CN112765203B - Internet code number resource management method and device - Google Patents

Abstract

The embodiment of the invention provides an Internet code number resource management method and device. The Internet code number resource management method carries out Internet code number resource management by a mixed deployment block chain mode and an RPKI mode, and the resource management process at least comprises the following steps: if a query request of resource query by a user performing resource allocation in an RPKI mode, a query request of resource query by a user not using the RPKI mode for resource management and not joining the blockchain system, or a query request of resource query by a user joining the blockchain system are received, user verification is performed according to a verification mode corresponding to a sending user of the query request, and after verification is passed, the query request is responded; and when a resource application request sent by a target user joining the blockchain system is received, responding to the resource application request. The scheme can realize the credible interaction of resource information of various management mechanisms in the evolution deployment from a centralized code number resource management mechanism to a distributed code number resource management mechanism.

Description

A method and device for Internet code number resource management

technical field

The invention belongs to the technical field of the Internet, and in particular relates to an Internet number resource management method and device.

Background technique

Under the current Internet system, the allocation of Internet number resources is carried out in a hierarchical system. The topmost layer is the IANA Internet Assigned Numbers Authority (Internet Assigned Numbers Authority), and the next layer of IANA is the RIR (Regional Internet Registry, Regional Internet Registry). There are some registration agencies under RIR, such as: NIR (National Internet Registry, national Internet registration management agency) and LIR (Local Internet Registry, general regional registration agency)). These registries obtain Internet code number resources from the upper-level RIRs, which can be used by themselves or continue to be distributed to lower levels, forming a hierarchical tree structure.

In order to enable the autonomous network to judge the correctness of the received routing information, prevent malicious attackers from forging BGP (Border Gateway Protocol, Border Gateway Protocol) information to carry out prefix hijacking, thereby ensuring data security, in the prior art, in the above On the basis of the Internet number resource allocation method, the RPKI (Resource Public Key Infrastructure) method is used. The RPKI method is specifically a certificate issuance method corresponding to the above-mentioned Internet number resource allocation method.

However, since the structural system based on the RPKI method is a centralized structural system, if a certain organization in the tree structure revokes the certificate, the certificates of all subtrees under the organization will become invalid. In order to deal with the shortcomings of the RPKI method, the centralized code number resource management mechanism needs to evolve and deploy to the distributed code number resource management mechanism, for example: combining RPKI and blockchain systems to realize the management of code number resources. Then, how to realize the evolution and deployment of centralized code number resource management mechanism to distributed code number resource management mechanism, multiple management mechanisms can trust and exchange resource information is an urgent problem to be solved.

Contents of the invention

The purpose of the embodiments of the present invention is to provide a method and device for Internet code number resource management, so as to realize the trusted exchange of resource information of multiple management mechanisms during the evolution deployment of the centralized code number resource management mechanism to the distributed code number resource management mechanism . The specific technical scheme is as follows:

An embodiment of the present invention provides a method for managing Internet number resources, which is applied to a blockchain system; the method includes:

Obtain a first query request sent by a first user; wherein, the first user is a user who uses the RPKI method for resource management, and the first query request carries the RPKI resource obtained by the first user Certificate and first query requirements information about address authorization relationship;

Authenticating the identity of the first user by judging whether the RPKI resource certificate carried in the first query request is a legal certificate;

If the authentication is passed, based on the target address authorization relationship about the IP prefix and the autonomous system number ASN recorded by the bookkeeping node of the blockchain system, feedback information matching the first query requirement information is fed back to the first user. Query the result, and extract the address authorization relationship from the RPKI resource certificate carried in the first query request, and update the target authorization relationship in the accounting node based on the extracted address authorization relationship.

Optionally, the method also includes:

Obtain a second query request sent by a second user; the second user is a user who has not used the RPKI method for resource management and has not joined the blockchain system, and the second query request carries the first 2. The user's own address authorization relationship and the second query requirement information about the address authorization relationship;

Authenticating the identity of the second user by using the address authorization relationship carried in the second query request;

If the authentication is passed, feed back the query result matching the second query requirement information to the second user, and update the account in the accounting node based on the address authorization relationship carried in the second query request. Target address authorization relationship;

Wherein, using the address authorization relationship carried in the second query request to authenticate the identity of the second user includes:

If the target address authorization relationship records an authorization relationship that is the same as the IP prefix of the address authorization relationship carried in the second query request and has a different ASN, it is determined that the identity authentication of the second user has not passed; otherwise, it is determined that The identity authentication of the second user passes.

Optionally, the method also includes:

Obtain a third query request sent by a third user; the third user is a user who joins the blockchain system, and the third query request carries the information sent by the blockchain system to the third user The key certificate, and the third query requirement information about the address authorization relationship;

Authenticating the identity of the third user by using the key certificate carried in the third query request;

If the authentication is passed, the query result matching the third query requirement information carried in the third query request is fed back to the third user.

Optionally, the method also includes:

When receiving a resource application request sent by a target user joining the blockchain system, the identity of the target user is authenticated based on the key certificate carried in the resource application request; wherein, the resource application request The key certificate carried in is the certificate issued by the blockchain system, and the resource application request also carries resource demand information;

If the authentication is passed, when the code number resources managed by the blockchain system meet the resource requirement information, it is determined that the resource requirement information matches the resource requirement information from the code number resources managed by the blockchain system The target code resource of is used as a user resource;

Feedback the user resource to the target user, so that the target user can obtain the user resource, and establish the target user's own resource for the code number resource that the target user needs to use in the user resource and record the established address authorization relationship in the target address authorization relationship of the accounting node.

Optionally, the code number resources managed by the blockchain system include resources to be allocated reported by the fourth user; the fourth user is a user who uses the RPKI method for resource management, and the resources to be allocated are code number resources not used by the fourth user itself;

Correspondingly, when the target user is the next-level user of the fourth user, when the code number resource managed by the blockchain system satisfies the resource requirement information, from the blockchain system Among the managed code number resources, determine the target code number resources that match the resource requirement information as user resources, including:

When the resource to be allocated reported by the fourth user satisfies the resource requirement information, determine a code number resource that matches the resource requirement information from the code number resource to be allocated reported by the fourth user, as the user resource.

In the second aspect, the embodiment of the present invention provides an Internet code number resource management device, which is applied to a blockchain system; the device includes:

The first acquisition module is configured to acquire a first query request sent by a first user; wherein, the first user is a user who uses the RPKI method for resource management, and the first query request carries the first The RPKI resource certificate obtained by the user and the first query requirement information about the address authorization relationship;

A first authentication module, configured to authenticate the identity of the first user by judging whether the RPKI resource certificate carried in the first query request is a legal certificate;

The first processing module is configured to, if the authentication is passed, based on the target address authorization relationship recorded by the bookkeeping node of the blockchain system with respect to the IP prefix and the autonomous system number ASN, to feed back the information related to the second user to the first user. A query result matching the requirement information, extracting an address authorization relationship from the RPKI resource certificate carried in the first query request, and updating the target authorization relationship in the billing node based on the extracted address authorization relationship .

Optionally, the device also includes:

The second acquisition module is configured to acquire a second query request sent by a second user; the second user is a user who has not used the RPKI method for resource management and has not joined the blockchain system, and the second query The request carries the address authorization relationship of the second user itself and the second query requirement information about the address authorization relationship;

A second authentication module, configured to authenticate the identity of the second user by using the address authorization relationship carried in the second query request;

The second processing module is configured to feed back a query result matching the second query requirement information to the second user if the authentication is passed, and update the address authorization relationship carried in the second query request to the second user. The target address authorization relationship in the accounting node;

Wherein, using the address authorization relationship carried in the second query request to authenticate the identity of the second user includes:

If the target address authorization relationship records an authorization relationship that is the same as the IP prefix of the address authorization relationship carried in the second query request and has a different ASN, it is determined that the identity authentication of the second user has not passed; otherwise, it is determined that The identity authentication of the second user passes.

Optionally, the device also includes:

The third obtaining module is used to obtain a third query request sent by a third user; the third user is a user who joins the block chain system, and the third query request carries information under the block chain system The key certificate issued to the third user, and the third query requirement information about the address authorization relationship;

A third authentication module, configured to authenticate the identity of the third user by using the key certificate carried in the third query request;

The third processing module is configured to feed back to the third user a query result that matches the third query requirement information carried in the third query request if the authentication is passed.

Optionally, the device also includes:

The fourth authentication module is used to authenticate the identity of the target user based on the key certificate carried in the resource application request when receiving the resource application request sent by the target user joining the blockchain system; Wherein, the key certificate carried in the resource application request is a certificate issued by the blockchain system, and the resource application request also carries resource demand information;

The fourth processing module is used to determine from the code number resources managed by the blockchain system when the code number resources managed by the blockchain system meet the resource requirement information if the authentication is passed. The target code number resources matching the resource requirement information are used as user resources;

An information feedback module, configured to feed back the user resources to the target user, so that the target user can obtain the user resources, and for the code number resources that the target user needs to use in the user resources, Establishing the address authorization relationship of the target user itself, and recording the established address authorization relationship in the target address authorization relationship of the billing node.

Optionally, the code number resources managed by the blockchain system include resources to be allocated reported by the fourth user; the fourth user is a user who uses the RPKI method for resource management, and the resources to be allocated are code number resources not used by the fourth user itself;

Correspondingly, when the target user is the next-level user of the fourth user, when the code number resources managed by the blockchain system meet the resource requirement information, the fourth processing module Among the code number resources managed by the blockchain system, determine the target code number resources that match the resource demand information as user resources, including:

When the resource to be allocated reported by the fourth user satisfies the resource requirement information, determine a code number resource that matches the resource requirement information from the code number resource to be allocated reported by the fourth user, as the user resource.

Beneficial effects of the embodiments of the present invention:

This solution manages Internet code number resources through the mixed deployment of blockchain and RPKI. In the process of resource management, users who use RPKI to allocate resources can pass the verification of the blockchain system. Make a resource query. In the case of mixed deployment of blockchain and RPKI, users who use RPKI to allocate resources can conduct credible resource queries through the blockchain. Therefore, this solution can be implemented in the centralized code number resource management mechanism In the evolution and deployment of the distributed code number resource management mechanism, multiple management mechanisms can trust and exchange resource information.

Of course, implementing any product or method of the present invention does not necessarily need to achieve all the above-mentioned advantages at the same time.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flow diagram of a method for managing Internet code number resources provided by an embodiment of the present invention;

Fig. 2 is the schematic diagram of resource management of the block chain system provided by the embodiment of the present invention;

Fig. 3 is a schematic structural diagram of an Internet code number resource management device provided by an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

In order to realize the trusted exchange of resource information of multiple management mechanisms during the evolution and deployment of the centralized code number resource management mechanism to the distributed code number resource management mechanism, the embodiment of the present invention provides an Internet code number resource management method and device.

Among them, the Internet code number resource management method provided by the embodiment of the present invention is applied to the block chain system, and each RIR is added to the block chain system, as well as the organizations at all levels responsible for each RIR; wherein, the RIR Responsible institutions at all levels may include: NIR, ISP (Internet Service Provider, Internet Service Provider), etc. It can be understood that blockchain technology uses block chain data structure to verify and store data, uses distributed node consensus algorithm to generate and update data, uses cryptography to ensure the security of data transmission and access, and utilizes automated A new distributed infrastructure and computing method that uses smart contracts composed of script code to program and manipulate data. The block chain system of the embodiment of the present invention is a system using block chain technology. The block chain system includes three types of nodes: endorsement nodes, bookkeeping nodes, and ordering nodes. Among them, the endorsement nodes are used to execute smart contracts. Nodes, through the execution of smart contracts, endorsement nodes can process various requests received by the blockchain system; sorting nodes are nodes used to sort operations; accounting nodes are nodes used to implement data storage; among them, the so-called A smart contract is a computer program deployed on an endorsement node, which automatically executes some pre-defined rules and terms based on some credible and non-tamperable data.

In the embodiment of the present invention, any RIR is an alliance of the alliance chain. In this way, the blockchain system is a blockchain system composed of multiple alliances, and the number of alliances is the same as the number of RIRs joining the blockchain system. In addition, since the distribution of the existing RIRs includes five regional Internet registries, when the RIRs of the five regional Internet registries are all added to the blockchain system, the blockchain system consists of five alliances , corresponding to 5 RIRs, each alliance has blockchain nodes, and all blockchain nodes form a blockchain system.

Among them, the five regional Internet registries assign IP prefixes and AS (Autonomous System, Autonomous System) numbers to the Internet in a hierarchical manner; and, the five regional Internet registries can include: RIPE (Reseaux IP Europeans, European IP Address Registration Center), LACNIC (Lation American and Caribbean Internet Address Registry, Latin American and Caribbean Internet Address Registration Center), ARIN (American Registry for Internet Numvers, American Internet Number Registration Center), AFRINIC (Africa Network Information Centre, Africa Network Information Center), and APNIC (Asia Pacific Network Information Centre, Asia Pacific Address Network Information Center).

In addition, when any user, such as an ISP user or an Enduser user (end user), etc., wishes to join the blockchain system, the user can authenticate to the blockchain system, and obtain access qualifications after passing the authentication. , the identity information of the user is recorded in the accounting node, and the identity information may include: identification information, network address, obtained Internet number resources, allocated network Internet number resources, access qualification certificates, etc. Moreover, any user who joins the blockchain system can obtain a certificate as a certificate of admission qualification: the key certificate issued by the blockchain system for identity authentication, and the communication certificate for communication authentication, so that This allows the blockchain system to manage identity authentication and communication security for each user, wherein the communication certificate used for communication authentication can be a TLS (TransportLayer Security, Transport Layer Security) certificate. It can be understood that in the embodiment of the present invention, the key certificate used for identity authentication and the communication certificate used for communication authentication are in the same form as the certificates obtained by users who join any blockchain in the prior art .

Moreover, when deploying the blockchain system, blockchain nodes can be deployed for the RIR that joins the blockchain system, of course, it does not need to be deployed; blockchain nodes can be deployed for institutions at all levels under the RIR, of course, also Can not be deployed. In addition, the entire blockchain system includes several blockchain nodes, and each blockchain node can be a node deployed for a RIR or a node deployed for a lower-level organization responsible for a RIR.

As shown in Figure 1, a method for managing Internet code number resources provided by an embodiment of the present invention may include the following steps:

S101. Acquire a first query request sent by a first user; wherein, the first user is a user who uses the RPKI method for resource management, and the first query request carries the information obtained by the first user. RPKI resource certificate and the first query requirement information about the address authorization relationship;

Since users who obtain Internet code number resources based on RPKI, such as ISP users and Enduser users, may have query requirements, the blockchain system can obtain Internet resources from nodes outside the chain based on RPKI based on blockchain. For users of code number resources, a query interface is provided.

Moreover, since users who belong to out-of-chain nodes and obtain network resources based on RPKI can obtain RPKI resource certificates during resource allocation, the RPKI resource certificates can verify the validity of their identities. Therefore, in this embodiment, the first user, that is, belongs to Users who are nodes outside the chain and obtain network resources based on RPKI can send a first query request to the blockchain system when they need to query the address authorization relationship. The first query request carries the information obtained by the first user. RPKI resource certificate and first query requirement information about address authorization relationship. Wherein, the first query requirement information is information to be queried. Exemplarily, the first query requirement information may include an IP prefix to be queried or an ASN to be queried.

S102. Authenticate the identity of the first user by judging whether the RPKI resource certificate carried in the first query request is a legal certificate;

Among them, the blockchain system can judge whether the RPKI resource certificate carried in the first query request is a legal certificate according to the existing authentication method on whether the RPKI resource certificate is valid; certified. It can be understood that when the RPKI resource certificate carried in the first query request is a legal certificate, it can be determined that the identity authentication of the first user has passed, and when the RPKI resource certificate carried in the first query request is not a legal certificate , it can be determined that the identity authentication of the first user fails.

S103, if the authentication is passed, based on the target address authorization relationship recorded by the bookkeeping node of the blockchain system about the IP prefix and the autonomous system number ASN, feed back to the first user the information corresponding to the first query requirement matching query results, extracting an address authorization relationship from the RPKI resource certificate carried in the first query request, and updating the target authorization relationship in the accounting node based on the extracted address authorization relationship.

If the authentication is passed, the blockchain system can feed back to the first user the information carried in the first query request based on the target address authorization relationship of the IP prefix and the autonomous system number ASN recorded by the bookkeeping node of the blockchain system. The query result matching the first query requirement information, and extracting the address authorization relationship from the RPKI resource certificate carried in the first query request, and updating the target authorization relationship in the billing node based on the extracted address authorization relationship, That is, the extracted address authorization relationship is recorded in the target address authorization relationship of the bookkeeping node in the blockchain system. Wherein, the first query requirement information may include the IP prefix to be queried or the ASN to be queried. At this time, the blockchain system may feed back the address authorization relationship including the IP prefix to be queried or the address authorization relationship including the ASN to be queried.

Among them, the target address authorization relationship can be represented in the form of IP-ASN, and the target address authorization relationship in the accounting node can facilitate the tracking and query of the allocated code number resources.

Wherein, the manner of extracting the address authorization relationship from the RPKI resource certificate carried in the first query request may refer to the prior art, which is not limited in the embodiment of the present invention.

In order to facilitate the understanding of the solution, Figure 2 shows the schematic diagram of the resource management of the blockchain system. Specifically: any user can join the blockchain system through identity registration, and when joining the blockchain system, the blockchain system can issue a key certificate for identity authentication to the user, The user can apply for resources and query data to the blockchain system based on the key certificate; in addition, any user can obtain network resources through RPKI, so that the user can query data based on the RPKI database; When the user wants to query data in the blockchain system, he can use the RPKI resource certificate to query the data in the blockchain system.

This solution manages Internet code number resources through the mixed deployment of blockchain and RPKI. In the process of resource management, users who use RPKI to allocate resources can pass the verification of the blockchain system. Make a resource query. In the case of mixed deployment of blockchain and RPKI, users who use RPKI to allocate resources can conduct credible resource queries through the blockchain. Therefore, this solution can be implemented in the centralized code number resource management mechanism In the evolution and deployment of the distributed code number resource management mechanism, multiple management mechanisms can trust and exchange resource information.

Since users who obtain network resources based on RPKI and methods other than the blockchain system may also have query requirements, the blockchain system can provide such users with a query interface. On the basis of the above embodiments, in another embodiment of the present invention, the Internet number resource management method may also include A1-A3:

Step A1, obtain the second query request sent by the second user; the second user is a user who has not used RPKI for resource management and has not joined the blockchain system, and the second query request carries the second user himself The address authorization relationship and the second query requirement information about the address authorization relationship;

Although the second user does not use the RPKI method for resource management and has not joined the blockchain system, the second user does not have the RPKI resource certificate and the key certificate issued by the blockchain system. Then, for data security, the second user's identity can be authenticated based on the second user's own second address authorization relationship, and when the authentication is passed, the second user's query requirement can be responded to. Wherein, the address authorization relationship of the second user itself is the authorization relationship between the IP prefix used by the second user itself and the ASN.

Step A2, using the address authorization relationship carried in the second query request to authenticate the identity of the second user;

Wherein, using the address authorization relationship carried in the second query request to authenticate the identity of the second user includes:

If the target address authorization relationship records an authorization relationship that is the same as the IP prefix of the address authorization relationship carried in the second query request and has a different ASN, it is determined that the identity authentication of the second user has not passed; otherwise, it is determined that the The identity authentication of the second user is passed.

It can be understood that if in the target address authorization relationship between the IP prefix and the ASN recorded by the bookkeeping node of the blockchain system, the IP prefix recorded in the address authorization relationship with the second user is the same as that of the second user's address If the ASN of the authorization relationship is different, it indicates that the address authorization relationship of the second user is inconsistent with the address authorization relationship recorded in the blockchain system. At this time, it can be determined that the identity authentication of the second user has not passed, that is, the second The user's identity is invalid.

Step A3, if the authentication is passed, feed back the query result matching the second query requirement information to the second user, and update the account information in the accounting node based on the address authorization relationship carried in the second query request. The target address authorization relationship of ;

In order to further enrich the address authorization relationship recorded by the bookkeeping nodes in the blockchain system, if the authentication is passed, the blockchain system can feed back to the second user that it matches the second query requirement information carried by the second query request , and record the address authorization relationship of the second user in the target address authorization relationship of the accounting node. It can be understood that if neither the IP prefix nor the ASN in the address authorization relationship of the second user appears in each address authorization relationship in the blockchain system, the second user will be judged as having passed the identity authentication. Therefore, In order to avoid that the IP prefix and ASN in the address authorization relationship of the second user do not actually belong to the legal authorization relationship, the credibility of the address authorization relationship of the second user recorded in the accounting node can be marked, and the marked is a low confidence level.

In this solution, due to the mixed deployment of blockchain and RPKI, users who use RPKI to allocate resources and users who obtain network resources based on methods other than RPKI and blockchain systems can all use the district The block chain conducts credible resource query. Therefore, this scheme can realize the evolution and deployment of the centralized code number resource management mechanism to the distributed code number resource management mechanism. Multiple management mechanisms can trust and exchange resource information, and this scheme is in There are many types of management mechanisms involved in resource management, making it applicable to a wide range of resource management scenarios.

On the basis of any of the above embodiments, in another embodiment of the present invention, the Internet number resource management method may also include Step B1-Step B3:

Step B1, obtain a third query request sent by a third user; the third user is a user who joins the blockchain system, and the third query request carries the information sent by the blockchain system to the The key certificate of the third user, and the third query requirement information about the address authorization relationship;

Among them, the third user who has obtained the access certificate in advance can send a third query request to the blockchain system when it needs to query whether certain address authorization relationships are legal; the third query request carries information for identity authentication and information to be requested.

In addition, when the first user and the second user query resources, the blockchain system will be based on the address authorization relationship in the RPKI resource certificate of the first user and the address authorization relationship carried in the second query request sent by the second user. , updating the target authorization relationship in the accounting node, so that the target authorization relationship includes the address authorization relationship of the first user and the second user, and at this time, the target authorization relationship is enriched. Then, the third user can query the address authorization relationship of various users from the target authorization relationship.

Step B2, using the key certificate carried in the third query request to authenticate the identity of the third user;

Step B3, if the authentication is passed, feeding back to the third user a query result that matches the third query requirement information carried in the third query request.

Wherein, the blockchain system utilizes the key certificate carried in the third query request to authenticate the identity of the third user for a specific implementation method that can refer to any identity authentication method of a network system using blockchain in the prior art, This embodiment of the present invention does not limit this.

After the identity authentication is passed, it indicates that the third user has the query authority. At this time, the blockchain system can feed back the information carried by the third query request to the third user based on the authorization relationship of the target address recorded in the accounting node. The third query is the query result matching the demand information. Wherein, the third query requirement information may include the IP prefix to be queried or the ASN to be queried. At this time, the blockchain system may feed back the address authorization relationship including the IP prefix to be queried or the address authorization relationship including the ASN to be queried.

In this solution, due to the mixed deployment of blockchain and RPKI methods, users who use RPKI to allocate resources and users who obtain network resources based on methods other than the blockchain system can all use the blockchain. Therefore, this solution can realize the trusted exchange resource information of multiple management mechanisms in the evolution deployment of centralized code number resource management mechanism to distributed code number resource management mechanism.

In another embodiment of the present invention, an Internet number resource management method may also include step C1-step C3:

Step C1, when receiving a resource application request sent by a target user joining the blockchain system, authenticate the identity of the target user based on the key certificate carried in the resource application request; wherein, the The key certificate carried in the resource application request is the certificate issued by the blockchain system, and the resource application request also carries resource demand information;

When the target users who join the blockchain system request resources, they can allocate resources based on the blockchain method, and the resources allocated based on the blockchain method are code number resources managed by the blockchain system. Exemplarily, in a specific application, the target user may be an ISP user, or an Enduser user (terminal user), and so on.

Wherein, the target user can request the Internet code number resource through a resource application request, and the Internet code number resource requested by the target user can be used by itself, or allocated to other users. For example, user1 applies for an address prefix 2f00:0000::/32, and at the same time applies for an AS number 12345, then user1 assigns 2f00:0000:0001::/48 to user2, and uses AS number 12345 and 2f00:0000:0002 at the same time /48 creates a correspondence.

In addition, the Internet code number resource requested by the resource application request may include: an IP prefix and an ASN (Autonomous System Number, autonomous system number), or may only include: an IP prefix. Moreover, the resource requirement information may include: resource data volume and resource type, or only resource type. In addition, those skilled in the art can understand that the resource requirement information may also include resource usage time limit. Exemplarily, the resource application request includes N ₁ IP prefixes to be allocated with a use time limit of 1 year and N ₂ ASNs with a use time limit of 2 years.

In addition, it can be understood that in the Internet, an AS refers to the entirety of all IP networks and routers under the jurisdiction of one or more entities, and they implement a common routing strategy for Internet website design. Moreover, ASNs are allocated in batches by the Internet Address Assignment Agency to various regional Internet registration agencies, and then they assign an ASN to each entity from the entire batch of ASNs, and entities wishing to obtain ASNs must be assigned according to the region to which they belong. An ASN will not be assigned until the application is approved.

In addition, when a resource application request is received, the blockchain system can authenticate the identity of the target user based on the key certificate carried in the resource application request according to the authentication method in the prior art, that is, authenticate the target user Whether it is a user who has obtained the access qualification. It can be understood that the resource application request may also carry a communication certificate, and the communication security is authenticated through the communication certificate.

If the authentication is passed, the blockchain system can execute step C2, and if the authentication is not passed, the process can be ended or the target user can be fed back with prompt information indicating that the authentication has not passed.

Step C2, if the authentication is passed, when the code number resources managed by the blockchain system meet the resource requirement information, determine the resource requirements from the code number resources managed by the blockchain system The target code number resources that match the information are used as user resources;

If the identity authentication of the target user is passed, when the code number resource managed by the blockchain system satisfies the resource requirement information, the blockchain system can use the code number resource managed by the blockchain system to , determine the target code number resource matching the resource requirement information as the user resource. It can be understood that if the resource requirement information only includes resource types, the code number resources managed by the blockchain system meet the resource requirement information specifically refers to: the code number resources managed by the blockchain system The resource type includes the resource type requested in the resource requirement information; if the resource requirement information includes the resource type and the resource requirement, the code number resources managed by the blockchain system meet the requirements specified in the resource requirement information. : The resource type of code number resources managed by the blockchain system includes the resource type requested in the resource requirement information, and the code number resources managed by the blockchain system belong to the requested resource type The amount of resource data is greater than the amount of resources requested in the resource requirement information.

Moreover, if the resource requirement information only includes the resource type, then from the code number resources managed by the blockchain system, determining the target code number resources that match the resource requirement information specifically refers to: from the blockchain system Among the code number resources managed, network resources belonging to the resource type requested by the resource requirement information are determined. Similarly, if the resource requirement information includes the resource type and resource requirement, then from the code number resources associated with the blockchain system, determine the target code number resource that matches the resource requirement information. Specifically refers to: from the blockchain system The code number resource managed by the system determines the target code number resource belonging to the resource type requested by the resource demand information and the resource demand quantity requested by the resource demand information. It should be noted that from the code number resources managed by the blockchain system, which resource allocation method is used specifically to determine the target code number resources that match the resource demand information can be set in advance. The embodiment of the present invention There is no limit to this.

Exemplarily, if the code number resources managed by the blockchain system include 300 IP prefixes and 200 ASNs, and the resource requirement information includes: 10 IP prefixes and 20 AS numbers, then from 300 IP prefixes and 200 ASNs , assign 10 IP prefixes and 20 ASNs to target users.

Step C3, feeding back the user resource to the target user so that the target user can obtain the user resource, and establishing the The address authorization relationship of the target user itself, and record the established address authorization relationship in the target address authorization relationship of the accounting node.

If the target user is an ISP user, if there are code number resources that the target user needs to use in the obtained user resources, an address authorization relationship can be established for the code number resources that the target user needs to use; and, since the ISP node can As the resource distributor of the next-level organization, the target user can use the obtained user resources, except the code number resources that they need to use, as the code number resources to be allocated, so as to carry out Internet code number resources for the next-level organization. No. resource allocation.

If the target user is an Enduser user (terminal user), since the target user is not a distributor of Internet code number resources, after the target user obtains the user resource, the user resource is used as the code number resource that the target user needs to use. Furthermore, the target user may establish an address authorization relationship with respect to the user resource.

In addition, it is understandable that after the blockchain system allocates user resources to target users, the user resources stored in the blockchain system will be characterized from the original occupied state to the occupied state, so that the block The chain system can accurately determine the remaining currently available target code number resources, which is convenient for the next allocation.

In addition, when the blockchain system allocates user resources to target users, it can also set a usage time limit in the resource demand information for user resources, so that the allocated user resources can be recycled after expiration, or, when the target user resources are about to expire, the target The user reminds in advance, so that the target user can make preparations for renewal or unsubscription in advance.

It should be noted that the code number resources managed by the above-mentioned blockchain system include the code number resources manually set in the blockchain system in advance, and the resources to be allocated reported by users who use RPKI for resource management; among them, the code number resources to be allocated Resources are code number resources requested by users using RPKI for resource management but not used by themselves. It is understandable that when the blockchain system is established, the code number resources managed by the blockchain system can only include the code number resources manually set in the blockchain system in advance, and users who subsequently use RPKI for resource management can report the code number resources. Number resources, so that the code number resources managed by the blockchain system include both manually given code number resources and code number resources reported by users. Exemplarily, in an implementation manner, the code number resources managed by the blockchain system include resources to be allocated reported by the fourth user, the fourth user is a user who uses RPKI for resource management, and the resources to be allocated It is a code number resource not used by the fourth user itself; in this implementation, the fourth user can allocate resources to the next-level users through the block chain. Correspondingly, when the target user is the next-level user of the fourth user, when the code number resource managed by the blockchain system satisfies the resource requirement information, from the blockchain system Among the managed code number resources, determine the target code number resources that match the resource requirement information as user resources, including:

When the resource to be allocated reported by the fourth user satisfies the resource requirement information, determine a code number resource that matches the resource requirement information from the code number resource to be allocated reported by the fourth user, as the user resource.

It can be understood that, in an implementation manner, the fourth user may report the resources to be allocated to the blockchain system when sending a query request to the blockchain system. Exemplarily, the resources to be allocated may be carried in the RPKI resource Of course, the certificate is not limited to this; in another implementation mode, when it is necessary to report the resources to be allocated, the fourth user can send a resource allocation request carrying the resources to be allocated and the RPKI resource certificate to the blockchain system, in order to After the block chain system passes the identity authentication of the fourth user by using the RPKI resource certificate in the resource allocation request, it saves the resources to be allocated in the resource allocation request.

It can be seen that this scheme can realize the evolution and deployment of centralized code number resource management mechanism to distributed code number resource management mechanism, and multiple management mechanisms can trust and exchange resource information; moreover, through this scheme, effective blockchain-based system resource allocation.

Corresponding to the above method embodiment, the embodiment of the present invention also provides an Internet number resource management device; as shown in Figure 3, the device includes:

The first obtaining module 310 is configured to obtain a first query request sent by a first user; wherein, the first user is a user who uses the RPKI method for resource management, and the first query request carries the first query request The RPKI resource certificate obtained by the user and the first query requirement information about the address authorization relationship;

The first authentication module 320 is configured to authenticate the identity of the first user by judging whether the RPKI resource certificate carried in the first query request is a valid certificate;

The first processing module 330 is configured to, if the authentication is passed, based on the target address authorization relationship recorded by the accounting node of the blockchain system with respect to the IP prefix and the autonomous system number ASN, to feed back the information related to the first user to the first user. First query the query result matching the requirement information, and extract the address authorization relationship from the RPKI resource certificate carried in the first query request, and update the target authorization in the accounting node based on the extracted address authorization relationship relation.

This solution manages Internet code number resources through the mixed deployment of blockchain and RPKI. In the process of resource management, users who use RPKI to allocate resources can pass the verification of the blockchain system. Make a resource query. In the case of mixed deployment of blockchain and RPKI, users who use RPKI to allocate resources can conduct credible resource queries through the blockchain. Therefore, this solution can be implemented in the centralized code number resource management mechanism In the evolution and deployment of the distributed code number resource management mechanism, multiple management mechanisms can trust and exchange resource information.

In an embodiment of the present invention, the device provided in the embodiment of the present invention may also include:

The second acquisition module is configured to acquire a second query request sent by a second user; the second user is a user who has not used the RPKI method for resource management and has not joined the blockchain system, and the second query The request carries the address authorization relationship of the second user itself and the second query requirement information about the address authorization relationship;

A second authentication module, configured to authenticate the identity of the second user by using the address authorization relationship carried in the second query request;

The second processing module is configured to feed back a query result matching the second query requirement information to the second user if the authentication is passed, and update the address authorization relationship carried in the second query request to the second user. The target address authorization relationship in the accounting node;

Wherein, using the address authorization relationship carried in the second query request to authenticate the identity of the second user includes:

If the target address authorization relationship records an authorization relationship that is the same as the IP prefix of the address authorization relationship carried in the second query request and has a different ASN, it is determined that the identity authentication of the second user has not passed; otherwise, it is determined that The identity authentication of the second user passes.

In an embodiment of the present invention, the device provided in the embodiment of the present invention may also include:

The third obtaining module is used to obtain a third query request sent by a third user; the third user is a user who joins the block chain system, and the third query request carries information under the block chain system The key certificate issued to the third user, and the third query requirement information about the address authorization relationship;

A third authentication module, configured to authenticate the identity of the third user by using the key certificate carried in the third query request;

The third processing module is configured to feed back to the third user a query result that matches the third query requirement information carried in the third query request if the authentication is passed.

In an embodiment of the present invention, the device also includes:

The fourth authentication module is used to authenticate the identity of the target user based on the key certificate carried in the resource application request when receiving the resource application request sent by the target user joining the blockchain system; Wherein, the key certificate carried in the resource application request is a certificate issued by the blockchain system, and the resource application request also carries resource demand information;

The fourth processing module is used to determine from the code number resources managed by the blockchain system when the code number resources managed by the blockchain system meet the resource requirement information if the authentication is passed. The target code number resources matching the resource requirement information are used as user resources;

An information feedback module, configured to feed back the user resources to the target user, so that the target user can obtain the user resources, and for the code number resources that the target user needs to use in the user resources, Establishing the address authorization relationship of the target user itself, and recording the established address authorization relationship in the target address authorization relationship of the billing node.

In an embodiment of the present invention, the code number resources managed by the blockchain system include resources to be allocated reported by the fourth user; the fourth user is a user who uses the RPKI method for resource management, so The resource to be allocated is a code number resource not used by the fourth user itself;

Correspondingly, when the target user is the next-level user of the fourth user, when the code number resources managed by the blockchain system meet the resource requirement information, the fourth processing module Among the code number resources managed by the blockchain system, determine the target code number resources that match the resource demand information as user resources, including:

When the resource to be allocated reported by the fourth user satisfies the resource requirement information, determine a code number resource that matches the resource requirement information from the code number resource to be allocated reported by the fourth user, as the user resource.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. There is no such actual relationship or order between them. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

Each embodiment in this specification is described in a related manner, the same and similar parts of each embodiment can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for relevant parts, refer to part of the description of the method embodiment.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present invention are included in the protection scope of the present invention.

Claims (8)

1. The Internet code number resource management method is characterized by being applied to a block chain system; the method comprises the following steps:

acquiring a first query request sent by a first user; the first user is a user performing resource management in an RPKI mode, and the first query request carries an RPKI resource certificate acquired by the first user and first query requirement information about an address authorization relationship;

authenticating the identity of the first user by judging whether the RPKI resource certificate carried by the first query request is a legal certificate or not;

If the authentication is passed, feeding back a query result matched with the first query requirement information to the first user based on a target address authorization relationship recorded by an accounting node of the blockchain system and related to an IP prefix and an ASN (autonomous system number), extracting an address authorization relationship from an RPKI resource certificate carried by the first query request, and updating the target address authorization relationship in the accounting node based on the extracted address authorization relationship;

acquiring a second query request sent by a second user; the second user is a user which does not use the RPKI mode to carry out resource management and does not join the blockchain system, and the second query request carries the address authorization relationship of the second user and second query requirement information about the address authorization relationship;

authenticating the identity of the second user by using the address authorization relationship carried by the second query request;

if the authentication is passed, feeding back a query result matched with the second query requirement information to the second user, and updating the target address authorization relationship in the accounting node based on the address authorization relationship carried in the second query request;

The step of authenticating the identity of the second user by using the address authorization relationship carried by the second query request includes:

if the target address authorization relationship records the authorization relationship which is the same as the IP prefix of the address authorization relationship carried by the second inquiry request and different from the ASN, judging that the identity authentication of the second user is not passed; otherwise, judging that the identity authentication of the second user passes.

2. The method according to claim 1, wherein the method further comprises:

acquiring a third query request sent by a third user; the third user is a user joining the blockchain system, and the third query request carries a key certificate issued to the third user by the blockchain system and third query requirement information about an address authorization relationship;

authenticating the identity of the third user by using a key certificate carried in the third inquiry request;

and if the authentication is passed, feeding back a query result matched with the third query requirement information carried by the third query request to the third user.

3. The method according to claim 1 or 2, characterized in that the method further comprises:

When a resource application request sent by a target user joining the blockchain system is received, authenticating the identity of the target user based on a key certificate carried in the resource application request; the key certificate carried in the resource application request is a certificate issued by the blockchain system, and the resource application request also carries resource demand information;

if the authentication is passed, when the code number resource managed by the block chain system meets the resource demand information, determining a target code number resource matched with the resource demand information from the code number resource managed by the block chain system as a user resource;

and feeding back the user resource to the target user so that the target user obtains the user resource, establishing an address authorization relationship of the target user according to the code number resource required to be used by the target user in the user resource, and recording the established address authorization relationship in the target address authorization relationship of the accounting node.

4. The method of claim 3 wherein the code number resources managed by the blockchain system include resources to be allocated reported by a fourth user; the fourth user is a user for resource management by using the RPKI mode, and the resource to be allocated is code number resource which is not used by the fourth user;

Correspondingly, when the target user is the next user of the fourth user, and when the code number resource managed by the blockchain system meets the resource requirement information, determining the target code number resource matched with the resource requirement information from the code number resource managed by the blockchain system as the user resource, wherein the target code number resource comprises:

and when the resources to be allocated, which are reported by the fourth user, meet the resource demand information, determining the code number resources matched with the resource demand information from the code number resources to be allocated, which are reported by the fourth user, as user resources.

5. An internet code number resource management device is characterized by being applied to a block chain system; the device comprises:

the first acquisition module is used for acquiring a first query request sent by a first user; the first user is a user performing resource management in an RPKI mode, and the first query request carries an RPKI resource certificate acquired by the first user and first query requirement information about an address authorization relationship;

the first authentication module is used for authenticating the identity of the first user by judging whether the RPKI resource certificate carried by the first query request is a legal certificate or not;

The first processing module is used for feeding back a query result matched with the first query requirement information to the first user based on a target address authorization relationship recorded by an accounting node of the blockchain system and related to an IP prefix and an ASN (autonomous system number) if authentication is passed, extracting an address authorization relationship from an RPKI resource certificate carried by the first query request, and updating the target address authorization relationship in the accounting node based on the extracted address authorization relationship;

the second acquisition module is used for acquiring a second query request sent by a second user; the second user is a user which does not use the RPKI mode to carry out resource management and does not join the blockchain system, and the second query request carries the address authorization relationship of the second user and second query requirement information about the address authorization relationship;

the second authentication module is used for authenticating the identity of the second user by utilizing the address authorization relationship carried by the second query request;

the second processing module is used for feeding back a query result matched with the second query requirement information to the second user if the authentication is passed, and updating the target address authorization relationship in the accounting node based on the address authorization relationship carried in the second query request;

The step of authenticating the identity of the second user by using the address authorization relationship carried by the second query request includes:

if the target address authorization relationship records the authorization relationship which is the same as the IP prefix of the address authorization relationship carried by the second inquiry request and different from the ASN, judging that the identity authentication of the second user is not passed; otherwise, judging that the identity authentication of the second user passes.

6. The apparatus of claim 5, wherein the apparatus further comprises:

the third acquisition module is used for acquiring a third query request sent by a third user; the third user is a user joining the blockchain system, and the third query request carries a key certificate issued to the third user by the blockchain system and third query requirement information about an address authorization relationship;

the third authentication module is used for authenticating the identity of the third user by utilizing the key certificate carried in the third inquiry request;

and the third processing module is used for feeding back a query result matched with the third query requirement information carried by the third query request to the third user if the authentication is passed.

7. The apparatus according to claim 5 or 6, further comprising:

the fourth authentication module is used for authenticating the identity of the target user based on a key certificate carried in a resource application request when the resource application request sent by the target user joining the blockchain system is received; the key certificate carried in the resource application request is a certificate issued by the blockchain system, and the resource application request also carries resource demand information;

a fourth processing module, configured to determine, if authentication is passed, a target code number resource that matches the resource requirement information from among code number resources managed by the blockchain system as a user resource when the code number resource managed by the blockchain system satisfies the resource requirement information;

and the information feedback module is used for feeding back the user resource to the target user so that the target user obtains the user resource, establishes an address authorization relationship of the target user for the code number resource required to be used by the target user in the user resource, and records the established address authorization relationship in the target address authorization relationship of the accounting node.

8. The apparatus of claim 7, wherein the code number resources managed by the blockchain system include resources to be allocated reported by a fourth user; the fourth user is a user for resource management by using the RPKI mode, and the resource to be allocated is code number resource which is not used by the fourth user;

correspondingly, when the target user is the next user of the fourth user, the fourth processing module determines, as the user resource, a target code number resource matched with the resource requirement information from the code number resources managed by the blockchain system when the code number resources managed by the blockchain system meet the resource requirement information, including:

and when the resources to be allocated, which are reported by the fourth user, meet the resource demand information, determining the code number resources matched with the resource demand information from the code number resources to be allocated, which are reported by the fourth user, as user resources.

Images