic network attributes in network objects, realizes the functions of flexible search of network resources and intelligent positioning of services, and gives the network richer resource perception capabilities in addition to data carrying, meeting the communication needs based on multi-dimensional attributes under the multi-dimensional identification fusion network system.

[0004] For the above network system, the existing method for generating Internet device identifiers is as follows:

[0005] (1) Data link layer identifier MAC

[0006] A MAC address is a hardware address in a network device (such as a computer, mobile phone, router, etc.) that is used to uniquely identify the device in the network. It is usually represented by a 48-bit binary number, usually displayed in hexadecimal format. The role of a MAC address is to uniquely identify a network device in a local area network so that the destination address and source address can be identified during data frame transmission. This ensures that data packets are only sent to the correct target device instead of being broadcast to the entire network. The MAC address of each network device is unique, so it can be ensured that no duplicate addresses appear in the local area network. The MAC address is a hardware-level identification of the device and is not affected by the operating system or software configuration, so it is highly reliable in network communications.

[0007] In this method, the data link layer identifier MAC can only uniquely identify the device in the same local area network, and cannot be directly used when communicating across networks. It is not suitable for cross-network communication. Unlike IP addresses, MAC addresses are usually fixed and cannot be changed dynamically. Therefore, in some cases, such as when the device replaces the network interface card or in application scenarios that require anonymity, the MAC address may not be flexible enough.

[0008] (2) Network layer identifier IP

[0009] The IP address is the only unified identifier of the traditional Internet, which is used to uniquely identify and locate a device or host. Each device connected to the Internet is assigned a unique IP address, through which data packets can be accurately routed to the target device. Through the IP address, users can access remote servers, browse web pages, send emails, etc. Therefore, the IP address is regarded as the unique identifier of devices and hosts on the Internet, and it plays a vital role in network communications.

[0010] The design of the above network layer identifier IP has the ambiguity problem of location attribute and identity attribute. It represents both user identity information and user location information, causing many problems, such as mobility support, security and location privacy, multi-home connection, routing scale scalability, etc.

[0011] (3) Application layer identifier URI

[0012] The Internet uses hierarchical semantic URIs at the application layer to uniformly describe services and content resources. URI is a universal identifier used to uniquely identify resources on the Internet, including web pages, files, services, etc. URIs usually have a hierarchical structure and can be composed of multiple parts, including protocol identifiers, host names, paths, etc. In order to convert URIs into actual network addresses, the Internet uses the DNS (Domain Name System) system to perform mapping queries between URIs and IP addresses. The DNS system converts the host name in the URI into the corresponding IP address, allowing users to access the corresponding resources through the URI. The DNS system provides domain name resolution services through distributed domain name servers. Users can send query requests to these servers to obtain the IP address corresponding to the corresponding host name. Users can access various resources on the Internet through URIs without directly operating IP addresses, achieving more convenient and unified network access.

[0013] This method uses the DNS system to perform mapping queries between URIs and IP addresses. This design bundles service content with network locations, causing resources to be dependent on location, poor flexibility, low transmission efficiency, and difficulty in adapting to the rapidly growing demand for video streaming.

[0014] (4) The transport layer lacks independent identification

[0015] The Internet transport layer does not have an independent namespace and uses the (IP+port) format to identify connections. At the transport layer, each network connection is assigned a unique port number and a corresponding target IP address. This port number is used to identify different applications or services, while the IP address is used to identify the target device or host. This connection identification method makes the transport layer namespace dependent on the network layer namespace. When conducting network communications, it is necessary to ensure consistency between the network layer and the transport layer to ensure that data packets can be correctly routed to the target device and application.

[0016] In the above method:

[0017] The data link layer identifier MAC can only uniquely identify a device in the same local area network. It cannot be used directly when communicating across networks and is not suitable for cross-network communication. Unlike IP addresses, MAC addresses are usually fixed and cannot be changed dynamically. Therefore, in some cases, such as when the device replaces the network interface card or in application scenarios that require anonymity, the MAC address may not be flexible enough.

[0018] The design of the network layer identifier IP has the ambiguity problem of location attribute and identity attribute. It represents both user identity information and user location information, causing many problems, such as mobility support, security and location privacy, multi-home connection, routing scale scalability, etc.

[0019] The application layer identifier URI uses the DNS system to perform mapping queries between URI and IP address. This design bundles the service content with the network location, causing resources to be dependent on the location, poor flexibility, low transmission efficiency, and difficulty in adapting to the rapid growth of video streaming needs.

[0020] The Internet transport layer does not have an independent namespace and uses the (IP+port) format to identify connections, making the transport layer namespace dependent on the network layer namespace. This design affects the implementation of multi-home technology and multi-path parallel transmission technology. In addition, due to the lack of dynamic adaptation to support upper-layer user needs and lower-layer network status, it is difficult to support network intelligent communication. Summary of the invention

[0021] In view of the above-mentioned deficiencies in the prior art, the device object identification generation method for a multi-dimensional identification fusion network provided by the present invention solves the ambiguity problem of location attributes and identity attributes in the existing identification naming methods, as well as the problems of voluntary dependence on location, poor network flexibility, low transmission efficiency, and the inability to guarantee security and privacy.

[0022] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is: a device object identification generation method for a multi-dimensional identification fusion network, comprising the following steps:

[0023] S1. Connect network devices to the multi-dimensional identification fusion network;

[0024] S2, generating a complete private key of the network device based on the attribute information provided by the network layer parsing mapping server of the multi-dimensional identity fusion network deployed in the controller;

[0025] S3. Through the network layer parsing mapping server, based on the multi-dimensional attribute information of the network device and in combination with the private key, dynamically generates a unique device object identifier with variable length and sends it to the corresponding network device.

[0026] Furthermore, in step S2, the attribute information provided by the network layer resolution mapping server includes the IP address of the access network device, the ID of the controller, and the IP address of the controller.

[0027] Furthermore, in the step S2, the complete private key of the network device is composed of the first private key part Qu generated by the network device and the first private key part Du generated by the key generation center.

[0028] Furthermore, the step S2 is specifically as follows:

[0029] S21, generate system parameters Params = {q, G1, G2, e, P, Ppub, H1, H2};

[0030] Where q is a large prime number, G1 is an additive cyclic group, G2 is a multiplicative cyclic group, P is an element, and P∈G1, e is a bilinear pairing, H1 and H2 are two secure hash functions;

[0031] S22, performing hash calculation on the attribute information provided by the network layer parsing mapping server to generate a random number t, and selecting the random number xu∈Z*q as the secret value of t, and then combining the system parameters to generate the first private key part Qu=H1(t,Xu) by the network device; wherein Xu is the private key part, Xu=xu·P;

[0032] S23. Based on the first private key part Qu, the key generation center generates a second private key part Du=z·Qu; wherein z is the master key of the key generation center;

[0033] S24. Generate a complete private key SKu=xu·Du of the network device according to the first private key part Qu and the second private key part Du.

[0034] Furthermore, in step S3, the multi-dimensional attribute information of the network device is information describing the source, identity and subordinate relationship of the network device separated from its location information.

[0035] Furthermore, the step S3 is specifically as follows:

[0036] S31, when a user initiates a communication request, a Packet-In message carrying multi-dimensional attribute information is sent to the controller through the edge network device, and the Packet-In message is parsed by the network layer parsing mapping server to generate a binary set M related to its identity information;

[0037] S32. Generate a unique network device identifier DUID=e(SKu·H2(M),P) according to the binary set M and the complete private key SKu; wherein H2(M) represents a hash function applied to the binary set M;

[0038] S33. Send a Packet-Out message carrying a unique network device identifier DUID=e(SKu·H2(M),P) to the corresponding network device.

[0039] Furthermore, the length of the unique device object identifier does not exceed 32 bytes.

[0040] The beneficial effects of the present invention are:

[0041] (1) The present invention identifies and characterizes user identity-related information by generating a unique device object identifier, making it independent of the user's location. This aims to solve the ambiguity problem between location attributes and identity attributes in existing identification and naming methods, as well as the voluntary dependence on location, poor network flexibility, low transmission efficiency, and the inability to guarantee security and privacy. By identifying and characterizing users through DUID, identity information is separated from the user's location, thereby achieving natural support for mobility and inherent security guarantees.

[0042] (2) The identity of the communication entity is determined by the device object identifier generated by the present invention, which will not change due to factors such as device movement, thereby ensuring the long-term effectiveness and stability of the communication process.

[0043] (3) In the method of the present invention, based on the idea of ​​non-public cryptography, the generation scheme of the distributed device object identifier UDID is designed to ensure the security of the access network device and has the characteristics of low generation complexity. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A flow chart of a method for generating device object identifiers for a novel multi-dimensional identifier fusion network provided by the present invention. DETAILED DESCRIPTION

[0045] The specific implementation modes of the present invention are described below to facilitate those skilled in the art to understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0046] The embodiment of the present invention provides a method for generating device object identifiers for a multi-dimensional identifier fusion network. Figure 1 As shown, the following steps are included:

[0047] S1. Connect network devices to the multi-dimensional identification fusion network;

[0048] S2, generating a complete private key of the network device based on the attribute information provided by the network layer parsing mapping server of the multi-dimensional identity fusion network deployed in the controller;

[0049] S3. Through the network layer parsing mapping server, based on the multi-dimensional attribute information of the network device and in combination with the private key, dynamically generates a unique device object identifier with variable length and sends it to the corresponding network device.

[0050] Exemplarily, the multi-dimensional unified identification technology constructs a multi-dimensional unified user identifier (Unified Identifier) ​​and a network-interconnection identifier NID (Network-interconnection Identifier) ​​through an identity and location separation mechanism, which are used to identify network user identity elements and network user location elements, respectively. Among them, the multi-dimensional unified user identifier UID includes a device object identifier (DUID) and an application service identifier (SUID). DUID is used to identify device identity, and SUID is used to identify user application services and content resources in the network. In this embodiment, the detailed generation details of DUID are designed mainly by combining the various attributes corresponding to DUID to achieve accurate characterization of user information.

[0051] In this embodiment, the multi-dimensional attribute information of the network device is information describing the source, identity and subordinate relationship of the network device separated from its location information.

[0052] Specifically, in a multi-dimensional identification fusion network, multi-dimensional attributes are used to describe user needs and network device information. These attributes are calculated by signature encryption to generate a unique UID (unique identifier) ​​under the design concept of location independence. After parsing the multi-dimensional attributes in the user request data message, the corresponding UID can be mapped and obtained to achieve understanding of the user's communication needs. Therefore, the multi-dimensional attributes must comprehensively and accurately characterize the various elements of users, services and content. For the variable-length device object identifier UDID, by extracting multi-dimensional device attributes such as device type, device brand / manufacturer, device serial number, device owner information, device-bound user identity information, and device registration and registration time, the network can accurately characterize the source, identity and affiliation of the user's device. When the user initiates a communication request, the network uniquely determines the identity of the other end by parsing these multi-dimensional attributes, providing the prerequisite for the subsequent mapping process and routing construction. These multi-dimensional attributes include communication objects, device manufacturers, device types, device serial numbers and device owners. By accurately describing and parsing these attributes, the network can meet the user's communication needs and ensure the efficiency and security of communication.

[0053] In step S2 of the embodiment of the present invention, the attribute information provided by the network layer resolution mapping server includes the IP address of the access network device, the ID of the controller, and the IP address of the controller.

[0054] In step S2 of the embodiment of the present invention, the complete private key of the network device is composed of the first private key part Qu generated by the network device and the first private key part Du generated by the key generation center; the communication device object cannot access the complete private key, thereby enhancing the security of key hosting.

[0055] In this embodiment, step S2 is specifically as follows:

[0056] S21: Generate system parameters Params = {q, G1, G2, e, P, Ppub, H1, H2};

[0057] Where q is a large prime number, G1 is an additive cyclic group, G2 is a multiplicative cyclic group, P is an element, and P∈G1, e is a bilinear pairing, H1 and H2 are two secure hash functions;

[0058] Exemplarily, hash functions H1 and H2 are expressed as:

[0059]

[0060] S22, performing hash calculation on the attribute information provided by the network layer parsing mapping server to generate a random number t, and selecting the random number xu∈Z*q as the secret value of t, and then combining the system parameters to generate the first private key part Qu=H1(t,Xu) by the network device; wherein Xu is the private key part, Xu=xu·P;

[0061] S23. Based on the first private key part Qu, the key generation center generates a second private key part Du=z·Qu; wherein z is the master key of the key generation center;

[0062] S24. Generate a complete private key SKu=xu·Du of the network device according to the first private key part Qu and the second private key part Du.

[0063] In this embodiment, in step S3, when the device is offline, the terminal has not yet generated data, but has pre-randomly generated a set of data block labels, and the labels of the reorganized data are recorded as id1, id2, ..., id N The controller calculates the hash values ​​of the tags as H2(id1), H2(id2), ..., H2(id N ) and the hash value of the system public key T = H1(P pub ). The following equation is how each access routing switch device obtains a partial DUID set:

[0064] Φ1={SKu·H2(id n )},1≤n≤N

[0065] Among them, id n It is a data block label randomly generated in the offline phase, subscript n is the index of the data block label, and N is the total number of generated data block labels.

[0066] On this basis, step S3 of this embodiment is specifically as follows:

[0067] S31, when a user initiates a communication request, a Packet-In message carrying multi-dimensional attribute information is sent to the controller through the edge network device, and the Packet-In message is parsed by the network layer parsing mapping server to generate a binary set M related to its identity information;

[0068] S32. Generate a unique network device identifier DUID=e(SKu·H2(M),P) based on the binary set M and the complete private key SKu; wherein H2(M) represents a hash function applied to the binary set M, used to generate a value compatible with the private key operation;

[0069] S33. Send a Packet-Out message carrying a unique network device identifier DUID=e(SKu·H2(M),P) to the corresponding network device.

[0070] In this embodiment, the length of the unique device object identifier generated by the above method does not exceed 32 bytes.

[0071] The device object identification UDID generation method for a multi-dimensional identification fusion network provided in an embodiment of the present invention constructs a multi-dimensional unified device object identification DUID through a method of separating identity and location, uniformly characterizes multi-dimensional elements, identifies the device identity, and makes it independent of the user's location, thereby achieving natural support for mobility and inherent security protection.

[0072] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0073] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A method for generating device object identifiers for a multi-dimensional identifier fusion network, characterized in that: The following steps are involved: S1. Connect network devices to the multi-dimensional identification fusion network; S2, generating a complete private key of the network device based on the attribute information provided by the network layer parsing mapping server of the multi-dimensional identity fusion network deployed in the controller; S3. Through the network layer parsing mapping server, based on the multi-dimensional attribute information of the network device and in combination with the private key, dynamically generates a unique device object identifier with variable length and sends it to the corresponding network device.

2. The device object identification generation method for a multi-dimensional identification fusion network according to claim 1, characterized in that: In the step S2, the attribute information provided by the network layer resolution mapping server includes the IP address of the access network device, the ID of the controller and the IP address of the controller.

3. The device object identification generation method for a multi-dimensional identification fusion network according to claim 1, characterized in that: In the step S2, the complete private key of the network device is composed of the first private key part Qu generated by the network device and the first private key part Du generated by the key generation center.

4. The method for generating device object identifiers for a multi-dimensional identifier fusion network according to claim 1, characterized in that: The step S2 is specifically as follows: S21: Generate system parameters Params = {q, G1, G2, e, P, Ppub, H1, H2}; Where q is a large prime number, G1 is an additive cyclic group, G2 is a multiplicative cyclic group, P is an element, and P∈G1, e is a bilinear pairing, H1 and H2 are two secure hash functions; S22, performing hash calculation on the attribute information provided by the network layer parsing mapping server to generate a random number t, and selecting the random number xu∈Z*q as the secret value of t, and then combining the system parameters to generate the first private key part Qu=H1(t,Xu) by the network device; wherein Xu is the private key part, Xu=xu·P; S23. Based on the first private key part Qu, the key generation center generates a second private key part Du=z·Qu; wherein z is the master key of the key generation center; S24. Generate a complete private key SKu=xu·Du of the network device according to the first private key part Qu and the second private key part Du.

5. The method for generating device object identifiers for a multi-dimensional identifier fusion network according to claim 1, characterized in that: In step S3, the multi-dimensional attribute information of the network device is information describing the source, identity and subordinate relationship of the network device separated from its location information.

6. The method for generating device object identifiers for a multi-dimensional identifier fusion network according to claim 4, characterized in that: The step S3 is specifically as follows: S31, when a user initiates a communication request, a Packet-In message carrying multi-dimensional attribute information is sent to the controller through the edge network device, and the Packet-In message is parsed by the network layer parsing mapping server to generate a binary set M related to its identity information; S32. Generate a unique network device identifier DUID=e(SKu·H2(M),P) according to the binary set M and the complete private key SKu; wherein H2(M) represents a hash function applied to the binary set M; S33. Send a Packet-Out message carrying a unique network device identifier DUID=e(SKu·H2(M),P) to the corresponding network device.

7. The method for generating device object identifiers for a multi-dimensional identifier fusion network according to claim 1, characterized in that: The length of the unique device object identifier does not exceed 32 bytes.

Images