Network communication method for unknown IP
By adopting UDP broadcast communication and encryption technology in an industrial production environment, the problem of difficult device management of unknown IP addresses is solved, and secure and reliable network communication and device identity identification are achieved.
Patent Information
- Application Number
- CN202411574666.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-06
- Publication Date
- 2025-02-07
AI Technical Summary
In an industrial production environment, network terminal equipment with unknown IP addresses is difficult to manage, and the prior art broadcast communication solutions have problems such as complex operation, low security, and prone to broadcast storms.
UDP broadcast communication method is adopted, and the management end and the device end use two UDP ports respectively to generate random number keys for encrypted communication through plain text identity information broadcast authentication to ensure communication security and device uniqueness.
It realizes secure and reliable network communication under unknown IP networks, avoids broadcast storms and device management complexity, and ensures communication security and device identity identification.
Smart Images
Figure CN119402569A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a network communication method, in particular to a network communication method for unknown IP. Background Art
[0002] At present, in most industrial production environments, when adding new Ethernet terminal devices, batch upgrading, batch changing network segments, and retrieving IP addresses, the IP addresses of the devices are usually unknown and subsequent network communications are impossible. As a result, when managing the devices, it is usually necessary to manually restore the device default settings or discover the devices through local network broadcasts for device management.
[0003] In the case of an unknown IP network, the communicating parties may not be in the same subnet, and the subnet settings of the device cannot be confirmed. Therefore, the device IP cannot be obtained through general IP scanning or ARP scanning. Restoring the default settings will cause the device to lose other original configuration information, which is not advisable. A better solution is to set it up through broadcast communication. However, the current implementation scheme based on broadcast communication is relatively confusing, and has the following disadvantages: (1) There is no complete, easy-to-operate, and easy-to-implement overall solution; (2) A large number of broadcast packets appear in the subnet, which may easily lead to broadcast storms; (3) Broadcasting in plain text without considering security; (4) The device has no authentication check on the management end and is easily hijacked; (5) When there are multiple devices with the same IP address in the same subnet, they cannot be managed. Summary of the invention
[0004] The technical problem to be solved by the present invention is to overcome the deficiencies of the prior art and provide a network communication method for unknown IP, which can realize network communication in the case of unknown IP network.
[0005] The technical solution adopted by the present invention is: the network communication method for unknown IP of the present invention comprises the following steps: A. Communication Agreement: The entire communication process uses UDP broadcast communication. The management end and the device end use two UDP ports. The management end's listening UDP port is M, and the remote port for broadcasting is N. The device end's listening UDP port is N, and the remote port for broadcasting is M. B. Establishment process: The management end carries its own identity information ID token and broadcasts it to all device ends in plain text; after receiving this message, all device ends generate a random number Key for each of them, and encrypt this random number and their own device information with the management end ID token as the key, and then broadcast it back to the management end to complete the communication establishment; after the communication establishment process is completed, the management end and the device end must each maintain the ID token and random number Key of this communication until the communication ends and exits; C. Data process: The data communication process is point-to-point communication, which is still carried out in the form of broadcasting. Different from the communication establishment process, the data process uses the key of the device end as the key and performs encrypted communication. The key values of different device ends are different, thus ensuring the security of the communication link. D. Exit process: When the management end and the device end complete a communication exit command, the communication exit is completed; when the management end has not communicated with the device end for a long time, the device end will also automatically complete the communication exit, and the management end needs to re-establish the process.
[0006] E. Error handling: If the corresponding process message is not received during the process, the device will enter an error state. In the error state, the device will not respond to any instructions until it returns to the "establishment state" F. Device-side state change process: After communication is established, the device-side state machine changes from "establishment state" to "data state". In the "data state", if the device receives a data packet that does not comply with the Key password verification, it will immediately exit the "data state" and enter the "error state". It will take a certain amount of time before it can automatically recover to the "establishment state". The communication data behavior in different states is different.
[0007] Furthermore, the encryption algorithm adopts a universal symmetric encryption method; in the establishment process, the key is the IDtoken of the management end; in the data process, the key is the Key of the device end, and in order to prevent algorithm leakage, different device types are encrypted with different keys to increase the security of communication.
[0008] Furthermore, the management end and the sending end use two UDP ports respectively instead of the same port. Each port has only one-way data communication. When the device has multiple network interfaces, it can implicitly obtain which interface the data packet is received from. In order to avoid broadcasting to other networks or repeated broadcasting, the network interface needs to be explicitly specified when programming the device. BRIEF DESCRIPTION OF THE DRAWINGS
[0009] Figure 1 is a communication flow chart of the present invention; Figure 2 It is a flow chart of device-side state changes; Figure 3is a node topology diagram of the present invention; Figure 4 It is the device-side program flowchart. DETAILED DESCRIPTION
[0010] 1. Explanation of terms: DTU: Data Transfer Unit is a device used for remote data transmission; RTU: Remote Terminal Unit is a device used to collect and transmit data from remote devices to a central monitoring system. MCU: Microprogrammed Control Unit, microcontroller processor, single-chip unit, used for communication, logical operations and other control; MPU: Micro Processor Unit, microprocessor; TCP: Transmission Control Protocol, transport layer communication protocol.
[0011] (ii) Figure 1 As shown, in this embodiment, the network communication method for unknown IP includes the following steps: A. Communication Agreement The entire communication process uses UDP broadcast communication. Both the management end and the device end use two UDP ports. The management end listens on UDP port M (the reference implementation is 7193), and the remote port for broadcasting is N (the reference implementation is 7194). The device end listens on UDP port N, and the remote port for broadcasting is M.
[0012] B. Establishment process The establishment process refers to the first communication between the management end and the device end in this session, which is used to negotiate subsequent communications. The broadcast communication in the establishment process is extremely important, involving the authentication of the management end by the device end, and the generation of encryption numbers for subsequent communications. First, the management end carries its own identity information ID token and broadcasts it to all device ends in plain text; after all device ends receive this message, they generate a random number Key for each of them, and use the management end ID token as the key to encrypt this random number and their own device information (such as IP, MAC, device serial number, etc.), and then broadcast it back to the management end to complete the communication establishment.
[0013] After the communication establishment process is completed, the management end and the device end must each maintain the ID token and random number Key of this communication until the communication ends and exits.
[0014] C. Data Process The data communication process is point-to-point communication, but it is still carried out in the form of broadcast. Unlike the communication establishment process, the data process uses the key of the device end as the key and conducts encrypted communication, and the key values of different device ends are different, thus ensuring the security of the communication link.
[0015] D. Exit process When the management end and the device end complete a communication exit instruction, the communication exit is completed.
[0016] When the management end does not communicate with the device end for a long time, the device end will automatically complete the communication exit, and the management end needs to re-establish the process.
[0017] E. Error handling If the corresponding process message is not received during the process, the device side enters an error state. In the error state, the device side does not respond to any instructions until it is restored to the "establishment state".
[0018] F. Device status change process After communication is established, the device state machine changes from "established state" to "data state". In the "data state", if the device receives a data packet that does not comply with the Key password verification, it will immediately exit the "data state" and enter the "error state". It will take a certain amount of time (10 minutes for reference implementation) to automatically restore to the "established state". The communication data behavior in different states is different, such as Figure 2 shown.
[0019] In this embodiment, the encryption algorithm can adopt a universal symmetric encryption method (the reference implementation is AES128-ECB mode), and the key is the ID token (establishment process) of the management end or the Key (data process) of the device end. In order to prevent algorithm leakage, different device types are encrypted with different keys to increase the security of communication.
[0020] In this embodiment, if Figure 3 As shown, the management end and the sending end use two UDP ports respectively, instead of using the same port. Each port has only one-way data communication. This is the core foundation of two-way communication based on unknown IP. The programming implementation is as follows: In addition, when the device has multiple network interfaces, since it can implicitly obtain the interface from which the data packet is received, in order to avoid broadcasting to other networks or repeated broadcasting, the network interface needs to be explicitly specified when programming the device.
[0021] In this embodiment, if Figure 4As shown in the figure, the entire software architecture mainly includes encryption and decryption modules, UDP communication modules, status monitoring modules, etc. Among them, the UDP communication socket is divided into two parts, listening port M and sending port N. Pay special attention to the following two points: (1) The listening address needs to be bound to all interfaces (that is, the 0.0.0.0 address), not a specific interface; (2) The sending port must be bound to a specified interface for sending, otherwise it cannot be sent according to the TCP / IP protocol specification.
[0022] The present invention has the following advantages: ① Only one data packet is sent in bulk, and the rest of the communication process is single-point communication, which will not cause impact on the network ②Transmitted in ciphertext, it is not easy to be cracked by criminals, ensuring communication security; ③Perform authority authentication during the communication establishment process to ensure the correct identity of the management end; ④The device is uniquely identified by serial number, and even if there are multiple devices with the same IP / MAC, the device can be accurately located; ⑤The device side maintains a state machine and a timer to maintain the establishment, exit, and security verification of the communication process.
[0023] The technology of the present invention is mainly used in the management, maintenance, update and upgrade of industrial network terminal equipment, especially in the scenario where the number of network terminal equipment is large and the management is difficult. For example, it can be applied to the management of charging piles in large charging stations, the management of DTU / RTU terminal equipment in industrial production environment networks, and the maintenance and debugging of the network interface of analytical instruments, etc., and has a wide range of applications. Although the embodiments of the present invention are described in terms of actual solutions, they do not constitute a limitation on the meaning of the present invention. For those skilled in the art, the modification of the implementation scheme and the combination with other schemes according to this specification are obvious.
Claims
1. A network communication method for unknown IP, characterized in that: The network communication method for unknown IP comprises the following steps: A. Communication Agreement: The entire communication process uses UDP broadcast communication. The management end and the device end use two UDP ports. The management end's listening UDP port is M, and the remote port for broadcasting is N. The device end's listening UDP port is N, and the remote port for broadcasting is M. B. Establishment process: The management end carries its own identity information ID token and broadcasts it to all device ends in plain text; after receiving this message, all device ends generate a random number Key for each of them, and encrypt this random number and their own device information with the management end ID token as the key, and then broadcast it back to the management end to complete the communication establishment; After the communication establishment process is completed, the management end and the device end must each maintain the ID token and random number Key of this communication until the communication ends and exits; C. Data process: The data communication process is point-to-point communication, which is still carried out in the form of broadcasting. Different from the communication establishment process, the data process uses the key of the device end as the key and performs encrypted communication. The key values of different device ends are different, thus ensuring the security of the communication link. D. Exit process: When the management end and the device end complete a communication exit command, the communication exit is completed; when the management end has not communicated with the device end for a long time, the device end will also automatically complete the communication exit, and the management end needs to re-establish the process.
2. A network communication method for unknown IP according to claim 1, characterized in that: The network communication method for unknown IP also includes the following steps: E. Error handling: If the corresponding process message is not received during the process, the device side enters an error state. In the error state, the device side does not respond to any instructions until it is restored to the "establishment state".
3. A network communication method for unknown IP according to claim 2, characterized in that: The network communication method for unknown IP also includes the following steps: F. Device-side state change process: After communication is established, the device-side state machine changes from "established state" to "data state". In the "data state", if the device receives a data packet that does not comply with the Key password verification, it will immediately exit the "data state" and enter the "error state". It will take a certain amount of time before it can automatically recover to the "established state". The communication data behavior in different states is different.
4. A network communication method for unknown IP according to claim 1, characterized in that: The encryption algorithm uses a universal symmetric encryption method. During the establishment process, the key is the ID token of the management end. During the data process, the key is the key of the device end. To prevent algorithm leakage, different device types are encrypted with different keys to increase the security of communication.
5. A network communication method for unknown IP according to claim 1, characterized in that: The management end and the sending end use two UDP ports respectively, instead of using the same port. Each port has only one-way data communication. When the device has multiple network interfaces, it can implicitly obtain the interface from which the data packet is received. In order to avoid broadcasting to other networks or repeated broadcasting, the network interface needs to be explicitly specified when programming the device.