217 results about "IPv4" patented technology

A system and a method for providing cybersecurity services in dual-stack traffic processing within one or more communication networks are disclosed. The system comprises one or more carrier edge nodes to transmit traffic data packets between one or more communication devices and one or more network services within the one or more communication networks by translating Internet Protocol version 6 (IPv6) addresses to Internet Protocol version 4 (IPv4) addresses. The one or more carrier edge nodes configured to assign one or more virtual local area network (VLAN) tags to at least one of: outbound communication device-originated data, and inbound communication device-originated data for identifying the traffic data packets. The one or more carrier edge nodes segments at least one of: the outbound and the inbound communication device-originated data into one or more categories for dynamically enforcing one or more security policies to provide the cybersecurity services.

The invention discloses a fusion quantum secure communication method of an NAT gateway, and relates to the technical field of communication network information security and quantum information. Comprising the steps of 1, creating a fusion quantum security communication system of an NAT gateway, 2, adopting a quantum hybrid encryption architecture through a quantum security module, and internally arranging a quantum key distribution unit and an anti-quantum computing acceleration chipset, 3, expanding a quintuple mapping structure of NAT through a dynamic address mapping and quantum encryption module, newly adding a quantum security dimension field QSV, and carrying out quantum encryption on the quantum key distribution unit and the anti-quantum computing acceleration chipset. And 4, developing a protocol non-inductive conversion engine through a hybrid protocol stack cooperation module, supporting an IPv4 / IPv6 dual-stack quantum tunnel and a quantum key inheritance protocol to realize cross-protocol family encryption parameter migration, dynamically adjusting a quantum encapsulation mode in an address conversion process, and dynamically associating an internal network address port with a quantum key parameter and a channel fingerprint feature. And 5, constructing a quantum perception type session state machine through an anti-quantum attack session management module, and performing a joint decision-making mechanism through quantum entanglement state monitoring and classical traffic feature analysis.

The invention relates to a method for realizing NAT on a core network UPF network element, and the method comprises the steps: when a user terminal establishes a 5G session, the UPF pre-allocates a public network IPv4 address and a continuous source port set for the session, the number of ports is dynamically adjusted according to a user package, and resources are bound to a session data structure; receiving a downlink packet of which a destination address is a public network IP based on a private network-to-public network mapping relation, positioning a session level hash table through a flow label direct index mechanism, adding a GTP-U packet header after reverse NAT conversion, and forwarding the packet to a mobile phone through service processing; on the basis of a stream label direct index mechanism, each session exclusively occupies an IP port pool and a hash table through a session-level resource isolation architecture, and is used for avoiding global lock competition in combination with multi-core CPU parallel processing; based on a DPI function switching strategy, an NAT mapping table is synchronized through a UPF cluster session mirroring mechanism for node fault switching zero packet loss.

The invention relates to an IPv4 data message processing method and device based on longest prefix matching. The method comprises the following steps: acquiring an IPv4 data message, and extracting a destination IP address in the message; based on a longest prefix matching mode, extracting a preset number of bits from the high order of the destination IP address; generating a search index through the preset number of bits; determining a corresponding table item in a pre-stored FPGA rule matching table according to the lookup index; extracting a message processing rule according to pre-stored information of the table item; and executing a subsequent processing action on the IPv4 data message based on the message processing rule. According to the method and the device, the IPv4 message prefix matching can be carried out through FPGA hardware acceleration, a matching result is generated through single query, linear speed processing under million-level rules is supported, and meanwhile, the longest prefix priority principle is automatically maintained when the rules are changed through a CPU-FPGA collaborative updating mechanism.

The present invention provides an automatic detection and network construction method based on the IPv6 protocol and an apparatus thereof, in which a user activates an auxiliary wizard program to determine whether the current connection to the Internet is a PPPoE protocol, and then carries out subsequent DHCPv6 communication protocols for PPPoE or IPoE environments to complete the construction of an IPV6 network and to obtain the required additional DHCPv6 information. In order to avoid the waste of IPV6 prefixes, the present invention also provides a method of hierarchically distributing prefixes through DHCP-PD. Finally, by obtaining the DHCPv6 additional information and the search method of PREF64, the appropriate IPv4 transition mechanism can be automatically determined and established. The present invention can not only significantly reduce the technical threshold for users to set up IPv6, but also complete the construction of the IPV6 network.

Network operators can define port mappings for UDP destination ports and the encapsulated protocol / traffic type (X) in UDP. BGP may be used to notify the UDP destination port-to-traffic type mapping to an encapsulator. A generic UDP encapsulation mechanism (X-in-UDP), where UDP can be used to encapsulate packets of any user configured protocol / traffic type X (e.g., IPv4, IPv6, MPLS, etc.), is described. Primary benefits of using UDP for encapsulation are to leverage UDP port numbers for load-balancing. Generic UDP encapsulation of any protocol / traffic type using user defined port-maps provides flexibility to network operators in constructing different overlay networks. UDP encapsulation helps leverage fine-grade load balancing over Equal-Cost Multipath (ECMP).

The invention relates to a hardware routing table look-up method based on segmented unified storage. The method comprises the following steps: firstly, acquiring an IPv4 / IPv6 routing prefix, dividing the IPv4 / IPv6 routing prefix into 1-4 address fields according to 32 bits, allocating a unique forward and backward segment identifier for each field, constructing table entries containing the segment identifiers, 32-bit segment data and a next hop, and uniformly storing the table entries into the same TCAM. During table lookup, segmenting an address to be looked up according to the same rule, querying the TCAM from a first segment by taking segment data as a key, and recording a backward segment identifier and a next hop after hit; and if the backward segment identifier is invalid, directly returning to the corresponding next hop, and if the backward segment identifier is valid, continuing query by taking the identifier and the next segment of data as a joint key. And when the table item is not hit or the identification verification fails, selecting the table item with the longest prefix and the valid next hop in the matched section, and returning to the next hop. According to the invention, IPv4 / IPv6 routing table entries can be uniformly stored, the TCAM space utilization rate is improved, and meanwhile, the hardware table look-up efficiency is guaranteed.

The invention discloses a corresponding management method for IPV4 and IPV6 addresses of the same user of network dual stacks, and relates to the technical field of network address management, network system nodes are divided into a main control node, a replica synchronization node and an edge cache node, a layered management architecture is constructed, hotspot users with frequent write-in are identified, a flow partitioning and path arbitration strategy is adopted, and the IPV4 and IPV6 addresses of the same user of the network dual stacks are correspondingly managed. The method comprises the following steps of: dynamically allocating an auxiliary book group, constructing a state deviation evaluation function, judging the consistency degree according to a version and hash information, selecting a corresponding synchronization strategy, fusing various mechanisms to form an execution layer consistency maintenance closed loop, and performing IPV4 and IPV6 address mapping relation management in a distributed environment. According to the management method, the stability, the accuracy and the reliability of the dual-stack user address mapping management system in a multi-source asynchronous operation environment are effectively enhanced by constructing a layered execution architecture which takes a main control node as a core, a copy synchronization node as a distribution guarantee and an edge cache node as a response terminal.

The invention relates to a network performance measurement method and device, computer equipment, a storage medium and a computer program product. Relates to the technical field of network security. The method comprises the following steps: in response to a network performance measurement instruction triggered by a user at a client, downloading a measurement script; calling the measurement script, and executing the following steps: generating a test access address of the to-be-tested website according to address information of the to-be-tested website; the test access address comprises an IPv4 access address and / or an IPv6 access address; sending an access request to the test access address, and recording a test result of the to-be-tested website; and sending the website address of the to-be-tested website, the test access address and the corresponding test result to a log server, so that the log server performs network performance measurement based on the test access address. By adopting the method, the accuracy of network performance measurement can be improved.

The invention discloses an IPv4 / IPv6 dual-stack network intelligent operation and maintenance management method and system based on AI, and relates to the field of AI. The method comprises the steps that through full-link multi-source data collection and feature processing of network equipment, terminals, protocols and services, a structured data set is constructed; real-time evaluation and visual monitoring of the network state are realized by using a multi-task AI model; once an abnormality is found, a fault node and a propagation path are accurately positioned through a fault diagnosis model; integrating various model outputs to automatically generate and execute a targeted operation and maintenance strategy; and on-line iterative optimization of the AI model and the knowledge base is driven through continuous effect evaluation and data feedback, so that the dual-stack network intelligent operation and maintenance capability of autonomous circulation is formed. The method has the advantages that AI enabling and dual-stack adaptation are focused, full-link multi-source data acquisition is taken as support, accurate evaluation, rapid diagnosis and intelligent decision making are realized through a multi-task fusion AI model, the operation and maintenance efficiency and the network stability are improved, and the labor cost is reduced.

Methods and systems for setting up a virtual private cloud can involve providing redundant or nested security layers including a local firewall within a provider firewall. In addition, a virtual private cloud proxy server can be provided with access to a data network through the local firewall and provider firewall. In addition, the virtual private cloud proxy server can be configured in coordination with the local firewall and the provider firewall to enable transparent proxying, wherein TCP / UDP traffic is redirected to a local port, with support interchangeable use IPV4 and IPV6, to selectively allow access to all system within the provider firewall. Furthermore, access can be provided to a set of rules, whereby internet packet traffic is filtered and then directed to and from clients within the local firewall based on a list of rules.

The embodiment of the invention provides a cross-network communication method and system, and the method comprises the steps: receiving source communication data; managing an address pool of the IPV4 network by adopting a bitmap scheme; according to the mapping relation list, adapting the source communication data to target communication data which can be transmitted by the target network and transmitting the target communication data to the target network; according to the bitmap scheme, the distribution state of the IPV4 addresses is marked through bits, the mapping relation list comprises the mapping relation among network identifiers of the multiple networks, and the target network is any one of the multiple networks different from the data source network. According to the embodiment of the invention, the data adaptation and transmission among different networks are realized, the compatibility problem between the articulated naturality web and the IPV4 network is effectively solved, and the data can be seamlessly switched and communicated between the two networks. The address pool of the IPV4 network in a plurality of networks is managed by adopting a bitmap scheme, and the allocation state of the IPV4 address is marked by bits, so that the efficient allocation and release of address resources are realized.

Various methods and processing systems are disclosed that provide an access termination component in a service provider network for managing network traffic. The method may include receiving dynamic host configuration protocol version 6 (DHCPv6) that solicits messages from one or more customer premise devices (CPEs) seeking network configuration information, transmitting DHCPv6 provisioning responses to the one or more CPEs, each DHCPv6 provisioning response which may include IPv6 provisioning parameters, updating an IPv4 prefix table with IPv4 prefixes, the IPv4 prefix table storing information related to networks that share IPv4 addresses, determining a 48-bit address and port set identifier value and a corresponding media access control (MAC) address, and adding the determined 48-bit address and port set identifier value and the corresponding MAC address into an address and port set identifier to MAC hash table.

The invention relates to an IPv4 / IPv6 traffic scheduling method, device and equipment in a dual-stack environment and a storage medium, and the method comprises the steps: deploying IPv4 / IPv6 translation equipment and a traffic scheduling DNS component, and configuring a traffic scheduling rule on the traffic scheduling DNS component; matching a DNS request domain name initiated by a dual-stack terminal based on the traffic scheduling rule; and executing traffic scheduling operation according to a matching result, and accessing the data path. Through cooperative work of a flow scheduling DNS component and translation equipment, an IPv4 / IPv6 path is selected according to a domain name or an address range based on a demand factor configuration rule table, and IPv4 / IPv6 flow scheduling in a dual-stack network environment is realized.

Edge networks for surrogate browsing and direct traffic via proxy are disclosed. A first server processes a received first IPv4 packet into an encapsulation. The encapsulation is sent to a second server. The second server determines a third server to which the encapsulation should be routed and transmits it. The third server processes the encapsulation, selects a public IP address, and transmits a second IPv4 packet using the selected public IP address as a source address of the second IPv4 packet.

The invention relates to a multi-tenant unified storage routing table item compression method and system based on identification mapping. The method comprises the following steps: in a routing table entry insertion stage, dynamically distributing a minimum available reduce ID for each new tenant, and ensuring that an IP prefix space of the new tenant is not overlapped with a tenant using the same reduce ID; in the lookup stage, a message VNI is firstly converted into a reduce ID through a mapping table realized based on an RAM, then the reduce ID and a destination IP are used as a joint key to look up the TCAM, and by constructing a mapping relation from the VNI to the reduce ID, the table item bit width of the TCAM is remarkably reduced on the premise of ensuring the routing correctness. The method is suitable for an IPv4 / IPv6 multi-tenant environment, the hardware area and power consumption can be effectively reduced especially in an FPGA or ASIC high-performance data plane, and meanwhile the line speed forwarding capacity is kept.

The invention provides a method for making a CPE self-adapt to an ACS, which relates to the field of communication technology and comprises the following steps: S1, monitoring the IP address of a TR-069 management interface of a CPE through a Netlink protocol, generating a valid HTTP connection request URL, and making the ACS initiate a connection request to the CPE, wherein the TR-069 management interface is a network card that carries TR-069 data; S2, the CPE, as a client, resolves the IP address of the ACS according to a domain name, creates a corresponding socket, regularly initiates an HTTP connection request session to the ACS, and reports basic information of the CPE to the ACS, wherein the basic information includes the HTTP connection request URL and events occurring during the period, the ACS returns response information, and the HTTP connection is disconnected after the session ends; S3, the CPE, as a server, creates a socket compatible with IPv4 and IPv6, and when the CPE is operated, the ACS immediately initiates a connection request to the HTTP connection request URL of the CPE, actively connects to the CPE, the CPE actively initiates a session, and reports a "6CONNECTION REQUEST" event and response information to the ACS, thereby realizing self-adaptation of the CPE to the ACS.

The application provides a lightweight inter-satellite routing implementation method and system suitable for a VDES constellation, the method comprising: a satellite pre-storing the topology of the entire constellation; a satellite sending end dividing data to be sent into smaller data packets, and encapsulating each data packet according to an IPv4 or IPv6 protocol; a gateway station specifying a central satellite and broadcasting to the entire constellation; each satellite calculating the shortest path from itself to the central satellite according to the central satellite by using a shortest path algorithm; sending IP data packets to the central satellite according to the calculated path; the central satellite sending data to the gateway station; the gateway station sending data and forwarding rules to the central satellite after processing; and the central satellite sending data to a destination satellite according to the forwarding rules. The application realizes interconnection and intercommunication between VDES satellites, and the protocol of the application is simple and reliable, and is suitable for running in a satellite on-board environment.

A disclosed method facilitates bidirectional traffic flows between a multi-tenant service and endpoints with private customer internet protocol (IP) addresses. The method provides for receiving a data packet having a data packet header identifying a first IPv6 address as a destination. The first IPv6 address embeds a first IPv4 address and a virtual network (VNet) identifier uniquely identifying a VNet of a cloud compute platform. The method further provides for routing the data packet to a host node within the cloud compute platform that hosts a virtual machine (VM) within the VNet identified by the VNet identifier and assigned to the first IPv4 address.

The application relates to a unified IPv4 / IPv6 address management method in an IPv6 evolution environment, which comprises the following steps: arranging all IPv4 and IPv6 address segments, planning IPv4 and IPv6 communication scenarios, allocating IPv4 and IPv6 mapping address segments, defining IPv4 and IPv6 address translation rules according to the IPv4 and IPv6 mapping address segments, generating an IPv4 and IPv6 address translation rule set, and generating corresponding mapping addresses for each real IPv4 / IPv6 address according to the IPv4 and IPv6 address translation rule set. In the process of IPv6 evolution, the real IPv4 / IPv6 address, the mapping IPv4 / IPv6 address and the IPv4 / IPv6 address translation rule involved in the IPv4 / IPv6 coexistence and communication scenario can be effectively managed.

This invention relates to a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis; it includes the following steps: multi-source parallel acquisition: collecting network layer information of various terminal devices in the intranet through command line interface or application programming interface; data cleaning and standardization: after acquisition, cleaning and standardizing the raw data; target device identification and detection strategy generation: based on the cleaned address list and combined with device information, identifying the target device type and automatically generating corresponding detection parameters; multi-protocol asset detection packet sending: sending detection packets to target IPv4 and IPv6 addresses according to configuration parameters; response data parsing and fingerprint recognition: performing structured parsing and multi-dimensional recognition on the received response data; dual-stack network data fusion and statistical analysis: after fingerprint recognition, fusing and analyzing the IPv4 and IPv6 detection results and constructing a unified asset database.

A method and system provide a BKAS addressing scheme. The scheme enables the encoding of disjoint intervals in each addressing block of an IPv6 / IPv4 address. This scheme permits a better flexibility in IP packet matching and an improved implementation of security policies by highly compressing the number of rules and offering much more expressivity in their semantics. This simplifies the configuration of security and network devices while significantly reducing the configuration anomalies. Furthermore, an efficient matching algorithm and a set of transitional methods are also provided. A BKAS design strategy for network subnetting is also provided, allowing for the elimination of all overlaps in the configuration rules of network and security devices while avoiding a combinatorial explosion of the number of configuration rules. The BKAS addressing scheme can be included in any hardware and software program.

A user plane function (UPF) of a telecommunications network configured to prioritize IPv6 addresses over IPv4 addresses for transmitting content over the telecommunications network from a content server to a user device. The UPF can receive a content request at including a uniform resource locator (URL) pointing to a resource on a host server. The UPF can also receive DNS queries including an AAAA and A record request. The UPF can forward the AAAA record and A record to a DNS server and receive an IPv6 and IPv4 address in response. The UPF can either delay A record transmission to the user device or transmit an x-header to the user device to facilitate an IPv6 client-server connection. The UPF can generate a data packet with the resource from the host server and transmit it to the user device using the IPv6 client-server connection.

The invention discloses an access method and device, communication equipment and a storage medium. The method comprises: a BRAS receiving a first request sent by a terminal device; the first request is used for requesting a first record of the first domain name; sending a second request to the domain name server, and receiving a second response corresponding to the second request sent by the domain name server; the second request comprises a first prefix identifier corresponding to the BRAS, the second request is used for requesting a second record of the first domain name, and the second response comprises the second record; the second record comprises an address translation prefix corresponding to the first prefix identifier; and a first response corresponding to the first request is sent to the terminal device, the first response comprises a first record, the first record comprises an address conversion prefix corresponding to the first prefix identifier, and the first record is used for modifying the IPv4 destination address into the IPv6 destination address by the terminal device so as to initiate access to the IPv6 destination address.

The present invention discloses a domain name query method, device, non-volatile storage medium, and electronic device. The method comprises: obtaining a first domain name query request for a target domain name based on a first domain name type, wherein the first domain name query request is used to indicate a query in a preset cache space for a first domain name address based on Internet Protocol version 6 (IPv6) corresponding to the target domain name and the first domain name type; if the first domain name address cannot be found in the preset cache space, converting the first domain name request to a second domain name query request based on a second domain name type, wherein the second domain name query request is used to indicate a query in the preset cache space for a second domain name address based on Internet Protocol version 4 (IPv4) corresponding to the target domain name and the second domain name type; and converting the second domain name address to the first domain name address according to a preset algorithm mapping table. The present invention solves the technical problem that the prior art cannot enable services that only support IPv4 to support the use of an IPv6 single stack.

The invention provides an IPv6 conversion processing method and device, equipment, a medium and a product, and the method comprises the steps: obtaining an original access request sent by a user, parsing a source station domain name requested to be accessed by the original access request into an IPv6 address, and obtaining a target access request after the parsing; sending the target access request to a proxy server matched with the user through an intelligent load balancing server, so that the proxy server forwards the target access request to an IPv4 address of a source station; and obtaining response content fed back by the source station, and forwarding the response content to the user.

The application discloses a networking method and system based on dynamic IPv6 addresses, wherein the system comprises terminal equipment and a VPN gateway, and the terminal equipment accesses a network through the VPN gateway. The dynamic change of the IPv6 address of the VPN gateway (if the public IPv4 address is sufficient, the method is also applicable) can effectively alleviate the network asset exposure surface and reduce the possibility of being attacked by taking advantage of the unlimited nature of the IPv6 address.

The present disclosure provides an IPv6 conversion processing method, device, equipment, medium and product, wherein the method comprises: obtaining an original access request sent by a user, and resolving a source station domain name requested by the original access request into an IPv6 address to obtain a target access request after resolution; sending the target access request to a proxy server matched with the user through an intelligent load balancing server, so that the proxy server forwards the target access request to an IPv4 address of a source station; and obtaining response content fed back by the source station, and forwarding the response content to the user.

A method for identifying end devices within a NATed network based on clustering TCP timestamp sequences belongs to the field of broadband network technologies in data communication. First, all TCP flows are extracted from a PCAP file formed by mixed traffic simultaneously collected from multiple terminals under a router according to the five-tuple, and invalid data rows are deleted through packet filtering. Then, the remaining data is used for quasi-linear regression analysis to obtain the slope and intercept parameters required for clustering, and a special normalization process is also performed on the timestamps during this process. Finally, the spectral clustering algorithm is used to cluster the generated samples, thereby determining the number of end devices and the corresponding associated TCP flows. The present invention is applicable to scenarios where IPv4 addresses are scarce and NAT is widely used. It can significantly improve the accuracy of home network monitoring and user behavior analysis, provide more valuable data for operators, solve the problem of device identification in the NAT environment, provide an efficient and accurate method for device counting and TCP flow differentiation, and contribute to the reasonable allocation and management of network resources.

The invention discloses a network repairing method and device and a storage medium, which are used for improving the stability and reliability of network connection. The method comprises the following steps: when a terminal runs, detecting whether the terminal has data transmission stagnation in network connection; if yes, respectively detecting the connection conditions of the IPv4 network and the IPv6 network of the terminal; and when the connection condition of at least one of the IPv4 network and the IPv6 network is connection failure, executing an automatic repair process which is used for repairing the connection of the IPv4 network and the IPv6 network.