Networking method and system based on dynamic IPv6 address

Abstract

The invention discloses a networking method and system based on a dynamic IPv6 (Internet Protocol Version 6) address, the system comprises terminal equipment and a VPN (Virtual Private Network) gateway, and the terminal equipment accesses a network through the VPN gateway. The IPv6 address of the VPN gateway is dynamically changed by utilizing the infinity advantage of the IPv6 address (if the IPv4 address of the public network is sufficient, the IPv6 address is also applicable), the network asset exposure surface can be effectively relieved, and the possibility of being attacked is reduced.

Description

Technical Field

[0001] The present invention relates to the field of networking technology, in particular to a networking method and system based on dynamic IPv6 addresses. Background Art

[0002] IPv6 (Internet Protocol Version 6) is the abbreviation of Internet Protocol Version 6. It is the next-generation IP protocol designed by the Internet Engineering Task Force (IETF) to replace IPv4. One of its biggest advantages is the number of addresses, which is said to be enough to encode an address for every grain of sand in the world.

[0003] A VPN (Virtual Private Network) establishes a private network over a public network for encrypted communications. It is widely used in enterprise networks. VPN gateways enable remote access by encrypting data packets and translating their destination addresses.

[0004] However, the existing method of using VPN gateway for networking has the following problems: 1. Equipment exposure risk‌ VPN gateways exposed to the public internet are vulnerable to brute force attacks. Attackers can scan the VPN gateway system's services and exploit vulnerabilities, security vulnerabilities, weak passwords, or default credentials. For example, devices with updated firmware may contain known vulnerabilities (such as CVE-identified vulnerabilities) that can be exploited by hackers. Hackers can also launch DDoS attacks, preventing the VPN gateway from providing normal services. 2. Key negotiation vulnerability‌ If a strong encryption algorithm (such as AES-256) is not configured correctly, it may be attacked by a man-in-the-middle attack or brute force, resulting in key leakage. In addition, the long-term fixed key of the Security Association (SA) is vulnerable to replay attacks. 3. Tunnel hijacking risk The risk is particularly high when attackers intercept communication traffic (such as banking transactions), tamper with data, or steal credentials, especially when the transmission is unencrypted. Summary of the Invention

[0005] To this end, the technical problem to be solved by the present invention is to provide a networking method and system based on dynamic IPv6 addresses, which takes advantage of the unlimited nature of IPv6 addresses and dynamically changes the VPN gateway IPv6 address (also applicable if there are sufficient public IPv4 addresses), which can effectively alleviate the exposure of network assets and reduce the possibility of attacks.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: A networking method based on dynamic IPv6 addresses comprises the following steps: 1) Pre-shared information is pre-set in the VPN gateway and the terminal device, and the VPN gateway IPv6 address prefix Part 0 is pre-set in the terminal device. The VPN gateway IPv6 address prefix Part 0 is 64 bits. S2) In the time window T k The VPN gateway first uses the NTP service to synchronize time, and then uses the standard time source Time1 and pre-shared information as input parameters to use the hash function to calculate the 64-bit VPN gateway IPv6 address suffix Part k , and change the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k Combined into the VPN gateway IPv6 address Address k , the VPN gateway will k Replace the old VPN gateway address k-1 The new VPN gateway address, k is a natural number greater than or equal to 1; S3) In the time window T k The terminal device uses the standard time source Time2 and pre-shared information as input parameters to calculate the 64-bit VPN gateway IPv6 address suffix Part using a hash function. k,n , and change the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k,n Combined into the VPN gateway IPv6 address Address k,m , n is a natural number greater than or equal to 3, m is a natural number greater than or equal to 2; S4) In the time window T k In the terminal device, the address is used at the same time k-1 and Address k,m Access the VPN gateway, when Address k,m and Address k If the same, the VPN gateway returns the address k,m Otherwise, the VPN gateway only returns the data packet containing Address k-1 The data packet, then go to the next step; S5) The terminal device uses the NTP service to synchronize time, and then repeats steps S3) and S4) until the terminal device uses Address k,m Successfully access the VPN gateway, that is, complete the network, use Address k,m After the network is established, the terminal device is 过渡 Address k and Addressk-1 Access the VPN gateway and disable Address k-1 , time t 过渡 The duration is a custom duration.

[0007] In the above-mentioned networking method based on dynamic IPv6 addresses, the pre-shared information is one or more of a symmetric key, a TPM key fingerprint, or device ID information. The pre-shared information is non-public information, i.e., information that is not publicly available on the public network.

[0008] In the above networking method based on dynamic IPv6 address, in step S2), the VPN gateway obtains the VPN gateway IPv6 address Address k Then set the VPN gateway IPv6 address to k Configure to the network interface.

[0009] In the above networking method based on dynamic IPv6 addresses, after the terminal device completes the initial networking, the VPN gateway generates a new VPN gateway address and signs and publishes the new address and sends the signature information to the terminal device, which decrypts and verifies the signature information to confirm the use of the address. k,m Access the Address in the success message k,m The new VPN gateway address generated for the VPN gateway.

[0010] In the above networking method based on dynamic IPv6 address, in step S4), if k Address cannot be used k,m If the VPN gateway is successfully accessed, the terminal device is prohibited from accessing the VPN gateway within the time window T. k At the end of the time window T k+1 Use Address during the period between the start time k-1 Access the VPN gateway and allow the terminal device to k+1 Re-establish a connection with the VPN gateway within 1 second; where k is a natural number greater than or equal to 1.

[0011] The above networking method based on dynamic IPv6 address, in the time window T k In the VPN gateway, use Address k and Address k-1 Provide services.

[0012] A system for networking using the above-mentioned networking method based on dynamic IPv6 addresses includes a terminal device and a VPN gateway, wherein the terminal device accesses the network through the VPN gateway; both the terminal device and the VPN gateway are provided with a time synchronization module and an address calculation module.

[0013] In the above system, the VPN gateway is further provided with an address configuration module for dynamically adding or removing the interface IPv6 address.

[0014] In the above system, the terminal device is further provided with a signature verification module for verifying the legitimacy of the new VPN gateway address issued by the VPN gateway.

[0015] The above system, VPN gateway and terminal device are also respectively provided with a VPN connection control module.

[0016] The technical solution of the present invention achieves the following beneficial technical effects: 1. This invention binds the IPv6 address space to time to form a dynamic, distributed, peer-to-peer negotiated hidden communication mechanism, effectively reducing the detectability of network nodes and the exposure of attack surfaces. It is particularly suitable for communication systems with extremely high requirements for security and predictability, such as government affairs, military industry, and the Internet of Things.

[0017] 2. This solution effectively adapts to the Zero Trust architecture, extending the "never trust, continuously verify" philosophy to network-layer IP connections. This ensures connection security from the outset, effectively mitigating the possibility of hacker attacks and addressing the potential risks of exposing VPN gateways to the public network in scenarios such as remote office access and corporate branch interconnection. Combined with solutions like digital certificate verification and SPA first-packet verification, this solution effectively addresses the challenges of sophisticated hackers and lagging user defense solutions, including insecure security and delayed upgrades and optimizations.

[0018] 3. The terminal device can calculate the current address of the VPN gateway locally based on the current time window, without the need for the terminal to obtain the VPN gateway IP address information through DNS queries, multicast queries, etc. The VPN gateway interface allows the simultaneous binding of multiple dynamically calculated IPv6 addresses, supporting multi-address monitoring and connection switching in conjunction with VPN applications.

[0019] 4. Supports smooth address rollover, ensuring uninterrupted VPN sessions and improving system stability through the "old address retention + new address pre-binding" mechanism. Optional extensions include: digitally signing address generation results to prevent man-in-the-middle attacks; and using quantum-resistant encryption algorithms to ensure future security. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a working principle diagram of the networking system based on dynamic IPv6 addresses in the present invention; Figure 2 This is a flow chart of the networking based on dynamic IPv6 addresses in the present invention. DETAILED DESCRIPTION

[0021] The present invention is further described below with reference to examples.

[0022] like Figure 1 As shown, the networking system based on dynamic IPv6 addresses in the present invention includes a terminal device and a VPN gateway, and the terminal device accesses the network through the VPN gateway. In the present invention, the VPN gateway is provided with a time synchronization module, an address calculation module, an address configuration module, and a VPN connection control module, and the terminal device is provided with a time synchronization module, an address calculation module, a signature verification module, and a VPN connection control module. The VPN connection control module in the terminal device supports multiple address attempts and connection status determination, the VPN connection control module in the VPN gateway supports binding multiple IPv6 addresses and monitoring VPN connections, and the address configuration module can realize the function of dynamically adding / removing interface IPv6 addresses.

[0023] In this embodiment, the example of networking using a VPN gateway and terminal devices is used for illustration. The terminal devices include computers, servers, and mobile phones. The specific steps for connecting multiple terminal devices using a VPN gateway to form an interconnected network are as follows: S1) pre-shared information is pre-set in the VPN gateway and the terminal device, and the VPN gateway IPv6 address prefix Part 0 is pre-set in the terminal device. The VPN gateway IPv6 address prefix Part 0 is 64 bits. The pre-shared information is one or more of a symmetric key, a TPM key fingerprint, or device ID information. S2) In the time window T k The VPN gateway first uses the NTP service to synchronize time, and then uses the standard time source Time1 and pre-shared information as input parameters to use the hash function to calculate the 64-bit VPN gateway IPv6 address suffix Part k , and change the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k Combined into the VPN gateway IPv6 address Address k , the VPN gateway will k Replace the old VPN gateway address k-1 The new VPN gateway address, k is a natural number greater than or equal to 1; S3) In the time window T k The terminal device uses the standard time source Time2 and pre-shared information as input parameters to calculate the 64-bit VPN gateway IPv6 address suffix Part using a hash function. k,n , and change the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k,n Combined into the VPN gateway IPv6 address Addressk,m , n is a natural number greater than or equal to 3, m is a natural number greater than or equal to 2; S4) In the time window T k In the terminal device, the address is used at the same time k-1 and Address k,m Access the VPN gateway, when Address k,m and Address k If the same, the VPN gateway returns the address k,m Otherwise, the VPN gateway only returns the data packet containing Address k-1 Then go to the next step; the terminal device receives the data packet returned by the VPN gateway and contains the Address k,m If the terminal device receives only the packet containing the Address returned by the VPN gateway, the terminal device can determine that the predicted VPN gateway address is correct. k-1 If the terminal device receives a packet of data, it can determine that the predicted VPN gateway address is wrong, that is, the terminal device needs to re-predict the VPN gateway address in the time window T k The new address generated in S5) The terminal device synchronizes time with the VPN gateway, and then repeats steps S3) and S4) until the terminal device uses Address k,m Successfully access the VPN gateway, that is, complete the network, use Address k,m After completing the network, disable Address k-1 .

[0024] In steps S2) and S3), the time window length is a constant T, for example, 600 seconds. The VPN gateway's standard time source Time1 and the terminal device's standard time source Time2 are calibrated and synchronized using the NTP service, and the current time window number is calculated: t = floor(current_utc_time / T) After the VPN gateway and the terminal device are synchronized, Time1 and Time2 should be the same, and the current time window number T can be used. k It is used as a standard time source and as a dynamic input for the VPN gateway address generation function, while the pre-shared information is used to form the VPN uniqueness input, improving the uniqueness and unpredictability of the VPN gateway address.

[0025] In step S2) and step S3), the address calculation module in the VPN gateway and the address calculation module in the terminal device complete the calculation of the VPN gateway IPv6 address suffix through the following steps: session_key = HMAC(PSI, t) / / SHA-3, BLAKE3 optional ipv6_suffix = Truncate(Hash(session_key), 64 bits) When entering a new time window Tk+1, and after the VPN gateway completes the calculation and splicing of the new VPN gateway address, the VPN gateway configures the network interface with the new VPN gateway address corresponding to the time window through the following command: ip -6 addr add 2001:db8:abcd:: <suffix>dev eth0 At the same time, the time window T k The old VPN gateway address used in the time window T is not removed yet. k+1 Continue to use it until the time window T k+ 1 is removed after completion, creating a smooth transition zone. The VPN gateway monitors all currently active addresses through the VPN connection control module to ensure seamless connection switching for end devices. This operation can be automated through scripts, scheduled tasks, or daemons.

[0026] During networking, the terminal device does not need to obtain any data about the VPN gateway's IPv6 address suffix from the VPN gateway. Instead, it calculates the VPN gateway's IPv6 address locally based on the time window and pre-shared information, and uses the calculated IPv6 address to attempt a connection. The specific connection attempt process is as follows: Time synchronization (error control <1s) / / Taking into account network delays, etc., this error tolerance can be avoided by the NTP value acquisition program to ensure that both parties use the same NTP value.

[0027] Calculate current and future window addresses Initiate a connection request to the current address If failed, try ±1 window address (anti-drift) When the session is about to expire, automatically connect to the next address (smooth reconnection) "If failed, try the ±1 window address" means that based on the progress of the time window, it is determined whether to predict the VPN gateway IPv6 address again for the current time window or the next time window, and then perform VPN gateway IPv6 address prediction.

[0028] In step S4), the terminal device detects whether the received data packet contains Address k,m The terminal device determines whether the prediction of the new address of the VPN gateway is successful, which can further improve network security.

[0029] In order to improve security, the present invention also enables a signature mechanism. At this time, the terminal device needs to first download and verify the VPN gateway signature package, and can only connect after the verification is passed.

[0030] After the terminal device completes the initial networking, the VPN gateway can generate a new VPN gateway address, sign and publish the new address, and send the signature information to the terminal device. For example, it can be encrypted using the VPN gateway private key and decrypted using the public key of the terminal device. The CA public key or digital certificate in the present invention is not available in the public environment by default. The issuance process of the new VPN gateway address is as follows: Data = t || suffix Sig = Sign(Data, K_priv) Signature results can be distributed via DNS TXT records or HTTPS directories: { "time": "t", "suffix": "a1b2:c3d4", "sig": "30440220..." } The terminal device uses the preset K_pub or CA certificate to verify its legitimacy to prevent a third party from forging an address to induce a connection.

[0031] After the networking method based on dynamic IPv6 address of the present invention is used to form a network, if a hacker wants to invade the network through the VPN gateway, he first needs to access the VPN gateway. At this time, the hacker uses a tool to scan 1 million IPv6 addresses per second, scanning an IPv6 address segment with a / 64 mask (including 2 64 host addresses), it would take about 500,000 years to traverse all possible addresses. The core reason is that the / 64 mask address segment of IPv6 contains 1.8×1019 host addresses, which far exceeds the total address space of IPv4 (about 4.3×10 9 ), attackers need to traverse an astronomical number of addresses to find a valid target. This results in high scanning costs (hardware resources and time) and low success rates, which is incompatible with short-term profit-making attacks such as ransomware, and thus discourages hackers from investing.

[0032] Moreover, VPN gateways change dynamically, and the network layer has strong traceability (no NAT), which increases the risk of attackers being exposed, further inhibiting large-scale scanning and attack behaviors, and increasing the cost of hacker attacks. In the present invention, a program is configured in the VPN gateway to periodically modify the VPN gateway IPv6 address according to a preset strategy so that terminal devices can actively access it and build a VPN encrypted tunnel. The terminal device can predict the changed VPN gateway IPv6 address by using pre-shared information and the prefix of the VPN gateway IPv6 address. The predicted changed VPN gateway IPv6 address is then used to build a VPN tunnel on the public network that can encrypt transmission, protecting the data stream from being decrypted and monitored, and from being tampered with. Most importantly, the server gateway IP address is hidden, and the unlimited advantage of IPv6 addresses is used to avoid asset exposure and attacks.

[0033] Obviously, the above embodiments are merely examples for clarity of explanation and are not intended to limit the implementation methods. Those skilled in the art will readily appreciate that other variations or modifications based on the above descriptions are possible. It is not necessary and impossible to enumerate all implementation methods here. Obvious variations or modifications arising therefrom remain within the scope of protection of the claims of this patent application.< / suffix>

Claims

1. A networking method based on dynamic IPv6 addresses, characterized in that: The steps include: S1) pre-shared information is pre-set in the VPN gateway and the terminal device, and the VPN gateway IPv6 address prefix Part 0 is pre-set in the terminal device. The VPN gateway IPv6 address prefix Part 0 is 64 bits. S2) In the time window T k The VPN gateway first uses the NTP service to synchronize time, and then uses the standard time source Time1 and pre-shared information as input parameters to use the hash function to calculate the 64-bit VPN gateway IPv6 address suffix Part k , and change the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k Combined into the VPN gateway IPv6 address Address k , the VPN gateway will k Replace the old VPN gateway address k-1 The new VPN gateway address, k is a natural number greater than or equal to 1; S3) In the time window T k The terminal device uses the standard time source Time2 and pre-shared information as input parameters to calculate the 64-bit VPN gateway IPv6 address suffix Part using a hash function. k,n , and change the VPN gateway IPv6 address prefix Part0 and the VPN gateway IPv6 address suffix Part k,n Combined into the VPN gateway IPv6 address Address k,m , n is a natural number greater than or equal to 3, m is a natural number greater than or equal to 2; S4) In the time window T k In the terminal device, the address is used at the same time k-1 and Address k,m Access the VPN gateway, when Address k,m and Address k If the same, the VPN gateway returns the address k,m Otherwise, the VPN gateway only returns the data packet containing the Address k-1 The data packet, then go to the next step; S5) The terminal device uses the NTP service to synchronize time, and then repeats steps S3) and S4) until the terminal device uses Address k,m Successfully access the VPN gateway, that is, complete the network, use Address k,m After the network is established, the terminal device is at time t 过渡 Address k and Address k-1 Access the VPN gateway and disable Address k-1 , time t 过渡 The duration is a custom duration.

2. The networking method based on dynamic IPv6 address according to claim 1, characterized in that: The pre-shared information is one or more of a symmetric key, a TPM key fingerprint, or terminal device ID information.

3. The networking method based on dynamic IPv6 address according to claim 1, characterized in that: In step S2), the VPN gateway obtains the VPN gateway IPv6 address Address k Then set the VPN gateway IPv6 address to k Configure to the network interface.

4. The networking method based on dynamic IPv6 address according to claim 1, characterized in that: After the terminal device completes the initial networking, the VPN gateway generates a new VPN gateway address and signs and publishes the new address and sends the signature information to the terminal device. The terminal device decrypts and verifies the signature information to confirm the use of the address. k,m Access the Address in the success message k,m The new VPN gateway address generated for the VPN gateway.

5. The networking method based on dynamic IPv6 address according to claim 1, characterized in that: In step S4), if in the time window T k Address cannot be used k,m If the VPN gateway is successfully accessed, the terminal device is prohibited from accessing the VPN gateway within the time window T. k At the end of the time window T k+1 Use Address during the period between the start time k-1 Access the VPN gateway and allow the terminal device to k+1 Re-establish a connection with the VPN gateway within 1 second; where k is a natural number greater than or equal to 1.

6. The networking method based on dynamic IPv6 address according to claim 5, characterized in that: In the time window T k In the VPN gateway, use Address k and Address k-1 Provide services.

7. A system for networking using the networking method based on dynamic IPv6 addresses according to claim 1, characterized in that: It includes terminal equipment and VPN gateway, and the terminal equipment accesses the network through the VPN gateway; both the terminal equipment and the VPN gateway are equipped with a time synchronization module and an address calculation module.

8. The system according to claim 7, characterized in that The VPN gateway is also provided with an address configuration module for dynamically adding or removing interface IPv6 addresses.

9. The system according to claim 7, wherein: The terminal device is also provided with a signature verification module for verifying the legitimacy of the new VPN gateway address issued by the VPN gateway.

10. The system according to claim 7, wherein: The VPN gateway and the terminal device are also respectively provided with a VPN connection control module.

Images