Application service identifier generation method for multi-dimensional identifier fusion network

Abstract

The invention discloses an application service identifier generation method for a multi-dimensional identifier fusion network, and the method comprises the steps: generating a variable-length application service identifier according to multi-dimensional attribute information through a non-equivalent encryption mode based on an elliptic curve when an opposite end initiates a service request response; the multi-dimensional attribute information comprises information which carries corresponding attributes and is obtained after states and requirements of application services / contents are identified and classified; the life cycle of the application service identifier is managed according to its service / content provision mode. According to the embodiment of the invention, the description of the network service is more standardized and unified by introducing the application service mark, and the availability, manageability and security of the network service are improved. Generation and representation of application service identification are an important technology, so that service description and customization of a multi-dimensional identification network and system are more accurate and comprehensive.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to an application service identifier generation method for a multi-dimensional identifier fusion network. Background Art

[0002] The traditional Internet is a unified, abstract network. IP addresses play an important role at the network layer. They can not only effectively identify the identity of a device, but also the location of the device, thereby completing the path addressing and data packet routing tasks between the host and the network. The IP address is a unified identification address format provided by the IP protocol, which assigns a unique identifier to each host or router interface on the Internet. The IP address assigns a logical address to each network and each host on the Internet, thereby shielding the differences in the physical addresses of the devices. Its unique structure enables it to be easily and effectively addressed in a short period of time. The allocation of IP addresses is managed by the Internet Corporation for Assigned Names and Numbers (ICANN).

[0003] In order to meet the urgent needs of diversified emerging services for the future Internet in terms of high security, lightweight, intelligence, efficiency, mobility, etc., solve the basic problems caused by the static and rigid architecture of the Internet, such as the single identity carrier and the difficulty in suppressing unknown threats, and overcome the various design differences between multi-dimensional heterogeneous identity spaces. Based on an in-depth study of the existing network identity system and its derivative technologies, a multi-dimensional identity fusion network is proposed, which adopts the principle of identity space separation to decouple and separate elements such as user identity, user application and network location, and uses a multi-dimensional unified user identifier (Unified Identifier, UID) to identify and characterize the terminal user identity, peer communication service and communication content, making it independent of the user's location, thereby achieving natural support for mobility and inherent security.

[0004] Existing IP naming methods for the above network include:

[0005] (1) Host Identity Protocol (HIP)

[0006] The Host Identity Protocol (HIP) is a host-based identity and location separation protocol. HIP introduces a host identity layer between the network layer and the transport layer in the TCP / IP architecture, and introduces a new host identity (HI) space between the domain name space and the IP address space. HIP uses HI as the host identity of the node for transport layer connections; it uses the IP address as the location identifier of the node for network layer routing. Therefore, HIP cancels the tight coupling relationship between the network layer and the transport layer and separates the dual functions of the IP address. The HIP protocol uses an extended header to represent the protocol header, encapsulates it with an Encapsulated Security Payload (ESP), and establishes an end-to-end IPSec ESP security association between two hosts to enhance data security. When HIP was first designed, it was mainly to solve security issues, and did not consider solving routing scalability issues.

[0007] (2) Location Identity Separation Protocol LISP

[0008] LISP (Locator / Identifier Separation Protocol) is a network protocol based on the identity and location separation mechanism proposed by Cisco. LISP divides IP addresses into Endpoint Identifier (EID) and Routing Locator (RLOC). EID is the IP address assigned to the terminal system, which is used to identify the identity information of the host in the access network. RLOC is the IP address assigned to the router, which is used to identify the location information of the host in the core network. LISP adopts the encapsulation mapping method. The ingress tunnel router (ITR) and the egress tunnel router (ETR) encapsulate and decapsulate the ingress data and egress data respectively. When the user initiates communication, EID is used as the source address and destination address. When the data packet arrives at the ITR, the ITR uses RLOC to encapsulate a LISP header for the data packet and forwards the data packet to the core network. The core network routes the data packet to the ETR according to the RLOC. The ETR decapsulates the data packet and removes the LISP header, and then routes the data packet to the communication peer according to the EID to complete a communication process.

[0009] (3)Handle system

[0010] The Handle System was proposed by the US National Research Institute (CNRI) in 1995 under the leadership of Dr. Robert Kahn, the father of the Internet, co-inventor of the TCP / IP protocol, and Turing Award winner. The Handle System is part of the Digital Object Architecture (DOA). The original DNS resolution system is only for host resolution. The Handle is a universal resolution for digital objects (information) with finer management granularity.

[0011] The above-mentioned traditional Internet identification naming system has multiple limitations and needs innovative research. It has formed an industry consensus and has become an important direction for future information network system research. At present, most of the research on identification systems at home and abroad starts from a single limitation. For example, the HIP and LISP protocols focus on the separation of identity and location identification. Since HIP introduces a new layer between the network layer and the transport layer, it increases the complexity of the protocol stack. Although LISP improves the scalability of the network, its single global mapping system may become an attack target. If the mapping database is tampered with or attacked, it may cause the data packet to be misrouted or intercepted, posing a security risk. Both lack a unified identification, description and addressing method for multi-dimensional target objects, and it is difficult to meet high demands such as fine-grained mobility. Summary of the invention

[0012] In view of the above-mentioned deficiencies in the prior art, the application service identifier generation method for a multi-dimensional identifier fusion network provided by the present invention solves the problem that the existing Internet identifier generation method lacks a unified identification, description and addressing method for multi-dimensional target objects, and is difficult to meet high demands such as fine-grained mobility.

[0013] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is: a method for generating an application service identifier for a multi-dimensional identifier fusion network, wherein the generation method is: when the other end initiates a service request response, a variable-length application service identifier is generated according to multi-dimensional attribute information through a non-encrypted method based on an elliptic curve;

[0014] The multi-dimensional attribute information includes information carrying corresponding attributes obtained after identifying and classifying the status and requirements of the application service / content;

[0015] The life cycle of the application service identifier is managed according to its service / content provision mode.

[0016] Furthermore, the method for generating a variable-length application service identifier based on an elliptic curve asymmetric encryption method is specifically as follows:

[0017] S1, through the service layer parsing mapper deployed on the controller, combines its identity information S and timestamp T into a seed number seed str =S+T;

[0018] Wherein, the identity information is determined based on multi-dimensional attribute information;

[0019] S2. Use the SHA-256 hash function to convert the seed number to seed str Generate a one-way hash value H(S,T)=SHA-256(seed str );

[0020] S3. According to the expression of the one-way hash value, the one-way hash value of the generated hexadecimal string is converted and mapped to the integer range specified on the elliptic curve:

[0021] S4. On the server side, randomly select an integer and generate Pb=nb·G through a point multiplication operation on the elliptic curve;

[0022] Among them, Pb is a point generated by the server, nb is an integer randomly selected by the server, and G is the base point, which represents a fixed point on the elliptic curve;

[0023] S5. At the end user, use the SHA-256 hash function to input the timestamp of the current device to generate a random number k, and calculate k·G to obtain a point R on the elliptic curve represented by R=k·G;

[0024] S6. Calculate Pm+k·Pb, and obtain a new point representation of point R on the elliptic curve as S=Pm+k·Pb=Pm+k·nb·G; where Pm represents a point form of the message;

[0025] S7, converting the point S into a variable-length binary form to generate a variable-length application service identifier SUID. Further, in step S3, the elliptic curve is represented as:

[0026] y 2 =x 3 +ax+b

[0027] Where a and b are constants on the elliptic curve and satisfy 4a 3 +27b 2 ≠0.

[0028] Furthermore, in step S4, the base point G satisfies:

[0029] The order n of the base point G is relatively large, and nG=O, where O is a point at infinity on the elliptic curve.

[0030] Furthermore, the provision mode of the service / content corresponding to the application service identifier includes ordinary service / content and short-term service / content.

[0031] Furthermore, when the provision mode is ordinary service / content, the method for lifecycle management of the application service identifier is specifically as follows:

[0032] Set the corresponding valid period T for the application service identifier v and keep alive period T k ;

[0033] In the effective period T v After the end, enter the keep alive period T k , by receiving the keep-alive message sent by the service / content provider to extend the effective period T v , and in the keep alive period T k Before the end, if no valid certificate is received from the service / content provider to the distributed management agency, the application service identifier will be deleted or recycled.

[0034] Furthermore, when the provision mode is ordinary service / content, the validity condition of the service application identifier is the current time t current satisfy:

[0035]

[0036] In the formula, is the starting time of the SUID of the i-th service application identifier, The valid period of the SUID of the i-th service application identifier, The keep-alive period of the SUID identified by the i-th service application, The proof time obtained at a certain moment.

[0037] Furthermore, when the provision mode is short-term service / content, the method for lifecycle management of the application service identifier is specifically as follows:

[0038] When the service / content provider registers, its maintenance time is sent to the distributed management agency as a special multi-dimensional attribute, and then the distributed management agency sets the effective period T for its corresponding service application identifier. vs ;

[0039] In the effective period T vs After the end, if no keep-alive message is received from the service / content provider, the corresponding service application identifier will be immediately recycled.

[0040] Furthermore, when the provision mode is short-term service / content, the validity condition of the service application identifier is the current time t current satisfy:

[0041]

[0042] In the formula, is the starting time of the SUID of the i-th service application identifier, Identify the validity period of the SUID for the i-th service application.

[0043] The beneficial effects of the present invention are:

[0044] 1) In terms of providing the same level of security, the asymmetric encryption based on elliptic curves in the method of the present invention requires a smaller key length than the traditional public key encryption algorithm, which makes the asymmetric encryption based on elliptic curves provide a high level of security at a relatively short key length, and the generated unique application service identifier SUID identifier is more difficult to be cracked and captured by the adversary.

[0045] 2) Since the key length used by the asymmetric encryption algorithm based on elliptic curves is shorter, the computational complexity is relatively low, which means that it is faster and more efficient in encryption operations, and can be applied to service request response scenarios that require high-frequency generation of application service identifiers.

[0046] 3) Shorter key length and encryption result means less bandwidth and storage space are occupied when transmitting and storing encrypted service attribute information, so it can be applied in distributed servers that need to distribute and store SUID on a large scale. DETAILED DESCRIPTION

[0047] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0048] The embodiment of the present invention provides a method for generating an application service identifier for a multi-dimensional identifier fusion network. The method comprises: when a peer terminal initiates a service request response, a variable-length application service identifier is generated according to multi-dimensional attribute information by a non-encryption method based on an elliptic curve;

[0049] The multi-dimensional attribute information includes information carrying corresponding attributes obtained after identifying and classifying the status and requirements of the application service / content;

[0050] The life cycle of the application service identifier is managed according to its service / content provision mode.

[0051] In an example of an embodiment of the present invention, for multi-dimensional attribute information, by identifying and classifying information such as the type of service / content, content version information, service category code, content name, and timeliness of service / content, the information is described as multi-dimensional attribute information carrying attributes. In the architecture of a multi-dimensional identification fusion network, the representation of services is particularly important. This embodiment provides a unified generation description mechanism for a service application identifier SUID. Through the service application identifier SUID, various attributes of network services can be refined to a more specific level, thereby better supporting the implementation of upper-layer services.

[0052] For example, by parsing the multi-dimensional attributes of the service in the communication request message initiated by the user, the network can identify the type information of the required service, and further classify different services and their corresponding demand information. When the user wants to obtain a certain type of service, the network can meet the user's communication needs on demand by selecting services with higher service quality attributes (connectivity, availability, congestion) and performance attributes (delay, jitter, bandwidth) from the same category of services. These attributes include but are not limited to the functional characteristics, performance indicators, security requirements, access control rules, etc. of the service.

[0053] In an embodiment of the present invention, the method for generating a variable-length application service identifier based on an asymmetric encryption method of an elliptic curve is specifically as follows:

[0054] S1, through the service layer parsing mapper deployed on the controller, combines its identity information S and timestamp T into a seed number seed str =S+T;

[0055] Wherein, the identity information is determined based on multi-dimensional attribute information;

[0056] Exemplarily, the identity information S includes the ID of the controller and the IP address of the controller;

[0057] S2. Use the SHA-256 hash function to convert the seed number to seed str Generate a one-way hash value H(S,T)=SHA-256(seed str );

[0058] S3. According to the expression of the one-way hash value, the one-way hash value of the generated hexadecimal string is converted and mapped to the integer range specified on the elliptic curve:

[0059] Exemplarily, the relevant expression is:

[0060] H int (S,T)=int(H(S,T),16)

[0061] R=H int(S,T)%(B-A+1)+a

[0062] S4. On the server side, randomly select an integer and generate Pb=nb·G through a point multiplication operation on the elliptic curve;

[0063] Among them, Pb is a point generated by the server, nb is an integer randomly selected by the server, and G is the base point, which represents a fixed point on the elliptic curve;

[0064] For example, Pb is a point generated by the server, which is obtained by scalar multiplication of a randomly selected integer nbnb and a base point GG on the elliptic curve, and is used in the encryption process or verification process; nb is an integer randomly selected by the server, usually called a private key or session key. It is a large integer used as a scalar in the elliptic curve encryption algorithm. This integer nb is the key factor in generating the point Pb, and it is crucial to maintain the privacy of nb for security;

[0065] S5. At the end user, use the SHA-256 hash function to input the timestamp of the current device to generate a random number k, and calculate k·G to obtain a point R on the elliptic curve represented by R=k·G;

[0066] S6. Calculate Pm+k·Pb, and obtain a new point representation of point R on the elliptic curve as S=Pm+k·Pb=Pm+k·nb·G; where Pm represents a point form of the message;

[0067] S7, converting the point S into a variable-length binary form to generate a variable-length application service identifier SUID. In step S3 of this embodiment, the elliptic curve is represented as:

[0068] y 2 =x 3 +ax+b

[0069] Where a and b are constants on the elliptic curve and satisfy 4a 3 +27b 2 ≠0, this condition ensures that the curve has no singular points, that is, the curve is smooth and non-degenerate.

[0070] Specifically, choosing a set of (a, b) parameters means determining the specific shape of the elliptic curve. These parameters are in the finite field In the case of , all computations are performed in a finite field, usually a prime number field or a binary field.

[0071] In this embodiment, the base point G is a fixed point on the elliptic curve and is used to generate the application service identifier, wherein the base point G satisfies:

[0072] The order n of the base point G is relatively large, and nG=O, where O is a point at infinity on the elliptic curve (also called the identity element).

[0073] In the embodiment of the present invention, when performing periodic management on the application service identifier, considering that the application service identifier SUID has higher independence, its life cycle should not be limited by different application scenarios. In order to more efficiently manage the identifiers of applications, services and content in the network, this embodiment adopts a decentralized identifier management server based on blockchain for unified registration, management and recycling.

[0074] In this embodiment, when performing life cycle management, it is necessary to consider the differences between services and content, and perform corresponding life cycle management according to the provision method; specifically, the provision method of service / content corresponding to the application service identifier includes ordinary service / content and short-term service / content.

[0075] In this embodiment, when the provision mode is ordinary service / content, the method for lifecycle management of the application service identifier is specifically as follows:

[0076] Set the corresponding valid period T for the application service identifier v and keep alive period T k ;

[0077] In the effective period T v After the end, enter the keep alive period T k , by receiving the keep-alive message sent by the service / content provider to extend the effective period T v , and in the keep alive period T k Before the end, if no valid certificate is received from the service / content provider to the distributed management agency, the application service identifier will be deleted or recycled.

[0078] For example, in this embodiment, a method similar to the RIP (Routing Information Protocol) protocol is used to maintain routing entries. After the decentralized management agency generates and issues the corresponding SUID, it sets a corresponding valid period T for each application service identifier. v and keep alive period T k .

[0079] In a specific embodiment, when the provision mode is ordinary service / content, the validity condition of the service application identifier is the current time t current satisfy:

[0080]

[0081] In the formula, is the starting time of the SUID of the i-th service application identifier, The valid period of the SUID of the i-th service application identifier, The keep-alive period of the SUID identified by the i-th service application, The proof time obtained at a certain moment, which needs to be between the end of the keep alive period and the current time t current between.

[0082] In this embodiment, when the provision mode is short-term service / content, the method for lifecycle management of the application service identifier is specifically as follows:

[0083] When the service / content provider registers, its maintenance time is sent to the distributed management agency as a special multi-dimensional attribute, and then the distributed management agency sets the effective period T for its corresponding service application identifier. vs ;

[0084] In the effective period T vs After the end, if no keep-alive message is received from the service / content provider, the corresponding service application identifier will be immediately recycled.

[0085] In a specific embodiment, when the provision mode is short-term service / content, the validity condition of the service application identifier is the current time t current satisfy:

[0086]

[0087] In the formula, is the starting time of the SUID of the i-th service application identifier, Identify the validity period of the SUID for the i-th service application.

[0088] Through the above method, the distributed management organization can efficiently manage the life cycle of the application service identifier SUID, reasonably utilize the effective space of the multi-dimensional identifier, and ensure that the services and content in the network are stably and efficiently managed.

[0089] In the embodiment of the present invention, by introducing the application service identifier SUID, the description of network services is made more standardized and unified, which helps to improve the availability, manageability and security of network services. In general, the generation and representation of the application service identifier SUID is an important technology that makes the service description and customization of multi-dimensional identification networks and systems more accurate and comprehensive.

[0090] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0091] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A method for generating application service identifiers for a multi-dimensional identifier fusion network, characterized in that: The generation method is: when the other end initiates a service request response, a variable-length application service identifier is generated according to the multi-dimensional attribute information through a non-encryption method based on an elliptic curve; The multi-dimensional attribute information includes information carrying corresponding attributes obtained after identifying and classifying the status and requirements of the application service / content; The life cycle of the application service identifier is managed according to its service / content provision mode.

2. The method for generating application service identifiers for a multi-dimensional identifier fusion network according to claim 1, characterized in that: The method for generating a variable-length application service identifier based on an asymmetric encryption method of an elliptic curve is specifically as follows: S1, through the service layer parsing mapper deployed on the controller, combines its identity information S and timestamp T into a seed number seed str =S+T; Wherein, the identity information is determined based on multi-dimensional attribute information; S2. Use the SHA-256 hash function to convert the seed number to seed str Generate a one-way hash value H(S,T)=SHA-256(seed str ); S3. According to the expression of the one-way hash value, the one-way hash value of the generated hexadecimal string is converted and mapped to the integer range specified on the elliptic curve: S4. On the server side, randomly select an integer and generate Pb=nb·G through a point multiplication operation on the elliptic curve; Among them, Pb is a point generated by the server, nb is an integer randomly selected by the server, and G is the base point, which represents a fixed point on the elliptic curve; S5. At the end user, use the SHA-256 hash function to input the timestamp of the current device to generate a random number k, and calculate k·G to obtain a point R on the elliptic curve represented by R=k·G; S6. Calculate Pm+k·Pb, and obtain a new point representation of point R on the elliptic curve as S=Pm+k·Pb=Pm+k·nb·G; where Pm represents a point form of the message; S7. Convert the point S into a variable-length binary form to generate a variable-length application service identifier SUID.

3. The method for generating application service identifiers for a multi-dimensional identifier fusion network according to claim 2, characterized in that: In step S3, the elliptic curve is represented as: y 2 =x 3 +ax+b Where a and b are constants on the elliptic curve and satisfy 4a 3 +27b 2 ≠0.

4. The method for generating a service identifier for a multi-dimensional identifier fusion network according to claim 3, characterized in that: In step S4, the base point G satisfies: The order n of the base point G is relatively large, and nG=O, where O is a point at infinity on the elliptic curve.

5. The method for generating a service identifier for a multi-dimensional identifier fusion network according to claim 1, characterized in that: The provision mode of the service / content corresponding to the application service identifier includes ordinary service / content and short-term service / content.

6. The method for generating a service identifier for a multi-dimensional identifier fusion network according to claim 5, characterized in that: When the provision mode is ordinary service / content, the method for lifecycle management of application service identifier is as follows: Set the corresponding valid period T for the application service identifier v and keep alive period T k ; In the effective period T v After the end, enter the keep alive period T k , by receiving the keep-alive message sent by the service / content provider to extend the effective period T v , and in the keep alive period T k Before the end, if no valid certificate is received from the service / content provider to the distributed management agency, the application service identifier will be deleted or recycled.

7. The method for generating a service identifier for a multi-dimensional identifier fusion network according to claim 6, characterized in that: When the provision mode is ordinary service / content, the validity condition of the service application identifier is the current time t current satisfy: In the formula, is the starting time of the SUID of the i-th service application identifier, The valid period of the SUID of the i-th service application identifier, The keep-alive period of the SUID identified by the i-th service application, The proof time obtained at a certain moment.

8. The method for generating a service identifier for a multi-dimensional identifier fusion network according to claim 5, characterized in that: When the provision method is short-term service / content, the method for lifecycle management of application service identifier is as follows: When the service / content provider registers, its maintenance time is sent to the distributed management agency as a special multi-dimensional attribute, and then the distributed management agency sets the effective period T for its corresponding service application identifier. vs ; In the effective period T vs After the end, if no keep-alive message is received from the service / content provider, the corresponding service application identifier will be immediately recycled.

9. The method for generating a service identifier for a multi-dimensional identifier fusion network according to claim 8, characterized in that: When the provision mode is short-term service / content, the validity condition of the service application identifier is the current time t current satisfy: (Keep alive period content and have valid proof) In the formula, is the starting time of the SUID of the i-th service application identifier, Identify the validity period of the SUID for the i-th service application.

Images