A prefix-based IP blacklist storage and retrieval method and system

Abstract

The present invention discloses a prefix-based IP blacklist storage and retrieval method and system. In the storage method of the present invention, all blacklists are classified according to CIDR addresses and single IP addresses, adjacent single IP addresses are merged into CIDR address format, and the CIDR address is converted into a format of prefix plus free address range, and the free address ranges of the same prefix are merged, wherein the prefix is ​​expressed in hexadecimal form; a blacklist search tree is constructed using a radix tree structure, the path of the search tree is the common prefix of the CIDR address, the free address range is stored in the leaf node, and the free address range of the single IP address is agreed to be 0. In the retrieval method of the present invention, the single IP address is converted into hexadecimal form, iterative retrieval is performed in the blacklist search tree, and a logical judgment is made whether a CIDR address or a single IP address in the blacklist is hit. The present invention can reduce the storage space requirement of the blacklist and improve the retrieval efficiency.

Description

Technical Field

[0001] The invention relates to a prefix-based IP blacklist storage and retrieval method and system, belonging to the technical field of network security. Background Art

[0002] In security protection systems such as Web Application Firewall (WAF), users can define blacklists based on single IP addresses or Classless Inter-Domain Routing (CIDR) addresses. The typical format is as follows:

[0003] { "ip_blacklist": [

[0004] "1.1.1.1",

[0005] "10.2.0.0 / 24"

[0006] ]}

[0007] 1.1.1.1 is a specific blacklisted IP, and 10.2.0.0 / 24 means that all IP addresses from 10.2.0.0 to 10.2.0.255 are on the blacklist. The WAF system parses the IP parameters in the key parts of the request (such as the header) and decides whether to release the request based on whether it matches the blacklist.

[0008] During the actual system operation, users will dynamically adjust the blacklist configuration according to network threats or their own security construction needs. Frequent blacklist adjustments will cause the following problems: 1. There is a lack of a unified search method for IP blacklist segments based on CIDR and single value forms. Converting CIDR to a single blacklist IP and storing them separately wastes storage space and reduces the speed of blacklist retrieval. 2. Users often change the blacklist according to their needs, and the storage space cannot be dynamically adjusted according to the changes in the blacklist, resulting in low storage and retrieval efficiency. Summary of the invention

[0009] Purpose of the invention: In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a prefix-based IP blacklist storage method, retrieval method and corresponding computer system and program product to reduce the storage space requirement of the blacklist and improve the retrieval efficiency.

[0010] Technical solution: To achieve the above-mentioned invention object, the present invention adopts the following technical solution:

[0011] In a first aspect, the present invention provides a prefix-based IP blacklist storage method, comprising the following steps:

[0012] Step 11: Obtain all blacklists configured by the user, classify them by CIDR address and single IP address, and obtain CIDR classification set and single IP classification set;

[0013] Step 12: merge adjacent single IP addresses in the single IP classification set into a CIDR address format and move them into the CIDR classification set;

[0014] Step 13, format each CIDR address in the CIDR classification set and convert it into a format of prefix plus free address range, where the prefix is ​​expressed in hexadecimal form;

[0015] Step 14: traverse the formatted CIDR classification set and merge the free address ranges with the same prefix;

[0016] Step 15: Repeat step 14 until the merged CIDR classification set does not change;

[0017] Step 16: Based on the merged CIDR classification set, a blacklist search tree is constructed, using a radix tree as a basic storage structure, wherein the path of the blacklist search tree is a common prefix of the CIDR address, and the leaf node stores the free address range;

[0018] Step 17, traverse the single IP classification set, express each single IP address in hexadecimal form, and execute steps 18 to 19 for each single IP address;

[0019] Step 18: Determine whether the single IP address hits the blacklist search tree. If it hits, return to step 17 and continue to the next single IP address; otherwise, go to step 19;

[0020] Step 19: Add the single IP address in hexadecimal format to the blacklist search tree, and set the free address range of the leaf node to the agreed 0 format.

[0021] Furthermore, the prefix of a CIDR address is determined by taking the bits of X-(X mod 8) as the prefix address, where mod represents the remainder operation and X is the number of network bits of the CIDR address. The free address range of a CIDR address is determined by calculating a range [0, 2 Y -1], the starting address A of the free address range is the value of the first 8 bits of the CIDR address after removing the prefix and the result of B. The free address range is [A, A+2 Y -1], where B is an 8-bit value, the first 8-Y bits are 1, and the last Y bits are 0.

[0022] Furthermore, in step 18, the step of determining whether the single IP address hits the blacklist search tree includes: iteratively searching the single IP address M in hexadecimal form, the first round of iteration is denoted as k=1, and the kth round of iterative calculation steps include:

[0023] Step 181, take the character substring of [0, k×2-1] bits in M, and determine whether it exists in the blacklist search tree;

[0024] Step 182: If the substring does not exist in the blacklist search tree, return to the missed blacklist and end; otherwise, go to step 183;

[0025] Step 183, determine whether the node hit by the current substring is a leaf node. If it is a non-leaf node, add 1 to k and return to step 181; otherwise, go to step 184;

[0026] Step 184, if the value of k is lenth(M) / 2, where lenth(M) is the character length of M, determine whether the free address range in the current leaf node is in the agreed form of 0, if so, return to the hit blacklist; otherwise, return to the miss blacklist; if the value of k is less than lenth(M) / 2, proceed to step 185;

[0027] Step 185, take the data of the [k×2, lenth(M)]th bit of M and convert it into a decimal expression, and determine whether it is in the free address range of the leaf node. If so, return the hit blacklist, otherwise return the miss blacklist.

[0028] Furthermore, when adding a new blacklist, if a single IP address is added, determine whether the single IP address to be added hits the blacklist search tree, and end if it hits; otherwise: in the set consisting of all the original single IP addresses and the single IP address to be added, merge the adjacent single IP addresses into CIDR format to obtain a new CIDR set, and merge the new CIDR set with the original CIDR classification set, and build a new blacklist search tree based on the merged CIDR classification set and the single IP address classification set, and replace the original blacklist search tree after the construction is completed.

[0029] Furthermore, when adding a new blacklist, if the new address is a CIDR address, the new CIDR address will be merged with the original CIDR classification set, keeping the original single IP classification set unchanged, and a new blacklist search tree will be constructed based on the merged CIDR classification set and the original single IP classification set. After the construction is completed, the original blacklist search tree will be replaced.

[0030] Furthermore, when deleting the blacklist, if a single IP address is deleted, determine whether the single IP address to be deleted hits the blacklist search tree, if not, end; otherwise: if the free address range of the leaf node in the hit result is in the agreed form of 0, directly delete the single IP address to be deleted from the blacklist search tree, otherwise, delete the single IP address to be deleted from the original single IP classification set, and build a new blacklist search tree based on the original CIDR classification set and the new single IP classification set. After the new blacklist search tree is built, it is used to replace the original blacklist search tree.

[0031] Furthermore, when deleting the blacklist, if the CIDR address is deleted, the CIDR address to be deleted is converted into the format of prefix plus free address range, and the prefix of the CIDR address to be deleted is searched in the blacklist search tree. If the search result is empty, the process ends; otherwise: delete the CIDR address to be deleted from the original CIDR classification set, and build a new blacklist search tree based on the new CIDR classification set and the original single IP classification set. After the new blacklist search tree is built, it is used to replace the original blacklist search tree.

[0032] In a second aspect, the present invention provides a prefix-based IP blacklist retrieval method, comprising the following steps:

[0033] Step 21, express each single IP address in hexadecimal form;

[0034] Step 22: In the blacklist search tree, iteratively search for a single IP address M in hexadecimal form. The blacklist search tree uses a radix tree as a basic storage structure. The path of the search tree is a common prefix of a CIDR address. The free address range is stored in a leaf node. For a single IP address, the free address range of the leaf node is set to the agreed form of 0. The first iteration is recorded as k=1, and the kth round of iterative calculation steps include:

[0035] Step 221, take the character substring of [0, k×2-1] bits in M, and determine whether it exists in the blacklist search tree;

[0036] Step 222: If the substring does not exist in the blacklist search tree, return to the missed blacklist and end; otherwise, proceed to step 223;

[0037] Step 223, determine whether the node hit by the current substring is a leaf node. If it is a non-leaf node, add 1 to k and return to step 221; otherwise, go to step 224;

[0038] Step 224, if the value of k is lenth(M) / 2, where lenth(M) is the character length of M, determine whether the free address range in the current leaf node is in the agreed form of 0, if so, return to the hit blacklist; otherwise, return to the miss blacklist; if the value of k is less than lenth(M) / 2, proceed to step 225;

[0039] Step 225, take the character substring of the [k×2, lenth(M)]th position of M, and convert it into a decimal expression, and determine whether it is in the free address range of the leaf node. If so, return the hit blacklist, otherwise return the miss blacklist.

[0040] In a third aspect, the present invention provides a computer system comprising a memory, a processor, and a computer program / instructions stored in the memory and executable on the processor, wherein the computer program / instructions, when executed by the processor, implement the steps of the above-mentioned prefix-based IP blacklist storage method or the prefix-based IP blacklist retrieval method.

[0041] In a fourth aspect, the present invention provides a computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned prefix-based IP blacklist storage method, or the prefix-based IP blacklist retrieval method.

[0042] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0043] 1. The present invention stores single IP addresses and CIDR addresses in a unified form by combining a prefix expression with a free address range (the free address range of a single IP address is agreed to be 0). Regardless of whether the user uses a single IP address or a CIDR address to define a blacklist, the storage space occupied is very small.

[0044] 2. The present invention improves the efficiency of blacklist IP search by encoding and compressing the height of the blacklist search tree. For IPv4 addresses, the maximum height of the compressed tree is 8, that is, a maximum of 4 searches can be performed in a multi-branch tree to reach a conclusion.

[0045] 3. The present invention can automatically merge and split blacklist expressions according to the adjustment of user configuration to ensure the lowest memory usage; at the same time, it can reduce unnecessary blacklist search paths and improve retrieval efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 The following is an example diagram of the formatting process of a CIDR address in an embodiment of the present invention.

[0047] Figure 2 The present invention is a flowchart of a prefix-based IP blacklist storage method according to an embodiment of the present invention.

[0048] Figure 3 This is an example diagram of a prefix-based blacklist search tree in an embodiment of the present invention.

[0049] Figure 4 The present invention is a flowchart of a prefix-based IP blacklist retrieval method according to an embodiment of the present invention.

[0050] Figure 5 This is a flowchart of processing of adding a single IP address to the blacklist in an embodiment of the present invention.

[0051] Figure 6 This is a flowchart of processing newly added CIDR addresses to the blacklist in an embodiment of the present invention.

[0052] Figure 7 The following is a flowchart of the process of deleting a single IP address from a blacklist in an embodiment of the present invention.

[0053] Figure 8 The following is a flowchart of the process of deleting CIDR addresses from a blacklist in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments.

[0055] First, the formatting and encoding of the CIDR network address involved in the present invention are described.

[0056] CIDR network addresses are formatted using a prefix plus a free address range, and are calculated as follows:

[0057] For a CIDR address in the form of 192.169.1.4 / X, the bits of X-(X mod 8) are used as the prefix address, where mod represents the remainder operation. Assuming X=30, the first 30-(30 mod 8)=24 bits are used as the prefix address, i.e., prefix=192.169.1.

[0058] The range of the suffix address is calculated based on the value of Y=8-(X mod 8). Assuming X=30, then Y=8-(30 mod8)=2, and the free range of the suffix address is [0, 2^Y-1]=[0, 3]; the starting address A of the suffix is ​​the result of the value of the first 8 bits of the CIDR address after removing the prefix (4 in 192.169.1.4 / X) and B. Among them, B is an 8-bit value, the first 8-Y bits are 1, and the last Y bits are 0. The free address range is [A, A+2 Y -1], for 192.169.1.4 / 30, the starting address is 4, so the free address range of this CIDR is [0+4, 3+4]=[4, 7].

[0059] The calculation method for IPv6 and IPv4 is the same. For an IPv6 address in the form of ef0b:: / 10, the prefix is ​​ef, the free address corresponds to Y=8-(10 mod 8) = 6, and the free range of the suffix address is [0, 2^Y-1]=[0, 63]. The starting address of the free range is the result of the subsequent 8 bits of the CIDR address after removing the prefix and B. B is an 8-bit value, the first 8-Y bits are 1, and the last Y bits are 0.

[0060] Convert the obtained prefix address into hexadecimal every eight bits and format them uniformly. For 192.169.1, the hexadecimal of 192 is C0, the hexadecimal of 169 is A9, and the hexadecimal of 1 is 01. The formatted prefix is ​​C0A901. Finally, the formatting result of 192.169.1.4 / 30 is prefix = C0A901, and the free address range is [4,7]. The prefix is ​​recorded as P and the free address range is recorded as Q, CIDR = P + Q; Figure 1 The following example illustrates the formatting process of the CIDR address.

[0061] like Figure 2 As shown, a prefix-based IP blacklist storage method disclosed in an embodiment of the present invention specifically includes the following steps:

[0062] Step 11. Obtain all blacklists configured by the user, classify them by CIDR address and single IP address, and obtain CIDR classification set and single IP classification set. The CIDR classification set is denoted as S={S1, S2, …, Sn}, and the single IP classification set is denoted as R={R1, R2, …, Rm}; n and m are the number of CIDR addresses and single IP addresses respectively, Si is the i-th CIDR address, i=1,2,…,n, Rj is the j-th single IP address, j=1,2,…,m.

[0063] Step 12: traverse the single IP classification set R, merge adjacent single IP addresses into CIDR address format, add them to the CIDR classification set S, and remove these IP addresses from R. For example, 192.168.0.4 and 192.168.0.5 can be merged into the CIDR of 192.168.0.5 / 31; 192.168.0.4, 192.168.0.5, 192.168.0.6, and 192.168.0.7 can be merged into the CIDR of 192.168.0.5 / 30.

[0064] Step 13: Format each CIDR address in the set S and convert it into the format of prefix plus free address range, that is, S'={{P1, Q1}, {P2, Q2}, …, {Pn', Qn'}}; n' is the number of CIDR addresses after the merger, Pi and Qi are the prefix and free address range of the i-th CIDR address respectively, and i=1,2,…,n'.

[0065] Step 14: traverse the set S' and merge the free address ranges with the same prefix. The merging method is as follows:

[0066] If two free address ranges are continuous in the integer domain, they are merged into a larger free address range. For two Q1 and Q2 that can be merged, the ranges are recorded as [Q1min, Q1max], [Q2min, Q2max], and the merged free address range is [min(Q1min, Q2min), max(Q1max, Q2max)].

[0067] No processing is performed on the free address range with the same prefix and discontinuous integer domain.

[0068] For the three CIDRs 192.169.201.0 / 30, 192.169.201.4 / 30, and 192.169.201.12 / 30, the formatted representations are: 192.169.201.0 / 30={C0A9C9, [0, 3]}; 192.169.201.4 / 30={C0A9C9, [4, 7]}; 192.169.201.12 / 30={C0A9C9, [12, 15]}; the results after merging are {C0A9C9, [0, 7]} and {C0A9C9, [12, 15]}.

[0069] Step 15: Repeat step 14 until the set S' no longer changes.

[0070] Step 16: Construct a blacklist search tree based on the set S', using a radix tree as the basic storage structure of the search tree, where the path of the search tree is the common prefix of CIDR, and the leaf nodes store the free address range. The specific storage structure is as follows: Figure 3 shown.

[0071] Step 17, traverse the single IP classification set R, and for each IP address, format and encode it by converting every eight bits into hexadecimal. The result is recorded as M. Perform the operations from step 18 to step 19 until all elements in R are traversed.

[0072] Step 18, based on the blacklist search tree constructed in step 16, refer to step 22 of a prefix-based IP blacklist retrieval method introduced below to determine whether the current IP address hits the blacklist search tree. If it hits, jump to step 17; otherwise, jump to step 19.

[0073] Step 19, add M to the search tree, and the free address range of the leaf node is [0,0].

[0074] like Figure 4 As shown, a prefix-based IP blacklist retrieval method disclosed in an embodiment of the present invention specifically includes the following steps:

[0075] Step 21: Format and encode a single IP address by converting it into hexadecimal format every eight bits, and record the result as M. For 192.169.0.1, the formatted result after encoding is M=C0A90001.

[0076] Step 22: Iterate and search in the blacklist search tree as follows to determine whether the IP hits the blacklist search tree. The first iteration is denoted as k=1; for IPv4, the maximum number of iterations is 4, and for IPv6, the maximum number of iterations is 16. The calculation of the kth iteration is as follows:

[0077] Step 221, take the character substring of [0, k×2-1] bits in M, and determine whether it exists in the blacklist search tree. For k=1, take "C0" as the substring; for k=3, take "C0A900" as the substring.

[0078] Step 222: If the substring does not exist in the blacklist search tree, return to the missed blacklist and end the search process; otherwise, jump to step 223;

[0079] Step 223: Determine whether the node hit by the current substring is a leaf node. If it is a non-leaf node, k=k+1, jump to step 221; otherwise, jump to step 224;

[0080] Step 224: If the iteration has reached the end of M (i.e., k=lenth(M) / 2, lenth(M) is the character length of M, and for IPv4, k=4), determine whether the data in the current leaf node is [0, 0]. If so, return to the hit blacklist; otherwise, return to the miss blacklist. If the iteration has not reached the end of M, jump to step 225;

[0081] Step 225, take the character substring of the [k×2, lenth(M)]th position of M, and convert it into a decimal expression, record the result as N, and determine whether N is in the free address range of the leaf node. If it is in the free address range, return to the blacklist hit; otherwise, the range does not hit the blacklist.

[0082] for Figure 3 For the query example shown, 192.169.0.1 is detected in the query path C0->A9->0001 and is hit by the detection rule of step 224; 192.168.201.3 is detected in the query path C0->A9->C9 and is hit by the detection rule of step 225.

[0083] Figure 5 and Figure 6 This shows the process of adding a new blacklist.

[0084] like Figure 5 As shown in the figure, when adding a single IP address, the specific steps are as follows:

[0085] Step 31: Execute the search process of the single IP in the blacklist search tree according to the prefix-based IP blacklist search method to determine whether the single IP address to be added hits the blacklist search tree. If it hits, the process ends; otherwise, jump to step 32.

[0086] Step 32: Take all existing single IP addresses and the single IP addresses to be added, form a set, and traverse All elements in , merge adjacent single IP addresses into CIDR format, and the resulting CIDR set is recorded as , while from Remove these merged single IP addresses.

[0087] Step 33: Combined with the original CIDR classification set S to obtain the set . For the collection and The blacklist search tree construction process is executed according to the prefix-based IP blacklist storage method.

[0088] After the blacklist search tree in step 34 and step 33 is constructed, it is used to replace the original blacklist search tree.

[0089] like Figure 6 As shown, when adding a new CIDR address, the new CIDR address is merged with the original CIDR classification set S, and the original single IP classification set R is kept unchanged. The blacklist search tree construction process is executed for the merged CIDR classification set and the original single IP classification set according to the prefix-based IP blacklist storage method. After the new blacklist search tree is built, it is used to replace the original blacklist search tree.

[0090] Figure 7 and Figure 8 The process of deleting the blacklist is shown.

[0091] like Figure 7 As shown in the figure, when deleting a single IP address, the specific steps are as follows:

[0092] Step 41, determine whether the single IP address to be deleted hits the blacklist search tree. If not, the process ends; otherwise, jump to step 42.

[0093] Step 42: If the free address range of the leaf node in the hit result is [0,0], directly delete the single IP address from the blacklist search tree and the process ends; otherwise, jump to step 43.

[0094] Step 43: Delete the single IP address from the original single IP classification set R, and build a new blacklist search tree with reference to steps 12 to 19.

[0095] Step 45: After the new blacklist search tree is constructed, it is used to replace the original blacklist search tree.

[0096] like Figure 8 As shown in the figure, when deleting a CIDR address, the specific steps are as follows:

[0097] Step 51: Format the CIDR address to be deleted and convert it into a format of prefix plus free address range.

[0098] Step 52: Search the prefix of the CIDR address to be deleted in the blacklist search tree. If the search result is empty, the process ends; otherwise, jump to step 53.

[0099] Step 53: After deleting the CIDR address to be deleted from the original CIDR classification set S, a new blacklist search tree is constructed with reference to steps 12 to 19.

[0100] Step 54: After the new blacklist search tree is constructed, it is used to replace the original blacklist search tree.

[0101] An embodiment of the present invention further discloses a computer system, including a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor, wherein the steps of the above methods are implemented when the computer program / instruction is executed by the processor.

[0102] The embodiment of the present invention also discloses a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned methods when executed by a processor. The program / instruction code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program / instruction codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program / instruction code implements the steps of the method of the present invention when executed by the processor or controller. The program / instruction code can be executed entirely on the machine, partially on the machine, partially on the machine as an independent software package, or entirely on a remote machine or server. The parts not described in detail in the present invention are all known technologies of those skilled in the art.

Claims

1. A prefix-based IP blacklist storage method, characterized in that: The steps include: Step 11: Obtain all blacklists configured by the user, classify them by CIDR address and single IP address, and obtain CIDR classification set and single IP classification set; Step 12: merge adjacent single IP addresses in the single IP classification set into a CIDR address format and move them into the CIDR classification set; Step 13, format each CIDR address in the CIDR classification set and convert it into a format of prefix plus free address range, where the prefix is ​​expressed in hexadecimal form; Step 14: traverse the formatted CIDR classification set and merge the free address ranges with the same prefix; Step 15: Repeat step 14 until the merged CIDR classification set does not change; Step 16: Based on the merged CIDR classification set, a blacklist search tree is constructed, using a radix tree as a basic storage structure, wherein the path of the blacklist search tree is a common prefix of the CIDR address, and the leaf node stores the free address range; Step 17, traverse the single IP classification set, express each single IP address in hexadecimal form, and execute steps 18 to 19 for each single IP address; Step 18: Determine whether the single IP address hits the blacklist search tree. If it hits, return to step 17 and continue to the next single IP address; Otherwise, go to step 19; Step 19: Add the single IP address in hexadecimal format to the blacklist search tree, and set the free address range of the leaf node to the agreed 0 format.

2. A prefix-based IP blacklist storage method according to claim 1, characterized in that: The prefix of a CIDR address is determined by taking the bits of X-(X mod 8) as the prefix address, where mod represents the remainder operation and X is the number of network bits in the CIDR address. The free address range of a CIDR address is determined by calculating a range [0, 2 Y -1], the starting address A of the free address range is the value of the first 8 bits of the CIDR address after removing the prefix and the result of B. The free address range is [A, A+2 Y -1], where B is an 8-bit value, the first 8-Y bits are 1, and the last Y bits are 0.

3. A prefix-based IP blacklist storage method according to claim 1, characterized in that: In step 18, the step of determining whether the single IP address hits the blacklist search tree includes: iteratively searching the single IP address M in hexadecimal form, the first round of iteration is denoted as k=1, and the kth round of iterative calculation steps include: Step 181, take the character substring of [0, k×2-1] bits in M, and determine whether it exists in the blacklist search tree; Step 182: If the substring does not exist in the blacklist search tree, return to the missed blacklist and end; otherwise, go to step 183; Step 183, determine whether the node hit by the current substring is a leaf node. If it is a non-leaf node, add 1 to k and return to step 181; otherwise, go to step 184; Step 184, if the value of k is lenth(M) / 2, where lenth(M) is the character length of M, determine whether the free address range in the current leaf node is in the agreed form of 0, if so, return to the hit blacklist; otherwise, return to the miss blacklist; if the value of k is less than lenth(M) / 2, proceed to step 185; Step 185, take the data of the [k×2, lenth(M)]th bit of M and convert it into a decimal expression, and determine whether it is in the free address range of the leaf node. If so, return the hit blacklist, otherwise return the miss blacklist.

4. A prefix-based IP blacklist storage method according to claim 1, characterized in that: When adding a new blacklist, if a single IP address is added, determine whether the single IP address to be added hits the blacklist search tree. If it hits, end; otherwise: in the set consisting of all the original single IP addresses and the single IP address to be added, merge the adjacent single IP addresses into CIDR format to obtain a new CIDR set, and merge the new CIDR set with the original CIDR classification set, build a new blacklist search tree based on the merged CIDR classification set and the single IP address classification set, and replace the original blacklist search tree after the construction is completed.

5. The method for storing a prefix-based IP blacklist according to claim 1, characterized in that: When adding a new blacklist, if the new address is a CIDR address, merge the new CIDR address with the original CIDR classification set, keep the original single IP classification set unchanged, and build a new blacklist search tree based on the merged CIDR classification set and the original single IP classification set. After the construction is completed, replace the original blacklist search tree.

6. A prefix-based IP blacklist storage method according to claim 1, characterized in that: When deleting a blacklist, if a single IP address is deleted, determine whether the single IP address to be deleted hits the blacklist search tree. If not, end; otherwise: if the free address range of the leaf node in the hit result is in the agreed form of 0, directly delete the single IP address to be deleted from the blacklist search tree, otherwise, delete the single IP address to be deleted from the original single IP classification set, and build a new blacklist search tree based on the original CIDR classification set and the new single IP classification set. After the new blacklist search tree is built, it is used to replace the original blacklist search tree.

7. A prefix-based IP blacklist storage method according to claim 1, characterized in that: When deleting a blacklist, if the CIDR address to be deleted is a CIDR address, the CIDR address to be deleted is converted into a format of prefix plus free address range, and the prefix of the CIDR address to be deleted is searched in the blacklist search tree. If the search result is empty, the process ends. Otherwise: delete the CIDR address to be deleted from the original CIDR classification set, build a new blacklist search tree based on the new CIDR classification set and the original single IP classification set, and after the new blacklist search tree is built, replace the original blacklist search tree with it.

8. A prefix-based IP blacklist retrieval method, characterized in that: The steps include: Step 21, express each single IP address in hexadecimal form; Step 22: In the blacklist search tree, iteratively search for a single IP address M in hexadecimal form. The blacklist search tree uses a radix tree as a basic storage structure. The path of the search tree is a common prefix of a CIDR address. The free address range is stored in a leaf node. For a single IP address, the free address range of the leaf node is set to the agreed form of 0. The first iteration is denoted as k=1, and the calculation steps for the kth iteration include: Step 221, take the character substring of [0, k×2-1] bits in M, and determine whether it exists in the blacklist search tree; Step 222: If the substring does not exist in the blacklist search tree, return to the missed blacklist and end; otherwise, proceed to step 223; Step 223, determine whether the node hit by the current substring is a leaf node. If it is a non-leaf node, add 1 to k and return to step 221; otherwise, go to step 224; Step 224, if the value of k is lenth(M) / 2, where lenth(M) is the character length of M, determine whether the free address range in the current leaf node is in the agreed form of 0, if so, return to the hit blacklist; otherwise, return to the miss blacklist; if the value of k is less than lenth(M) / 2, proceed to step 225; Step 225, take the character substring of the [k×2, lenth(M)]th position of M, and convert it into a decimal expression, and determine whether it is in the free address range of the leaf node. If so, return the hit blacklist, otherwise return the miss blacklist.

9. A computer system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images