CN109698791B - Anonymous access method based on dynamic path - Google Patents
Anonymous access method based on dynamic path Download PDFInfo
- Publication number
- CN109698791B CN109698791B CN201811441363.3A CN201811441363A CN109698791B CN 109698791 B CN109698791 B CN 109698791B CN 201811441363 A CN201811441363 A CN 201811441363A CN 109698791 B CN109698791 B CN 109698791B
- Authority
- CN
- China
- Prior art keywords
- node
- path
- random number
- data packet
- message
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 33
- 230000004044 response Effects 0.000 claims abstract description 30
- 230000005540 biological transmission Effects 0.000 claims abstract description 21
- 238000004891 communication Methods 0.000 claims abstract description 13
- 238000001514 detection method Methods 0.000 claims description 8
- 230000008569 process Effects 0.000 abstract description 7
- 238000011144 upstream manufacturing Methods 0.000 description 6
- 238000010586 diagram Methods 0.000 description 4
- 241000234282 Allium Species 0.000 description 3
- 235000002732 Allium cepa var. cepa Nutrition 0.000 description 3
- 230000007246 mechanism Effects 0.000 description 3
- 230000006855 networking Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000011664 signaling Effects 0.000 description 2
- 230000007547 defect Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/02—Topology update or discovery
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/16—Multipoint routing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/74—Address processing for routing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
- H04L63/0421—Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/56—Provisioning of proxy services
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
- H04L67/63—Routing a service request depending on the request content or context
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides an anonymous access method based on dynamic path, the message transmitted by the terminal is forwarded by the forwarding path established by the route server in the network, and finally sent to the target; in the process of establishing the path, the path planning server judges the delay time and the transmission speed of each agent node through the update response fed back by each agent node, so that the forwarding path established for the terminal by the path planning server is the path with the best communication quality, namely the path with the shortest delay time and the fastest transmission speed, and the invention can ensure the transmission speed of node data; in addition, in the process of establishing the path, each proxy node returns the random number corresponding to the IP address of the upper-level proxy node and the random number corresponding to the IP address of the lower-level proxy node which are connected with the proxy node to the path planning server, so that the path planning server can obtain the specific information of the path and realize the control of message transmission.
Description
Technical Field
The invention belongs to the technical field of anonymous communication networks, and particularly relates to an anonymous access method based on a dynamic path.
Background
In an open network environment, a network terminal needs to perform terminal identity authentication when accessing, and if a terminal user does not want to expose own identity, the opposite side cannot judge the real physical address of the user while accessing a website. The anonymous access mode commonly used at present is onion routing (Tor), and users perform anonymous access on the internet through Tor. The Tor user runs an onion proxy server on the local machine, periodically communicates with other Tor servers, and forms a virtual loop in the Tor network. The Tor server is provided by the internet user, and the client randomly selects the Tor server with strong randomness. After the information is sent from the Tor server of the client, the server does not know that the server is an entry node, only knows that a request needs to be established, and the subsequent transmission process is the same, so that the identity information of the requester cannot be judged. And the information enters a Tor loop, the encrypted information is transmitted among Tor servers of the virtual loop, and after the encrypted information reaches an exit node, plaintext data is sent to a target server from the node.
Therefore, the anonymous access method of the onion router has the following defects:
1. as the jump node is a Tor server of other users, the transmission speed of the node data cannot be ensured.
2. Due to the random strategy adopted by the jump, the specific information of the path cannot be obtained, and the control on the data transmission process cannot be realized.
Disclosure of Invention
In order to solve the above problems, the present invention provides an anonymous access method based on a dynamic path, which can ensure the transmission speed of node data and realize the control of message transmission.
An anonymous access method based on a dynamic path comprises the following steps:
the method comprises the steps that a path planning server establishes a forwarding path, wherein the first node of the forwarding path is an entrance node, the middle of the forwarding path is more than two middle nodes, the last node of the forwarding path is an exit node, and the IP addresses of the entrance node, the middle nodes and the exit node respectively correspond to a random number; the entry node and the exit node are also provided with a pair of symmetric keys;
sending the forwarding path to a terminal through a relay server, acquiring random numbers corresponding to all intermediate nodes and exit nodes on the forwarding path by the terminal, encrypting an original data packet by adopting the symmetric key to obtain a data packet X, attaching each random number to the head of the data packet X layer by layer according to the reverse sequence of the corresponding node on the forwarding path, encrypting the data packet X once when each layer of random number is attached to the head of the data packet X, and sequentially completing the encryption of the data packet to which each layer of random number is attached to obtain a message;
the terminal forwards the message to the inlet node of the forwarding path through the relay server, the message is forwarded to the outlet node through intermediate nodes at all levels of the forwarding path, the outlet node decrypts the message by using the symmetric secret key to obtain an original data packet, and the original data packet is sent to a target to realize anonymous access;
the entry node, the intermediate node and the exit node are all proxy nodes, and the establishment of the forwarding path by the path planning server is specifically as follows:
the terminal sends a path updating request to a path planning server every set time length;
after receiving the path updating request, the path planning server sends updating information to all the entry nodes connected with the path planning server, and then each entry node forwards the updating information to the next-level agent node connected with the entry node, and so on until all the agent nodes receive the updating information;
each level of agent nodes generate update responses after receiving the update information, and then send the random number corresponding to the IP address of the upper level of agent nodes connected with the agent nodes, the random number corresponding to the IP address of the lower level of agent nodes and the update responses back to the path planning server along the time-coming path of the update information; wherein, the connection relation among all levels of proxy nodes determines all possible paths;
and the path planning server judges the delay time and the transmission speed of each proxy node according to the received update response, and takes the path with the shortest delay time and the fastest transmission speed in all possible paths as a forwarding path to complete the establishment of the forwarding path.
Further, the encryption of the data packets to which the random numbers of each layer are added in sequence is specifically:
the entry node, the intermediate node and the exit node are provided with respective private keys;
the number of layers of the random number of the exit node of the forwarding path attached to the head of the data packet X is two, and after the random number of the first layer of exit node is attached to the data packet X, the data packet X attached with the random number of the first layer of exit node is encrypted by using a private key of the exit node to obtain a data packet X1;
after the random number of the second layer of exit nodes is added to the data packet X1, the data packet X1 added with the random number of the second layer of exit nodes is encrypted by using the private key of the last intermediate node to obtain a data packet X2;
after the random number of the last intermediate node is added to the data packet X2, the data packet X2 added with the random number of the last intermediate node is encrypted by using a private key of the penultimate intermediate node to obtain a data packet X3;
and repeating the steps until the private key of the entrance node is adopted to encrypt the data packet Xn added with the random number of the first intermediate node, and completing the encryption of the random numbers of each layer, wherein n is the sum of the numbers of the intermediate nodes and the exit node.
Further, the number of layers of the random number attached to the head of the original data packet by the egress node of the forwarding path is two, the ingress node, the intermediate node and the egress node all have respective private keys, and the ingress node and the egress node also have a pair of symmetric keys, so that the ingress node, the intermediate node and the egress node execute a dynamic blacklist detection operation after receiving the message and before forwarding the message;
the dynamic blacklist detection operation comprises the following steps:
s101: the current node receives a message, and detects whether the source IP address of the received message is in a blacklist: if so, discarding the message; if not, the step S102 is carried out, wherein the initial blacklist is an empty name list;
s102: inquiring whether the current first random number carried by the message exists in a corresponding relation table of the random number and the IP address, if not, entering a step S103, and if so, entering a step S104; wherein, the initial random number and IP address corresponding relation table is a null table;
s103: and decrypting the layer of the current first random number in the message by adopting a private key corresponding to the current node: if the decryption fails, adding the source IP address of the message into the blacklist; if the decryption is successful, obtaining a random number corresponding to the IP address of the downstream node of the current node, further obtaining the IP address of the downstream node of the current node, then adding the random number and the IP address into the corresponding relation table of the random number and the IP address, and forwarding the decrypted message to the downstream node;
s104: and detecting whether the IP address corresponding to the first random number is the IP address of the current node, if so, indicating that the current node is an exit node, decrypting the original data packet in the message by using the symmetric key, forwarding the decrypted data to the target, and if not, forwarding the message of which the layer where the current first random number is stripped is to the downstream node corresponding to the current random number.
Further, if the entry node and the exit node in the forwarding path are combined for the first time, after the forwarding path is established by the path planning server, and before the forwarding path is sent to the terminal through the relay server, the entry node further performs the following steps:
the method comprises the steps that an entrance node generates a random symmetric secret key for an exit node, wherein the symmetric secret key is encrypted by using a public key of the exit node, and a private key signature of the entrance node is obtained;
the entry node sends the symmetric secret key to the exit node through the intermediate node, the exit node installs the symmetric secret key after verifying the signature and generates a random secret key, wherein the random secret key is encrypted by using a public key of the entry node, and a private key of the exit node is signed;
and the outlet node sends the random secret key to the inlet node through the intermediate node, and the inlet node installs the random secret key.
Further, in step S104, the egress node decrypts the original data packet in the message using the symmetric key, and forwards the decrypted message to the target, specifically:
the exit node decrypts the original data packet in the message by using the symmetric secret key of the entry node and sends a communication request to the target;
the target receives the message and generates a target response after receiving the communication request, and then sends the target response to the output port node;
the exit node encrypts the target response by using a self symmetric key, and then sends the encrypted target response to the entry node through the intermediate node;
and the entry node decrypts the target response by using the symmetric key of the exit node, and then sends the decrypted target response to the user to realize anonymous access.
Further, the portal node forwards the update information to the next-level proxy node connected with the portal node in a breadth traversal mode.
Has the advantages that:
1. the invention provides an anonymous access method based on dynamic path, wherein messages transmitted by a terminal are forwarded in a network by a forwarding path established by a path planning server and finally sent to a target; in the process of establishing the path, the path planning server judges the delay time and the transmission speed of each agent node through the update response fed back by each agent node, and the forwarding path established for the terminal by the path planning server is the path with the best communication quality, namely the path with the shortest delay time and the fastest transmission speed, so that the invention can ensure the transmission speed of node data; in addition, in the process of establishing the path, each proxy node returns the random number corresponding to the IP address of the upper-level proxy node and the random number corresponding to the IP address of the lower-level proxy node which are connected with the proxy node to the path planning server, so that the path planning server can obtain the specific information of the path and realize the control of message transmission.
2. The invention provides an anonymous access method based on a dynamic path, which adopts a dynamic blacklist mechanism to complete networking, each node judges whether the node is legal or not by successfully decrypting a received data packet, and simultaneously, each node is successfully decrypted, only a random number and an IP address corresponding to a downstream node of the current node and a random number and an IP address corresponding to an upstream node can be obtained, but a complete path is not known, so that the anonymous path is realized, and the anonymity, the safety and the high efficiency of a user when accessing a network can be guaranteed.
Drawings
Fig. 1 is a schematic diagram of a network topology of an anonymous access method based on a dynamic path according to the present invention;
FIG. 2 is a flow chart of a dynamic blacklist detection operation provided by the present invention;
fig. 3 is a signaling diagram for performing point-to-point negotiation encryption between an ingress node and an egress node according to the present invention.
Detailed Description
In order to make the technical solutions better understood by those skilled in the art, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application.
Example one
Referring to fig. 1, the figure is a schematic diagram of a network topology of an anonymous access method based on a dynamic path according to this embodiment. An anonymous access method based on a dynamic path comprises the following steps:
the method comprises the steps that a path planning server establishes a forwarding path, wherein the first node of the forwarding path is an entrance node, the middle of the forwarding path is more than two middle nodes, the last node of the forwarding path is an exit node, and the IP addresses of the entrance node, the middle nodes and the exit node respectively correspond to a random number; the entry node and the exit node are also provided with a pair of symmetric keys;
sending the forwarding path to a terminal through a relay server, acquiring random numbers corresponding to all intermediate nodes and exit nodes on the forwarding path by the terminal, encrypting an original data packet by adopting the symmetric key to obtain a data packet X, attaching each random number to the head of the data packet X layer by layer according to the reverse sequence of the corresponding node on the forwarding path, encrypting the data packet X once when each layer of random number is attached to the head of the data packet X, and sequentially completing the encryption of the data packet to which each layer of random number is attached to obtain a message;
the terminal forwards the message to the inlet node of the forwarding path through the relay server, the message is forwarded to the outlet node through intermediate nodes at all levels of the forwarding path, the outlet node decrypts the message by using the symmetric secret key to obtain an original data packet, and the original data packet is sent to a target to realize anonymous access;
the entry node, the intermediate node and the exit node are all proxy nodes, and the establishment of the forwarding path by the path planning server is specifically as follows:
the terminal sends a path updating request to a path planning server every set time length;
after receiving the path updating request, the path planning server sends updating information to all the entry nodes connected with the path planning server, and then each entry node forwards the updating information to the next-level agent node connected with the entry node, and so on until all the agent nodes receive the updating information;
each level of agent nodes generate update responses after receiving the update information, and then send the random number corresponding to the IP address of the upper level of agent nodes connected with the agent nodes, the random number corresponding to the IP address of the lower level of agent nodes and the update responses back to the path planning server along the time-coming path of the update information; wherein, the connection relation among all levels of proxy nodes determines all possible paths;
and the path planning server judges the delay time and the transmission speed of each proxy node according to the received update response, and takes the path with the shortest delay time and the fastest transmission speed in all possible paths as a forwarding path to complete the establishment of the forwarding path.
It should be noted that the encryption of the data packet added with each layer of random numbers that is sequentially completed specifically includes:
the entry node, the intermediate node and the exit node are provided with respective private keys;
the number of layers of the random number of the exit node of the forwarding path attached to the head of the data packet X is two, and after the random number of the first layer of exit node is attached to the data packet X, the data packet X attached with the random number of the first layer of exit node is encrypted by using a private key of the exit node to obtain a data packet X1;
after the random number of the second layer of exit nodes is added to the data packet X1, the data packet X1 added with the random number of the second layer of exit nodes is encrypted by using the private key of the last intermediate node to obtain a data packet X2;
after the random number of the last intermediate node is added to the data packet X2, the data packet X2 added with the random number of the last intermediate node is encrypted by using a private key of the penultimate intermediate node to obtain a data packet X3;
and repeating the steps until the private key of the entrance node is adopted to encrypt the data packet Xn added with the random number of the first intermediate node, and completing the encryption of the random numbers of each layer, wherein n is the sum of the numbers of the intermediate nodes and the exit node.
Example two
Based on the above embodiments, the present embodiment provides another anonymous access method based on dynamic path. In the process of message transmission, each node on the path does not need to acquire a legal list which can be communicated with the node in advance, and the validity verification is completed through a dynamic blacklist mechanism. Specifically, the number of layers of the random number attached to the head of the original data packet by the egress node of the forwarding path is two, the ingress node, the intermediate node, and the egress node all have respective private keys, and the ingress node and the egress node also have a pair of symmetric keys, so that the ingress node, the intermediate node, and the egress node perform a dynamic blacklist detection operation after receiving the message and before forwarding the message.
Referring to fig. 2, it is a flowchart of a dynamic blacklist detection operation provided in this embodiment. The dynamic blacklist detection operation comprises the following steps:
s101: the current node receives a message, detects whether the source IP address of the received message is in the blacklist, if so, discards the message; if not, the step S102 is carried out, wherein the initial blacklist is an empty name list;
s102: inquiring whether the current first random number carried by the message exists in a corresponding relation table of the random number and the IP address, if not, entering a step S103, and if so, entering a step S104; wherein, the initial random number and IP address corresponding relation table is a null table;
s103: and decrypting the layer of the current first random number in the message by adopting a private key corresponding to the current node: if the decryption fails, adding the source IP address of the message into the blacklist; if the decryption is successful, obtaining a random number corresponding to the IP address of the downstream node of the current node, further obtaining the IP address of the downstream node of the current node, then adding the random number and the IP address into the corresponding relation table of the random number and the IP address, and forwarding the decrypted message to the downstream node;
s104: and detecting whether the IP address corresponding to the first random number is the IP address of the current node, if so, indicating that the current node is an exit node, decrypting the original data packet in the message by using the symmetric key, forwarding the decrypted data to the target, and if not, forwarding the message of which the layer where the current first random number is stripped is to the downstream node corresponding to the current random number.
It should be noted that, because two layers of random numbers corresponding to the egress nodes are added to the head of the original data packet, the first layer of random numbers of the egress nodes are stripped at the following intermediate node, the last intermediate node obtains the IP address corresponding to the random number according to the random number of the egress node obtained by decryption, and forwards the message of stripping the random number of the first layer of egress nodes to the egress nodes according to the IP address, at this time, the egress nodes decrypt the message by using their own private keys to obtain the random number of the second layer of egress nodes, and the IP address corresponding to the random number of the second layer of egress nodes is the current host, that is, the IP address of the host where the egress nodes are located, that is, the message is forwarded to the egress nodes; and then the exit node decrypts the message with the random numbers of all layers stripped by using the symmetric key, and finally forwards the decrypted message to the target.
It should be noted that, because the RSA method is used for negotiation, frequent processing consumes a lot of performance, so that the frequency of RSA decryption failure in each source IP processing cannot exceed 10 times/s, and a black hole is added to an IP with excessive decryption failure times for a period of time to avoid malicious attacks.
Therefore, in the embodiment, a centralized directory server is not adopted to organize the network, but from the networking perspective, an anonymous communication network scheme is constructed based on a dynamic blacklist mechanism, and the availability of an anonymous communication path is provided by adopting a section-by-section encryption mode, a multi-level network structure, multi-layer encryption and other technologies, so that the anonymity, the safety and the high efficiency of a user when accessing the network are guaranteed.
EXAMPLE III
Based on the above embodiments, this embodiment takes as an example that the terminal a sends a message to the ingress node through the relay server, the ingress node forwards the message to the egress node through the node a and the node B, and the egress node sends the message to the target a, and details a process of obtaining the message by attaching random numbers corresponding to all nodes on a forwarding path to the head of the original data packet layer by layer according to a reverse order by the terminal.
Each node would be designed to only know its upstream and downstream nodes. For example, the upstream node information of the node a is an ingress node IP address and a random number x, the downstream node information is a node B IP address and a random number B, the upstream node information of the node B is the node a IP address and the random number a, the downstream node information is an egress node IP address and a random number d, and the upstream node information of the egress node is the node B IP address and the random number B; if the random number sequence corresponding to the path sequence is xabd, then the random numbers are sequentially added to the header of the original data packet according to the order of ddbax, that is, the random numbers of the message from the outermost layer to the innermost layer are xabd respectively.
It can be seen that each node in the entire network is connected with only a limited number of upstream nodes and downstream nodes. Meanwhile, each node only knows the private key, certificate and port providing service, and each node is designed not to receive more information than the node needs. In the process of message transmission, the terminal encrypts the secret key of each node on the path layer by layer, so that a data inlet is controlled by a user, an intermediate node in the network cannot know the content of data, and a data outlet cannot know which data inlet the data comes from, thereby providing high safety and concealment for the user.
Example four
When communication is performed between an ingress node and an egress node, that is, the ingress node forwards a message to the egress node through two or more intermediate nodes, if the ingress node and the egress node in the forwarding path are combined for the first time, the ingress node and the egress node need to negotiate an AES256 symmetric key. The following describes in detail the procedure of negotiating the AES256 symmetric key by the ingress node and the egress node based on the above embodiments.
Referring to fig. 3, this figure is a signaling diagram for performing point-to-point negotiation encryption between an ingress node and an egress node according to this embodiment.
If the entry node and the exit node in the forwarding path are combined for the first time, after the forwarding path is established by the path planning server, and before the forwarding path is sent to the terminal through the relay server, the entry node further executes the following steps:
the method comprises the steps that an entrance node generates a random symmetric secret key for an exit node, wherein the symmetric secret key is encrypted by using a public key of the exit node, and a private key signature of the entrance node is obtained;
the entry node sends the symmetric secret key to the exit node through the intermediate node, the exit node installs the symmetric secret key after verifying the signature and generates a random secret key, wherein the random secret key is encrypted by using a public key of the entry node, and a private key of the exit node is signed;
and the outlet node sends the random secret key to the inlet node through the intermediate node, and the inlet node installs the random secret key.
Further, after the ingress node establishes the forwarding path and before obtaining the message, the following steps are also executed:
the ingress node encrypts the original data packet using its own symmetric key.
Further, in step S104, the egress node decrypts the original data packet in the message using the symmetric key, and forwards the decrypted message to the target, specifically:
the exit node decrypts the message by using the symmetric secret key of the entrance node and sends a communication request to the target;
the target receives the message and generates a target response after receiving the communication request, and then sends the target response to the output port node;
the exit node encrypts the target response by using a self symmetric key, and then sends the encrypted target response to the entry node through the intermediate node;
and the entry node decrypts the target response by using the symmetric key of the exit node, and then sends the decrypted target response to the user to realize communication.
Further, if the ingress node does not receive the destination response from the egress node within a set time, the ingress node resets the key status of the egress node.
Further, the ingress node will reset the egress node key state the first time it sends a message out.
The present invention may be embodied in other specific forms without departing from the spirit or essential attributes thereof, and it will be understood by those skilled in the art that various changes and modifications may be made herein without departing from the spirit and scope of the invention as defined in the appended claims.
Claims (5)
1. An anonymous access method based on a dynamic path is characterized by comprising the following steps:
the method comprises the steps that a path planning server establishes a forwarding path, wherein the first node of the forwarding path is an entrance node, the middle of the forwarding path is more than two middle nodes, the last node of the forwarding path is an exit node, and the IP addresses of the entrance node, the middle nodes and the exit node respectively correspond to a random number; the entry node and the exit node are also provided with a pair of symmetric keys;
sending the forwarding path to a terminal through a relay server, acquiring random numbers corresponding to all intermediate nodes and exit nodes on the forwarding path by the terminal, encrypting an original data packet by adopting the symmetric key to obtain a data packet X, attaching each random number to the head of the data packet X layer by layer according to the reverse sequence of the corresponding node on the forwarding path, encrypting the data packet X once when each layer of random number is attached to the head of the data packet X, and sequentially completing the encryption of the data packet to which each layer of random number is attached to obtain a message; the encryption of the data packets added with the random numbers of each layer is specifically:
the entry node, the intermediate node and the exit node are provided with respective private keys;
the number of layers of the random number of the exit node of the forwarding path attached to the head of the data packet X is two, and after the random number of the first layer of exit node is attached to the data packet X, the data packet X attached with the random number of the first layer of exit node is encrypted by using a private key of the exit node to obtain a data packet X1;
after the random number of the second layer of exit nodes is added to the data packet X1, the data packet X1 added with the random number of the second layer of exit nodes is encrypted by using the private key of the last intermediate node to obtain a data packet X2;
after the random number of the last intermediate node is added to the data packet X2, the data packet X2 added with the random number of the last intermediate node is encrypted by using a private key of the penultimate intermediate node to obtain a data packet X3;
repeating the steps until the private key of the entrance node is adopted to encrypt the data packet Xn added with the random number of the first intermediate node, and completing the encryption of the random numbers of each layer, wherein n is the sum of the numbers of the intermediate node and the exit node;
the terminal forwards the message to the inlet node of the forwarding path through the relay server, the message is forwarded to the outlet node through intermediate nodes at all levels of the forwarding path, the outlet node decrypts the message by using the symmetric secret key to obtain an original data packet, and the original data packet is sent to a target to realize anonymous access;
the entry node, the intermediate node and the exit node are all proxy nodes, and the establishment of the forwarding path by the path planning server is specifically as follows:
the terminal sends a path updating request to a path planning server every set time length;
after receiving the path updating request, the path planning server sends updating information to all the entry nodes connected with the path planning server, and then each entry node forwards the updating information to the next-level agent node connected with the entry node, and so on until all the agent nodes receive the updating information;
each level of agent nodes generate update responses after receiving the update information, and then send the random number corresponding to the IP address of the upper level of agent nodes connected with the agent nodes, the random number corresponding to the IP address of the lower level of agent nodes and the update responses back to the path planning server along the time-coming path of the update information; wherein, the connection relation among all levels of proxy nodes determines all possible paths;
and the path planning server judges the delay time and the transmission speed of each proxy node according to the received update response, and takes the path with the shortest delay time and the fastest transmission speed in all possible paths as a forwarding path to complete the establishment of the forwarding path.
2. The anonymous-access method based on dynamic path as set forth in claim 1, wherein said ingress node, intermediate node and egress node perform dynamic blacklist detection operation after receiving said message and before forwarding said message;
the dynamic blacklist detection operation comprises the following steps:
s101: the current node receives a message, and detects whether the source IP address of the received message is in a blacklist: if so, discarding the message; if not, the step S102 is carried out, wherein the initial blacklist is an empty name list;
s102: inquiring whether the current first random number carried by the message exists in a corresponding relation table of the random number and the IP address, if not, entering a step S103, and if so, entering a step S104; wherein, the initial random number and IP address corresponding relation table is a null table;
s103: and decrypting the layer of the current first random number in the message by adopting a private key corresponding to the current node: if the decryption fails, adding the source IP address of the message into the blacklist; if the decryption is successful, obtaining a random number corresponding to the IP address of the downstream node of the current node, further obtaining the IP address of the downstream node of the current node, then adding the random number and the IP address into the corresponding relation table of the random number and the IP address, and forwarding the decrypted message to the downstream node;
s104: and detecting whether the IP address corresponding to the first random number is the IP address of the current node, if so, indicating that the current node is an exit node, decrypting the original data packet in the message by using the symmetric key, forwarding the decrypted data to the target, and if not, forwarding the message of which the layer where the current first random number is stripped is to the downstream node corresponding to the current random number.
3. The anonymous access method based on dynamic path as set forth in claim 1, wherein if the ingress node and the egress node in the forwarding path are combined for the first time, after the path planning server establishes the forwarding path and before the forwarding path is sent to the terminal through the relay server, the ingress node further performs the following steps:
the method comprises the steps that an entrance node generates a random symmetric secret key for an exit node, wherein the symmetric secret key is encrypted by using a public key of the exit node, and a private key signature of the entrance node is obtained;
the entry node sends the symmetric secret key to the exit node through the intermediate node, the exit node installs the symmetric secret key after verifying the signature and generates a random secret key, wherein the random secret key is encrypted by using a public key of the entry node, and a private key of the exit node is signed;
and the outlet node sends the random secret key to the inlet node through the intermediate node, and the inlet node installs the random secret key.
4. The anonymous access method according to claim 2, wherein in step S104, the egress node decrypts an original data packet in the message using the symmetric key, and forwards the decrypted message to the destination, specifically:
the exit node decrypts the original data packet in the message by using the symmetric secret key of the entry node and sends a communication request to the target;
the target receives the message and generates a target response after receiving the communication request, and then sends the target response to the output port node;
the exit node encrypts the target response by using a self symmetric key, and then sends the encrypted target response to the entry node through the intermediate node;
and the entry node decrypts the target response by using the symmetric key of the exit node, and then sends the decrypted target response to the user to realize anonymous access.
5. The anonymous-access method based on dynamic path as set forth in claim 1, wherein said portal node forwards said updated information to a next-level proxy node connected thereto in a breadth-traversal manner.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811441363.3A CN109698791B (en) | 2018-11-29 | 2018-11-29 | Anonymous access method based on dynamic path |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811441363.3A CN109698791B (en) | 2018-11-29 | 2018-11-29 | Anonymous access method based on dynamic path |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109698791A CN109698791A (en) | 2019-04-30 |
| CN109698791B true CN109698791B (en) | 2021-05-11 |
Family
ID=66230244
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811441363.3A Active CN109698791B (en) | 2018-11-29 | 2018-11-29 | Anonymous access method based on dynamic path |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109698791B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111314336B (en) * | 2020-02-11 | 2021-03-23 | 中国科学院信息工程研究所 | A method and system for constructing dynamic transmission path for anti-tracking network |
| CN111970244B (en) * | 2020-07-20 | 2022-06-03 | 北京邮电大学 | The Construction of Anonymous Communication Network Based on Ring Architecture and the Method of Message Forwarding |
| CN111970245B (en) * | 2020-07-20 | 2021-07-20 | 北京邮电大学 | A heterogeneous layered anonymous communication network construction method and device |
| CN113572727B (en) * | 2021-06-08 | 2023-04-28 | 深圳市国电科技通信有限公司 | Data security hidden transmission method and system based on P2P network routing node |
| CN115514520B (en) * | 2022-08-11 | 2023-09-22 | 北京天元特通科技有限公司 | Network transmission method, device, equipment and medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101873216A (en) * | 2010-07-08 | 2010-10-27 | 布日古德 | Host authentication method, data packet transmission method and receiving method |
| CN103906046A (en) * | 2014-04-17 | 2014-07-02 | 上海电机学院 | Safe point-to-point on-demand routing method based on identity hiding |
| CN106936833A (en) * | 2017-03-15 | 2017-07-07 | 广东工业大学 | A kind of content center network method for secret protection based on Hybrid Encryption and anonymous group |
| CN108566337A (en) * | 2018-03-21 | 2018-09-21 | 常熟理工学院 | A kind of generation information network implementation method based on big data |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7418504B2 (en) * | 1998-10-30 | 2008-08-26 | Virnetx, Inc. | Agile network protocol for secure communications using secure domain names |
| US8948177B2 (en) * | 2012-07-30 | 2015-02-03 | Hewlett-Packard Development Company, L.P. | Policy based routing |
-
2018
- 2018-11-29 CN CN201811441363.3A patent/CN109698791B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101873216A (en) * | 2010-07-08 | 2010-10-27 | 布日古德 | Host authentication method, data packet transmission method and receiving method |
| CN103906046A (en) * | 2014-04-17 | 2014-07-02 | 上海电机学院 | Safe point-to-point on-demand routing method based on identity hiding |
| CN106936833A (en) * | 2017-03-15 | 2017-07-07 | 广东工业大学 | A kind of content center network method for secret protection based on Hybrid Encryption and anonymous group |
| CN108566337A (en) * | 2018-03-21 | 2018-09-21 | 常熟理工学院 | A kind of generation information network implementation method based on big data |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109698791A (en) | 2019-04-30 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109698791B (en) | Anonymous access method based on dynamic path | |
| Ahmed et al. | IPv6 neighbor discovery protocol specifications, threats and countermeasures: a survey | |
| Zhuang et al. | Cashmere: Resilient anonymous routing | |
| US8650397B2 (en) | Key distribution to a set of routers | |
| US9641430B2 (en) | Verifying data plane paths based on a validated secure control plane | |
| CN103701700B (en) | Node discovery method in a kind of communication network and system | |
| CN110392128B (en) | Method and system for providing quasi-addressless IPv6 public web services | |
| WO2009060283A1 (en) | Method and apparatus for secure communication | |
| JP2018521534A (en) | Network device and method for processing a session using a packet signature | |
| CN110493367B (en) | Unaddressed IPv6 non-public server, client and communication method | |
| US9722919B2 (en) | Tying data plane paths to a secure control plane | |
| CN101471772A (en) | Communication method, device and system | |
| Tanizawa et al. | A secure communication network infrastructure based on quantum key distribution technology | |
| Liyanage et al. | Secure hierarchical virtual private LAN services for provider provisioned networks | |
| Kita et al. | Producer anonymity based on onion routing in named data networking | |
| Alzahrani et al. | Key management in information centric networking | |
| Wang et al. | A data plane security model of segmented routing based on SDP trust enhancement architecture | |
| Elamathi et al. | RETRACTED ARTICLE: Enhanced secure communication over inter-domain routing in heterogeneous wireless networks based on analysis of BGP anomalies using soft computing techniques | |
| Shikfa et al. | Bootstrapping security associations in opportunistic networks | |
| Liyanage | Enhancing security and scalability of virtual private LAN services | |
| Raheem et al. | A secure authentication protocol for IP-based wireless sensor communications using the Location/ID Split Protocol (LISP) | |
| Chang et al. | Using resource public key infrastructure for secure border gateway protocol | |
| Kallash et al. | A security framework for node-to-node communications based on the LISP architecture | |
| Zubair et al. | Design, implement, and evaluate the performance of an IPsec inspired security framework for HIP-VPLS environments | |
| Chen | Infrastructure-based Anonymous Communication Protocols in Future Internet Architectures |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |