PEER ENROLLMENT METHOD, ROUTE UPDATING METHOD, COMMUNICATION SYSTEM, AND RELEVANT DEVICES

• US 20150074779A1
• Filed: 11/17/2014
• Published: 03/12/2015
• Est. Priority Date: 04/14/2009
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: GU, Yingjie, SONG, Haibin, JIANG, Xingfeng
• Granted Patent: US 9,819,688 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1046 Joining mechanisms

Abstract

A peer enrollment method, a route updating method, a communication system, and relevant devices to improve security of a peer-to-peer (P2P) network. The peer enrollment method includes: receiving an enrollment request from a peer, where the enrollment request carries identity information of the peer; verifying the identity information of the peer, and if the verification succeeds, obtaining peer location information of the peer and generating a peer credential according to the peer location information; and sending the peer credential carrying the peer location information to the peer so that the peer joins the P2P network according to the peer credential. Embodiments of the present application further provide a route updating method, a communication system, and relevant devices. Embodiments of the present application may improve security of the P2P network effectively.

Claims

1. A peer enrollment method, comprising:

receiving an enrollment request of a peer, wherein the enrollment request comprises identity information of the peer;

verifying the identity information of the peer, and if the verification succeeds, obtaining peer location information of the peer, and generating a peer credential according to the peer location information; and

sending the peer credential comprising the peer location information to the peer.

2. The method of claim 1, wherein the obtaining the peer location information of the peer comprises:

sending a request for obtaining the peer location information to a topology information server, wherein the request carries the identity information of the peer; and

receiving the peer location information of the peer returned by the topology information server, wherein the peer location information is one of the following;

an autonomous system identification (ID) allocated by the topology information server for the peer according to the identity information,

an area ID allocated by the topology information server for the peer according to the identity information, and

peer coordinates allocated by the topology information server for the peer according to the identity information.

3. The method of claim 1, wherein the obtaining the peer location information of the peer comprises:

sending a request for obtaining the peer location information to a content delivery network (CDN) redirection server, wherein the request comprises the identity information of the peer;

receiving an address of an edge server which is closest to the peer in a physical distance, returned by the CDN redirection server, wherein the address of the edge server is determined by the CDN redirection server for the peer according to the identity information; and

using the address of the edge server as the peer location information of the peer.

4. The method of claim 1, wherein the obtaining the peer location information of the peer comprises:

sending a request for obtaining the peer location information to a content delivery network redirection server, wherein the request comprises the identity information of the peer;

receiving an address of an edge server which is the closest to the peer in a physical distance, returned by the CDN redirection server, wherein the address of the edge server is determined by the CDN redirection server for the peer according to the identity information;

converting the address of the edge server into a corresponding location identification (ID) according to a preset algorithm; and

using the corresponding location ID as the peer location information of the peer.

5. A route updating method, comprising:

receiving, by a first peer, a client message sent by a second peer;

obtaining, by the first peer, a peer credential of the second peer according to the client message, wherein the peer credential is sent by an enrollment server to the second peer when the second peer is enrolled; and

judging, by the first peer, according to peer location information of the first peer and peer location information of the second peer comprised in the peer credential of the second peer, whether the second peer is closest to the first peer in a physical distance, and if the second peer is closest to the first peer in the physical distance, updating a routing table stored by the first peer.

6. The method of claim 5, wherein the client message comprises a peer identification (ID) of the second peer, and the method further comprises:

judging, by the first peer, whether a peer ID of the first peer has a same prefix as the peer ID of the second peer, and if the peer ID of the first peer has the same prefix as the peer ID of the second peer, obtaining the peer credential of the second peer.

7. The method of claim 6, wherein the first peer obtaining the peer credential of the second peer according to the client message comprises:

judging, by the first peer, whether the first peer stores the peer credential of the second peer, and

if the first peer does not store the peer credential of the second peer, requesting the second peer for the peer credential, and receiving the peer credential of the second peer sent by the second peer.

8. The method of claim 6, wherein the first peer obtaining the peer credential of the second peer according to the client message comprises:

obtaining, by the first peer, the peer credential of the second peer comprised in the client message.

9. The method of claim 7, wherein:

the peer location information is one of the following groups consisting of;

an autonomous system ID allocated by a topology information server;

an area ID allocated by the topology information server;

peer coordinates allocated by the topology information server;

an address of an edge server queried by a content delivery network (CDN) redirection server; and

a location ID corresponding to the address of the edge server determined by the enrollment server.

10. A communication system, comprising:

an enrollment server, configured to;

receive an enrollment request of a peer, wherein the enrollment request comprises identity information of the peer;

verify the identity information of the peer;

if the verification succeeds, obtain peer location information of the peer, and send a peer credential comprising the peer location information to the peer; and

the peer, configured to;

send the enrollment request to the enrollment server, wherein the enrollment request comprises the identity information of the peer;

receive the peer credential that is sent by the enrollment server and comprises the peer location information; and

join a peer-to-peer (P2P) network according to the peer credential.

11. The communication system of claim 10, further comprising:

an information providing server, configured to provide the peer location information of the peer to the enrollment server.

12. The communication system of claim 11, wherein:

the information providing server is a topology information server;

the enrollment server is further configured to send the identity information of the peer to the topology information server, and receive the peer location information returned by the topology information server; and

the topology information server is configured to allocate the peer location information for the peer according to the identity information sent by the enrollment server, and return the peer location information to the enrollment server, wherein the peer location information is one of an autonomous system identification (ID), an area ID, and peer coordinates.

13. The communication system of claim 11, wherein:

the information providing server is a content delivery network (CDN) redirection server;

the enrollment server is further configured to send the identity information of the peer to the CDN redirection server, and receive the peer location information returned by the CDN redirection server; and

the CDN redirection server is configured to;

determine an address of an edge server closest to the peer in a physical distance, according to the identity information sent by the enrollment server, use the address of the edge server as the peer location information of the peer, and send the peer location information to the enrollment server.

14. The communication system of claim 13, wherein the enrollment server is further configured to convert the address of the edge server into a corresponding location identification (ID) according to a preset algorithm and use the location ID as the peer location information of the peer.

15. A communication system, comprising:

a first peer and a second peer, wherein;

the first peer is configured to;

receive a client message sent by the second peer, and obtain a peer credential of the second peer according to the client message, wherein the peer credential of the second peer is sent by an enrollment server to the second peer when the second peer is enrolled; and

judge whether the second peer is closest to the first peer in a physical distance, according to peer location information of the first peer, and peer location information of the second peer comprised in the peer credential of the second peer, and if the second peer is closest to the first peer in the physical distance, update a routing table stored by the first peer; and

the second peer is configured to send the client message to the first peer.

16. The communication system of claim 15, wherein the first peer is further configured to judge whether its own peer identification (ID) has a same prefix as a peer ID of the second peer, and if the peer ID of the first peer has the same prefix as the peer ID of the second peer, obtain the peer credential of the second peer.

17. The communication system of claim 16, wherein:

the first peer is further configured to judge whether the first peer stores the peer credential of the second peer, and

if the first peer does not store the peer credential of the second peer, one of the following occurs;

(a) the first peer is configured to request the second peer for the peer credential and receive the peer credential sent by the second peer, and the second peer is further configured to send the peer credential of the second peer to the first peer according to a request of the first peer; and

(b) the first peer is configured to obtain the peer credential of the second peer comprised in the client message.

18. A server, comprising a processor and a non-transitory processor readable medium having processor-executed instructions stored thereon, the processor-executed instructions including a plurality of units, the units including:

a receiving unit, configured to receive an enrollment request of a peer, wherein the enrollment request carries identity information of the peer;

a verifying unit, configured to verify the identity information of the peer;

an obtaining unit, configured to obtain peer location information of the peer after the verifying unit verifies the identity information successfully;

a credential generating unit, configured to generate a peer credential according to the peer location information; and

a sending unit, configured to send the peer credential carrying the peer location information to the peer.

19. The server of claim 18, wherein the obtaining unit comprises one of a first obtaining unit, a second obtaining unit and a third obtaining unit, wherein:

the first obtaining unit is configured to send the identity information of the peer to a topology information server and receive peer location information of the peer returned by the topology information server, wherein the peer location information is one of;

an autonomous system identification (ID) allocated by the topology information server for the peer according to the identity information, an area ID allocated by the topology information server for the peer according to the identity information, and peer coordinates allocated by the topology information server for the peer according to the identity information;

the second obtaining unit is configured to send the identity information of the peer to a content delivery network (CDN) redirection server, receive an address of an edge server returned by the CDN redirection server, wherein the address of the edge server which is the closest to the peer in a physical distance, is determined by the CDN redirection server for the peer according to the identity information, and use the address of the edge server as the peer location information of the peer; and

the third obtaining unit is configured to send the identity information of the peer to the CDN redirection server, receive the address of the edge server returned by the CDN redirection server, wherein the address of the edge server which is the closest to the peer in a physical distance, is determined by the CDN redirection server for the peer according to the identity information, convert the address of the edge server into a corresponding location ID according to a preset algorithm, and use the corresponding location ID as the peer location information of the peer.

20. A first network peer, comprising a processor and a non-transitory processor readable medium having processor-executed instructions stored thereon, the processor-executed instructions including a plurality of units, the units including:

a message receiving unit, configured to receive a client message sent by a second network peer;

a credential receiving unit, configured to receive a peer credential sent by the second network peer, wherein the peer credential of the second network peer is sent by an enrollment server to the second network peer when the second network peer is enrolled;

a distance judging unit, configured to judge whether the second network peer is closest to the first network peer in a physical distance according to peer location information of the first network peer and peer location information of the second network peer that is in the peer credential of the second network peer; and

a route updating unit, configured to update a routing table if the second network peer is closest to the first network peer in the physical distance.

21. The first network peer of claim 20, further comprising:

a credential judging unit, configured to judge whether the first network peer stores the peer credential of the second network peer, and if the first network peer does not store the peer credential of the second network peer, request the second network peer for the peer credential of the second network peer.