WO2023165324A1

WO2023165324A1 - Communication method, network device, terminal, and domain name system server

Info

Publication number: WO2023165324A1
Application number: PCT/CN2023/075817
Authority: WO
Inventors: 程建明; 蒋胜; 郑秀丽; 江伟玉; 杨言
Original assignee: 华为技术有限公司
Priority date: 2022-03-03
Filing date: 2023-02-14
Publication date: 2023-09-07
Also published as: CN116743410A

Abstract

A communication method, comprising: receiving an uplink data packet which is sent by a terminal; upon detecting that the uplink data packet carries a high-defense address identifier, acquiring, from the uplink data packet, an IP address of the terminal and a first virtual IP address of an application server; acquiring a key; according to the key, and the IP address of the terminal and the first virtual IP address, which are carried in the uplink data packet, generating an IP address to be processed; when the IP address to be processed is not the IP address of the application server, determining that the uplink data packet is illegitimate; and when the IP address to be processed is the IP address of the application server, modifying a destination IP address of the uplink data packet from the first virtual IP address to the IP address of the application server, and then sending the modified uplink data packet to the application server. In this way, one application server corresponds to a plurality of virtual IP addresses, thereby reducing the risk of the IP address of an application server being attacked by a network. Further provided in the present application is a related device capable of implementing the communication method.

Description

A communication method, network equipment, terminal and domain name system server

This application claims the priority of the Chinese patent application with the application number 202210210483.2 and the application name "a communication method, network equipment, terminal and domain name system server" submitted to the China Patent Office on March 3, 2022, the entire content of which is passed References are incorporated in this application.

technical field

The present application relates to the communication field, in particular to a communication method, network equipment, terminal and domain name system server.

Background technique

In a network attack scenario targeting a specific target, the attacker needs to obtain the Internet Protocol (IP) address of the target, and then launch an attack against the address. As a means of defending against network attacks, IP address hopping can change the IP address and prevent attackers from continuously launching network attacks on the IP address of the attack target. IP address hopping includes real IP address hopping and virtual IP address hopping.

At present, there is a method of virtual IP address hopping as follows: When the terminal wants to access the application server, the terminal requests the application server from the domain name system (domain name system, DNS) server through the mobile target defense (mobile target defense, MTD) gateway proxy. The DNS server sends the IP address of the application server to the MTD gateway agent, and the MTD gateway agent modifies the IP address of the application server in the message to a virtual IP address, and then sends the virtual IP address to the terminal. After obtaining the virtual IP address, the terminal sends a data message to the MTD gateway agent according to the virtual IP address, and the destination IP address of the data message is the virtual IP address. After the MTD gateway agent receives the data message, according to the mapping table of the virtual IP address and the IP address of the application server, the destination IP address of the data message is changed from the virtual IP address to the IP address of the application server, and then contains the IP address of the application server. The data packet of the IP address is sent to the application server.

When multiple terminals access the application server, different terminals get the same virtual IP address within a single hopping period. When the virtual IP address is shared or resold, it is easy for network attackers to use multiple bot devices to carry out network attacks on application servers.

Contents of the invention

In view of this, this application provides a communication method that can generate multiple virtual IP addresses for each application server's IP address, thereby preventing network attackers from using multiple bot devices to launch network attacks using the same virtual IP address, and improving network security sex. The present application also provides a terminal, a network device, a domain name system server, etc. capable of implementing the above-mentioned communication method.

The first aspect provides a communication method, which includes: receiving an uplink data packet sent by a terminal; when it is detected that the uplink data packet carries a high-defense address identifier, obtaining the terminal's IP address and the first virtual address of the application server from the uplink data packet IP address; after obtaining the key, according to the key, the IP address of the terminal and the first virtual IP address generate the IP address to be processed; when the IP address to be processed is not the IP address of the application server, it is determined that the uplink data packet is illegal; when the IP address to be processed is not the IP address of the application server; When the processing IP address is the IP address of the application server, modify the destination IP address of the uplink data packet from the first virtual IP address to the IP address to be processed, and send the uplink data packet carrying the IP address to be processed to the application server. The uplink data packet carries the first virtual IP address of the application server and the IP address of the terminal. Since the first virtual IP address is based on the key, the IP address of the terminal The address is generated from the IP address of the application server, so one application server IP address corresponds to many virtual IP addresses, which can prevent network attackers from using multiple bot devices to launch network attacks on the application server corresponding to one virtual IP address.

In a possible implementation manner, generating the IP address to be processed according to the key, the IP address of the terminal, and the first virtual IP address includes: when the uplink data packet further includes the first address generation sequence, according to the key, the terminal The IP address, the first virtual IP address and the first address generation sequence generate the IP address to be processed. Since the first address generation sequence includes the address generation time of the first virtual IP address and the address lifetime of the first virtual address, it can be verified whether the first virtual IP address is legal according to the first address generation sequence, which can improve the validity of the virtual IP address. safety.

In another possible implementation, the above method further includes: receiving the downlink data packet sent by the application server, and when it is detected that the downlink data packet carries the high-defense address identifier, according to the key, the IP address of the application server, the IP address of the terminal The address and the first address generation sequence generate the first virtual IP address; determine the address end time of the first virtual IP address according to the first address generation sequence; when the address end time is greater than the verification time, determine that the target time difference is equal to the address end time minus the verification Time: when the target time difference is greater than the preset duration, generate a first downlink data packet according to the downlink data packet and the first virtual IP address, and send the first downlink data packet to the terminal. The downlink data packet carries the IP address of the application server, the IP address of the terminal, the first address generation sequence and the high-defense address identification. After converting the IP address of the application server into a virtual IP address, the IP address of the application server can be hidden. When the end time of the address is less than the verification time, it indicates that the first virtual IP address has expired, and the downlink data packet can be discarded, or the first downlink data packet can be generated according to the downlink data packet and the first virtual IP address, and the first downlink data packet can be sent to the terminal.

In another possible implementation, when the target time difference is less than or equal to the preset duration, the second address generation sequence is obtained, and the second address generation sequence is generated according to the key, the IP address of the application server, the IP address of the terminal, and the second address generation sequence. Two virtual IP addresses; generate a second downlink data packet according to the downlink data packet, the first virtual IP address, the second virtual IP address, the second address generation sequence and the address switching identifier, and send the second downlink data packet to the terminal. Wherein, the second downlink data packet carries the first virtual IP address, the second virtual IP address, the second address generation sequence and the address switching identifier. The second address generation sequence includes address generation time of the second virtual IP address and address lifetime of the second virtual IP address. This provides a method for notifying the terminal to perform address switching by using the downlink data packet.

In another possible implementation manner, when the target time difference is less than or equal to the preset duration, the second address generation sequence is obtained, and the second address generation sequence includes the address generation time of the second virtual IP address and the address generation time of the second virtual IP address. Address survival time; generate a second virtual IP address according to the key, the IP address of the application server, the IP address of the terminal, and the second address generation sequence; send an address switch carrying the second virtual IP address and the second address generation sequence to the terminal Notification; generate a first downlink data packet according to the downlink data packet and the first virtual IP address, and send the first downlink data packet to the terminal. The address switching notification belongs to the control plane message, which provides another method for notifying the terminal to perform address switching.

In another possible implementation manner, generating the IP address to be processed according to the key, the IP address of the terminal, the first virtual IP address, and the first address generation sequence includes: using the key to convert the second part of the first virtual IP address to Decryption; perform the first XOR operation on the second part of the terminal's IP address and the decryption result; perform the second XOR operation on the first address generation sequence and the first XOR operation result; convert the first virtual IP The first part of the address and the result of the second XOR operation form the IP address to be processed. This provides a feasible address decryption method.

In another possible implementation, before obtaining the key, receive the application service sent by the key management server The IP address of the application server and the key corresponding to the IP address of the application server. There is a one-to-one correspondence between the key and the IP address of the application server. After the key is deployed on the network device, it can perform address translation on the virtual IP address generated by using the key.

In another possible implementation manner, before obtaining the key, the IP address of the terminal and the key corresponding to the IP address of the terminal are received from the key management server. There is a one-to-one correspondence between the key and the IP address of the terminal. After the key is deployed on the network device, it can perform address translation on the virtual IP address generated by using the key.

In another possible implementation manner, before obtaining the key, the key sent by the key management server is received. This key is used for address translation. In the foregoing possible implementation manners, the key management server may periodically send new keys to improve the security of the virtual address.

The second aspect provides a communication method. The method includes: after sending an address request message including a domain name to a domain name system server, receiving a response message sent by the domain name system server according to the address request message, and then generating an uplink data packet, and sending an uplink data packet to a network device. data pack. The uplink data packet carries the IP address of the terminal, the first virtual IP address and the high-defense address identification. According to this implementation, the real IP address of the application server can be hidden when sending uplink data, thereby improving communication security.

In a possible implementation manner, the response message further includes the first address generation sequence, and the uplink data packet further includes the first address generation sequence. The first address generation sequence includes the address generation time of the first virtual IP address and the address lifetime of the first virtual address. The generation moment of the virtual IP address may be a time stamp. Since the address generation time and address lifetime of the virtual IP address are unique, the encryption and decryption of the virtual IP address can reduce the possibility of counterfeiting and have good security.

In another possible implementation manner, the above method further includes: receiving a first downlink data packet sent by the network device, where the first downlink data packet carries the first virtual IP address. When the first virtual IP address has not expired, the network device sends a downlink data packet carrying the first virtual IP address.

In another possible implementation, the above method further includes: receiving a second downlink data packet sent by the network device, the second downlink data packet carrying the first virtual IP address, the second virtual IP address, the second address generation sequence and Address switching identification; generating an uplink data packet carrying a second virtual IP address, a second address generation sequence and a high-defense address identification according to the address switching identification. The second address generation sequence includes address generation time of the second virtual IP address and address lifetime of the second virtual IP address. When the first virtual IP address is about to expire, the network device can send the second downlink data packet to the terminal, and the terminal generates the uplink data packet carrying the second virtual IP address and the second address generation sequence, and then sends the uplink data to the network device Bag. Different virtual IP addresses are used for communication during each address hopping period, thereby further improving network security.

In another possible implementation, the above method further includes: after receiving the first downlink data packet and the address switching notification sent by the network device, generating a second virtual IP address carrying the second virtual IP address according to the address switching notification, the second address generation sequence and the uplink data packet identified by Anti-DDoS Pro address. The first downlink data packet carries the first virtual IP address. The address switching notification includes a second virtual IP address and a second address generation sequence. When the first virtual IP address is about to expire, the network device can send the first downlink data packet and address switching notification to the terminal, and the terminal generates an uplink data packet carrying the second virtual IP address and the second address generation sequence according to the address switching notification After that, the uplink data packet can be sent to the network device. This provides another address switching method, using different virtual IP addresses for communication during each address switching period, thereby further improving High network security.

The third aspect provides a communication method, the method includes: receiving an address request message sent by a terminal, and when the domain name included in the address request message is a high-defense domain name, obtaining a key and a high-defense address identifier; then according to the key, the terminal's The IP address and the IP address of the application server generate a first virtual IP address; and send a response message to the terminal. The response message includes the first virtual IP address and the Anti-DDoS Pro address identifier. Accordingly, a virtual IP address can be provided to hide the real IP address of the application server during communication, thereby improving communication security.

In a possible implementation manner, generating the first virtual IP address according to the key, the IP address of the terminal and the IP address of the application server includes: obtaining the first address generation sequence, and according to the key, the IP address of the terminal and the IP address of the application server The IP address and first address generation sequence generates a first virtual IP address. The first address generation sequence includes the address generation time of the first virtual IP address and the address lifetime of the first virtual address. This provides a way to generate a virtual IP address.

In another possible implementation manner, generating the first virtual IP address according to the secret key, the IP address of the terminal, the IP address of the application server, and the first address generation sequence includes: combining the second part of the IP address of the terminal with the application Perform the first XOR operation on the second part of the server's IP address; perform the second XOR operation on the first address generation sequence and the first XOR operation result; use the key to pair the second XOR operation result performing encryption; combining the encryption result and the first part of the IP address of the application server to form a first virtual IP address. This provides a way to generate a virtual IP address.

The fourth aspect provides a network device, which has the function of implementing the communication method in the first aspect. This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware. Hardware or software includes one or more modules corresponding to the above-mentioned functions.

The fifth aspect provides a terminal, which has the function of implementing the communication method in the second aspect. This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware. Hardware or software includes one or more modules corresponding to the above-mentioned functions.

The sixth aspect provides a domain name system server, and the domain name system server has the function of implementing the communication method in the third aspect. This function may be implemented by hardware, or may be implemented by executing corresponding software on the hardware. The hardware or software includes one or more modules corresponding to the above functions.

A seventh aspect provides a network device, which includes a processor and a memory, where the memory is used to store a program; and the processor implements the method of the first aspect by executing the program.

An eighth aspect provides a terminal, which includes a processor and a memory, where the memory is used to store a program; and the processor implements the method of the second aspect by executing the program.

A ninth aspect provides a domain name system server, which includes a processor and a memory, where the memory is used to store a program; and the processor implements the method of the third aspect by executing the program.

A tenth aspect provides a computer-readable storage medium, in which instructions are stored, and when the computer-readable storage medium is run on a computer, it causes the computer to execute the methods in the above aspects.

The eleventh aspect provides a computer program product containing instructions, which, when run on a computer, causes the computer to perform the methods of the above aspects.

A twelfth aspect provides a chip system, including at least one processor, the processor is coupled to a memory, the memory is used to store computer programs or instructions, and the processor is used to execute the computer programs or instructions, to Methods of implementing the above aspects.

Description of drawings

FIG. 1 is a schematic diagram of an address jumping scenario of the present application;

Fig. 2 is a signaling diagram of the communication method in the embodiment of the present application;

FIG. 3 is another signaling diagram of the communication method in the embodiment of the present application;

FIG. 4 is another signaling diagram of the communication method in the embodiment of the present application;

FIG. 5A is a schematic diagram of generating a first virtual IP address according to a key, a user IP address, an IP address of an application server, and a first address generation sequence in an embodiment of the present application;

FIG. 5B is a schematic diagram of generating an application server IP address according to the key, the first virtual IP address, the user IP address and the first address generation sequence in the embodiment of the present application;

FIG. 6 is another signaling diagram of the communication method in the embodiment of the present application;

FIG. 7 is another signaling diagram of the communication method in the embodiment of the present application;

FIG. 8 is a schematic diagram of the first downlink data packet in the embodiment of the present application;

FIG. 9 is a schematic diagram of a second downlink data packet in the embodiment of the present application;

FIG. 10 is a structural diagram of a network device in an embodiment of the present application;

FIG. 11 is a structural diagram of a terminal in an embodiment of the present application;

FIG. 12 is a structural diagram of a domain name system server in an embodiment of the present application;

FIG. 13 is another structural diagram of a network device in an embodiment of the present application;

FIG. 14 is another structural diagram of a terminal in the embodiment of the present application;

FIG. 15 is another structural diagram of the domain name system server in the embodiment of the present application.

Detailed ways

The communication method of the present application can be applied to an IP network system. In one example, the IP network system includes a terminal 10 , a network device 20 , a domain name system server 30 , a key management server 40 and an application server 50 . The data transmission process of the above devices includes:

Step S11 , the key management server 40 sends the key to the domain name system server 30 .

Step S12 , the key management server 40 sends the key to the network device 20 .

The key management server 40 stores keys. The key management server 40 can periodically send the key to the domain name system server 30 and the network device 20, and the domain name system server 30 and the network device 20 can store the key locally after receiving the key. Step S12 may be performed before step S11, and step S11 and step S12 may also be performed together.

Step S13 , the terminal 10 sends an address request to the network device 20 .

After the user inputs the domain name on the terminal 10, the terminal 10 generates an address request carrying the domain name, and sends the address request to the network device.

Step S14 , the network device 20 sends the address request to the domain name system server 30 .

After receiving the address request, the domain name system server 30 determines the virtual IP address and virtual address associated information of the application server 50 according to the domain name carried in the address request. The virtual IP address and key of the application server 50, the IP address of the terminal 10 The address is related to the IP address of the application server 50.

The virtual address-related information refers to information related to the virtual IP address of the application server 50 . For example, high-defense address identification, address generation sequence. The address generation sequence includes address generation time and address lifetime of the virtual IP address. The high-defense address identification can also be understood as a virtual address identification.

Step S15 , the domain name system server 30 sends the virtual IP address of the application server 50 and the associated information of the virtual address to the network device 20 .

Step S16 , the network device 20 sends the virtual IP address of the application server 50 and the virtual address association information to the terminal 10 .

After acquiring the virtual IP address of the application server 50 and the associated information of the virtual address, the terminal 10 generates a data packet including the virtual IP address of the application server 50 and the associated information of the virtual address.

Step S17 , the terminal 10 sends a data packet including the virtual IP address of the application server 50 and information associated with the virtual address to the network device 20 .

After receiving the data packet, the network device 20 performs address hopping on the destination address of the data packet, so that the destination address of the data packet is converted from the virtual IP address of the application server 50 to the IP address of the application server 50 .

Step 18, the network device 20 sends a data packet including the IP address of the application server 50 and the associated information of the virtual address to the application server 50 .

Step 19, the application server 50 sends a data packet including the IP address of the application server 50 and the associated information of the virtual address to the network device 20 .

Step 20 , the network device 20 sends to the terminal 10 a data packet including the virtual IP address of the application server 50 and the associated information of the virtual address.

The network device can perform address hopping between the virtual IP address and the real IP address of the application server 50, so that the real IP address of the application server can be hidden. Since the virtual IP address of the application server 50 is related to the key, the IP address of the terminal 10 is related to the IP address of the application server 50, when m terminals access the application server 50 at the same time, there are m virtual IP addresses corresponding to the application server 50, This can prevent network attackers from using multiple bot devices to launch network attacks on the application server 50 corresponding to one virtual IP address, thus improving network security. m is a positive integer.

Address hopping in this application is a moving target defense technology (Moving Target Defense, MTD), that is, by dynamically and continuously changing the attack surface (changing IP addresses, network ports, network configuration information, software, etc.), the attacker's surface For large uncertainties, it is difficult to predict and explore, thereby improving network security. In the existing virtual IP address hopping method, within a single address hopping period, one application server corresponds to one virtual IP address. When the virtual IP address is disclosed or resold, network attackers can use multiple bot devices to launch network attacks on the virtual IP address, such as distributed denial of service attacks (distributed denial of service, DDOS). For this problem, this application provides a communication method that enables one application server to correspond to multiple virtual IP addresses, thereby reducing the possibility of network attackers using multiple bot devices to launch network attacks on one virtual IP address.

The communication method of the present application is introduced below. Referring to FIG. 2, an embodiment of the communication method provided by the present application includes:

Step 201, the terminal sends an address request message to the domain name system server. The address request message carries a domain name.

Step 202, the domain name system server judges whether the domain name carried in the address request message is a high-defense domain name, if so, then Execute step 204, if not, execute step 203.

Step 203, the domain name system server sends the IP address corresponding to the domain name to the terminal.

The terminal can access the server corresponding to the domain name according to the IP address corresponding to the domain name.

Step 204, the domain name system server obtains the key and the Anti-DDoS Pro address identifier.

There are several ways to obtain keys.

In an alternative embodiment, the domain name system server obtains the key from a locally stored key. Before obtaining the key, the domain name system server periodically receives the key from the key management server, and then saves it locally. During a single key period, the domain name system server or network device uses the key for encryption and decryption.

In another optional embodiment, the key management server stores the mapping relationship between the IP address of the terminal and the key. The domain name system server periodically receives the IP address of the terminal and the key corresponding to the IP address of the terminal sent by the key management server. Alternatively, the domain name system server sends a key request carrying the IP address of the terminal to the key management server, and the key management server obtains the key according to the IP address of the terminal carried in the key request. In this way, the IP address of each terminal corresponds to a key.

In another optional embodiment, the key management server stores the mapping relationship between the IP address of the application server and the key. The domain name system server periodically receives the IP address of the application server and the key corresponding to the IP address of the application server sent by the key management server. Alternatively, the domain name system server sends a key request carrying the IP address of the application server to the key management server, and the key management server obtains the key according to the IP address of the application server carried in the key request. In this way, the IP address of each application server corresponds to a key.

Step 205, the domain name system server generates a first virtual IP address according to the key, the IP address of the terminal and the IP address of the application server.

Step 206, the domain name system server sends a response message including the first virtual IP address and the high-defense address identifier to the terminal.

Step 207, the terminal sends an uplink data packet to the network device.

After receiving the response message, the terminal can generate an uplink data packet. The uplink data packet carries the IP address of the terminal, the first virtual IP address and the high-defense address identification. The IP address of the terminal is the source IP address of the uplink data packet, and the first virtual IP address is the destination IP address of the uplink data packet.

Step 208, when it is detected that the uplink data packet carries the high-defense address identifier, obtain the IP address of the terminal and the first virtual IP address of the application server from the uplink data packet.

After receiving the uplink data packet sent by the terminal, detect whether the uplink data packet includes the high-defense address identification. When it is detected that the uplink data packet carries the high-defense address identifier, it indicates that the destination IP address of the uplink data packet is a virtual IP address. Obtain the IP address of the terminal and the first virtual IP address of the application server from the uplink data packet. It should be understood that if the data packet sent by the terminal does not carry the high-defense address identifier, it indicates that the server corresponding to the destination IP address of the data packet is not a high-defense server, and the data packet is directly forwarded according to the destination IP address of the data packet.

Step 209, the network device acquires the key.

The key obtained by the domain name system server in step 204 and the key obtained by the network device in step 209 are the same.

In an optional embodiment, the network device obtains the key from locally stored keys. It should be noted that before the network device obtains the key, the key management server can periodically send the key to the network device, and the network device receives the key After the key is created, save the key locally.

In another optional embodiment, after the network device sends a key acquisition request to the key management server, it receives the terminal IP address and the key corresponding to the terminal IP address sent by the key management server.

In another optional embodiment, after the network device sends a key acquisition request to the key management server, it receives the IP address of the application server and the key corresponding to the IP address of the application server sent by the key management server. It should be noted that the network device and the application server are in the same domain, and the prefix of the virtual IP address is used to point to this domain. The forwarding device (such as a router or switch) in the network can send the uplink data packet to the network device of the domain according to the prefix of the virtual IP address.

Step 210, the network device generates an IP address to be processed according to the key, the IP address of the terminal and the first virtual IP address.

In an optional embodiment, step 210 includes: using a key to decrypt the second part of the first virtual IP address; performing an XOR operation on the second part of the terminal's IP address and the decryption result; The first part of the address and the XOR operation result form the IP address to be processed. In this embodiment, the first part of the IP address of the application server is the same as the first part of the first virtual IP address, and the second part of the IP address of the application server is different from the second part of the first virtual IP address. In this application, the first part and the second part can be intercepted from the IP address according to the actual situation, and the length of the first part and the second part can also be set according to the actual situation, which is not limited in this application. The decryption algorithm and the encryption algorithm use the same key. The decryption algorithm can be but not limited to international data encryption algorithm (international data encryption algorithm, IDEA) algorithm, data encryption standard (data encryption standard, DES) algorithm, triple DES algorithm, etc.

Step 211 , the network device judges whether the IP address to be processed is the IP address of the application server, if yes, execute step 213 , if not, execute step 212 .

When the IP address to be processed is the IP address of the application server, it indicates that the second part of the first virtual IP address is obtained by encrypting the second part of the IP address of the application server using a key. When the IP address to be processed is not the IP address of the application server, it indicates that the second part of the first virtual IP address is not obtained by encrypting the second part of the IP address of the application server with a key.

Step 212, the network device determines that the uplink data packet is illegal.

When the uplink data packet is illegal, the network can forward the uplink data packet to the traffic cleaning center or honeypot server, or the network device discards the illegal data packet.

Step 213, the network device modifies the destination IP address of the uplink data packet from the first virtual IP address to the IP address of the application server. When the IP address to be processed is the IP address of the application server, it indicates that the uplink data packet is legal, and the destination IP address of the data packet is converted.

Step 214, the network device sends the modified uplink data packet to the application server. In the modified uplink data packet, the destination IP address is the IP address of the application server.

In this embodiment, since the first virtual IP address is related to the key, the IP address of the terminal and the IP address of the application server, when multiple terminals send uplink data packets to the same application server, the uplink data packets sent by different terminals have Different virtual IP addresses, which can prevent network attackers from using multiple bot devices and the same virtual IP address to launch network attacks on the same application server.

In this application, the application server can send downlink data packets to the terminal, and the downlink data packets can be implemented as shown in Figure 2 The response data packet of the modified uplink data packet in the example may also be a message initiated by the application server, such as a push message. Referring to Figure 3, in an optional embodiment, the above method also includes:

Step 301, the network device receives the downlink data packet sent by the application server. The downlink data packet carries the IP address of the application server, the IP address of the terminal, and the high-defense address identification. When the network device detects that the downlink data packet carries the high-defense address identifier, step 302 is executed.

Step 302, the network device generates a first virtual IP address according to the key, the IP address of the application server and the IP address of the terminal.

Specifically, the network device encrypts the second part of the IP address of the application server according to the key; performs an XOR operation on the second part of the IP address of the terminal and the encrypted result, and XORs the first part of the IP address of the application server with The operation result forms the first virtual IP address. Since the second part of the IP address of different terminals is different, different virtual IP addresses will be generated according to the IP addresses of different terminals. Using key encryption can improve the security of the virtual IP address.

Step 303, the network device modifies the source IP address of the downlink data packet from the IP address of the application server to the first virtual IP address.

Step 304, the network device sends the modified downlink data packet to the terminal.

In this embodiment, the network device can convert the real IP address carried in the downlink data packet into a virtual IP address, so that the real IP address of the application server can be hidden and network security can be improved.

In the above embodiments, when the key management server periodically changes the key, the virtual IP address generated by using the key will also change, so the virtual IP address can be updated periodically, which can improve the security of the virtual IP address. In addition, the present application can also use the key and time stamp to generate a virtual IP address, which can further improve the security of the virtual IP address. Referring to Figure 4, another embodiment of the communication method provided by the present application includes:

Step 401, the terminal sends an address request message to the domain name system server. The address request message carries a domain name.

Step 402, the domain name system server judges whether the domain name carried in the address request message is a high-defense domain name, if yes, execute step 404, if not, execute step 403.

Step 403, the domain name system server sends the IP address corresponding to the domain name to the terminal. The terminal can access the server corresponding to the domain name according to the IP address corresponding to the domain name.

Step 404, the domain name system server obtains the key, the first address generation sequence and the high-defense address identification.

There are several ways to obtain keys.

In an alternative embodiment, the domain name system server obtains the key from locally stored keys. Before obtaining the key, the domain name system server periodically receives the key from the key management server, and then saves it locally. During a single key period, the domain name system server or network device uses the key for encryption and decryption. The keys issued in different key periods are different, so the virtual IP addresses carried in data packets sent by the same terminal in different key periods are also different.

In another optional embodiment, the key management server stores the mapping relationship between the IP address of the terminal and the key. The domain name system server periodically receives the IP address of the terminal and the key corresponding to the IP address of the terminal sent by the key management server. Alternatively, the domain name system server sends a key request carrying the IP address of the terminal to the key management server, and the key management server obtains the key according to the IP address of the terminal carried in the key request. In this way each IP address of the terminal has a key.

In another optional embodiment, the key management server stores the mapping relationship between the IP address of the application server and the key. The domain name system server periodically receives the IP address of the application server and the key corresponding to the IP address of the application server sent by the key management server. Alternatively, the domain name system server sends a key request carrying the IP address of the application server to the key management server, and the key management server obtains the key according to the IP address of the application server carried in the key request. This way there is one key per application server.

Step 405, the domain name system server generates a first virtual IP address according to the key, the IP address of the terminal, the IP address of the application server, and the first address generation sequence.

It should be noted that the relationship between the key, the IP address of the terminal and the IP address of the application server, the address generation sequence and the virtual IP address can be described by the following formula:
vIP _ij ＝F _key (SrcIP _i ,DstIP,Seq _j )

vIP _ij represents the virtual IP address associated with the IP address of the i-th terminal and the j-th address generation sequence. SrcIP _i is the IP address of the i-th terminal, and Seq _j is the generated sequence for the j-th address. Both i and j are positive integers. DstIP represents the IP address of the application server. F _key () represents the encryption function related to the key key, which is used to represent IDEA algorithm, DES algorithm or triple DES algorithm.

Step 406, the domain name system server sends a response message including the first virtual IP address, the first address generation sequence and the high-defense address identifier to the terminal.

Step 407, the terminal sends an uplink data packet to the network device.

After receiving the response message, the terminal can generate an uplink data packet. The uplink data packet carries the IP address of the terminal, the first virtual IP address, the first address generation sequence and the high-defense address identification. The IP address of the terminal is the source IP address of the uplink data packet, and the first virtual IP address is the destination IP address of the uplink data packet.

Step 408, when it is detected that the uplink data packet carries the high-defense address identifier, obtain the IP address of the terminal from the uplink data packet, and generate a sequence of the first virtual IP address and the first address of the application server.

After receiving the uplink data packet sent by the terminal, detect whether the uplink data packet includes the high-defense address identification. When it is detected that the uplink data packet carries the high-defense address identifier, it indicates that the destination IP address of the uplink data packet is a virtual IP address. The IP address of the terminal, the first virtual IP address of the application server and the first address generation sequence are obtained from the uplink data packet. It should be understood that if the data packet sent by the terminal does not carry the high-defense address identifier, it indicates that the server corresponding to the destination IP address of the data packet is not a high-defense server, and the data packet can be forwarded directly according to the destination IP address of the data packet.

Step 409, the network device acquires the key. The key obtained by the domain name system server in step 404 and the key obtained by the network device in step 409 are the same.

In an optional embodiment, the network device obtains the key from locally stored keys. It should be noted that before the network device obtains the key, the key management server may periodically send the key to the network device, and the network device stores the key locally after receiving the key.

In another optional embodiment, after the network device sends a key acquisition request to the key management server, it receives the IP address of the terminal and the key corresponding to the IP address of the terminal sent by the key management server.

In another optional embodiment, after the network device sends a key management server to obtain a key request, it receives the key The IP address of the application server and the key corresponding to the IP address of the application server are sent by the management server. It should be noted that the network device and the application server are in the same domain, and the prefix of the virtual IP address is used to point to this domain. The forwarding device (such as a router or switch) in the network can send the uplink data packet to the network device of the domain according to the prefix of the virtual IP address.

Step 410, the network device generates an IP address to be processed according to the key, the IP address of the terminal, the first virtual IP address and the first address generation sequence.

The relationship between the key, the IP address of the terminal, the first virtual IP address, the first address generation sequence and the IP address to be processed can be expressed by the following formula:
IP=F _key (SrcIP _i , vIP _ij , Seq _j ).

IP represents the IP address to be processed. vIP _ij represents the virtual IP address associated with the IP address of the i-th terminal and the j-th address generation sequence. SrcIP _i is the IP address of the i-th terminal, and Seq _j is the generated sequence for the j-th address. F _key () represents a function related to the key key.

In an optional embodiment, step 410 includes: using a key to decrypt the second part of the first virtual IP address; performing the first XOR operation on the second part of the terminal's IP address and the decryption result; An address generation sequence and the result of the first XOR operation are subjected to a second XOR operation; the first part of the first virtual IP address and the result of the second XOR operation are used to form an IP address to be processed. In this embodiment, the first part of the IP address of the application server is the same as the first part of the first virtual IP address, and the second part of the IP address of the application server is different from the second part of the first virtual IP address. The decryption algorithm and the encryption algorithm use the same key. The decryption algorithm can be but not limited to international data encryption algorithm (international data encryption algorithm, IDEA) algorithm, data encryption standard (data encryption standard, DES) algorithm, triple DES algorithm.

Step 411 , the network device judges whether the IP address to be processed is the IP address of the application server, if yes, execute step 413 , if not, execute step 412 .

Step 412, the network device determines that the uplink data packet is illegal.

When the IP address to be processed is not the IP address of the application server, the network device determines that the uplink data packet is illegal, and the network device can forward the uplink data packet to the traffic cleaning center or the honeypot server, or the network device discards the illegal data packet.

Step 413, the network device modifies the destination IP address of the uplink data packet from the first virtual IP address to the IP address of the application server. When the IP address to be processed is the IP address of the application server, it indicates that the uplink data packet is legal, and the destination IP address of the data packet is converted. Address conversion is also called address hopping.

Step 414, the network device sends the modified uplink data packet to the application server.

In the modified uplink data packet, the destination IP address is the IP address of the application server.

In this embodiment, since the first virtual IP address is the same as the key, the IP address of the terminal is the same as the IP address of the application server. Off, when multiple terminals send uplink data packets to the same application server, the uplink data packets sent by different terminals have different virtual IP addresses. The possibility of network attacks, which can further improve network security.

Secondly, since the virtual IP address is related to the address generation time and the address lifetime of the virtual IP address, the security of the virtual IP address can be improved.

Thirdly, the lifetime of the virtual IP address can be determined based on the address generation time and the address lifetime. The present application can check the timeliness of the virtual IP address based on the lifetime of the virtual IP address, and judge whether the virtual IP address has expired. The security of data transmission can be improved by automatically changing the virtual IP address.

The process of generating a virtual IP address according to the encryption key, the IP address of the terminal, the IP address of the application server and the first address generation sequence in this application will be described below with reference to FIG. 5A . Referring to FIG. 5A, in an example, the IP address of the terminal includes a first part 501 of the terminal IP address and a second part 502 of the terminal IP address, and the lengths of the first part 501 of the terminal IP address and the second part 502 of the terminal IP address are the same. is 64 bits. The IP address of the application server includes the first part 503 of the IP address of the application server and the second part 504 of the IP address of the application server, and the lengths of the first part 503 of the IP address of the application server and the second part 504 of the IP address of the application server are equal. is 64 bits.

Select two items from the second part 502 of the terminal IP address, the second part 504 of the IP address of the application server and the first address generation sequence 505 to perform the first XOR operation, and then combine the remaining items with the first XOR operation The result is subjected to a second XOR operation. The result of the second XOR operation is encrypted using the key 506 to obtain the second part 508 of the first virtual IP address. The first part 503 of the IP address of the application server is the same as the first part 507 of the first virtual IP address, and the first part 507 of the first virtual IP address and the second part 508 of the first virtual IP address form the first virtual IP address.

The process of generating the IP address of the application server according to the key, the IP address of the terminal, the first virtual IP address and the first address generation sequence in this application will be described below in conjunction with FIG. 5B . Referring to FIG. 5B, in an example, the IP address of the terminal includes a first part 501 of the terminal IP address and a second part 502 of the terminal IP address, and the lengths of the first part 501 of the terminal IP address and the second part 502 of the terminal IP address are the same. is 64 bits. The IP address of the application server includes the first part 503 of the IP address of the application server and the second part 504 of the IP address of the application server, and the lengths of the first part 503 of the IP address of the application server and the second part 504 of the IP address of the application server are equal. is 64 bits.

The second portion 508 of the first virtual IP address is decrypted using the key 506 . Select two items from the decryption result, the first address generation sequence 505 and the second part 502 of the terminal IP address to perform the first XOR operation, and perform the second XOR operation on the result of the first XOR operation and the remaining items, to obtain the second part 504 of the IP address of the application server. The first part 503 of the IP address of the application server is the same as the first part 507 of the first virtual IP address, and the first part 503 of the IP address of the application server and the second part 504 of the IP address of the application server form the IP address of the application server.

It should be understood that for the three binary values of A, B and C, A⊕B⊕C=B⊕C⊕A=A⊕C⊕B. ⊕ is an XOR operator.

It should be noted that the first part and the second part can be intercepted from the IP address according to the actual situation, for example, the first part and the second part can be exchanged, that is, the first part participates in encryption and XOR operation. The length of the first part and the length of the second part are not limited to 64 bits, which can be set according to actual conditions, and are not limited in this application.

After step 414, the application server may send a downlink data packet to the terminal in response to the modified uplink data packet. The network device can modify the destination address carried in the downlink data from the IP address of the application server to the first virtual IP address, so that the real IP address of the application server can be hidden.

Referring to Figure 6, in an optional embodiment, the above method also includes:

Step 601, the network device receives the downlink data packet sent by the application server. The downlink data packet carries the IP address of the application server, the IP address of the terminal, the first address generation sequence and the high-defense address identification. When the network device detects that the downlink data packet carries the high-defense address identifier, step 602 is executed.

Step 602, the network device generates a first virtual IP address according to the key, the IP address of the terminal, the IP address of the application server and the first address generation sequence.

Step 603, the network device determines the address end time of the first virtual IP address according to the first address generation sequence.

Step 604: When the end time of the address is greater than the verification time, determine that the target time difference is equal to the end time of the address minus the verification time.

When the end time of the address is greater than the verification time, it indicates that the first virtual IP address has not expired. When the end time of the address is less than the verification time, it indicates that the first virtual IP address has expired, and step 608 may be performed or the downlink data packet may be discarded.

Step 605, the network device judges whether the target time difference is greater than the preset duration, if yes, execute step 606, if not, execute step 608.

The preset duration is related to the data transmission duration T between the terminal and the application server, and can be set according to actual conditions.

In one example, the preset duration is equal to 2T. When the time difference between the verification time and the end time of the address is greater than 2T, it indicates that the virtual IP address used for the next data transmission will not expire, so there is no need to replace the virtual IP address. When the time difference between the verification time and the end time of the address is less than or equal to 2T, it indicates that the use of the virtual IP address for the next data transmission will expire, and the virtual IP address needs to be replaced. In this way, the virtual IP address can be replaced in advance to prevent the virtual IP address of the data packet from expiring.

Step 606, the network device generates a first downlink data packet according to the downlink data packet and the first virtual IP address.

Specifically, the network device modifies the source IP address of the downlink data packet from the IP address of the application server to the first virtual IP address to obtain the first downlink data packet. The source IP address of the downlink data packet is the IP address of the application server, and the source IP address of the first downlink data packet is the first virtual IP address.

Step 607, the network device sends the first downlink data packet to the terminal.

Step 608, the network device obtains the second address generation sequence.

Step 609, the network device generates a second virtual IP address according to the key, the IP address of the application server, the IP address of the terminal, and the second address generation sequence.

Step 610, the network device generates a second downlink data packet according to the downlink data packet, the first virtual IP address, the second virtual IP address and the address switching identifier.

Specifically, the network device modifies the source IP address of the downlink data packet from the IP address of the application server to the first virtual IP address, and then add the second virtual IP address in the downlink data packet, the second address generation sequence and the address switching identifier, and then the second downlink data packet is obtained. The source IP address of the downlink data packet is the IP address of the application server, the source IP address of the second downlink data packet is the first virtual IP address, and the second downlink data packet also carries virtual address association information of the second virtual IP address, for example A second address generation sequence and an address switch flag. The second address generation sequence includes address generation time and address lifetime of the second virtual IP address. The address switch flag is used to change the destination IP address of the uplink data packet.

Step 611, the network device sends the second downlink data packet to the terminal.

After receiving the second downlink data packet, the terminal may not generate an uplink data packet carrying the first virtual IP address and the first address generation sequence according to the address switching identifier, but may generate the second virtual IP address, the second address generation sequence and the high Anti-address identification of the uplink data packet, and then perform step 612.

Step 612, the terminal sends an uplink data packet to the network device.

After the network device receives the uplink data packet and detects the high-defense address identifier, step 613 is executed.

Step 613, the network device generates the IP address of the application server according to the key, the IP address of the terminal, the second virtual IP address and the second address generation sequence.

Step 614, the network device modifies the destination address of the uplink data packet from the second virtual IP address to the IP address of the application server.

Step 615, the network device sends the modified uplink data packet to the application server.

The first virtual IP address and the second virtual IP address represent two periods of virtual IP addresses. When the second virtual IP address is about to expire, it can be replaced with another virtual IP address, and the replacement process can refer to the corresponding content recorded above.

In this embodiment, when the application server sends a downlink data packet to the network device, the network device may modify the source IP address of the downlink data packet from the IP address of the application server to the first virtual IP address, thereby hiding the real IP address of the application server.

Secondly, since the first virtual IP address is related to the key, the IP address of the terminal, the IP address of the application server and the address generation sequence, one application server can correspond to multiple virtual IP addresses, which can reduce the cost of the existing communication method. The risk of being attacked by a large number of broiler devices after the virtual IP address is shared or resold.

Thirdly, the network device can change the virtual IP address according to the lifetime of the virtual IP address, which can improve the security of the virtual IP address. This method for replacing the virtual IP address does not require additional management equipment for setting the virtual IP address to manage and maintain the virtual IP address, so it has the advantage of being simple and convenient.

In addition, the application can replace the virtual IP address in advance to prevent the virtual IP address from expiring during data transmission. This ensures continuity of data flow.

Referring to FIG. 7, in another optional embodiment, the communication method above further includes:

Step 701, the network device receives the downlink data packet sent by the application server. The downlink data packet carries the IP address of the application server, the IP address of the terminal, the first address generation sequence and the high-defense address identification. When the network device detects that the downlink data packet carries the high-defense address identifier, step 702 is executed.

Step 702, the network device generates a first virtual IP address according to the key, the IP address of the application server, the IP address of the terminal and the first address generation sequence.

Step 703, the network device determines the address end time of the first virtual IP address according to the first address generation sequence.

Step 704: When the address end time is greater than the verification time, determine that the target time difference is equal to the address end time minus the verification time.

When the end time of the address is greater than the verification time, it indicates that the first virtual IP address has not expired. When the end time of the address is less than the verification time, it indicates that the first virtual IP address has expired, and step 708 may be performed or the downlink data packet may be discarded.

Step 705, the network device judges whether the target time difference is greater than the preset duration, if yes, execute step 706, if not, execute step 708.

In one example, the preset duration is equal to 2T. When the time difference between the verification time and the end time of the address is greater than 2T, it indicates that the virtual IP address used for the next data transmission will not expire, so there is no need to replace the virtual IP address. When the time difference between the verification time and the end time of the address is less than or equal to 2T, it indicates that the use of the virtual IP address for the next data transmission will expire, and the virtual IP address needs to be replaced.

Step 706, the network device generates a first downlink data packet according to the downlink data packet and the first virtual IP address.

Step 707, the network device sends the first downlink data packet to the terminal.

Step 708, the network device obtains the second address generation sequence.

Step 709, the network device generates a second virtual IP address according to the key, the IP address of the application server, the IP address of the terminal and the second address generation sequence.

Step 710, the network device generates an address switching notification carrying the second virtual IP address and the second address generation sequence.

Step 711, the network device sends an address switching notification to the terminal.

The address switching notification belongs to the control plane message. After the terminal receives the address switching notification, it can not generate an uplink data packet carrying the first virtual IP address and the first address generation sequence according to the address switching notification, but generate the second virtual IP address, the second address generation sequence and the high-defense address The identified uplink data packet, and then execute step 714. In this way, the virtual IP address can be replaced in advance to prevent the virtual IP address of the data packet from expiring.

Step 712, the network device generates a first downlink data packet according to the downlink data packet and the first virtual IP address.

Specifically, the network device modifies the source IP address of the downlink data packet from the IP address of the application server to the first virtual IP address to obtain the first downlink data packet.

Step 713, the network device sends the first downlink data packet to the terminal.

It should be noted that steps 712 to 713 are the process of sending the first downlink data packet, and steps 708 to 711 are the process of sending the address switching notification. The two processes are independent and there is no fixed sequence.

Step 714, the terminal sends an uplink data packet to the network device.

After the network device receives the uplink data packet and detects the high-defense address identifier, step 715 is executed.

Step 715, the network device generates the IP address of the application server according to the key, the IP address of the terminal, the second virtual IP address and the second address generation sequence.

Step 716, the network device modifies the destination address of the uplink data packet from the second virtual IP address to the IP address of the application server.

Step 717, the network device sends the modified uplink data packet to the application server.

Secondly, since the virtual IP address is related to the key, the IP address of the terminal, the IP address of the application server, and the address generation sequence, one application server can correspond to multiple virtual IP addresses, which can reduce the number of virtual IP addresses in existing communication methods. After the IP address is shared or resold, the risk of being attacked by a large number of bot devices.

In addition, the present application provides a method of notifying the terminal to switch the virtual IP address through a control plane message, which can prevent the virtual IP address from expiring during the communication process, making the implementation of the solution more flexible.

The first downlink data packet and the second downlink data packet of the present application are introduced below. Referring to Fig. 8, in an example, the first downlink data packet comprises message header 81 and payload 82, and message header 81 comprises the first virtual IP address 811, the IP address 812 of terminal and the virtual address of the first virtual address Related information 813. The virtual address association information 813 of the first virtual address includes a high-defense address identifier, an address generation sequence length, an address generation sequence, an address switching field, and an additional field.

Referring to Fig. 9, in one example, the second downlink data packet includes a header 91 and a payload 92, the header 91 includes a first virtual IP address 911, the IP address 912 of the terminal and the virtual address association of the second virtual address Message 913. The virtual address association information 913 of the second virtual address includes a high-defense address identifier, an address generation sequence length, an address generation sequence, an address switching identifier, and a second virtual IP address.

In an example of the present application, the type field indicates an address type. The value of the type field is 1, which means the high-defense address identification. The value of the type field is 0 for non-anti-advanced address identification.

The value of the RDLENGTH field indicates the length of the address generation sequence, and the length is 2 bytes.

The value of the RDATA field represents the address generation sequence, and the length is 128 bytes.

The FLAG field represents an address switching field, and the length is 1 byte. A value of 1 in the FLAG field indicates an address switching flag. A value of 0 in the FLAG field indicates that the address is not switched.

The Additional Record field represents an additional field with a length of 128 bytes. When the value of the FLAG field is 0, the value of the Additional Record field can be NULL, indicating that there is no additional information. When the value of the FLAG field is 1, it means that the value of the Additional Record field is the second virtual IP address.

It should be understood that the content included in the virtual address association information and the length of each field are not limited to the above examples.

The present application also provides a device capable of implementing the above communication method. The network device of the present application can implement the steps performed by the network device in the foregoing embodiments. Referring to FIG. 10, in one embodiment, the network device 1000 of the present application includes:

a receiving unit 1001, configured to receive an uplink data packet sent by a terminal;

The processing unit 1002 is configured to obtain the terminal's Internet Protocol IP address and the first virtual IP address of the application server from the uplink data packet when it is detected that the uplink data packet carries the high-defense address identifier; obtain a key; according to the key, the terminal's The IP address and the first virtual IP address generate the IP address to be processed; when the IP address to be processed is not the IP address of the application server, it is determined that the upstream data packet is illegal; when the IP address to be processed is the IP address of the application server, the upstream data packet is determined to be illegal; The destination IP address of the first virtual IP address is changed to the IP address of the application server;

The sending unit 1003 is configured to send the modified uplink data packet to the application server.

In an optional embodiment, the uplink data packet further includes a first address generation sequence, and the first address generation sequence includes the address generation time of the first virtual IP address and the address lifetime of the first virtual address;

The processing unit 1002 is specifically configured to generate the IP address to be processed according to the key, the IP address of the terminal, the first virtual IP address and the first address generation sequence.

In another alternative embodiment,

The receiving unit 1001 is also used to receive the downlink data packet sent by the application server, the downlink data packet carries the IP address of the application server, the IP address of the terminal, the first address generation sequence and the high defense address identification;

The processing unit 1002 is further configured to generate a first virtual IP address according to the IP address of the application server, the IP address of the terminal, and the first address generation sequence when it is detected that the downlink data packet carries the high-defense address identifier; according to the address generation time and address The survival time determines the end time of the address; when the end time of the address is greater than the verification time, determine the target time difference equal to the end time of the address minus the verification time; when the target time difference is greater than the preset duration, generate the first downlink data packet;

The sending unit 1003 is further configured to send the first downlink data packet to the terminal.

In another optional embodiment, the processing unit 1002 is further configured to obtain a second address generation sequence when the target time difference is less than or equal to a preset duration, and the second address generation sequence includes the address generation time of the second virtual IP address and the second address generation time. The address survival time of the second virtual IP address; according to the key, the IP address of the application server, the IP address of the terminal and the second address generation sequence to generate the second virtual IP address; according to the downlink data packet, the first virtual IP address, the second virtual IP address The IP address and the address switching identifier generate a second downlink data packet, the second downlink data packet carries the first virtual IP address, the second virtual IP address and the address switching identifier, and the address switching identifier is used to change the destination IP address of the uplink data packet;

The sending unit 1003 is further configured to send the second downlink data packet to the terminal.

In another alternative embodiment,

The processing unit 1002 is further configured to obtain a second address generation sequence, the second address generation sequence includes the address generation time of the second virtual IP address and the address lifetime of the second virtual IP address; according to the key, the IP address of the application server, the terminal The IP address and the second address generation sequence generate the second virtual IP address;

The sending unit 1003 is further configured to send to the terminal an address switch notification carrying a second virtual IP address and a second address generation sequence, where the address switch notification is used to change the destination IP address and address generation sequence of the uplink data packet;

The processing unit 1002 is further configured to generate a first downlink data packet according to the downlink data packet and the first virtual IP address when the target time difference is less than or equal to a preset duration;

In another optional embodiment, the processing unit 1002 is specifically configured to convert the second virtual IP address of the first virtual IP address to Decrypt part of the IP address; perform the first XOR operation on the second part of the terminal's IP address and the decryption result; perform the second XOR operation on the first address generation sequence and the first XOR operation result; The first part of the IP address and the result of the second XOR operation form the IP address to be processed.

In another alternative embodiment,

The receiving unit 1001 is also configured to receive the IP address of the application server and the key corresponding to the IP address of the application server sent by the key management server.

The terminal of the present application can implement the steps performed by the terminal in the foregoing embodiments. Referring to FIG. 11 , in an embodiment, a terminal 1100 includes a receiving unit 1101 , a processing unit 1102 and a sending unit 1103 .

The sending unit 1103 is configured to send an address request message to a domain name system server, where the address request message includes a domain name;

The receiving unit 1101 is configured to receive a response message sent by the domain name system server according to the address request message, the response message includes the first virtual Internet Protocol IP address of the application server and the high-defense address identifier;

The processing unit 1102 generates an uplink data packet, and the uplink data packet carries the IP address of the terminal, the first virtual IP address and the high-defense address identifier;

The sending unit 1103 is also configured to send the uplink data packet to the network device.

In an optional embodiment, the response message further includes a first address generation sequence, and the uplink data packet further includes a first address generation sequence, and the first address generation sequence includes the address generation time of the first virtual IP address and the first virtual address The lifetime of the address.

In another alternative embodiment,

The receiving unit 1101 is also configured to receive a first downlink data packet sent by a network device, where the first downlink data packet carries a first virtual IP address.

In another alternative embodiment,

The receiving unit 1101 is further configured to receive a second downlink data packet sent by the network device, where the second downlink data packet carries a first virtual IP address, a second virtual IP address, a second address generation sequence and an address switching identifier;

The processing unit 1102 is further configured to generate an uplink data packet carrying a second virtual IP address, a second address generation sequence and a high-defense address identifier according to the address switching identifier.

In another alternative embodiment,

The receiving unit 1101 is also used to receive the first downlink data packet and the address switching notification sent by the network device, the first downlink data packet carries the first virtual IP address, and the address switching notification includes the second virtual IP address and the second address generation sequence ;

The processing unit 1102 is further configured to generate an uplink data packet carrying the second virtual IP address, the second address generation sequence and the high-defense address identifier according to the address switching notification.

The domain name system server of the present application can implement the steps performed by the domain name system server in the above embodiments. Referring to Figure 12, in one embodiment, domain name system server 1200 includes:

The receiving unit 1201 is configured to receive an address request message sent by the terminal, where the address request message includes a domain name;

A processing unit 1202, configured to obtain the key and the address identifier of Anti-Advanced when the domain name is an Anti-Advanced domain name;

The processing unit 1202 is further configured to generate a first virtual IP address according to the key, the IP address of the terminal, and the IP address of the application server;

The sending unit 1203 is configured to send a response message to the terminal, the response message includes the first virtual IP address and the high-defense location Address ID.

In an alternative embodiment,

The processing unit 1202 is specifically configured to obtain a first address generation sequence, the first address generation sequence includes the address generation time of the first virtual IP address and the address lifetime of the first virtual address; according to the key, the terminal's IP address and the application server The IP address and the first address generation sequence generate the first virtual IP address.

In another alternative embodiment,

The processing unit 1202 is specifically configured to perform a first XOR operation on the second part of the IP address of the terminal and the second part of the IP address of the application server; perform a second XOR operation on the result of the first address generation sequence and the first XOR operation A second XOR operation; using a key to encrypt the result of the second XOR operation; combining the encrypted result and the first part of the IP address of the application server to form a first virtual IP address.

The following introduces the network equipment, terminal and domain name resolution server of the present application from the perspective of hardware. Referring to FIG. 13 , in one embodiment, a network device 1300 of the present application includes a processor 1301 , a memory 1302 and a communication interface 1303 . The number of the processor 1301, the memory 1302 and the communication interface 1303 may be one or more. The processor 1301 and the memory 1302 are connected through a bus 1304 , and the processor 1301 and the communication interface 1303 are connected through a bus 1305 .

In the embodiment of the present application, the processor 1301 may be a central processing unit (central processing unit, CPU), or other specific integrated circuit (application specific integrated circuit, ASIC). The processor 1301 can also be other general processors, digital signal processing (digital signal processing, DSP), application specific integrated circuit (application specific integrated circuit, ASIC), field programmable gate array (field programmable gate array, FPGA) or Other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

The memory 1302 is the main memory of the network device 1300 . Usually, a dynamic random access memory (Dynamic Random Access Memory, DRAM) is used as the memory 1302 . The processor 1301 can access the memory 1302 at high speed through the memory controller, and perform read and write operations on any storage unit in the memory 1302 . In addition to DRAM, the memory 1302 may also be other random access memories, such as Static Random Access Memory (Static Random Access Memory, SRAM). In addition, the memory 1302 may also be a read-only memory (Read Only Memory, ROM). As for the read-only memory, for example, it may be a programmable read-only memory (Programmable Read Only Memory, PROM), an erasable programmable read-only memory (Erasable Programmable Read Only Memory, EPROM), and the like. This embodiment does not limit the quantity and type of the memory 1302 . In addition, the memory 1302 can be configured to have a power saving function. The power protection function means that when the system is powered off and then powered on again, the data stored in the memory will not be lost. The memory 1302 with a power saving function is called a nonvolatile memory.

The communication interface 1303 is used to communicate with other devices. The communication interface 1303 can receive uplink data or send downlink data. The bus 1304 may be but not limited to a double data rate (DDR) bus, and the bus 1305 may be but not limited to a PCIe bus.

In this embodiment, the memory 1302 is used to store programs, and the processor 1301 can execute the steps performed by the network device in the foregoing embodiments by calling the programs stored in the memory 1302 .

Referring to FIG. 14 , in another embodiment, a terminal 1400 of the present application includes a processor 1401 and a memory 1404 . The processor 1401 is connected to the memory 1404 through the DDR bus 1403 . Here, different memory 1404 may use different data bus It communicates with the processor 1401, so the DDR bus 1403 can also be replaced with other types of data buses, and the embodiment of the present application does not limit the type of the bus. In addition, the terminal 1400 also includes various input and output devices, and the processor 1401 can access these input and output devices 1407 through the PCIe bus 1405 .

The processor (Processor) 1401 is the computing core and control core of the computing device 1400 . Processor 1401 may include one or more processing cores (core) 1402 . Processor 1401 may be a VLSI. An operating system and other software programs are installed in the processor 1401, so that the processor 1401 can realize access to the memory 1404 and various PCIe devices. In this embodiment of the present application, the processing core 1402 in the processor 1401 may be, for example, a CPU or an ASIC. The processor 1401 may also be other general-purpose processors, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. In practical applications, the terminal 1400 may also include multiple processors.

The memory controller (Memory Controller) is a bus circuit controller that controls the memory 1404 inside the terminal 1400 and is used to manage and plan data transmission from the memory 1404 to the processing core 1402. Through the memory controller, data can be exchanged between the memory 1404 and the processing core 1402 . The memory controller can be an independent chip, and is connected with the processing core 1402 through the system bus. Those skilled in the art can know that the memory controller can also be integrated into the processor 1401, can also be built into the north bridge, or can be an independent memory controller chip, the embodiment of the present application does not specify the specific location of the memory controller and form of existence. In practical applications, the memory controller can control necessary logic to write data into the memory 1404 or read data from the memory 1404 . The memory controller 1404 may be a memory controller in processor systems such as general processors, special accelerators, GPUs, FPGAs, and embedded processors.

The memory 1404 is the main memory of the terminal 1400 . The memory 1404 is usually used to store various running software in the operating system, input and output data, and information exchanged with external storage. In order to improve the access speed of the processor 1401, the memory 1404 needs to have the advantage of fast access speed. In traditional computer system architecture, DRAM is usually used as the memory 1404 . The processor 1401 can access the memory 1404 at high speed through the memory controller, and perform read and write operations on any storage unit in the memory 1404 . In addition to DRAM, the memory 1404 may also be other random access memories, such as SRAM. In addition, the memory 1404 may also be a ROM. As for the read-only memory, for example, it can be PROM, EPROM and so on. This embodiment does not limit the quantity and type of the memory 1404 . In addition, the memory 1404 can be configured to have a power saving function. The power protection function means that when the system is powered off and then powered on again, the data stored in the memory will not be lost. The memory 1404 with a power saving function is called a nonvolatile memory.

An input/output (input/ourput, I/O) device 1407 refers to hardware capable of data transmission, and may also be understood as a device connected to an I/O interface. Common I/O devices include network cards, printers, keyboards, and mice. All external storage can also be used as I/O devices, such as hard disks, floppy disks, and CDs. The processor 1401 can access various input and output 1407 through the PCIe bus 1405 . It should be noted that the PCIe bus 1405 is just an example, and may be replaced by other buses, such as a unified (unified bus, UB) bus.

A baseboard management controller (Baseboard Management Controller, BMC) 1406 can upgrade the firmware of the device, manage the running status of the device, and troubleshoot. The processor 1401 can access the baseboard management controller 1406 through a PCIe bus or a bus such as USB or I2C. The base management controller 1406 can also be connected to at least one sensor. The status data of the terminal is obtained through the sensor, where the status data includes: temperature data, current data, voltage data and so on. In this application, there is no specific limitation on the type of status data. Baseboard Management Controller 1406 via PCIe The bus or other types of buses communicate with the processor 1401, for example, transfer the obtained state data to the processor 1401 for processing. The baseboard management controller 1406 can also maintain the program codes in the memory 1404, including upgrading or restoring. The baseboard management controller 1406 may also control a power supply circuit or a clock circuit in the terminal 1400 . In a word, the baseboard management controller 1406 can manage the terminal 1400 through the above manner. However, the baseboard management controller 1406 is only an optional device. In some implementation manners, the processor 1401 may directly communicate with the sensor, so as to directly manage and maintain the terminal.

In this embodiment, the memory 1404 is used to store programs. By calling the program stored in the memory 1404, the processor 1401 is configured to execute the steps executed by the terminal in the foregoing embodiments.

The present application provides a domain name system server 1500 capable of performing the steps performed by the domain name system server in the foregoing embodiments. FIG. 15 is a schematic structural diagram of a domain name system server provided by an embodiment of the present application. Referring to FIG. 15 , the domain name system server 1500 may have relatively large differences due to different configurations or performances, and may include one or more central processing units 1522 and memory 1532, and one or more storage media for storing application programs 1542 or data 1544 1530 (eg, one or more mass storage devices). Wherein, the memory 1532 and the storage medium 1530 may be temporary storage or persistent storage. The program stored in the storage medium 1530 may include one or more modules, and each module may include a series of instructions to operate on the domain name system server. Furthermore, the central processing unit 1522 can be configured to communicate with the storage medium 1530 , and execute a series of instruction operations in the storage medium 1530 on the domain name system server 1500 .

The domain name system server 1500 can also include one or more power supplies 1526, one or more wired or wireless network interfaces 1550, one or more input and output interfaces 1558, and/or, one or more operating systems 1541, such as Windows Server™, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

It should be noted that the information interaction and execution process between the modules/units of the above-mentioned device are based on the same concept as the method embodiment of the present application, and the technical effect it brings is the same as that of the method embodiment of the present application. The specific content can be Refer to the descriptions in the foregoing method embodiments of the present application, and details are not repeated here.

The present application provides a computer-readable storage medium. A computer program is stored in the computer-readable storage medium. When the computer program is run on a computer, it causes the computer to execute the communication method in the foregoing embodiment or optional embodiment.

The present application also provides a computer program product, which, when run on a computer, causes the computer to execute the communication method in the above-mentioned embodiments or optional embodiments.

The present application also provides a chip system, which includes a processor and a memory coupled to each other. The memory is used to store computer programs or instructions, and the processing unit is used to execute the computer programs or instructions stored in the memory, so that the device performs the steps performed by the network device, terminal or domain name system server in the above embodiments. Optionally, the memory is an on-chip memory, such as a register, a cache, etc., and the memory can also be a memory located outside the chip in a site, such as a read-only memory (read-only memory, ROM) or a memory that can store static information and instructions. Other types of static storage devices, random access memory (random access memory, RAM), etc. The processor mentioned in any of the above places may be a general-purpose central processing unit, a microprocessor, an application specific integrated circuit (ASIC) or one or more integrated circuits for implementing the above-mentioned communication method.

In addition, it should be noted that the device embodiments described above are only schematic, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units. That is, it can be located in one place, or it can also be distributed to multiple network elements. according to actual needs Part or all of the modules are selected to achieve the purpose of the solution of this embodiment. In addition, in the drawings of the device embodiments provided in the present application, the connection relationship between the modules indicates that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software plus necessary general-purpose hardware, and of course it can also be realized by special hardware including application-specific integrated circuits, dedicated CPUs, dedicated memories, Special components, etc. to achieve. In general, all functions completed by computer programs can be easily realized by corresponding hardware, and the specific hardware structure used to realize the same function can also be varied, such as analog circuits, digital circuits or special-purpose circuit etc. However, for this application, software program implementation is a better implementation mode in most cases. Based on this understanding, the essence of the technical solution of this application or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, such as a floppy disk of a computer , U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the method of each embodiment of the present application.

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product.

A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part. A computer can be a general purpose computer, special purpose computer, computer network, or other programmable device. Computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, e.g. Coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL) or wireless (such as infrared, wireless, microwave, etc.) transmission to another website site, computer, server or data center. Computer readable storage medium can be Any available media that can be stored by a computer or a data storage device such as a server, data center, etc. that includes one or more available media. Available media can be magnetic media, (such as floppy disks, hard disks, tapes), optical media (such as DVDs), Or a semiconductor medium (such as a solid state disk (solid state disk, SSD)), etc.

Claims

A communication method, characterized in that, comprising:

receiving the uplink data packet sent by the terminal;

When it is detected that the uplink data packet carries a high-defense address identifier, obtain the Internet Protocol IP address of the terminal and the first virtual IP address of the application server from the uplink data packet;

get the key;

According to the key, the IP address of the terminal carried in the uplink data packet and the first virtual IP address generate an IP address to be processed;

When the IP address to be processed is not the IP address of the application server, it is determined that the uplink data packet is illegal;

When the IP address to be processed is the IP address of the application server, modify the destination IP address of the uplink data packet from the first virtual IP address to the IP address of the application server, and report to the application server Send the modified uplink data packet.
The method according to claim 1, wherein the uplink data packet further includes a first address generation sequence, and the first address generation sequence includes the address generation time of the first virtual IP address and the first The address lifetime of the virtual address;

The generating the IP address to be processed according to the key, the IP address of the terminal and the first virtual IP address includes:

Generate an IP address to be processed according to the key, the IP address of the terminal, the first virtual IP address and the first address generation sequence.
The method according to claim 2, further comprising:

Receiving a downlink data packet sent by the application server, the downlink data packet carrying the IP address of the application server, the IP address of the terminal, the first address generation sequence and the high defense address identification;

When it is detected that the downlink data packet carries a high-defense address identifier, the first virtual IP is generated according to the key, the IP address of the application server, the IP address of the terminal and the first address generation sequence address;

determining the address end time of the first virtual IP address according to the first address generation sequence;

When the address end time is greater than the verification time, determine that the target time difference is equal to the address end time minus the verification time;

When the target time difference is greater than the preset duration, generate a first downlink data packet according to the downlink data packet and the first virtual IP address, and send the first downlink data packet to the terminal.
The method according to claim 3, characterized in that the method further comprises:

When the target time difference is less than or equal to the preset duration, a second address generation sequence is acquired, the second address generation sequence including the address generation time of the second virtual IP address and the address lifetime of the second virtual IP address; According to the key, the IP address of the application server, the IP address of the terminal and the second address generation sequence generate a second virtual IP address; according to the downlink data packet, the first virtual IP address, the The second virtual IP address, the second address generation sequence and the address switching identifier generate a second downlink data packet, and send the second downlink data packet to the terminal.
The method according to claim 3, characterized in that the method further comprises:

When the target time difference is less than or equal to the preset duration, a second address generation sequence is acquired, the second address generation sequence including the address generation time of the second virtual IP address and the address lifetime of the second virtual IP address; Generate a second virtual IP address according to the key, the IP address of the application server, the IP address of the terminal, and the second address generation sequence; send a message carrying the second virtual IP address and the second address generation sequence to the terminal address switching notification;

generating a first downlink data packet according to the downlink data packet and the first virtual IP address, and sending the first downlink data packet to the terminal.
The method according to any one of claims 2 to 5, wherein the IP address to be processed is generated according to the key, the IP address of the terminal, the first virtual IP address and the first address generation sequence include:

decrypting the second part of the first virtual IP address using a key;

performing a first XOR operation on the second part of the terminal's IP address and the decryption result;

performing a second exclusive OR operation on the first address generation sequence and the result of the first exclusive OR operation;

Combining the first part of the first virtual IP address and the result of the second XOR operation to form the IP address to be processed.
The method according to any one of claims 1 to 5, wherein, before the obtaining the key, the method further comprises:

The IP address of the application server and the key corresponding to the IP address of the application server are received from the key management server.
A communication method, characterized in that, comprising:

sending an address request message to a domain name system server, where the address request message includes a domain name;

Receiving a response message sent by the domain name system server according to the address request message, the response message including the first virtual Internet Protocol IP address of the application server and the high-defense address identifier;

Generate an uplink data packet, the uplink data packet carries the IP address of the terminal, the first virtual IP address of the application server and the high-defense address identification;

Send uplink data packets to network devices.
The method according to claim 8, wherein the response message further includes a first address generation sequence, and the uplink data packet further includes a first address generation sequence, and the first address generation sequence includes a first virtual The address generation time of the IP address and the address lifetime of the first virtual address.
The method according to claim 8 or 9, wherein the method further comprises:

receiving a first downlink data packet sent by the network device, where the first downlink data packet carries a first virtual IP address.
The method according to claim 9, characterized in that the method further comprises:

receiving a second downlink data packet sent by the network device, the second downlink data packet carrying a first virtual IP address, the second virtual IP address, a second address generation sequence and an address switching identifier, and the second address The generation sequence includes address generation time and address survival time of the second virtual IP address;

Generate an uplink data packet carrying the second virtual IP address, the second address generation sequence and the high-defense address identifier according to the address switching identifier.
The method according to claim 9, characterized in that the method further comprises:

receiving a first downlink data packet and an address switching notification sent by the network device, the first downlink data packet carrying a first virtual IP address, and the address switching notification includes a second virtual IP address and a second address generation sequence ;

Generate an uplink data packet carrying a second virtual IP address, a second address generation sequence, and a high-defense address identifier according to the address switching notification.
A communication method, characterized in that, comprising:

receiving an address request message sent by a terminal, where the address request message includes a domain name;

When the domain name is a high-defense domain name, obtain the key and high-defense address identification;

Generate a first virtual Internet Protocol IP address according to the key, the IP address of the terminal and the IP address of the application server;

Sending a response message to the terminal, where the response message includes the first virtual IP address and the Anti-DDoS Pro address identifier.
The method according to claim 13, wherein generating the first virtual IP address according to the key, the IP address of the terminal and the IP address of the application server comprises:

Obtaining a first address generation sequence, the first address generation sequence including the address generation time of the first virtual IP address and the address lifetime of the first virtual address;

A first virtual IP address is generated according to the key, the IP address of the terminal, the IP address of the application server, and the first address generation sequence.
The method according to claim 14, wherein the generating the first virtual IP address according to the key, the IP address of the terminal, the IP address of the application server, and the first address generation sequence comprises :

performing a first XOR operation on the second part of the IP address of the terminal and the second part of the IP address of the application server;

performing a second XOR operation on the result of the first address generation sequence and the first XOR operation;

Encrypt the result of the second XOR operation by using the key;

Combining the encryption result with the first part of the IP address of the application server to form a first virtual IP address.
A network device, characterized in that it includes:

a receiving unit, configured to receive an uplink data packet sent by the terminal;

A processing unit, configured to acquire the Internet Protocol IP address of the terminal and the first virtual IP address of the application server from the uplink data packet when it is detected that the uplink data packet carries a high-defense address identifier;

The processing unit is also used to obtain a key;

The processing unit is further configured to generate an IP address to be processed according to the key, the IP address of the terminal and the first virtual IP address;

The processing unit is further configured to determine that the uplink data packet is illegal when the IP address to be processed is not the IP address of the application server; when the IP address to be processed is the IP address of the application server, modifying the destination IP address of the uplink data packet from the first virtual IP address to the IP address of the application server;

A sending unit, configured to send the modified uplink data packet to the application server.
The network device according to claim 16, wherein the uplink data packet further includes a first address generation sequence, and the first address generation sequence includes the address generation time of the first virtual IP address and the second The address lifetime of a virtual address;

The processing unit is specifically configured to generate an IP address to be processed according to the key, the IP address of the terminal, the first virtual IP address and the first address generation sequence.
The network device according to claim 17, characterized in that,

The receiving unit is further configured to receive a downlink data packet sent by the application server, the downlink data packet carries the IP address of the application server, the IP address of the terminal, the first address generation sequence and the high defense address identification;

The processing unit is further configured to generate the second IP address according to the IP address of the application server, the IP address of the terminal, and the first address generation sequence when detecting that the downlink data packet carries a high-defense address identifier. a virtual IP address;

The processing unit is further configured to determine the address end time according to the address generation time and the address lifetime; when the address end time is greater than the verification time, determine that the target time difference is equal to the address end time minus the verification time;

The processing unit is further configured to generate a first downlink data packet according to the downlink data packet and the first virtual IP address when the target time difference is greater than a preset duration;

The sending unit is further configured to send the first downlink data packet to the terminal.
The network device according to claim 18, characterized in that,

The processing unit is further configured to obtain a second address generation sequence when the target time difference is less than or equal to a preset duration, and the second address generation sequence includes the address generation time of the second virtual IP address and the The address lifetime of the second virtual IP address; according to the key, the IP address of the application server, the IP address of the terminal and the second address generation sequence to generate a second virtual IP address; according to the downlink data Packet, the first virtual IP address, the second virtual IP address and the address switching identifier generate a second downlink data packet;

The sending unit is further configured to send a second downlink data packet to the terminal.
The network device according to claim 18, characterized in that,

The processing unit is further configured to obtain a second address generation sequence when the target time difference is less than or equal to a preset duration, and the second address generation sequence includes the address generation time of the second virtual IP address and the second The address lifetime of the virtual IP address; according to the key, the IP address of the application server, the IP address of the terminal and the second address generation sequence to generate a second virtual IP address;

The sending unit is further configured to send an address switching notification carrying a second virtual IP address and a second address generation sequence to the terminal;

The processing unit is further configured to generate a first downlink data packet according to the downlink data packet and the first virtual IP address;

The sending unit is further configured to send the first downlink data packet to the terminal.
The network device according to any one of claims 17 to 20, wherein the processing unit is specifically configured to use the key to decrypt the second part of the first virtual IP address; performing a first XOR operation on the second part of the terminal's IP address and the decryption result; performing a second XOR operation on the first address generation sequence and the first XOR operation result; and performing a second XOR operation on the first virtual IP The first part of the address and the result of the second XOR operation form the IP address to be processed.
The network device according to any one of claims 16 to 20, characterized in that,

The receiving unit is further configured to receive the IP address of the application server and the key corresponding to the IP address of the application server sent by the key management server.
A terminal, characterized in that, comprising:

a sending unit, configured to send an address request message to a domain name system server, where the address request message includes a domain name;

A receiving unit, configured to receive a response message sent by the domain name system server according to the address request message, the response message including the first virtual Internet Protocol IP address of the application server and the high-defense address identifier;

A processing unit, configured to generate an uplink data packet, the uplink data packet carrying the IP address of the terminal, the first virtual IP address of the application server and the high-defense address identifier;

The sending unit is further configured to send an uplink data packet to the network device.
The terminal according to claim 23, wherein the response message further includes a first address generation sequence, and the uplink data packet further includes a first address generation sequence, and the first address generation sequence includes the first address generation sequence The address generation time of a virtual IP address and the address lifetime of the first virtual address.
The terminal according to claim 23 or 24, characterized in that,

The receiving unit is further configured to receive a first downlink data packet sent by the network device, where the first downlink data packet carries a first virtual IP address.
The terminal according to claim 24, characterized in that,

The receiving unit is further configured to receive a second downlink data packet sent by the network device, the second downlink data packet carrying the first virtual IP address, the second virtual IP address, the second address generation sequence and the address Switch logo;

The processing unit is further configured to generate an uplink data packet carrying the second virtual IP address, a second address generation sequence, and a high-defense address identifier according to the address switching identifier.
The terminal according to claim 24, characterized in that,

The receiving unit is further configured to receive a first downlink data packet and an address switching notification sent by the network device, the first downlink data packet carries a first virtual IP address, and the address switching notification includes a second virtual IP address. IP address and second address generation sequence;

The processing unit is further configured to generate an uplink data packet carrying a second virtual IP address, a second address generation sequence and a high-defense address identifier according to the address switching notification.
A domain name system server, characterized in that it comprises:

a receiving unit, configured to receive an address request message sent by a terminal, where the address request message includes a domain name;

A processing unit, configured to obtain a key and an address identifier of Anti-Advanced when the domain name is an Anti-Advanced domain name;

The processing unit is further configured to generate a first virtual IP address according to the key, the IP address of the terminal and the Internet Protocol IP address of the application server;

A sending unit, configured to send a response message to the terminal, where the response message includes the first virtual IP address and the high-defense address identifier.
The domain name system server according to claim 28, wherein,

The processing unit is specifically configured to acquire a first address generation sequence, where the first address generation sequence includes address generation time of the first virtual IP address and address lifetime of the first virtual address; according to the key, the The IP address of the terminal, the IP address of the application server, and the first address generation sequence generate a first virtual IP address.
Domain name system server according to claim 29, is characterized in that,

The processing unit is specifically configured to perform a first XOR operation on the second part of the IP address of the terminal and the second part of the IP address of the application server; Perform a second XOR operation on the result of the XOR operation; use the key to encrypt the result of the second XOR operation; combine the encrypted result with the application The first part of the IP address of the server constitutes the first virtual IP address.
A computer-readable storage medium storing instructions, characterized in that, when it is run on a computer, it causes the computer to perform the method described in any one of claims 1 to 15.