CN114844658B - A method, device and storage medium for determining a source address of a home location - Google Patents
A method, device and storage medium for determining a source address of a home location Download PDFInfo
- Publication number
- CN114844658B CN114844658B CN202110053740.1A CN202110053740A CN114844658B CN 114844658 B CN114844658 B CN 114844658B CN 202110053740 A CN202110053740 A CN 202110053740A CN 114844658 B CN114844658 B CN 114844658B
- Authority
- CN
- China
- Prior art keywords
- address
- value
- ipv6
- converted
- home
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 49
- 238000006243 chemical reaction Methods 0.000 claims description 45
- 238000004590 computer program Methods 0.000 claims description 10
- 230000011218 segmentation Effects 0.000 claims description 8
- 230000008569 process Effects 0.000 claims description 3
- 238000012795 verification Methods 0.000 abstract description 25
- 238000013519 translation Methods 0.000 description 23
- 238000013507 mapping Methods 0.000 description 16
- 238000010586 diagram Methods 0.000 description 11
- 230000002354 daily effect Effects 0.000 description 8
- 238000012544 monitoring process Methods 0.000 description 8
- 230000006870 function Effects 0.000 description 7
- 230000000977 initiatory effect Effects 0.000 description 7
- 238000004364 calculation method Methods 0.000 description 6
- 238000012545 processing Methods 0.000 description 5
- 238000000605 extraction Methods 0.000 description 4
- 230000009286 beneficial effect Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000010276 construction Methods 0.000 description 2
- 230000007547 defect Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008520 organization Effects 0.000 description 2
- 230000004075 alteration Effects 0.000 description 1
- 229910002056 binary alloy Inorganic materials 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000018109 developmental process Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 230000003203 everyday effect Effects 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000011426 transformation method Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/09—Mapping addresses
- H04L61/25—Mapping addresses of the same type
- H04L61/2503—Translation of Internet protocol [IP] addresses
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
本发明公开了一种确定归属地源地址方法、装置及存储介质，包括：确定发起恶意攻击的IPv6地址；对所述IPv6地址进行转化后，得到转化后的地址值；在地址归属库中，根据所述转化后的地址值确定IPv6地址的归属地源地址，其中，所述地址归属库中包含有地址值与归属地源地址的对应关系。采用本发明，能够实现防止恶意攻击的IPv6归属地源地址验证。方式灵活多样，利于验证及应用。推广适用范围可大可小。实现简单且具有较好的应用场景，可以进行产品实现后的大规模推广及扩展应用。
The present invention discloses a method, device and storage medium for determining a home source address, including: determining an IPv6 address that initiates a malicious attack; converting the IPv6 address to obtain a converted address value; determining the home source address of the IPv6 address according to the converted address value in an address home library, wherein the address home library contains a correspondence between the address value and the home source address. The present invention can be used to implement IPv6 home source address verification to prevent malicious attacks. The method is flexible and diverse, which is conducive to verification and application. The scope of promotion and application can be large or small. The implementation is simple and has a good application scenario, and large-scale promotion and expanded application can be carried out after the product is realized.
Description
Technical Field
The present invention relates to the field of communications technologies, and in particular, to a method, an apparatus, and a storage medium for determining a home source address.
Background
IP (internet protocol ) addresses are an important underlying resource for communication network construction. The IPv4 (internet protocol version 4 ) address pool of global and asia-pacific areas has been exhausted in 2011. The IPv6 (internet protocol version 6, internet Protocol Version) protocol is the next generation IP protocol designed by IETF (internet engineering task Force ) to replace the IPv4 protocol. IPv6 can effectively solve the problem of insufficient number of IPv4 addresses by expanding the address length to 128 bits.
IPv6 is now in the development phase, and address allocation data and route announcement data are updated every day. Accordingly, more and more attackers use IPv6 addresses to perform corresponding attack actions, so how to trace source of the IPv6 addresses of these malicious attacks, that is, perform source address verification of the home location, becomes more and more urgent. It is highly desirable to construct an IPv6 home source address verification system that prevents malicious attacks, guaranteeing network security, and tracking traceability and evidence collection.
The prior art has the defect that the source address verification of the IPv6 attribution aiming at the malicious attack is not provided with an effective scheme.
Disclosure of Invention
The invention provides a method, a device and a storage medium for determining a home source address, which are used for solving the problem that the source address verification of the prior IPv6 home for malicious attack is not provided with an effective scheme.
The invention provides the following technical scheme:
A method of determining a home source address, comprising:
Determining an IPv6 address for initiating a malicious attack;
after the IPv6 address is converted, a converted address value is obtained;
and determining a home source address of the IPv6 address according to the converted address value in an address home base, wherein the address home base comprises a corresponding relation between the address value and the home source address.
In practice, the address home library is constructed according to one or a combination of the following parameters, start_InitiaP, end_ InitIP, country, province or State, city, district, longitude and Latitude.
In practice, the home source address of the IPv6 address is determined according to the translated address value, which is MaliciousIP, by start_initip (i) < MaliciousIP < end_initip (i).
In the implementation, determining the home source address of the IPv6 address according to the converted address value in the address home library comprises the following steps:
And obtaining a record to which the address value belongs according to the converted address value, and extracting geographic position information in the record as a home source address.
In practice, the reverse conversion of the IPv6 address is performed on the first 64 bits in the IPv6 address.
In implementation, the reverse conversion is performed on the IPv6 address, and the binary IPv6 address is converted into a decimal value and then used as the converted address value.
In an implementation, performing reverse translation on the IPv6 address includes:
Converting S 1S2S3S4 into a decimal value T 1,S5S6S7S8, converting S 1S2S3S4 into a decimal value T 2,S9S10S11S12, converting S 3,S13S14S15S16 into a decimal value T 4, wherein the first 64 bits of the IPv6 address are S1S2S3S4:S5S6S7S8:S9S10S11S12:S13S14S15S16,, each S i is a hexadecimal value converted by 4 bits in a binary manner, and i is a value from 1 to 16;
T 1*248+T2*232+T3*216+T4 is calculated and this value is taken as the translated address value.
In an implementation, performing reverse translation on the IPv6 address includes:
dividing the first 64 bits in the IPv6 address into m subsections according to the subsection of the address attribution library, wherein the bit number of each subsection is C 1、C2、C3、……、Cm, and C 1+C2+C3+……+Cm = 64;
Converting binary values of C 1、C2、C3、……、Cm bits corresponding to the m subsections into decimal values T 1、T2、T3、……、Tm respectively;
Calculation of And each value is used as the address value after conversion.
An apparatus for determining a home source address, comprising:
A processor for reading the program in the memory, performing the following process:
Determining an IPv6 address for initiating a malicious attack;
after the IPv6 address is converted, a converted address value is obtained;
determining a home source address of the IPv6 address according to the converted address value in an address home base, wherein the address home base comprises a corresponding relation between the address value and the home source address;
And a transceiver for receiving and transmitting data under the control of the processor.
In practice, the address home library is constructed according to one or a combination of the following parameters, start_InitiaP, end_ InitIP, country, province or State, city, district, longitude and Latitude.
In practice, the home source address of the IPv6 address is determined according to the translated address value, which is MaliciousIP, by start_initip (i) < MaliciousIP < end_initip (i).
In the implementation, determining the home source address of the IPv6 address according to the converted address value in the address home library comprises the following steps:
And obtaining a record to which the address value belongs according to the converted address value, and extracting geographic position information in the record as a home source address.
In practice, the reverse conversion of the IPv6 address is performed on the first 64 bits in the IPv6 address.
In implementation, the reverse conversion is performed on the IPv6 address, and the binary IPv6 address is converted into a decimal value and then used as the converted address value.
In an implementation, performing reverse translation on the IPv6 address includes:
Converting S 1S2S3S4 into a decimal value T 1,S5S6S7S8, converting S 1S2S3S4 into a decimal value T 2,S9S10S11S12, converting S 3,S13S14S15S16 into a decimal value T 4, wherein the first 64 bits of the IPv6 address are S1S2S3S4:S5S6S7S8:S9S10S11S12:S13S14S15S16,, each S i is a hexadecimal value converted by 4 bits in a binary manner, and i is a value from 1 to 16;
T 1*248+T2*232+T3*216+T4 is calculated and this value is taken as the translated address value.
In an implementation, performing reverse translation on the IPv6 address includes:
dividing the first 64 bits in the IPv6 address into m subsections according to the subsection of the address attribution library, wherein the bit number of each subsection is C 1、C2、C3、……、Cm, and C 1+C2+C3+……+Cm = 64;
Converting binary values of C 1、C2、C3、……、Cm bits corresponding to the m subsections into decimal values T 1、T2、T3、……、Tm respectively;
Calculation of And each value is used as the address value after conversion.
An apparatus for determining a home source address, comprising:
An address module for determining an IPv6 address for initiating a malicious attack;
the conversion module is used for obtaining a converted address value after converting the IPv6 address;
the determining module is used for determining the home source address of the IPv6 address according to the converted address value in the address home base, wherein the address home base contains the corresponding relation between the address value and the home source address.
In practice, the address home library is constructed according to one or a combination of the following parameters, start_InitiaP, end_ InitIP, country, province or State, city, district, longitude and Latitude.
In implementations, the determining module is further configured to determine the home source address by start_initip (i) < MaliciousIP < end_initip (i), the translated address value being MaliciousIP.
In implementation, the determining module is further configured to determine, in an address home library, a home source address of the IPv6 address according to the converted address value, where the determining module includes:
And obtaining a record to which the address value belongs according to the converted address value, and extracting geographic position information in the record as a home source address.
In practice, the translation module is further configured to reverse translate the first 64 bits in the IPv6 address.
In implementation, the conversion module is further configured to convert the binary IPv6 address into a decimal value when the IPv6 address is reversely converted, and then use the decimal value as the converted address value.
In an implementation, the translation module is further configured to, when performing reverse translation on the IPv6 address, include:
Converting S 1S2S3S4 into a decimal value T 1,S5S6S7S8, converting S 1S2S3S4 into a decimal value T 2,S9S10S11S12, converting S 3,S13S14S15S16 into a decimal value T 4, wherein the first 64 bits of the IPv6 address are S1S2S3S4:S5S6S7S8:S9S10S11S12:S13S14S15S16,, each S i is a hexadecimal value converted by 4 bits in a binary manner, and i is a value from 1 to 16;
T 1*248+T2*232+T3*216+T4 is calculated and this value is taken as the translated address value.
In an implementation, the translation module is further configured to, when performing reverse translation on the IPv6 address, include:
dividing the first 64 bits in the IPv6 address into m subsections according to the subsection of the address attribution library, wherein the bit number of each subsection is C 1、C2、C3、……、Cm, and C 1+C2+C3+……+Cm = 64;
Converting binary values of C 1、C2、C3、……、Cm bits corresponding to the m subsections into decimal values T 1、T2、T3、……、Tm respectively;
Calculation of And each value is used as the address value after conversion.
A computer readable storage medium storing a computer program for performing the above method of determining a home source address.
The invention has the following beneficial effects:
in the technical scheme provided by the embodiment of the invention, after the IPv6 address for initiating the malicious attack is determined, the home source address of the IPv6 address can be determined according to the preset address home base, so that the home source address of the IPv6 address can be determined according to the IPv6 address for the malicious attack, and further, the verification of the IPv6 home source address for preventing the malicious attack can be realized.
Furthermore, the address attribution library is generated in various modes, and the generation is performed according to the network size, so that the modes are flexible and various, and the verification and the application are facilitated. The popularization application range is large or small, and the method can be used for an organization, an industry or a country or a plurality of countries. The IPv6 home address verification system for preventing malicious attacks is simple to realize and has a good application scene, and can be widely popularized and expanded after product realization.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the invention and do not constitute a limitation on the invention. In the drawings:
FIG. 1 is a schematic flow chart of a method for determining a home source address according to an embodiment of the present invention;
fig. 2 is a schematic flow chart of an embodiment of an IPv6 home source address verification method for preventing malicious attacks according to the present invention;
FIG. 3 is a schematic diagram of a device for determining a home source address according to an embodiment of the present invention;
fig. 4 is a schematic structural diagram of an IPv6 home source address verification system for preventing malicious attacks according to an embodiment of the present invention.
Detailed Description
The inventors noted during the course of the invention that:
The scheme discloses a potential risk IPv6 address positioning method and a positioning server. The method mainly comprises the steps of obtaining IPv6 monitoring data in real time, generating a record containing an address with a unified IPv6 address format, a network segment identifier and a region identifier by each piece of IPv6 monitoring data, obtaining daily increment data of the IPv6 monitoring data corresponding to each preset region, comparing the daily increment data of the monitoring data of each preset region with the set maximum daily increment of the corresponding region, updating the set maximum daily increment of the region A to the daily increment data of the IPv6 monitoring data of the current region A if the daily increment data of the IPv6 monitoring data of the region A is larger than the set maximum daily increment, positioning the IPv6 address causing the daily increment in the IPv6 monitoring data of the region A to be a target IPv6 address, namely a potential risk IPv6 address, and inquiring and returning the attribution information of the target IPv6 address, so that the monitoring efficiency is improved. But this solution is a solution to find potential IPv6 addresses and does not address the problem of IPv6 home source address verification that is involved in preventing malicious attacks.
Therefore, the prior source address verification of the IPv6 attribution for malicious attack has no effective method, and even if a part of malicious IPv6 address library exists, the target IPv6 address system has the defects of complex inquiry, inconvenient operation, incapability of effectively positioning attribution information and the like.
Based on this, the embodiment of the invention provides a source address determining scheme of an IPv6 attribution for malicious attack, and a specific embodiment of the invention is described below with reference to the accompanying drawings.
FIG. 1 is a schematic flow chart of an implementation of a method for determining a home source address, and as shown in the figure, may include:
step 101, determining an IPv6 address for initiating malicious attack;
102, converting the IPv6 address to obtain a converted address value;
and 103, determining a home source address of the IPv6 address according to the converted address value in an address home base, wherein the address home base comprises a corresponding relation between the address value and the home source address.
In the implementation, determining the home source address of the IPv6 address according to the converted address value in the address home library comprises the following steps:
And obtaining a record to which the address value belongs according to the converted address value, and extracting geographic position information in the record as a home source address.
The method comprises the steps of carrying out reverse conversion on an IPv6 address of a malicious attack on the basis of an IPv6 home base to obtain a converted address value, carrying out size comparison in the home base by utilizing the converted address value to obtain a record to which the address value belongs, and extracting geographic position information in the record to realize home source address verification.
In practice, the address home library is constructed according to one or a combination of the following parameters, start_InitiaP, end_ InitIP, country, province or State, city, district, longitude and Latitude.
In specific implementation, the home source address of the IPv6 address is determined according to the converted address value, which is MaliciousIP, by the start_initip (i) < MaliciousIP < end_initip (i).
Specifically, an IPv6 address of a malicious attack can be input, then a conversion function is called to reversely convert the IPv6 address of the malicious attack, a converted address mapping value is recorded as MaliciousIP, the converted address mapping value MaliciousIP is compared with the sizes of the start_Initial IP (i) and the end_Initial IP (i) in a home base, if the start_Initial IP (i) < MaliciousIP < end_Initial (i), a record to which the address mapping value of the malicious attack belongs is obtained, and geographic position information in the record is extracted to obtain a home source address.
The following examples illustrate the invention.
First, the implementation of the IPv6 address home base will be described. The IPv6 address home base may include 7 components, namely, start_ InitIP (Start point), end_ InitIP (End point), country (Country), province or State (province or state), city (City), district (region), longitude and Latitude (latitude and longitude). Therefore, seven tuples of the IPv6 address home base are formed, namely [ Start_ InitIP |end_ InitIP |country| Province or State |City| District | Longitude and Latitude ], so that the generation and construction of the IPv6 address home base can be realized.
One possible generation implementation of the IPv6 address home library is described below.
For IPv6 address entry, the entry is any of the original 128-bit IPv6 addresses that need to be entered into the home pool.
For address generation of an IPv6 address home base, the input 128-bit IPv6 address is used for address conversion and generation, and the original 128-bit address is generated into an address in the home base which can be rapidly compared and inquired according to an address generation mode. Thereby, a value corresponding to start_initip and end_ InitIP in the home library element, or a corresponding value generated by any other IPv6 address translation between start_ InitIP and end_ InitIP is generated. The specific address generation method may at least include 2 methods, which will be described below.
And generating the geographic position of the IPv6 address home library, and mapping and generating by using the geographic position information corresponding to the input 128-bit IPv6 address. Thus, values corresponding to Country, province or State, city, district, and Longitude and Latitude in the home library element are generated. The specific generation mode can be that the mapping extraction of the geographic position is carried out according to a rule method, and at least two types of the geographic position can be divided into the following two types:
The first type is constructed aiming at a home base corresponding to the IPv6 address of the unit, the 128-bit address is segmented according to the coding rule, then the segmented original value is compared with the IPv6 coding rule of the unit to obtain specific country, province, city, district information, and then longitude and latitude information is reversely found according to urban area information.
Second, constructing a home base corresponding to the IPv6 address of the non-self unit, segmenting the 128-bit original address according to a large coding rule specified in the standard, obtaining rough count, province or state and city, district information by the large segmentation on the front side, and then reversely finding longitude and latitude information according to state, city and region information.
Fig. 2 is a schematic flow diagram of an implementation of an IPv6 home source address verification method for preventing malicious attacks, where as shown in the drawing, the IPv6 home source address verification for preventing malicious attacks may include:
step 201, inputting an IPv6 address of a malicious attack.
Step 202, calling a conversion function to reversely convert the IPv6 address of the malicious attack.
That is, the output of step 201 is received and reverse conversion is performed. The conversion modes here may include a first mode, i.e., IPv6 address conversion mode 1, and a second mode, i.e., IPv6 address conversion mode 2. Specific embodiments will be further described below.
And 203, obtaining a converted address mapping value, which is recorded as MaliciousIP.
Step 204, comparing the converted address mapping value MaliciousIP with each of the sizes of Start_InitiaP (i) and end_InitiaP (i) in the home base.
That is, the output of step 203 is received, and the size is compared. The elements of the home library here are composed of the following 7 elements, namely, start_initip, end_ InitIP, country, province or State, city, district, longitude and Latitude, respectively. The comparison of the sizes may be performed by comparing the number of different rounds/segments according to the transformation method in step 202. For example, one round/segment is performed in the case of the first mode IPv6 address translation mode 1, and m rounds/segments are performed in the case of the second mode IPv6 address translation mode 2.
Step 205, if start_initip (i) < MaliciousIP < end_initip (i), obtaining the record to which the address mapping value of the malicious attack belongs.
That is, the output of step 204 is received, and the matching location of the associated record is performed. The record matching method performs different rounds/segments according to the conversion method in step 202, and performs one round/segment if the first method is IPv6 address conversion method 1, and performs m rounds/segments if the second method is IPv6 address conversion method 2. Or directly from the number of rounds/segments performed in step 204.
And 206, extracting the geographical position information in the record to obtain the home source address.
That is, the output of step 205 is received, the geographical location information in the record is extracted, and the home source address is obtained, thereby implementing the source address verification.
In practice, the reverse conversion of the IPv6 address is performed on the first 64 bits in the IPv6 address.
In specific implementation, the reverse conversion is performed on the IPv6 address, and the converted address value is obtained by converting the binary IPv6 address into a decimal value.
The following describes the way to translate the IPv6 address, which can be as follows:
The first mode is IPv6 address translation mode 1.
In an implementation, performing reverse translation on the IPv6 address includes:
Converting S 1S2S3S4 into a decimal value T 1,S5S6S7S8, converting S 1S2S3S4 into a decimal value T 2,S9S10S11S12, converting S 3,S13S14S15S16 into a decimal value T 4, wherein the first 64 bits of the IPv6 address are S1S2S3S4:S5S6S7S8:S9S10S11S12:S13S14S15S16,, each S i is a hexadecimal value converted by 4 bits in a binary manner, and i is a value from 1 to 16;
T 1*248+T2*232+T3*216+T4 is calculated and this value is taken as the translated address value.
Specifically, in the 128-bit IPv6 address, the latter 64 bits are mainly used for identifying the host, and have little influence on information such as attribution. Thus, a 128-bit IPv6 address can be segmented, in a first step, by 64 bits. For the last 64 bits, the address is directly truncated without subsequent consideration, and for the first 64 bits, the address is converted and generated. Therefore, the address comparison speed can be greatly increased, the comparison efficiency is enhanced, and the space complexity is reduced.
And the second step is mainly to convert the address of the first 64 bits according to an absolute value method. That is, assuming that the first 64 bits of the original IPv6 address are S1S2S3S4:S5S6S7S8:S9S10S11S12:S13S14S15S16,, each S i is a hexadecimal value converted by 4 bits binary, the decimal values S 1S2S3S4 are T 1,S5S6S7S8 and T 2,S9S10S11S12 and T 3,S13S14S15S16 are T 4, respectively, and then T 1*248+T2*232+T3*216+T4 is calculated, and the value is used as an address mapping value after IPv6 address conversion of malicious attack. Taking 2009:8001:fff1:ffff as an example, the address mapping value information after address conversion can be calculated.
In the second mode, IPv6 address translation mode 2.
In an implementation, performing reverse translation on the IPv6 address includes:
dividing the first 64 bits in the IPv6 address into m subsections according to the subsection of the address attribution library, wherein the bit number of each subsection is C 1、C2、C3、……、Cm, and C 1+C2+C3+……+Cm = 64;
Converting binary values of C 1、C2、C3、……、Cm bits corresponding to the m subsections into decimal values T 1、T2、T3、……、Tm respectively;
Calculation of And each value is used as the address value after conversion.
Specifically, in the 128-bit IPv6 address, the latter 64 bits are mainly used for identifying the host, and have little influence on information such as attribution. Thus, a 128-bit IPv6 address can be segmented, in a first step, by 64 bits. For the last 64 bits, the address is directly truncated without subsequent consideration, and for the first 64 bits, the address is converted and generated. Therefore, the address comparison speed can be greatly increased, the comparison efficiency is enhanced, and the space complexity is reduced.
And secondly, the first 64 bits are mainly used for converting addresses according to a segmentation method, and then different segments are stored with different numerical values so as to facilitate the subsequent comparison of the sizes. The method comprises two links of segmentation and evaluation.
1 Segmentation, namely, assuming that the first 64 bits of the original IPv6 address are S1S2S3S4:S5S6S7S8:S9S10S11S12:S13S14S15S16,, wherein each S i is a hexadecimal value converted by 4 bits binary system, the segmentation can be determined according to the number of segments adopted by the original home base. Let m segments be divided, and the number of bits in each segment is C 1、C2、C3、……、Cm.C1+C2+C3+……+Cm =64. For example, the segments are divided into 6 segments in order of 20 bits, 4 bits, 8 bits, 4 bits, and 20 bits.
And 2, evaluating, namely respectively converting the addresses according to different segments to obtain the address converted values of the corresponding segments. The scheme is that binary values of C 1、C2、C3、……、Cm bits corresponding to m subsections are respectively converted into decimal values T 1、T2、T3、……、Tm, and then calculated And taking the values as address mapping values corresponding to different segments after IPv6 address conversion.
Based on the same inventive concept, the embodiment of the invention also provides a device for determining the home source address and a computer readable storage medium, and because the principle of solving the problems of the devices is similar to that of the method for determining the home source address, the implementation of the devices can refer to the implementation of the method, and the repetition is omitted.
In implementing the technical scheme provided by the embodiment of the invention, the method can be implemented as follows.
Fig. 3 is a schematic structural diagram of a device for determining a home source address, and as shown in the drawing, the device includes:
the processor 300 is configured to read the program in the memory 320, and execute the following procedures:
Determining an IPv6 address for initiating a malicious attack;
after the IPv6 address is converted, a converted address value is obtained;
determining a home source address of the IPv6 address according to the converted address value in an address home base, wherein the address home base comprises a corresponding relation between the address value and the home source address;
a transceiver 310 for receiving and transmitting data under the control of the processor 300.
In practice, the address home library is constructed according to one or a combination of the following parameters, start_InitiaP, end_ InitIP, country, province or State, city, district, longitude and Latitude.
In practice, the home source address of the IPv6 address is determined according to the translated address value, which is MaliciousIP, by start_initip (i) < MaliciousIP < end_initip (i).
In the implementation, determining the home source address of the IPv6 address according to the converted address value in the address home library comprises the following steps:
And obtaining a record to which the address value belongs according to the converted address value, and extracting geographic position information in the record as a home source address.
In practice, the reverse conversion of the IPv6 address is performed on the first 64 bits in the IPv6 address.
In implementation, the reverse conversion is performed on the IPv6 address, and the binary IPv6 address is converted into a decimal value and then used as the converted address value.
In an implementation, performing reverse translation on the IPv6 address includes:
Converting S 1S2S3S4 into a decimal value T 1,S5S6S7S8, converting S 1S2S3S4 into a decimal value T 2,S9S10S11S12, converting S 3,S13S14S15S16 into a decimal value T 4, wherein the first 64 bits of the IPv6 address are S1S2S3S4:S5S6S7S8:S9S10S11S12:S13S14S15S16,, each S i is a hexadecimal value converted by 4 bits in a binary manner, and i is a value from 1 to 16;
T 1*248+T2*232+T3*216+T4 is calculated and this value is taken as the translated address value.
In an implementation, performing reverse translation on the IPv6 address includes:
dividing the first 64 bits in the IPv6 address into m subsections according to the subsection of the address attribution library, wherein the bit number of each subsection is C 1、C2、C3、……、Cm, and C 1+C2+C3+……+Cm = 64;
Converting binary values of C 1、C2、C3、……、Cm bits corresponding to the m subsections into decimal values T 1、T2、T3、……、Tm respectively;
Calculation of And each value is used as the address value after conversion.
Wherein in fig. 3, a bus architecture may comprise any number of interconnected buses and bridges, and in particular, one or more processors represented by processor 300 and various circuits of memory represented by memory 320, linked together. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, power management circuits, etc., which are well known in the art and, therefore, will not be described further herein. The bus interface provides an interface. Transceiver 310 may be a number of elements, including a transmitter and a receiver, providing a means for communicating with various other apparatus over a transmission medium. The processor 300 is responsible for managing the bus architecture and general processing, and the memory 320 may store data used by the processor 300 in performing operations.
The embodiment of the invention also provides a device for determining the source address of the home location, which comprises the following steps:
An address module for determining an IPv6 address for initiating a malicious attack;
the conversion module is used for obtaining a converted address value after converting the IPv6 address;
the determining module is used for determining the home source address of the IPv6 address according to the converted address value in the address home base, wherein the address home base contains the corresponding relation between the address value and the home source address.
In practice, the address home library is constructed according to one or a combination of the following parameters, start_InitiaP, end_ InitIP, country, province or State, city, district, longitude and Latitude.
In implementations, the determining module is further configured to determine the home source address by start_initip (i) < MaliciousIP < end_initip (i), the translated address value being MaliciousIP.
In implementation, the determining module is further configured to determine, in an address home library, a home source address of the IPv6 address according to the converted address value, where the determining module includes:
And obtaining a record to which the address value belongs according to the converted address value, and extracting geographic position information in the record as a home source address.
In practice, the translation module is further configured to reverse translate the first 64 bits in the IPv6 address.
In implementation, the conversion module is further configured to convert the binary IPv6 address into a decimal value when the IPv6 address is reversely converted, and then use the decimal value as the converted address value.
In an implementation, the translation module is further configured to, when performing reverse translation on the IPv6 address, include:
Converting S 1S2S3S4 into a decimal value T 1,S5S6S7S8, converting S 1S2S3S4 into a decimal value T 2,S9S10S11S12, converting S 3,S13S14S15S16 into a decimal value T 4, wherein the first 64 bits of the IPv6 address are S1S2S3S4:S5S6S7S8:S9S10S11S12:S13S14S15S16,, each S i is a hexadecimal value converted by 4 bits in a binary manner, and i is a value from 1 to 16;
T 1*248+T2*232+T3*216+T4 is calculated and this value is taken as the translated address value.
In an implementation, the translation module is further configured to, when performing reverse translation on the IPv6 address, include:
dividing the first 64 bits in the IPv6 address into m subsections according to the subsection of the address attribution library, wherein the bit number of each subsection is C 1、C2、C3、……、Cm, and C 1+C2+C3+……+Cm = 64;
Converting binary values of C 1、C2、C3、……、Cm bits corresponding to the m subsections into decimal values T 1、T2、T3、……、Tm respectively;
Calculation of And each value is used as the address value after conversion.
For convenience of description, the parts of the above apparatus are described as being functionally divided into various modules or units, respectively. Of course, the functions of each module or unit may be implemented in the same piece or pieces of software or hardware when implementing the present invention.
The embodiment of the invention also provides a computer readable storage medium, which is characterized in that the computer readable storage medium stores a computer program for executing the method for determining the home source address.
For implementation, reference may be made to the above-described embodiments of the method for determining a home source address.
In practice, other possible implementation configurations of the means for determining the home source address are not excluded, such as the following system.
Fig. 4 is a schematic structural diagram of an IPv6 home source address verification system for preventing malicious attacks, as shown in the figure, it may be as follows:
The IPv6 home source address verification system for preventing malicious attack can be composed of an IPv6 address input module, an IPv6 address reverse conversion module, an IPv6 address mapping value matching module and an IPv6 home source address extraction module. Therefore, the IPv6 home source address verification of malicious attack is realized, the address comparison speed can be greatly increased, the comparison efficiency is enhanced, the space complexity is reduced, and the follow-up tracing and evidence obtaining are facilitated.
The IPv6 home source address verification system for preventing malicious attack comprises 4 functional modules, namely an IPv6 address input module 401, an IPv6 address reverse conversion module 402, an IPv6 address mapping value matching module 403 and an IPv6 home source address extraction module 404. The method can be concretely as follows:
the IPv6 address input module 401 is an input item of the entire system, that is, a 128-bit IPv6 address for malicious attack.
The IPv6 address reverse conversion module 402 is configured to reverse-convert the input 128-bit IPv6 address, and convert the original 128-bit address into an address mapping value that can be quickly compared and queried according to a conversion manner.
And the IPv6 address mapping value matching module 403 is configured to compare and match the size of the converted address mapping value in the home base.
And the IPv6 home source address extraction module 404 is used for extracting the geographic position information in the record in the matching to obtain the home source address and realize source address verification.
In summary, in the technical scheme provided by the embodiment of the invention, the verification of the IPv6 home source address for preventing malicious attack can be realized. The mode is flexible and various, and is beneficial to verification and application.
The popularization application range is large or small, and the method can be used for an organization, an industry or a country or a plurality of countries.
The IPv6 home address verification system for preventing malicious attacks is simple to realize and has a good application scene, and can be widely popularized and expanded after product realization.
It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, magnetic disk storage, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It will be apparent to those skilled in the art that various modifications and variations can be made to the present invention without departing from the spirit or scope of the invention. Thus, it is intended that the present invention also include such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.
Claims (9)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110053740.1A CN114844658B (en) | 2021-01-15 | 2021-01-15 | A method, device and storage medium for determining a source address of a home location |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110053740.1A CN114844658B (en) | 2021-01-15 | 2021-01-15 | A method, device and storage medium for determining a source address of a home location |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114844658A CN114844658A (en) | 2022-08-02 |
| CN114844658B true CN114844658B (en) | 2025-01-07 |
Family
ID=82560875
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110053740.1A Active CN114844658B (en) | 2021-01-15 | 2021-01-15 | A method, device and storage medium for determining a source address of a home location |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114844658B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115550307B (en) * | 2022-09-20 | 2024-10-11 | 中国银行股份有限公司 | Business processing method, business end, user end and system based on block chain |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109040338A (en) * | 2018-07-26 | 2018-12-18 | 赛尔网络有限公司 | The address IPv6 source tracing method based on space-time |
| CN111447292A (en) * | 2020-02-24 | 2020-07-24 | 北京邮电大学 | IPv6 geographical position positioning method, device, equipment and storage medium |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102006290B (en) * | 2010-08-12 | 2013-08-07 | 清华大学 | IP source address tracing method |
| CN109150894A (en) * | 2018-09-12 | 2019-01-04 | 珠海豆饭科技有限公司 | A kind of method and system for identifying malicious user |
| CN110764969A (en) * | 2019-10-25 | 2020-02-07 | 新华三信息安全技术有限公司 | Network attack source tracing method and device |
| CN111225079B (en) * | 2019-12-31 | 2024-03-05 | 苏州三六零智能安全科技有限公司 | Method, device, storage medium and device for positioning geographical position of malicious software author |
-
2021
- 2021-01-15 CN CN202110053740.1A patent/CN114844658B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109040338A (en) * | 2018-07-26 | 2018-12-18 | 赛尔网络有限公司 | The address IPv6 source tracing method based on space-time |
| CN111447292A (en) * | 2020-02-24 | 2020-07-24 | 北京邮电大学 | IPv6 geographical position positioning method, device, equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114844658A (en) | 2022-08-02 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20150161207A1 (en) | Assisting query and querying | |
| WO2020042586A1 (en) | Method and apparatus for generating address of smart contract, computer device, and readable storage medium | |
| US20090279437A1 (en) | Locality-based routing table generation | |
| CN111629081A (en) | Internet protocol IP address data processing method and device and electronic equipment | |
| CN110830442A (en) | Message processing method, device and gateway | |
| CN102754394A (en) | A hash table storage, search method and device | |
| CN104767839A (en) | IP positioning method and device | |
| CN111083179A (en) | IoT cloud platform, device interaction method and device based on IoT cloud platform | |
| CN112162951A (en) | Information retrieval method, server and storage medium | |
| CN114970464A (en) | Method, apparatus, terminal device and storage medium for generating identification | |
| CN114844658B (en) | A method, device and storage medium for determining a source address of a home location | |
| CN114205329A (en) | Equipment coding method and device | |
| CN107451461B (en) | Equipment fingerprint processing method and device of mobile equipment, server and storage medium | |
| CN114338527B (en) | IPv6 active identifier processing method and system | |
| CN116775689B (en) | Data query method and device, storage medium and electronic equipment | |
| WO2017088690A1 (en) | Method and device for retrieving domain name | |
| CN113379542B (en) | Block chain transaction query method, device, medium and electronic equipment | |
| CN113973111A (en) | Data forwarding method and device, gateway equipment and computer readable storage medium | |
| CN117749762B (en) | DNS access request processing method, device, equipment and storage medium | |
| CN114064312A (en) | Data processing system and model training method | |
| CN116366478B (en) | An FPGA-based data packet comparison and deduplication method | |
| CN112532414A (en) | Method, device and equipment for determining ISP attribution and computer storage medium | |
| CN112650964B (en) | Service processing method, equipment and machine readable storage medium | |
| CN114697378B (en) | Website access method, device, equipment and medium | |
| CN114726825B (en) | Method, system, electronic device and storage medium for constructing IPv6 address library |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |