Dynamic path verification method based on reorganization of authentication fragments

Patent metadata

Field	Value
Publication number	US-12058143-B2
Application number	US-202217665735-A
Country	US
Kind code	B2
Filing date	Feb 7, 2022
Priority date	Apr 24, 2020
Publication date	Aug 6, 2024
Grant date	Aug 6, 2024

Abstract

A dynamic path verification method based on reorganization of authentication fragments is proposed. The method includes: sending an initial expected path verification structure to a data packet sending end via a guarantee service node, and sending notification information to the respective routing nodes on an initial expected path; after updating the initial expected path to a new expected path, inserting the new expected path verification structure into a subsequent data packet to be sent, verifying the data packet by other nodes except a migration node, and sending the subsequent data packet to be sent to a next hop of routing node; performing the parsing verification on the received data packet by the migration node.

First claim

What is claimed is:

1. A dynamic path verification method based on reorganization of authentication fragments, comprising:
sending an initial expected path verification structure to a data packet sending end via a guarantee service node, and sending notification information to respective routing nodes on an initial expected path; inserting the initial expected path verification structure by the data packet sending end into a data packet to be sent, sending the inserted data packet to a next hop of routing node based on the initial expected path; performing, by a routing node on the initial expected path after receiving the inserted data packet, a parsing verification on the inserted data packet according to a session symmetric key of the routing node and the initial expected path verification structure, and continuing to send the inserted data packet to a next routing node in a case that the parsing verification passes;
updating the initial expected path to a new expected path in a case that the initial expected path changes, resending an application to the guarantee service node by the data packet sending end, generating a new expected path verification structure by the guarantee service node according to the new expected path, sending the new expected path verification structure to the data packet sending end and a migration node, and sending new notification information to the respective routing nodes;
inserting the new expected path verification structure by the data packet sending end into a subsequent data packet to be sent, and sending the subsequent data packet to be sent to a next hop of routing node, performing the parsing verification on a received data packet by intermediate routing nodes except for the migration node, and forwarding the received data packet of the intermediate routing nodes to a next hop of routing node in a case that the parsing verification passes;
performing the parsing verification on a received data packet by the migration node, determining whether the received data packet of the migration node is inserted into the new expected path verification structure in a case that the parsing verification passes, replacing the initial expected path verification structure inserted with the received data packet of the migration node by the new expected path verification structure in a case that the data packet is not inserted into the new expected path verification structure, and sending the received data packet of the migration node to a next hop of routing node on the new expected path to continue performing verification in a case that the data packet is inserted into the new expected path verification structure; and
performing the parsing verification on a received data packet by a data packet receiving end, determining whether source address information in a header of the received data packet of the data packet receiving end is consistent with expected starting node information in a case that the parsing verification passes, completing verification of the received data packet of the data packet receiving end on a session transmission path and determining that data packet is normal in a case that the source address information in the header of the received data packet of the data packet receiving end is consistent with the expected starting node information, and discarding the received data packet of the data packet receiving end in a case that the source address information in the header of the received data packet of the data packet receiving end is inconsistent with the expected starting node information.

2. The method of claim 1 , further comprising:
generating, by the guarantee service node, the expected path verification structure by encrypting expected previous hop of information and expected next hop of information of respective nodes on the expected path with a session symmetric key, wherein the expected path verification structure comprises a plurality of pieces of fragment information to be verified corresponding to routing nodes on the expected path.

3. The method of claim 1 , wherein notification information received by different nodes on the expected path are different, and the notification information comprises expected previous hop of information of the respective routing nodes and a valid time limit, and the notification information is parsed through a session symmetric key of each node.

4. The method of claim 1 , further comprising:
extracting the expected path verification structure in the data packet by a routing node on the expected path after receiving the data packet, acquiring expected previous hop of information of a current data packet with fragment information corresponding to the routing node in the expected path verification structure parsed with a session symmetric key of the routing node, determining whether previous hop of information of an actual receiving port of the current data packet is consistent with the expected previous hop of information, determining that the verification passes in a case that the previous hop of information of the actual receiving port of the current data packet is consistent with the expected previous hop of information, and determining that the verification fails in a case that the previous hop of information of the actual receiving port of the current data packet is inconsistent with the expected previous hop of information.

5. The method of claim 4 , further comprising:
performing the parsing verification on the received data packet by each routing node on the expected path, discarding the data packet and issuing error report information to the guarantee service node corresponding to the routing node, the data packet sending end and the data packet receiving end in a case that the verification fails.

6. The method of claim 5 , further comprising: in a case of failing to pass the verification and a security requirement level being greater than a preset value, actively generating, by each routing node, warning report information for a received session data packet with a random time interval within a session valid time limit, and transmitting the warning report information to the guarantee service node, the data packet sending end and the data packet receiving end respectively, wherein the warning report information at least describes a data packet receiving a session within a certain time interval and information on a state of the data packet passing or failing to pass the verification.

7. The method of claim 1 , wherein during a transmission and verification process of a session data packet, the data packet sending end retransmits an application to the guarantee service node in a case that the initial expected path changes, and the application comprises at least new expected path information of the session and an updated session valid time limit.

8. The method of claim 1 , wherein the migration node is a first intersection node of the initial expected path and the new expected path.

9. The method of claim 1 , further comprising:
resending, by the guarantee service node, notification information related to the new expected path after the initial expected path is updated to the new expected path, and notifying each routing node on the initial expected path subsequent to the migration node to cancel a session, and notifying each routing node on the new expected path to add or update the session.

10. The method of claim 1 , wherein determining whether the data packet is inserted into the new expected path verification structure comprises:
parsing the expected path verification structure of the data packet with the session symmetric key of the migration node to obtain an expected next hop of node of the data packet, and determining whether the

Assignees

• Univ Tsinghua

Inventors

• Xu Ke
• Yang Fan
• Wu Bo
• Li Qi
• Wu Jianping

Classifications

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title