CN102368740A - Network addressing method - Google Patents

Abstract

A new type of network addressing method, characterized in that the address of each network interface is composed of a mixture of responsibility domain labels in a flat structure and intra-domain labels in a hierarchical structure. The responsibility domain label is a hash value of the public key of the responsibility domain, which is the same as the responsibility domain The domain public keys are naturally one-to-one correspondence. In the domain of responsibility, use the identity-based signature algorithm to go offline on demand, and assign private keys to network devices, so that the corresponding public keys are their hybrid network addressing scheme addresses. According to the network addressing method of the present invention, it not only has an inherent and distributed trust model, but also does not cause an increase in deployment cost and a decrease in communication performance.

Description

A method of network addressing

technical field

The invention relates to a network addressing method, which can provide an internal and distributed trust model in the whole network, and belongs to the field of network security, especially to the field of IP routing and switching.

Background technique

AIP (Accountable Internet Protocol, an accountable network layer protocol) provides an inherent, distributed trust model by redesigning the network addressing scheme.

There are many deficiencies in the network addressing scheme of AIP: (1) The deployment cost is high, and AIP has a variable-length address structure, which requires ① to completely change the IP protocol, inter-domain routing protocol, and intra-domain routing protocol; ② redistribute host addresses, and modify The operating system of the end host; ③ upgrade all applications; ④ expand the DNS (Domain Name System, domain name resolution system) server function. (2) The communication performance is low. It can be seen from Fig. 1 that the packet header of AIP is much larger than the packet header of IPv4 or IPv6. Due to the limitation of the maximum path transmission unit, data of the same size needs to be divided into more packets for transmission in AIP, which will greatly increase or decrease the data transmission delay and reduce the end-to-end communication performance.

Contents of the invention

The purpose of the present invention is to provide a network addressing method, which not only has an inherent, distributed trust model, but also does not cause an increase in deployment cost and a decrease in communication performance.

For this reason, the present invention provides a kind of network addressing method, it is characterized in that, the address of each network interface is all made up of the responsibility domain label of plane structure and the domain label of hierarchical structure, and the responsibility domain label is the public key of responsibility domain The hash value has a natural one-to-one correspondence with the public key of the domain of responsibility. In the domain of responsibility, use the identity-based signature algorithm to go offline on demand, and assign private keys to network devices, so that the corresponding public key is their hybrid network addressing scheme address.

Preferably, an asymmetric cryptosystem is used to generate the public/private key pair of the domain of responsibility.

Preferably, the asymmetric cryptosystem is RSA, DSA, ECDSA.

Preferably, the hybrid network addressing scheme is compatible with the IPv6 network, and the length of the address of the hybrid network addressing scheme is 128 bits. At this time, the length of the responsibility domain label is 88 bits, the length of the reserved domain is 8 bits, and the length of the intra-domain label is 32 bits. bit.

Preferably, the improved inter-domain routing mechanism includes replacing the AS number and the destination IP prefix in the BGP routing update message with the responsibility domain label; organizing the routing table and the forwarding table with the responsibility domain label as a handle.

Preferably, the improved intra-domain routing mechanism includes improving intra-domain routing protocols so that they can adapt to mixed network addressing scheme addresses.

Preferably, the intra-domain routing protocols include RIP and OSPF.

Preferably, the inter-domain router organizes the forwarding table with the responsibility domain label of the flat structure as a handle, and uses the hash table to precisely locate the routing information of the given destination address when forwarding the packet.

Preferably, a registration query center is set up, which is responsible for storing and distributing all responsibility domain public keys and intra-domain public parameters, and supports the updating of responsibility domain labels, public keys and intra-domain public parameters.

Preferably, the reserved domain is located between the "responsible domain label domain" and the "intra-domain label domain".

The beneficial effects of the present invention are specifically as follows:

(1) Inherent distributed trust model: First, the responsibility domain itself guarantees the credibility of its public key, and the responsibility domain guarantees the credibility of the public key of the devices in the domain by guaranteeing the public parameters in the domain. Therefore, each responsibility domain is a device in the domain There is no "root trust anchor" in the whole trust model, so the present invention provides a distributed trust model. Secondly, the distributed trust model provided by the present invention exists in the routing structure and does not need to deploy any mechanism outside the routing structure, so the trust model provided by the present invention is internal.

(2) Lower deployment cost: the length of the address of the present invention can be 128 bits, taking this special case as an example, 1. the present invention only changes the demarcation method of the network number and the host number in the end node address, and will not change The hardware, operating system and application programs of the end nodes; ② the present invention will not affect the intra-domain routers and intra-domain routing mechanisms, and the responsibility domain can still flexibly and autonomously adopt the existing intra-domain routing protocols. 3. the present invention changes the inter-domain routing mechanism, requiring upgrades of BGP routers and iBGP routers; 4. the present invention will not change the DNS system. It can be seen that the deployment cost of the present invention is far less than that of AIP.

(3) communication performance is high: the length of the address of the present invention can be 128 bits, take this special case as example, at this moment the packet header can adopt the header format of IPv6, the present invention can not reduce because of increasing the packet header length like AIP communication performance.

The present invention provides a novel network addressing method, which itself has an internal trust model, and because the trust model is distributed, it will not cause disputes over Internet management rights.

Description of drawings

FIG. 1 is a schematic diagram of the routing structure of the AIP.

Fig. 2 is a schematic diagram of a network addressing method according to the present invention.

Detailed ways

Researchers often use asymmetric cryptosystems to solve network security problems. Building a reasonable trust model is the premise of using asymmetric cryptosystem to solve network security problems. Here, the trust model refers to the technical means to ensure the "authenticity of the public key", where "authenticity of the public key" can be understood in the following way: Assume that the network entity A (labeled as Q _A ) claims to have the public key pk _A , If network entity B believes that pk _A is indeed A's public key, or that the private key pr _A corresponding to pk _A is only legitimately owned by A, then B believes that A's public key pk _A is trustworthy.

表示断语“标签Q_A对应的公钥是pk_A”，则信任模型应达到的技术效果可以概括为：

如果Q_x向外宣称

那么，其它网络实体通过信任模型可以辨别出是否可信。Assuming that the set of network entities involved in the security scheme is Q, let the one-to-one correspondence

Express the assertion "the public key corresponding to the label Q _A is pk _A ", then the technical effect that the trust model should achieve can be summarized as:

If Q _x declares

Then, other network entities can discern through the trust model Is it credible.

In existing network security schemes, researchers generally adopt a centralized trust model. specifically,

(1) Set up a trust anchor in the network, its private key is pr, and the corresponding public key is pk, all network entities should obtain and store pk, and all network entities believe that the trust anchor can arbitrate the trustworthiness of the public key sex.

则

表明信任锚认为

是可信的。(3)如果A向网络实体B宣称

A应当向B一并提交

B使用信任锚的公钥pk验证如果验证通过，那么B相信“CA认为

是可信的”，因为B相信信任锚可以仲裁公钥的可信性，所以，B相信

可信。可见上述步骤达到了信任模型要求的技术效果。(2) For any network entity A (labeled as Q _A ), if its public key is assumed to be pk _A , then A declares Before, you should first obtain the trust anchor pair The digital signature of the corresponding relationship. This digital signature can be recorded as

but

Indicates that the trust anchor believes

be believable. (3) If A claims to network entity B

A should also submit to B

B uses the public key pk of the trust anchor to verify If verification passes, then B believes that "CA believes

is trusted", because B believes that the trust anchor can arbitrate the credibility of the public key, so B believes

believable. It can be seen that the above steps have achieved the technical effect required by the trust model.

In summary, a centralized trust model requires a trust anchor, and requires that all network entities trust that trust anchor to arbitrate the trustworthiness of public keys. In the current political and social environment, how to set up the trust anchor has become a difficult problem. For example, it is difficult to determine whether it is set in the United States or China, whether it is managed by the United States or NATO, or whether it is managed by China or Russia. Researchers generally summarize this shortcoming as that the centralized trust model is easy to cause disputes over Internet management rights, and therefore, it is difficult to obtain practical applications.

Aiming at the above-mentioned shortcomings of the centralized trust model, the present invention designs a novel network addressing method HAS (Hybrid Addressing Scheme, hybrid addressing scheme). HAS itself has a built-in trust model, and because the trust model is distributed, it will not cause disputes over Internet management rights.

AIP (Accountable Internet Protocol) also provides an inherent, distributed trust model by redesigning the network addressing scheme. AIP takes Accountability Domain (AD) as the basic element of network topology. A domain of responsibility is a network with independent management entities in the Internet, and domains of responsibility can be nested. AIP regards the network corresponding to the IP prefix as the top-level responsibility domain, and only the top-level responsibility domain can participate in global routing. Based on the above routing structure, AIP designs a hierarchical address structure, and each level of the address is a self-certification label

First, each AD and network device has a unique self-authentication label, which mainly consists of the hash value of the corresponding public key. Because the hash algorithm has a good one-way property, there is a one-to-one correspondence between the self-certification label and the public key. It is worth noting that the AIP requires the use of the RSA algorithm to generate the public/private key pair of the domain of responsibility, and the AIP does not provide a specific hash algorithm.

Secondly, the address of each network interface has a hierarchical structure, consisting of the labels of all ADs between the top AD and the AD where the network interface resides, the network equipment label, and the interface number (the rightmost 8 bits of the network equipment label). It can be seen that the length of the AIP address is variable.

Based on the above network addressing method, AIP has designed a special packet forwarding method.

In Figure 1, AD ₁ and AD ₄ are the labels of the top-level AD, AD ₂ is nested in AD ₁ , AD ₃ is nested in AD ₂ , terminal A is nested in AD ₃ , and AD ₅ is also nested in AD ₄ , AD ₆ is nested in AD ₅ , and terminal B is nested in AD ₆ . Among AD ₁ to AD ₆ , only top-level domains AD ₁ and AD ₄ participate in global routing, and border routers in other domains only know the routes to their upper-level ADs and lower-level ADs. The labels of A and B are EID ₁ and EID ₂ respectively, and the global addresses are AD ₁ :AD ₂ :AD ₃ :EID ₁ and AD ₄ :AD ₅ :AD ₆ :EID ₂ respectively.

As shown in Figure 1, when A initiates communication to B, it needs to fill the source label EID ₁ , source top-level domain AD ₁ , destination label EID ₂ and destination top-level domain AD ₄ into the corresponding positions of the packet header, and the source The intermediate domains (AD ₂ and AD ₃ ) are attached to the source stack SS, and the destination intermediate domains (AD ₅ and AD ₆ ) are attached to the destination stack DS. After receiving the packet, the border router of AD ₃ finds that the "destination top-level domain" (the domain labeled 4 in Figure 1) is not AD ₁ , and submits the packet to the upper-level AD, and the border router of AD ₂ performs the same operation. Finally, the border router of AD ₁ forwards the packet to AD ₄ (because the border router of AD ₁ has a route to AD ₄ ). After the border router of AD ₄ receives the packet, it takes out the label AD ₅ of the lower-level domain from the DS, and replaces the "destination top-level domain" with AD ₅ , and then continues to forward the packet. AD ₅ 's border router does the same, and replaces "Destination TLD" with AD ₆ . The packet finally reaches the destination terminal B. This completes a packet exchange process.

As can be seen from the above, AIP has an inherent, distributed trust model:

之间的对应关系不需要其它网络主体担保，这样，每个AD和网络设备都成为它自己的信任锚，整个信任模型中不存在“根信任锚”，所以，AIP的网络寻址方案使得它具有分布式的信任模型。In AIP, each AD and network device has a unique self-certification label,

The corresponding relationship between them does not require guarantees from other network subjects. In this way, each AD and network device becomes its own trust anchor, and there is no "root trust anchor" in the entire trust model. Therefore, the network addressing scheme of AIP makes it Has a distributed trust model.

The credibility of the relationship exists in the network addressing scheme, and there is no need to deploy any mechanism outside the routing system. Therefore, AIP has an internal trust model.

The performance of the present invention is more superior than that of AIP. According to one embodiment of the present invention, the implementation steps include:

Step 1: Given a routing structure that has domains of responsibility as elements .

The network with independent management subjects in the Internet is regarded as the domain of responsibility, and the domain of responsibility is the basic element of the network topology. In this way, the entire network appears as "a union of many domains of responsibility", and a single domain of responsibility appears as an element form of the network topology. The granularity of the domain of responsibility is variable: regardless of the network size, any network with a single, independent management entity can become a domain of responsibility, such as fixed subnets (enterprise networks or campus networks), mobile subnets (subnets on trains and ships) , and autonomous systems are all likely to be treated as independent domains of responsibility.

Step 2: Based on the above routing structure, design a network addressing method

The network addressing method is as follows: the address of each network interface is composed of a mixture of a responsibility domain label d in a flat structure and an intra-domain label f in a hierarchical structure, and is recorded as d:f, referred to as an HAS address.

As shown in Figure 2, d uniquely represents the responsibility domain identity in the entire network, and f uniquely represents the address of the network interface in the responsibility domain.

(1) When it needs to be compatible with other networks, the length of d and f can be further limited

For example, in order to be compatible with the IPv6 network, the length of d can be specified as 88 bits, the length of the reserved field is 8 bits, and the length of f is 32 bits, so that the total length of the address is 128 bits, which is the same as the length of the IPv6 address.

(2) Based on the asymmetric cryptosystem and hash function, set the responsibility domain label of the planar structure

The responsibility domain label is the hash value of the responsibility domain public key. Specifically, for domain i, its label d _i can be generated according to formula (1):

d _i =P _r f _i (pk _i ) (1)

In formula (1), pk _i represents the public key independently generated by responsibility domain i, and the corresponding private key is denoted as _pri ; Prf _i (.) represents the hash function selected by responsibility domain i, which has good one-way property. specifically,

1) Asymmetric cryptographic systems, such as RSA, DSA, ECDSA (Elliptic Curve Digital Signature Algorithm, Elliptic Curve Digital Signature Algorithm), etc. can be used to generate public/private key pairs in the domain of responsibility.

2) A common hash function (such as SHA, MD-5, etc.) can be used to process the domain of responsibility public key to generate a domain of responsibility label; it can also be based on the symmetric cryptosystem AES, and the hash function can be constructed with the standard method ISO/IEC 10118-2, The domain of responsibility public key is then processed using this hash function to generate a domain of responsibility label.

(3) Set reserved domain

As shown in Figure 2, the reserved domain is located between the "responsibility domain label domain" and the "intra-domain label domain". It is worth noting that the length of the reserved field is not fixed, it is just a padding field without any semantics, and the value of this field can be set to all zeros.

(4) Set the label in the domain

The intra-domain label adopts the hierarchical structure of CIDR (Classless Inter-Domain Routing, Classless Inter-Domain Routing) mode, and supports subnet division and prefix aggregation. The domain of responsibility assigns labels within the domain independently.

(5) The responsibility domain sets the private key of the terminal device, and the corresponding public key is its HAS address

Use an identity-based signature algorithm (such as the JYH algorithm) in the domain of responsibility to assign private keys to network devices in the domain as needed, so that the corresponding public keys are their respective HAS addresses.

Step 3: Based on the above network addressing method, design an inter-domain routing mechanism

Improve the BGP protocol (Border Gateway Protocol, border gateway protocol), use the improved BGP protocol to complete inter-domain routing: (1) replace the AS (Autonomous System, autonomous system) number and destination IP prefix that appear in the BGP routing update message with Domain of Responsibility label. (2) Organize the routing table and forwarding table with the responsibility domain label as the handle.

Step 4: Based on the above network addressing method, design the intra-domain routing mechanism

Because the label in the domain has a hierarchical structure, it is possible to (1) improve RIP (Routing Information Protocol, Routing Information Protocol), OSPF (Open Shortest-Path First Interior Gateway Protocol, Open Shortest Path First) and other intra-domain routing protocols, so that they can be the same as the HAS address (2) Use the improved RIP or OSPF and other intra-domain routing protocols to complete the routing function within the responsibility domain.

Step 5: Based on the above network addressing method, design the packet forwarding process

After adopting the HAS address, (1) each packet header mainly includes information such as source address and destination address. In particular, if the length of the HAS address is limited to 128 bits, then the packet header can adopt the header format of IPv6. (2) The inter-domain router organizes the inter-domain routing table and forwarding table with the responsibility domain label of the flat structure as the handle). When forwarding packets, the inter-domain router can abandon the longest prefix matching algorithm in the Internet and use the hash table instead Pinpoint routing information for a given destination address.

Step 6: Based on the above network addressing method, design a public key management mechanism

The public key management mechanism is mainly composed of PSR (Public Shared Registry, registration query center). The registration query center is responsible for storing and distributing all responsibility domain public keys, and supports the dynamic updating of responsibility domain labels and public keys. PSR works as follows:

(1) PSR contains a list of public key information. Each domain-of-responsibility label corresponds to an entry in the list. The information contained in each entry includes: "Responsibility Domain Label", "Public Key", "Generation Parameters", "Intra-Domain Public Parameters" (for responsibility domain i, assuming that it uses a certain identity-based signature algorithm, the The specific parameters required by the algorithm are called public parameters in the responsibility domain i, denoted as π _i ), "generation time", "validity period", "status value", "entry location", and "digital signature". When the "status value" item is 0, it means that the entry is still valid; when the "status value" item is 1, it means that the entry has been abolished. The "entry position" item is optional, and when the "status value" item is 1, the "entry position" item indicates the entry position corresponding to the new label. The "Digital Signature" item stores the digital signature of the responsibility domain on the public key", "generation parameters", "intra-domain public parameters", "generation time", "validity period", "status value", and "entry location".

(2) Distribution: Each responsibility domain periodically queries the PSR to update information such as labels, public keys, and public parameters in other domains in real time.

(3) Update: In order to resist possible key strength degradation, three responsibility domain label update methods are designed: ①Regular update, any responsibility domain must generate a new public/private key pair before the time exceeds the validity period, Tags and public parameters in the domain, and abolish the old entries in the PSR, and register new storage entries; ②Temporary update, each responsibility domain can actively update the public/private key pair, tags and public parameters in the domain at any time, Temporary update also needs to abolish the old entry and register a new entry; ③ Partial update allows the domain of responsibility to update the "public parameters in the domain" attribute in the storage entry separately. In addition, when regular updates and temporary updates occur, each responsibility domain needs to replace the old responsibility domain label in the routing table, forwarding table, or mapping relationship table with a new responsibility domain label.

Claims (10)

1. a new network addressing method is characterized in that, the address of each network interface all is made up of the responsibility territory label of planar structure and the territory interior label mixing of hierarchical structure; Responsibility territory label is the Hash Value of responsibility territory PKI; It is corresponding one by one natively with responsibility territory PKI, in the responsibility territory, uses based on the signature algorithm of identity off-line as required; For the network equipment distributes private key, make that corresponding PKI is exactly their hybrid network addressing scheme address.

2. network addressing method as claimed in claim 1 is characterized in that, uses the public affairs/private key in asymmetric cryptosystem generation responsibility territory right.

3. network addressing method as claimed in claim 2 is characterized in that, asymmetric cryptosystem is RSA, DSA, ECDSA.

4. network addressing method as claimed in claim 1; It is characterized in that; The hybrid network addressing scheme is with the IPv6 Web-compatible, and the length of hybrid network addressing scheme address is 128 bits, and at this moment the length of responsibility territory label is 88 bits; The length that keeps the territory is 8 bits, and the length of territory interior label is 32 bits.

5. network addressing method as claimed in claim 1 is characterized in that, the inter-domain routing mechanism after the improvement comprises, all replaces to responsibility territory label with the AS that occurs in the BGP routing update message number with purpose IP prefix; With responsibility territory label is handle, organizes routing table and transmits.

6. network addressing method as claimed in claim 1 is characterized in that routing mechanism comprises in the territory after the improvement, improves Routing Protocol in the territory, makes them to adapt with hybrid network addressing scheme address.

7. network addressing method as claimed in claim 6 is characterized in that Routing Protocol comprises RIP, OSPF in the said territory.

8. network addressing method as claimed in claim 1 is characterized in that, inter domain router is that the handle tissue is transmitted with the responsibility territory label of planar structure, when transmitting grouping, uses the accurately routing iinformation of the given destination address in location of Hash table.

9. network addressing method as claimed in claim 1 is characterized in that, the trade mark enquiries center is set, and is responsible for storage, distributes common parameter in all responsibility territory PKIs and the territory, and support the renewal of common parameter in responsibility territory label, PKI and the territory.

10. network addressing method as claimed in claim 1 is characterized in that, keeps the territory and is positioned between " responsibility territory label field " and " interior label territory, territory ".

Images