Method and apparatus for verifying an IP address

Abstract

Embodiments of the present application disclose IP address verification methods, and relate to the technical field of communication. A specific embodiment of the method comprises: obtaining a network request of a first network device, the network request of the first network device comprising an IP address of the first network device and a verifiable credential of the first network device, wherein the IP address of the first network device comprises a distributed identity of the first network device; and verifying the verifiable credential of the first network device based on the distributed identity of the first network device to determine whether the IP address of the first network device is verified. The IP address can be verified by using the verifiable credential, thereby avoiding problems such as IP address forgery and hijacking, and improving communication security. Corresponding devices, electronic devices and computer readable media are also provided.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to an IP address verification method, apparatus, electronic device, and computer-readable medium. Background Technology

[0002] In existing technologies, traditional network routing protocols primarily forward data based on the destination address, lacking reliable verification of the source address. This leads to frequent security incidents, such as IP address spoofing of the communication initiator, routing hijacking between ASs (Remote Access Servers), and DNS system domain name hijacking. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide an IP address verification method, applied to a second network device, which can perform security verification on the IP address in the network request of the party initiating the network request (such as the first network device), thereby avoiding address spoofing and hijacking problems. The verification method includes the following steps:

[0004] Obtain the network request of the first network device. The network request of the first network device includes the IP address of the first network device and the verifiable credentials of the first network device, wherein the IP address of the first network device includes the distributed identity identifier of the first network device.

[0005] The verifiable credentials of the first network device are verified based on the distributed identity identifier of the first network device to determine whether the IP address of the first network device has been successfully verified.

[0006] In some embodiments of the present invention, the verifiable credential includes signature information, wherein the signature information is generated by the issuer based on the issuer's private key; the distributed identity identifier of the first network device and the public key of the issuer are stored in the distributed identity subsystem, and the public key of the issuer corresponds to the distributed identity identifier of the first network device; the verifiable credential of the first network device is verified based on the distributed identity identifier of the first network device, including:

[0007] The issuer's public key is obtained from the distributed identity subsystem based on the distributed identity identifier of the first network device;

[0008] The signature information in the verifiable credential is verified using the issuer's public key.

[0009] In some embodiments of the present invention, the signature information is generated by the issuing party signing the verifiable information of the first network device based on the issuing party's private key, wherein the verifiable information of the first network device includes the identity information of the first network device; verifying the signature information in the verifiable credential based on the issuing party's public key includes:

[0010] The signature information in the verifiable credential is verified using the issuer's public key to obtain the identity information of the first network device in the verifiable credential.

[0011] The identity information of the first network device can be verified based on the pre-stored identity information of the first network device in the credentials.

[0012] In some embodiments of the present invention, the verifiable information of the first network device further includes the distributed identity identifier of the first network device; verifying the signature information in the verifiable credential based on the issuer's public key includes:

[0013] The signature information in the verifiable credential is verified using the issuer's public key to obtain the distributed identity identifier of the first network device in the verifiable credential.

[0014] The distributed identity verification based on the IP address of the first network device can verify the distributed identity of the first network device in the credentials.

[0015] In some embodiments of the present invention, the IP address of the first network device further includes an address prefix; the method further includes:

[0016] Verify the address prefix in the IP address of the first network device based on the pre-stored address prefix of the first network device's IP address.

[0017] In some embodiments of the present invention, the identity information of the first network device includes the physical address of the first network device.

[0018] In some embodiments of the present invention, the issuing party includes a distributed identity subsystem.

[0019] In some embodiments of the present invention, the distributed identity of the first network device is generated by the distributed identity subsystem based on random time information and the distributed identity generation information of the first network device, wherein the distributed identity generation information of the first network device includes one or more of the identifier of the first network device, the physical address of the first network device, and the public key of the first network device.

[0020] According to another aspect of the present invention, an IP address verification device is provided, applied to a second network device. The device includes an acquisition module and a verification module, wherein...

[0021] The acquisition module is configured to acquire the network request of the first network device. The network request of the first network device includes the IP address of the first network device and the verifiable credentials of the first network device, wherein the IP address of the first network device includes the distributed identity identifier of the first network device.

[0022] The verification module is configured to verify the verifiable credentials of the first network device based on the distributed identity identifier of the first network device, so as to determine whether the IP address of the first network device has been verified.

[0023] According to another aspect of the present invention, an electronic device is provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the IP address verification method provided in the embodiments of the present invention.

[0024] According to another aspect of the present invention, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the IP address verification method provided in the embodiments of the present invention.

[0025] One embodiment of the above invention has the following advantages or beneficial effects: In this embodiment, the second network device parses the network request of the first network device to obtain the IP address and verifiable credentials of the first network device. The IP address of the first network device includes its distributed identity identifier. The IP address is verified based on the distributed identity identifier and the verifiable credentials. If the verification is successful, it indicates that the distributed identity identifier information in the IP address is correct, thus verifying the correctness of the IP address. By verifying the IP address, it is possible to effectively verify whether the network request of the first network device has been forged or hijacked, thereby improving the security of network request processing.

[0026] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0027] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein:

[0028] Figure 1 This is a flowchart illustrating an IP address verification method according to some embodiments of the present invention;

[0029] Figure 2 This is a schematic diagram of the architecture of a network communication system according to some embodiments of the present invention;

[0030] Figure 3 This is a flowchart illustrating the preceding IP address generation method in the IP address verification method according to some embodiments of the present invention;

[0031] Figure 4 This is a schematic diagram of the process of verification based on verifiable credentials in the IP address verification method according to some embodiments of the present invention;

[0032] Figure 5This is a flowchart illustrating the verification of credentials based on pre-stored identity information in an IP address verification method according to some embodiments of the present invention;

[0033] Figure 6 This is a flowchart illustrating the IP address verification method based on pre-stored identity information and distributed identity verification credentials in other embodiments of the present invention.

[0034] Figure 7 This is a flowchart illustrating an IP address verification method according to other embodiments of the present invention;

[0035] Figure 8 This is a schematic diagram of the architecture of a cross-chain network communication system that operates according to the IP address verification method in some embodiments of the present invention.

[0036] Figure 9 This is a schematic diagram of the process for generating distributed identity identifiers and credentials in the IP address verification method according to other embodiments of the present invention;

[0037] Figure 10 This is a flowchart illustrating the process of generating and configuring the IP address of node a in the IP address verification method according to other embodiments of the present invention;

[0038] Figure 11 This is a flowchart illustrating the IP address verification process in a cross-chain scenario according to other embodiments of the present invention.

[0039] Figure 12 This is a schematic diagram of the structure of an IP address verification device according to some embodiments of the present invention;

[0040] Figure 13 This is an exemplary system architecture diagram in which embodiments of the present invention can be applied;

[0041] Figure 14 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0042] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0043] In this embodiment of the invention, "DID (Decentralized Identifiers)" refers to a distributed identity identifier, a string-based identifier representing a digital identity. The DID is generated by the distributed identity subsystem based on the applicant's public key and other information. The distributed identity subsystem also stores a DID document corresponding to the DID, containing the DID and its corresponding public key. "VC (Verifiable Credential)" refers to a verifiable credential, typically a JSON string containing VC metadata, a declaration section, and a proof section. The VC metadata mainly includes information such as the issuer, issuance date, and type of declaration. The declaration section contains one or more specific descriptions of the subject; for example, if a VC is an ID card, the declaration section would include the holder's name, gender, date of birth, address, and other personal information. The proof section is usually the issuer's digital signature, used to ensure the integrity and authenticity of the VC content, prevent tampering, and verify the issuer's identity. "MAC" address refers to the globally unique physical address of a network device.

[0044] IP addresses are generally composed of a network address (or address prefix) and a host address (or interface identifier). Organizations or individuals typically apply for an IP address prefix from a registry authority, which represents an address range. For example, in the 32-bit IPv4 address 192.168.1.0 / 24, 192.168.1 is the address prefix. Under this address prefix, there are 255 IPv4 addresses, ranging from 192.168.1.1 to 192.168.1.254. IPv6 is the next-generation network technology relative to IPv4, effectively solving the problem of insufficient IPv4 network address space and offering higher security. IPv6 addresses are 128 bits long, composed of an address prefix (usually 64 bits) and an interface identifier (usually 64 bits). IPv6 address users typically apply for an IPv6 address prefix (address range) from an IPv6 address registry and allocation authority, and then generate the interface identifier according to relevant specifications or custom methods. In existing IPv6 address or other IP address generation schemes, interface identifiers often directly use MAC addresses. However, MAC addresses contain information such as device manufacturer and operating system details, posing a risk of information leakage. By publicly disclosing the MAC address information within an IP address, external parties will know the network device's manufacturer and operating system information, increasing the risk of attacks using this information and reducing network security. Furthermore, existing network routing protocols do not perform security verification on the source address of network requests, making it impossible to prevent network address spoofing and network request hijacking. The embodiments of this invention generate interface identifiers based on distributed identity identifiers, replacing existing MAC addresses. Even if the IP address is publicly disclosed, there is no risk of privacy information being leaked through the IP address. Additionally, during communication using this IP address, verifiable credentials can be used to verify the IP address's correctness.

[0045] like Figure 1 As shown, an IP address verification method provided by an embodiment of the present invention is illustrated, which can be applied to, for example... Figure 2The network communication system 100 shown includes a first network device 110 and a second network device 120. In some embodiments, the network communication system 100 further includes an IP address allocation subsystem 130 and a distributed identity subsystem 140. The IP address allocation subsystem 130 interacts with the distributed identity subsystem 140 to obtain the distributed identity identifier of the first network device 110, and generates an IP address for the first network device 110 based on the distributed identity identifier. Subsequently, the first network device 110 organizes a network request based on the IP address and sends the network request to the second network device 120. The second network device 120 verifies the authenticity of the IP address of the first network device 110 in the network request, and processes the first network request after verification.

[0046] In some embodiments of the present invention, the IP address verification method can also be applied to inter-domain communication, and the network system 100 may further include a third network device 150. In some embodiments of the present invention, the second network device 120 and the first network device 110 are in the same local area network (LAN), and the third network device 150 is in another LAN. In this scenario, the second network device 120 may be a gateway device. In some embodiments of the present invention, the first network device 110 is in a first LAN, the third network device 150 is in a second LAN, and the second network device 120 is in a relay network. In some embodiments of the present invention, the second network device 120 may be a relay subsystem or a relay device.

[0047] In this embodiment of the invention, the network system 100 can also be used in a cross-chain scenario. The first network device 110 can be a source chain network node, the second network device 120 can be a relay subsystem, and the third network device 150 can be a destination chain network node. The first network device 110 sends the cross-chain network request to the second network device 120. The second network device 120 verifies the IP address of the first network device. After successful verification, it forwards the cross-chain network request to the third network device 150. The third network device 150 processes the network request and returns a response result to the second network device 120. The second network device 120 verifies the IP address of the third network device (its generation method is similar to that of the first network device). After successful verification, it returns a response result to the first network device 110.

[0048] In this embodiment of the invention, the IP address allocation subsystem 130 generates and allocates IP addresses for network devices. The IP address in this embodiment includes an IP address prefix and an IP address interface identifier. The IP address in this embodiment can be an IPv6 address or other types of IP addresses.

[0049] In this embodiment of the invention, the distributed identity subsystem 140 is established by a trusted institution, primarily providing support functions such as distributed identity issuance and verification. It can be implemented using a distributed or blockchain technology architecture. The IP address allocation subsystem 130 is mainly responsible for the generation and updating of IPv6 addresses for network devices, such as a DHCPv6 server. The IP address allocation subsystem 130 is generally an internal enterprise system that stores information about the organization's network nodes, such as the system network address prefix, the identifier of each network node and its MAC address (physical address), the public key of each network node, the complete IP address, and other information and their corresponding relationships. Each network node's MAC address is unique, and the MAC address can be used to represent the identity of the network node. If the MAC address is directly used to organize the IP address of the network node, there is a risk of exposing the network node's identity. In this embodiment of the invention, the IP address allocation subsystem 130 is generally located in the same security domain as the first network device and is a system with a network operation and maintenance management role. Considering the security of the IP address allocation subsystem 130, a front-end system can be deployed within the IP address allocation subsystem 130 to forward and interact with the distributed identity subsystem 140. The front-end system and the IP address allocation subsystem 130 can be regarded as a single system.

[0050] like Figure 1 The IP address verification method in this embodiment of the invention is applied to a second network device, and the verification method includes the following steps:

[0051] S210: Obtain the network request of the first network device 110. The network request of the first network device 110 includes the IP address of the first network device and the verifiable credentials of the first network device, wherein the IP address of the first network device includes the distributed identity identifier of the first network device.

[0052] Before the first network device initiates a network request in this embodiment of the invention, the IP address allocation subsystem 130 interacts with the distributed identity subsystem based on the information of the first network device to obtain the distributed identity identifier of the first network device, and generates the IP address of the first network device based on the distributed identity identifier of the first network device.

[0053] like Figure 3 As shown, the method by which the IP address allocation subsystem 130 generates the IP address of the first network device includes the following steps:

[0054] S201: The IP address allocation subsystem 130 sends a distributed identity request to the distributed identity subsystem. The distributed identity request includes the identity information and public key of the first network device. The identity information of the first network device includes its physical address (MAC address). In this embodiment, the IP address allocation subsystem can obtain the identity information and public key of the first network device from the first network device 110, or it can collect them manually and then import them into the IP address allocation subsystem 130. In this embodiment, the IP address allocation subsystem 130 can periodically send identity request requests to the distributed identity subsystem 140 to update the generated IP addresses and improve communication security. In some embodiments of this invention, if the initially generated IP address is duplicated with an already allocated IP address, the IP address allocation subsystem 130 can be triggered to send a distributed identity request to the distributed identity subsystem 140 again until the generated IP address is not duplicated with an already allocated IP address.

[0055] In an embodiment of the present invention, the identity information of the first network device 110 can be set to globally unique identity information, thereby ensuring the uniqueness of the generated distributed identity identifier.

[0056] In some embodiments of the present invention, the IP address allocation subsystem 130 also sends signature information to the distributed identity subsystem 140. Based on the signature information, the distributed identity subsystem 140 verifies that the IP address allocation subsystem 130 sent the distributed identity request, ensuring that the request information has not been tampered with. Specifically, the distributed identity subsystem 140 sending the distributed identity request further includes:

[0057] The system sends a signature information generated by signing the identity information of the first network device and the public key of the first network device using the private key of the first network device to the distributed identity subsystem 140, so that the distributed identity subsystem 140 can verify the signature information using the public key of the first network device.

[0058] In this embodiment of the invention, when the first network device 110 sends its identity information and public key to the IP address allocation subsystem 130, it also sends a signature generated by signing the identity information and public key of the first network device using its private key to the IP address allocation subsystem 130. The IP address allocation subsystem 130 sends the signature information to the distributed identity subsystem 140. The distributed identity subsystem 140 verifies the signature information based on the public key of the first network device 110. After successful verification, it proceeds with the subsequent operation of generating a distributed identity identifier.

[0059] S202: The IP address allocation subsystem 130 obtains the first network device distributed identity identifier generated by the distributed identity subsystem 140 based on the identity information of the first network device 110, the public key of the first network device 110 and random information, wherein the bit length n of the first network device distributed identity identifier is less than the bit length of the IP address interface identifier, and n is an integer greater than 0.

[0060] In the embodiments of the present invention, the distributed identity subsystem 140 generates a first network device distributed identity identifier based on the identity information of the first network device 110, the public key of the first network device 110, and random information. This ensures that the generated distributed identity identifier is associated with the identity of the first network device 110. At the same time, through random information, it ensures that the distributed identity identifiers generated at different times are different, and enables dynamic updating of the first network device distributed identity identifier.

[0061] In this embodiment of the invention, a distributed identity identifier for the first network device 110 can be generated by calculating the identity information, public key, and random information of the first network device 110 using a hash algorithm. In some embodiments of the invention, the number of bits in the generated hash value can be limited, for example, to a length of n; alternatively, the first n bits, the last n bits, or bits at intervals can be extracted from the generated hash value to obtain the distributed identity identifier for the first network device. In some embodiments of the invention, the hash algorithm used can be a Chinese cryptographic hash function algorithm, such as the SM3 function. In some embodiments of the invention, the length n of the distributed identity identifier can be fixed before generating the distributed identity identifier, for example, it can be 32 bits, 48 ​​bits, or 56 bits. In some embodiments of the invention, the length of the IP address interface identifier can be 64 bits.

[0062] In some embodiments of the present invention, the identity information of the first network device 110 may include the identifier of the first network device 110 and the physical address of the first network device 110. Since the physical address of a network device is globally unique, a distributed identity identifier is generated through the physical address of the first network device 110, so that different network devices generate different identifiers. The identifier of the first network device 110 may be a unique identifier of the first network device within a certain local area network, such as a device ID, a unique device name, etc.

[0063] In some embodiments of the present invention, the random information includes random timestamps or other random information to ensure the randomness of each generation of distributed identity identifiers.

[0064] In some embodiments of the present invention, when generating the distributed identity identifier of the first network device 110, the distributed identity subsystem 140 also generates a distributed identifier document corresponding to the distributed identity identifier, which stores the public key of the first network device 110. Subsequently, the public key of the first network device 110 can be obtained from the distributed identity subsystem 140 through the distributed identity identifier of the first network device 110.

[0065] S203: The IP address allocation subsystem 130 generates an IP address interface identifier based on the first network device's distributed identity identifier, or a combination of the first network device's distributed identity identifier and other relevant identification information of the first network device 110, and generates the first network device's IP address based on the pre-allocated IP address prefix and the IP address interface identifier.

[0066] In some embodiments of the present invention, other relevant identification information of the first network device 110 includes one or more of the following: first network device ID, first network device name, first network device tag, first network device public key, first network device model, first network device hostname, first network device serial number, first network device MAC address, first network device operating system version information, etc.

[0067] In some embodiments of the present invention, when the combination of the number of bits of the distributed identity identifier of the first network device and the number of bits of other related identification information of the first network device does not reach the length of the IP address interface identifier, a random number of length m is generated to make up the length of the IP address interface identifier, where m is an integer greater than 0; in the embodiments of the present invention, the number of bits m of the random number generated by the IP address allocation subsystem 130 can be fixed before the random number is generated, and an m-bit random number can be generated directly or m bits can be taken from the generated random number.

[0068] In this embodiment of the invention, the IP address interface identifier can be generated by concatenating the beginning and end, or by inserting and concatenating according to a set rule.

[0069] In some embodiments of the present invention, the distributed identity subsystem 140 may also store and forward the verifiable credentials of the first network device 110. The IP address allocation subsystem 130 receives the verifiable credentials of the first network device 110 sent by the distributed identity subsystem 140, and sends the IP address and verifiable credentials of the first network device 110 to the first network device 110. Subsequently, the first network device 110 organizes network requests based on its IP address and verifiable credentials.

[0070] In some embodiments of the present invention, the declaration portion of the verifiable credential of the first network device 110 includes verifiable information of the first network device 110, and the verifiable portion of the verifiable credential of the first network device 110 includes a signature of the declaration portion using the issuer's private key.

[0071] In some embodiments of the present invention, the verifiable information of the first network device 110 includes the identity information of the first network device 110, and may further include the distributed identity identifier of the first network device 110.

[0072] In some embodiments of the present invention, the distributed identity subsystem 140 stores the distributed identity identifier of the first network device 110, and stores the public key of the issuing party corresponding to the distributed identity identifier of the first network device. In some embodiments of the present invention, the issuing party can be the distributed identity subsystem 140 or other trusted systems.

[0073] In some embodiments of the present invention, the issuer is a distributed identity subsystem 140, and within the distributed identity subsystem 140, a public key of the distributed identity subsystem 140 is stored corresponding to the distributed identity identifier of the first network device 110.

[0074] In some embodiments of the present invention, the issuer is another trusted system. After the other trusted system issues the verifiable credential of the first network device 110, it sends the distributed identity identifier of the first network device 110 and the public key of the other trusted system to the distributed identity subsystem 140 for storage.

[0075] In this embodiment of the invention, the distributed identity identifier information of the first network device 110 is used in the process of generating the IP address of the first network device 110. Subsequently, during communication, the distributed identity identifier can also be used to verify the IP address of the first network device. For example, according to preset rules, the first 32 bits of the interface identifier are the distributed identity identifier; therefore, by verifying the correctness of the distributed identity identifier, the correctness of the IP address is verified. In this embodiment, after generating the distributed identity identifier, the distributed identity subsystem 140 issues a verifiable credential (VC) using the issuer's private key and sends the verifiable credential to the IP address allocation subsystem 130. The IP address allocation subsystem 130 forwards the credential and IP address to the first network device 110. Subsequently, during external communication, the first network device 110 can include the verifiable credential. The communicating partner can obtain the issuer's public key from the distributed identity subsystem based on the distributed identity identifier and use the issuer's public key to verify the verifiable credential of the first network device. If the verification is correct, the IP address in the network request of the first network device is correct, thus ensuring communication security through IP address verification.

[0076] In some embodiments of the present invention, the distributed identity subsystem 140 can use its private key to sign the distributed identity identifier of the first network device 110 to generate a verifiable credential. The verifiable credential includes the distributed identity identifier of the first network device 110 and the signature of the distributed identity identifier of the first network device 110 (generated based on the private key signature of the distributed identity subsystem). The process of verifying the verifiable credential is to verify the signature of the distributed identity identifier of the first network device using the public key of the distributed identity subsystem 140.

[0077] In some embodiments of the present invention, the distributed identity subsystem 140 can generate verifiable credentials based on the identity information of the first network device 110 and the distributed identity identifier of the first network device, or it can generate verifiable credentials based on the identity information of the first network device 110, the public key of the first network device, and the distributed identity identifier of the first network device.

[0078] In this embodiment of the invention, to avoid duplicate generated IP addresses, a deduplication detection is performed before finally allocating the IP address of the first network device. Specifically, it also includes:

[0079] Check if the IP address of the first network device conflicts with the deployed IP address. If a conflict exists, update the random number and regenerate the IP address of the first network device.

[0080] In this embodiment of the invention, when a conflict is detected between the IP address of the first network device and an already deployed IP address, a random number is regenerated cyclically and concatenated again to generate an IP address until there is no duplicate IP address. This ensures the uniqueness of the IP address.

[0081] In some embodiments of the present invention, the IP address of the first network device can be updated periodically or actively triggered to update the IP address of the first network device. When regenerating the IP address, steps S201 to S203 in the embodiments of the present invention can be re-executed.

[0082] S220: Verify the verifiable credentials of the first network device 110 based on the distributed identity identifier of the first network device 110 to determine whether the IP address of the first network device has been verified. When the verifiable credentials have been verified, the IP address has been verified.

[0083] In some embodiments of the present invention, the verifiable credential includes signature information, wherein the signature information is generated by the issuer based on the issuer's private key; the distributed identity subsystem stores the distributed identity identifier of the first network device and, corresponding to the distributed identity identifier of the first network device 110, stores the issuer's public key, and the issuer's public key corresponds to the issuer's private key; such as Figure 4 As shown, the verification of verifiable credentials for the first network device includes:

[0084] S221: Obtain the issuer's public key from the distributed identity subsystem 140 based on the distributed identity identifier of the first network device 110; the distributed identity subsystem 140 stores the distributed identity identifier of the first network device 110 and the corresponding issuer's public key, and can query and obtain the issuer's public key based on the distributed identity identifier. In some embodiments of the present invention, the issuer can be the distributed identity subsystem 140.

[0085] S222: Verify the signature information in the verifiable credential using the issuer's public key. The signature information is verified using the issuer's public key.

[0086] In some embodiments of the present invention, the second network device 120 pre-stores the identity information of the first network device 110; the signature information in the verifiable credential is generated by the issuer signing the verifiable information of the first network device 110 based on the issuer's private key, and the verifiable information of the first network device 110 includes the identity information of the first network device 110; such as Figure 5 As shown, the signature information in the verifiable credential is verified using the issuer's public key, including:

[0087] S2221: The signature information in the verifiable credential is verified using the issuer's public key to obtain the identity information of the first network device 110 from the verifiable credential; the signature information is verified based on the issuer's public key. If the verification passes, the identity information of the first network device 110 is obtained from the verifiable credential. In some embodiments of the present invention, the identity information of the first network device 110 can be used as the declaration part of the verifiable credential, and the signature information as the proof part of the verifiable credential. Successful verification indicates that the content of the declaration part is credible.

[0088] S2222: Verify the identity information of the first network device 110 in the verifiable credential based on the pre-stored identity information of the first network device 110. Compare the pre-stored identity information of the first network device 110 with the identity information of the first network device in the verifiable credential; if they do not match, the verification fails. By verifying the correctness of the identity information in the verifiable credential, the correctness of the distributed identity identifier in the IP address is verified.

[0089] In some embodiments of the present invention, the correctness of the distributed identity in the IP address can be further verified by verifying the correspondence between the distributed identity identifier and the identity information. Specifically, the verifiable information of the first network device also includes the distributed identity identifier of the first network device; such as Figure 6As shown, the verification of the signature information in the verifiable credential based on the issuer's public key includes steps S2221 and S2222 (steps S2221 and S2222 are consistent with the steps in the previous embodiment and will not be repeated here), and also includes:

[0090] S2223: Verify the signature information in the verifiable credential using the issuer's public key to obtain the distributed identity identifier of the first network device 110 from the verifiable credential; verify the signature information based on the issuer's public key; if the verification is successful, obtain the distributed identity identifier of the first network device from the verifiable credential. In some embodiments of the present invention, the distributed identity identifier and identity information of the first network device 110 can serve as the declaration part of the verifiable credential, and the signature information as the proof part of the verifiable credential. Successful verification indicates that the content of the declaration part is credible.

[0091] S2224: Verify the distributed identity identifier of the first network device 110 in the verifiable credential based on the distributed identity identifier in the IP address of the first network device 110. Compare the pre-stored distributed identity identifier of the first network device with the distributed identity identifier of the first network device in the verifiable credential; if they do not match, the verification fails. By verifying the correctness of the identity information and the distributed identity identifier in the verifiable credential, the correctness of the distributed identity identifier in the IP address is verified. In this embodiment of the invention, after verifying the identity information, the distributed identity identifier is also verified, thereby verifying the correspondence between the identity information and the distributed identity identifier.

[0092] It should be noted that the order of the steps for verifying the distributed identity identifier of the first network device 110 and the steps for verifying the identity information of the first network device 110 in this embodiment of the invention is not limited. The verification of the distributed identity identifier can be performed first, or the verification of the identity information can be performed first.

[0093] In the embodiments of the present invention, not only is the identity information in the credential verified to be consistent with the pre-stored identity information, but also the distributed identity identifier in the credential is verified to be consistent with the pre-stored distributed identity identifier, thus performing multiple verifications and improving the reliability of verification.

[0094] In some embodiments of the present invention, the address prefix in the IP address can also be verified to achieve multiple verifications. Specifically, the IP address of the first network device also includes an address prefix; the second network device pre-stores the address prefix of the IP address of the first network device; the verification method further includes: verifying the IP address of the first network device according to the pre-stored address prefix of the IP address of the first network device.

[0095] In some embodiments of the present invention, the distributed identity identifier of the first network device 110 is generated by the distributed identity subsystem 140 based on random time information and first network device distributed identity generation information. The first network device distributed identity identifier generation information includes one or more of the identifier of the first network device 110, the physical address of the first network device 110, and the public key of the first network device 110. The use of random time information in the generation of the distributed identity identifier ensures the randomness of the generated distributed identity identifier and avoids the risk of identification cracking due to prolonged use of the same identifier.

[0096] The IP address verification method of this invention includes a distributed identity identifier embedded in the IP address. The receiving party pre-stores the identity information of the communication initiator, the distributed identity identifier, and the IP address prefix. During a network request, the initiator sends the IP address and verifiable credentials to the counterparty. The counterparty uses the distributed identifier in the IP address to obtain the public key of the verifiable credentials from the distributed identity subsystem and verifies the signature information in the verifiable credentials. The initiator's identity information is read from the verifiable credentials and compared with the pre-stored identity information. Further verification can be performed by reading the distributed identity identifier from the verifiable credentials and comparing it with the pre-stored distributed identity identifier. Additionally, the address prefix in the IP address can be compared with the pre-stored address prefix. After multiple verifications pass, the IP address is verified correctly. This multi-layered verification ensures communication security and avoids the risk of source address spoofing.

[0097] The IP address verification method in this invention embodiment can be applied in cross-chain scenarios, such as... Figure 7 As shown, some other embodiments of the present invention provide an IP address verification method applicable to, for example... Figure 8 In the cross-chain network system shown, the embodiments of the present invention include the following relevant parameters:

[0098] 1) Chain-A_Node_a_ID: A standard identity identifier for a network device node a (server host, gateway, switch, router, etc.) in source chain A.

[0099] 2) Node_a_MAC: The hardware address of the network device node a, used for physical layer identification and device identification, and is generally assigned by the device manufacturer during manufacturing.

[0100] 3) Node_a_DID: A distributed identity identifier issued by the distributed identity subsystem for network device node a. It typically requires identity verification with the distributed identity subsystem before the distributed identity subsystem issues the Node_a_DID. Its length is n bits, where n < 64.

[0101] 4) Node_a_DID-VC: This is a verifiable credential issued by the distributed identity subsystem for network device node a. It is the signature information of the network device node's identity information using its private key by the distributed system.

[0102] 5) Node_a_DID-DOC: The distributed identity subsystem stores information related to network device node a, mainly the mapping relationship between Node_a_DID and other related information (such as Node_a_MAC, public key of network device node a, etc.).

[0103] 6) IP_A: The IP address of source chain A.

[0104] 7) Node_a_PrefixIP: The address prefix of the IP address of node a, such as the first 64 bits.

[0105] 8) Node_a_Suffix IP: The address suffix (interface identifier) ​​of the IP address of node a, such as the last 64 bits.

[0106] 9) Node_a_IP: The complete IP address of node a, usually composed of an address prefix and an address suffix, 128 bits.

[0107] 10) IP_Relay: The IP address of the relay subsystem Relay.

[0108] 11) Pk, Sk: Public and private keys. In this scheme, the public and private keys of network node a are identified as Node_a_Pk and Node_a_Sk; the public and private keys of the distributed identity subsystem are identified as DIDsystem_Pk and DIDsystem_Sk; and the public and private keys of the relay subsystem are identified as Relay_Pk and Relay_Sk.

[0109] like Figure 7 As shown, the steps in this embodiment of the invention include:

[0110] S310: The IP address generation subsystem interacts with the distributed identity subsystem to request a DID identifier. Specifically, as follows... Figure 9 As shown, it includes the following steps:

[0111] S311: The IP address generation subsystem and the distributed identity subsystem establish a secure connection channel.

[0112] S312: The IP address generation subsystem initiates a DID request for Node_a, and submits the network device node a's regular identity identifier Node_a_ID, MAC address Node_a_MAC, public key Node_a_Pk, and Node_a_Sk to the distributed identity subsystem to sign this information.

[0113] S313: The distributed identity subsystem verifies signatures based on the public key Node_a_Pk. It performs a hash operation based on information such as the regular identity identifier Node_a_ID, MAC address Node_a_MAC, public key Node_a_Pk, and timestamp (ensuring randomness), generating the hash result hash1.

[0114] S314: Based on the rules, select n bits from the hash result hash1 to generate an n-bit Node_a_DID.

[0115] S315: The distributed system generates a credential (signature) Node_a_DID-VC based on information such as Node_a_ID, MAC address Node_a_MAC, public key Node_a_Pk, and Node_a_DID, using the private key DIDsystem_Sk.

[0116] S316: The distributed identity subsystem generates identity document information related to Node_a_DID, namely Node_a_DID-DOC. The identity document information mainly includes mapping relationships such as Node_a_DID and Node_a_ID, MAC address Node_a_MAC, and public key Node_a_Pk.

[0117] S317: The distributed identity subsystem returns the distributed identity DID identifier Node_a_DID and credential information Node_a_DID-VC of Node_a to the IP address generation subsystem.

[0118] In this embodiment of the invention, the logic of the IP address generation subsystem interacting with the distributed identity subsystem to apply for the DID of a node in chain B is similar to the logic of applying for the DID described above.

[0119] S320: Assign and generate Node_a_IP address. For example... Figure 10 As shown, the specific process is as follows:

[0120] S321: The IP address generation subsystem combines Node_a_DID and other relevant identification information to generate a 64-bit address suffix (interface identifier) ​​Node_a_Suffix IP. That is, Node_a_DID is a part of the address suffix (interface identifier). In some embodiments of this invention, other relevant identification information includes node ID, node name, node tag, node public key, device model, hostname, serial number, MAC address, operating system version information, etc.

[0121] S322: Combine the allocated Node_a_PrefixIP (64-bit) and Node_a_Suffix IP to generate a 128-bit IPv6 address Node_a_IP.

[0122] S323: Configure Node_a_IP on network device node a.

[0123] S330: The relay subsystem verifies the source address of node a. In this embodiment of the invention, the relay subsystem pre-stores the IP prefix information of node a, such as Node_a_PrefixIP and Node_a_MAC, as a whitelist. The specific verification steps are as follows: Figure 11 As shown, it includes:

[0124] S331: Source chain A and the relay subsystem establish a secure connection and initiate a cross-chain request. The cross-chain request is initiated by node a in chain A to node b in chain B, passing through the relay subsystem. The IP layer packet content of the cross-chain request includes: Node_a_IP (source address), Node_a_DID-VC, relay subsystem IP, and other information.

[0125] S332: After receiving the IP packet from node a, the relay subsystem performs source address multi-verification.

[0126] Mainly includes:

[0127] 1. Read the IP prefix Node_a_PrefixIP from Node_a_IP and verify it against the stored one. If the verification fails, proceed with the cross-chain operation.

[0128] 2. After successful verification, read the DID identifier Node_a_DID and the corresponding Node_a_DID-VC from the IP suffix (interface identifier) ​​in Node_a_IP.

[0129] 3. The relay subsystem accesses the distributed identity subsystem based on the DID identifier Node_a_DID and obtains the verification public key DIDsystem_Pk from it.

[0130] 4. The relay subsystem verifies Node_a_DID-VC based on the obtained public key DIDsystem_Pk. The verification includes signature verification, as well as verification of information such as the MAC address in the credential and the correspondence between DID and MAC address.

[0131] S333: After successful verification, the relay subsystem continues to construct a cross-chain request to chain B and proceed with subsequent cross-chain requests.

[0132] After receiving the cross-chain request from the relay subsystem, and after the relay subsystem receives the cross-chain result from chain B, the destination chain B can also perform source address verification. The approach is the same as above.

[0133] This invention proposes a novel IP source address verification method for cross-chain scenarios, combining distributed identity technology. This enhances the security of source address verification while providing a degree of privacy protection. The integration of distributed identity technology also offers improved traceability support.

[0134] like Figure 12 As shown, this embodiment of the invention provides an IP address verification device 400, applied to a second network device. The device 400 includes an acquisition module 410 and a verification module 420, wherein...

[0135] The acquisition module 410 is configured to acquire the network request of the first network device. The network request of the first network device includes the IP address of the first network device and the verifiable credentials of the first network device. The IP address of the first network device includes the distributed identity identifier of the first network device generated by the distributed identity subsystem.

[0136] The verification module 420 is configured to verify the IP address of the first network device based on the distributed identity identifier and verifiable credentials of the first network device.

[0137] In some embodiments of the present invention, the verifiable credential includes signature information, wherein the signature information is generated by the issuer based on the issuer's private key; the distributed identity subsystem stores the distributed identity identifier of the first network device, and corresponding to the distributed identity identifier of the first network device, stores the issuer's public key, the issuer's public key corresponding to the issuer's private key; the verification module 420 is further configured to: obtain the issuer's public key from the distributed identity subsystem according to the distributed identity identifier of the first network device; and verify the signature information in the verifiable credential according to the issuer's public key.

[0138] In some embodiments of the present invention, the second network device pre-stores the identity information of the first network device; the signature information is generated by the issuer signing the verifiable information of the first network device based on the issuer's private key, and the verifiable information of the first network device includes the identity information of the first network device; the verification module 420 is further configured to: perform signature verification processing on the signature information in the verifiable credential according to the issuer's public key to obtain the identity information of the first network device in the verifiable credential; and verify the identity information of the first network device in the verifiable credential based on the pre-stored identity information of the first network device.

[0139] In some embodiments of the present invention, the verifiable information of the first network device further includes the distributed identity identifier of the first network device; the verification module 420 is further configured to: perform signature verification processing on the signature information in the verifiable credential according to the issuer's public key to obtain the distributed identity identifier of the first network device in the verifiable credential; and verify the distributed identity identifier of the first network device in the verifiable credential based on the distributed identity identifier in the IP address of the first network device.

[0140] In some embodiments of the present invention, the IP address of the first network device further includes an address prefix; the second network device pre-stores the address prefix of the IP address of the first network device; the device further includes an address prefix verification module 430, which is configured to verify the IP address of the first network device according to the pre-stored address prefix of the IP address of the first network device.

[0141] In some embodiments of the present invention, the identity information of the first network device includes the physical address of the first network device.

[0142] In some embodiments of the present invention, the issuing party includes a distributed identity subsystem.

[0143] In some embodiments of the present invention, the distributed identity of the first network device is generated by the distributed identity subsystem based on random time information and the distributed identity generation information of the first network device, wherein the distributed identity generation information of the first network device includes one or more of the identifier of the first network device, the physical address of the first network device, and the public key of the first network device.

[0144] The device features of the embodiments of the present invention can be referred to the features of the methods and steps of the embodiments of the present invention, and the system embodiments can be combined with the features of the method embodiments to obtain new embodiments, and vice versa, and will not be repeated here.

[0145] An embodiment of the present invention provides an electronic device comprising: a processor and a memory storing a computer program, wherein the processor is configured to implement a method for IP address verification according to any embodiment of the present invention when running the computer program. Additionally, apparatus for implementing IP address verification according to an embodiment of the present invention may also be provided.

[0146] Figure 13 An exemplary system architecture 1300 is shown that can be applied to the IP address verification method or IP address verification device of the present invention.

[0147] like Figure 13As shown, system architecture 1300 may include terminal devices 1301, 1302, and 1303, network 1304, and server 1305. Network 1304 is used as a medium to provide a communication link between terminal devices 1301, 1302, and 1303 and server 1305. Network 1304 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0148] Users can use terminal devices 1301, 1302, and 1303 to interact with server 1305 via network 1304 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 1301, 1302, and 1303, such as gateway configuration applications, communication applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0149] Terminal devices 1301, 1302, and 1303 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0150] Server 1305 can be a server that provides various services, such as a backend management server that supports shopping websites browsed by users using terminal devices 1301, 1302, and 1303 (for example only). The backend management server can analyze and process data such as received product information query requests, and feed back the processing results (such as target push information and product information - for example only) to the terminal devices.

[0151] It should be noted that the IP address verification method provided in this embodiment of the invention is generally executed by server 1305, and correspondingly, the IP address verification implementation device is generally set in server 1305.

[0152] It should be understood that Figure 13 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0153] The following is for reference. Figure 14 It shows a schematic diagram of the structure of a computer system 1400 suitable for implementing terminal devices or servers of the present invention. The methods or apparatus for implementing the methods in the embodiments of the present invention can be implemented on the computer system 1400. Figure 14 The terminal device or server shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present invention.

[0154] like Figure 14As shown, the computer system 1400 includes a central processing unit (CPU) 1401, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 1402 or programs loaded from storage section 1408 into random access memory (RAM) 1403. The RAM 1403 also stores various programs and data required for the operation of the system 1400. The CPU 1401, ROM 1402, and RAM 1403 are interconnected via a bus 1404. An input / output (I / O) interface 1405 is also connected to the bus 1404.

[0155] The following components are connected to I / O interface 1405: an input section 1406 including a keyboard, mouse, etc.; an output section 1407 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1408 including a hard disk, etc.; and a communication section 1409 including a network interface card such as a LAN card, modem, etc. The communication section 1409 performs communication processing via a network such as the Internet. A drive 1410 is also connected to I / O interface 1405 as needed. Removable media 1411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1410 as needed so that computer programs read from them can be installed into storage section 1408 as needed.

[0156] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1409, and / or installed from removable medium 1411. When the computer program is executed by central processing unit (CPU) 1401, it performs the functions defined above in the system of this invention.

[0157] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0158] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0159] The units or modules described in the embodiments of the present invention can be implemented in software or hardware. The described units or modules can also be housed in a processor; for example, a processor can be described as including a sending unit (or "module"), an acquisition unit, a determining unit, and a first processing unit. The names of these units or modules do not necessarily limit the specific unit or module itself; for example, a sending unit can also be described as "a unit that sends an image acquisition request to a connected server."

[0160] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs that, when executed by the device, cause the device to perform the IP address verification method in the above embodiments.

[0161] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. An IP address verification method, characterized in that, Applied to a second network device, the method includes the following steps: Obtain a network request from a first network device, wherein the network request from the first network device includes the IP address of the first network device and verifiable credentials of the first network device, wherein the IP address of the first network device includes the distributed identity identifier of the first network device; The verifiable credentials of the first network device are verified based on the distributed identity identifier of the first network device to determine whether the IP address of the first network device has been successfully verified. The verifiable credential includes signature information, wherein the signature information is generated by the issuer based on the issuer's private key; the distributed identity identifier of the first network device and the public key of the issuer are stored in the distributed identity subsystem, and the public key of the issuer corresponds to the distributed identity identifier of the first network device; the verification of the verifiable credential of the first network device based on the distributed identity identifier of the first network device includes: The issuer's public key is obtained from the distributed identity subsystem based on the distributed identity identifier of the first network device; The signature information in the verifiable credential is verified using the issuer's public key.

2. The method according to claim 1, characterized in that, The signature information is generated by the issuing party signing the verifiable information of the first network device based on the issuing party's private key. The verifiable information of the first network device includes the identity information of the first network device. The step of verifying the signature information in the verifiable credential based on the issuer's public key includes: The signature information in the verifiable credential is verified using the public key of the issuing party to obtain the identity information of the first network device in the verifiable credential. The identity information of the first network device in the verifiable credentials is verified based on the pre-stored identity information of the first network device.

3. The method according to claim 2, characterized in that, The verifiable information of the first network device also includes the distributed identity identifier of the first network device; The step of verifying the signature information in the verifiable credential based on the issuer's public key includes: The signature information in the verifiable credential is verified using the public key of the issuing party to obtain the distributed identity identifier of the first network device in the verifiable credential. The distributed identity identifier of the first network device in the verifiable credentials is verified based on the distributed identity identifier in the IP address of the first network device.

4. The method according to any one of claims 1 to 3, characterized in that, The IP address of the first network device also includes an address prefix; the method further includes: The address prefix in the IP address of the first network device is verified based on the pre-stored address prefix of the first network device's IP address.

5. The method according to claim 2, characterized in that, The identity information of the first network device includes the physical address of the first network device.

6. The method according to any one of claims 1 to 3, characterized in that, The issuing party includes the distributed identity subsystem.

7. The method according to claim 1, characterized in that, The distributed identity of the first network device is generated by the distributed identity subsystem based on random time information and the distributed identity generation information of the first network device, wherein the distributed identity generation information of the first network device includes one or more of the first network device's identifier, the first network device's physical address, and the first network device's public key.

8. An IP address verification device, characterized in that, Applied to a second network device, the device includes an acquisition module and a verification module, wherein, The acquisition module is configured to acquire a network request from a first network device. The network request from the first network device includes the IP address of the first network device and verifiable credentials of the first network device, wherein the IP address of the first network device includes the distributed identity identifier of the first network device. The verification module is configured to verify the verifiable credentials of the first network device based on the distributed identity identifier of the first network device, in order to determine whether the IP address of the first network device has been successfully verified. The verifiable credential includes signature information, wherein the signature information is generated by the issuer based on the issuer's private key; the distributed identity identifier of the first network device and the public key of the issuer are stored in the distributed identity subsystem, and the public key of the issuer corresponds to the distributed identity identifier of the first network device; the verification module is further configured to: The issuer's public key is obtained from the distributed identity subsystem based on the distributed identity identifier of the first network device; The signature information in the verifiable credential is verified using the issuer's public key.

9. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-7.

10. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.

Images