Blockchain node IP address generation method and apparatus, electronic device, and readable medium

Abstract

Embodiments of the present application disclose a blockchain node IP address generation method, and relate to the technical field of blockchains. A specific implementation of the method includes: sending a distributed identity system a distributed identity identification application request; obtaining a target blockchain node distributed identity identification generated by the distributed identity system according to identity information of the target blockchain node, a public key of the target blockchain node, and random information; generating a random number with a bit length of m; splicing the random number and the target blockchain node distributed identity identification to generate an IP address interface identifier, and generating a target blockchain node IP address according to a pre-allocated IP address prefix and the IP address interface identifier. The security of the IP address can be improved, and information leakage can be avoided. Corresponding devices, electronic equipment, and computer readable media are also provided.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and computer-readable medium for generating IP addresses for blockchain nodes. Background Technology

[0002] IP addresses are generally composed of a network address (or address prefix) and a host address (or interface identifier). Enterprises typically apply for an IP address prefix from a registry, which represents an address range. For example, in the 32-bit IPv4 address 192.168.1.0 / 24, 192.168.1 is the address prefix. Under this prefix, there are 255 IPv4 addresses, ranging from 192.168.1.1 to 192.168.1.254. IPv6 is the next-generation network technology compared to IPv4, effectively solving the problem of insufficient IPv4 network address space and offering higher security. IPv6 addresses are 128 bits long, composed of an address prefix (usually 64 bits) and an interface identifier (usually 64 bits). IPv6 address users typically apply for an IPv6 address prefix (address range) from an IPv6 address registry and allocation authority, and then generate the interface identifier according to relevant specifications or custom methods.

[0003] In existing technologies, there are many reference specifications for the specific generation of IPv6 addresses. Users can obtain a complete IPv6 address based on these specifications and the IPv6 address prefix they have applied for. However, most of these reference specifications do not consider the privacy and security verification of the source address, especially the privacy of the source address, which still needs to be strengthened. For example, the MAC address in an IP address can often reflect device vendor information, operating system information, etc., and the IP address may lead to privacy leaks. In addition, the SLAAC protocol and the DHCPv6 protocol both have privacy information leakage problems, which may lead to attack risks such as network eavesdropping, location tracking, IP address scanning, and the theft of device attribute information. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method for generating IP addresses for blockchain nodes, applied to an IP address generation system. The IP address includes an IP address prefix and an IP address interface identifier. By generating IP addresses through distributed identity identification, the method avoids leakage of the privacy information of the address user and improves security during communication. The method includes the following steps:

[0005] Send a distributed identity request to the distributed identity system. The distributed identity request includes the identity information of the target blockchain node and the public key of the target blockchain node.

[0006] The distributed identity system obtains the distributed identity identifier of the target blockchain node generated by the target blockchain node based on the target blockchain node's identity information, the target blockchain node's public key, and random information. The bit length n of the target blockchain node's distributed identity identifier is less than the bit length of the IP address interface identifier, and n is an integer greater than 0.

[0007] Generate a random number of length m, where m is an integer greater than 0, and the sum of n and m is less than or equal to the length of the IP address interface identifier;

[0008] An IP address interface identifier is generated by concatenating a random number and the distributed identity identifier of the target blockchain node. The IP address of the target blockchain node is then generated based on the pre-allocated IP address prefix and the IP address interface identifier.

[0009] In some embodiments of the present invention, it further includes:

[0010] Receive verifiable credentials generated by a distributed identity system, wherein the basic information for generating verifiable credentials by the distributed identity system includes the identity information of the target blockchain node and the distributed identity identifier of the target blockchain node;

[0011] Send the target blockchain node's IP address and verifiable credentials to the target blockchain node.

[0012] In some embodiments of the present invention, sending a distributed identity request to a distributed identity system further includes:

[0013] Send a signature to the distributed identity system, which is generated by signing the target blockchain node's identity information and public key using the target blockchain node's private key, so that the distributed identity system can verify the signature using the target blockchain node's public key.

[0014] In some embodiments of the present invention, it further includes:

[0015] Check if the target blockchain node's IP address conflicts with the deployed IP address. If a conflict exists, update the random number and regenerate the target blockchain node's IP address.

[0016] In some embodiments of the present invention, the identity information of the target blockchain node includes the identifier of the target blockchain node and the physical address of the target blockchain node.

[0017] In some embodiments of the present invention, when the sum of n and m is less than the bit length of the IP address interface identifier, the IP address interface identifier is generated by concatenating a random number and the distributed identity identifier of the target blockchain node, including:

[0018] An IP address interface identifier is generated by concatenating a random parameter of length x, a random number, and the distributed identity identifier of the target blockchain node, where x is an integer greater than 0, and the sum of n, m, and x equals the length of the IP address interface identifier.

[0019] In some embodiments of the present invention, the random information includes a random timestamp.

[0020] According to another aspect of the present invention, a blockchain node IP address generation device is provided, applied to an IP address generation system. The IP address includes an IP address prefix and an IP address interface identifier. The device includes a distributed identity request module, a distributed identity acquisition module, a random number generation module, and a target blockchain node IP address generation module.

[0021] The distributed identity request module is configured to send a distributed identity request to the distributed identity system. The distributed identity request includes the identity information of the target blockchain node and the public key of the target blockchain node.

[0022] The distributed identity identifier acquisition module is configured to acquire the distributed identity identifier of the target blockchain node generated by the distributed identity system based on the identity information, public key, and random information of the target blockchain node. The bit length n of the distributed identity identifier of the target blockchain node is less than the bit length of the IP address interface identifier, and n is an integer greater than 0.

[0023] The random number generation module is configured to generate random numbers of length m, where m is an integer greater than 0, and the sum of n and m is less than or equal to the length of the IP address interface identifier.

[0024] The target blockchain node IP address generation module is configured to generate an IP address interface identifier by concatenating a random number and the target blockchain node's distributed identity identifier, and to generate the target blockchain node IP address based on the pre-allocated IP address prefix and the IP address interface identifier.

[0025] According to another aspect of the present invention, an electronic device is provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for generating blockchain node IP addresses provided in the embodiments of the present invention.

[0026] According to another aspect of the present invention, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method for generating blockchain node IP addresses provided in the embodiments of the present invention.

[0027] One embodiment of the above invention has the following advantages or beneficial effects: In this embodiment, the IP address generation system sends the identity information and public key information of the target blockchain node to the distributed identity system. The distributed identity system generates a distributed identity identifier for the target blockchain node based on the identity information, public key information, and random information. The IP address generation system then combines the distributed identity identifier and random number to form an IP address interface identifier. Finally, based on the pre-allocated IP address prefix, it generates a complete IP address for the target blockchain node. Since the IP address is generated using the distributed identity identifier, the user's privacy information cannot be obtained through the IP address, thus improving IP address security and preventing privacy information leakage. At the same time, using the distributed identity identifier of the target blockchain node to generate the IP address allows for secure verification of the IP address in subsequent communication processes, improving communication security.

[0028] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0029] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0030] Figure 1 This is a flowchart illustrating a method for generating blockchain node IP addresses according to some embodiments of the present invention;

[0031] Figure 2 This is a schematic diagram of the architecture of a blockchain network communication system according to some embodiments of the present invention;

[0032] Figure 3 This is a flowchart illustrating the process of concatenating interface identifiers in the method for generating the IP address of a blockchain node according to some embodiments of the present invention.

[0033] Figure 4 This is a flowchart illustrating some additional concatenated interface identifiers in the method for generating the IP address of a blockchain node according to some embodiments of the present invention;

[0034] Figure 5 This is a flowchart illustrating a method for generating blockchain node IP addresses according to other embodiments of the present invention;

[0035] Figure 6 This is a schematic diagram of the process of generating a distributed identity identifier in the blockchain node IP address generation method according to other embodiments of the present invention;

[0036] Figure 7 This is a schematic diagram of the process of generating and allocating IP addresses in the blockchain node IP address generation method according to other embodiments of the present invention;

[0037] Figure 8 This is a functional architecture diagram of a blockchain node IP address generation device according to some embodiments of the present invention;

[0038] Figure 9 This is an exemplary system architecture diagram in which embodiments of the present invention can be applied;

[0039] Figure 10 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0040] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0041] In this embodiment of the invention, "DID (Decentralized Identifiers)" refers to a distributed identity identifier, a string-based identifier representing a digital identity. The DID is generated by a distributed identity generation system based on the applicant's public key and other information. The distributed identity generation system also stores a DID document corresponding to the DID, containing the DID and its corresponding public key. "VC (Verifiable Credential)" refers to a verifiable credential, typically a JSON string containing VC metadata, a declaration section, and a proof section. VC metadata mainly includes information such as the issuer, issuance date, and type of declaration. The declaration section contains one or more specific descriptions of the entity; for example, if a VC is an ID card, the declaration section would include the holder's name, gender, date of birth, ethnicity, address, and other personal information. The proof section is usually the issuer's digital signature, used to ensure the integrity and authenticity of the VC content, prevent tampering, and verify the issuer's identity. "MAC" address refers to the globally unique physical address of a network device.

[0042] In existing IPv6 address or other IP address generation schemes, interface identifiers often directly use MAC addresses. However, MAC addresses contain information such as device manufacturer and operating system details, posing a risk of information leakage. By publicly disclosing the MAC address information within an IP address, external parties will know the network device's manufacturer and operating system information, thus increasing the risk of attacks using this information and reducing network security. The embodiments of this invention generate interface identifiers based on distributed identity identifiers, replacing the existing MAC addresses. Even if the IP address is made public, it will not pose a risk of privacy information leakage through the IP address.

[0043] like Figure 1 The illustration shows a method for generating blockchain node IP addresses according to an embodiment of this application. Figure 2 The diagram illustrates a blockchain network communication system 100 used in the generation method of this application embodiment, including a target blockchain node 110, an IP address generation system 120, and a distributed identity system 130. In this embodiment, the target blockchain network node 110 refers to a node in the blockchain system, which may include devices requiring cross-domain communication such as server hosts, gateways, switches, and routers. The distributed identity system 130 is established by a trusted institution and mainly provides support functions such as the issuance and verification of distributed identities. It can be implemented through a distributed or blockchain technology architecture. The IP address generation system 120 is mainly responsible for the generation and updating of IPv6 addresses of nodes under the blockchain system, such as a DHCPv6 server. The IP address generation system 120 is generally an internal enterprise system that stores information about the organization's network nodes, such as the system network address prefix, the identifier and MAC address of each network node, the public key of each network node, the complete IP address, and other information and corresponding relationships. It is generally located in the same security domain as the blockchain network nodes and plays a network operation and maintenance management role. Considering the security of the system, the IP address generation system 120 can deploy a front-end system to forward and interact with the distributed identity system 130. The front-end system and the distributed identity system 130 can be regarded as a single system.

[0044] The generation method in this embodiment of the invention is applied to the IP address generation system 120. The IP address in this embodiment of the invention includes an IP address prefix and an IP address interface identifier. The IP address in this embodiment of the invention can be an IPv6 address or other types of IP addresses.

[0045] like Figure 1 As shown, the generation method in this embodiment of the invention includes the following steps:

[0046] S210: Send a distributed identity identifier request to the distributed identity system. The distributed identity identifier request includes the identity information and public key of the target blockchain node. In this embodiment, the IP address generation system 120 can obtain the identity information and public key of the target blockchain node from the target blockchain node 110, or it can collect these information manually and then import them into the IP address generation system 120. In this embodiment, the IP address generation system 120 can periodically send identifier request requests to the distributed identity system to update the generated IP addresses and improve communication security. In some embodiments of this invention, if the initially generated IP address is duplicated with an already allocated IP address, the IP address generation system can be triggered to send a distributed identity identifier request to the distributed identity system again until the generated IP address is not duplicated with an already allocated IP address.

[0047] In embodiments of the present invention, the identity information of the target blockchain node can be set to globally unique identity information, thereby ensuring the uniqueness of the generated distributed identity identifier.

[0048] In some embodiments of the present invention, the IP address generation system 120 also sends signature information to the distributed identity system 130. Based on the signature information, the distributed identity system 130 verifies that the IP address generation system 120 has sent a distributed identity request, ensuring that the request information has not been tampered with. Specifically, the distributed identity system sending the distributed identity request also includes:

[0049] Send a signature to the distributed identity system 130, which is generated by signing the identity information of the target blockchain node and the public key of the target blockchain node using the private key of the target blockchain node, so that the distributed identity system can verify the signature information using the public key of the target blockchain node.

[0050] In this embodiment of the invention, when the target blockchain node 110 sends its identity information and public key to the IP address generation system 120, it also uses its private key to sign the target blockchain node's identity information and public key to generate signature information, which is then sent to the IP address generation system 120. The IP address generation system 120 sends the signature information to the distributed identity system 130. The distributed identity system 130 verifies the signature information based on the target blockchain node 110's public key. After successful verification, it proceeds with the subsequent operation of generating a distributed identity identifier.

[0051] S220: Obtain the distributed identity identifier of the target blockchain node generated by the distributed identity system based on the identity information, public key, and random information of the target blockchain node, wherein the bit length n of the distributed identity identifier of the target blockchain node is less than the bit length of the IP address interface identifier, and n is an integer greater than 0.

[0052] In the embodiments of the present invention, the distributed identity system 130 generates a distributed identity identifier for the target blockchain node based on the target blockchain node's identity information, the target blockchain node's public key, and random information. This ensures that the generated distributed identity identifier is associated with the identity of the target blockchain node. At the same time, through random information, it ensures that the distributed identity identifiers generated at different times are different, enabling dynamic updating of the target blockchain node's distributed identity identifier.

[0053] In some embodiments of this invention, a hash algorithm can be used to calculate the identity information, public key, and random information of the target blockchain node to generate a distributed identity identifier for the target blockchain node. In some embodiments of this invention, the number of bits in the generated hash value can be limited, for example, to a length of n; alternatively, the first n bits, the last n bits, or bits at intervals can be extracted from the generated hash value to obtain the distributed identity identifier for the target blockchain node. In some embodiments of this invention, the hash algorithm used can be a Chinese cryptographic hash function algorithm, such as the SM3 function. In some embodiments of this invention, the length n of the distributed identity identifier can be fixed before generating the distributed identity identifier, for example, it can be 32 bits, 48 ​​bits, or 56 bits. In some embodiments of this invention, the length of the IP address interface identifier can be 64 bits.

[0054] In some embodiments of the present invention, the identity information of the target blockchain node may include the identifier of the target blockchain node and the physical address of the target blockchain node. Since the network address of a network device is globally unique, a distributed identifier is generated through the physical address of the target blockchain node, so that different network devices generate different identifiers.

[0055] In some embodiments of the present invention, the random information includes random timestamps or other random information to ensure the randomness of each generation of distributed identity identifiers.

[0056] In some embodiments of the present invention, when generating the distributed identity identifier of the target blockchain node, the distributed identity system 130 also generates a distributed identifier document corresponding to the distributed identity identifier, which stores the public key of the target blockchain node. Subsequently, the public key of the target blockchain node can be obtained from the distributed identity system through the distributed identity identifier of the target blockchain node.

[0057] S230: Generate a random number of length m, where m is an integer greater than 0, and the sum of n and m is less than or equal to the length of the IP address interface identifier. In this embodiment of the invention, the number of bits m of the random number generated by the IP address generation system 120 can be fixed before generating the random number. It can directly generate an m-bit random number or take m bits from the generated random number. In this embodiment of the invention, the sum of the length n of the distributed identity identifier of the target blockchain node and the length m of the random number can be exactly equal to the length of the IP address interface identifier, or it can be less than the length of the IP address interface identifier. The remaining bits are then filled with other random parameters.

[0058] S240: Generate an IP address interface identifier by concatenating a random number and the distributed identity identifier of the target blockchain node. Generate the IP address of the target blockchain node based on the pre-allocated IP address prefix and the IP address interface identifier.

[0059] In this embodiment of the invention, the IP address interface identifier can be generated by concatenating the beginning and end of the string, or by inserting and concatenating according to a set rule. For example, Figure 3 As shown, the distributed identity identifier of the target blockchain node is 32 bits (binary), and the identity identifier is (4,5,7,A,B,4,5,A). 16 The random number is 32 bits long (binary), and the random number is (1,F,7,B,7,A,B,4). 16 After concatenating the first and last bits, the resulting IP address interface identifier is 64 bits (binary), which is (4,5,7,A,B,4,5,A,1,F,7,B,7,A,B,4). 16 Represented in decimal, the IP address interface identifier is (69,122,180,90,31,123,122,180); if a concatenation method is used, such as Figure 4 As shown, the interface identifier for generating the IP address is (4,1,5,F,7,7,A,B,B,7,4,A,5,B,A,4). 16 If expressed in decimal, the IP address interface identifier is (65,95,119,171,183,74,91,164).

[0060] In this embodiment of the invention, the pre-allocated IP address prefix is ​​allocated by an IP address allocation agency. The pre-allocated IP address prefix has a length of 64 bits, for example, 192.172.126.127,180,199,210,255. Then, when the IP address interface identifier is 69,122,180,90,31,123,122,180, the complete target blockchain node IP address is 192.172.126.127,180,199,210,255,69,122,180,90,31,123,122,180.

[0061] In some embodiments of the present invention, when the sum of n and m is less than the bit length of the IP address interface identifier, the IP address interface identifier is generated by concatenating a random number and the distributed identity identifier of the target blockchain node, including:

[0062] An IP address interface identifier is generated by concatenating a random parameter of length x, a random number, and the distributed identity identifier of the target blockchain node, where x is an integer greater than 0, and the sum of n, m, and x equals the length of the IP address interface identifier.

[0063] For example, the IP address length in this application can be uniformly described in binary form. When the IP address interface identifier has a bit length of 64, n is 32, m is 24, and x is 8. The process of concatenating the interface identifier in this embodiment can be in the order of distributed identity identifier, random number, random parameter, or distributed identity identifier, random parameter, random number, etc. Besides the above-mentioned beginning and end concatenation, insertion concatenation can also be performed according to a set order. For example, a set interval insertion concatenation can be performed, dividing the distributed identity identifier into 8-bit groups, combining the random number and random parameter, and then dividing the values ​​in the random number and random parameter into 8-bit groups as well, inserting them into the grouped distributed identity identifier at intervals to form the IP address.

[0064] In some embodiments of the present invention, the method for generating a target blockchain node further includes:

[0065] Receive verifiable credentials generated by the distributed identity system 130, wherein the basic information for generating verifiable credentials by the distributed identity system includes the identity information of the target blockchain node 110 and the distributed identity identifier of the target blockchain node; send the IP address of the target blockchain node and the verifiable credentials to the target blockchain node.

[0066] In this embodiment of the invention, the distributed identity identifier information of the target blockchain node is used in the process of generating the IP address of the target blockchain node. Subsequently, during communication, the distributed identity identifier can be used to verify the IP address of the target blockchain node. For example, according to preset rules, the first 32 bits of the interface identifier are the distributed identity identifier; by verifying the correctness of the distributed identity identifier, the correctness of the IP address can be verified. In this embodiment, after generating the distributed identity identifier, the distributed identity system 130 issues a verifiable credential (VC) using its private key and sends the verifiable credential to the IP address generation system 120. The IP address generation system 120 forwards the credential and IP address to the target blockchain node 110. During subsequent external communication, the target blockchain node 110 can include the verifiable credential. The communicating party can verify the distributed identity identifier of the target blockchain node 110 based on the verifiable credential, thereby verifying the first 32 bits of the interface identifier in the IP address of the target blockchain node 110. The communicating party can verify the IP address of the target blockchain node through the verifiable credential, ensuring communication security.

[0067] In some embodiments of the present invention, the distributed identity system 130 can use its private key to sign the distributed identity identifier of the target blockchain node to generate a verifiable credential. The verifiable credential includes the distributed identity identifier of the target blockchain node and the signature of the distributed identity identifier of the target blockchain node (generated by the private key of the distributed identity system). The process of verifying the verifiable credential is to verify the signature of the distributed identity identifier of the target blockchain node using the public key of the distributed identity system. If the signature verification is successful, the distributed identity identifier of the target blockchain node in the credential is verified.

[0068] In some embodiments of the present invention, the distributed identity system can generate verifiable credentials based on the identity information of the target blockchain node 110 and the distributed identity identifier of the target blockchain node, or it can generate verifiable credentials based on the identity information of the target blockchain node 110, the public key of the target blockchain node, and the distributed identity identifier of the target blockchain node.

[0069] In this embodiment of the invention, to avoid duplicate generated IP addresses, a deduplication check is performed before finally allocating the IP address of the target blockchain node. Specifically, it also includes:

[0070] Check if the target blockchain node's IP address conflicts with the deployed IP address. If a conflict exists, update the random number and regenerate the target blockchain node's IP address.

[0071] In this embodiment of the invention, when a conflict is detected between the target blockchain node's IP address and an already deployed IP address, a random number is regenerated cyclically and concatenated again to generate an IP address until no duplicates are found with the already deployed IP address. This ensures the uniqueness of the IP address.

[0072] In some embodiments of the present invention, the IP address of the target blockchain node can be updated periodically, or the IP address of the target blockchain node can be actively triggered to be updated. When regenerating the IP address, steps S210 to S240 in the embodiments of the present invention can be re-executed.

[0073] This invention utilizes the distributed identity identifier of the target blockchain node to generate IP addresses, preventing the acquisition of user privacy information through IP addresses, thus improving IP address security and preventing privacy information leakage. Furthermore, using the distributed identity identifier of the target blockchain node to generate IP addresses allows for secure verification of the IP addresses during subsequent communication, enhancing communication security.

[0074] The method described in this embodiment of the invention can be applied to cross-chain scenarios. In a cross-chain scenario, the source chain initiates a request to the relay system, which forwards it to the destination chain. The method described in this embodiment can be used to assign IP addresses to the source chain network nodes. During the cross-chain process, a Distributed Identity (DID) is first assigned to the source chain network nodes. Then, based on the DID and other identity information, combined with cryptographic techniques, an IPv6 address interface identifier is generated. Combined with the IPv6 address prefix, a complete IPv6 address is generated.

[0075] like Figure 5 As shown, other embodiments of the present invention provide a method for generating IP addresses for blockchain nodes, including the following related parameters in these embodiments:

[0076] 1) Node_A_ID: A standard identity identifier for a blockchain network node device (server host, gateway, switch, router, etc.).

[0077] 2) Node_A_MAC: The hardware address of a blockchain network node device, used to identify the device at the physical layer, and is generally assigned by the device manufacturer during manufacturing.

[0078] 3) Node_A_DID: A distributed identity issued by the distributed identity system for network node devices. It typically requires identity verification with the distributed identity system before the system issues the Node_A_DID. Its length is n bits, where n < 64.

[0079] 4) Node_A_DID-VC: is a credential issued by the distributed identity system for network node devices. It is the signature information of the network node device's identity information using its private key.

[0080] 5) Node_A_DID-DOC: The distributed identity system stores information related to Node_A, mainly the mapping relationship between Node_A_DID and other related information (such as Node_A_MAC).

[0081] 6) IP_A: The IP address of source chain network node A.

[0082] 7) Node_A_PrefixIP: The address prefix of the IP address of node A, such as the first 64 bits.

[0083] 8) Node_A_Suffix IP: The address suffix (interface identifier) ​​of the IP address of node A, such as the last 64 bits.

[0084] 9) Node_A_IP: The complete IP address of node A, usually composed of an address prefix and an address suffix, 128 bits.

[0085] 10) Pk, Sk: Public and private keys. In this scheme, the public and private keys of network node A are identified as Node_A_Pk and Node_A_Sk; the public and private keys of the distributed identity system are identified as DIDsystem_Pk and DIDsystem_Sk.

[0086] 11) R: A random number with a length of m bits, used in the generation of IP address suffixes.

[0087] like Figure 5 As shown, the steps in this embodiment of the invention include:

[0088] S310: The IP address generation system interacts with the distributed identity system to request a DID identifier. Specifically, as follows... Figure 6 As shown, it includes the following steps:

[0089] S311: The IP address generation system and the distributed identity system establish a secure connection channel to transmit public keys to each other.

[0090] S312: The IP address generation system initiates a DID request for Node_A, submits the network node A's regular identity identifier Node_A_ID, MAC address Node_A_MAC, public key Node_A_Pk, and Node_A_Sk's signature of this information to the distributed identity system.

[0091] S313: The distributed identity system verifies signatures based on the public key Node_A_Pk.

[0092] S314: The distributed system uses information such as the conventional identity identifier Node_A_ID, MAC address Node_A_MAC, public key Node_A_Pk, and timestamp (to ensure randomness) to perform calculations based on SM3 and other methods to generate a 256-bit hash result hash1.

[0093] S315: Based on the rules, select n bits from the hash result hash1 to generate an n-bit Node_A_DID.

[0094] S316: The distributed system generates a credential (signature) Node_A_DID-VC based on information such as Node_A_ID, MAC address Node_A_MAC, public key Node_A_Pk, and Node_A_DID, using the private key DIDsystem_Sk.

[0095] S317: The distributed identity system generates identity document information related to Node_A_DID, Node_A_DID-DOC, mainly including mapping and association relationships such as Node_A_DID and Node_A_ID, MAC address Node_A_MAC, and public key Node_A_Pk.

[0096] S318: The distributed identity system returns the distributed identity DID identifier Node_A_DID and credential information Node_A_DID-VC generated by Node_A to the IP address generation system.

[0097] S320: Generate and allocate the source address of Node_A. For example... Figure 7 As shown, the specific process is as follows:

[0098] S321: The IP address generation system generates a random number R of length m, m+n=64, that is, the length of the random number (m) and the length of Node_A_DID (n) are added together to equal the length of the interface identifier (64).

[0099] In this embodiment of the invention, m+n<64 can also be used depending on the actual situation, but other parameters (bit length is x) need to be added, x+m+n = length of interface identifier (64).

[0100] S322: Concatenate the random number R and Node_A_DID into a 64-bit address suffix (interface identifier) ​​Node_A_Suffix IP.

[0101] S323: Combine the Node_A_PrefixIP (64-bit) and Node_A_Suffix IP stored in the system to generate a 128-bit IPv6 address Node_A_IP.

[0102] S324: Internally check if Node_A_IP conflicts with other addresses. If a conflict is found, S321 to S324 can be executed repeatedly.

[0103] S325: Complete the generation of a 128-bit IPv6 address.

[0104] S326: Configure Node_A_IP on network node device A. This address can then be used to establish external network connections.

[0105] In some embodiments of the present invention, when Node_A needs to update its network address, such as periodically updating the network address or changing the address when connecting to a new network, there are two methods:

[0106] 1. Repeat steps S310 and S320 to regenerate a new DID and a complete IP address.

[0107] 2. Keep the DID fixed and execute the S320 process, only re-constructing the random number R part of the network address suffix and concatenating it to generate a new complete IP address.

[0108] This invention proposes a novel network address generation method based on cryptography and distributed technologies. It effectively protects the privacy of network node IP address information without exposing the MAC address information of network nodes, thus significantly improving system security. It supports rapid IP address updates through flexible updates of network address suffixes, meeting the privacy and security requirements of some privacy-focused communication scenarios.

[0109] like Figure 8 As shown, this embodiment of the invention provides an IP address generation device 400 for blockchain nodes, applied to an IP address generation system. The IP address includes an IP address prefix and an IP address interface identifier. The device 400 includes a distributed identity request module 410, a distributed identity acquisition module 420, a random number generation module 430, and a target blockchain node IP address generation module 440.

[0110] The distributed identity request module 410 is configured to send a distributed identity request to the distributed identity system. The distributed identity request includes the identity information of the target blockchain node and the public key of the target blockchain node.

[0111] The distributed identity acquisition module 420 is configured to acquire the distributed identity identifier of the target blockchain node generated by the distributed identity system based on the identity information of the target blockchain node, the public key of the target blockchain node, and random information. The bit length n of the distributed identity identifier of the target blockchain node is less than the bit length of the IP address interface identifier, and n is an integer greater than 0.

[0112] The random number generation module 430 is configured to generate random numbers with a bit length of m, where m is an integer greater than 0, and the sum of n and m is less than or equal to the bit length of the IP address interface identifier.

[0113] The target blockchain node IP address generation module 440 is configured to generate an IP address interface identifier by concatenating a random number and the distributed identity identifier of the target blockchain node, and to generate the target blockchain node IP address based on the pre-allocated IP address prefix and the IP address interface identifier.

[0114] In some embodiments of the present invention, the apparatus 400 further includes a verifiable credential distribution module 450, which is specifically configured to: receive a verifiable credential generated by the distributed identity system based on the identity information of the target blockchain node and the distributed identity identifier of the target blockchain node; and send the verifiable credential to the target blockchain node.

[0115] In some embodiments of the present invention, the distributed identity request module 410 is configured to send signature information generated by signing the identity information of the target blockchain node and the public key of the target blockchain node using the private key of the target blockchain node, so that the distributed identity system can verify the signature information using the public key of the target blockchain node.

[0116] In some embodiments of the present invention, the apparatus 400 further includes a conflict detection module 460, which is configured to detect whether the target blockchain node IP address conflicts with the deployed IP address. If a conflict exists, the random number is updated and the target blockchain node IP address is regenerated.

[0117] In some embodiments of the present invention, the identity information of the target blockchain node includes the identifier of the target blockchain node and the physical address of the target blockchain node.

[0118] In some embodiments of the present invention, when the sum of n and m is less than the bit length of the IP address interface identifier, the target blockchain node IP address generation module 440 is configured to generate the IP address interface identifier by concatenating a random parameter of bit length x, a random number and the distributed identity identifier of the target blockchain node, where x is an integer greater than 0 and the sum of n, m and x is equal to the bit length of the IP address interface identifier.

[0119] In some embodiments of the present invention, the random information includes a random timestamp.

[0120] The device features of the embodiments of the present invention can be referred to the features of the methods and steps of the embodiments of the present invention, and the system embodiments can be combined with the features of the method embodiments to obtain new embodiments, and vice versa, and will not be repeated here.

[0121] An embodiment of the present invention provides an electronic device comprising: a processor and a memory storing a computer program, the processor being configured to implement a method for generating an IP address of any blockchain node according to an embodiment of the present invention when running the computer program. Additionally, apparatus for implementing the generation of an IP address of a blockchain node according to an embodiment of the present invention may also be provided.

[0122] Figure 9 An exemplary system architecture 900 is shown, in which the method or apparatus for generating IP addresses of blockchain nodes according to embodiments of the present invention can be applied.

[0123] like Figure 9 As shown, system architecture 900 may include terminal devices 901, 902, and 903, network 904, and server 905. Network 904 is used as a medium to provide a communication link between terminal devices 901, 902, and 903 and server 905. Network 904 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0124] Users can use terminal devices 901, 902, and 903 to interact with server 905 via network 904 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 901, 902, and 903, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0125] Terminal devices 901, 902, and 903 can be various electronic devices with displays that support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0126] Server 905 can be a server providing various services, such as a backend management server supporting shopping websites browsed by users using terminal devices 901, 902, and 903 (for example only). The backend management server can analyze and process data such as received product information query requests, and feed back the processing results (such as target push information, product information - for example only) to the terminal devices.

[0127] It should be noted that the method for generating the IP address of a blockchain node provided in this embodiment of the invention is generally executed by server 905, and correspondingly, the device for generating the IP address of a blockchain node is generally located in server 905.

[0128] It should be understood that Figure 9 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0129] The following is for reference. Figure 10 It shows a schematic diagram of the structure of a computer system 1000 suitable for implementing terminal devices or servers of the present invention. The methods or apparatus for implementing the methods in the embodiments of the present invention can be implemented on the computer system 1000. Figure 10 The terminal device or server shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present invention.

[0130] like Figure 10 As shown, the computer system 1000 includes a central processing unit (CPU) 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage section 1008 into a random access memory (RAM) 1003. The RAM 1003 also stores various programs and data required for the operation of the system 1000. The CPU 1001, ROM 1002, and RAM 1003 are interconnected via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0131] The following components are connected to I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to I / O interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 1010 as needed so that computer programs read from it can be installed into storage section 1008 as needed.

[0132] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by central processing unit (CPU) 1001, it performs the functions defined in the system of this invention.

[0133] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0134] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0135] The units or modules described in the embodiments of the present invention can be implemented in software or hardware. The described units or modules can also be housed in a processor; for example, a processor can be described as including a sending unit (or "module"), an acquisition unit, a determining unit, and a first processing unit. The names of these units or modules do not necessarily limit the specific unit or module itself; for example, a sending unit can also be described as "a unit that sends an image acquisition request to a connected server."

[0136] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs that, when executed by the device, cause the device to perform the IP address generation method for blockchain nodes in the above embodiments.

[0137] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for generating IP addresses for blockchain nodes, characterized in that, Applied to an IP address generation system, wherein the IP address includes an IP address prefix and an IP address interface identifier, the method includes the following steps: Send a distributed identity identifier request to the distributed identity system, wherein the distributed identity identifier request includes the identity information of the target blockchain node and the public key of the target blockchain node; The distributed identity system obtains a distributed identity identifier for the target blockchain node generated based on the target blockchain node's identity information, the target blockchain node's public key, and random information, wherein the bit length n of the target blockchain node's distributed identity identifier is less than the bit length of the IP address interface identifier, and n is greater than 0. Generate a random number of length m, where m is greater than 0, and the sum of n and m is less than or equal to the length of the IP address interface identifier; The IP address interface identifier is generated by concatenating the random number and the distributed identity identifier of the target blockchain node. The IP address of the target blockchain node is generated by combining the pre-allocated IP address prefix and the IP address interface identifier.

2. The method according to claim 1, characterized in that, Also includes: Receive verifiable credentials generated by the distributed identity system, wherein the distributed identity system generates the verifiable credentials based on the identity information of the target blockchain node and the distributed identity identifier of the target blockchain node; Send the target blockchain node's IP address and the verifiable credentials to the target blockchain node.

3. The method according to claim 1, characterized in that, Sending a distributed identity request to the distributed identity system further includes: A signature is generated by signing the identity information of the target blockchain node and the public key of the target blockchain node using the private key of the target blockchain node, so that the distributed identity system can verify the signature information using the public key of the target blockchain node.

4. The method according to claim 1, characterized in that, Also includes: Detect whether the target blockchain node IP address conflicts with the deployed IP address. If a conflict exists, update the random number and regenerate the target blockchain node IP address.

5. The method according to claim 1, characterized in that, The identity information of the target blockchain node includes the identifier of the target blockchain node and the physical address of the target blockchain node.

6. The method according to claim 1, characterized in that, When the sum of n and m is less than the bit length of the IP address interface identifier, the step of generating the IP address interface identifier by concatenating the random number and the distributed identity identifier of the target blockchain node includes: The IP address interface identifier is generated by concatenating a random parameter of length x, the random number, and the distributed identity identifier of the target blockchain node, where x is greater than 0, and the sum of n, m, and x is equal to the length of the IP address interface identifier.

7. The method according to claim 1, characterized in that, The random information includes a random timestamp.

8. A blockchain node IP address generation device, characterized in that, This system is used for IP address generation. The IP address includes an IP address prefix and an IP address interface identifier. The device includes a distributed identity request module, a distributed identity acquisition module, a random number generation module, and a target blockchain node IP address generation module. The distributed identity request module is configured to send a distributed identity application request to the distributed identity system. The distributed identity application request includes the identity information of the target blockchain node and the public key of the target blockchain node. The distributed identity identifier acquisition module is configured to acquire the distributed identity identifier of the target blockchain node generated by the distributed identity system based on the identity information of the target blockchain node, the public key of the target blockchain node, and random information, wherein the bit length n of the distributed identity identifier of the target blockchain node is less than the bit length of the IP address interface identifier, and n is an integer greater than 0. The random number generation module is configured to generate random numbers with a bit length of m, where m is an integer greater than 0, and the sum of n and m is less than or equal to the bit length of the IP address interface identifier. The target blockchain node IP address generation module is configured to generate the IP address interface identifier by concatenating the random number and the target blockchain node distributed identity identifier, and to generate the target blockchain node IP address by concatenating the pre-allocated IP address prefix and the IP address interface identifier.

9. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-7.

10. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.

Images