298 results about "IPv4" patented technology

A system and a method for providing cybersecurity services in dual-stack traffic processing within one or more communication networks are disclosed. The system comprises one or more carrier edge nodes to transmit traffic data packets between one or more communication devices and one or more network services within the one or more communication networks by translating Internet Protocol version 6 (IPv6) addresses to Internet Protocol version 4 (IPv4) addresses. The one or more carrier edge nodes configured to assign one or more virtual local area network (VLAN) tags to at least one of: outbound communication device-originated data, and inbound communication device-originated data for identifying the traffic data packets. The one or more carrier edge nodes segments at least one of: the outbound and the inbound communication device-originated data into one or more categories for dynamically enforcing one or more security policies to provide the cybersecurity services.

Aspects of the subject disclosure may include, for example, establishing a Layer 2 multipoint virtual private network (VPN) among a plurality of sites connected via a switched, shared or dedicated ethernet provided by a service provider, where the plurality of sites correspond to multiple locations of a target enterprise, determining a count of the plurality of sites that requires a connection to one or more cloud service providers over a common backbone network of the service provider, generating a VLAN that conforms to a Border Gateway Protocol (BGP), assigning a block of IP addresses to a network of the target enterprise, based on the determined count, assigning two or more subnets having IP addresses of both IPv4 and IPV6 address families with respect to the VLAN, and connecting the plurality of sites to the one or more cloud service providers. Other embodiments are disclosed.

A method is provided in which in a case where a predetermined instruction is received, and Internet Protocol version 4 (IPv4) is set as a protocol used for communication by an information processing apparatus, a first setting process is executed without executing a display process, and in a case where the predetermined instruction is received, and another protocol different from IPv4 is set as a protocol used for communication by the information processing apparatus, the display process is executed.

The invention discloses an automatic configuration method and device for load balancing equipment, and belongs to the technical field of networks, and the method comprises the steps: obtaining load balancing planning information; extracting a data center network area, load balancing equipment and IPv4 / IPv6 planning information, analyzing a corresponding relation among the information, and forming a network matrix in combination with a financial service current situation; setting a load balancing demand template, and receiving and arranging load balancing configuration demands; remotely connecting the load balancing equipment, reading the equipment configuration, analyzing the existing equipment configuration, and classifying; matching the load balancing configuration demand with the network matrix, and incrementally and automatically generating a configuration command line or an API interface change template to obtain final load balancing configuration; and remotely connecting each load balancing device of the data center and issuing final load balancing configuration. According to the method, the load balancing configuration work can be simply and efficiently completed, the load configuration efficiency and accuracy are improved, and the security of the financial cloud data center is guaranteed.

The invention discloses a fusion quantum secure communication method of an NAT gateway, and relates to the technical field of communication network information security and quantum information. Comprising the steps of 1, creating a fusion quantum security communication system of an NAT gateway, 2, adopting a quantum hybrid encryption architecture through a quantum security module, and internally arranging a quantum key distribution unit and an anti-quantum computing acceleration chipset, 3, expanding a quintuple mapping structure of NAT through a dynamic address mapping and quantum encryption module, newly adding a quantum security dimension field QSV, and carrying out quantum encryption on the quantum key distribution unit and the anti-quantum computing acceleration chipset. And 4, developing a protocol non-inductive conversion engine through a hybrid protocol stack cooperation module, supporting an IPv4 / IPv6 dual-stack quantum tunnel and a quantum key inheritance protocol to realize cross-protocol family encryption parameter migration, dynamically adjusting a quantum encapsulation mode in an address conversion process, and dynamically associating an internal network address port with a quantum key parameter and a channel fingerprint feature. And 5, constructing a quantum perception type session state machine through an anti-quantum attack session management module, and performing a joint decision-making mechanism through quantum entanglement state monitoring and classical traffic feature analysis.

A security policy matching method based on IP slices mainly comprises the steps of IP address slicing, policy association, policy tree generation, policy fast matching and the like, the method adopts a virtual address thought, an address object is sliced into an address unit, the corresponding relation between the address unit and a policy is reflected by utilizing a bit, and then an ordered AVL policy tree is constructed, so that the security policy matching efficiency is improved. And efficient matching between the source IP and the destination IP of the message and the security policy is realized. According to the method, when the number of strategies is configured more, the influence on the performance is smaller, and the expansibility is high; and meanwhile, the support for the ipv4 and the ipv6 is relatively good, the occupied memory is relatively small, and the hardware requirements of low-end equipment are met.

The invention relates to a method for realizing NAT on a core network UPF network element, and the method comprises the steps: when a user terminal establishes a 5G session, the UPF pre-allocates a public network IPv4 address and a continuous source port set for the session, the number of ports is dynamically adjusted according to a user package, and resources are bound to a session data structure; receiving a downlink packet of which a destination address is a public network IP based on a private network-to-public network mapping relation, positioning a session level hash table through a flow label direct index mechanism, adding a GTP-U packet header after reverse NAT conversion, and forwarding the packet to a mobile phone through service processing; on the basis of a stream label direct index mechanism, each session exclusively occupies an IP port pool and a hash table through a session-level resource isolation architecture, and is used for avoiding global lock competition in combination with multi-core CPU parallel processing; based on a DPI function switching strategy, an NAT mapping table is synchronized through a UPF cluster session mirroring mechanism for node fault switching zero packet loss.

The invention relates to an IPv4 data message processing method and device based on longest prefix matching. The method comprises the following steps: acquiring an IPv4 data message, and extracting a destination IP address in the message; based on a longest prefix matching mode, extracting a preset number of bits from the high order of the destination IP address; generating a search index through the preset number of bits; determining a corresponding table item in a pre-stored FPGA rule matching table according to the lookup index; extracting a message processing rule according to pre-stored information of the table item; and executing a subsequent processing action on the IPv4 data message based on the message processing rule. According to the method and the device, the IPv4 message prefix matching can be carried out through FPGA hardware acceleration, a matching result is generated through single query, linear speed processing under million-level rules is supported, and meanwhile, the longest prefix priority principle is automatically maintained when the rules are changed through a CPU-FPGA collaborative updating mechanism.

The present invention provides an automatic detection and network construction method based on the IPv6 protocol and an apparatus thereof, in which a user activates an auxiliary wizard program to determine whether the current connection to the Internet is a PPPoE protocol, and then carries out subsequent DHCPv6 communication protocols for PPPoE or IPoE environments to complete the construction of an IPV6 network and to obtain the required additional DHCPv6 information. In order to avoid the waste of IPV6 prefixes, the present invention also provides a method of hierarchically distributing prefixes through DHCP-PD. Finally, by obtaining the DHCPv6 additional information and the search method of PREF64, the appropriate IPv4 transition mechanism can be automatically determined and established. The present invention can not only significantly reduce the technical threshold for users to set up IPv6, but also complete the construction of the IPV6 network.

Network operators can define port mappings for UDP destination ports and the encapsulated protocol / traffic type (X) in UDP. BGP may be used to notify the UDP destination port-to-traffic type mapping to an encapsulator. A generic UDP encapsulation mechanism (X-in-UDP), where UDP can be used to encapsulate packets of any user configured protocol / traffic type X (e.g., IPv4, IPv6, MPLS, etc.), is described. Primary benefits of using UDP for encapsulation are to leverage UDP port numbers for load-balancing. Generic UDP encapsulation of any protocol / traffic type using user defined port-maps provides flexibility to network operators in constructing different overlay networks. UDP encapsulation helps leverage fine-grade load balancing over Equal-Cost Multipath (ECMP).

The invention relates to a hardware routing table look-up method based on segmented unified storage. The method comprises the following steps: firstly, acquiring an IPv4 / IPv6 routing prefix, dividing the IPv4 / IPv6 routing prefix into 1-4 address fields according to 32 bits, allocating a unique forward and backward segment identifier for each field, constructing table entries containing the segment identifiers, 32-bit segment data and a next hop, and uniformly storing the table entries into the same TCAM. During table lookup, segmenting an address to be looked up according to the same rule, querying the TCAM from a first segment by taking segment data as a key, and recording a backward segment identifier and a next hop after hit; and if the backward segment identifier is invalid, directly returning to the corresponding next hop, and if the backward segment identifier is valid, continuing query by taking the identifier and the next segment of data as a joint key. And when the table item is not hit or the identification verification fails, selecting the table item with the longest prefix and the valid next hop in the matched section, and returning to the next hop. According to the invention, IPv4 / IPv6 routing table entries can be uniformly stored, the TCAM space utilization rate is improved, and meanwhile, the hardware table look-up efficiency is guaranteed.

In one embodiment, a method includes acquiring an Internet Protocol version 6 (IPv6) address for a physical interface of a first network element. The method also includes configuring an Internet Protocol version 4 (IPv4) over IPv6 tunnel between the first network element and a second network element using the physical interface of the first network element. The method also includes acquiring an updated IPv6 address for the physical interface of the first network element and using an IPv6 Service Level Agreement (SLA) Hypertext Transfer Protocol (HTTP) operation to notify the second network element of the updated IPv6 address to establish a bidirectional IPv4 over IPv6 tunnel. The method further includes establishing a control connection with an IPv4 SD-WAN controller and automatically building an SD-WAN overlay tunnel with the bidirectional IPv4 over IPv6 tunnel as a transport.

The invention discloses a corresponding management method for IPV4 and IPV6 addresses of the same user of network dual stacks, and relates to the technical field of network address management, network system nodes are divided into a main control node, a replica synchronization node and an edge cache node, a layered management architecture is constructed, hotspot users with frequent write-in are identified, a flow partitioning and path arbitration strategy is adopted, and the IPV4 and IPV6 addresses of the same user of the network dual stacks are correspondingly managed. The method comprises the following steps of: dynamically allocating an auxiliary book group, constructing a state deviation evaluation function, judging the consistency degree according to a version and hash information, selecting a corresponding synchronization strategy, fusing various mechanisms to form an execution layer consistency maintenance closed loop, and performing IPV4 and IPV6 address mapping relation management in a distributed environment. According to the management method, the stability, the accuracy and the reliability of the dual-stack user address mapping management system in a multi-source asynchronous operation environment are effectively enhanced by constructing a layered execution architecture which takes a main control node as a core, a copy synchronization node as a distribution guarantee and an edge cache node as a response terminal.

The invention relates to a network performance measurement method and device, computer equipment, a storage medium and a computer program product. Relates to the technical field of network security. The method comprises the following steps: in response to a network performance measurement instruction triggered by a user at a client, downloading a measurement script; calling the measurement script, and executing the following steps: generating a test access address of the to-be-tested website according to address information of the to-be-tested website; the test access address comprises an IPv4 access address and / or an IPv6 access address; sending an access request to the test access address, and recording a test result of the to-be-tested website; and sending the website address of the to-be-tested website, the test access address and the corresponding test result to a log server, so that the log server performs network performance measurement based on the test access address. By adopting the method, the accuracy of network performance measurement can be improved.

In this monitoring system (1), a collection unit (21) of an xFlow proxy (2) collects, in an IPv6 network, flow information including the relevant IPv6 address information for communication between IPv4 addresses via the IPv6 network. A detection unit (31) of a flow collector (3) detects information on attack traffic from within the collected flow information. When notified of a targeted address of the detected attack traffic, an extraction unit (41) of an IPv6 network controller (4) extracts the information of an IPv6 address from the information of the targeted address.

The invention discloses an IPv4 / IPv6 dual-stack network intelligent operation and maintenance management method and system based on AI, and relates to the field of AI. The method comprises the steps that through full-link multi-source data collection and feature processing of network equipment, terminals, protocols and services, a structured data set is constructed; real-time evaluation and visual monitoring of the network state are realized by using a multi-task AI model; once an abnormality is found, a fault node and a propagation path are accurately positioned through a fault diagnosis model; integrating various model outputs to automatically generate and execute a targeted operation and maintenance strategy; and on-line iterative optimization of the AI model and the knowledge base is driven through continuous effect evaluation and data feedback, so that the dual-stack network intelligent operation and maintenance capability of autonomous circulation is formed. The method has the advantages that AI enabling and dual-stack adaptation are focused, full-link multi-source data acquisition is taken as support, accurate evaluation, rapid diagnosis and intelligent decision making are realized through a multi-task fusion AI model, the operation and maintenance efficiency and the network stability are improved, and the labor cost is reduced.

Methods and systems for setting up a virtual private cloud can involve providing redundant or nested security layers including a local firewall within a provider firewall. In addition, a virtual private cloud proxy server can be provided with access to a data network through the local firewall and provider firewall. In addition, the virtual private cloud proxy server can be configured in coordination with the local firewall and the provider firewall to enable transparent proxying, wherein TCP / UDP traffic is redirected to a local port, with support interchangeable use IPV4 and IPV6, to selectively allow access to all system within the provider firewall. Furthermore, access can be provided to a set of rules, whereby internet packet traffic is filtered and then directed to and from clients within the local firewall based on a list of rules.

The embodiment of the invention provides a cross-network communication method and system, and the method comprises the steps: receiving source communication data; managing an address pool of the IPV4 network by adopting a bitmap scheme; according to the mapping relation list, adapting the source communication data to target communication data which can be transmitted by the target network and transmitting the target communication data to the target network; according to the bitmap scheme, the distribution state of the IPV4 addresses is marked through bits, the mapping relation list comprises the mapping relation among network identifiers of the multiple networks, and the target network is any one of the multiple networks different from the data source network. According to the embodiment of the invention, the data adaptation and transmission among different networks are realized, the compatibility problem between the articulated naturality web and the IPV4 network is effectively solved, and the data can be seamlessly switched and communicated between the two networks. The address pool of the IPV4 network in a plurality of networks is managed by adopting a bitmap scheme, and the allocation state of the IPV4 address is marked by bits, so that the efficient allocation and release of address resources are realized.

The present application relates to the technical field of communications, and relates to a method and apparatus for accessing an IPv4 server by an IPv6-only user, and a related device. The method comprises: in response to a session establishment request, which is sent by a terminal device, acquiring a target network address of a target device from a network repository function (NRF) network element when it is determined that a session type, to which the terminal device is subscribed, is IPv6 only, wherein the target device is a network device that supports a domain name system (DNS) 64 capability; and sending the target network address to the terminal device, wherein the target network address is used by the terminal device to access the IPv4 server by means of the target device. By means of the present application, an Ipv6-only user accessing an IPv4 server can be realized.

Various methods and processing systems are disclosed that provide an access termination component in a service provider network for managing network traffic. The method may include receiving dynamic host configuration protocol version 6 (DHCPv6) that solicits messages from one or more customer premise devices (CPEs) seeking network configuration information, transmitting DHCPv6 provisioning responses to the one or more CPEs, each DHCPv6 provisioning response which may include IPv6 provisioning parameters, updating an IPv4 prefix table with IPv4 prefixes, the IPv4 prefix table storing information related to networks that share IPv4 addresses, determining a 48-bit address and port set identifier value and a corresponding media access control (MAC) address, and adding the determined 48-bit address and port set identifier value and the corresponding MAC address into an address and port set identifier to MAC hash table.

The invention relates to an IPv4 / IPv6 traffic scheduling method, device and equipment in a dual-stack environment and a storage medium, and the method comprises the steps: deploying IPv4 / IPv6 translation equipment and a traffic scheduling DNS component, and configuring a traffic scheduling rule on the traffic scheduling DNS component; matching a DNS request domain name initiated by a dual-stack terminal based on the traffic scheduling rule; and executing traffic scheduling operation according to a matching result, and accessing the data path. Through cooperative work of a flow scheduling DNS component and translation equipment, an IPv4 / IPv6 path is selected according to a domain name or an address range based on a demand factor configuration rule table, and IPv4 / IPv6 flow scheduling in a dual-stack network environment is realized.

Edge networks for surrogate browsing and direct traffic via proxy are disclosed. A first server processes a received first IPv4 packet into an encapsulation. The encapsulation is sent to a second server. The second server determines a third server to which the encapsulation should be routed and transmits it. The third server processes the encapsulation, selects a public IP address, and transmits a second IPv4 packet using the selected public IP address as a source address of the second IPv4 packet.

The invention relates to a multi-tenant unified storage routing table item compression method and system based on identification mapping. The method comprises the following steps: in a routing table entry insertion stage, dynamically distributing a minimum available reduce ID for each new tenant, and ensuring that an IP prefix space of the new tenant is not overlapped with a tenant using the same reduce ID; in the lookup stage, a message VNI is firstly converted into a reduce ID through a mapping table realized based on an RAM, then the reduce ID and a destination IP are used as a joint key to look up the TCAM, and by constructing a mapping relation from the VNI to the reduce ID, the table item bit width of the TCAM is remarkably reduced on the premise of ensuring the routing correctness. The method is suitable for an IPv4 / IPv6 multi-tenant environment, the hardware area and power consumption can be effectively reduced especially in an FPGA or ASIC high-performance data plane, and meanwhile the line speed forwarding capacity is kept.

The invention provides a method for making a CPE self-adapt to an ACS, which relates to the field of communication technology and comprises the following steps: S1, monitoring the IP address of a TR-069 management interface of a CPE through a Netlink protocol, generating a valid HTTP connection request URL, and making the ACS initiate a connection request to the CPE, wherein the TR-069 management interface is a network card that carries TR-069 data; S2, the CPE, as a client, resolves the IP address of the ACS according to a domain name, creates a corresponding socket, regularly initiates an HTTP connection request session to the ACS, and reports basic information of the CPE to the ACS, wherein the basic information includes the HTTP connection request URL and events occurring during the period, the ACS returns response information, and the HTTP connection is disconnected after the session ends; S3, the CPE, as a server, creates a socket compatible with IPv4 and IPv6, and when the CPE is operated, the ACS immediately initiates a connection request to the HTTP connection request URL of the CPE, actively connects to the CPE, the CPE actively initiates a session, and reports a "6CONNECTION REQUEST" event and response information to the ACS, thereby realizing self-adaptation of the CPE to the ACS.

The application provides a lightweight inter-satellite routing implementation method and system suitable for a VDES constellation, the method comprising: a satellite pre-storing the topology of the entire constellation; a satellite sending end dividing data to be sent into smaller data packets, and encapsulating each data packet according to an IPv4 or IPv6 protocol; a gateway station specifying a central satellite and broadcasting to the entire constellation; each satellite calculating the shortest path from itself to the central satellite according to the central satellite by using a shortest path algorithm; sending IP data packets to the central satellite according to the calculated path; the central satellite sending data to the gateway station; the gateway station sending data and forwarding rules to the central satellite after processing; and the central satellite sending data to a destination satellite according to the forwarding rules. The application realizes interconnection and intercommunication between VDES satellites, and the protocol of the application is simple and reliable, and is suitable for running in a satellite on-board environment.

A disclosed method facilitates bidirectional traffic flows between a multi-tenant service and endpoints with private customer internet protocol (IP) addresses. The method provides for receiving a data packet having a data packet header identifying a first IPv6 address as a destination. The first IPv6 address embeds a first IPv4 address and a virtual network (VNet) identifier uniquely identifying a VNet of a cloud compute platform. The method further provides for routing the data packet to a host node within the cloud compute platform that hosts a virtual machine (VM) within the VNet identified by the VNet identifier and assigned to the first IPv4 address.

Techniques for automatically orchestrating routes configured to track behind-the-service endpoints executing in association with service endpoint devices in a service chain. A network controller may be utilized to override a tracker IP address for each HA pair in a service, allowing customers to configure the tracker IP address to be provisioned behind a service they wish to track, such that packets containing the tracker IP address will be forced to go through the service itself, allowing the network to gauge a status of the service (e.g., up, down, etc.). The network controller may be configured to automatically orchestrate a route that causes packets addressed to a service endpoint device hosting a service through an outgoing interface of the endpoint device, into the service, and to a behind-the-service IP address. These techniques may be utilized with tunnel connected services and / or services connected over physical interface(s) (e.g., IPv4 and / or IPv6).

The application relates to a unified IPv4 / IPv6 address management method in an IPv6 evolution environment, which comprises the following steps: arranging all IPv4 and IPv6 address segments, planning IPv4 and IPv6 communication scenarios, allocating IPv4 and IPv6 mapping address segments, defining IPv4 and IPv6 address translation rules according to the IPv4 and IPv6 mapping address segments, generating an IPv4 and IPv6 address translation rule set, and generating corresponding mapping addresses for each real IPv4 / IPv6 address according to the IPv4 and IPv6 address translation rule set. In the process of IPv6 evolution, the real IPv4 / IPv6 address, the mapping IPv4 / IPv6 address and the IPv4 / IPv6 address translation rule involved in the IPv4 / IPv6 coexistence and communication scenario can be effectively managed.

This invention relates to a dual-stack network asset discovery method based on multi-protocol collaborative detection and intelligent fingerprint analysis; it includes the following steps: multi-source parallel acquisition: collecting network layer information of various terminal devices in the intranet through command line interface or application programming interface; data cleaning and standardization: after acquisition, cleaning and standardizing the raw data; target device identification and detection strategy generation: based on the cleaned address list and combined with device information, identifying the target device type and automatically generating corresponding detection parameters; multi-protocol asset detection packet sending: sending detection packets to target IPv4 and IPv6 addresses according to configuration parameters; response data parsing and fingerprint recognition: performing structured parsing and multi-dimensional recognition on the received response data; dual-stack network data fusion and statistical analysis: after fingerprint recognition, fusing and analyzing the IPv4 and IPv6 detection results and constructing a unified asset database.

A method and system provide a BKAS addressing scheme. The scheme enables the encoding of disjoint intervals in each addressing block of an IPv6 / IPv4 address. This scheme permits a better flexibility in IP packet matching and an improved implementation of security policies by highly compressing the number of rules and offering much more expressivity in their semantics. This simplifies the configuration of security and network devices while significantly reducing the configuration anomalies. Furthermore, an efficient matching algorithm and a set of transitional methods are also provided. A BKAS design strategy for network subnetting is also provided, allowing for the elimination of all overlaps in the configuration rules of network and security devices while avoiding a combinatorial explosion of the number of configuration rules. The BKAS addressing scheme can be included in any hardware and software program.