User identity, source address and path verification method and system, storage medium

Abstract

The application discloses a user identity, source address and path verification method and system and a storage medium, and integrates a decentralized identity (DID) with source path verification through a distributed key distribution server (KDS) infrastructure. According to the technical scheme of the application, the user identity, address, path and data are bound through encryption and hop-by-hop address conversion, and privacy is maintained through encrypted path verification.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a method and system for verifying user identity, source address and path, as well as a storage medium. Background Technology

[0002] As the internet continues to expand and cybersecurity threats become increasingly complex, traditional network architectures have exposed significant security vulnerabilities in source address verification and path verification. While the current "narrow-waisted" design of the internet has laid the foundation for network development, its lack of built-in security verification mechanisms has led to increasingly serious security threats such as BGP hijacking, DDoS attacks, and AI-based attacks.

[0003] Source address verification is a fundamental requirement for network security. In existing networks, the source address of data packets is easily forged, allowing attackers to easily launch IP spoofing attacks, making it difficult to trace the source of the attack. Although various source address verification technologies have been proposed in the industry, these technologies often only verify network layer identifiers and cannot trace back to the specific user identity.

[0004] Path verification technology aims to ensure that data packets are forwarded along the intended path, preventing path hijacking and traffic redirection attacks. Traditional path verification schemes typically rely on path identifiers or cryptographic tokens, but these suffer from high computational overhead and complex deployment. Furthermore, existing schemes often expose path information during the verification process, posing a risk to network privacy.

[0005] With the rise of the W3C's Decentralized Identity (DID) standard and the increasing prevalence of users accessing networks via multiple devices, network operators face a greater challenge: how to achieve accurate user behavior tracking and network accountability while protecting user privacy. Existing identity management and network authentication technologies are separate and lack effective integration mechanisms, making it difficult to meet the comprehensive requirements of next-generation networks for security, privacy, and deployability.

[0006] The academic community has proposed various solutions to the source address and path verification problem. These solutions can be broadly categorized into two types: revolutionary approaches and incremental enhancement approaches. Revolutionary approaches, such as OPT and EPIC, propose fundamental redesigns of network architecture, while incremental approaches, such as PPV, PAVI, and MASK, focus on incremental improvements to existing protocols. However, all these solutions face a fundamental trade-off between privacy protection and network security: strengthening path verification and source authentication often compromises privacy, while privacy protection may hinder the security controls of network providers.

[0007] The existing technology has the following drawbacks:

[0008] (1) Insufficient identity tracking capabilities: Existing solutions (OPT, PPV, EPIC, PAVI, MASK, path-hiding verification methods, etc.) only verify the source address or host identifier of data packets, without integrating the identity information of network users. With the increasing popularity of the W3C's DID standard and users accessing the network through multiple devices, operators find it difficult to achieve accurate user behavior tracking.

[0009] (2) The dilemma of balancing privacy and security: Current solutions either over-expose end-user information (such as including plaintext source addresses and path information in packet extension headers), making end-users vulnerable to traffic analysis and correlation attacks; or over-protect end-user privacy, preventing network providers from implementing necessary security controls. This either-or design philosophy makes it difficult to simultaneously achieve end-user privacy protection and network security management.

[0010] (3) Insufficient Deployment Incentives: Most existing solutions not only introduce new identifiers at the technical level, increasing the difficulty of integration with existing network infrastructure, but more importantly, they fail to meet the needs of both end users and network providers. End users resist adoption due to privacy concerns, while network providers lack the motivation to deploy due to limited security control capabilities.

[0011] (4) Complex cryptographic operations: The authentication process uses complex elliptic curve cryptography (ECC), bilinear pairing or large number calculations. These operations are not friendly to resource-constrained devices and increase the difficulty of deployment.

[0012] (5) Over-reliance on third-party trust institutions: Frequent interaction with trust institutions during the authentication process can overload these institutions, potentially leading to security issues and single points of failure. Summary of the Invention

[0013] The technical problem to be solved by the present invention is to provide a method and system for verifying user identity, source address and path, as well as a storage medium.

[0014] To achieve the above objectives, the present invention adopts the following technical solution:

[0015] A method for verifying user identity, source address, and path includes:

[0016] Step S1: Generate decentralized identifiers through the Key Distribution Server (KDS) and convert them into anonymous identifiers for storage on the blockchain;

[0017] Step S2: Calculate the secure privacy path and encrypted materials through the Key Distribution Server (KDS) and distribute them to each intermediate network element;

[0018] Step S3: Embed identity information and encrypted path information into the data packet and initialize the path verification mark;

[0019] Step S4: Verify identity hop by hop and update path markers, while simultaneously verifying identity and path integrity.

[0020] Preferably, in step S2, after KDS receives the transmission request from the source, it determines the path PATH=(id) S ,id1,id2,...,id n ,id D KDS generates the symmetric key between adjacent intermediate network element pairs: K path ={k sd ,k0,k1,...,k n} and the secret value α = {α S ,α1,...,α D} and distribute it to each node;

[0021] KDS computation path encryption material:

[0022]

[0023] P i =β i [0:32]⊕id i ,

[0024] β=β0⊕β1⊕...⊕β n ,

[0025] And set MSG_KDS = {β, PATH = (P0, P1, ..., P n )} is sent to the source.

[0026] Preferably, step S3 includes:

[0027] Step S31: The source receives MSG_KDS = {β, PATH = (P0, P1, ..., P...} n After that, the checksum seed for the packet payload and source identity is calculated using the following formula:

[0028]

[0029] Where H() is the hash function, To use key k sd Encrypt the value;

[0030] And calculate the actual next-hop path based on the first-hop encrypted path P0:

[0031] Step S32: The source AID serves as the basic anonymous identifier, and each preceding hop uses a symmetric key shared with the next hop to encrypt the identifier.

[0032]

[0033] IID0 = ε0[0:64] ⊕ AID (AID is the anonymous user identifier, IID0 is the address label)

[0034] Where ε0 is an intermediate parameter, TS0 is the timestamp of the user processing the data packet and is embedded in the extended header, id1 is an intermediate network element identifier, and k0 is the symmetric key between the user and the first-hop routing node.

[0035] Step S33: Calculate path verification information: Mark0 = ε0⊕seed⊕β0⊕β.

[0036] Preferably, in step S4, each network element ID i Upon receiving the data packet, first look up the symmetric key k between the previous hop and the previous hop. i-1 ,calculate:

[0037]

[0038] Decrypt the next-hop network element node: id i+1 =β i [0:32]⊕P i

[0039] Find the key k negotiated with the next hop. i Get the timestamp and calculate

[0040] The IID embedded in the packet from the previous hop. i-1 The anonymous identity of the source is calculated in the middle:

[0041] AID'=ε i-1 [0:64]⊕IID i The system requests KDS to verify the authenticity of the AID and whether there have been any recent communication requests. If the AID is invalid, the data packet is discarded and an error message is reported; if the AID is valid, the AID is re-encrypted to generate an IID. i =ε i [0:64]⊕AID',

[0042] Last updated path verification information: Mark i =Mark i-1 ⊕β i ⊕ε i-1 ⊕ε i .

[0043] Preferably, in step S4, the destination ID D After receiving the data packet, look up the symmetric key k between the previous hop and the previous hop. n ,calculate:

[0044]

[0045] Mark D =Mark n ⊕ε n

[0046] AID'=ε n [0:64]⊕IID n

[0047] Destination query KDS to obtain k sd Decrypt Mark D calculate:

[0048] Verify whether AID matches AID'. If they match, the source identity and path verification is successful; otherwise, the verification fails.

[0049] As a preferred option, the destination queries the key k from the KDS based on the AID. sd Choose to query only in the first package.

[0050] This invention also provides a user identity, source address, and path verification system, comprising:

[0051] The first processing module is used to generate decentralized identifiers through the Key Distribution Server (KDS) and convert them into anonymous identifiers for storage on the blockchain;

[0052] The second processing module is used to calculate the secure privacy path and encrypted materials through the key distribution server KDS and distribute them to each intermediate network element;

[0053] The third processing module is used to embed identity information and encrypted path information into the data packet and initialize the path verification flag;

[0054] The fourth processing module is used to verify identity hop by hop and update path markers, while also performing identity and path integrity verification.

[0055] The present invention also provides a storage medium, comprising: a memory and a processor, wherein the memory stores a computer program executed by the processor, and the computer program, when executed by the processor, performs a user identity, source address and path verification method.

[0056] This invention designs an identity-aware privacy-enhancing source and path verification method, which has the following technical effects:

[0057] (1) Triple verification of identity, source address and path: Integrating decentralized identity (DID) with network layer verification mechanism to achieve secure association of user identity, address, path and data.

[0058] (2) Balancing privacy protection and network accountability: By providing end users with comprehensive privacy protection through customizable verification services, the system verifies identity, source, and path while retaining the ability to securely control authorization tracking.

[0059] (3) Lightweight authentication mechanism: It adopts a hash-based lightweight algorithm to avoid complex elliptic curve cryptography operations, which is suitable for resource-constrained IoT devices.

[0060] (4) Reduce reliance on third-party trust institutions: Design a distributed key distribution server (KDS) architecture to reduce reliance on a single trust institution.

[0061] (5) Practical deployment solution: The IPv6 extension header design ensures seamless integration with the existing network and minimizes modifications to the existing infrastructure. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0063] Figure 1 This is a schematic diagram illustrating the data processing of the user identity, source address, and path verification method according to an embodiment of the present invention;

[0064] Figure 2 This is a schematic diagram of the data packet processing process;

[0065] Figure 3 This is a schematic diagram of a data packet structure. Detailed Implementation

[0066] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0067] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0068] Example 1:

[0069] like Figure 1 , 2 As shown, this invention provides a method for verifying user identity, source address, and path. Through collaborative interaction between terminal devices, intermediate network elements, a key distribution server (KDS), and blockchain infrastructure, it achieves secure path verification based on identity, comprising five key stages: In the user identity management stage, KDS generates a decentralized identifier (DID) and converts it into an anonymous identifier (AID) stored on the blockchain; in the forwarding path generation stage, KDS calculates the secure path and encrypted materials and distributes them to each intermediate network element; in the source processing stage, identity information is embedded in the data packet and path verification tags are initialized; in the intermediate network element processing stage, identity is verified hop-by-hop and path tags are updated; and in the destination processing stage, final identity and path integrity verification is completed. This invention ensures identity anonymity and path verifiability during data transmission through symmetric key encryption, hop-by-hop tag conversion, and cumulative verification mechanisms.

[0070] Furthermore, the role of terminal devices (source and destination):

[0071] As the ultimate initiator and consumer of network traffic;

[0072] Establish a secure communication channel and embed identity information and encrypted path information into data packets;

[0073] The role of intermediate network elements:

[0074] Perform packet forwarding and participate in the identity and path verification process;

[0075] It holds a symmetric key shared with adjacent network elements;

[0076] Perform hop-by-hop label transition.

[0077] The role of a Key Distribution Server (KDS):

[0078] A trusted entity responsible for key management and distribution across domains (such as the Autonomous System (AS) domain, routing domain, etc.);

[0079] At least one KDS is running in each domain;

[0080] Manage the mapping of decentralized identifiers (DIDs) and their anonymous identifiers (AIDs);

[0081] The role of blockchain infrastructure:

[0082] A distributed ledger jointly maintained by the KDS network;

[0083] Provides immutable, consensus-based records for identity authentication.

[0084] The user identity, source address, and path verification method of the present invention includes the following steps:

[0085] Phase 1: User Identity Management

[0086] KDS processes user attributes to generate unique DIDs, which are recorded on the blockchain for immutable verification. To enhance privacy, these DIDs are converted into AIDs using a cryptographic hash function.

[0087] AID = DID ⊕ MAC K (T i [0:64]

[0088] Where K is a system key known only to the network domain KDS, and T i It is the generation timestamp of AID, MAC K () represents the message authentication code calculated using key K, ⊕ represents the XOR operation, and [0:64] represents the truncation of the string from 0 to 63 bits.

[0089] Phase Two: Forwarding Path Generation

[0090] After receiving the transmission request from the source, KDS determines the path PATH=(id S ,id1,id2,...,id n ,id D KDS generates a symmetric key between adjacent network element (i.e., intermediate network element) pairs: K path ={k sd ,k0,k1,...,k n} and the secret value α = {α S ,α1,...,α D} and distribute it to each node.

[0091] KDS computation path encryption material:

[0092] (Encrypted intermediate value, calculated by each node during data packet transmission)

[0093] P i =β i [0:32]⊕id i (Encrypted path information)

[0094] β=β0⊕β1⊕...⊕β n (Aggregation of encrypted intermediate values)

[0095] And set MSG_KDS = {β, PATH = (P0, P1, ..., P n )} is sent to the source.

[0096] Phase 3: Source Processing

[0097] 1. The source receives MSG_KDS = {β, PATH = (P0, P1, ..., P...} n After that, the checksum seed for the packet payload and source identity is calculated using the following formula:

[0098]

[0099] Where H() is the hash function, To use key k sd Encrypt the value.

[0100] And calculate the actual next-hop path based on the first-hop encrypted path P0:

[0101] 2. Identity Embedding:

[0102] The identity embedding mechanism integrates anonymous identifiers into network packets while maintaining security and privacy. During transmission, the source's AID serves as the underlying anonymous identifier, and each preceding hop uses a symmetric key shared with the next hop to encrypt the identifier.

[0103]

[0104] IID0 = ε0[0:64] ⊕ AID (AID is the anonymous user identifier, IID0 is the address label)

[0105] Where ε0 is an intermediate parameter, TS0 is the timestamp of the user processing the data packet and is embedded in the extended header, id1 is an intermediate network element identifier, and k0 is the symmetric key between the user and the first-hop routing node.

[0106] Final path verification information: Mark0 = ε0⊕seed⊕β0⊕β.

[0107] The source embeds IID0 into Figure 3 The IID field in the data packet structure, PATH = (P0, P1, ..., P n The epoch, sequence number, and reserved bit fields can be embedded into the PATH field for encrypted path information, the Mark0 field for Mark, and the TS0 field for timestamps. Additionally, the epoch, sequence number, and reserved bit fields can be used to embed numerical values ​​for replay attacks, packet loss detection, etc.

[0108] Phase 4: Intermediate Network Element Processing

[0109] Each network element ID i Upon receiving the data packet, first look up the symmetric key k between the previous hop and the previous hop.i-1 ,calculate:

[0110]

[0111] Decrypt the next-hop network element node: id i+1 =β i [0:32]⊕P i

[0112] Find the key k negotiated with the next hop. i Get the timestamp and calculate

[0113] Then, the IID is embedded into the packet from the previous hop. i-1 The anonymous identity of the source is calculated as follows: AID' = ε i-1 [0:64]⊕IID i The system requests KDS to verify the authenticity of the AID and whether there have been any recent communication requests. If the AID is invalid, the data packet is discarded and an error message is reported. If the AID is valid, the AID is re-encrypted to generate an IID. i =ε i [0:64]⊕AID',

[0114] Last updated path verification information: Mark i =Mark i-1 ⊕β i ⊕ε i-1 ⊕ε i .

[0115] Source end will IID i Embedded into Figure 3 In the packet structure, the IID field, Mark0 is embedded in the Mark field, and TS0 is embedded in the timestamp field. Additionally, the epoch, sequence number, and reserved bit fields can be used to embed numerical values ​​for replay attacks, packet loss detection, etc.

[0116] It's important to note that during intermediate node forwarding, the PATH field can remain unchanged, or it can delete or overwrite already decrypted path information. However, subsequent path information must remain unchanged, such as PATH = (P0, P1, ..., P...). n In the ) message, it has already been forwarded to the node ID. i Alright, ID i By calculating id i+1 =β i [0:32]⊕P i The address of the next hop is obtained, at this moment P i The preceding encrypted address sequence (P0, P1, ..., P iRandom values ​​can be used to overwrite the result, resulting in a sequence: PATH = (P'0, P'1, P'...) i ,P i+1 ,P n This can increase privacy protection. This is optional and can be set according to your needs.

[0117] Phase 5: Destination Processing

[0118] Destination ID D Upon receiving the data packet, first look up the symmetric key k between the previous hop and the previous hop. n ,calculate:

[0119]

[0120] Mark D =Mark n ⊕ε n

[0121] AID'=ε n [0:64]⊕IID n

[0122] Destination query KDS to obtain k sd Decrypt Mark D calculate:

[0123] Verify whether AID matches AID'. If they match, the source identity and path verification is successful; otherwise, the verification fails.

[0124] It should be noted here that the destination queries the key k from KDS based on the AID. sd You can choose to query only the first packet, and then cache it locally to verify subsequent data packets, which reduces the interaction between the terminal and KDS. Furthermore, to adapt to dynamically changing network environments, you can also query the KDS for keys at certain time intervals. Specific query granularities can be divided into: packet-by-packet query -> periodic query -> session query.

[0125] This invention has the following characteristics:

[0126] 1. First implementation of identity-network layer binding: The first mechanism to bind a user's DID to the network layer. By embedding DID information in the IPv6 address interface identifier and including encrypted path information in the extension header, secure association of identity, address, path and data is achieved.

[0127] 2. Innovative encryption scheme: An encryption scheme is designed to achieve identity privacy and stream unlinkability through hop-by-hop translation of source address labels. At the same time, path information is encrypted in the extension header to ensure that each forwarding node only knows its directly adjacent nodes.

[0128] 3. IPv6-compliant extension header design: Employing an IPv6-compliant extension header design ensures seamless integration with existing networks. Comparative evaluations with state-of-the-art methods demonstrate a balanced performance and enhanced security features.

[0129] 4. Robust privacy protection:

[0130] Sender anonymity: Anonymous identifiers (AIDs) prevent attackers from obtaining the real identity through packet analysis;

[0131] Source address privacy: The source address is translated at each hop, hindering traffic analysis;

[0132] Sender-receiver unlinkability: An observer cannot associate the sender and receiver by monitoring the flow of traffic;

[0133] Path privacy: Path information is encrypted, and endpoints and intermediate network elements can only access the next-hop address.

[0134] Example 2:

[0135] This invention also provides a user identity, source address, and path verification system, including:

[0136] The first processing module is used to generate decentralized identifiers through the Key Distribution Server (KDS) and convert them into anonymous identifiers for storage on the blockchain;

[0137] The second processing module is used to calculate the secure privacy path and encrypted materials through the key distribution server KDS and distribute them to each intermediate network element;

[0138] The third processing module is used to embed identity information and encrypted path information into the data packet and initialize the path verification flag;

[0139] The fourth processing module is used to verify identity hop by hop and update path markers, while also performing identity and path integrity verification.

[0140] Example 3:

[0141] This invention also provides a storage medium, including a memory and a processor, wherein the memory stores a computer program executed by the processor, and the computer program performs a user identity, source address, and path verification method when executed by the processor.

[0142] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for verifying user identity, source address, and path, characterized in that, include: Step S1: Generate decentralized identifiers through the Key Distribution Server (KDS) and convert them into anonymous identifiers for storage on the blockchain; Step S2: Calculate the secure privacy path and encrypted materials through the Key Distribution Server (KDS) and distribute them to each intermediate network element; Step S3: Embed identity information and encrypted path information into the data packet and initialize the path verification flag; Step S4: Verify identity hop by hop and update path markers, while simultaneously verifying identity and path integrity; In step S2, after KDS receives the transmission request from the source, it determines the path PATH = (id S , id1, id2, ..., id n ,id D KDS generates the symmetric key between adjacent intermediate network element pairs: K path = {k sd , k0, k1, ..., k n } and the secret value α={α S , α1, ..., α D } and distribute it to each node; KDS computation path encryption material: b i = (id i-1 || id i || a i ), P i = b i [0:32] ⊕ id i , β = β0 ⊕ β1 ⊕ ... ⊕ β n， And set MSG_KDS={β,PATH=(P0, P1, ..., P n Send to the source; Step S3 includes: Step S31: The source receives MSG_KDS={β,PATH=(P0, P1, ..., P n After that, the checksum seed for the packet payload and source identity is calculated using the following formula: seed = H(payload) ⊕ (AID) Where H() is the hash function, To use the key Encrypt the value; And based on the first-hop encrypted path P0, the actual next-hop path is calculated: id1 = β0 ⊕ P0 = (id S || id D || α0)⊕P0, Step S32: The source AID serves as the basic anonymous identifier, and each preceding hop uses a symmetric key shared with the next hop to encrypt the identifier. ε0 = (id s || id1 || TS0) IID0 = ε0[0:64] ⊕ AID Where AID is the anonymous user identifier, IID0 is the address label, ε0 is the intermediate parameter, TS0 is the timestamp of the user processing the data packet and is embedded in the extended header, id1 is the intermediate network element identifier, and k0 is the symmetric key between the user and the first-hop routing node. Step S33: Calculate path verification information: Mark0 = ε0⊕seed⊕β0⊕β; In step S4, each network element ID i Upon receiving the data packet, first look up the symmetric key k between the previous hop and the previous hop. i-1 ,calculate: ε i-1 = (id i-1 || id i || TS i-1 ), b i = (id i-1 || id i || a i ), Decrypt the next-hop network element node: id i+1 =β i [0:32] ⊕P i Find the key k negotiated with the next hop. i Get the timestamp and calculate ε i = (id i || id i+1 ||TS i ), The IID embedded in the packet from the previous hop. i-1 The anonymous identity of the source is calculated in the middle: AID'=ε i-1 [0:64]⊕IID i， Request KDS to verify the authenticity of the AID and whether there have been any recent communication requests; if the AID is invalid, discard the data packet and report an error message; if the AID is valid, encrypt the AID again to generate the IID. i = ε i [0:64] ⊕ AID', Last updated path verification information: Mark i = Mark i-1 ⊕ β i ⊕ ε i-1 ⊕ ε i ; In step S4, the destination ID D After receiving the data packet, look up the symmetric key k between the previous hop and the previous hop. n ,calculate: ε n = (id n || id D || TS n ), mark D = Mark n ⊕ ε n AID'=e n [0:64]⊕IID n Destination query KDS to obtain k sd Decrypt Mark D Calculate: AID= (H(payload) ⊕Mark D ), Verify whether AID matches AID'. If they match, the source identity and path verification is successful; otherwise, the verification fails. The destination queries the key k from KDS based on AID. sd Choose to query only in the first package.

2. A user identity, source address, and path verification system that implements the user identity, source address, and path verification method of claim 1, characterized in that, include: The first processing module is used to generate decentralized identifiers through the Key Distribution Server (KDS) and convert them into anonymous identifiers for storage on the blockchain; The second processing module is used to calculate the secure privacy path and encrypted materials through the key distribution server KDS and distribute them to each intermediate network element; The third processing module is used to embed identity information and encrypted path information into the data packet and initialize the path verification flag; The fourth processing module is used to verify identity hop by hop and update path markers, while also performing identity and path integrity verification.

3. A computer-readable storage medium, characterized in that, include: A memory and a processor, wherein the memory stores a computer program executed by the processor, the computer program performing the user identity, source address, and path verification method as described in claim 1 when executed by the processor.

Images