IP address network division method and device, equipment and storage medium

Abstract

This application provides an IP address network partitioning method, apparatus, device, and storage medium, belonging to the field of asset management technology. The method includes: converting a target IP address into an integrated IP address block, wherein the target IP address belongs to either IPv4 or IPv6; determining the host bit width based on a variable-length subnet mask, and logically right-shifting the tail address block within the IP address block according to the host bit width to obtain a bit value; comparing the bit value of the tail address block with a reference bit value of the tail address block in a preset network partitioning rule to determine whether the target IP address matches the network partitioning rule. This method eliminates code redundancy and branch prediction failures. It significantly improves cache locality and instruction pipeline efficiency, thereby enhancing the adaptability of the solution.

Description

Technical Field

[0001] This application belongs to the field of asset management technology, specifically relating to an IP address networking method, apparatus, device, and storage medium. Background Technology

[0002] As the network attack surface continues to expand, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), and Web Application Firewalls (WAFs) all rely on rapid network segment filtering of source / destination IP addresses to distinguish trusted traffic, suspicious traffic, and known attack sources with millisecond-level precision. Simultaneously, asset management systems also need to dynamically classify devices as "confirmed assets" or "unconfirmed assets" based on IP network segment attribution, achieving real-time risk profiling. Therefore, IP network segment matching has become one of the most frequent and CPU-intensive core operations at the underlying level of various security products.

[0003] Existing technologies generally use Radix trees for prefix matching. Radix trees construct multi-branch tree indexes by compressing common prefixes, with a query complexity of approximately O(k) (where k is the prefix length), which can meet basic performance requirements when the rule size is moderate.

[0004] However, Radix trees require separate node structures, bit offsets, and backtracking logic for IPv4 and IPv6, leading to code path duplication and poor cache locality. Furthermore, each rule addition or deletion may trigger node splitting or merging, necessitating locking and reconstructing the entire tree, severely impacting dynamic update efficiency. Therefore, a more adaptable IP address networking method is needed. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for IP address networking.

[0006] Firstly, this application provides a method for IP address network partitioning, the method comprising:

[0007] The target IP address is converted into a unified IP address block, wherein the target IP address belongs to either the IPv4 protocol version or the IPv6 protocol version;

[0008] The host bit width is determined based on the variable-length subnet mask, and the tail address block within the IP address block is logically right-shifted according to the host bit width to obtain the bit value.

[0009] The point value of the tail address block is compared with the reference point value of the tail address block in the preset network partitioning rule to determine whether the target IP address matches the network partitioning rule.

[0010] In one possible implementation, comparing the bit value of the tail address block with the reference bit value of the tail address block in the preset network partitioning rule to determine whether the target IP address matches the network partitioning rule includes:

[0011] In the network partitioning rules, find the reference point value of the tail address block that is equal to the point value of the tail address block.

[0012] If the reference point value of the current rule is not equal to the point value of the tail address block, then the matching operation for the current rule is terminated and the next rule is continued.

[0013] If the reference point value of the current rule is equal to the point value of the tail address block, then the current rule is retained as the rule to be matched, and the first address block discrimination process is entered.

[0014] In one possible implementation, the entry into the first address block determination process includes:

[0015] Determine the reference starting address block set of the rule to be matched, and determine the starting address block set of the IP address block;

[0016] Compare the bit values ​​of the corresponding first address block pairs in the reference first address block set and the first address block set block by block;

[0017] If all the bit values ​​of the corresponding first address block pairs are equal, then the target IP address is determined to match the network partitioning rule.

[0018] If the bit values ​​of any corresponding first address block pair are not equal, the matching operation for the current rule is terminated and the next rule is continued until a match is found or all rules are traversed.

[0019] In one possible implementation, before comparing the bit value of the tail address block with the reference bit value of the tail address block in the preset network partitioning rules, the method further includes:

[0020] When the addition, modification or deletion of the network division rules is detected, the reference point value of the tail address block is recalculated for the changed part of the rules;

[0021] The pre-built cache table is updated based on the recalculated reference point values, wherein the cache table is used to record the number of reference points for each loaded rule tail address block, and the corresponding logical shift value.

[0022] In one possible implementation, the conversion of the target IP address into a unified IP address block includes:

[0023] If the target IP address belongs to the IPv4 protocol version, the target IP address is divided into a single 4-byte address block with a length of 32 bits;

[0024] If the target IP address belongs to the IPv6 protocol version, the target IP address is divided into four 4-byte address blocks with a length of 128 bits.

[0025] The 4-byte address blocks are stored sequentially in network byte order to form a continuous IP address block independent of the protocol version.

[0026] In one possible implementation, the step of logically right-shifting the tail address block within the IP address block according to the host bit width to obtain the bit value includes:

[0027] The host bit width is determined based on the difference between the integer bit width and the length of the variable-length subnet mask;

[0028] The number of bits for logical right shift is determined based on the remainder after modulo and minus correction of the host bit width;

[0029] Based on the median value of the variable-length subnet mask length minus one, the quotient obtained by dividing by the integer bit width is used to determine the index position of the tail address block within the IP address block in the 4-byte address block sequence.

[0030] Perform a logical right shift of the logical right shift bits on the tail address block located at the index position to obtain the bit value of the tail address block.

[0031] In one possible implementation, after determining whether the target IP address matches the network partitioning rule, the method further includes:

[0032] If the target IP address does not match the network partitioning rule, the target IP address will be stored in the unconfirmed asset database.

[0033] If the target IP address matches the network partitioning rule, the device information corresponding to the target IP address will be stored in the asset confirmation database.

[0034] Secondly, this application provides an IP address networking device, comprising: a conversion module, a calculation module, and a control module, wherein:

[0035] The conversion module is used to convert the target IP address into an integrated IP address block, wherein the target IP address belongs to either the IPv4 protocol version or the IPv6 protocol version.

[0036] The calculation module is used to determine the host bit width based on the variable-length subnet mask, and to perform a logical right shift on the tail address block within the IP address block based on the host bit width to obtain the bit value.

[0037] The control module is used to compare the point value of the tail address block with the reference point value of the tail address block in the preset network partitioning rule to determine whether the target IP address matches the network partitioning rule.

[0038] In one possible implementation, the control module is further configured to:

[0039] In the network partitioning rules, find the reference point value of the tail address block that is equal to the point value of the tail address block.

[0040] If the reference point value of the current rule is not equal to the point value of the tail address block, then the matching operation for the current rule is terminated and the next rule is continued.

[0041] If the reference point value of the current rule is equal to the point value of the tail address block, then the current rule is retained as the rule to be matched, and the first address block discrimination process is entered.

[0042] In one possible implementation, the control module is further configured to:

[0043] Determine the reference starting address block set of the rule to be matched, and determine the starting address block set of the IP address block;

[0044] Compare the bit values ​​of the corresponding first address block pairs in the reference first address block set and the first address block set block by block;

[0045] If all the bit values ​​of the corresponding first address block pairs are equal, then the target IP address is determined to match the network partitioning rule.

[0046] If the bit values ​​of any corresponding first address block pair are not equal, the matching operation for the current rule is terminated and the next rule is continued until a match is found or all rules are traversed.

[0047] In one possible implementation, before comparing the point value of the tail address block with the reference point value of the tail address block in the preset network partitioning rules, the control module is further configured to:

[0048] When the addition, modification or deletion of the network division rules is detected, the reference point value of the tail address block is recalculated for the changed part of the rules;

[0049] The pre-built cache table is updated based on the recalculated reference point values, wherein the cache table is used to record the number of reference points for each loaded rule tail address block, and the corresponding logical shift value.

[0050] In one possible implementation, the conversion module is further configured to:

[0051] If the target IP address belongs to the IPv4 protocol version, the target IP address is divided into a single 4-byte address block with a length of 32 bits;

[0052] If the target IP address belongs to the IPv6 protocol version, the target IP address is divided into four 4-byte address blocks with a length of 128 bits.

[0053] The 4-byte address blocks are stored sequentially in network byte order to form a continuous IP address block independent of the protocol version.

[0054] In one possible implementation, the computing module is further configured to:

[0055] The host bit width is determined based on the difference between the integer bit width and the length of the variable-length subnet mask;

[0056] The number of bits for logical right shift is determined based on the remainder after modulo and minus correction of the host bit width;

[0057] Based on the median value of the variable-length subnet mask length minus one, the quotient obtained by dividing by the integer bit width is used to determine the index position of the tail address block within the IP address block in the 4-byte address block sequence.

[0058] Perform a logical right shift of the logical right shift bits on the tail address block located at the index position to obtain the bit value of the tail address block.

[0059] In one possible implementation, after determining whether the target IP address matches the network partitioning rule, the control module is further configured to:

[0060] If the target IP address does not match the network partitioning rule, the target IP address will be stored in the unconfirmed asset database.

[0061] If the target IP address matches the network partitioning rule, the device information corresponding to the target IP address will be stored in the asset confirmation database.

[0062] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0063] The memory stores computer-executed instructions;

[0064] The processor executes computer execution instructions stored in the memory to implement the IP address networking method as described in the first aspect.

[0065] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a computer, are used to implement the IP address networking method as described in the first aspect.

[0066] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, can implement the steps of the scheme recommendation method as described in any of the first aspects.

[0067] The IP address networking method, apparatus, device, and storage medium provided in this application map the target IP address into a protocol-independent unified IP address block. A variable subnet mask is then used to determine the host bit width. Based on the host bit width, the tail address block within the IP address block is logically shifted right to obtain the bit value. Finally, this bit value is directly compared with the preset reference bit value in the networking rules to determine whether the target IP address matches the networking rules. This method unifies the mapping of dual-stack addresses into a protocol-independent numerical representation, eliminating the code redundancy and branch prediction failure problems caused by the traditional Radix tree requiring separate maintenance of heterogeneous node structures and backtracking paths for IPv4 and IPv6. Employing a subnet mask-based bitwise operation and numerical comparison mechanism transforms prefix matching into a single arithmetic operation and constant-time lookup, significantly improving cache locality and instruction pipeline efficiency, thereby enhancing the adaptability of the solution. Attached Figure Description

[0068] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0069] Figure 1 A flowchart illustrating an IP address network partitioning method provided in this application embodiment. Figure 1 ;

[0070] Figure 2 A flowchart illustrating an IP address network partitioning method provided in this application embodiment. Figure 2 ;

[0071] Figure 3 This is a schematic diagram of the structure of an IP address networking device provided in an embodiment of this application;

[0072] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0073] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0074] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0075] Current technologies commonly use Radix trees for prefix matching. Radix trees construct a multi-branch tree index by compressing common prefixes, with a query complexity of approximately O(k) (where k is the prefix length), which meets basic performance requirements when the rule size is moderate. However, Radix trees require separate node structures, bit offsets, and backtracking logic for IPv4 and IPv6, leading to code path duplication and poor cache locality. Furthermore, each rule addition or deletion may trigger node splitting or merging, necessitating locking and reconstructing the entire tree, severely impacting dynamic update efficiency. Therefore, a more adaptable IP address networking method is urgently needed.

[0076] This application provides a method for IP address network partitioning. It maps target IP addresses to protocol-independent unified IP address blocks, determines the host bit width using a variable subnet mask, and logically right-shifts the tail address block within the IP address block according to the host bit width to obtain the bit values. Finally, it directly compares these bit values ​​with the preset reference bit values ​​in the network partitioning rules to determine whether the target IP address matches the rules. This method unifies the mapping of dual-stack addresses to protocol-independent numerical representations, eliminating the code redundancy and branch prediction failures caused by the traditional Radix tree requiring separate maintenance of heterogeneous node structures and backtracking paths for IPv4 and IPv6. Employing a subnet mask-based bitwise operation and numerical comparison mechanism transforms prefix matching into a single arithmetic operation and constant-time lookup, it significantly improves cache locality and instruction pipeline efficiency, thereby enhancing the adaptability of the solution.

[0077] The technical solutions of this application and how they solve the aforementioned technical problems are described in detail below with specific embodiments. These specific embodiments may exist independently or in combination with each other. Identical or similar concepts or processes may not be repeated in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0078] It should be noted that the executing entity of this application can be any electronic device with network packet processing capabilities and routing decision-making functions, specifically including but not limited to: routing devices for implementing cross-network segment traffic forwarding and path selection, such as core routers, Layer 3 switches, and multi-protocol label switching devices; network security devices for implementing access control and traffic filtering policies, such as firewalls, intrusion detection systems, intrusion prevention systems, deep packet inspection engines, and zero-trust gateways; software-defined network controllers for centralized management of network topology and policy distribution, virtual routing components in cloud network platforms, and network function virtualization infrastructure; high-performance load balancers, content delivery network nodes, and edge computing gateways deployed at network boundaries or content delivery layers; and high-performance servers, container hosts, and cloud host instances integrating smart network interface cards or data plane development kits. For ease of understanding, subsequent embodiments will be described using intrusion detection systems as an example.

[0079] Figure 1 A flowchart illustrating an IP address network partitioning method provided in this application embodiment. Figure 1 .like Figure 1 As shown, the method includes:

[0080] S101. Convert the target IP address into a unified IP address block.

[0081] In this step, as the network attack surface continues to expand, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), and Web Application Firewalls (WAFs) all rely on rapid network segment filtering of source / destination IP addresses to distinguish trusted traffic, suspicious traffic, and known attack sources with millisecond-level precision. Simultaneously, asset management systems also need to dynamically classify devices as "confirmed assets" or "unconfirmed assets" based on IP network segment attribution, achieving real-time risk profiling. Therefore, IP network segment matching has become one of the most frequent and CPU-intensive core operations at the underlying level of various security products. Existing technologies generally use Radix trees for prefix matching. Radix trees construct multi-branch tree indexes by compressing common prefixes, with a query complexity of approximately O(k) (where k is the prefix length), which can meet basic performance requirements when the rule size is moderate. However, Radix trees require separate node structures, bit offsets, and backtracking logic for IPv4 and IPv6, leading to code path duplication and poor cache locality; furthermore, each rule addition or deletion may trigger node splitting or merging, necessitating locking and reconstruction of the entire tree, severely impacting dynamic update efficiency. Therefore, a more adaptable method for IP address networking is needed.

[0082] To address the aforementioned issues of protocol heterogeneity and structural rigidity, a protocol-independent address normalization mechanism and a numerical comparison paradigm are needed. This is achieved by constructing a unified address space representation and replacing prefix traversal with fixed-bit operations, thereby eliminating the maintenance overhead of polymorphic nodes and the dependency on tree topology. Therefore, this embodiment first maps the target IPv4 or IPv6 address to a protocol-independent, unified fixed-length address block, achieving a homogeneous representation of the dual-stack address space. Then, the host bit width is determined based on the variable-length subnet mask, and a logical right shift operation is performed on the tail address block to obtain the bit value. Finally, the calculated bit value is directly compared with the preset reference bit value in the network partitioning rules, and the network segment to which the target address belongs is determined through numerical equivalence judgment. This process completely avoids hierarchical traversal, node allocation, and backtracking operations of the tree structure. Rule additions and deletions only require atomic updates of the reference value to take effect, without needing to reconstruct the index structure or trigger a top-down locking synchronization mechanism.

[0083] Specifically, when an intrusion detection system performs deep packet inspection, it first needs to extract the header information of the packets to be inspected from the captured network traffic, and then obtain the target IP address field carried within. Given that both IPv4 and IPv6 protocols coexist in the current network environment, and that they differ fundamentally in address length and encoding methods, the intrusion detection system needs to perform a corresponding protocol-independent processing procedure based on the version identifier of the target IP address. The implementation process is as follows:

[0084] If the target IP address belongs to the IPv4 protocol version, the IPv4 address is divided into a single 4-byte address block with a length of 32 bits;

[0085] If the target IP address belongs to the IPv6 protocol version, the IPv6 address is divided into four 4-byte address blocks with a length of 128 bits.

[0086] The 4-byte address blocks are stored sequentially in network byte order to form a continuous IP address block that is independent of the protocol version.

[0087] Specifically, upon receiving a packet, the intrusion detection system first parses the link layer header, extracts the network layer start position, and reads the version field to confirm the protocol type of the target IP address. If the version field indicates IPv4, the system immediately treats the subsequent 32 bits of data as a whole, reads the entire 32 bits into the register in a single operation, and then calls a byte order conversion function to convert the host byte order to network byte order. The conversion result is directly written to the starting memory location, forming a single 4-byte address block with a fixed write length of 4 bytes. The entire process requires only one memory write operation without any additional branch checks.

[0088] If the version field indicates IPv6, the system continues reading 128 bits of data. To maintain the same granularity as IPv4, the intrusion detection system segments the 128 bits of data in cyclical blocks of 4 bytes each: 4 bytes are extracted from the packet each time, resulting in four reads and four writes. After each read, the bytes are converted to their correct order and then written to memory in ascending order, forming four consecutive 4-byte address blocks. After the four writes are completed, the starting address of the memory area is a unified image of the IPv6 address, with a fixed total length of 16 bytes. There are no gaps or need for zero padding, as the 128 bits of data are completely covered by four 4-byte blocks.

[0089] After completing the protocol version segmentation operations described above, the intrusion detection system performs byte order unification processing. Network byte order is defined as a standardized byte arrangement method, namely big-endian representation, in which the most significant byte of multi-byte data is stored at the lowest memory address, and the least significant byte is stored at the highest memory address. The intrusion detection system arranges the 4-byte address blocks obtained from the aforementioned processing according to the requirements of network byte order, ensuring that the most significant and least significant bytes within each 32-bit address block conform to network transmission standards.

[0090] Subsequently, the intrusion detection system physically or logically stores the byte-order-adjusted 4-byte address blocks in a predetermined order, forming contiguous IP address blocks independent of protocol versions. This contiguous storage structure eliminates the differences in the original form between IPv4 and IPv6 addresses, constructing a unified linear address representation. This allows subsequent bitwise operations based on variable subnet masks to be performed on a consistent memory layout without distinguishing between underlying protocol versions, thus providing a standardized data foundation for high-speed matching of intrusion detection rules.

[0091] For example, the intrusion detection system receives a mirrored packet, parses it to obtain the source address as 192.0.2.13, and the version field indicates IPv4. The system reads the 32-bit raw data into a register, converts it to network byte order (0xC000020D), and then writes this value to the beginning of memory, forming a single 4-byte address block. Subsequent processes directly use this block as a reference to calculate the tail address block value.

[0092] The system then received another message with a source address of 2001:0DB8::0001:0002 and a version field indicating IPv6. The system sequentially extracted four 32-bit data segments from the message: 0x20010DB8, 0x00000000, 0x00000001, and 0x00000002. After byte order conversion, each segment was written sequentially into memory, forming four consecutive 4-byte address blocks. At this point, the 128-bit address was evenly mapped to storage units of the same width as IPv4. Subsequent host bit width determination, logical right shift, and bit value comparison all used the same set of register instructions, eliminating the need to distinguish between protocol types.

[0093] S102. Determine the host bit width based on the variable length subnet mask, and logically right-shift the tail address block within the IP address block according to the host bit width to obtain the bit value.

[0094] In this step, during the power-on initialization phase, the intrusion detection system reads a set of network segment records from the rule configuration file. Each record is accompanied by a decimal integer, which is called the variable-length subnet mask. The variable-length subnet mask can describe the boundary between network and host numbers with bit-level precision, allowing the same physical rule to cover both wide area networks with tens of millions of hosts and point-to-point links with only two hosts, thus avoiding address waste or overly coarse segmentation caused by fixed-class masks. Therefore, this embodiment uses the variable-length subnet mask as the sole basis for all subsequent bit operations.

[0095] The process of determining the bit value of the tail address block within an IP address block is as follows:

[0096] The host bit width is determined based on the difference between the integer bit width and the length of the variable-length subnet mask;

[0097] The number of bits for logical right shift is determined based on the remainder after modulo and subtraction correction of the host bit width;

[0098] Based on the quotient obtained by dividing the intermediate value of the variable-length subnet mask length by one by the integer bit width, the index position of the tail address block within the IP address block in the 4-byte address block sequence is determined.

[0099] Perform a logical right shift of bits on the tail address block located at the index position to obtain the bit value of the tail address block.

[0100] Specifically, after determining the variable-length subnet mask, the intrusion detection system first obtains the local word length attribute to get the integer bit width. The integer bit width represents the number of bits occupied by an unsigned integer in the hardware register, which is typically thirty-two on mainstream platforms. The system subtracts the length of the variable-length subnet mask from the integer bit width, and the difference is defined as the host bit width. The host bit width directly reflects the proportion of the host address in the space; the larger the value, the more addresses can be allocated within the network segment, and it also means that more bits need to be shifted right subsequently.

[0101] After obtaining the host bit width, the system does not directly use it as the shift bit. Instead, it first performs a modulo operation on the host bit width, and then subtracts one from the result to form a boundary-protected residual. This residual is named the logical right shift bit. The modulo and subtraction operations can prevent out-of-bounds shifts that occur when the mask length is exactly a multiple of the integer bit width, ensuring that the shift result always falls within the legal range.

[0102] Meanwhile, the system needs to locate the index position to be shifted. To do this, the system first subtracts one from the length of the variable-length subnet mask to form an intermediate value, then divides this intermediate value by the integer bit width to obtain the quotient. This quotient is the index position of the tail address block in the four-word address block sequence. Since division naturally rounds down, this index can directly indicate the four-word offset of the tail address block without additional comparison or traversal.

[0103] After the index is established, the system retrieves the four-word data at the corresponding position from the integrated IP address block and treats it as an unsigned integer. Subsequently, the system performs a logical right shift of the aforementioned logical right shift number of times on this integer. During the shift process, high-order bits are automatically padded with zeros, and low-order bits are discarded. The final value remaining in the register is the point value of the tail address block. This point value has eliminated the randomness of the host number portion, retaining only the network number characteristic, thus enabling a fast equality comparison with the preset reference point value to complete the hit determination of the entire rule.

[0104] Through the above steps, the intrusion detection system converts variable-length subnet masks to point bit values ​​using pure bit operations. This eliminates the need for node splitting in a tree structure and avoids duplicate codes caused by protocol differences, achieving the effect of single-path, lock-free, and incremental updates even when the mask length changes arbitrarily.

[0105] S103. Compare the point value of the tail address block with the reference point value of the tail address block in the preset network division rule to determine whether the target IP address matches the network division rule.

[0106] In this step, during the power-on initialization phase, the intrusion detection system loads network segmentation rules from persistent storage. Each rule consists of four fields arranged sequentially: the first field records the IP version number, used to distinguish whether subsequent address blocks use the 32-bit IPv4 format or the 128-bit IPv6 format; the second field gives the starting value of the address segment, which occupies four bytes in IPv4 and sixteen bytes in IPv6, stored in network byte order; the third field carries a variable-length subnet mask, recording the proportion of the network number in decimal integer form, ranging from one to thirty-two or from one to one hundred and twenty-eight, automatically limited according to the IP version; the fourth field is the enable status information, and the entire rule is allowed to participate in the subsequent matching process only when this status is enabled. Through the above four-tuple, the intrusion detection system can maintain IPv4 and IPv6 network segment policies simultaneously in a single table, without needing to establish separate storage space for the two protocols.

[0107] After loading is complete, the intrusion detection system pre-executes the same tail address block bit value calculation process as the packet side for each effective rule: the host bit width is determined based on the variable length subnet mask, then the logical right shift bit is obtained by modulo and subtraction, the tail address block index is located according to the quotient value obtained by dividing the median value by the integer bit width, and finally the four-word data at the index position is logically shifted to the right, thereby obtaining the tail address block reference bit value corresponding to the rule, and caching it in the memory array to form a preset set of network partitioning rule reference bit values.

[0108] When an online packet enters the detection process, the intrusion detection system has already obtained the target IP address carried in the current packet according to the aforementioned steps, converted it into an integrated IP address block, and completed the real-time calculation of the bit value of the tail address block. At this time, the system compares the bit value of this bit value sequentially with the reference bit value of each item in the preset set. If the two are inconsistent, the system immediately determines that the target IP address does not belong to the network segment described by the current rule, terminates the subsequent processing of the rule, and continues to read the reference bit value of the next rule. If the two are consistent, the system considers the network number part to be completely matched, and thus retains the current rule as a candidate, and continues to enter the first address block discrimination stage to further confirm whether the host number range meets the policy requirements. Through the above-mentioned comparison mechanism, the intrusion detection system completes the network segment hit determination in a branchless and lockless bit operation mode, which not only eliminates the prefix backtracking overhead of the tree structure, but also ensures the indiscriminate processing of IPv4 and IPv6 within the same execution path.

[0109] Furthermore, after the intrusion detection system completes the comparison between the tail address block bit value and the reference bit value, it has determined whether the target IP address carried by the current packet matches the network partitioning rules. At this point, the system proceeds to the subsequent asset classification process based on the comparison result to continuously improve the network asset ledger. The implementation process is as follows:

[0110] If the target IP address does not match the network partitioning rules, the target IP address will be stored in the unconfirmed asset database.

[0111] If the target IP address matches the network partitioning rules, the target IP address will be stored in the confirmed asset database.

[0112] Specifically, when a comparison result indicates a mismatch, the system immediately writes the target IP address to the unconfirmed asset database. Before writing, the system first performs a deduplication check on the target IP address: if a record with the same address already exists in the database, only the timestamp of the last occurrence and the occurrence count are updated. If it does not exist, a new record is created, and the record is filled with the target IP address, current timestamp, source interface number, and mismatch reason code, so that auditors can trace the historical behavior of this address later. The unconfirmed asset database is stored using a sequential append method, supporting high-frequency insertion without complex index maintenance, ensuring low-latency writes even in high-traffic scenarios.

[0113] When the comparison result indicates a match, the system then writes the device information corresponding to the target IP address into the confirmed asset database. The device information includes at least the target IP address, MAC address, hostname, operating system fingerprint, list of open ports, and the matched network partitioning rule number. The writing process also begins with a deduplication check: if the address already exists in the confirmed asset database, an incremental update is performed, retaining the original asset tag and merging the newly collected attribute fields into the record; if it is a new address, a complete record is inserted and marked as confirmed. The confirmed asset database uses a hybrid hash and B+ tree index, ensuring that subsequent queries based on IP address or rule number can be completed in constant or logarithmic time, facilitating quick retrieval of all online devices within a specific network segment by maintenance personnel.

[0114] Through the aforementioned classification and storage mechanism, the intrusion detection system can classify active addresses in the network space into confirmed and unconfirmed assets in real time after each IP address matching judgment. The unconfirmed asset database provides the security team with a list of unknown devices, which can serve as a basis for investigating potential threats or shadow IT. The confirmed asset database forms an authoritative ledger, supporting lifecycle management, policy compliance checks, and rapid location of abnormal behavior. Since the classification action is triggered immediately after the matching result, no additional manual intervention is required. The system achieves a fully automated closed loop from traffic identification to asset storage, significantly reducing the workload of operation and maintenance, while improving asset visibility and network governance accuracy.

[0115] This application provides a method for IP address network partitioning. It maps target IP addresses to protocol-independent unified IP address blocks, determines the host bit width using a variable subnet mask, and logically right-shifts the tail address block within the IP address block according to the host bit width to obtain the bit values. Finally, it directly compares these bit values ​​with the preset reference bit values ​​in the network partitioning rules to determine whether the target IP address matches the rules. This method unifies the mapping of dual-stack addresses to protocol-independent numerical representations, eliminating the code redundancy and branch prediction failures caused by the traditional Radix tree requiring separate maintenance of heterogeneous node structures and backtracking paths for IPv4 and IPv6. Employing a subnet mask-based bitwise operation and numerical comparison mechanism transforms prefix matching into a single arithmetic operation and constant-time lookup, it significantly improves cache locality and instruction pipeline efficiency, thereby enhancing the adaptability of the solution. By uniformly dividing IPv4 and IPv6 addresses into 4-byte address blocks and storing them in network byte order, a unified IP address block independent of protocol version is formed. This eliminates the need to design separate storage structures for the two protocols, ensuring unique code paths and consistent cache locality, significantly reducing development redundancy and memory fragmentation, while improving the efficiency of subsequent bit operations. The host bit width is first determined by the difference between the integer bit width and the mask length. Then, the logical right shift bits are obtained through modulo and subtraction correction. The tail address block index is located by dividing the median value of the subtracted mask length by the integer bit width. This allows for point value calculations to be completed in constant time, avoiding hierarchical backtracking and node splitting in tree structures. Query latency remains stable along the shortest path, and CPU usage increases linearly with rule size rather than logarithmically. Once the matching results are determined, non-matching addresses are immediately written to the unconfirmed asset database, and matching addresses and their device information are written to the confirmed asset database. This achieves a zero-manual closed loop for traffic identification and asset classification. Operation and maintenance personnel can quickly discover shadow IT or unknown threats based on real-time ledgers. At the same time, they can carry out lifecycle management and policy compliance audits based on the confirmed asset database. Overall operation and maintenance workload is reduced, and network visibility and security governance accuracy are improved simultaneously.

[0116] Figure 2 A flowchart illustrating an IP address network partitioning method provided in this application embodiment. Figure 2This embodiment provides a detailed explanation of the steps for determining whether a target IP address matches the network partitioning rules. For example... Figure 2 As shown, the method includes:

[0117] S201. In the network partitioning rules, find the reference point value of the tail address block that is equal to the point value of the tail address block.

[0118] In this step, the tail address block value is a compressed signature of the network number portion. Only after confirming that this signature is completely consistent with the reference value pre-stored on the rule side can it be concluded that the target IP address and the current rule are in the same logical network segment. If the signatures do not match, continuing to compare subsequent fields will not only waste CPU cycles but also reduce the cache hit rate due to unnecessary memory accesses. Therefore, before proceeding to the more refined first address block discrimination, it is necessary to filter out the vast majority of irrelevant rules at the lowest cost.

[0119] Therefore, this embodiment adopts a linear scanning method in the network partitioning rules, sequentially extracting the reference point value of the tail address block corresponding to each rule and comparing it with the calculated target tail address block value. If an inconsistency is found, any subsequent operations on that rule are immediately terminated, and the comparison jumps to the next rule. Only when both are completely equal is the current rule marked as a rule to be matched, triggering the subsequent first address block discrimination process. This achieves rapid pruning with a single integer comparison, significantly reducing the overall matching time.

[0120] After calculating the tail address block position value of the target IP address, the intrusion detection system immediately enters the rule comparison stage. At this time, the system starts from the head of the pre-loaded network partitioning rule linked list in memory, sequentially retrieves the tail address block reference position value of the first rule, and compares it with the already calculated tail address block position value.

[0121] S202. If the reference point value of the current rule is not equal to the point value of the tail address block, then terminate the matching operation of the current rule and continue to the next rule.

[0122] In this step, after completing the register-level equality comparison of the tail address block bit values, if the intrusion detection system finds any bit difference between the reference bit value and the target value of the current rule, it immediately triggers a fast path abandonment. First, the system marks the remaining fields of the rule in the cache as invalid to prevent subsequent logical misuse. Then, the pre-extracted rule length offset is added to the current memory pointer, causing the pointer to slide directly to the starting address of the next rule without rollback or saving intermediate states. During this process, the system does not trigger any additional memory allocation, nor does it log the missed rules; it only retains a lightweight count for subsequent statistics, thus avoiding latency caused by disk or network I / O. After the abandonment operation is completed, the system immediately loads the tail address block reference bit value of the next rule from the new address and re-enters the equality comparison process, ensuring that it can still maintain packet-by-packet processing capability at gigabit speeds. Through the above immediate termination mechanism, the intrusion detection system eliminates irrelevant rules with minimal overhead, significantly reducing the probability of CPU branch prediction failure and freeing up valuable cache space for subsequent rules, thus linearly improving the overall matching efficiency.

[0123] S203. If the reference point value of the current rule is equal to the point value of the tail address block, then the current rule is retained as the rule to be matched, and the first address block discrimination process is entered.

[0124] In this step, when the reference point value of the tail address block of a rule is exactly the same as the target value, the system stops scanning, marks the rule as a rule to be matched, and retains its subsequent field addresses so that it can enter the first address block discrimination process. Through the above-mentioned rule-by-rule search mechanism, the intrusion detection system quickly filters out the vast majority of irrelevant rules with minimal computational cost, significantly reducing the computational and memory access requirements of subsequent fine-grained comparisons.

[0125] Furthermore, the rule that the tail address block points are equal may cover subnets of different sizes. Only by checking the contents of the first address block corresponding to all host bits above it block by block can we eliminate mismatches where the network number is the same but the subnet prefix is ​​longer, and avoid misclassifying traffic to the wrong network segment. Therefore, after the tail address block is filtered, a fine comparison of the first address block set is required.

[0126] The implementation process of the starting address block identification procedure is as follows:

[0127] Determine the set of reference starting address blocks for the rules to be matched, and determine the set of starting address blocks for IP address blocks;

[0128] Compare the bit values ​​of the corresponding first address block pair in the first address block set and the first address block set block by block;

[0129] If all the bit values ​​of the corresponding first address block pairs are equal, then the target IP address is determined to have matched the network partitioning rules.

[0130] If the bit values ​​of any corresponding first address block pair are not equal, the matching operation for the current rule is terminated and the next rule is continued until a match is found or all rules are traversed.

[0131] By employing a block-by-block comparison mechanism to quickly coarsely screen the tail address blocks, and then completing the subnet-level fine screening with minimal memory access, the false positive rate approaches zero. Simultaneously, since the comparison operations reside entirely within the CPU cache, the overall latency is linearly related to the number of blocks, avoiding exponential overhead. This allows for microsecond-level decision-making capabilities even in high-throughput scenarios, significantly improving the accuracy of network asset classification and threat blocking.

[0132] In another possible implementation, network partitioning rules change frequently during runtime as threat intelligence is issued. If all rules are reloaded and the tail address block reference point value is calculated one by one for each addition or deletion, it will cause instantaneous CPU spikes, memory jitter, and matching interruptions. Therefore, only the changed parts need to be partially recalculated and the cache table refreshed in real time to ensure zero interruption in the online comparison process. Therefore, after detecting the addition, modification, or deletion of rules, the intrusion detection system in this embodiment immediately extracts the mask length of the changed rules, re-executes the host bit width determination, logical shift value calculation, and tail address block reference point value generation only for these rules, and then updates the corresponding entries in the pre-built cache table in an atomic write manner, so that the cache table is always consistent with the latest rules without rebuilding the entire table.

[0133] The implementation process is as follows:

[0134] When a new, modified, or deleted network partitioning rule is detected, the reference point value of the tail address block is recalculated for the changed part of the rule.

[0135] The pre-built cache table is updated based on the recalculated reference point values. The cache table records the number of reference points for each loaded rule's tail address block, as well as the corresponding logical shift value.

[0136] By using an incremental update mechanism, the complexity of rule maintenance is reduced from full updates to simple changes, resulting in lower peak CPU usage and eliminating the need for double memory reservation. Simultaneously, because the comparison thread always targets the same cache table, matching latency remains stable, preventing packet loss or latency fluctuations in online traffic. This ensures continuous and real-time IP address network partitioning capabilities even in high-frequency threat intelligence push scenarios.

[0137] This application provides an IP address network partitioning method. By comparing the bit values ​​of the tail address blocks one by one, most irrelevant rules can be eliminated with a single register operation, avoiding subsequent redundant memory accesses and calculations. This reduces matching latency by an order of magnitude and decreases CPU branch prediction failure rate, maintaining microsecond-level judgment capability even in high-throughput scenarios. After the tail address block is filtered, the bit values ​​of the reference first address block set and the first address block set of the IP address block are compared block by block to ensure that the network number is completely consistent before a match is declared. This eliminates misjudgments caused by prefix overlap, making the accuracy of asset classification and threat blocking close to 100%. Moreover, the comparison process is entirely within the cache, and the latency is linearly related to the number of blocks, with the overhead not increasing exponentially with the number of rules. When rules are added, modified, or deleted, only the tail address block reference bit values ​​are recalculated for the changed parts and the cache table is atomically updated, avoiding full reconstruction. This reduces peak CPU usage, eliminates the need for double memory reservation, and ensures zero-pause online comparison threads. This enables continuous real-time matching in the context of second-level threat intelligence push, significantly improving dynamic update efficiency and business continuity.

[0138] Figure 3 This is a schematic diagram of an IP address network partitioning device provided in an embodiment of this application. Figure 3 As shown, the IP address networking device 30 includes: a conversion module 301, a calculation module 302, and a control module 303, wherein:

[0139] The conversion module 301 is used to convert the target IP address into an integrated IP address block, wherein the target IP address belongs to the IPv4 protocol version or the IPv6 protocol version.

[0140] The calculation module 302 is used to determine the host bit width based on the variable length subnet mask, and to logically right-shift the tail address block in the IP address block according to the host bit width to obtain the bit value;

[0141] The control module 303 is used to compare the point value of the tail address block with the reference point value of the tail address block in the preset network division rule to determine whether the target IP address matches the network division rule.

[0142] In one possible implementation, the control module 303 is further configured to:

[0143] In the network partitioning rules, find the reference point value of the tail address block that is equal to the point value of the tail address block.

[0144] If the reference point value of the current rule is not equal to the point value of the tail address block, then the matching operation for the current rule is terminated and the next rule is continued.

[0145] If the reference point value of the current rule is equal to the point value of the tail address block, the current rule is retained as the rule to be matched, and the process of judging the first address block begins.

[0146] In one possible implementation, the control module 303 is further configured to:

[0147] Determine the set of reference starting address blocks for the rules to be matched, and determine the set of starting address blocks for IP address blocks;

[0148] Compare the bit values ​​of the corresponding first address block pair in the first address block set and the first address block set block by block;

[0149] If all the bit values ​​of the corresponding first address block pairs are equal, then the target IP address is determined to have matched the network partitioning rules.

[0150] If the bit values ​​of any corresponding first address block pair are not equal, the matching operation for the current rule is terminated and the next rule is continued until a match is found or all rules are traversed.

[0151] In one possible implementation, before comparing the point value of the tail address block with the reference point value of the tail address block in the preset network partitioning rules, the control module 303 is further configured to:

[0152] When a new, modified, or deleted network partitioning rule is detected, the reference point value of the tail address block is recalculated for the changed part of the rule.

[0153] The pre-built cache table is updated based on the recalculated reference point values. The cache table records the number of reference points for each loaded rule's tail address block, as well as the corresponding logical shift value.

[0154] In one possible implementation, the conversion module 301 is further configured to:

[0155] If the target IP address belongs to the IPv4 protocol version, divide the target IP address into a single 4-byte address block with a length of 32 bits;

[0156] If the target IP address belongs to the IPv6 protocol version, divide the target IP address into four 4-byte address blocks with a length of 128 bits;

[0157] The 4-byte address blocks are stored sequentially in network byte order to form a continuous IP address block that is independent of the protocol version.

[0158] In one possible implementation, the computing module 302 is further configured to:

[0159] The host bit width is determined based on the difference between the integer bit width and the length of the variable-length subnet mask;

[0160] The number of bits for logical right shift is determined based on the remainder after modulo and subtraction correction of the host bit width;

[0161] Based on the quotient obtained by dividing the intermediate value of the variable-length subnet mask length by one by the integer bit width, the index position of the tail address block within the IP address block in the 4-byte address block sequence is determined.

[0162] Perform a logical right shift of bits on the tail address block located at the index position to obtain the bit value of the tail address block.

[0163] In one possible implementation, after determining whether the target IP address matches the network partitioning rules, the control module 303 is further configured to:

[0164] If the target IP address does not match the network partitioning rules, the target IP address will be stored in the unconfirmed asset database.

[0165] If the target IP address matches the network partitioning rules, the device information corresponding to the target IP address will be stored in the asset confirmation database.

[0166] This embodiment provides an IP address network partitioning device that can execute the IP address network partitioning method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0167] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 40 includes a processor 401 and a memory 402 communicatively connected to the processor 401. Optionally, the electronic device 40 also includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0168] Memory 402 stores instructions executed by the computer;

[0169] The processor 401 executes computer execution instructions stored in the memory 402 to implement the IP address networking method described above.

[0170] At least one processor 401 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0171] Optionally, in specific implementations, the processor 401 and memory 402 are implemented independently. In this case, the processor 401 and memory 402 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc., but this does not imply that there is only one bus or one type of bus.

[0172] Optionally, in a specific implementation, if the processor 401 and the memory 402 are integrated on a single chip, the processor 401 and the memory 402 can communicate through an internal interface.

[0173] This application also provides a computer storage medium storing computer execution instructions, which, when executed by a processor, implement the aforementioned IP address networking method.

[0174] The aforementioned computer-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The computer-readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0175] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Alternatively, the readable storage medium can be an integral part of the processor. Both the processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the control device of a garment handling apparatus.

[0176] This unit division is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0177] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0178] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0179] If this function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods indicated in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0180] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0181] The technical solutions of this application have been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it is readily understood by those skilled in the art that the scope of protection of this application is obviously not limited to these specific embodiments. The above embodiments are only used to illustrate the technical solutions of this application and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for dividing IP addresses into network topologies, characterized in that, The method includes: The target IP address is converted into a unified IP address block, wherein the target IP address belongs to either the IPv4 protocol version or the IPv6 protocol version; The host bit width is determined based on the variable-length subnet mask, and the tail address block within the IP address block is logically right-shifted according to the host bit width to obtain the bit value. The point value of the tail address block is compared with the reference point value of the tail address block in the preset network partitioning rule to determine whether the target IP address matches the network partitioning rule.

2. The method according to claim 1, characterized in that, The step of comparing the bit value of the tail address block with the reference bit value of the tail address block in the preset network partitioning rules to determine whether the target IP address matches the network partitioning rules includes: In the network partitioning rules, find the reference point value of the tail address block that is equal to the point value of the tail address block. If the reference point value of the current rule is not equal to the point value of the tail address block, then the matching operation for the current rule is terminated and the next rule is continued. If the reference point value of the current rule is equal to the point value of the tail address block, then the current rule is retained as the rule to be matched, and the first address block discrimination process is entered.

3. The method according to claim 2, characterized in that, The process for determining entry into the first address block includes: Determine the reference starting address block set of the rule to be matched, and determine the starting address block set of the IP address block; Compare the bit values ​​of the corresponding first address block pairs in the reference first address block set and the first address block set block by block; If all the bit values ​​of the corresponding first address block pairs are equal, then the target IP address is determined to match the network partitioning rule. If the bit values ​​of any corresponding first address block pair are not equal, the matching operation for the current rule is terminated and the next rule is continued until a match is found or all rules are traversed.

4. The method according to claim 2, characterized in that, Before comparing the point value of the tail address block with the reference point value of the tail address block in the preset network partitioning rules, the method further includes: When the addition, modification or deletion of the network division rules is detected, the reference point value of the tail address block is recalculated for the changed part of the rules; The pre-built cache table is updated based on the recalculated reference point values, wherein the cache table is used to record the number of reference points for each loaded rule tail address block, and the corresponding logical shift value.

5. The method according to claim 1, characterized in that, The process of converting the target IP address into a unified IP address block includes: If the target IP address belongs to the IPv4 protocol version, the target IP address is divided into a single 4-byte address block with a length of 32 bits; If the target IP address belongs to the IPv6 protocol version, the target IP address is divided into four 4-byte address blocks with a length of 128 bits. The 4-byte address blocks are stored sequentially in network byte order to form a continuous IP address block independent of the protocol version.

6. The method according to claim 5, characterized in that, The step of logically right-shifting the tail address block within the IP address block according to the host bit width to obtain the bit value includes: The host bit width is determined based on the difference between the integer bit width and the length of the variable-length subnet mask; The number of bits for logical right shift is determined based on the remainder after modulo and minus correction of the host bit width; Based on the median value of the variable-length subnet mask length minus one, the quotient obtained by dividing by the integer bit width is used to determine the index position of the tail address block within the IP address block in the 4-byte address block sequence. Perform a logical right shift of the logical right shift bits on the tail address block located at the index position to obtain the bit value of the tail address block.

7. The method according to claim 1, characterized in that, After determining whether the target IP address matches the network partitioning rule, the method further includes: If the target IP address does not match the network partitioning rule, the target IP address will be stored in the unconfirmed asset database. If the target IP address matches the network partitioning rule, the device information corresponding to the target IP address will be stored in the asset confirmation database.

8. An IP address networking device, characterized in that, include: The module consists of a conversion module, a calculation module, and a control module, among which: The conversion module is used to convert the target IP address into an integrated IP address block, wherein the target IP address belongs to either the IPv4 protocol version or the IPv6 protocol version. The calculation module is used to determine the host bit width based on the variable-length subnet mask, and to perform a logical right shift on the tail address block within the IP address block to obtain the bit value based on the host bit width. The control module is used to compare the point value of the tail address block with the reference point value of the tail address block in the preset network partitioning rule to determine whether the target IP address matches the network partitioning rule.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the IP address networking method as described in any one of claims 1 to 7.

Images