Packet forwarding method supporting path changing and sending and receiving end hiding

Abstract

Provided in the present application is a packet forwarding method supporting path changing and sending and receiving end hiding, the method comprising: a sending end sending a packet to a network, wherein a packet header carries a random forwarding flag bit Flag and an encrypted receiving end identifier SRID; after receiving the packet, a random forwarding node randomly selecting an address from a next-hop address candidate set to forward the packet; and after receiving the packet, a decryption node decrypting the SRID and parsing same to obtain a receiving end address RIP, adding the RIP to the next-hop address candidate set, and randomly selecting an address from the next-hop address candidate set to forward the packet, until the packet is forwarded to a receiving end. The present application has the following advantages: data routing cannot be predicted in advance, and the sending end is hidden; the receiving end of the packet is hidden by means of a method for encrypting a receiving end identifier, such that an attacker cannot obtain the correlation of the packet by analyzing feature fields of the sending end and the receiving end, and the sending end and the receiving end are anonymous; and thus the overall difficulty of the attacker in stealing data is increased, and the anti-attack capability of the network is improved.

Description

A message forwarding method supporting variable path and transceiver end hiding

[0001] Related Applications

[0002] This application claims priority to Chinese Patent Application No. 202410875239.7, filed on July 2, 2024, entitled “A message forwarding method supporting variable path and transceiver end hiding”, which is hereby incorporated by reference. TECHNICAL FIELD

[0003] The present application belongs to the technical field of information security in a network environment, and specifically relates to a message forwarding method supporting variable path and transceiver end hiding. BACKGROUND

[0004] Public networks have the characteristics of user openness, access openness, and transmission openness, so the use of public networks for transmission of sensitive data faces security risks and is extremely vulnerable to network attacks. Eavesdropping attacks are a very dangerous network attack. Attackers lurk in the network, collect communication data on nodes or links through port traffic mirroring, data replication, and other means, and then use analysis tools to analyze message characteristics to obtain important sensitive information such as target passwords and communication sessions, thereby seriously threatening network security.

[0005] Currently, networks mostly use deterministic routing methods, which leads to the fact that routing paths can be predicted in advance, and attackers can easily find key nodes and paths and intercept information during the routing process. At the same time, the headers of the data packets forwarded in the network are mostly plaintext information, which can be easily analyzed for relevance and then filtered for target information.

[0006] Existing security defense methods are divided into static defense and mobile target defense methods. Static defense methods protect data content confidentiality through end-to-end encryption and other technologies. With the development of quantum computing and other technologies, it is possible to break the code, and relying solely on encryption technology cannot meet higher communication security needs. Mobile target defense methods increase routing dynamics through path hopping and other technologies to increase the difficulty for attackers to find paths, but existing methods mostly calculate hopping paths based on global topology, which has high overhead, poor scalability, and security dependent on central systems. At the same time, attackers can easily analyze the relevance of data packets based on the characteristic information in the message header, including the IP addresses of the transceiver ends.

[0007] Therefore, a method is proposed that can provide path concealment and transceiver end anonymity for data packets during transmission in a network, which is of great significance for improving the security and attack resistance of networks.

[0008] SUMMARY

[0009] The present application aims to overcome the defects that the security of user data and identity information is difficult to guarantee in the existing network transmission process.

[0010] To achieve the above-mentioned purpose, the present application provides a message forwarding method supporting variable path and transceiver end hiding, which relates to a network composed of a sending end, a receiving end and a plurality of network nodes, characterized in that,

[0011] The network adopts an architecture separating identity from address, uses an identifier irrelevant to network address to uniquely identify the receiving end, and uses an analysis system to maintain the mapping relationship between the receiving end identifier RID and the receiving end network address RIP;

[0012] The network nodes carrying the message forwarding include random forwarding nodes and decryption nodes; the decryption nodes are selected from the set of random forwarding nodes according to a set rule; all decryption nodes generate the same public key PK and private key SK using a group key negotiation algorithm;

[0013] The message forwarding method includes:

[0014] Step 1) After receiving the message, the network node adopts different processing methods according to the node type for the message with the destination address being the node address and the random forwarding flag bit Flag indicating random forwarding, if the node is a decryption node, go to step 2), if it is a random forwarding node, go to step 3), otherwise go to step 4);

[0015] Step 2) The network node uses the private key SK to decrypt the SRID to obtain the receiving end identifier RID, and obtains the receiving end address RIP from the analysis system, adds RIP to the next hop candidate address set, and goes to step 3);

[0016] Step 3) The network node selects an address from the next hop candidate address set using a random selection algorithm, modifies the message destination address to the address, and modifies the source address to the network address of the current node, and goes to step 4);

[0017] Step 4) The network node forwards the message according to the destination address.

[0018] As an improvement of the above-mentioned method, the message forwarding method further includes the process of sending the message by the sending end:

[0019] The sending end sends the message to the network node, and the message header carries the random forwarding flag bit Flag and the receiving end encrypted identifier SRID; the source address of the message is filled with the sending end address, and the destination address is filled with the entry network node address; the receiving end encrypted identifier SRID is generated based on the public key PK and the receiving end identifier RID, and at the same time supports that the private key SK and the encrypted identifier SRID can be decrypted to obtain RID.

[0020] As an improvement of the above method, the setting rule comprises: periodic random selection; the periodic random selection method is: selecting N from all M random forwarding nodes as decryption nodes with time T as a period, and reselecting and updating the decryption nodes every time T, wherein N / M does not exceed a set proportion threshold α; the proportion threshold α is determined according to security and efficiency needs.

[0021] As an improvement of the above method, the group key agreement algorithm used by the decryption node comprises: a distributed group key agreement algorithm, an attribute-based key agreement algorithm or a centralized key distribution method; the update frequency of the public-private key pair and the storage mode of the private key are adjusted according to security requirements.

[0022] As an improvement of the above method, the generation method of the receiving end encryption identifier SRID comprises: directly encrypting the receiving end identifier RID using the public key PK to generate, or encrypting a binary number obtained by splicing the receiving end identifier RID and a random number sequence rand using the public key PK to generate;

[0023] The asymmetric cryptographic algorithm used for generating the SRID using the public key PK comprises: ECC and RSA;

[0024] The random number sequence rand is a binary bit stream generated by using a random algorithm.

[0025] As an improvement of the above method, the random forwarding flag bit Flag represents the meaning comprising: using the variable path and the transceiver end hiding capability, or not using the variable path and the transceiver end hiding capability.

[0026] As an improvement of the above method, the next hop candidate address set of the random forwarding node is a subset selected from a set comprising all random forwarding node addresses and decryption node addresses by a screening method; the screening method comprises: random selection and service level selection based on analysis system.

[0027] As an improvement of the above method, the random selection algorithm of the random forwarding node comprises: a simple random sampling algorithm, a reservoir sampling algorithm, a weighted random selection algorithm and a random walk algorithm.

[0028] As an improvement of the above method, the next hop candidate address set of the decryption node is composed of an address subset selected from the random forwarding node address set and the decryption node address set, and the receiving end address RIP.

[0029] As an improvement of the above method, the random selection algorithm of the decryption node is selected according to security and efficiency requirements, and the optional method comprises: a weighted random selection algorithm, a random walk algorithm with a hop threshold and a random gradient descent algorithm.

[0030] Compared with the prior art, the application has the advantages of:

[0031] The application provides a message forwarding method supporting variable path and transmitter-receiver hiding. The method hides the transmitter by random forwarding, so that the data routing cannot be predicted in advance. The method hides the feature information of the receiver by encrypting and randomly confusing the receiver identifier, so that the attacker cannot obtain the message correlation by analyzing the feature field. The method increases the difficulty of data stealing for the attacker, improves the anti-attack ability of the network, and provides anonymity of the transmitter and receiver. BRIEF DESCRIPTION OF DRAWINGS

[0032] Fig. 1 is a flowchart of the message forwarding method supporting variable path and transmitter-receiver hiding;

[0033] Fig. 2 is a network architecture supporting variable path and transmitter-receiver hiding;

[0034] Fig. 3 is a structure diagram of the data message supporting variable path and transmitter-receiver hiding;

[0035] Fig. 4 is a processing flow of the decryption node data message;

[0036] Fig. 5 is a processing flow of the random forwarding node data message. DETAILED DESCRIPTION

[0037] The technical solutions of the application will be described in detail below with reference to the accompanying drawings.

[0038] The application provides a message forwarding method supporting variable path and transmitter-receiver hiding. The method involves a network composed of a transmitter, a receiver and a plurality of network nodes. The network adopts an architecture separating the identifier from the address, uses an identifier irrelevant to the network address to uniquely identify the receiver, and uses an analysis system to maintain the mapping relationship between the receiver identifier RID and the receiver network address RIP. The network nodes carrying the message forwarding include random forwarding nodes and decryption nodes. The decryption nodes are selected from the set of random forwarding nodes according to a set rule. All decryption nodes generate the same public key PK and private key SK using a group key negotiation algorithm.

[0039] The set rule includes periodic random selection. The periodic random selection method is to randomly select N nodes from all M random forwarding nodes as decryption nodes with a period T, and to reselect and update the decryption nodes every T time, wherein N / M does not exceed a set proportion threshold α. The value of the proportion threshold α is determined according to the needs of security and efficiency.

[0040] The group key negotiation algorithm used by the decryption node includes a distributed group key negotiation algorithm, an attribute-based key negotiation algorithm, or a centralized key distribution method; the update frequency of the public-private key pair and the storage mode of the private key are adjusted according to security requirements.

[0041] As shown in FIG. 1, the message forwarding method supporting variable path and transceiver end hiding includes:

[0042] Step 1: The sending end sends a message to a network node, and the message header carries a random forwarding flag bit Flag and a receiving end encryption identifier SRID; the source address of the message is filled with the address of the sending end, and the destination address is filled with the address of the entry network node; the receiving end encryption identifier SRID is generated based on the public key PK and the receiving end identifier RID, and the private key SK and the encryption identifier SRID can be decrypted to obtain the RID.

[0043] The generation method of the receiving end encryption identifier SRID includes directly encrypting the receiving end identifier RID using the public key PK or encrypting the binary number obtained by splicing the receiving end identifier RID and a random number sequence rand using the public key PK. The random number sequence rand is a binary bit stream generated using a random algorithm.

[0044] The asymmetric cryptographic algorithm used for generating the SRID using the public key PK includes ECC and RSA.

[0045] The random forwarding flag bit Flag represents the meaning including: using the variable path and transceiver end hiding capability, or not using the variable path and transceiver end hiding capability.

[0046] Step 2: After receiving the message, the network node processes the message according to different node types if the destination address is the address of the node and the random forwarding flag bit Flag indicates random forwarding, if the node is a decryption node, go to step 3, if it is a random forwarding node, go to step 4, otherwise go to step 5.

[0047] Step 3: The network node uses the private key SK to decrypt the receiving end encryption identifier SRID to obtain the receiving end identifier RID, parses the receiving end address RIP from the parsing system, adds RIP to the next hop candidate address set, and goes to step 4.

[0048] The next hop candidate address set of the random forwarding node is a subset selected from a set containing all random forwarding node addresses and decryption node addresses by a screening method; the screening method includes random selection and service level selection based on the parsing system.

[0049] The next-hop candidate address set of the decryption node is composed of an address subset filtered from the random forwarding node address set and the decryption node address set, and the receiving end address RIP.

[0050] Step 4: The network node selects an address from the next-hop candidate address set by using a random selection algorithm, modifies the message destination address to the address, and modifies the source address to the network address of the current node, and goes to step 5.

[0051] The random selection algorithm of the random forwarding node includes a simple random sampling algorithm, a reservoir sampling algorithm, a weighted random selection algorithm, and a random walk algorithm.

[0052] The random selection algorithm of the decryption node is selected according to security and efficiency requirements, and optional methods include a weighted random selection algorithm, a random walk algorithm with a hop threshold, and a random gradient descent algorithm.

[0053] Step 5: The network node forwards the message according to the destination address.

[0054] Embodiment 1

[0055] As shown in FIG. 2, there are n network nodes with random forwarding capability (referred to as random forwarding nodes) in the network, and m of them are selected as network nodes with encryption and decryption capability (referred to as decryption nodes), and the ratio of m / n does not exceed the threshold α. All decryption nodes generate the same public key eCP_PK and private key eCP_SK through a group key negotiation algorithm, the public key is published in the network, and the private key is securely stored locally. It should be noted that the decryption node is an enhanced random forwarding node, which has the complete functions of the random forwarding node, and also has the functions of generating and maintaining public and private keys and asymmetrically encrypting and decrypting messages. In this embodiment, the total number of random forwarding nodes is n = 20, the number of decryption nodes is m = 5, and the threshold α = 25%.

[0056] FIG. 3 is a structure diagram of a data message supporting variable path and transceiver end hiding, which uses an IPv6 extension header to extend the message field related to encryption and randomness. The meanings of the fields are as follows:

[0057] IPv6 basic header:

[0058] Next header: filled with 0x99, indicating that the extended message header supporting variable path and transceiver end hiding capability is used;

[0059] Source address: filled with the IP of the current node, i.e., LN_IP;

[0060] Destination address: filled with the IP of the next-hop node, i.e., NextHop_IP.

[0061] Extended packet header:

[0062] Receiving end encryption identifier SRID: encrypted by using the public key eCP_PK on the binary number spliced by the receiving end identifier RID and a fixed length random number sequence rand, that is, SRID = eCP_PK(concatenate(RID, rand))

[0063] Random forwarding flag bit (Flag): 1 bit, indicating whether to use the variable path and the ability of transceiver end hiding, 1-enabled, 0-not enabled;

[0064] Figure 4 is the processing flow after the decryption node receives the data packet, which specifically includes:

[0065] Step 1: detect the destination address and the encrypted random forwarding flag bit in the packet header, and judge whether it is the data packet that needs to be processed by the node (i.e. "Destination Address==LN_IP&&SR Flag==1")

[0066] Step 1.1: if it is true, go to step 2;

[0067] Step 1.2: otherwise, go to step 4;

[0068] Step 2: use the decryption node group shared private key eCP_SK to decrypt the encrypted identifier SRID to obtain the receiving end identifier RID;

[0069] Step 3: based on RID, the corresponding receiving end address RIP is obtained by parsing the parsing system;

[0070] Step 4: add RIP to the next hop candidate address set, and increase the weight of RIP;

[0071] Step 5: adopt weighted random selection to randomly select a node as the next hop forwarding node;

[0072] Step 6: modify the destination address of the data packet to the network address of the selected next hop forwarding node, and modify the source address to the network address of the current node;

[0073] Step 7: forward the data packet.

[0074] Figure 5 is the processing flow after the random forwarding node receives the data packet, which specifically includes:

[0075] Step 1: detect the destination address and the random forwarding flag bit Flag in the packet header, and judge whether it is the data packet that needs to be processed by the node (i.e. "Destination Address==LN_IP&&Flag==1")

[0076] Step 1.1: If true, go to Step 2;

[0077] Step 1.2: Otherwise, go to Step 4;

[0078] Step 2: From the next-hop candidate address set, randomly select a node as the next-hop forwarding node, go to Step 3;

[0079] Step 3: Modify the destination address of the data packet to the selected network address, and modify the source address to the network address of the current node;

[0080] Step 4: Forward the data packet.

[0081] The overall steps of the random forwarding of the data packet spkt in the network are as follows:

[0082] The sending end sends the data packet spkt(SRID, Flag = 1), the source address is filled in as the sending end address SIP, and the destination address is filled in as the address of the entry network node;

[0083] Forward the data packet according to the destination address, and judge:

[0084] (2.1) If the next-hop node is a random forwarding node, go to Step (3);

[0085] (2.2) If the next-hop node is a decryption node, go to Step (4);

[0086] (2.3) If the next-hop node is the receiving end, the process ends.

[0087] The random node receives spkt(SRID, Flag = 1), and judges:

[0088] (3.1) If the packet destination address is the address of the node and Flag = 1, randomly select an address NextHop_IP from the next-hop candidate address set, go to Step (5);

[0089] (3.2) Otherwise, go to Step (2);

[0090] The encryption node receives spkt(SRID, Flag = 1), and judges:

[0091] (4.1) If the packet destination address is the address of the node and Flag = 1,

[0092] (4.1.1) Use eCP_SK to decrypt SRID to get plaintext, and take the front fixed length (160 bits) as the receiving end identifier RID;

[0093] (4.1.2) using the RID query resolution system to obtain the receiving end address RIP;

[0094] (4.1.2) adding the receiving end address RIP into the next hop candidate set NAList to obtain a set NAList', and increasing the weight value of RIP;

[0095] (4.1.3) using a weighted random selection algorithm to randomly select an address NextHop_IP from the next hop candidate address set NAList', and transferring to step (5);

[0096] (4.2) otherwise, transferring to step (2);

[0097] modifying the destination address of the packet to NextHop_IP and the source address to the current node address LN_IP, and transferring to step (2);

[0098] The packet forwarding method provided by the application supports variable paths and transceiver end hiding, makes data routing unpredictable in advance through random forwarding, and hides the sending end; the characteristic information of the receiving end is hidden through encryption and random confusion of the receiving end identifier, so that an attacker cannot obtain the packet correlation through analysis of the characteristic field; the difficulty of data stealing by the attacker is increased, the anti-attack capability of the network is improved, and the anonymity of the transceiver end is provided.

[0099] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the application and are not limiting. Although the application is described in detail with reference to the embodiments, those skilled in the art should understand that the technical solutions of the application can be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the application, and all should be covered in the scope of the claims of the application.

Claims

1. A message forwarding method supporting variable path and transceiver hiding, involving a network comprising a sending end, a receiving end and a plurality of network nodes, characterized in that, the network adopts an architecture separating identity from address, uses an identifier irrelevant to network address to uniquely identify the receiving end, and uses a resolution system to maintain the mapping relationship between the receiving end identifier RID and the receiving end network address RIP; the network nodes carrying the message forwarding comprise random forwarding nodes and decryption nodes; the decryption nodes are selected from the set of random forwarding nodes according to a set rule; all decryption nodes use a group key negotiation algorithm to generate the same public key PK and private key SK; the message forwarding method comprises: Step 1) After receiving a message, the network node adopts different processing methods according to node type for the message with the destination address being the address of the node and the random forwarding flag bit Flag indicating random forwarding; if the node is a decryption node, go to Step 2); if it is a random forwarding node, go to Step 3); otherwise, go to Step 4); Step 2) The network node uses the private key SK to decrypt the receiving end encrypted identifier SRID to obtain the receiving end identifier RID, resolves the receiving end address RIP from the resolution system, adds RIP to the next hop candidate address set, and goes to Step 3); Step 3) The network node selects an address from the next hop candidate address set using a random selection algorithm, modifies the destination address of the message to the address, modifies the source address to the network address of the current node, and goes to Step 4); Step 4) The network node forwards the message according to the destination address.

2. The message forwarding method of claim 1, wherein, The message forwarding method further comprises the process of sending the message by the sending end: The sending end sends the message to the network node, and the message header carries the random forwarding flag bit Flag and the receiving end encrypted identifier SRID; the source address of the message is filled with the address of the sending end, and the destination address is filled with the address of the entry network node; the receiving end encrypted identifier SRID is generated based on the public key PK and the receiving end identifier RID, and supports decryption of RID based on the private key SK and the encrypted identifier SRID.

3. The message forwarding method of claim 1, wherein, The set rule comprises periodic random selection; the periodic random selection method is to randomly select N nodes from all M random forwarding nodes as decryption nodes with a period of time T, and to reselect and update the decryption nodes every time T, wherein N / M does not exceed a set proportion threshold α; the proportion threshold α is determined according to security and efficiency requirements.

4. The message forwarding method of supporting variable path and transceiver hiding according to claim 1, characterized in that, The group key negotiation algorithm used by the decryption nodes comprises a distributed group key negotiation algorithm, an attribute-based key negotiation algorithm or a centralized key distribution method; the update frequency of the public-private key pair and the storage method of the private key are adjusted according to security requirements.

5. The method of claim 1, wherein the method further comprises: The generation method of the receiving end encrypted identifier SRID comprises directly encrypting the receiving end identifier RID using the public key PK or encrypting the binary number obtained by splicing the receiving end identifier RID and a random number sequence rand using the public key PK; The asymmetric cryptographic algorithm used for generating SRID using the public key PK comprises ECC and RSA; The random number sequence rand is a binary bit stream generated by a random algorithm.

6. The method of claim 1, wherein the method further comprises: The random forwarding flag Flag represents the meaning of using or not using the variable path and the transceiver end hiding capability.

7. The method of claim 1, wherein the method further comprises: The next hop candidate address set of the random forwarding node is a subset selected from a set containing all random forwarding node addresses and decryption node addresses by a screening method. The screening method includes random selection and service level selection based on the analysis system.

8. The method of claim 1, wherein the method further comprises: The random selection algorithm of the random forwarding node includes simple random sampling algorithm, reservoir sampling algorithm, weighted random selection algorithm and random walk algorithm.

9. The method of claim 1, wherein the method further comprises: receiving a packet from a first node; determining whether the first node is a source node or a relay node; and determining whether to forward the packet to a second node based on the determination of whether the first node is the source node or the relay node. The next hop candidate address set of the decryption node is composed of an address subset selected from the random forwarding node address set and the decryption node address set, and the receiving end address RIP.

10. The method of claim 1, wherein the method further comprises: The random selection algorithm of the decryption node is selected according to the security and efficiency requirements, and the optional methods include weighted random selection algorithm, random walk algorithm with hop threshold and random gradient descent algorithm.

Images