WO2021036707A1

WO2021036707A1 - Post ip sovereign network architecture

Info

Publication number: WO2021036707A1
Application number: PCT/CN2020/106725
Authority: WO
Inventors: 李挥; 綦九华; 张昕淳; 谢鑫; 侯韩旭; 韦国华; 李文军; 杨昕; 王菡; 马化军
Original assignee: 北京大学深圳研究生院
Priority date: 2019-08-29
Filing date: 2020-08-04
Publication date: 2021-03-04
Also published as: CN110868446A

Abstract

The present invention is applicable to the field of computer network communications, and provides a post IP sovereign network architecture. All devices in the post IP sovereign network architecture use a new network taking an identity identifier as a center, and there is no IP network in the new network. The sovereign network devices further comprise an ID-ICN router and an EAN node, the ID-ICN router being used for supporting the inter-translation, addressing and network data transmission between different identities and content identifiers, and the EAN node being used for allowing users in the sovereign network to freely request, within a permission range, other networks and Internet data outside the sovereign network, allowing users, carrying the Visa of the present sovereignty network, from the other sovereign networks to access data in the present sovereign network, shielding all the requests actively initiated by other networks outside the sovereign network and the Internet, and installing a relevant content review procedure in the EAN node and preliminarily reviewing and filtering the content reaching the node. The sovereign network uses a blockchain to latch user information and a behavior log, so as to prevent data from being tampered, and can quickly locate an individual or unit for anomalous data. At the same time, a content network taking an identity identifier as a center is used to transmit underlying data, improving the efficiency of network transmission and eliminating the harm of an existing IP attack in the sovereign network. At the same time, the identity identifier is used to make a content request, preventing country domain names from being erased by a specific country or organization, thereby effectively improving the security of national networks.

Description

A post-IP sovereign network architecture

Technical field

The invention belongs to the improvement field of interconnection communication technology, and particularly relates to a post-IP sovereign network system architecture.

Background technique

Use the existing IP system to construct a sovereign network, and deploy an IPv4 mirroring root server, an IPv6 mirroring root server, and an IPv6 firewall in the sovereign network. These two kinds of root servers and firewalls ensure that all domain name allocation, address resolution, and information control for IPv4 and IPv6 are within the borders of various countries. At the same time, the mirroring switch ensures the smooth flow of scientific and technological communication between the domestic network and the international network and the absolute control of security and ideological communication. Its system architecture is shown in Figure 1.

There are two fundamental flaws in the IP-based network system: the top-level domain name management and technology are inherently inadequate. Domain name resolution is the key to opening the door to the Internet and the foundation of the Internet. The root server is the core of the entire domain name resolution system. Among the multi-level servers that provide domain name resolution, the 13 root domain name servers are at the top, all managed by the Internet Corporation for Assigned Names and Mumbers, an Internet name and address allocation agency authorized by the U.S. government. Among the 13 root domain name servers, one of them is the main root server located in Virginia, USA. The remaining 12 are secondary root servers, 9 of which are located in the United States, and the remaining 3 are located in the United Kingdom, Sweden, and Japan. Although ICANN is a non-profit international organization, its board of directors is composed of committee members from various countries, but the organization is a direct subordinate unit of the U.S. Department of Commerce. The U.S. government also retains the power of supervision. It is a quasi-governmental organization. Laws and regulations are not binding on it. According to the agreement, the US Department of Commerce has the right to veto ICANN's management rights at any time. The management of top-level domain names and the root zone database are controlled and managed by the United States, which in fact constitutes a unilateral network monopoly.

The IP protocol is inherently inadequate in terms of security, mobility, and QoS in terms of technology and performance genes, and does not adapt to the development of technology and application requirements. Moreover, after the sovereign network is connected to the Internet using the existing IP system, there are still three major threats to national security in the Internet, namely, political subversion, network control, and hacker attacks. The security of the sovereign network cannot be guaranteed. At the same time, the sovereign network cannot manage and control user behavior, and cannot guarantee a clean and healthy network environment for minors.

The decimal network system is mainly composed of IPv9 address protocol, IPv9 header protocol, IPv9 transition period protocol, digital domain name specification and other protocols and standards. Digital domain name refers to the method of using 0-9 Arabic numerals instead of traditional English letters as domain names to surf the Internet. At the same time, the digital domain name can also be directly used as an overlapped IPv9 address. The digital domain name is an integral part of the decimal network system.

The IPv9 protocol refers to the use of Arabic numerals from 0 to 9 as the virtual IP address of the network, and the decimal system as a text representation method, which is a convenient way to find online users; in order to improve efficiency and facilitate end users, some of the addresses are included. It can be used directly as a domain name; at the same time, it adopts the classification and coding of the original computer network, cable broadcasting and television network and telecommunication network.

Decimal network refers to a brand-new network that uses decimal arithmetic and text representation methods to connect various computers that use decimal arithmetic to form a network, and can communicate with existing networks.

The decimal network system adopts a decimal, multi-protocol digital domain name system in the domain name system, which is compatible with English, Chinese and other domain names, and maps them to unique IP addresses in the world; establishes a distributed root domain name system and introduces the concept of national and regional Each country has its own root domain name system to establish and maintain its status and image as a sovereign country on the Internet.

IPv9 increases the IP address length from 32 bits and 128 bits to 2048 bits to support more address levels, more addressable nodes, and simpler automatic address configuration. At the same time, the length of the 32-bit IPv4 address is reduced to 16 bits to solve the quick use of cellular communication in mobile communications. IPv9 addresses specify 256-bit identifiers for interfaces and interface groups. There are three types of addresses: 1. Unicast: A single interface has an identifier. A packet sent to a unicast address is delivered to the interface identified by the address; 2. Any-on-demand: Generally, a group of interfaces belonging to different nodes has an identifier. A packet sent to an arbitrary-on-demand address is delivered to an interface identified by the address and measured according to the routing protocol; 3. Multicast: Generally, a group of interfaces belonging to different nodes has an identifier. Packets sent to a multicast address are delivered to all interfaces of that address. There is no broadcast address in IPv9, and its function is replaced by a multicast address.

There are five types of IPv9 addresses:

1. Pure IPv9 address: The form of this address is Y[Y[Y[Y[Y[Y[Y[Y where each Y represents a ^{decimal integer from 0 to 2 32} = 4294967296.

2. IPv4 compatible IPv9 address: The form of this address is Y[Y[Y[Y[Y[Y[Y[DDDD where each Y represents a ^{decimal integer from 0 to 2 32} = 4294967296. D represents a ^{decimal integer between 0 and 2 8} =255 of the original IPv4.

3. IPv6 compatible IPv9 address: the form of this address is Y[Y[Y[Y[X:X:X:X:X:X:X:X, where each Y represents one from 0 to 2 ³² = 4294967296 Decimal integer between. X represents a hexadecimal number from 0000 to FFFF in the original IPv6.

4. Special compatible address.

5. []Full decimal address: In order to facilitate the application of logistics code and full decimal address. [] is expressed as an abbreviated representation of an IPv9 full-decimal address, just as 192.1.1.0/24 represents a C segment address in IPv4.

IPv9 has the following characteristics:

1. Adopt the method of fixed length without positioning, which can reduce network overhead, just like a telephone, it can be used with variable length.

2. Use a specific encryption mechanism. The control of the encryption algorithm is in the hands of our country, so the network is particularly secure. As IPv9 has more addresses, more address methods (fixed length not fixed length, fixed length fixed length, and unique IP address encryption technology), there are more IPv9 extension header definitions to make the network more secure. The address headers, messages, and protocol numbers are not disclosed and form a system of its own. Even if the agreement is open, only the civilian part will be disclosed. The military part will be determined by the military. Compared with IPv4/IPv6, my country cannot decide various security measures in the network system. Although the use of network layer IPSEC, application layer SSL and other measures, it is still difficult to guarantee There is a difference in security. From theoretical analysis, the difficulty of cracking dedicated protocols is greater than that of cryptographic algorithms. According to the current IPV4/IPV6 standards, 32-bit/128-bit addresses cannot be encrypted. If encrypted, the destination cannot be found.

3. The TCP/IP protocol of absolute code type and long stream code is adopted to solve the contradiction between sound and image transmission in packet switching circuit. You can directly use the IP address as a domain name, which is especially suitable for mobile phones and home Internet scenarios.

4. There are emergency categories to solve the problem of unblocked lines in wars and national emergencies. Because of their own protocol standards, in addition to ensuring the ciphertext transmission of network communications, the protocol also sets the emergency status bit. Once a war occurs, the military network In the case of partial destruction, the relevant civil routers are urgently requisitioned through router broadcast, and the routing table is modified to achieve the purpose of requisitioning for war.

5. Due to the realization of point-to-point lines, the privacy of users is strengthened.

6. Especially suitable for wireless network transmission.

In addition to the appealing features, IPv9 is also independent of the original IPv4 and IPv6 Internet networking, which can effectively control and manage network security and information security, and can select valuable information for my use by downloading foreign information according to actual needs. In order to avoid the intrusion of bad information from abroad, that is, the network is accidentally attacked by foreign countries. Conducive to business development. Due to the independent networking, relevant departments can independently and flexibly develop public information services under the premise of complying with relevant national policies, which is conducive to the development of advanced application business systems based on the development of Chinese information retrieval in the future.

At the same time, in order not to change user habits, IPv9 is compatible with IPv4 and IPv6. At the same time, IPv4 can be used as a tunnel to carry data transmission between two IPv9 subnets, and IPv9 as a tunnel to carry data transmission between two IPv4 subnets.

The main advantages of this invention are: First, it has an independent intellectual property system and huge cyberspace resources. Second, the decimal network system can directly translate the original binary address into decimal text, which caters to people's daily usage habits. Third, the domain name and the IP address are unified, which is the same as the identification code of people and things, which can combine telephone, mobile phone, domain name and IP address, IPTV, IP phone, etc. into one number; domain name and IP address are combined into one, saving The translation between network domain names and IP addresses makes network communication fast and direct, which improves the communication capabilities of existing network switching equipment. Fourth, use a specific encryption mechanism to ensure network security. Fifth, starting from the standpoint of safeguarding sovereignty, creatively proposed the concept of "sovereign equality" on the Internet; and adopted a decimal, multi-protocol digital domain name system in the domain name system, compatible with English, Chinese and other domain names, and mapped them into The only IP address in the world.

IPv9, the decimal network, still has many shortcomings. The specific shortcomings are as follows:

1. The basic bits of the source and destination addresses used by IPv9 packets are 256 bits, and the longest is 2048 bits. The address space of 256 bits is 2 ²⁵⁶ , and the total number of atoms of ordinary matter in the observable universe N is about 10 ⁸⁰ . The address space can be compared to the total number of atoms of ordinary matter in the observable universe. Using 256 bits as the address space is already very huge, even more unimaginable for 2048 bits. The actual network does not need such a huge address space.

2. The address space of IPv9 is huge, and there will be problems with the efficiency of address space usage. Not every address is effectively used, and there will be a lot of free addresses.

3. Since IPv9 uses 256 bits as the source and destination address, its message header is very huge, which will cause network transmission efficiency and congestion control problems. For very small data, an IPv9 packet header is also needed for transmission, and the network transmission efficiency is low. Moreover, the current Ethernet frame length of IPv4 and IPv6 networks is 1500 bytes. If the IPv9 message header occupies too much space, the amount of data that can be transmitted in each frame will be reduced.

4. The memory and computing capabilities of devices in the Internet of Things and Industrial Internet are very limited, usually stored below 10KB. IPv9 uses a longer header for data transmission and does not provide good support for Internet of Things usage scenarios.

5. IPv9 requires that the MTU of each link on the Internet is at least 576 bytes. On any link, if it cannot transfer 576 bytes of data in a data packet, then the link-related data segment and reassembly must be supported by layers below IPv9. This undoubtedly increases the data processing pressure on the link layer.

6. IPv9 directly uses the address as the domain name for content request, which has a huge domain name address, how to quickly find, match, and forward in the router will be a problem.

7. How to quickly find and address the naming and addressing methods used in IPv9 is a big challenge under the huge number of identifications. At the same time, the geographic location-based addressing scheme proposed by IPv9 requires the conversion of IP addresses and geographic addresses. Since geographic addresses and IPv9 addresses are both large, how to quickly convert is also a challenge.

8. IPv9 adopts a new "decimal" address format that is different from IPv4 and IPv6, but the consequence of adopting a unique address format is artificially causing obstacles to the Internet.

9. IPv9 cannot guarantee the true security of the network, because the purpose of the IP protocol suite is to help computers on different networks (such as Ethernet, token ring, FDDI, ATM, etc.) communicate with each other on a virtual "common network". Different IP protocols are only implemented in different ways, and the purpose of helping any computer on the network communicate with each other is the same. Therefore, IPv9 and IPv6 are essentially different protocol versions derived from the same technology and different conventions. The inherent defects of IPv4 and IPv6 also have their own.

10. There is no broadcast address in the IPv9 protocol, which uses a multicast address instead of broadcast. The use of IPv9 to construct a sovereign network will lead to restrictions on the real-time, extensive and flexible data transmission of the sovereign network.

Summary of the invention

The purpose of the present invention is to provide a post-IP sovereign network architecture, which aims to solve the inherent security problems of using the IP protocol. The use of the IP protocol to build a sovereign network cannot guarantee the manageability and control of the network. At the same time, IP is mobile. Insufficient genes are innate and cannot provide good support for many mobile services.

The present invention is realized in this way, a post-IP sovereign network system architecture, in which the devices in the post-IP sovereign network system architecture all adopt a new type of network centered on identity identification, and there is no IP network in the new type of network; The sovereign network equipment also includes an ID-ICN router and an EAN node. The ID-ICN router is used to support translation, addressing, and network data transmission between different identities and content identifiers; the EAN node is used to allow users in the sovereign network Freely request data from other networks and the Internet outside the sovereign network within the scope of authority, as well as other sovereign network users who carry the sovereign network visa to access the data within the sovereign network, and block all requests initiated by other networks and the Internet outside the sovereign network. , And install the relevant content review program in the EAN node to conduct preliminary review and filtering on the content arriving at the node.

A further technical solution of the present invention is that the post-IP sovereign network system architecture uses a distributed storage subsystem with endogenous security for data storage to ensure data security.

The further technical scheme of the present invention is: in the post-IP sovereign network system architecture, users are managed through the blockchain management subsystem; users register through personal real identity information, and the user registration information is stored in the block of the sovereign network In the chain node, the user needs to bind the relevant identity information at the time of registration to access the sovereign network; in the sovereign network, the blockchain management subsystem votes on the content published by the user, and the content approved by the vote is allowed to be published, and the user publishes the content The information and the behavior log of the user request data are locked; different identifiers can be defined inside the sovereign network, and the mutual translation between different identifiers is completed in the blockchain management subsystem.

The further technical solution of the present invention is that: both authorized users and broadcasting production networks in the sovereign network can release video and audio, and the authorized users to release audio and video include the following steps:

SY1. Authorized users log in through personal information;

SY2, after logging in, request the release of audio and video content from the blockchain node;

SY3. The blockchain will vote on the request to publish audio and video content. If the vote is passed, it will agree to authorize the user to publish the audio and video content, lock the user and the content information released in the blockchain and perform the next step, such as voting If it fails, the authorized user is prohibited from publishing this audio and video content;

SY4. Authorize users in the blockchain management to publish audio and video content in a distributed storage system with endogenous security or their own local host; the publishing content of the radio and television production network includes the following steps:

SZ1. Obtain content resources from the Internet through external access nodes on the sovereign network;

SZ2, the internal production and broadcasting network produces the content and then distributes the content through the network;

SZ3: After the content reaches the edge ID-ICN router or EAN node, it is sent to ordinary users.

A further technical solution of the present invention is that the ordinary user obtains the data, and the data provider has cached this part of the content in the IP Internet or the sovereign network, or the node of the sovereign network; the IP Internet obtaining data includes the following steps:

SIP1. Ordinary users log on to the Sovereign Network with personal identification information;

SIP2. Ordinary users send content requests to the edge node ID-ICN routers, and send them to the external access nodes of the sovereign network through the identity-centric network or directly send the request to the external access nodes of the sovereign network connected to it, and record it on the blockchain node The content information requested by the user;

SIP3, Sovereign Network External Visiting Nodes will review the user's authority in the content request. If the requested content exceeds the user's authority, the content request will be discarded, and if it is within the authority, proceed to the next step;

SIP4, Sovereign network external visiting nodes extract the requested content information and request data from the Internet according to the traditional Internet method;

SIP5, Internet content providers provide requested content data to external nodes of the sovereign network in accordance with traditional Internet methods;

SIP6, the external visitor node of the sovereign network conducts a preliminary review of the requested content data, if the review is passed, execute the next step, if not, discard the data and return to step SIP4;

SIP7, the external visitor node of the sovereign network encapsulates the requested Internet content data into a data packet in the central network with the identity identifier and returns it to the ordinary user according to the path of the content request;

The step of obtaining data with this part of content cached in the sovereign network or in the node of the sovereign network includes the following steps:

SN1. Ordinary users log on to the Sovereign Network with personal identification information;

SN2. Ordinary users send content requests to network nodes in the sovereign network or external access nodes of the sovereign network to determine whether there is in the cache. If there is, the sovereign network node or external access node of the sovereign network directly returns the cached content to the requesting user, if not, it goes Take the data from the original data place and return it to the requesting user.

A further technical solution of the present invention is that the data obtained by the production and broadcasting network is mainly obtained by obtaining resources on the Internet, making and distributing them.

A further technical solution of the present invention is that when other networks outside the sovereign network or Internet users send a request to a node outside the sovereign network, the node outside the sovereign network discards the request message.

A further technical solution of the present invention is that the mutual visits between multiple national sovereign networks in the post-IP sovereign network system architecture include the following steps:

SDG1. The registered user sends a visa request to the overseas visitor node of the sovereign network of the country that represents other sovereign network visas;

SDG2, the external visitor node of the home country's sovereign network sends the visa request to the target requesting country through Overlay IP;

SDG3, the external visitor node of the target requesting national sovereignty network will review the incoming request. If the review is passed, the visa request will be sent to the blockchain for voting and the next step will be implemented. If the review is not passed, the information will be fed back to the visa requester;

SDG4. For the request for successful voting, the visa will be returned to the requester according to the request path;

SDG5, the content requester uses the visa-carrying interest group to request other sovereign network content;

After SDG6, the destination sovereign network external visit node has passed the visa review, the content provider will return the content according to the requested path.

The further technical solution of the present invention is that the post-IP sovereign network architecture takes identity as the central network to naturally support multi-path, allowing mobile devices to connect to multiple connectable base stations at the same time without affecting the coverage of the current base station. The transmission of data naturally supports wireless communication.

The further technical solution of the present invention is: in the post-IP sovereign network architecture, if the mobile user is in the sovereign network, the mobile user uses the identity identifier as the central network to request content; if the mobile user is located outside the sovereign network, The IP content request first communicates with the base station through the Overlay IP method, and then the base station performs content request and transmission through the traditional IP network; if the mobile user is located outside the sovereign network, the request for the sovereign network content includes the following steps:

S5G1, the wireless terminal device with identity identification first communicates with the base station through Overlay IP;

S5G2, intra-regional stations send data to a target sovereign network externally visited node through traditional IP transmission;

S5G3, Sovereign Network External Visiting Nodes will review the user's identity, and allow access if passed, and reject if not passed.

The beneficial effect of the present invention is that the content network centered on the identity is used for bottom data transmission, the transmission mainly relies on the interest grouping and the data grouping, and the transmission mode is driven by the consumer's interest. In the communication process, since neither the interest group nor the data group uses the traditional IP address for data interaction, the country domain name is prevented from being erased by a specific country or organization, and the security of the national network is effectively improved. The internal identification space of the sovereign network of each country is managed by the country itself, realizing the complete autonomy of each country in the post-IP era; using the sovereign network centered on the identity identification and using the data warehouse to cache the latest data, users in the same domain The same content only needs to be fetched once from the original data provider, and then can be fetched directly in the ID-ICN router, which improves the overall data transmission efficiency of the network and greatly improves the user experience; the identity-centric network is introduced into the network Caching will gradually cache the contents of the Internet into the sovereign network to enrich the resources within the network. When the sovereign network is physically disconnected from the Internet, users can still obtain the content they had obtained before the disconnection, without affecting the user's use.

Description of the drawings

Figure 1 is a schematic diagram of the traditional IP sovereign network architecture.

Figure 2 is a schematic diagram of a post-IP sovereign network architecture provided by an embodiment of the present invention.

Figure 3 is a schematic diagram of a blockchain subsystem signature scheme provided by an embodiment of the present invention.

Fig. 4 is a schematic diagram of content published by an authorized user according to an embodiment of the present invention.

Fig. 5 is a schematic diagram of content distributed by a radio and television production and broadcasting network provided by an embodiment of the present invention.

Fig. 6 is a schematic diagram of data obtained by ordinary users from the Internet according to an embodiment of the present invention.

FIG. 7 is a schematic diagram of a common user obtaining data on a sovereign network according to an embodiment of the present invention.

Fig. 8 is a schematic diagram of a production network provided by an embodiment of the present invention going to the Internet to obtain data.

Fig. 9 is a schematic diagram of an IP extranet accessing the content of a sovereign network according to an embodiment of the present invention.

Fig. 10 is a schematic diagram of a visa acquisition process provided by an embodiment of the present invention.

FIG. 11 is a schematic diagram of obtaining content internationally with a visa provided by an embodiment of the present invention.

FIG. 12 is a schematic diagram of data transmission through an IP tunnel between multiple national sovereign networks according to an embodiment of the present invention.

FIG. 13 is a schematic diagram of a sovereign network mobile user requesting sovereign network content outside the sovereign network according to an embodiment of the present invention.

FIG. 14 is a schematic diagram of a three-layer protection of a sovereign network according to an embodiment of the present invention.

detailed description

A network hierarchical management scheme bound with identity identification is proposed, which solves the problem of confusion in network content management at this stage. The hierarchical management plan not only promotes the dissemination of information, but also eliminates the influence of traditional media on unsuitable information for minors to a certain extent.

The sovereign network uses identity tags for routing, and its name space is unlimited in principle, avoiding the problem of IPv4 address exhaustion. The network pays more attention to the storage of network resources or users themselves rather than traditional network resources, avoiding the performance problem of traditional IP networks.

As shown in Figure 1, the post-IP sovereign network architecture provided by the present invention is sufficient, and the devices in the post-IP sovereign network architecture all adopt a new type of network centered on identity identification, and there is no IP network in the new type of network; The sovereign network equipment also includes an ID-ICN router and an EAN node. The ID-ICN router is used to support translation, addressing, and network data transmission between different identities and content identifications; the EAN node is used to allow the sovereign network Internal users freely request data from other networks and Internet outside the sovereign network within the scope of authority, as well as other sovereign network users who carry the sovereign network visa to access the data within the sovereign network, and all requests initiated by other networks and the Internet outside the sovereign network are all Screening is performed, and a related content review program is installed in the EAN node, and the content arriving at the node is initially reviewed and filtered.

Existing network systems are all constructed using the IP protocol, but now IPv4 addresses have been exhausted. The use of IPv6 can solve the address space problem, but the use of the IP protocol has inherent security problems. Moreover, using the IP protocol to construct a sovereign network cannot guarantee the manageability and control of the network. At the same time, IP is inherently inadequate in mobility and cannot provide good support for many mobile services.

In view of the above-mentioned problems, the present invention, a post-IP sovereign network system architecture, system and software storage medium, is used to construct a sovereign network with a new network system centered on identity identification, and achieve de-IP in the sovereign network. The data in the sovereign network is driven by the data consumer receiving end and a caching mechanism is introduced to ensure the efficiency of data transmission. At the same time, the sovereign network adopts a data transmission method different from IP so that traditional IP attacks such as worms, port scanning and other viruses lose the propagation environment and cannot Launch an effective attack. Public key signatures are also added to interest groups and data groups to ensure data safety and reliability. The invention also introduces the blockchain to store user information and behavior information, prevents data from being tampered with, and ensures the manageability and control of user behavior and content. At the same time, access control is added to ensure the clean and healthy network environment of minors. The present invention also designs a sovereign network external visit node, which is located at the border between the sovereign network and the Internet, and only allows Internet traffic actively requested by users in the sovereign network and authorized data requested by other sovereign network users to flow into the sovereign network. Requests initiated within the network are directly discarded, ensuring that users in the sovereign network can freely access Internet content while ensuring the security of the sovereign network network.

EAN node: Uni-direction External Visiting Node.

ID-ICN router: the internal router of the sovereign network (Identify-Information Central Network Router).

Sovereign network overall architecture design

The architecture design of the sovereign network is shown in Figure 2. In the national sovereign network, all devices use a new type of network centered on identity identification, and there is no IP network in the network. The biggest difference between its equipment and the existing system is the addition of ID-ICN routers and EAN nodes. The ID-ICN router is a router that supports the translation, addressing, and network data transmission of different identities and content identifiers. The external access node of the sovereign network allows users in the sovereign network to freely request Internet data within the scope of authority. All requests are blocked. At the same time, relevant content review programs such as AI content review programs are installed in the EAN node to conduct preliminary review and filtering of the content that reaches the node. Through these two steps, external network attacks can be well isolated and security protection can be ensured.

The background support of the National Sovereign Network is consistent with the functions of the existing radio and television system, and its storage system uses distributed storage to ensure data backup security. Users register with personal identification information such as their own ID card, mobile phone number, fingerprint, etc. The user registration information will be locked in the blockchain node for subsequent user management; the user needs to bind the relevant identification information during registration to access the sovereign network.

Blockchain management subsystem

The blockchain management subsystem is mainly used to lock user registration information, user published content information, and user request data behavior, and vote on user published content, and only approved content is allowed to be published. At the same time, different logos can be defined within the sovereign network, and the mutual translation between the logos is completed in the blockchain subsystem. The blockchain management subsystem uses tree chain group/ring signatures. Figure 3 is the signature scheme adopted by the blockchain management subsystem. Based on the supervisability and anonymity of the group/ring signature, it can achieve a balance between the controllable and manageable needs of the system and the protection of user privacy. By establishing a group relationship between nodes of different levels and different identities, the administrator of the upper domain can quickly locate the problem domain and identify the corresponding malicious nodes, improving the security of the system.

Implementation of each process of the network with identity identification as the center

User registration

Users register with real information such as ID number, mobile phone number, and face when opening a Sovereign Network account; the system uploads user information to the blockchain for lock-in.

Content release

In the Sovereign Network, in addition to the broadcast and television production network that can publish video, audio and other content, authorized users can also publish content. Authorized users can publish content on the Sovereign Network after they have successfully voted on the blockchain. The flow of authorized users to publish content is shown in Figure 4.

①. First authorize the user to log in through fingerprint, iris, face;

②. After logging in successfully, request the blockchain node to publish content (the blockchain node can be deployed on the ID-ICN router or the server can be deployed separately);

③. The blockchain is voted on. After the voting is passed, authorized users can publish content. When publishing the content, the publisher signs the content with the public key, and locks the user and the content information released in the blockchain;

④ If the user successfully publishes the content, the user can publish the content in a distributed storage system with endogenous security or its own local host.

Sovereign Networks is another major source of content distribution from the broadcasting and television production and broadcasting network. The process is shown in Figure 5.

First, the internal production and broadcasting network staff obtain content resources from the Internet through the external visitation node of the sovereign network; secondly, the internal production and broadcasting network work to produce content, when the content is produced, the producer needs to use the public key to sign, and then distribute the content through the network; Second, the content reaches the edge ID-ICN router or EAN node, and then is sent to home users or enterprise users.

Ordinary users get data

Enterprise users and home users are collectively referred to as ordinary users. There are two situations for ordinary users to obtain data. The first is that the data provider is on the IP Internet. When obtaining data for the first time, ordinary users of the sovereign network must go to the Internet to obtain data through the external visitor node of the sovereign network. The data transmission process is shown in Figure 6. ；

①. Ordinary users in the sovereign network use fingerprints, iris, faces, etc. to log in;

②. After successful login, ordinary users send content requests to edge nodes, and then the edge nodes transmit the request to the external access nodes of the sovereign network through the network; or ordinary users directly send the request to the external access nodes of the sovereign network connected to it, and the blockchain The node records which user requested which content information;

③. Sovereign network external access nodes review the user's authority in the content request. The review methods are mainly as follows: One is to put the user information in the signature, and the sovereign network external access node verifies whether the content of the user's request meets the scope of authority. In addition, an authority domain is added to the interest group. The external visitor node of the sovereign network verifies whether the content requested by the user meets the authority scope according to the authority domain. There is a permission control domain in the interest group, which can control the scope of its access content for different levels. The specific permission information is shown in Table 1). If the requested content exceeds the user's permission, the content request is directly discarded, and if it is within the permission, proceed to the next step;

④. Sovereign network foreign visitor nodes extract the content information of the content request, and then request data from the Internet according to the traditional Internet method;

⑤. Internet content providers provide their requested data to external nodes on the sovereign network in accordance with traditional Internet methods;

⑥. The external visit node of the sovereign network conducts a preliminary review of the data, such as keyword filtering and AI classification and recognition;

⑦. The external visitor node of the sovereign network encapsulates the data requested from the Internet into a data packet in the central network with the identity identifier, and then returns it to the ordinary user according to the path of the content request.

The second is that the content provider is inside the Sovereign Network (the content publisher is a Sovereign Network user) or has cached this part of the content in the Sovereign Network node, that is, the user himself or other users have previously requested the same content, then Obtain data directly inside the sovereign network as shown in Figure 7.

② After successful login, ordinary users send content requests to network nodes in the sovereign network or nodes outside the sovereign network;

③. If the requested content is cached by the sovereign network node or the external access node of the sovereign network, the content will be directly returned to the user, if not, the data will be fetched from the original data place and returned to the requesting user.

Table 1 User access control level table

Production and broadcast network to obtain data

The main channel for employees in the production and broadcasting network to obtain data is to go to the Internet to obtain resources for production and distribution. The main access method for the employees of the production and broadcasting network is to access the Internet. The flow chart is shown in Figure 8.

①. The staff of the production and broadcasting network use fingerprint, iris, face, etc. to log in;

②. After the login is successful, the production network employee user sends a content request to the edge node, and then the edge node transmits the request to the external visitor node of the sovereign network through the identity identifier as the central network; or the production network employee user directly sends the request to the connected node At the same time, the blockchain node records which content information is requested by which production network employee user;

③. The Sovereign Network's external visit node reviews the authority of the production and broadcast network staff in the content request. If the requested content exceeds the user's authority, such as the request code, directly discard the content request. If it is within the authority, proceed to the next step;

⑥. The external visit node of the sovereign network conducts preliminary review and filtering of data, such as keyword filtering and AI identification;

⑦. Sovereign network external access nodes encapsulate the data requested from the Internet into data packets in the sovereign network, and then return to the production network staff users according to the content request path;

⑧. The internal staff of the production and broadcasting network make content production based on the returned data.

2.2.4.5 IP external network access to sovereign network data

In addition to users on the sovereign network to access Internet data, there may also be external network users or attackers accessing the sovereign network. However, for the sake of security in this system, the external access nodes of the sovereign network prohibit the external network from actively requesting data in the sovereign network. The flow chart is shown in Figure 9.

①. The Internet user sends a request to the external visitor node of the sovereign network;

②. The visiting node of the sovereign network discards the request message.

Data transfer between multiple national sovereign networks

Each country can build its own sovereign network, thus forming a cyberspace United Nations. There are two ways to transfer data between the sovereign networks of multiple countries. The first is to access visas that can be sent between countries through the sovereign network of the target country to visit. The user's visa application process is shown in Figure 10.

①. First, the user host sends a visa request to the foreign node of the home country's sovereign network;

②. The foreign visitor node of the home country's sovereign network sends the visa request to the target requesting country through Overlay IP;

③. The external visiting node of the target requesting country's sovereign network will review the incoming request;

④. The approved visa request is sent to the blockchain for voting;

⑤. For the request for a successful vote, the visa will be returned to the requester according to the request path.

For users who have obtained a visa to visit the content of the sovereign network they want to visit, the visa information can be put into the signature of the interest group, and these individuals or units can directly access the sovereign network of this country by carrying the visa information. Content, the foreign visitor node of the sovereign network of the target country will verify the visa information, and the content can be successfully obtained if the verification is passed, as shown in Figure 11.

①. The content requester sends an interest group with visa information;

②. The foreign visitor node of the home country's sovereign network sends the interest group request to the target requesting country through Overlay IP;

③. The foreign visitor node of the sovereign network of the target country verifies the visa;

④. For the request for successful authentication, the visiting node of the sovereign network sends the interest group to the content source;

⑤. The content source returns the content to the content requester in the same way.

The other is the content sent actively by the content sender, which only uses the IP tunnel for data transmission. For example, the flow of E-mail is shown in Figure 12.

①. The content sender first sends the data to the external visitor node of the sovereign network according to the data transmission method in the sovereign network;

②. The EAN node transmits the data to the server at IP in the way of TCP/IP;

③. This server then transmits the content to the EAN node of the destination country in the way of TCP/IP;

④. The EAN node of the target country verifies the content, and then sends the verified content to the content receiver according to the data transmission method in the sovereign network.

Support measures for 5G

Due to the introduction of in-network caching and natural support for multi-pathing with identity identification as the center content, it can well support 5G communication. The intra-network cache ensures good mobility. When a user moves to another base station coverage area, the device only needs to send another interest packet. There is a cache on the path of the last request, so that the most recent one can be found on the link. The cached node returns the data directly. The identity-centric network inherently supports multi-path, which allows mobile devices to connect to multiple connectable base stations at the same time. When it is out of the coverage of the current base station, it does not affect data transmission. In the post-IP sovereign network architecture, if the mobile user is in the sovereign network, the mobile user uses the identity identifier as the central network to request content; if the mobile user is located outside the sovereign network, the IP content request is made through the Overlay IP method. Communicate with the base station, and then the base station performs content request and transmission through the traditional IP network; if the mobile user is located outside the sovereign network, the request for the content of the sovereign network includes the following steps, and the data transmission process is shown in Figure 13.

①. The wireless terminal device with identity identification first communicates with the base station through Overlay IP;

②. The station in the area sends the data to a target sovereign network outside visit node through the traditional IP transmission method;

③. The external visitor node of the sovereign network verifies the identity of the user, and if it passes, the access is allowed, and if it fails, it is rejected.

Security measures

The security of the sovereign network in the present invention is guaranteed by the following aspects: authentic identity authentication; blockchain technology to prevent data tampering; each data signature authentication; the sovereign network external visit node prevents all active requests initiated by IP; Secure storage system; routers through which data passes through the sovereign network have firewalls, packet inspections, AI program audits and other inspection measures to form an anti-attack Markov chain; the network environment of the identity-centric network is inconsistent with IP, resulting in existing Some malicious viruses and traffic that bypass the filtering mechanism and enter the sovereign network use the IP network to destroy the attack method, and lose their operating environment in the sovereign network.

Attacks on the sovereign network can be attacked by IP extranet users and intranet users. The attack protection can be divided into three layers. The first layer is whether users on the external network or on the internal network want to actively send traffic to the sovereign network, they must first crack the key signed during data transmission within the sovereign network; the second layer is the ID-ICN router inside the sovereign network. A protection and detection method; the third layer is for the protection of distributed storage systems with endogenous security. The schematic diagram is shown in Figure 14.

Beneficial effects brought by technical solutions

The technical scheme of the present invention is based on the content network centered on the identity identification for bottom data transmission, the transmission mainly relies on interest packets and data packets, and the transmission mode is driven by consumer interests. In the communication process, since neither the interest group nor the data group uses the traditional IP address for data interaction, the country domain name is prevented from being erased by a specific country or organization, and the security of the national network is effectively improved. The internal identification space of each country's sovereign network is managed by the country itself, realizing the complete autonomy of each country in the cyberspace of the post-IP era.

The Sovereign Network, which uses identity identification as the central network, uses a data warehouse to cache the latest data. Users in the same domain only need to fetch the same content from the original data provider once, and then directly fetch it in the ID-ICN router. , Improve the overall data transmission efficiency of the network, and greatly improve the user experience; because the identity-centric content network introduces in-network caching, the content in the Internet will be gradually cached in the sovereign network, enriching the resources in the network, and when the sovereign network and the After the Internet is physically disconnected, users can still obtain the content they had obtained before the disconnection (this part of the content we think is the content that users care about), and does not affect the user's use. At the same time, the Sovereign Network supports users to actively publish content, enriching the content resources of the Sovereign Network.

In the future, the Internet of Things, Internet of Vehicles, Industrial Internet, 4K/8K HD video, 5G development and changes in the life habits of individual users, mobile access will become the main Internet access solution in the future, so the use of identity-centric networks The sovereign network of China has a natural advantage in supporting mobile access and has a good guarantee for meeting future business needs.

In the sovereign network, interest packets are transmitted in the network in a multicast manner, and multiple channels can be selected for data transmission, and the data packets will return along the path of the interest packets. When this link is unavailable, the interest group will automatically select another available shortest path for transmission, without the need to reconnect TCP like IP, which effectively improves the efficiency of data transmission.

The Sovereign Network guarantees the security of the system in a variety of ways and provides extremely high-level security protection. In the Sovereign Network, users will bundle the corresponding biometric identity information and other identity information as identity identifiers to log on to the Sovereign Network, and the network content they publish and the network resources they visit will also be bundled with corresponding identity information and recorded on the blockchain. Ensure that the data cannot be tampered with, and the abnormal information and content can be quickly and accurately located to individuals. The management node in the sovereign network will refuse to register, delete and punish the illegal network resources and malicious users in the network. In this way, the content is safe, manageable and controllable. At the same time, the external visitor nodes of the sovereign network will filter sensitive or malicious text, pictures, video, and audio data through keywords matching, AI detection and other technologies. The network system has complete security features.

Sovereign Network introduces a hierarchical management mechanism by adding authority control domains to interest groups, allowing different users to access different ranges of Internet resources, so as to provide minors with a clean, healthy and safe network environment.

The sovereign network allows users on the network to actively obtain Internet data and other sovereign network users who have the sovereign network to issue visas to actively access the content of the sovereign network, which can prohibit active requests from external IPs, reduce traditional network data injection attacks, and ensure production and broadcasting The network runs online in real time; at the same time, the new network transmission architecture makes existing IP viruses lose the operating environment, effectively improving network security; and the system will use distributed storage with endogenous security to further ensure the security of data in the sovereign network.

A sovereign network architecture under a three-tier network security system is proposed. The sovereign network of each country is managed by each country through distributed consensus technology to ensure that the network resources are authentic and not tampered with. The control rights of the sovereign network are returned to the relevant management agencies of various countries, and it is no longer monopolized by an independent institution, ensuring that the sovereignty of cyberspace of various countries is not violated.

Inside the sovereign network, there are external access nodes of the sovereign network, network supervision nodes, individual users, and corporate users. The Sovereign Network and the traditional Internet conduct data communication through the Sovereign Network's external visitor nodes, which are mainly responsible for network data transmission, content filtering, authority management and other services. At the same time, each Sovereign Network's external visitor node is responsible for completing the internal identity, content identification and tradition The process of conversion, transmission and verification between the identities of Internet IP addresses.

A management scheme for user access to the sovereign network is proposed. The user binds the corresponding biometric identity information and other identity authentication information as the identity identifier to log in to the network, and the network resources it publishes will also bind its identity information. The spatial information identification and the network resources accessed when the user logs on to the network will be recorded on the blockchain of the network supervision node of the domain for security supervision and data protection.

Provides a management solution for users to access the sovereign networks of other countries. Users will bundle the corresponding biometric identity information and other identity authentication information as personal electronic passports. It needs to obtain the corresponding country's electronic visa to visit the sovereign network of other countries, and its electronic visa information includes the length of the visit and the permission of the visit. Sovereign network external visit nodes have complete supervision and control over the access of users in the sovereign network of other countries to the information in the sovereign network.

Provides a management solution for users to access the traditional Internet. Users in the sovereign network will interact with traditional Internet data according to their user rights. All traditional Internet data transmission requests need to be implemented through the sovereign network external visit node, the sovereign network external visit node will convert and route the identification provided by the user, and at the same time detect the data transmitted from the traditional Internet into the sovereign network. Prevent bad and malicious data from entering the sovereign network.

Provides a solution for the registration and management of resources in the sovereign network. All resources generated in the sovereign network will be bound with the identity of the publisher and the corresponding content identifier. The process of logo registration and management needs to be jointly confirmed by management nodes in the domain, which solves the problems of squatting and dictatorship in traditional network logo registration and management, and improves the efficiency of system network resources and the scalability of the overall network.

The present invention introduces a blockchain technology that integrates a tree-shaped chain group/ring signature, based on the anonymity and supervisability of the group/ring signature, and can achieve a balance between the controllable and manageable requirements of the system and the open and transparent characteristics of the blockchain. By establishing a group relationship between nodes of different levels and different identities, the administrator of the upper domain can quickly locate the problem domain and identify the corresponding malicious nodes, improving the security of the system. At the same time, user information and user behavior information are locked in the blockchain to prevent data from being tampered with, and to ensure that the system can be supervised.

A network hierarchical management scheme bound with identity identification is proposed, which solves the problem of confusion in network content management at this stage. The hierarchical management plan not only promotes the dissemination of information, but also eliminates the influence of traditional media on unsuitable information for minors to a certain extent. In this way, when minors use the Internet, the content they visit is effectively managed according to local government regulations (such as not being able to play games, watching adult programs, etc., which greatly purifies the environment for children to surf the Internet).

A gradual deployment plan for the smooth transition of the network is proposed. The sovereign network accesses the traditional Internet while realizing the inviolability of the cyberspace of each country. Support the return of IP network identification to the original mission of information transmission between countries.

The above descriptions are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modification, equivalent replacement and improvement made within the spirit and principle of the present invention shall be included in the protection of the present invention. Within range.

Claims

A post-IP sovereign network architecture, which is characterized in that the devices in the post-IP sovereign network architecture all adopt a new type of network centered on identity identification, and there is no IP network in the new type of network; the sovereign network device It also includes an ID-ICN router and an EAN node. The ID-ICN router is used to support translation, addressing, and network data transmission between different identities and content identifiers; the EAN node is used to allow users in the sovereign network to be within the scope of authority Freedom to request other networks and Internet data outside the sovereign network, as well as other sovereign network users carrying the sovereign network visa to access the data in the sovereign network, and all requests initiated by other networks and the Internet outside the sovereign network are blocked, and A related content review program is installed in the EAN node, and the content arriving at the node is initially reviewed and filtered.
The post-IP sovereign network architecture of claim 1, wherein the post-IP sovereign network architecture uses a distributed storage subsystem with endogenous security for data storage to ensure data security.
The post-IP sovereign network architecture according to claim 2, characterized in that, in the post-IP sovereign network architecture, users are managed through a blockchain management subsystem to ensure that user behaviors are manageable and controllable; Register through personal real identity information, store user registration information in the blockchain node of the sovereign network, and the user needs to bind the relevant identity information at the time of registration to access the sovereign network; the blockchain management subsystem in the sovereign network Users publish content for voting, the content approved by the vote is allowed to be published, and the information about the content published by the user and the behavior log of the user request data are locked; in the sovereign network, different identifiers can be defined internally, and different identifiers can be translated in the district. Completed in the block chain management subsystem.
The post-IP sovereign network system architecture according to claim 3, characterized in that in the sovereign network, both authorized users and radio and television production and broadcasting networks can publish video and audio, and authorized users to publish audio and video include the following steps:

SY1. Authorized users log in through personal information;

SY2, after logging in, request the release of audio and video content from the blockchain node;

SY3. The blockchain will vote on the request to publish audio and video content. If the vote is passed, it will agree to authorize the user to publish the audio and video content, lock the user and the content information released in the blockchain and perform the next step, such as voting If it fails, the authorized user is prohibited from publishing this audio and video content;

SY4. Authorize users in the blockchain management to publish audio and video content in a distributed storage system with endogenous security or their own local host; the publishing content of the radio and television production network includes the following steps:

SZ1. Obtain content resources from the Internet through external access nodes on the sovereign network;

SZ2, the internal production and broadcasting network produces the content and then distributes the content through the network;

SZ3: After the content reaches the edge ID-ICN router or EAN node, it is sent to ordinary users.
The post-IP sovereign network architecture according to claim 4, characterized in that the ordinary user obtains data, and the data provider has this part of the content cached in the IP Internet or the sovereign network, or the internal node of the sovereign network; the ordinary user Obtaining data from IP Internet includes the following steps:

SIP1. Ordinary users log on to the Sovereign Network with personal identification information;

SIP2, ordinary users send content requests to edge ID-ICN routers, and send them to the external access nodes of the sovereign network through the network request or directly send the request to the external access nodes of the sovereign network connected to it, and record the content of the user request on the blockchain node information;

SIP3, Sovereign Network External Visiting Nodes will review the user's authority in the content request. If the requested content exceeds the user's authority, the content request will be discarded, and if it is within the authority, proceed to the next step;

SIP4, Sovereign network external visiting nodes extract the requested content information and request data from the Internet according to the traditional Internet method;

SIP5, Internet content providers provide the requested content data to external nodes of the sovereign network in accordance with traditional Internet methods;

SIP6, the Sovereign Network's external visitation node conducts a preliminary review of the content data provided by the Internet, if the review is passed, the next step will be executed, if it is not passed, the data will be discarded and the step SIP4 will be returned;

SIP7, the external visitor node of the sovereign network encapsulates the requested Internet content data into a data packet in the central network with the identity identifier and returns it to the ordinary user according to the path of the content request;

The step of obtaining data with this part of content cached in the sovereign network or in the node of the sovereign network includes the following steps:

SN1. Ordinary users log on to the Sovereign Network with personal identification information;

SN2. Ordinary users send content requests to network nodes in the sovereign network or external access nodes of the sovereign network to determine whether there is in the cache. If there is, the sovereign network node or external access node of the sovereign network will directly return the content requested by the user to the requesting user. If not, go to the original data place to get the data and return it to the requesting user.
The post-IP sovereign network system architecture of claim 5, wherein the data obtained by the production and broadcast network is mainly obtained from the Internet, produced and distributed.
The post-IP sovereign network architecture according to claim 6, characterized in that, when other networks or Internet users outside the sovereign network send a request to a sovereign network external visit node, the sovereign network external visit node discards the request message .
The post-IP sovereign network architecture of claim 7, wherein the mutual visits between multiple national sovereign networks in the post-IP sovereign network architecture include the following steps:

SDG1. The registered user sends a visa request to the overseas visitor node of the sovereign network of the country that represents other sovereign network visas;

SDG2, the external visitor node of the home country's sovereign network sends the visa request to the target requesting country through Overlay IP;

SDG3, the foreign visitor node of the target requesting state sovereignty network will review the incoming request. If the review is passed, the visa request will be sent to the blockchain for voting and the next step; if the review is not passed, the information will be sent back to the visa requester;

SDG4. For the request for successful voting, the visa will be returned to the requester according to the request path;

SDG5, the content requester uses the visa-carrying interest group to request other sovereign network content;

After SDG6, the destination sovereign network external visit node has passed the visa review, the content provider will return the content according to the requested path.
The post-IP sovereign network architecture according to claim 8, characterized in that the post-IP sovereign network architecture takes identity as the central network to naturally support multi-path, allowing mobile devices to simultaneously connect to multiple connectable The base station does not affect the transmission of data when it is out of the coverage of the current base station. It naturally supports wireless communication and is suitable for future services of 4K, 8K, VR, Internet of Things, and Internet of Vehicles.
The post-IP sovereign network architecture according to claim 9, characterized in that, in the post-IP sovereign network architecture, if the mobile user is in the sovereign network, the mobile user uses the identity identifier as the central network for content Request; if the mobile user is located outside the sovereign network, the request for IP content is first communicated with the base station through the Overlay IP method, and then the base station performs content request and transmission through the traditional IP network; if the mobile user is located outside the sovereign network, the request for the content of the sovereign network includes the following steps :

S5G1, the wireless terminal device with identity identification first communicates with the base station through Overlay IP;

S5G2, intra-regional stations send data to a target sovereign network externally visited node through traditional IP transmission;

S5G3, Sovereign Network External Visiting Nodes will review the user's identity, and allow access if passed, and reject if not passed.