Source address verification method, system and device and storage medium

Abstract

The invention relates to the technical field of data processing, and discloses a source address verification method, system and device and a storage medium, and the method applied to a data providing end can comprise the steps that source address verification information associated with a data receiving end is acquired, and the source address verification information is continuously and dynamically updated; based on the source address verification information, determining a source address verification field matched with the to-be-transmitted data packet; and based on a communication protocol between the data providing end and the data receiving end, inserting the source address verification field into the header part of the data packet to be transmitted, and providing the data packet to be transmitted with the source address verification field to the data receiving end. Through the technical scheme provided by the invention, the dynamically adjusted source address verification information can be added for the transmission data packet based on the communication protocol in the data transmission process, the source address information of the transmission data is prevented from being maliciously tampered, and the data transmission security is improved.

Description

Source address verification methods, systems, devices, and storage media Technical Field

[0001] This disclosure relates to the field of data processing technology, and in particular to a source address verification method, system, device and storage medium. Background Technology

[0002] Access control via IP address is a classic network security technology used to prevent unauthorized access and reduce the risk of potential network attacks. This technology is widely used in various network environments such as corporate networks, data centers, and home networks. For example, it can be configured to allow only IP addresses on a whitelist to access the network, or to disallow IP addresses on a blacklist.

[0003] In order to ensure the information security of the data receiving end and prevent potential network attacks during data transmission, it is necessary to identify and verify the authenticity of the source address information of the data provider. Summary of the Invention

[0004] The purpose of this disclosure is to provide a source address verification method, system, device, and storage medium that can add dynamically adjusted source address verification information to transmitted data packets based on communication protocols during data transmission, thereby preventing the source address information of transmitted data from being maliciously tampered with and improving the security of data transmission.

[0005] To address the aforementioned technical problems, the first aspect of this disclosure provides a source address verification method applied to a data provider. Specifically, it may include: obtaining source address verification information associated with a data receiver, wherein the source address verification information is continuously and dynamically updated; determining a source address verification field matching the data packet to be transmitted based on the source address verification information; inserting the source address verification field into the header portion of the data packet to be transmitted based on the communication protocol between the data provider and the data receiver, and providing the data packet to be transmitted with the source address verification field to the data receiver.

[0006] In one possible implementation of the first aspect described above, source address verification information is shared between the data provider and the data receiver based on a quantum key distribution protocol.

[0007] In one possible implementation of the first aspect above, the process of determining the source address verification field that matches the data packet to be transmitted includes: dividing the source address verification information into multiple source address verification fields based on a preset length; determining a first sequence identifier corresponding to the source address verification field based on the position of the source address verification field in the source address verification information; determining a second sequence identifier corresponding to the data packet to be transmitted based on the transmission order of the data packet to be transmitted; and matching source address verification fields with the same first sequence identifier and second sequence identifier with the data packet to be transmitted to determine the source address verification field that matches the data packet to be transmitted.

[0008] In one possible implementation of the first aspect above, the process of inserting the source address verification field into the header of the data packet to be transmitted based on the communication protocol between the data provider and the data receiver includes: when the communication protocol is IPv6, adding an address verification extension header to the header of the data packet to be transmitted, and filling the source address verification field into the address verification extension header; the header of the data packet to be transmitted includes the source address information of the data provider, the destination address information of the data receiver, the original extension header associated with the IPv6 protocol, and the address verification extension header arranged in sequence.

[0009] In one possible implementation of the first aspect above, the process of inserting the source address verification field into the header portion of the data packet to be transmitted based on the communication protocol between the data provider and the data receiver includes: when the communication protocol is IPv4, inserting the source address verification field at the beginning of the options field in the header portion of the data packet to be transmitted; the header portion of the data packet to be transmitted includes the source address information of the data provider, the destination address information of the data receiver, and the source address verification field arranged in sequence.

[0010] The second aspect of this disclosure provides a source address verification method applied to a data receiving end, which specifically includes: determining the source address information corresponding to the received transmission data packet based on the header portion of the transmission data packet; determining the data provider corresponding to the transmission data packet based on the source address information, and determining source address verification information associated with the data provider; extracting a source address verification field from the header portion based on the communication protocol between the data receiving end and the data provider; and determining whether the source address verification field matches the source address verification information: if they match, confirming the reception of the transmission data packet; otherwise, discarding the transmission data packet; wherein the source address verification information is continuously and dynamically updated.

[0011] In one possible implementation of the second aspect above, the process of extracting the source address verification field from the header portion of the received transmission data packet includes: when the communication protocol is IPv6, determining the last extension header of the header portion as the address verification extension header; and extracting a field of a preset length from the address verification extension header as the source address verification field.

[0012] In one possible implementation of the second aspect above, the process of extracting the source address verification field from the header of the received transmission data packet includes: when the communication protocol is IPv4, extracting a field of a preset length from the starting position of the options field in the header as the source address verification field.

[0013] In one possible implementation of the second aspect above, the process of determining whether the source address verification field matches the source address verification information includes: when the transmitted data packet is the first received data packet, retrieving the source address verification field from the source address verification information; if there is a part in the source address verification information that matches the source address verification field, determining that the source address verification field matches the source address verification information; and based on the length of the source address verification field, dividing the source address verification information that matches the source address verification field into multiple matching verification fields, and assigning a first sequence identifier to each matching verification field.

[0014] In one possible implementation of the second aspect above, the process of determining whether the source address verification field matches the source address verification information further includes: when the data packet is not the first received data packet, starting from the first sequence identifier corresponding to the previously confirmed received data packet, searching for the source address verification field among multiple matching verification fields of the source address verification information; if there is a part in the multiple matching verification fields that is consistent with the source address verification field, determining that the source address verification field matches the source address verification information.

[0015] A third aspect of this disclosure provides a source address verification system, which specifically includes a data provider and a data receiver. The data provider includes a first verification negotiation unit, a verification generation unit, and a data transmission unit. The data receiver includes a second verification negotiation unit, a data receiving unit, and a source address verification unit. The first and second verification negotiation units are used to generate source address verification information associated with the data provider and the data receiver, and this information is continuously and dynamically updated. The verification generation unit is used to determine a source address verification field matching the data packet to be transmitted based on the source address verification information, and to insert the source address verification field into the data packet to be transmitted based on the communication protocol between the data provider and the data receiver. The data transmission unit provides the data packet to be transmitted, which includes a source address verification field, to the data receiving end. The data receiving unit receives the data packet and determines the source address information corresponding to the data packet based on the header of the received data packet. The data receiving unit also determines the data provider corresponding to the data packet based on the source address information and determines the source address verification information associated with the data provider based on the second verification negotiation unit. The source address verification unit extracts the source address verification field from the header based on the communication protocol between the data receiving end and the data provider, and determines whether the source address verification field matches the source address verification information: if they match, the data packet is received; otherwise, the data packet is discarded.

[0016] A fourth aspect of this disclosure provides a source address verification device, which may specifically include: at least one processor and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to implement the steps of the source address verification method provided in the first or second aspect.

[0017] The fifth aspect of this disclosure provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the steps of the source address verification method provided in the first or second aspect.

[0018] The technical solution provided in this disclosure enables the addition of dynamically adjusted source address verification information to transmitted data packets based on the communication protocol during data transmission. This allows for effective authentication and verification of the source address information of the data provider, preventing malicious tampering and enhancing data transmission security. Furthermore, the source address verification information can be obtained using quantum key distribution technology, preventing third parties other than the data provider and receiver from obtaining the quantum-encrypted source address verification information and improving the system's resistance to quantum computing attacks. In this technical solution, the source address verification field matched by each data packet belongs to a different part of the source address verification information, allowing for independent updates to the source address verification field of each packet, further enhancing the security of the source address verification information during data transmission. Attached Figure Description

[0019] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0020] Figure 1 is an exemplary flowchart of a source address verification method according to an embodiment of the present disclosure; Figure 2 is a schematic flowchart of determining a source address verification field that matches a data packet to be transmitted according to an embodiment of the present disclosure; Figure 3 is a schematic flowchart of another source address verification method according to an embodiment of the present disclosure; Figure 4 is a schematic flowchart of determining whether a source address verification field matches source address verification information according to an embodiment of the present disclosure; Figure 5 is a schematic flowchart of determining whether a source address verification field matches source address verification information according to an embodiment of the present disclosure; Figure 6 is a schematic structural diagram of a source address verification system according to an embodiment of the present disclosure; Figure 7 is a schematic structural diagram of a source address verification device according to an embodiment of the present disclosure. Detailed Implementation

[0021] Based on the relevant descriptions in the background art, in order to prevent potential network attacks during data transmission, it is necessary to identify and verify the authenticity of the source address information of the data provider. To address the aforementioned technical problem, this disclosure provides a source address verification method, system, device, and storage medium. During data transmission, it can add dynamically adjusted source address verification information to the transmitted data packets based on the communication protocol, enabling effective identification and verification of the data provider's source address information, preventing malicious tampering of the source address information of the transmitted data, and improving the security of data transmission.

[0022] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the various embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details are provided in the embodiments of this disclosure to facilitate a better understanding of the disclosure. However, the technical solutions claimed in this disclosure can be implemented even without these technical details and various variations and modifications based on the following embodiments. The division of the following embodiments is for ease of description and should not constitute any limitation on the specific implementation of this disclosure. The various embodiments can be combined with and referenced by each other without contradiction.

[0023] In some embodiments of this disclosure, Figure 1 illustrates a flowchart of a source address verification method. In some embodiments, the process 100 shown in Figure 1 is applied to the data provider, i.e., the data provider generates and adds source address verification information, specifically including the following steps: Step 110: Obtain source address verification information associated with the data receiver, wherein the source address verification information is continuously and dynamically updated. In some embodiments, the source address verification information may be obtained through negotiation between the data receiver and the data provider, and it is only associated with a specific data provider and data receiver, and is continuously and uninterruptedly updated between the data provider and the data receiver. In some embodiments, the update frequency of the source address verification information may be fixed, random, or adaptively updated according to the data transmission needs between the data provider and the data receiver. For example, the source address verification information may be dynamically updated once before each batch of data packets to be transmitted, etc., without limitation.

[0024] In some embodiments, specifically, source address verification information can be shared between the data provider and the data receiver based on a quantum key distribution protocol. Quantum key distribution (QKD) is a technology that uses the fundamental principles of quantum mechanics to securely generate and distribute keys. It is considered one of the most theoretically secure key distribution methods currently available. The source address verification information generated based on quantum key distribution technology can be shared between the data provider and the data receiver in the form of a random sequence. It also has the anonymity characteristic of not being known by other third parties and the dynamic change and update characteristic, which can effectively improve the security of source address verification information during data transmission and prevent the source address verification information from being leaked, stolen, or tampered with due to network quantum computing attacks. This is not limited to this.

[0025] Step 120: Based on the source address verification information, determine the source address verification field that matches the data packet to be transmitted. In some embodiments, the source address verification field may be a truncated component of the source address verification information. For example, when the source address verification information is in the form of a random number sequence, the source address verification field may be a truncated field of the same length from the random number sequence, and there may be differences between the source address verification fields that match different data packets to be transmitted; this is not limited here. The specific implementation of matching the corresponding source address verification field for the data packet to be transmitted will be described in detail later, and is not limited here.

[0026] Step 130: Based on the communication protocol between the data provider and the data receiver, insert the source address verification field into the header of the data packet to be transmitted, and provide the data packet with the source address verification field to the data receiver. In some embodiments, the data packet header is a special reserved field attached to the front of the data packet in network protocol communication. Specifically, it may contain basic information such as destination address, source address, and protocol type. Its structure is determined by the communication protocol between the data provider and the data receiver. It is understandable that the communication protocol between the data provider and the data receiver determines the structural differences of the header of the data packet to be transmitted. Different communication protocols often require the data packet to be transmitted to have a corresponding header structure. Different header structures also have corresponding requirements for the insertion position of the source address verification field. That is, the insertion of the source address verification field needs to be adaptively adjusted according to the communication protocol. Since the source address verification field matched by each data packet to be transmitted belongs to a different part of the source address verification information, inserting the source address verification field enables independent updating of the source address verification for each data packet to be transmitted, further improving the security of the source address verification information and its resistance to network attacks during data transmission.

[0027] It is understood that, based on the above process 100, dynamically adjusted source address verification information can be added to the transmitted data packets during data transmission based on the communication protocol, preventing the source address information of the transmitted data from being maliciously tampered with and improving the security of data transmission. The specific implementation of the above process 100 will be further explained and illustrated below with reference to embodiments.

[0028] In some embodiments of this disclosure, Figure 2 illustrates a flowchart for determining a source address verification field that matches a data packet to be transmitted. As shown in Figure 2, process 200 may specifically include the following steps: Step 210: Divide the source address verification information into multiple source address verification fields based on a preset length. In some embodiments, taking a random number sequence obtained through quantum key distribution as an example, the random number sequence can be divided into multiple source address verification fields with a length of 4 bytes. Each source address verification field corresponds to a 4-byte random number sequence. This can avoid using complex and lengthy identification content while satisfying the insertion of source address verification information, thus reducing the pressure on subsequent data packet transmission. Users can also choose an appropriate byte length for the source address verification field according to actual needs, which is not limited here.

[0029] Step 220: Determine the first sequence identifier corresponding to the source address verification field based on its position in the source address verification information. In some embodiments, the first sequence identifier can be allocated sequentially starting from the first source address verification field obtained from the random number sequence corresponding to the source address verification information. For example, for the random number sequence "1234567898765432", it can be divided into four source address verification fields "1234", "5678", "9876", and "5432" with a length of 4 bits. During the allocation of the first sequence identifier, it can be allocated sequentially in the order of "1, 2, 3, 4...". For example, the first sequence identifier corresponding to the source address verification field "1234" is "1", the first sequence identifier corresponding to the source address verification field "5678" is "2", the first sequence identifier corresponding to the source address verification field "9876" is "3", and so on. That is, the difference between the first sequence identifiers of adjacent source address verification fields is 1. Users can also choose other allocation methods for the first sequence identifier according to actual needs, which are not limited here.

[0030] Step 230: Determine the second sequence identifier corresponding to the data packets to be transmitted based on the transmission order of the data packets to be transmitted. In some embodiments, during data transmission, the data transmission agreement between the data provider and the data receiver can be established first to determine the size, data transmission rate, and other information of a single data packet to be transmitted during the data transmission process from the data provider to the data receiver. Based on this information, the data content to be transmitted is divided into multiple data packets of appropriate size. Users can choose a suitable method for dividing the data packets to be transmitted according to their actual needs; no limitation is made here. In some embodiments, further, a corresponding second sequence identifier can be assigned to each data packet to be transmitted based on the transmission order of the data packets to be transmitted, so as to facilitate the subsequent matching process between the source address verification field and the data packets to be transmitted. For example, the second sequence identifier can be assigned sequentially based on a natural number sequence, starting from the first data packet to be transmitted in the transmission sequence. For example, the second sequence number corresponding to the first data packet is "1", the second sequence number corresponding to the second data packet is "2", and so on. In a specific implementation scenario, a counter can be set at the data provider end. Starting from the first data packet sent to the data receiver end, the counter is incremented by one for each packet sent, and the counter value is used as the second sequence identifier of the data packet to be transmitted. This is not limited here.

[0031] Step 240: Match source address verification fields with the same first sequence identifier and second sequence identifier with the data packets to be transmitted to determine the source address verification field that matches the data packets to be transmitted. In some embodiments, by matching source address verification fields with the same first sequence identifier and second sequence identifier with the data packets to be transmitted, each data packet to be transmitted can be matched with a different source address verification field, thereby achieving per-packet updates of the source address verification information of the data packets to be transmitted, which can better protect against network attacks targeting source address information. For example, taking the source address verification information as containing four source address verification fields "1234", "5678", "9876", and "5432" as an example, the first data packet to be transmitted in the transmission sequence can be matched with the source address verification field "1234", the second data packet to be transmitted can be matched with the source address verification field "5678", and the third data packet to be transmitted can be matched with the source address verification field "9876", so that the source address verification fields matched by each data packet to be transmitted are not completely the same, which is not limited here. In some embodiments, further, in order to avoid the situation where the number of data packets to be transmitted in a single transmission is too large, and the number of second sequence identifiers corresponding to the data packets to be transmitted exceeds the number of first sequence identifiers, so that the data packets to be transmitted later in the transmission order cannot match the corresponding source address verification field, during the generation of source address verification information, a longer quantum random number sequence can be generated so that the number of source address verification fields obtained from the division can meet the quantity requirements of a single data packet transmission process, which is not limited here.

[0032] In some embodiments of this disclosure, further, during the process of inserting the source address check field into the header of the data packet to be transmitted based on the communication protocol between the data provider and the data receiver, if the communication protocol is IPv6 (Internet Protocol Version 6), the source address check field can be inserted by adding an extension header. Specifically, in some embodiments, an extension header as an address check extension header can be added after the last extension header in the original header, and the source address check field can be filled into the end of the address check extension header, thereby achieving the insertion of the source address check field. In one specific embodiment, when the source address check field is 4 bytes (32 bits) long, the first 8 bits of the last extension header in the original header section can be modified to "01001100", and an address check extension header can be added after the last extension header in the original header section. The first 8 bits of the address check extension header are the original 8 bits of the last extension header in the original header section, the middle 24 bits of the address check extension header are filled with 0, and the last 32 bits of the address check extension header are filled with the source address check field. The value in the payload length of the basic header is changed to the original value plus one, which is not limited here. It is understood that after inserting the source address check field, the header of the data packet to be transmitted can include, in sequence, the source address information of the data provider, the destination address information of the data receiver, the original extension header associated with the IPv6 protocol, and the address check extension header, which is not limited here.

[0033] In some embodiments of this disclosure, further, during the process of inserting the source address check field into the header portion of the data packet to be transmitted based on the communication protocol between the data provider and the data receiver, if the communication protocol is IPv4 (Internet Protocol Version 4), the source address check field can be inserted using the options field of the IPv4 header. The options field is an optional field located at the end of the IPv4 header, used to support specific or extended functions. It is not a mandatory field in every IPv4 header; it is only used when needed. In some embodiments, specifically, the source address check field can be inserted at the beginning of the options field in the header portion of the data packet to be transmitted, i.e., the source address check field is appended after the destination address information. It is understood that after inserting the source address check field, the header portion of the data packet to be transmitted may include the source address information of the data provider, the destination address information of the data receiver, and the source address check field arranged sequentially, which is not limited here.

[0034] It is understood that the solution provided by the aforementioned embodiments can add source address verification information to the data packets to be transmitted on the data provider side, and update the source address verification information packet by packet in each data packet to be transmitted. Moreover, the generated source address verification information can resist quantum computing attacks, and avoid the security vulnerability risks that may be faced during data transmission as much as possible. The following will take the data receiver as the execution subject and explain in detail how the data receiver performs source address verification on the received data in the source address verification method provided in this disclosure.

[0035] In some embodiments of this disclosure, Figure 3 illustrates a flowchart of another source address verification method. In some embodiments, the process 300 shown in Figure 3 is applied to the data receiving end, that is, the data receiving end performs source address verification on the received transmission data packet, which may specifically include the following steps: Step 310: Determine the source address information corresponding to the transmission data packet based on the header portion of the received transmission data packet.

[0036] Step 320: Based on the source address information, determine the data provider corresponding to the transmitted data packet, and determine the source address verification information associated with the data provider. It is understood that a data receiver may correspond to one or more data providers. For a received transmitted data packet, the data receiver first needs to identify the provider's identity information, and then confirm the source address verification information corresponding to that data provider based on the provider's identity. In some embodiments, the source address information can be obtained by parsing the header of the transmitted data packet, and the corresponding data provider can be determined based on the source address information; this is not limited here.

[0037] Step 330: Based on the communication protocol between the data receiver and the data provider, extract the source address verification field from the header. It is understandable that differences in communication protocols can cause changes in the insertion position of the source address verification field in the header. Given a specific data provider, the extraction method for the source address verification field can be determined based on the communication protocol between the data provider and the data receiver. For example, in the case of IPv6, the last extension header in the header can be used as the address verification extension header, and a field of a preset length can be extracted from the end of the address verification extension header as the source address verification field. Similarly, in the case of IPv4, a field of a preset length can be extracted from the beginning of the options field in the header as the source address verification field; no further limitation is made here.

[0038] Step 340: Based on the source address verification information, determine whether the source address verification field matches the source address verification information: if yes, confirm receipt of the transmission data packet; otherwise, discard the transmission data packet. In some embodiments, the source address verification information in step 330 includes all source address verification information associated with the data provider. Since the source address verification information continuously and dynamically updated between the data provider and the data receiver is constantly changing randomly, the source address verification information used by the data provider when inserting the source address verification field may be inconsistent with the current source address verification information of the data receiver when receiving the data to be verified. Therefore, the extracted source address verification field can be matched with all source address verification information associated with the data provider to verify the data identification information: if they match, it means that the source address verification field has passed the verification and the source address information corresponding to the transmission data packet has not been illegally tampered with; if they do not match, it means that the source address information corresponding to the transmission data packet has been illegally tampered with, and it can be directly discarded or processed in other ways, which are not limited here. In some embodiments, when the IPv6 communication protocol is used between the data provider and the data receiver, in addition to confirming the receipt of the transmitted data packet, it is also necessary to delete the newly added address check extension header, fill the first 8 bits of the address check extension header with the first 8 bits of the previous extension header, and change the value of the payload length in the basic header to the original value minus one in the header section, which is not limited here.

[0039] The following will further explain the matching and determination process between the source address verification field and the source address verification information with reference to the embodiments.

[0040] In some embodiments of this disclosure, Figure 4 further illustrates a flowchart for determining whether a source address verification field matches source address verification information. As shown in Figure 4, process 400 may specifically include the following steps: Step 410: When the transmitted data packet is the first received data packet, retrieve the source address verification field from the source address verification information. It is understood that, based on the relevant descriptions of the foregoing embodiments, the source address verification field corresponding to the first received data packet is often located at the beginning of the corresponding source address verification information, which facilitates the subsequent determination of the source address verification information corresponding to the transmitted data packets in the current batch from the source address verification information based on the source address verification field corresponding to the first received data packet. This is not limited here. In some embodiments, a sliding window can be set according to the length of the source address verification field, and a sliding step size can be set according to the unit length of the source address verification information. The source address verification field can be retrieved by blindly checking the source address verification information by moving the sliding window. Users can also choose other suitable retrieval methods for the source address verification field according to actual needs. This is not limited here.

[0041] Step 420: If a portion of the source address verification information matches the source address verification field, determine if the source address verification field matches the source address verification information. It can be understood that, after the above retrieval process, if a portion of the source address verification information completely matches the source address verification field, it can be determined that the source address verification field matches the source address verification information. Based on the location of this portion, the source address verification information is confirmed. In subsequent source address verification processes for data packets transmitted in the same batch, it is only necessary to search within the scope of the confirmed source address verification information, significantly reducing the computational overhead and time required for source address verification field retrieval.

[0042] Step 430: Divide the source address verification information into multiple matching verification fields based on the length of the source address verification field, and assign a first sequence identifier to each matching verification field. In some embodiments, further, when the source address verification information is determined, it can be divided into multiple matching verification fields based on the same division method as the data provider, and the first sequence identifier can be assigned using the same allocation method, which will not be elaborated here.

[0043] In some embodiments of this disclosure, Figure 5 further illustrates another flowchart for determining whether the source address verification field matches the source address verification information. As shown in Figure 5, the process 500 may specifically include the following steps: Step 510: When the data packet is not received first, starting from the first sequence identifier corresponding to the previously confirmed received data packet, the source address verification field is retrieved from multiple matching verification fields of the source address verification information. In some embodiments, in sequential transmission scenarios without any packet loss, since both the first sequence identifier and the second sequence identifier are arranged according to natural number sequences, the matching verification field corresponding to the next first sequence identifier can be searched based on the first sequence identifier corresponding to the previously confirmed received data packet for source address verification. Considering that in actual application scenarios, there may be cases where data packets are not received strictly according to the transmission order or packet loss occurs, a corresponding preset length range can be set in the source address verification information starting from the first sequence identifier corresponding to the previously confirmed received data packet, and the source address verification field can be retrieved within the preset length range. This avoids repeated blind selection retrieval within the fully random number sequence range of the source address verification information, further improving the efficiency of source address verification field retrieval. In a specific implementation scenario, a counter can be set at the data receiving end, starting from 0 from the first received transmission data packet. The counter increments by one for each transmitted data packet, and a preset range is determined based on the counter count value. For example, the preset range can be the matching check field corresponding to the current counter count value plus ten, which is not limited here.

[0044] Step 520: If there is a portion in multiple matching verification fields that matches the source address verification field, determine if the source address verification field matches the source address verification information. It can be understood that if there is a portion within a preset length range that completely matches the source address verification field, it can be determined that the source address verification field matches the source address verification information.

[0045] In some embodiments of this disclosure, FIG6 illustrates a schematic diagram of a source address verification system. As shown in FIG6, it may specifically include a data provider 610 and a data receiver 620. In some embodiments, the data provider 610 may specifically include a first verification negotiation unit 611, a verification generation unit 612, and a data transmission unit 613; the data receiver 620 may specifically include a second verification negotiation unit 621, a data receiving unit 622, and a source address verification unit 623.

[0046] The data provider 610 and the data receiver 620 can generate, continuously update, and share source address verification information through the first verification negotiation unit 611 and the second verification negotiation unit 621. In some embodiments, the data provider 610 can use the verification generation unit 612 to determine the source address verification field that matches the data packet to be transmitted based on the source address verification information, and insert the source address verification field into the header of the data packet to be transmitted based on the communication protocol between the data provider 610 and the data receiver 620. Finally, the data packet to be transmitted with the source address verification field is provided to the data receiver 620 through the data transmission unit 613. In some embodiments, the data receiver 620 can receive transmission data packets through the data receiving unit 622, and determine the source address information and data provider corresponding to the transmission data packet based on the header portion of the received transmission data packet. Then, based on the communication protocol between the data receiver and the data provider, it extracts the source address verification field from the header portion. The source address verification unit 623 of the data receiver 620 determines whether the source address verification field matches the source address verification information associated with the data provider 610: if yes, it confirms receipt of the transmission data packet; otherwise, it discards the transmission data packet. The source address verification information associated with the data provider 610 can be provided through the second verification negotiation unit 621, which is not limited here. It is understood that the implementation of various functional units in the data provider 610 and data receiver 620 can refer to the execution methods of each step in the source address verification method in the foregoing embodiments, which will not be elaborated here. In some embodiments, the source address verification system provided in this disclosure can be located at the network layer, and can be implemented through entities such as network switches and firewalls, which is not limited here.

[0047] Some embodiments of this disclosure also relate to a source address verification device. Specifically, FIG7 shows a schematic diagram of the structure of a source address verification device. As shown in FIG7, the source address verification device includes at least one processor 710 and a memory 720 communicatively connected to the at least one processor. The memory 720 stores instructions that can be executed by the at least one processor 710. The instructions are executed by the at least one processor 710 to enable the at least one processor 710 to perform the steps of the source address verification method provided in the foregoing embodiments.

[0048] The memory 720 and processor 710 are connected via a bus, which may include any number of interconnecting buses and bridges, connecting various circuits of one or more processors 710 and memory 720 together. The bus may also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. A bus interface provides an interface between the bus and the transceiver. The transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 710 is transmitted over a wireless medium via an antenna, which further receives data and transmits it to the processor.

[0049] In some embodiments, the processor 710 may be responsible for managing the bus and general processing, and may also provide various functions, including adding source address verification information, parsing source address verification information, and other control functions, which are not limited herein; while the memory 720 may be used to store data used by the processor when performing operations, which are not limited herein.

[0050] In some embodiments of this disclosure, a computer-readable storage medium is also disclosed, which stores computer instructions that, when executed by a processor, implement the steps of the source address verification method provided in the foregoing embodiments. In some embodiments, the computer-readable storage medium may include flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the computer-readable storage medium may be an internal storage unit of a computer device, such as the hard disk or memory of the computer device. In other embodiments, the computer-readable storage medium may also be an external storage device of a computer device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., provided on the computer device. Of course, the computer-readable storage medium may also include both internal storage units and external storage devices of a computer device. In this embodiment, the computer-readable storage medium is typically used to store the operating system and various application software installed on the computer device, such as the program code of the service access method and / or service invocation method in this embodiment. Furthermore, the computer-readable storage medium can also be used to temporarily store various types of data that have been output or will be output.

[0051] In some embodiments of this disclosure, a computer program product is also involved, including a computer program that, when executed by a processor, implements the steps of the source address verification method provided in the foregoing embodiments.

[0052] In some embodiments, the computer program product may involve only a computer program, which may be carried on a storage medium or a processing device. In other embodiments, the computer program product may also be a storage medium or processing device containing the aforementioned computer program. The processing device may include one or more processors, and the storage medium. Those skilled in the art will understand that the implementation of all or part of the steps in the source address verification method provided in the foregoing embodiments can be accomplished by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the source address verification method provided in the foregoing embodiments of this disclosure.

[0053] The basic concepts have been described above. It is obvious that the detailed disclosure above is merely illustrative and does not constitute a limitation of this specification. Although not explicitly stated herein, various modifications, improvements, and corrections may be made to this specification by those skilled in the art. Such modifications, improvements, and corrections are taught in this specification and therefore remain within the spirit and scope of the exemplary embodiments described herein.

Claims

1. A source address verification method, characterized in that, Applied to a data provider, the method includes: acquiring source address verification information associated with a data receiver, wherein the source address verification information is continuously and dynamically updated; determining a source address verification field that matches a data packet to be transmitted based on the source address verification information; inserting the source address verification field into the header portion of the data packet to be transmitted based on the communication protocol between the data provider and the data receiver, and providing the data packet to be transmitted with the source address verification field to the data receiver.

2. The source address verification method according to claim 1, characterized in that, The source address verification information is shared between the data provider and the data receiver based on the quantum key distribution protocol.

3. The source address verification method according to claim 1, characterized in that, The process of determining the source address verification field that matches the data packet to be transmitted includes: dividing the source address verification information into multiple source address verification fields based on a preset length; determining a first sequence identifier corresponding to the source address verification field based on the position of the source address verification field in the source address verification information; determining a second sequence identifier corresponding to the data packet to be transmitted based on the transmission order of the data packet to be transmitted; and matching the source address verification fields with the same first sequence identifier and second sequence identifier with the data packet to be transmitted to determine the source address verification field that matches the data packet to be transmitted.

4. The source address verification method according to claim 1, characterized in that, In the process of inserting the source address verification field into the header portion of the data packet to be transmitted based on the communication protocol between the data provider and the data receiver, the method includes: when the communication protocol is IPv6, adding an address verification extension header to the header portion of the data packet to be transmitted, and filling the source address verification field into the address verification extension header; the header portion of the data packet to be transmitted includes, in sequence, the source address information of the data provider, the destination address information of the data receiver, the original extension header associated with the IPv6 protocol, and the address verification extension header.

5. The source address verification method according to claim 1, characterized in that, The process of inserting the source address verification field into the header portion of the data packet to be transmitted based on the communication protocol between the data provider and the data receiver includes: when the communication protocol is IPv4, inserting the source address verification field at the beginning of the options field in the header portion of the data packet to be transmitted; the header portion of the data packet to be transmitted includes the source address information of the data provider, the destination address information of the data receiver, and the source address verification field arranged in sequence.

6. A source address verification method, characterized in that, Applied to a data receiving end, the method includes: determining source address information corresponding to the received transmission data packet based on the header portion of the transmission data packet; determining the data provider corresponding to the transmission data packet based on the source address information, and determining source address verification information associated with the data provider; extracting a source address verification field from the header portion based on the communication protocol between the data receiving end and the data provider; and determining whether the source address verification field matches the source address verification information: if yes, confirming receipt of the transmission data packet; otherwise, discarding the transmission data packet.

7. The source address verification method according to claim 6, characterized in that, The process of extracting the source address verification field from the header of the received transmission data packet includes: when the communication protocol is IPv6, determining the last extension header of the header portion as the address verification extension header; and extracting a field of a preset length from the address verification extension header as the source address verification field.

8. The source address verification method according to claim 6, characterized in that, The process of determining whether the source address verification field matches the source address verification information includes: when the transmitted data packet is the first received data packet, retrieving the source address verification field from the source address verification information; if there is a part in the source address verification information that matches the source address verification field, determining that the source address verification field matches the source address verification information; and based on the length of the source address verification field, dividing the source address verification information that matches the source address verification field into multiple matching verification fields, and assigning a first sequence identifier to each matching verification field.

9. The source address verification method according to claim 8, characterized in that, The process of determining whether the source address verification field matches the source address verification information further includes: when the transmitted data packet is not the first received data packet, starting from the first sequence identifier corresponding to the previously confirmed received transmitted data packet, searching for the source address verification field among the multiple matching verification fields of the source address verification information; if there is a part in the multiple matching verification fields that is consistent with the source address verification field, determining that the source address verification field matches the source address verification information.

10. A source address verification system, characterized in that, The system includes a data provider and a data receiver. The data provider includes a first verification negotiation unit, a verification generation unit, and a data transmission unit. The data receiver includes a second verification negotiation unit, a data receiving unit, and a source address verification unit. The first and second verification negotiation units generate source address verification information associated with the data provider and the data receiver, and this information is continuously and dynamically updated. The verification generation unit determines a source address verification field matching the data packet to be transmitted based on the source address verification information and inserts the source address verification field into the header of the data packet based on the communication protocol between the data provider and the data receiver. The data transmission unit transmits the data packet containing the source address verification field... The data packet to be transmitted is provided to the data receiving end; the data receiving unit is used to receive the data packet and determine the source address information corresponding to the data packet based on the header portion of the received data packet; the data receiving unit is also used to determine the data provider corresponding to the data packet based on the source address information, and determine the source address verification information associated with the data provider based on the second verification negotiation unit; the source address verification unit is used to extract the source address verification field from the header portion based on the communication protocol between the data receiving end and the data provider, and determine whether the source address verification field matches the source address verification information based on the source address verification information: if yes, the data packet is confirmed to be received; otherwise, the data packet is discarded.

11. A source address verification device, characterized in that, include: At least one processor, and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to implement the steps of the source address verification method according to any one of claims 1 to 5, or the steps of the source address verification method according to any one of claims 6 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions, which, when executed by a processor, implement the steps of the source address verification method according to any one of claims 1 to 5, or the steps of the source address verification method according to any one of claims 6 to 9.

Images