基于分层动态地址的访问控制方案设计

Accessibility privacy enforcement with hierarchical address dynamics

提出了基于IPv6的分层动态地址访问控制系统Hardy的设计原型.Hardy在不影响IPv6地址前缀路由功能的前提下,将地址的后缀部分设置为可动态改变的身份地址.分层网络中的子节点将会从父节点继承部分身份地址加入到自己的地址中作为后缀.同时,父节点将获知子节点的身份地址并据其对通往子节点的流量进行过滤.主机或网络节点通过定期改变自己的身份地址并通知父节点修改过滤规则,来阻止曾经获取其合法地址的恶意用户对其进行进一步访问.身份地址可以通过终端主动访问的方式告知对端,或通过平台发布供授权得到验证的对端获取.

The designing prototype of an IPv6-based hierarchical dynamical addressing system named Hardy was proposed.Hardy imposed the IPv6 address suffix as a dynamical identity address called IA,without affecting its routing and forwarding functionalities.The identity address(IA)of a parent node was adopted by the children nodes as the suffix for their IA.Meanwhile,a child node′s IA was acknowledged by its parent node for traffic filtering,to prevent malicious access from hosts who had obtained the obsolete IA.The up-to-date identity address can be directly notified to the other hosts by active access,or be published and retrieved by those who passed the authority verification.