TWI784280B - Network communication method and network communication system - Google Patents

Abstract

A network communication method is disclosed. The network communication method includes: sending, by a first terminal, a connection request message with an address thereof; receiving, by a second terminal, the connection request message; determining, by the second terminal, whether the address included in the connection request message is a valid address accepted thereby; and sending, by the second terminal, a connection message to the first terminal in response to the connection request message if yes. The address of the first terminal and the valid address are generated dynamically.

Description

Network communication method and network communication system

The present invention relates to network communication, and in particular to a network communication method and network communication system.

Network communication generally uses communication address and communication protocol to complete the communication connection of the terminal. In the process of terminal communication in the past, in order to ensure the secure communication between different terminals, information encryption is usually carried out, and the communication address and communication protocol used are public, but this method is often due to encryption and decryption. The design is too simple to be cracked, and malicious people can carry out network attacks on specific network terminals, such as distributed denial-of-service attack (DDoS), causing system paralysis or instability.

On the other hand, in recent years, industrial control systems have been widely used in various fields. As the number of industrial control systems deployed increases, threats to them are becoming more frequent. Therefore, information security of industrial control systems has become a very important issue. For example, if the industrial control equipment in the critical infrastructure is maliciously invaded or attacked, it may cause damage to the people's livelihood system and even threaten national security.

The purpose of the present invention is to provide a new network connection protection mechanism, which can dynamically update the communication addresses of the transmitting end and the receiving end in the existing network environment, so as to ensure that only the transmitting end and the receiving end are connected during network communication. The receiving end knows the addresses of both parties, but cannot be obtained by a third party, avoiding related attacks and information security risks.

One aspect of the present invention is to provide a network communication method, which includes: sending a connection request message including its address by the first terminal; and receiving the connection request message by the second terminal, and judging the address included in the connection request message Whether it is a valid address accepted by it, and if so, send a connection approval message corresponding to the connection request message to the first terminal. The address and effective address of the first terminal are dynamically generated.

According to an embodiment of the present invention, the address of the first terminal is calculated by the first terminal according to the initialization parameter, and the effective address is calculated by the second terminal according to the initialization parameter.

According to yet another embodiment of the present invention, the address of the first terminal and the effective address are updated every predetermined period.

According to yet another embodiment of the present invention, the network communication method further includes: updating the valid address among the valid addresses that has not been updated for the longest time every the predetermined period.

According to yet another embodiment of the present invention, the address of the first terminal and the effective address are IP addresses.

According to some embodiments of the present invention, the address of the first terminal includes a preamble (prefix) and a host identification code bit (host ID), and the address of the first terminal is updated to the first The host identification code bit of the address of a terminal is updated dynamically.

According to some embodiments of the present invention, the host identification code bit of the address of the first terminal includes a fixed device identification code part and a dynamically updated remaining part.

According to some embodiments of the present invention, the effective address includes a leading bit and a host identification code bit, and the effective address is updated dynamically with the host identification code bit of the effective address every predetermined period.

According to some embodiments of the present invention, the host ID bit of the effective address includes a fixed device ID part and a dynamically updated remaining part.

Another aspect of the present invention is to provide a network communication system, which includes a first terminal and a second terminal. The first terminal is configured to dynamically generate its address and send a connection request message including its address. The second terminal is configured to dynamically generate a valid address and receive a connection request message, and determine whether the address of the first terminal included in the connection request message is a valid address, and if so, send a connection approval message corresponding to the connection request message to the first terminal .

Embodiments of the invention are discussed in detail below. It should be appreciated, however, that the embodiments provide many applicable concepts that can be implemented in a wide variety of specific contexts. The discussed and disclosed embodiments are for illustration only, and are not intended to limit the scope of the present invention.

The terms used herein are only used to describe specific embodiments, and are not intended to limit the scope of patent applications. Unless otherwise limited, the terms "a" or "the" in the singular may also be used in the plural.

As used herein, the term "coupled" may refer to two or more elements in direct physical or electrical contact with each other, or in indirect physical or electrical contact with each other. "Coupled" may also mean that two or more elements interoperate or act.

It can be understood that although terms such as "first" and "second" used herein may be used to describe different elements and/or entities, these elements and/or entities should not be limited by these terms. These terms are only used to distinguish one element and/or entity from other elements and/or entities.

For the sake of simplicity and clear description, element symbols and/or letters may be used repeatedly in various embodiments herein, but this does not mean that there is a causal relationship between the various embodiments and/or configurations discussed.

FIG. 1 is a schematic diagram of a network communication system 100 according to an embodiment of the present invention. The network communication system 100 includes a plurality of terminals 110 and a network 120 . Each terminal 110 may be composed of a single or multiple devices. The network 120 may be, for example, a global area network, a cellular network, a wide area network, a metropolitan area network, a local area network, and/or or personal area network (personal area network), but not limited to. The terminal 110 can access the network 120 through wired and/or wireless means. The network 120 may include a core network and, for example, access points, access points, or others. In addition, the terminal 110 and the network 120 can be connected and communicate with each other through the internet, intranet, extranet or other network technologies according to their types. It should be noted that the network communication system 100 shown in FIG. 1 only takes three as an example, and the network communication system 100 may include more than two terminals, but not limited to three, according to usage requirements.

Each terminal 110 includes a device 112 and a plug-in 114 . The device 112 has a network connection function, and may be, for example, a computer, a smart phone, an industrial machine, a car electronics, a household appliance, etc., but is not limited thereto. The plug-in device 114 is coupled to the device 112 and serves as a medium for the device 112 to communicate with the network 120 . In some embodiments, device 112 and add-on 114 may be integrated into a single entity.

FIG. 2 is a functional block diagram of the external device 114 in FIG. 1 . As shown in FIG. 2 , the plug-in device 114 includes a first interface 202 , an addressing module 204 , an address conversion module 206 , an encryption and decryption module 208 and a second interface 210 . The first interface 202 is coupled to the device 112 that belongs to the same terminal 110 as the plug-in device 114, and is used for receiving the message of the device 112 that includes the address that has not been dynamically updated, and/or for sending the message that includes the restored address The message is sent to device 112 . The addressing module 204 calculates the dynamic address to determine the dynamic addresses of the transmitting end and the receiving end, and provides information of both communication parties of the communication transfer module. In some embodiments, the addressing module 204 can use a hash function including algorithms such as MD5 message digest algorithm or secure hash algorithm (secure hash algorithm) to calculate the dynamic bits of the transmitting end and the receiving end address, but not limited to. In some other embodiments, the addressing module 204 can obtain the dynamic addresses of the transmitting end and the receiving end by referring to a lookup table. The address conversion module 206 can store the dynamic address of the transmitting end and/or the receiving end, and when transmitting a message, according to the dynamic address generated by the addressing module 204, determine whether the address of the device 112 can be used, and/or When receiving a message from another terminal, according to the dynamic address generated by the addressing module 204, it is judged whether the address in the received message is included in the valid dynamic address it accepts. The encryption/decryption module 208 provides the encryption/decryption function of addresses and data. The second interface 210 is coupled to the network 120 and is used for transmitting the message including the dynamic address to the network 120 and/or for receiving the message from the network 120 . The dynamic address generated by the addressing module 204 may be an IP address or other applicable addresses.

In some embodiments, the dynamic address generated by the addressing module 204 has N bits, wherein the first M bits are leading bits (prefix), and the last (N-M) bits are interface identification code bits. The interface identification code bit includes the host identification code bit (host ID) and the extended identification code bit. The content of the host identification code bit corresponds to a specific device, and the content of the extended identification code bit can be based on time or other factors change dynamically. The number of bits of the leading bit, the host identification code bit and the extended identification code bit can be correspondingly adjusted according to actual applications.

FIG. 3 is a flowchart of a method for network communication at a transmitting end according to an embodiment of the present invention. The transmitting end may be any one in FIG. 1 or a specific terminal 110 . The network communication method at the sending end in FIG. 3 can be performed by the plug-in device 114 in the terminal 110 at the sending end, which is described as follows. First, proceed to step S302 to generate the address of the transmitting end. Specifically, the device 112 transmits the connection request message to the plug-in device 114 belonging to the same terminal 110, and then the plug-in device 114 converts the address in the connection request message provided by the device 112 into a dynamic address as the sending end address. Next, step S304 is performed to confirm whether the converted dynamic address can be used. If available, go to step S306 to calculate the target address of the receiving end, and then proceed to step S308, send a connection request message to the receiving end according to the calculated target address of the receiving end; otherwise, proceed to step S310, update dynamic address, and repeat step S304.

Step S312 is to determine whether a response from the receiving end is received within a predetermined time after sending the connection request message. If a response from the receiving end is received within the predetermined time, that is, a connection approval message corresponding to the sent connection request message is received, then proceed to step S314 to complete the communication connection with the receiving end; otherwise, proceed to step S310 to update the dynamic address , and repeat step S304.

FIG. 4 is a flowchart of a method for network communication at a receiving end according to an embodiment of the present invention. The receiving end may be any terminal 110 or a specific terminal 110 in FIG. 1 except the transmitting end. The network communication method at the transmitting end in FIG. 4 can be performed by the plug-in device 114 in the terminal 110 at the receiving end, which is described as follows. Firstly, proceed to step S402, and receive a connection request message from the transmitting end. Next, proceed to step S404 to determine whether the sending end address included in the connection request message is a valid address accepted by the receiving end. If yes, go to step S406, send a connection approval message corresponding to the connection request message to the first terminal; otherwise, go to step S408, ignore the received connection request message, for example, treat the received connection request message as invalid.

It should be noted that both the transmitting end and the receiving end use the same method to obtain the dynamic address, so as to ensure the correctness of judging whether the address is a valid address. For example, if a hash function is used, the type and content of the hash function used by the transmitting end and the receiving end are the same. In addition, in some embodiments, each time the communication between the transmitting end and the receiving end is completed, both the transmitting end and the receiving end dynamically change the address used for the next communication.

In addition, since the addresses of both the transmitting end and the receiving end will change dynamically, the address may change during the message transmission. In view of this, the network communication method of the present invention can use three addresses as the basis for judging whether the communication connection can be completed, which are respectively the address used in the current time slot, the address used in the previous time slot, and the address used in the previous time slot. The address to use for the next slot. If the network communication method uses an address with a leading bit and a host identification code bit, the content of the leading bit and the host identification code bit of these three addresses is the same but the content of the extended identification code bit is different .

FIG. 5 is an example of sending a connection request message from the sender to the receiver. The sender uses addresses Addr1-Addr5 in time slots 1-5 respectively. In FIG. 5 , the transmitting end sends a connection request message including the address Addr2 to the receiving end in time slot 2, and the receiving end receives the connection request message in time slot 2. The receiving end generates effective addresses such as Addr1-Addr3 in time slot 2, and since the address Addr2 in the received connection request message is included in the effective addresses such as Addr1-Addr3, the receiving end judges that the connection request message is a valid message , and then a corresponding connection approval message can be sent to the sender.

FIG. 6 is another example of the sender sending a connection request message to the receiver. The sender uses addresses Addr1-Addr5 in time slots 1-5 respectively. In FIG. 6 , the transmitting end sends a connection request message including the address Addr2 to the receiving end in time slot 2 , and the receiving end receives the connection request message in time slot 3 . The receiving end generates effective addresses such as Addr2-Addr4 in time slot 3, and since the address Addr2 in the received connection request message is included in the effective addresses such as Addr2-Addr4, the receiving end judges that the connection request message is a valid message , and then a corresponding connection approval message can be sent to the sender.

Although the present invention has been disclosed above with the embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field may make some changes and modifications without departing from the spirit and scope of the present invention. The scope of protection of the present invention should be defined by the scope of the appended patent application.

100: Network communication system 110: terminal 112: Equipment 114: External device 120: Network 202: The first interface 204: addressing module 206:Address conversion module 208: Encryption/decryption module 210: the second interface S302: step S304: step S306: step S308: step S310: step S312: step S314: step S402: step S404: step S406: step S408: step

For a more complete understanding of the embodiments and advantages thereof, reference is now made to the following description taken in conjunction with the accompanying drawings, in which: [Fig. 1] is a schematic diagram of a network communication system according to an embodiment of the present invention; [Figure 2] is a functional block diagram of the external device in [Figure 1]; [ FIG. 3 ] is a flowchart of a method for network communication at a transmitting end according to an embodiment of the present invention; [ FIG. 4 ] is a flowchart of a method for network communication at a receiving end according to an embodiment of the present invention; [FIG. 5] is an example of sending a connection request message from the transmitting end to the receiving end; and [FIG. 6] is another example of sending a connection request message from the transmitter to the receiver.

Domestic deposit information (please note in order of depositor, date, and number) none Overseas storage information (please note in order of storage country, institution, date, and number) none

100: Network communication system

110: terminal

112: Equipment

114: External device

120: Network

Claims (9)

A network communication method, comprising: sending a connection request message by a first terminal, the connection request message including the address of the first terminal; and receiving the connection request message by a second terminal, and distinguishing the connection request message Whether the included address of the first terminal is one of at least one valid address accepted by it, if so, send a connection approval message corresponding to the connection request message to the first terminal, otherwise ignore the connection request message ; Wherein, the address of the first terminal and the at least one effective address are dynamically generated, the address of the first terminal is calculated by the first terminal according to an initialization parameter, and the at least one effective address is calculated by the first terminal The second terminal is calculated according to the initialization parameters. The network communication method as described in Claim 1, wherein the address of the first terminal and the at least one valid address are updated every predetermined period. The network communication method as described in claim 2, wherein the at least one valid address is a plurality of valid addresses, and the network communication method further includes: updating the longest among the valid addresses every predetermined period updater. The network communication method as described in Claim 1, wherein the address of the first terminal and the at least one effective address are IP addresses. The network communication method as described in claim 1, wherein the address of the first terminal includes a preamble (prefix) and a host identification code bit (host ID), and the address of the first terminal is The periodic update is the dynamic update of the host identification code bits of the address of the first terminal. The network communication method as described in claim 5, wherein the host identification code bits of the address of the first terminal include a device identification code part, the device identification code part is fixed, and the rest of the host identification code bits for dynamic updates. The network communication method as described in claim 1, wherein each of the at least one effective address includes a leading bit and a host identification code bit, and the address of each of the at least one effective address Updating every predetermined period is a dynamic update of the host identification code bits of each of the at least one valid address. The network communication method as described in claim 7, wherein the host identification code bits of each of the at least one effective address include a device identification code part, the device identification code part is fixed, and the host identification code bits The remainder of the meta is dynamically updated. A network communication system, comprising: a first terminal configured to dynamically generate an address and send a connection request message, the connection request message includes the address of the first terminal, and the first The address of the terminal is calculated by the first terminal according to an initialization parameter; and a second terminal configured to dynamically generate at least one effective address and receive the connection request message, and determine the first terminal included in the connection request message Whether the address of the address is one of the at least one valid address, if so, send a connection approval message corresponding to the connection request message to the first terminal, otherwise ignore the connection request message, wherein the at least one valid address Calculated by the second terminal according to the initialization parameter.

Images