Random NAT mechanism implementation method based on IPv6 address, terminal equipment and storage medium

Abstract

The invention relates to a random NAT (Network Address Translation) mechanism implementation method based on IPv6 (Internet Protocol Version 6) addresses, terminal equipment and a storage medium. The method comprises the following steps: S1, presetting an IPv6 secondary throwing pool with multiple groups of IPv6 addresses; s2, when an extranet access request sent by an enterprise internal client is obtained, an NAT source address is randomly selected from the IPv6 secondary throwing pool, and the extranet access request comprises a real IPv6 address of the enterprise internal client; s3, replacing the real IPv6 address of the enterprise internal client with the NAT source address randomly selected in the step S2 to generate a new extranet access request to communicate with the extranet; and S4, when a network data packet returned by the extranet is obtained, forwarding the network data packet to the corresponding enterprise internal client according to the internal mapping relationship, and by the method, when the enterprise internal client initiates extranet access, the concealment and security when the intranet terminal accesses the extranet can be improved.

Description

Technical Field

[0001] The present application relates to the field of network communication technology, and in particular to a method for implementing a random NAT mechanism based on an IPv6 address, a terminal device, and a storage medium. Background Art

[0002] With the popularization and development of the Internet, network security issues have become increasingly prominent. The traditional NAT64 or NAT66 ordered NAT mechanism is easily exploited by attackers due to its orderliness, thus threatening the security of customer intranet terminals.

[0003] In the existing network architecture, NAT (Network Address Translation) technology is widely used to achieve address translation between private networks and public networks. However, the orderliness of NAT technology allows attackers to infer the topology of the internal network and the allocation of IP addresses by analyzing the NAT mapping relationship, thereby launching targeted attacks. The above-mentioned security risks are particularly evident in the traditional NAT64 and NAT66 mechanisms, because they usually use fixed mapping rules and algorithms, resulting in a certain regularity and predictability of the IP addresses of the internal network, which is prone to security risks. Summary of the invention

[0004] The main purpose of this application is to provide a method for implementing a random NAT mechanism based on IPv6 addresses, a terminal device, and a storage medium, aiming to solve the problem that traditional NAT mechanisms, such as one-to-one mapping or IPv6 and IPv4 splicing, due to their orderliness, make it easy for attackers to exploit this feature to attack intranet terminals, thereby threatening the security of customer intranets.

[0005] To achieve the above object, the present application provides a method for implementing a random NAT mechanism based on an IPv6 address, comprising the following steps:

[0006] S1, preset an IPv6 secondary throw pool with multiple groups of IPv6 addresses;

[0007] S2, when receiving an external network access request sent by an internal client of the enterprise, randomly selects a NAT source address from the IPv6 secondary throw pool. The external network access request includes the real IPv6 address of the internal client of the enterprise.

[0008] S3, replacing the real IPv6 address of the internal client of the enterprise with the NAT source address randomly selected in step S2 to generate a new external network access request to communicate with the external network;

[0009] S4, when the network data packet returned from the external network is obtained, the network data packet is forwarded to the corresponding internal client of the enterprise according to the internal mapping relationship.

[0010] In one embodiment, randomly selecting a NAT source address from the IPv6 secondary throw pool in step S2 includes:

[0011] S2-1, obtain the access signal of the internal client and extract the intranet source IP and time information;

[0012] S2-2 uses a hash algorithm to generate a unique random number sequence using the intranet source IP and time as seeds;

[0013] S2-3, according to the preset IPv6 address selection method, select an idle IPv6 address from the IPv6 secondary throw pool, and splice it with the random number sequence generated in step S2-2 to form a complete NAT source address.

[0014] In one embodiment, the IPv6 address prefix length generated by the random number sequence is the same as the preset IPv6 secondary throw pool prefix length.

[0015] In one embodiment, between step S2 and step S3, the following step is also included: checking whether the generated NAT source address has been occupied; if so, returning to step S2-3 to reselect an idle IPv6 address; if not, proceeding to the next step.

[0016] In one embodiment, step S2-2 further includes: adding an additional random string to the input of the hash algorithm.

[0017] In one embodiment, the random character string is directly set in the form of the current timestamp of the system.

[0018] In one embodiment, step S1 includes:

[0019] S1-1, determine the prefix length of the IPv6 secondary throw pool based on network scale and requirements;

[0020] S1-2, select an unused address range in the IPv6 address space as the base address of the secondary pool;

[0021] S1-3, generating a complete IPv6 address list according to the determined prefix length and base address;

[0022] S1-4, storing the generated IPv6 address list in a secure database or configuration file to form an IPv6 secondary throw pool.

[0023] In one embodiment, between step S1-3 and step S1-4, it also includes: presetting an IPv6 address management mechanism, monitoring the usage of the IPv6 secondary throw pool, and establishing a dynamically updated address status table in the database.

[0024] To achieve the above-mentioned purpose, the present application further provides a terminal device, characterized in that the terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the computer program is executed by the processor, the steps of the above-mentioned method for implementing a random NAT mechanism based on an IPv6 address are implemented.

[0025] To achieve the above-mentioned purpose, the present application further provides a storage medium, characterized in that a computer program is stored on the storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned method for implementing a random NAT mechanism based on an IPv6 address are implemented.

[0026] The beneficial effects of the technical solution of the present invention are:

[0027] By randomly selecting the NAT source address, the real IPv6 address of the internal client is effectively hidden, the anonymity and concealment of the network are enhanced, and the risk of being directly located and attacked by attackers is reduced. A unique random number sequence is generated through a hash algorithm and concatenated with the IPv6 secondary pool prefix to ensure the uniqueness of each NAT source address, avoid address conflicts, and improve the utilization of IPv6 address resources.

[0028] By determining the number of bits of the generated NAT source address according to the prefix length of the secondary pool, the uniqueness and randomness of the NAT source address are ensured, the concealment and security of the internal network terminal accessing the external network are improved, and the risk of being directly located and attacked by the attacker is reduced. And because the NAT source address is dynamically replaced for each access, even if the attacker intercepts the data packet, it is difficult to determine which specific internal device initiated the request, thereby protecting the privacy of the user.

[0029] At the same time, adding an additional random string, such as the system's current timestamp, to the input of the hash algorithm can further enhance the randomness and unpredictability of the generated NAT source address. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of the application environment of the random NAT mechanism implementation method based on IPv6 address provided in this application;

[0031] Figure 2 This is a schematic diagram of the steps of a method for implementing a random NAT mechanism based on an IPv6 address in an embodiment of the present application;

[0032] Figure 3 This is a schematic block diagram of the internal structure of a terminal device according to an embodiment of the present application.

[0033] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0034] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0035] In addition, if the description of "first", "second", etc. is involved in this application, it is only used for descriptive purposes (such as for distinguishing the same or similar elements), and cannot be understood as indicating or suggesting its relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but it must be based on the ability of ordinary technicians in this field to implement. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0036] See also Figure 1 , Figure 1 A schematic diagram of the application environment of a method for implementing a random NAT mechanism based on an IPv6 address provided in the present application, wherein 10 includes multiple internal enterprise clients, 20 is a NAT device, 30 is an external network, and the arrows between 10 and 20, and between 20 and 30 indicate that a network path can be established.

[0037] The NAT device 20 executes a random NAT mechanism implementation method based on an IPv6 address.

[0038] See also Figure 2 In an embodiment of the present application, a method for implementing a random NAT mechanism based on an IPv6 address is provided, comprising the following steps:

[0039] S1, preset an IPv6 secondary throw pool with multiple groups of IPv6 addresses.

[0040] S2, when obtaining the external network access request sent by the internal client of the enterprise, randomly select the NAT source address from the IPv6 secondary throw pool, and the external network access request includes the real IPv6 address of the internal client of the enterprise.

[0041] S3, replace the real IPv6 address of the internal client of the enterprise with the NAT source address randomly selected in step S2 to generate a new external network access request to communicate with the external network.

[0042] S4, when the network data packet returned from the external network is obtained, the network data packet is forwarded to the corresponding internal client of the enterprise according to the internal mapping relationship.

[0043] The step S2 of randomly selecting a NAT source address from the IPv6 secondary throw pool includes:

[0044] S2-1, obtain the access signal of the internal client and extract the intranet source IP and time information.

[0045] S2-2 uses a hash algorithm to generate a unique random number sequence using the intranet source IP and time as seeds.

[0046] S2-3, according to the preset IPv6 address selection method, select an idle IPv6 address from the IPv6 secondary throw pool, and splice it with the random number sequence generated in step S2-2 to form a complete NAT source address.

[0047] In this solution, by randomly selecting the NAT source address, the real IPv6 address of the internal client is effectively hidden, the anonymity and concealment of the network are enhanced, and the risk of being directly located and attacked by attackers is reduced. A unique random number sequence is generated through a hash algorithm and concatenated with the IPv6 secondary pool prefix to ensure the uniqueness of each NAT source address, avoid address conflicts, and improve the utilization of IPv6 address resources.

[0048] In summary, compared with the prior art, the present invention effectively hides the real IPv6 address of the internal client by randomly selecting the NAT source address, enhances the anonymity and concealment of the network, and reduces the risk of attackers directly locating and attacking the internal network.

[0049] In one embodiment, the hash algorithm may be SHA-256 or MD5, which is used to map input data (such as intranet source IP and time information) into a string of fixed length. Furthermore, the generated string is highly random and unique, thereby ensuring the uniqueness and unpredictability of the generated NAT source address.

[0050] Specifically, when an internal client initiates an external network access request, the system automatically obtains its access signal and extracts relevant information as a seed to input into the hash algorithm. The algorithm then generates a random number sequence, which is concatenated with the preset IPv6 secondary pool prefix to form a new, unique NAT source address. Since the random number sequence generated each time is different, even if the same seed value is used, no duplicate addresses will be generated, thus ensuring the security and privacy of network communications.

[0051] In one embodiment, the method of selecting the IPv6 address in step S2-3 is as follows: according to the length of the IPv6 secondary pool prefix, an IPv6 address with the same length as the IPv6 secondary pool prefix is ​​selected from the IPv6 secondary pool. That is, if the IPv6 secondary pool uses a 64-bit prefix, the random number sequence will generate a corresponding 64-bit IPv6 address, and concatenate it with the prefix of the secondary pool to form a complete NAT source address.

[0052] In this solution, the number of bits of the generated NAT source address is determined according to the prefix length of the secondary pool, ensuring the uniqueness and randomness of the NAT source address, improving the concealment and security of the intranet terminal accessing the external network, and reducing the risk of attackers directly locating and attacking the internal network.

[0053] In one embodiment, the steps between step S2 and step S3 further include:

[0054] Check whether the generated NAT source address has been occupied. If it has been occupied, return to step S2-3 to reselect an idle IPv6 address; if it has not been occupied, proceed to the next step.

[0055] Furthermore, step S2-2 also includes: adding an additional random string to the input of the hash algorithm.

[0056] The random character string can directly adopt the current timestamp of the system.

[0057] In this solution, by adding an additional random string, such as the current system timestamp, to the input of the hash algorithm, the randomness and unpredictability of the generated NAT source address can be further enhanced.

[0058] Since the timestamp is unidirectional and changes in real time, it not only provides a certain degree of time series protection for the NAT source address, making it difficult for attackers to infer future address patterns from historical data, but also means that each generated NAT source address will be unique, thus avoiding the possibility of address conflicts. In addition, the generation time of the NAT source address can be tracked when necessary.

[0059] In one embodiment, step S1 includes:

[0060] S1-1, determine the prefix length of the IPv6 secondary throw pool based on the network scale and requirements.

[0061] S1-2, in the IPv6 address space, select an unused address range as the base address of the secondary pool.

[0062] S1-3, generating a complete IPv6 address list according to the determined prefix length and base address.

[0063] S1-4, storing the generated IPv6 address list in a secure database or configuration file to form an IPv6 secondary throw pool.

[0064] Furthermore, between step S1-3 and step S1-4, the following steps are also included:

[0065] An IPv6 address management mechanism is preset to monitor the usage of the IPv6 secondary pool and establish a dynamically updated address status table in the database.

[0066] The IPv6 address management mechanism is as follows:

[0067] S1-3a, monitors the usage of IPv6 addresses, including addresses assigned to devices, unused addresses, and expired addresses.

[0068] S1-3b, based on the monitoring results, update the address status table in the database to record the status of each address (such as allocated, unused or expired).

[0069] S1-3c, regularly check the address status table to ensure that there are enough available addresses in the address pool to meet network needs.

[0070] S1-3d, when a new IPv6 address needs to be allocated, an unused address is selected from the address pool and the address status table is updated.

[0071] S1-3e, when a device no longer needs an IPv6 address, it marks it as unused and updates it in the address status table.

[0072] S1-3f, for expired addresses, they can be removed from the address pool and the address status table is updated.

[0073] S1-3g, provides an API interface to allow other systems or services to query and modify the address status table.

[0074] In this solution, by monitoring the use of IPv6 addresses and updating the address status table in real time, the system can dynamically track the allocation, use, and release status of each address, ensuring that there are always enough available addresses in the address pool for new devices to access, avoiding the waste of address resources. At the same time, when an IPv6 address needs to be allocated to a new device, the system can quickly select an unused address from the address pool for allocation and automatically update the address status table, thereby improving the efficiency and accuracy of address allocation and reducing the need for manual intervention.

[0075] In addition, an API interface is provided to allow other systems or services to query and modify the address status table, enhancing the flexibility and scalability of the system.

[0076] The present application also provides a terminal device, the internal structure of which can be as follows: Figure 3 As shown. The terminal device includes a processor, a memory, a communication interface and a database connected via a system bus. The processor is used to provide computing and control capabilities. The memory of the terminal device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the terminal device is used to store data called by the computer program. The communication interface of the terminal device is used to communicate data with an external terminal. The input device of the terminal device is used to receive a signal input by an external device. When the computer program is executed by the processor, a random NAT mechanism implementation method based on an IPv6 address as described in the above embodiment is implemented.

[0077] Those skilled in the art will understand that Figure 3 The structure shown in is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the terminal device to which the solution of the present application is applied.

[0078] In addition, the present application also proposes a storage medium, the storage medium includes a computer program, and the computer program, when executed by a processor, implements the steps of the method for implementing a random NAT mechanism based on an IPv6 address as described in the above embodiment. It can be understood that the storage medium in this embodiment can be a volatile storage medium or a non-volatile storage medium.

[0079] To summarize, the random NAT mechanism implementation method based on IPv6 address, terminal device and storage medium provided in the embodiments of the present application can randomly select a NAT source address from a preset IPv6 secondary pool when an internal client of an enterprise initiates external network access, so as to ensure that the NAT source address used for each access is random, thereby improving the confidentiality and security of the internal network terminal when accessing the external network.

[0080] Those of ordinary skill in the art can understand that all or part of the processes in the random NAT mechanism implementation method based on IPv6 address in the above-mentioned embodiment can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the random NAT mechanism implementation method based on IPv6 address as described above. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0081] It should be noted that, in this article, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, device, article or random NAT mechanism implementation method based on IPv6 address that includes a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such process, device, article or random NAT mechanism implementation method based on IPv6 address. In the absence of more restrictions, an element defined by the sentence "includes one..." does not exclude the existence of other identical elements in the process, device, article or random NAT mechanism implementation method based on IPv6 address that includes the element.

[0082] The above description is only a preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly used in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for implementing a random NAT mechanism based on an IPv6 address, characterized in that: The following steps are involved: S1, preset an IPv6 secondary throw pool with multiple groups of IPv6 addresses; S2, when receiving an external network access request sent by an internal client of the enterprise, randomly selects a NAT source address from the IPv6 secondary throw pool. The external network access request includes the real IPv6 address of the internal client of the enterprise. S3, replacing the real IPv6 address of the internal client of the enterprise with the NAT source address randomly selected in step S2 to generate a new external network access request to communicate with the external network; S4, when a network data packet returned from the external network is obtained, the network data packet is forwarded to the corresponding internal client of the enterprise according to the internal mapping relationship.

2. The method for implementing a random NAT mechanism based on an IPv6 address according to claim 1, characterized in that: Randomly selecting a NAT source address from the IPv6 secondary throw pool in step S2 includes: S2-1, obtain the access signal of the internal client and extract the intranet source IP and time information; S2-2 uses a hash algorithm to generate a unique random number sequence using the intranet source IP and time as seeds; S2-3, according to the preset IPv6 address selection method, select an idle IPv6 address from the IPv6 secondary throw pool, and splice it with the random number sequence generated in step S2-2 to form a complete NAT source address.

3. The method for implementing a random NAT mechanism based on an IPv6 address according to claim 2, characterized in that: The IPv6 address prefix length generated by the random number sequence is the same as the preset IPv6 secondary throw pool prefix length.

4. The method for implementing a random NAT mechanism based on an IPv6 address according to claim 3, characterized in that: The steps S2 and S3 also include: Check whether the generated NAT source address has been occupied. If it has been occupied, return to step S2-3 to reselect an idle IPv6 address; if it has not been occupied, proceed to the next step.

5. The method for implementing a random NAT mechanism based on an IPv6 address according to claim 4, characterized in that: The step S2-2 also includes: adding an additional random string to the input of the hash algorithm.

6. The method for implementing a random NAT mechanism based on an IPv6 address according to claim 5, characterized in that: The random character string is directly set in the form of the current timestamp of the system.

7. The method for implementing a random NAT mechanism based on an IPv6 address according to claim 1, characterized in that: The step S1 comprises: S1-1, determine the prefix length of the IPv6 secondary throw pool based on network scale and requirements; S1-2, select an unused address range in the IPv6 address space as the base address of the secondary pool; S1-3, generating a complete IPv6 address list according to the determined prefix length and base address; S1-4, storing the generated IPv6 address list in a secure database or configuration file to form an IPv6 secondary throw pool.

8. According to the method for implementing a random NAT mechanism based on an IPv6 address in claim 7, the step S1-3 and the step S1-4 further include: An IPv6 address management mechanism is preset to monitor the usage of the IPv6 secondary pool and establish a dynamically updated address status table in the database.

9. A terminal device, characterized in that: The terminal device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of the method for implementing a random NAT mechanism based on an IPv6 address as described in any one of claims 1 to 7 are implemented.

10. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for implementing a random NAT mechanism based on an IPv6 address as described in any one of claims 1 to 7.

Images