Multi-dimensional identification system-oriented equipment identification analysis method

Abstract

The invention discloses an equipment identification analysis method for a multi-dimensional identification system, relates to the technical field of computer network communication, and effectively prevents spoofing attacks through an encryption authentication mechanism to ensure the safety and credibility of identification analysis. Mapping of multi-dimensional attributes such as equipment identification (DID) and service identification (SID) is supported, and adaptability and flexibility of identification analysis are enhanced. By combining the dynamic table, the static table and the proxy analysis strategy, efficient cache management is realized, so that the influence of the broadcast request on the network performance is reduced, and the overall analysis efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network communication, and particularly to a device identification resolution method for a multi-dimensional identification system. Background Art

[0002] Currently, the resolution of network device identification mainly relies on traditional protocols. Its core mechanism is to implement the mapping from IP address to MAC address through broadcast requests. However, with the popularization of multi-dimensional identification networks, traditional technologies have the following problems: the traditional protocol design is based on fixed fields and does not reserve extended fields to support multi-dimensional identification attributes; the security mechanism is lacking and cannot verify the authenticity of the message source; the separation between the dynamic table and the static table is insufficient, and there is a lack of a hybrid caching strategy, resulting in low communication efficiency across network segments.

[0003] Currently, the technology for resolving network device identification mainly relies on traditional protocols such as ARP and NDP, which have significant limitations. The protocol architecture is rigid, and the fixed message format cannot be extended for multi-dimensional identification; the lack of an identity authentication mechanism leads to risks of man-in-the-middle attacks and DDoS floods; the fragmentation of static and dynamic entries causes a sharp increase in cross-network segment communication latency and inefficient caching strategies; at the same time, it is difficult to adapt to scenarios such as 5G mobile roaming and massive access in the Internet of Things, resulting in high energy consumption and communication bottlenecks, restricting the development of new networks such as industrial Internet and vehicle Internet. Summary of the Invention

[0004] Aiming at the limitations of the traditional ARP protocol in the multi-dimensional identification network, such as insufficient applicability caused by single-dimensional mapping, potential attack risks brought by security vulnerabilities, and low efficiency of the broadcast mechanism, the present invention proposes a device identification resolution method for a multi-dimensional identification system. The aim is to improve the security, compatibility, and efficiency of identification resolution. An encryption authentication mechanism is used to effectively prevent spoofing attacks and ensure the security and credibility of identification resolution. By supporting the mapping of multi-dimensional attributes such as device identification (DID) and service identification (SID), the adaptability and flexibility of identification resolution are enhanced. By combining dynamic tables, static tables, and proxy resolution strategies, efficient cache management is achieved, thereby reducing the impact of broadcast requests on network performance and improving the overall resolution efficiency.

[0005] A device identification resolution method for a multi-dimensional identification system uses the DIR protocol for device identification resolution. In a local area network, the device identification DID is resolved into a MAC address, enabling the device to find the hardware address of the target device in the local network, thereby transmitting data frames. This method includes the following key steps: Designing protocol messages by extending traditional ARP fields to support multi-dimensional identification and security authentication, forming a message field with a destination MAC address, a source MAC address, and protocol-related data; Establishing an interaction process engine based on an encrypted signature request and response mechanism, and implementing DIR protocol device data transmission based on the mapping of DID and MAC through this interaction process engine; Establishing a hybrid cache management of a dynamic table, a static table, and a proxy table, storing and updating the DIR protocol during data transmission, and at the same time establishing an anomaly detection mechanism to monitor that the DIR protocol is not tampered with or attacked.

[0006] Further, the message field of the protocol message design sequentially includes a destination MAC address DST, a source MAC address SRC, length or type, hardware type, protocol type, hardware size, protocol size, operation code Op, the sender's hardware address, the sender's protocol address, the destination hardware address, the destination protocol address, encryption and authentication, padding, and frame check sequence FCS.

[0007] Further, in the protocol message design, the protocol type is used to indicate the type of the mapped protocol address, that is, the upper-layer network type. For the multi-dimensional identification system, this value is 1. If it is an IP system, this value is 2; Encryption and authentication are based on the public key signature of the DID and are used to verify the authenticity of the DIR message; The packet sequence number is used in the multi-stream transmission scenario to support multi-path communication of the same DID.

[0008] Further, the interaction process engine includes the following steps: Step 1: DIR request encryption and broadcast. When device 1 needs to resolve the MAC address of device 2, it first queries the local DIR cache table. If it hits, device 1 transmits data to device 2; If it does not hit, a DIR request message is generated, the content of the message is hashed, and a digital signature is generated by encrypting it with the private key of device 1. Immediately afterwards, a broadcast frame is encapsulated and sent to the local area network; Step 2: DIR response verification and unicast. After receiving the request, device 2 decrypts the hash value with the public key of device 1 to verify the signature and compares the integrity of the message; If the verification fails, the datagram is discarded and no response is made; If the verification passes, the DID-MAC mapping of device 1 is stored in the dynamic table, and a message containing the DID, MAC, and digital signature of device 2 is unicast in response; Step 3: Cache update and data communication: After receiving the response, device 1 verifies the signature of device 2. If the verification is successful, the dynamic DIR cache table is updated, and the cache address is directly used for subsequent communication. If the verification fails, the message is discarded and a security warning is triggered.

[0009] Further, the hybrid cache management includes the following contents: The dynamic DIR table is stored in the device's memory, automatically generated during DIR interactions, and automatically deleted when the time-to-live (TTL) expires. It supports fast topology updates in high-density device scenarios. The static DIR table is stored in the device's memory, manually configured by the administrator to prevent malicious tampering and does not expire automatically. The proxy DIR table is stored in the memory of the router or gateway device that configures the proxy DIR. It is used to record the mapping relationship between the DID and MAC of devices across network segments, enabling devices in different subnets to communicate without global broadcasting.

[0010] The beneficial effects achieved by the present invention are as follows: (1) Through the public key signature technology based on DID, the present invention encrypts and authenticates DIR request / response messages. Compared with the traditional ARP protocol, it can effectively prevent man-in-the-middle attacks and DIR spoofing, significantly improving the credibility and data integrity of network communication.

[0011] (2) Traditional protocols only support one-dimensional IP-MAC mapping, while the extended protocol fields of the present invention are compatible with multi-dimensional information such as device types and service attributes. Through multi-dimensional identifier combination addressing, it can achieve precise matching of complex task requirements and is applicable to dynamic interconnection scenarios of a large number of heterogeneous devices.

[0012] (3) Through the dynamic table, static table, and proxy parsing mechanism, the DIR cache hit rate is improved, broadcast requests are significantly reduced, and network congestion is effectively alleviated. For example, in an industrial automation system, the static table can fix the mapping relationship of key devices, avoiding communication interruptions caused by the expiration of dynamic table entries. Through the proxy DIR mechanism, it supports the resolution of devices across VLANs and subnets, enabling cross-domain communication without global broadcasting.

[0013] (4) The present invention is applicable to fields such as industrial Internet with high security requirements, interconnection of high-density heterogeneous Internet of Things devices, and multi-domain collaborative smart city networks. It provides efficient and reliable underlying communication guarantee for complex real-time tasks and has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a schematic diagram of the DIR protocol message format fields in the embodiments of the present invention.

[0015] Figure 2 It is a schematic diagram of the interaction process in the embodiments of the present invention.

[0016] Figure 3 It is the DIR cache table in the embodiments of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0017] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings of the specification.

[0018] The Device Identity Resolution (DIR) protocol of the present invention provides a mapping relationship between device identifiers (DIDs) and hardware MAC addresses in a local area network, ensuring that a device can find the hardware address of a target device in the local network, thereby enabling the transmission of data frames. The core architecture of the present invention includes three key parts: a protocol message design that extends the traditional Address Resolution Protocol (ARP) field to support multi-dimensional identifiers and security authentication; an interaction process engine based on an encrypted signature request and response mechanism; and a hybrid cache management with dynamic tables, static tables, and proxy tables.

[0019] The protocol message design of the DIR protocol of the present invention is as Figure 1 shown, and the more core parts are: Among them, the message field format is shown in Figure 1, and it is divided into fifteen fields: Destination MAC Address (DST), Source MAC Address (SRC), Length or Type, Hardware Type, Protocol Type, Hardware Size, Protocol Size, Op (Operation Code), Sender's Hardware Address, Sender's Protocol Address, Destination Hardware Address, Destination Protocol Address, Encryption and Authentication, Padding, and FCS.

[0020] DST: The Destination MAC Address field is used to specify the recipient of the Ethernet frame. It is a broadcast address when sending a DIR request. When the frame is transmitted in the local area network, network devices will check the value of this field to decide whether to process the frame. For example, if a device's MAC address matches the value in the DST field, it will receive and process the frame; otherwise, it will ignore the frame.

[0021] SRC: The Source MAC Address field is used to indicate the MAC address of the device that sends the Ethernet frame.

[0022] Length or Type: If the value of the field is between 0 and 1500, it represents the length of the frame payload in bytes. If the value of the field is 1536 (0x0600) or above, it represents the protocol type of the data in the frame. This field type is divided into four categories: ① ether_type$XEROX_PUP, ② ether_type$DOD_INTERNET, ③ ether_type$CHAOS, ④ ether_type$ADDRESS_RESOLUTION. When the field is of the fourth type, it means that the MAC contains a DIR request packet.

[0023] Hardware type: Indicates the hardware address type, i.e., the network type at the data link layer. For Ethernet, this value is 1.

[0024] Protocol type: Indicates the mapped protocol address type, i.e., the upper-layer network type. For the multi-dimensional identification system, this value is 1, and for the IP system, this value is 2.

[0025] Hardware size: Indicates the number of bytes of the hardware address. It represents the length of the host address identifier corresponding to the hardware type in bytes. For Ethernet, the hardware address is the MAC address, and this value is 6.

[0026] Protocol size: Indicates the number of bytes of the protocol address. It identifies the length of the address identifier of the upper-layer protocol in bytes. For the multi-dimensional identification system, the protocol address is the device identifier in the multi-dimensional identification system, and this value is 16.

[0027] Op: Indicates that this operation is a DIR request (value is 1), DIR response (value is 2). Since the length type fields of DIR requests and responses are the same, this field is required.

[0028] Sender's hardware address, sender's protocol address, destination hardware address, destination protocol address: For a DIR request, except for the destination hardware address (set to 0), all other fields need to be filled. When a system receives a DIR request, it fills in its own hardware address, swaps the two sender addresses and the two receiver addresses, sets the Op field to 2, and then sends the generated response.

[0029] Encryption and authentication: Can use DID-based public key signatures to verify the authenticity of DIR messages.

[0030] Padding: Makes the length of the message meet the minimum length requirement of the Ethernet frame.

[0031] FCS: Frame Check Sequence, used to detect whether errors occur during frame transmission.

[0032] The role of the protocol type is to indicate the mapped protocol address type, i.e., the upper-layer network type. For the multi-dimensional identification system, this value is 1, and for the IP system, this value is 2; the role of encryption and authentication is that it can use DID-based public key signatures to verify the authenticity of DIR messages; the role of the packet sequence number is for multi-stream transmission scenarios, supporting multi-path communication for the same DID.

[0033] The following is the core interaction process for the mapping between the device identifier DID and the MAC address. Refer to Figure 2 : Step 1: Encryption and Broadcasting of DIR Requests. When Device A needs to resolve the MAC address of Device C, it first queries the local DIR cache table (including dynamic and static tables). If a hit occurs, Device A can transmit data to Device C. If not, a DIR request message is generated, the content of the message is hashed, and a digital signature is generated by encrypting it with the private key of Device A. Then, a broadcast frame is encapsulated and sent to the local area network. All devices in the local area network receive this frame and check whether the destination DID is the same as their own. If it is the same, proceed to Step 2; if not, discard the frame without performing other operations.

[0034] Step 2: Verification and Unicast of DIR Responses. After receiving the request, Device C uses the public key of Device A to decrypt the hash value to verify the signature and compare the integrity of the message. If the verification fails, discard the datagram without any response. If the verification passes, store the DID-MAC mapping of Device A in the dynamic table and unicast a response message containing the DID, MAC, and digital signature of Device C.

[0035] Step 3: Cache Update and Data Communication. After receiving the response, Device A verifies the signature of Device C. If the verification is successful, update the dynamic DIR cache table, and directly use the cached address for subsequent communication. If the verification fails, discard the message and trigger a security warning.

[0036] Hybrid Cache Management, each entry is as Figure 3 shown: (1) The dynamic DIR table is stored in the memory of the device, automatically generated during DIR interaction, and automatically deleted when the time-to-live (TTL) expires, supporting fast topology updates in high-density device scenarios.

[0037] (2) The static DIR table is stored in the memory of the device, but is manually configured by the administrator to prevent malicious tampering and does not expire automatically.

[0038] (3) The proxy DIR table is stored in the memory of the router or gateway device configured with the proxy DIR, used to record the DID-MAC mapping relationships of devices across network segments, enabling devices in different subnets to communicate without global broadcasting, reducing network load and improving efficiency.

[0039] The following gives a specific application process of the method in this embodiment: S1, Deployment of the running environment of the Data Plane Development Kit (DPDK). The following is the main process of device initialization.

[0040] S11, Loading of hardware drivers, loading the user-space I / O driver (UIO) and binding the network card; S12, Initialization of DPDK, the host CPU calls a function to initialize the DPDK running environment; S13, Call a function to configure the port; S14, Call the queue_setup() function to create receive and send queues; S2, Generate and sign a DIR request, construct a DIR request message, and ensure its security through encryption authentication.

[0041] S21, Generate a message in the format as Figure 1 shown, set the protocol type field to 0xA001 to indicate that the current protocol is a multi-dimensional identification system; initialize the target DID field to be empty and wait for the response to fill it, etc.

[0042] S22, Calculate the hash and generate a signature for the message. Use an algorithm to calculate the hash value of the message content to generate a fixed-length digest, encrypt the hash value with the device's private key to generate a digital signature, and append it to the end of the message.

[0043] S23, Broadcast and send the message. Set the target MAC address to the broadcast address and broadcast the request to the local area network through the bulk send interface of DPDK.

[0044] S3, Receive and verify the DIR response, verify the legality of the response message, and update the local cache table.

[0045] S31, Parse the message. Extract the response message from the receive queue and parse the source DID, MAC address, and signature fields.

[0046] S32, Verify the signature. Decrypt the signature with the sender's public key to obtain the original hash value, recalculate the hash value of the message content, and compare it with the decryption result. If they are the same, it is determined that the message has not been tampered with and the source is trusted.

[0047] S33, Update the cache table. Store the legal DID-MAC mapping relationship in the DIR cache table (including the dynamic table and the static table), and set the survival time.

[0048] S4, Security guarantee and exception handling.

[0049] S41, Anomaly detection mechanism. When the DIR response signature verification fails 3 times in a row, it is determined as a potential attack and device isolation is triggered. When it is detected that a write operation is performed on the static DIR table, the administrator needs to perform identity verification through a password after obtaining system authorization, only allow operations to configure static table entries through encrypted APIs to prohibit direct modification of memory or configuration files, and attach the administrator's digital signature to each static table entry. When the system loads, verify the validity of the signature. Through the above three mechanisms, it is a legal write. If it fails to pass the verification mechanism, it is determined as an illegal write attempt and recorded as a high-risk security event.

[0050] S5, Perform data transmission S51, When device A already has the DID and MAC of device C, the data frame sent by device A to C can use the correct hardware address of device C to locate the interface of device C, and then complete the accurate transmission of data to the destination.

[0051] The above are only the preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. Any equivalent modifications or changes made by those of ordinary skill in the art according to the disclosed content of the present invention shall be included in the protection scope recorded in the claims.

Claims

1. A device identification and resolution method for a multi-dimensional identification system, characterized in that: This method uses the device identification and resolution DIR protocol to resolve the device identification DID into a MAC address in a local area network, enabling the device to find the hardware address of the target device in the local network, thereby transmitting data frames; This method includes the following key steps: expanding the traditional ARP field to support the protocol message design of multi-dimensional identification and security authentication, forming a message field with the target MAC address, source MAC address, and protocol-related data; Establish an interactive process engine based on the request and response mechanism of encrypted signatures, and implement the DIR protocol device data transmission based on the DID and MAC mapping through this interactive process engine; Establish a hybrid cache management of dynamic tables, static tables, and proxy tables, perform DIR protocol storage and update during data transmission, and at the same time establish an anomaly detection mechanism to monitor that the DIR protocol is not tampered with or attacked.

2. The device identification and resolution method for a multi-dimensional identification system according to claim 1, characterized in that: The message field of the protocol message design sequentially includes the target MAC address DST, source MAC address SRC, length or type, hardware type, protocol type, hardware size, protocol size, operation code Op, sender's hardware address, sender's protocol address, destination hardware address, destination protocol address, encryption and authentication, padding, frame check sequence FCS.

3. The device identification and resolution method for a multi-dimensional identification system according to claim 2, characterized in that: In the protocol message design described above, the protocol type is used to indicate the type of the mapped protocol address, that is, the upper-layer network type. For a multi-dimensional identification system, this value is 1. If it is an IP system, this value is 2; encryption and authentication are used for public key signature based on DID to verify the authenticity of the DIR message; the packet sequence number is used in the multi-stream transmission scenario to support multi-path communication of the same DID.

4. The device identification and resolution method for a multi-dimensional identification system according to claim 1, characterized in that: The interactive process engine includes the following steps: Step 1: DIR request encryption and broadcast. When device 1 needs to resolve the MAC address of device 2, it first queries the local DIR cache table. If it hits, device 1 transmits data to device 2; if it misses, a DIR request message is generated, the content of the message is hashed, and a digital signature is generated by encrypting with the private key of device 1. Then, a broadcast frame is encapsulated and sent to the local area network; Step 2: DIR response verification and unicast. After receiving the request, device 2 decrypts the hash value with the public key of device 1 to verify the signature and compare the integrity of the message; if the verification fails, the data packet is discarded and no response is made; if the verification passes, the DID-MAC mapping of device 1 is stored in the dynamic table, and a unicast response message containing the DID, MAC, and digital signature of device 2 is sent; Step 3: Cache update and data communication: After receiving the response, device 1 verifies the signature of device 2. If the verification is successful, the dynamic DIR cache table is updated, and the cached address is directly used for subsequent communication. If the verification fails, the message is discarded and a security warning is triggered.

5. The device identification resolution method for a multi-dimensional identification system according to claim 1, characterized in that: The hybrid cache management includes the following contents: The dynamic DIR table is stored in the device's memory, automatically generated during DIR interaction, and automatically deleted when the time to live TTL expires, supporting fast topology update in high-density device scenarios; The static DIR table is stored in the device's memory, manually configured by the administrator to prevent malicious tampering and does not expire automatically; The proxy DIR table is stored in the memory of the router or gateway device that configures the proxy DIR, and is used to record the mapping relationship between the DID and MAC of devices across network segments, enabling devices in different subnets to communicate without global broadcasting.

Images