IPV6 legality verification method and device
By converting the IP address into binary form and combining mask bit operation, the forward and reverse IP address ranges are calculated, and the problem of inefficient IPV6 address range verification in the prior art is solved, and efficient and accurate IPV6 legality verification is achieved.
Patent Information
- Application Number
- CN202411870850.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-18
- Publication Date
- 2025-03-07
AI Technical Summary
The prior art is inefficient when performing IPV6 address range verification in large-scale, high-concurrency network environments, and cannot effectively solve the performance bottleneck of IPV6 legality verification.
By converting the IP address to be verified into a binary form of forward and reverse, and combining the bit operations of the front and back masks, the minimum and maximum IP address ranges of forward and reverse directions are calculated, and bit-by-bit comparisons are performed to determine the legitimacy of the IP address.
It improves the efficiency of IPV6 address range verification, reduces the calculation amount, enhances the accuracy of the algorithm, avoids missed detection, and adapts to complex network environments and multiple mask combinations.
Smart Images
Figure CN119583208A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security, and in particular to an IPv6 legality verification method and device. Background Art
[0002] In modern network security systems, IP address verification is one of the important links to ensure network security and prevent malicious attacks. With the complexity of the network environment and the continuous changes in security threats, how to efficiently and accurately check whether an IP address is located in a certain IP mask segment has become an important requirement for network security devices and firewalls.
[0003] Currently, in network security systems, common IP address checking methods include traditional bit-by-bit comparison, mask matching, or routing table lookup. However, with the popularity of IPV6 addresses and the increasing size of networks, these traditional methods often face performance bottlenecks in large-scale, high-concurrency network environments. Therefore, it is particularly important to develop a fast, efficient, and scalable IPV6 range verifier. Summary of the invention
[0004] The purpose of the present invention is to provide an IPV6 legality verification method and device to solve the problem of low efficiency of the prior art.
[0005] To achieve one of the above-mentioned purposes of the invention, an embodiment of the present invention provides an IPV6 legitimacy verification method, the method comprising: The received IP address to be verified is converted into forward and reverse binary forms, and compared with the preset legal forward and reverse minimum and maximum IP address ranges respectively; When the IP address to be checked is within the preset legal forward and reverse minimum and maximum IP address ranges at the same time, the IP address to be checked is determined to be legal.
[0006] As a further improvement of an embodiment of the present invention, the method further includes obtaining a legal IPV6 address preset by the system, calculating a preset legal minimum and maximum forward IP address range and a minimum and maximum reverse IP address range, including, Obtain the system preset legal IPV6 address by querying the configuration file, database, dynamic configuration interface or by manual input.
[0007] As a further improvement of an embodiment of the present invention, the method further includes that the calculation of the preset legal forward minimum and maximum IP address ranges and the reverse minimum and maximum IP address ranges includes, Convert the preset legal IPv6 address range into a 128-bit binary array; Processing the 128-bit binary array through forward and backward mask operations, calculating the minimum and maximum forward IP address ranges, and determining the binary representation of the legal IP address range; Perform byte-reversal and order-reversal operations on the forward minimum and maximum IP addresses to generate a binary representation of the reverse minimum and maximum IP address ranges.
[0008] As a further improvement of an embodiment of the present invention, the method further includes: the front and back mask operations include: According to the front mask information, the fixed number of bits covered by the front mask in the IP address is determined, and the host part not covered by the front mask is set to the minimum value 0 or the maximum value 1, so as to form the binary representation of the possible minimum and maximum positive IP addresses in the IP address range; According to the post-mask information, the variable bits in the host part covered by the post-mask in the IP address are set to a minimum value of 0 or a maximum value of 1, and a binary representation of the possible reverse minimum and maximum IP addresses in the IP address range is generated; The minimum and maximum possible forward and reverse IPs in an IP address range represent the starting and ending boundaries of legal IP addresses in a given range, respectively.
[0009] As a further improvement of an embodiment of the present invention, the method further includes that the byte reversal and sequence reversal operations include: The byte reversal operation is to reverse each byte of the positive minimum and maximum IP binary arrays, and move each bit in the byte from high bit to low bit, and from low bit to high bit; The order reversal operation is to perform order reversal on the binary array after byte reversal to generate reverse binary representations of the minimum and maximum IP address ranges.
[0010] As a further improvement of an embodiment of the present invention, the method further includes that the "comparing with the preset legal forward and reverse minimum and maximum IP address ranges respectively" includes, Compare the forward binary representation of the IP address to be checked with the binary representations of the minimum and maximum forward IP addresses to determine whether the IP address to be checked is within the forward range; The reverse binary representation of the IP address to be checked is compared with the binary representations of the reverse minimum and maximum IP addresses to determine whether the IP to be checked is within the reverse range.
[0011] To achieve one of the above-mentioned purposes of the invention, an embodiment of the present invention provides an IPV6 legality verification device, the device comprising a conversion module and a judgment module; The conversion module is used to receive the IP address to be verified and convert it into forward and reverse binary forms, and compare them with the preset legal forward and reverse minimum and maximum IP address ranges respectively; The judgment module is used to determine that the IP address to be checked is legal when the IP address to be checked is within the preset legal forward and reverse minimum and maximum IP address ranges at the same time.
[0012] In order to achieve one of the above-mentioned purposes of the invention, an embodiment of the present invention also provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can be run on the processor, and when the program is executed on the processor, the steps in the above-mentioned IPV6 legitimacy verification method are implemented.
[0013] To achieve one of the above-mentioned purposes of the invention, an embodiment of the present invention further provides a storage medium, wherein the storage medium stores a computer program, and is characterized in that when the computer program is executed by a processor, the steps in the above-mentioned IPV6 legitimacy verification method are implemented.
[0014] Compared with the prior art, the present invention provides an IPV6 legality verification method and device, which can effectively improve the efficiency of IP address range verification by combining the bit operation of the front mask and the rear mask and adopting the technical method of bit-by-bit reversal of the binary byte array. In the processing of the IPV6 address, the traditional method needs to traverse all possible IP addresses, and the calculation complexity is high. However, the present invention uses forward and reverse calculations, and only uses mask bits and shift operations to quickly determine whether the IP address is within the range, which greatly reduces the amount of calculation. The present invention further enhances the accuracy of the algorithm by introducing reverse calculations, ensuring that all possible boundary conditions are processed, thereby avoiding the situation of missed detection. The application of the present invention in network security systems, especially in the fields of firewalls, intrusion detection and prevention systems, access control systems, etc., can maintain high efficiency when processing large-scale IP address data, and adapt to complex network environments and multiple mask combinations. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] Figure 1 It is an overall flow chart of the IPV6 legality verification method described in the present invention.
[0016] Figure 2 It is a specific flow chart of the IPV6 legality verification method described in the present invention.
[0017] Figure 3 It is a schematic diagram of the architecture of the IPV6 legality verification device described in the present invention. DETAILED DESCRIPTION
[0018] The present invention will be described in detail below in conjunction with the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, methodological, or functional changes made by a person skilled in the art based on these embodiments are all within the scope of protection of the present invention.
[0019] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.
[0020] In the first embodiment of the present invention, the present invention provides an IPV6 legality verification method, such as Figure 1 As shown, the method includes, S1: Receive the IP address to be verified and convert it into forward and reverse binary forms, and compare it with the preset legal forward and reverse minimum and maximum IP address ranges respectively; S2: When the IP address to be verified is within the preset legal forward and reverse minimum and maximum IP address ranges at the same time, the IP address to be verified is determined to be legal.
[0021] In a specific embodiment of the present invention, a legal IPV6 address preset by the system is obtained, and the preset legal minimum and maximum forward IP address range and the minimum and maximum reverse IP address range are calculated, including: Obtain the system preset legal IPV6 address by querying the configuration file, database, dynamic configuration interface or by manual input.
[0022] It should be noted that querying the configuration file: the system usually reads the predefined IPV6 address range from the configuration file. The configuration file may be stored in text format and contain details of the front mask and the back mask. Querying the database: In some complex systems, the predefined IPV6 address ranges may be stored in the database. The system queries the database to obtain these address ranges during initialization. Querying the dynamic configuration: The system can also obtain the allowed IPV6 address ranges through the dynamic configuration interface. These interfaces can be REST APIs, gRPC services, or other forms of network services. Manual input: In some cases, the system administrator can manually enter and update the IPV6 address range through the command line or graphical user interface. These address ranges are then recorded by the system and used for verification.
[0023] In a specific embodiment of the present invention, the preset legal forward minimum and maximum IP address ranges and reverse minimum and maximum IP address ranges are calculated, specifically, Convert the preset legal IPv6 address range into a 128-bit binary array; Processing the 128-bit binary array through forward and backward mask operations, calculating the minimum and maximum forward IP address ranges, and determining the binary representation of the legal IP address range; Perform byte-reversal and order-reversal operations on the forward minimum and maximum IP addresses to generate a binary representation of the reverse minimum and maximum IP address ranges.
[0024] It should be noted that the IPV6 address consists of 8 groups of hexadecimal digits, each group consists of 4 hexadecimal digits, representing a 16-bit binary number. Through the combination of the front mask and the back mask, we can determine the fixed part and the variable part within the IP address range. Among them, the front mask (Prefix Mask) indicates the fixed number of bits in the network part, that is, the fixed IP address prefix part, which is usually used to identify the network part of the address; the back mask (Suffix Mask) indicates the variable number of bits in the host part, that is, the variable IP address suffix part, which is used to distinguish different hosts in the same network.
[0025] In a specific embodiment of the present invention, the front and back mask operations are specifically, According to the front mask information, the fixed number of bits covered by the front mask in the IP address is determined, and the host part not covered by the front mask is set to the minimum value 0 or the maximum value 1, so as to form the binary representation of the possible minimum and maximum positive IP addresses in the IP address range; According to the post-mask information, the variable bits in the host part covered by the post-mask in the IP address are set to a minimum value of 0 or a maximum value of 1, and a binary representation of the possible reverse minimum and maximum IP addresses in the IP address range is generated; The minimum and maximum possible forward and reverse IPs in an IP address range represent the starting and ending boundaries of legal IP addresses in a given range, respectively.
[0026] It should be noted that the front mask operation determines the fixed number of bits in the IP address, fixes the network part, ensures the accuracy of the network prefix, and thus accurately divides all possible IP address boundaries within a given network range. The back mask operation generates accurate reverse IP address boundaries by processing the variable number of bits in the host part, ensuring accurate judgment of the IP address range in complex network configurations. The two-way calculation (forward and reverse) method covers all possible boundary conditions, especially when dealing with special masks and IP address layouts, ensuring that all IP address ranges are correctly checked. At the same time, the subnet range calculation combines the front mask and the back mask to completely define the legal IP address range of each subnet to avoid missing any boundary conditions.
[0027] In a specific embodiment of the present invention, the byte reversal and sequence reversal operations are specifically, The byte reversal operation is to reverse each byte of the positive minimum and maximum IP binary arrays, and move each bit in the byte from high bit to low bit, and from low bit to high bit; The order reversal operation is to perform order reversal on the binary array after byte reversal to generate reverse binary representations of the minimum and maximum IP address ranges.
[0028] It should be noted that the byte reversal operation effectively handles the complex situations that may arise in the IP address layout in certain network configurations by reversing each byte of the forward minimum and maximum IP binary arrays, shifting each bit in the byte from high to low and from low to high. The sequential reversal operation ensures that the reverse representation of the IP address can correctly reflect its actual range by sequentially reversing the binary array after byte reversal, and solves the byte order confusion problem that may be caused by the reversal operation. The combination of byte reversal and sequential reversal operations can generate a reverse binary representation of the minimum and maximum IP address ranges, which is particularly important for handling special mask combinations and asymmetric situations in IP address layout. Through reverse calculation, all possible IP address ranges can be fully covered, including those boundary conditions that may be missed in the forward calculation, ensuring the comprehensiveness and accuracy of IP address verification.
[0029] In a specific embodiment of the present invention, the comparison is made with the preset legal forward and reverse minimum and maximum IP address ranges, specifically, Compare the forward binary representation of the IP address to be checked with the binary representations of the minimum and maximum forward IP addresses to determine whether the IP address to be checked is within the forward range; The reverse binary representation of the IP address to be checked is compared with the binary representations of the reverse minimum and maximum IP addresses to determine whether the IP to be checked is within the reverse range.
[0030] In a specific implementation scenario of the present invention, Assume that the IPv6 addresses allowed by the system are as follows: C132:3BAA:334C:0000:0000:0000:AD32:4371 Front mask: 48 Back mask: 32 Generate a positive IP range: Forward Minimum IP Binary: 1100000100110010[48 zeros]10101101001100100100001101110001 Forward Max IP Binary: 1100000100110010[48 1s]10101101001100100100001101110001 Generate reverse IP range: Reverse Minimal IP Binary: 10001110110000100100110010110101[48 zeros]0100110010000011 Reverse Max IP Binary: 10001110110000100100110010110101[48 1s]0100110010000011 Assume that the IPV6 address to be verified is as follows: Address 1: A6DF:BC82:4C52:3244:13BD:12AC:3476:437F Address 2: C132:3BAA:334C:3211:32DA:1231:AD32:4372 Address three: C132:3BAA:334C:1326:AC21:431C:AD32:4371 Verification address 1: A6DF:BC82:4C52:3244:13BD:12AC:3476:437F Calculate the forward IP binary of address one: 10100110110111111011110010000010010010011000101001000110010001000001001110111101000100101010110000110100001101100100001101111111 Compare this binary to the positive minimum and maximum IP binary calculated above.
[0031] The result is: greater than the minimum positive IP binary and greater than the maximum positive binary.
[0032] Conclusion: Does not comply with the forward verification rules and verification fails.
[0033] Verification address 2: C132:3BAA:334C:3211:32DA:1231:AD32:4372 Calculate the forward IP binary of address two: 1100000100110010001110111010101000110011010011000011001000010001001100101101101000010010001100011010110100100100001101110010 Compare this binary to the positive minimum and maximum IP binary calculated above.
[0034] The result is: greater than the minimum positive IP binary and less than the maximum positive binary.
[0035] Conclusion: The forward verification rules are met and the reverse IP range needs to be verified.
[0036] Calculate the reverse IP binary of address two: 0100111011000010010011001011010110001100010010000101101101001100100010000100110010110001010101110111000100110010000011 Compare this binary to the reversed minimum and maximum IP binary calculated above.
[0037] The result is: greater than the reverse minimum IP binary and greater than the maximum reverse binary.
[0038] Conclusion: It complies with the forward verification rules, but does not comply with the reverse verification rules, so the verification fails.
[0039] Verification address three: C132:3BAA:334C:1326:AC21:431C:AD32:4371 Calculate the forward IP binary of address three: 1100000100110010001110111010101000110011010011000001001100100100110101011000010000101000011000111001010101100100100001101110001 Compare this binary to the positive minimum and maximum IP binary calculated above.
[0040] The result is: greater than the minimum positive IP binary and less than the maximum positive binary.
[0041] Conclusion: The forward verification rule is met and the reverse IP range needs to be verified.
[0042] Calculate the reverse IP binary of address three: 10001110110000100100110010110101001110001100001010000100001101010101100100110001010101110111000100110010000011 Compare this binary to the reversed minimum and maximum IP binary calculated above.
[0043] The result is: greater than the reverse minimum IP binary and less than the maximum reverse binary.
[0044] Conclusion: It complies with the forward verification rules and the reverse verification rules, and the verification is successful.
[0045] In the second embodiment of the present invention, the present invention provides an IPV6 legality verification device, the device comprising a conversion module 1 and a judgment module 2; The conversion module 1 is used to receive the IP address to be verified and convert it into forward and reverse binary forms, and compare them with the preset legal forward and reverse minimum and maximum IP address ranges respectively; The judgment module 2 is used to determine that the IP address to be checked is legal when the IP address to be checked is within the preset legal forward and reverse minimum and maximum IP address ranges at the same time.
[0046] In the third embodiment of the present invention, the present invention provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can be run on the processor, and when the program is executed on the processor, the steps in the above-mentioned IPV6 legitimacy verification method are implemented.
[0047] In a fourth embodiment of the present invention, the present invention provides a storage medium storing a computer program, wherein the computer program implements the steps in the above-mentioned IPV6 legitimacy verification method when executed by a processor.
[0048] In summary, the IPV6 legality verification method and device provided by the present invention can effectively improve the efficiency of IP address range verification by combining the bit operation of the front mask and the rear mask and adopting the technical method of bit-by-bit reversal of the binary byte array. In the processing process of the IPV6 address, the traditional method needs to traverse all possible IP addresses, and the calculation complexity is high. However, the present invention uses forward and reverse calculations, and only uses mask bits and shift operations to quickly determine whether the IP address is within the range, which greatly reduces the amount of calculation. The present invention further enhances the accuracy of the algorithm by introducing reverse calculations, ensuring that all possible boundary conditions are processed, thereby avoiding the situation of missed detection. The application of the present invention in network security systems, especially in the fields of firewalls, intrusion detection and defense systems, access control systems, etc., can maintain high efficiency when processing large-scale IP address data, and adapt to complex network environments and multiple mask combinations.
[0049] It should be understood that although this specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each implementation mode may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.
[0050] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the modules described above can refer to the corresponding process in the aforementioned method implementation, and will not be repeated here.
[0051] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present implementation scheme.
[0052] In addition, each functional module in each embodiment of the present application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of hardware plus software functional modules.
[0053] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for a computer system (which can be a personal computer, a server, or a network system, etc.) or a processor to perform some steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.
[0054] Finally, it should be noted that the above implementation modes are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned implementation modes, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned implementation modes, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various implementation modes of the present application.
Claims
1. An IPV6 legality verification method, characterized in that: include, The received IP address to be verified is converted into forward and reverse binary forms, and compared with the preset legal forward and reverse minimum and maximum IP address ranges respectively; When the IP address to be checked is within the preset legal forward and reverse minimum and maximum IP address ranges at the same time, the IP address to be checked is determined to be legal.
2. The IPV6 legality verification method according to claim 1, characterized in that: Also includes, Get the legal IPV6 addresses preset by the system, calculate the preset legal minimum and maximum forward IP address ranges and the minimum and maximum reverse IP address ranges, including, Obtain the system preset legal IPV6 address by querying the configuration file, database, dynamic configuration interface or by manual input.
3. The IPV6 legality verification method according to claim 2, characterized in that: The calculation of the preset legal forward minimum and maximum IP address ranges and reverse minimum and maximum IP address ranges includes: Convert the preset legal IPv6 address range into a 128-bit binary array; Processing the 128-bit binary array through forward and backward mask operations, calculating the minimum and maximum forward IP address ranges, and determining the binary representation of the legal IP address range; Perform byte-reversal and order-reversal operations on the forward minimum and maximum IP addresses to generate a binary representation of the reverse minimum and maximum IP address ranges.
4. The IPV6 legality verification method according to claim 3, characterized in that: The front and back mask operations include: According to the front mask information, the fixed number of bits covered by the front mask in the IP address is determined, and the host part not covered by the front mask is set to the minimum value 0 or the maximum value 1, so as to form the binary representation of the possible minimum and maximum positive IP addresses in the IP address range; According to the post-mask information, the variable bits in the host part covered by the post-mask in the IP address are set to a minimum value of 0 or a maximum value of 1, and a binary representation of the possible reverse minimum and maximum IP addresses in the IP address range is generated; The minimum and maximum possible forward and reverse IPs in an IP address range represent the starting and ending boundaries of legal IP addresses in a given range, respectively.
5. The IPV6 legality verification method according to claim 4, characterized in that: The byte reversal and sequence reversal operations include, The byte reversal operation is to reverse each byte of the positive minimum and maximum IP binary arrays, and move each bit in the byte from high bit to low bit, and from low bit to high bit; The order reversal operation is to perform order reversal on the binary array after byte reversal to generate reverse binary representations of the minimum and maximum IP address ranges.
6. The IPV6 legality verification method according to claim 5, characterized in that: The "comparison with the preset legal forward and reverse minimum and maximum IP address ranges respectively" includes: Compare the forward binary representation of the IP address to be checked with the binary representations of the minimum and maximum forward IP addresses to determine whether the IP address to be checked is within the forward range; The reverse binary representation of the IP address to be checked is compared with the binary representations of the reverse minimum and maximum IP addresses to determine whether the IP to be checked is within the reverse range.
7. An IPV6 legality verification device, characterized in that: Includes a conversion module and a judgment module; The conversion module is used to receive the IP address to be verified and convert it into forward and reverse binary forms, and compare them with the preset legal forward and reverse minimum and maximum IP address ranges respectively; The judgment module is used to determine that the IP address to be checked is legal when the IP address to be checked is within the preset legal forward and reverse minimum and maximum IP address ranges at the same time.
8. An electronic device, comprising a memory and a processor, characterized in that: The memory stores a computer program that can be run on the processor, and when the program is executed on the processor, the steps in the IPV6 legitimacy verification method as described in any one of claims 1-6 are implemented.
9. A storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, the steps in the IPV6 legitimacy verification method as described in any one of claims 1-6 are implemented.