Safe IPv6 private network access method and device

Abstract

The embodiment of the invention provides a secure IPv6 private network access method. The secure IPv6 private network access method comprises the following steps: receiving an access request containing client identification information; verifying the legality of the access request, and reversely returning a verification result to the client; if the verification is successful, registering the client through the identification information, obtaining a request message in the identification information, and sending the request message to an IPv6 network access server; wherein the IPv6 network access server is used for responding to a request message, configuring a network parameter containing an IPv6 address according to message information, and controlling the client to access a network. By adopting the IPv6 private network, the problem of address resource exhaustion is solved, the network security is enhanced, the risk of network attack can be effectively reduced, the data security and privacy of the client can be protected, and the network access efficiency and stability of the mobile equipment can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of network communication technology, and more specifically, relates to a secure IPv6 private network access method and device. Background Art

[0002] IP (Internet Protocol) network access technology refers to a series of methods by which a device obtains an IP address and uses related protocols to access the Internet or a private network. The IP address is the identity of the device in the network. The core of network access technology is to assign a legal IP address to the device and configure appropriate network parameters so that it can communicate in the network environment.

[0003] Most current network access still uses IPv4, but the number of IPv4 addresses is limited. With the explosive growth of Internet devices, address resources are gradually exhausted, and its overall security is still limited. There are problems when mobile devices roam and switch networks, such as the complexity and low efficiency of the mobile IP protocol. Therefore, a secure IPv6 private network access method and device that can at least partially solve the above problems is needed. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a secure IPv6 private network access method and device that overcomes the above problems or at least partially solves the above problems.

[0005] In order to solve the above problem, an embodiment of the present invention discloses a secure IPv6 private network access method, the method comprising executing the following steps at an authentication end: receiving an access request including client identification information; Verify the legitimacy of the access request and return the verification result to the client; If the verification is successful, the client is registered through the identification information, and the request message in the identification information is obtained, and the request message is sent to the IPv6 network access server; wherein the IPv6 network access server is used to respond to the request message, configure the network parameters including the IPv6 address according to the message information, and control the client to access the network.

[0006] Preferably, after receiving the access request including the client identification information, the method further comprises: According to the identification information of the client, a routing protocol and the client IP routing information corresponding to the identification information are determined in a preset routing table.

[0007] Preferably, verifying the legitimacy of the access request and returning the verification result to the client includes: Acquire the user information recorded in the identification information; Verify the user's identity, including determining whether the user information is legal, whether the user is on the blacklist of the non-IPv6 network access server, and whether the user is allowed to enter the target network; and return the verification result to the client.

[0008] Preferably, registering the client through the identification information, obtaining the request message in the identification information, and sending the request message to the IPv6 network access server includes: Registering the client through the identification information and obtaining the request message in the identification information; Based on the routing protocol, the request message and IP routing information are sent to the IPv6 network access service end; wherein the IP routing information is used to instruct the IPv6 network access service end to control the client to access the network.

[0009] Preferably, registering the client through the identification information and obtaining the request message in the identification information includes: Mapping the user identity information to a user ID, and ensuring that there is a one-to-one correspondence between the user ID and the user identity information; Encrypt the MAC address information in the client identification information through the HASH algorithm, and encrypt the user ID through the ciphertext to obtain the ciphertext containing the address identification; The ciphertext containing the address identifier is used as reference information to update the interface identifier in the iteration request message.

[0010] Preferably, determining the routing protocol and the client IP routing information corresponding to the identification information in a preset routing table according to the identification information of the client includes: Obtain the client's identification information, including the client's device number, user name, and MAC address. By querying the preset routing table, the mapping relationship between the identification information and the corresponding routing protocol and the client IPv6 routing information is determined.

[0011] An embodiment of the present invention discloses a secure IPv6 private network access method, the method comprising executing the following steps at an IPv6 network access service end: Receive a request message sent by the authentication end; the request message includes the target IP routing information of the client, and the authentication end is used to determine the target IP routing information through the routing table pre-configured for different clients; The client is controlled to access the network according to the target IP routing information.

[0012] The embodiment of the present invention discloses a secure IPv6 private network access device, including: A receiving module, used to receive an access request containing client identification information; The verification module is used to verify the legitimacy of the access request and return the verification result to the client; A network access module is used to register the client through the identification information if the verification is successful, obtain the request message in the identification information, and send the request message to the IPv6 network access server; wherein the IPv6 network access server is used to respond to the request message, configure the network parameters including the IPv6 address according to the message information, and control the client to access the network.

[0013] An embodiment of the present invention discloses an electronic device, including: One or more processors; and one or more machine-readable media having instructions stored thereon, which, when executed by the one or more processors, enable the electronic device to execute the above-mentioned secure IPv6 private network access method.

[0014] The embodiment of the present invention discloses a computer-readable storage medium, wherein the computer program stored in the storage medium enables a processor to execute the above-mentioned secure IPv6 private network access method.

[0015] The embodiments of the present invention include the following advantages: The present invention receives an access request containing client identification information; verifies the legitimacy of the access request, and returns the verification result to the client; if the verification is successful, the client is registered through the identification information, and the request message in the identification information is obtained, and the request message is sent to the IPv6 network access server; wherein the IPv6 network access server is used to respond to the request message, and configure the network parameters containing the IPv6 address according to the message information, and control the client to access the network. It not only has basic metering functions, but also has remote control and billing functions according to rates and time periods. It can not only meet the needs of the current rapid development of the Internet of Things, but also meet the development needs of the Internet of Things. By using an IPv6 private network to solve the problem of address resource exhaustion and enhance network security, it can effectively reduce the risk of network attacks and protect the data security and privacy of the client; it can also provide better support for mobile devices. After using this solution to access the IPv6 private network, the mobile device is smoother when roaming and switching networks, and the network access efficiency and stability of the mobile device can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flowchart of a secure IPv6 private network access method embodiment of the present invention; Figure 2A schematic diagram of the structure of an embodiment of a secure IPv6 private network access device of the present invention; Figure 3 It is a structural schematic diagram of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] Embodiment 1 A secure IPv6 private network access method, the method comprising executing the following steps at an authentication end: S101, receiving an access request including client identification information; S102, verify the legitimacy of the access request, and return the verification result to the client; S103. If the verification is successful, the client is registered through the identification information, and the request message in the identification information is obtained, and the request message is sent to the IPv6 network access server; wherein the IPv6 network access server is used to respond to the request message, configure the network parameters including the IPv6 address according to the message information, and control the client to access the network.

[0019] In this embodiment, the above-mentioned secure IPv6 private network access method, on the one hand, because IPv6 has a huge address space, after using this solution to access the IPv6 private network, it is no longer troubled by the limited number of IPv4 addresses. With the continuous growth of Internet devices, it can provide sufficient IP addresses for new devices to ensure that the devices can smoothly access the network and avoid the situation where they cannot access the network due to insufficient addresses; on the other hand, IPv6 itself integrates security protocols such as IPsec. After accessing the IPv6 private network through this solution, it provides better security protection for network access from the protocol level. Compared with the situation where IPv4 is designed with less security considerations, it can effectively reduce the risk of network attacks and protect the data security and privacy of the client. On the other hand, the above-mentioned IPv6 has better support for mobile devices in design. After using this solution to access the IPv6 private network, the mobile device is smoother when roaming and switching networks. Compared with the problem that the IPv4 mobile IP protocol is complex and inefficient, it can improve the network access efficiency and stability of mobile devices and meet the mobile networking needs of users in different scenarios. In addition, due to the huge IPv6 address space, this solution can easily support large-scale network expansion. Whether adding new client devices or expanding network coverage, planning and deployment can be more flexible to meet growing business needs.

[0020] A unified data management function is integrated in the above-mentioned authentication end, and self-service management and adaptive matching of the client IP routing are realized through the authentication end. The network structure adjustment does not require the cooperation of the core control plane of the mobile network, which can avoid communication failures when the client networking changes, and at the same time reduce the maintenance workload of the core network and the authentication end; furthermore, through the adaptive matching of the client IP routing, real-time automatic updates can be realized, thereby improving the overall efficiency of network access.

[0021] The network access method provided in the application embodiment can be applied to Figure 1 In the application environment shown in the figure, the authentication end is connected to multiple clients, and each client communicates with the 5G core network through the authentication end to access the 5G network; the clients include but are not limited to various personal computers, laptops, smart phones, tablets, IoT devices and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc.

[0022] Embodiment 2 A secure IPv6 private network access method, wherein, after S101, receiving an access request containing client identification information, it also includes: determining, in a preset routing table, a routing protocol and the client IP routing information corresponding to the identification information according to the identification information of the client.

[0023] Further, determining, in a preset routing table, a routing protocol and the client IP routing information corresponding to the identification information according to the identification information of the client, includes: Obtain the client's identification information, including the client's device number, user name, and MAC address. By querying the preset routing table, the mapping relationship between the identification information and the corresponding routing protocol and the client IPv6 routing information is determined.

[0024] When receiving a request from a client, the client's identification information is first obtained. This identification information can be a unique feature identifier such as the client's device number, user name, MAC address, etc. Then, the system will query the preset routing table. This routing table is pre-configured and maintained, and contains the mapping relationship between different identification information and the corresponding routing protocol and client IPv6 routing information.

[0025] When querying the routing table, the system will use the obtained client identification information as an index for quick search. Once an entry matching the identification information is found, the corresponding routing protocol can be determined. Different clients may need to use different routing protocols for data transmission. For example, some clients may be suitable for using static routing protocols, while others are more suitable for dynamic routing protocols. At the same time, the client IPv6 routing information corresponding to the identification information can also be determined. IPv6 routing information can include key information such as the destination IPv6 address, the next hop IPv6 address, and the outbound interface. This information will guide the data transmission path in the network and ensure that the client's request can be accurately routed to the target server or other network nodes.

[0026] For example, when a client A with specific identification information sends a request, the system determines that the client corresponds to the dynamic routing protocol RIPng (Routing Information Protocol next generation) by querying the routing table, and obtains its IPv6 routing information as follows: the destination IPv6 address is XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX, the next hop IPv6 address is YYYY:YYYY:YYYY:YYYY:YYYY:YYYY:YYYY, and the outgoing interface is Interface Z. In this way, the system can forward and process the request of client A along the correct path according to these determined routing protocols and IPv6 routing information.

[0027] And obtain the request message in the identification information, and send the request message to the IPv6 network access server; wherein the IPv6 network access server is used to respond to the request message and configure the network parameters including the IPv6 address according to the message information.

[0028] It may be further preferred that S102, verifying the legitimacy of the access request and returning the verification result to the client, includes: obtaining user information recorded in the identification information; Verify the user's identity, including determining whether the user information is legal, whether the user is on the non-IPv6 network access server blacklist (operator blacklist), and whether the user is allowed to enter the target network; and return the verification result to the client.

[0029] By obtaining the user information in the identification information and verifying it, it is ensured that only legitimate users can access the network. Multi-faceted verification of user identity, including determining whether the user information is legitimate information, can prevent illegal users from accessing the network by impersonating their identities, thereby reducing the risk of the network being attacked maliciously. Checking whether the user is in the IPv6 network access server blacklist (operator blacklist) further strengthens the security of the network. If the user is in the blacklist, it means that the user may have a record of bad behavior. Prohibiting the user from accessing the network can protect the security and stability of other legitimate users and the network. Determining whether the user is allowed to enter the target network can achieve fine control of network access. For example, some specific networks may only allow access to specific types of users or users with specific permissions. This verification method can ensure that only qualified users can enter the target network, improving the security of the network and the reasonable allocation of resources. Through blacklist screening and access judgment, bad users can be excluded in a timely manner to reduce their negative impact on network performance and other user experiences. At the same time, it can also reduce the cost and workload of network management because it does not take a lot of time and resources to deal with problems caused by bad users.

[0030] It can be further preferred that the registering the client through the identification information, obtaining the request message in the identification information, and sending the request message to the IPv6 network access server include: registering the client through the identification information, and obtaining the request message in the identification information; based on the routing protocol, sending the request message and IP routing information to the IPv6 network access server; wherein the IP routing information is used to instruct the IPv6 network access server to control the client's access to the network.

[0031] When a device (client) attempts to access the network, the device sends an access request containing the client identification information to the authentication end. After receiving the request, the authentication end first obtains the user information recorded in the identification information, such as the employee's username and password, the device's unique identification code, etc. Then it performs user identity verification to confirm that the user information is legal and that the user is not on the blacklist, and that the user is allowed to enter the enterprise network. If the verification is successful, the authentication end registers the client through the identification information and obtains the request message from the identification information. Assume that the request message is a request to access a specific server within the enterprise.

[0032] According to the preset routing protocol (such as OSPFv3 and other IPv6 routing protocols), the authentication end sends a request message and IP routing information to the IPv6 network access server. The IP routing information may include the destination IPv6 address (the IPv6 address of the internal server of the enterprise), the next hop IPv6 address (which may be the address of a router in the network), etc. After receiving the request message and IP routing information, the IPv6 network access server configures the network parameters including the IPv6 address according to this information and controls the client's access to the network. For example, a suitable IPv6 address is assigned to the client, and the corresponding routing rules are set so that the client can successfully access the target server.

[0033] By sending IP routing information to the IPv6 access server, accurate routing control of the client's access to the network can be achieved. The access server can plan the best network path for the client based on this information to ensure the efficiency and stability of data transmission. For the client, there is no need to perform complex network configuration. The authentication terminal and the access server will automatically complete the configuration of network parameters for the client based on the identification information and IP routing information, so that the client can quickly access the network. This greatly reduces the user's operating difficulty, improves the ease of use of the network, and helps to improve the efficiency of network management and reduce management costs.

[0034] It can be further preferred that the client is registered through the identification information and the request message in the identification information is obtained, including: mapping the user identity information into a user ID, and determining that there is a one-to-one correspondence between the user ID and the user identity information; encrypting through a HASH algorithm according to the MAC address information in the client identification information, and encrypting the user ID through a ciphertext to obtain a ciphertext containing an address identifier; using the ciphertext containing the address identifier as reference information to update the interface identifier in the iterative request message.

[0035] When sending an access request, the authentication end first obtains the user identity information in the identification information, such as the student's student number and name. Then, the user identity information is mapped to a unique user ID to ensure that each client's user ID corresponds to their identity information. The MAC address information in the client identification information is extracted and encrypted using the HASH algorithm to obtain a ciphertext. The user ID is then encrypted with this ciphertext to obtain a ciphertext containing an address identifier. For example, assuming that the MAC address of student A is encrypted with the HASH algorithm to obtain ciphertext X, and the user ID of student A is Y, the user ID Y is encrypted with ciphertext X to obtain ciphertext Z containing an address identifier. This ciphertext Z containing an address identifier is used as reference information to update the interface identifier in the iterative request message. In this way, the request message carries encrypted user-specific information during transmission.

[0036] It can be further preferred that the above-mentioned implementation method of mapping the user identity information into the user ID is: mapping the attribute information including the user name, mobile phone number and name through a hash algorithm to obtain a bit string, intercepting several bits from the bit string and then determining the user additional information based on the user type information, and merging them to generate a user ID.

[0037] Embodiment 3 A secure IPv6 private network access method, the method comprising the following steps at an IPv6 network access service end: receiving a request message sent by an authentication end; the request message comprises the target IP routing information of the client, the authentication end is used to determine the target IP routing information by configuring routing tables for different clients in advance; and controlling the client to access the network according to the target IP routing information. Specifically, receiving a request message sent by an authentication end; the request message comprises the IP routing information of the client, and the target IP routing information is determined by the authentication end based on the IP routing information configured in advance for different local devices. Controlling the client to access the network according to the target IP routing information, that is, self-service management and adaptive matching of the target IP routing information of the client that needs to access the network are performed by the authentication end. That is, the authentication end determines the target IP routing information of the client based on the pre-configured IP routing information of each local device, and then sends the target IP routing information to the IPv6 network access service end in the form of a request message by the authentication end.

[0038] Embodiment 4 As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0039] In this embodiment, Figure 2As shown, a secure IPv6 private network access device is also disclosed, including: Receiving module 101, used to receive an access request including client identification information; Verification module 102, used to verify the legitimacy of the access request and return the verification result to the client; The network access module 102 is used to register the client through the identification information if the verification is successful, obtain the request message in the identification information, and send the request message to the IPv6 network access server; wherein the IPv6 network access server is used to respond to the request message, configure the network parameters including the IPv6 address according to the message information, and control the client to access the network.

[0040] Reference Figure 3 In an embodiment of the present invention, the present invention further provides a computer device. The above-mentioned computer device 12 is in the form of a general computing device. The components of the computer device 12 may include but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 connecting different system components (including the system memory 28 and the processing unit 16).

[0041] The bus 18 represents one or more of several types of bus 18 structures, including a memory bus 18 or memory controller, a peripheral bus 18, an accelerated graphics port, a processor, or a local bus 18 using any of a variety of bus 18 architectures. These architectures include, by way of example, but are not limited to, an Industry Standard Architecture (ISA) bus 18, a Micro Channel Architecture (MAC) bus 18, an Enhanced ISA bus 18, an Audio Video Electronics Standards Association (VESA) local bus 18, and a Peripheral Component Interconnect (PCI) bus 18.

[0042] The computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0043] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 31 and / or cache memory 32. Computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write to non-removable, non-volatile magnetic media (commonly referred to as a "hard drive"). Although Figure 3Not shown, a disk drive for reading and writing to a removable non-volatile disk (such as a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (such as a CD-ROM, DVD-ROM or other optical medium) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory may include at least one program product having a set (e.g., at least one) of program modules 42, which are configured to perform the functions of various embodiments of the present invention.

[0044] A program / utility 41 having a set (at least one) of program modules 42 may be stored in, for example, a memory, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules 42, and program data, each of which or some combination may include an implementation of a network environment. The program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0045] The computer device 12 may also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, camera, etc.), one or more devices that enable a user to interact with the computer device 12, and / or any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed via an input / output (I / O) interface 22. In addition, the computer device 12 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network (e.g., Internet) via a network adapter 20. As shown, the network adapter 21 communicates with other modules of the computer device 12 via a bus 18. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the computer device 12, including but not limited to: microcode, device drivers, redundant processing units 16, external disk drive arrays, RAID systems, tape drives, and data backup storage systems 34, etc.

[0046] The processing unit 16 executes various functional applications and data processing by running programs stored in the system memory 28, such as implementing the secure IPv6 private network access method provided by the embodiment of the present invention.

[0047] That is, when the processing unit 16 executes the program, it implements: receiving an access request including client identification information; verifying the legitimacy of the access request, and returning the verification result to the client; if the verification is successful, registering the client through the identification information, obtaining the request message in the identification information, and sending the request message to the IPv6 network access server; wherein the IPv6 network access server is used to respond to the request message, configure network parameters including the IPv6 address according to the message information, and control the client to access the network.

[0048] In an embodiment of the present invention, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the secure IPv6 private network access method provided in all embodiments of the present application.

[0049] That is, when the program is executed by the processor, it is implemented as follows: receiving an access request containing client identification information; verifying the legitimacy of the access request, and returning the verification result to the client; if the verification is successful, registering the client through the identification information, obtaining the request message in the identification information, and sending the request message to the IPv6 network access server; wherein the IPv6 network access server is used to respond to the request message, configure network parameters containing the IPv6 address according to the message information, and control the client to access the network.

[0050] Any combination of one or more computer-readable media may be used. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, device or device.

[0051] Computer-readable signal media may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0052] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, Python, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0053] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0054] It should be understood by those skilled in the art that the embodiments of the present invention can be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0055] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0056] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0057] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0058] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0059] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0060] The above is a detailed introduction to a secure IPv6 private network access method and device, electronic device and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A secure IPv6 private network access method, characterized in that: The method comprises executing the following steps at the authentication end: receiving an access request including client identification information; Verify the legitimacy of the access request and return the verification result to the client; If the verification is successful, the client is registered through the identification information, and the request message in the identification information is obtained, and the request message is sent to the IPv6 network access server; wherein the IPv6 network access server is used to respond to the request message, configure the network parameters including the IPv6 address according to the message information, and control the client to access the network.

2. The method according to claim 1, characterized in that After receiving the access request including the client identification information, the method further includes: According to the identification information of the client, a routing protocol and the client IP routing information corresponding to the identification information are determined in a preset routing table.

3. The method according to claim 1, characterized in that Verifying the legitimacy of the access request and returning the verification result to the client includes: Acquire the user information recorded in the identification information; Verify the user's identity, including determining whether the user information is legal, whether the user is on the blacklist of the non-IPv6 network access server, and whether the user is allowed to enter the target network; and return the verification result to the client.

4. The method according to claim 1, characterized in that The registering the client through the identification information, obtaining the request message in the identification information, and sending the request message to the IPv6 network access server includes: Registering the client through the identification information and obtaining the request message in the identification information; Based on the routing protocol, the request message and IP routing information are sent to the IPv6 network access service end; wherein the IP routing information is used to instruct the IPv6 network access service end to control the client to access the network.

5. The method according to claim 4, characterized in that The registering the client through the identification information and obtaining the request message in the identification information includes: Mapping the user identity information to a user ID, and ensuring that there is a one-to-one correspondence between the user ID and the user identity information; Encrypt the MAC address information in the client identification information through the HASH algorithm, and encrypt the user ID through the ciphertext to obtain the ciphertext containing the address identification; The ciphertext containing the address identifier is used as reference information to update the interface identifier in the iteration request message.

6. The method according to claim 2, characterized in that Determining, in a preset routing table according to the identification information of the client, the routing protocol and the client IP routing information corresponding to the identification information, includes: Obtain the client's identification information, including the client's device number, user name, and MAC address. By querying the preset routing table, the mapping relationship between the identification information and the corresponding routing protocol and the client IPv6 routing information is determined.

7. A secure IPv6 private network access method, characterized in that: The method comprises executing the following steps at the IPv6 network access service end: Receive a request message sent by the authentication end; the request message includes the target IP routing information of the client, and the authentication end is used to determine the target IP routing information through the routing table pre-configured for different clients; The client is controlled to access the network according to the target IP routing information.

8. A secure IPv6 private network access device, characterized in that: include: A receiving module, used to receive an access request containing client identification information; The verification module is used to verify the legitimacy of the access request and return the verification result to the client; A network access module is used to register the client through the identification information if the verification is successful, obtain the request message in the identification information, and send the request message to the IPv6 network access server; wherein the IPv6 network access server is used to respond to the request message, configure the network parameters including the IPv6 address according to the message information, and control the client to access the network.

9. An electronic device, characterized in that: include: one or more processors; and one or more machine-readable media having instructions stored thereon, which, when executed by the one or more processors, enable the electronic device to execute the secure IPv6 private network access method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer program stored therein enables the processor to execute the secure IPv6 private network access method as described in any one of claims 1 to 7.

Images