CN103701700B - Node discovery method in a kind of communication network and system - Google Patents

Abstract

The present invention provides a node discovery method and system in a communication network; the method includes: the source node sends a discovery request message to the next hop node, and the discovery request message carries the address information of the source node and the identity of the source node information, the address information of the destination node, and the challenge value generated by the source node; the node that receives the discovery request message returns to the source node the verification information submitted by the node to the source node; judges whether the node is the destination node according to the address information, If it is not the destination node, the discovery request message will be forwarded to the next hop node of the node; after the source node receives the verification information returned by the destination node, it will verify each node according to the verification information submitted by the received nodes; If all verifications pass, each node is determined as a trusted node. The invention can ensure the safety and reliability of communication transmission between network devices and reduce communication delay.

Description

A node discovery method and system in a communication network

technical field

The invention relates to the communication field, in particular to a node discovery method and system in a communication network.

Background technique

The emergence of communication networks enables people to communicate more quickly and exchange information more smoothly. As a main carrier of information transmission, the communication network has achieved unprecedented development. While its basic and overall status has become increasingly prominent, it is also constantly facing increasingly diverse security threats and an increasingly complex network security environment. Due to the characteristics of the Internet, such as openness, globality, virtuality, uncertainty of identity, decentralization, and equality, certain needs of people can be met, and it is precisely because of these characteristics of the Internet that many safe question. Especially for high-speed, large-scale, complex and multi-hop communication networks, network security is particularly important.

In the Internet, information is transmitted from one end to the other through the transmission media and devices (routers, switches, servers, gateways, etc.) of many segments in the network. Path selection is one of the factors that must be considered in the design and operation of communication networks. For the operation of the network, its path selection is to find a message sent from the source to the destination with the least cost. Due to the openness of the communication network, the confidentiality of the information in the data packet cannot be effectively guaranteed during the transmission of the communication network. The information carried in the data packet may be exposed to malicious nodes on the path. On the one hand, the information in the data packet is cracked by brute force, and on the other hand, some surrender nodes are used to obtain information in the network. After obtaining the topology information of these networks, malicious nodes will implement various attacks accordingly. Therefore, for the sender of the information, it is necessary to find a credible and effective path to the destination to ensure that every node in the process of information transmission is credible, so as to ensure that the information is not obtained by illegal nodes.

In communication networks, the most commonly used node discovery process is the traceroute detection process. This process implements its functionality by increasing the TTL (Time To Live) value. Whenever a data packet passes through a router, its survival time will be reduced by 1; when its survival time is 0, the device will cancel the data packet and send an ICMP (Internet Control Message Protocol, Internet Control Message Protocol) TTL data packet to The sender of the original packet. However, this process does not ensure the authenticity and reliability of the nodes on the found path, and each node discovery process needs to repeatedly send multiple data packets, which greatly consumes network overhead.

IETF (Internet Engineering Task Force) proposed a neighbor discovery protocol NDP in order to solve the communication and address automatic configuration problems between different nodes on the same link. This protocol is a basic part of the IPv6 protocol, but it must be established on the basis of a trusted network, and there are a lot of security threats in reality. Subsequently, the IETF proposed the IPSec authentication header and the SEND (Secure Neighbor Discovery, Secure Neighbor Discovery) protocol to improve the security of NDP. By adding password generation address, RSA (a public key encryption algorithm) signature, timestamp and current session label options, and introducing router authentication mechanism, the secure neighbor discovery protocol greatly improves the security of the neighbor discovery process, but this protocol still There are a lot of security problems, such as the inability to resist forged NDP packet attacks. In recent years, researchers have also designed a variety of routing discovery protocols for adhoc (point-to-point) networks. However, due to the local, small, and wireless characteristics of adhoc networks, they are not suitable for cross-domain, high-speed, and large-scale communication networks.

Contents of the invention

The technical problem to be solved by the present invention is how to ensure the safety and reliability of communication transmission between network devices and reduce communication delay.

In order to solve the above problems, the present invention provides a node discovery method in a communication network, comprising:

S101. The source node sends a discovery request message to the next-hop node, and the discovery request message carries address information of the source node, identity information of the source node, address information of the destination node, and a challenge value generated by the source node;

S102. The node that receives the discovery request message returns to the source node the verification information submitted by the node to the source node, including: the address information and digital certificate of the node, and the challenge response of the node to the source node value; judging whether the current node is a destination node according to the address information therein, if not the destination node, forwarding the discovery request message to the next hop node of the current node;

S103. After receiving the verification information returned by the destination node, the source node verifies each node according to the received verification information submitted by each node; if all verifications pass, each node is determined as a trusted node.

Optionally, the challenge response value of a node to the source node is the result of logical operation between the source node and the node, and the signature generated by the node's private key; wherein, the source node and The relevant information between the nodes includes: the identity information of the node, the identity information of the source node, and the challenge value generated by the source node;

The steps for the source node to verify each node according to the received verification information submitted by each node include:

The source node respectively verifies whether the address information and the digital certificate in the verification information submitted by each node are valid; respectively verifies whether the signature in the challenge response value generated by the node is valid through the public key carried in the digital certificate of each node.

Optionally, the step of forwarding the discovery request message to the next hop node of the current node includes:

Save the address information of the last hop node in the discovery request message, then delete the additional information of nodes other than the source node in the discovery request message, and add the additional information of the node in the discovery request message , and finally sent to the next hop node of the current node; the additional information includes: the address information of the current node, identity information and the challenge value generated by the current node;

The step S102 also includes:

When the previous hop node is not the source node, construct a proximity discovery response message and send it to the previous hop node, which carries the verification information submitted by the current node to the previous hop node, including: the address information of the current node, the digital certificate and The challenge response value of this node for the previous hop node; the challenge response value of this node for the previous hop node is the relevant information between the previous hop node and this node, and the relevant information generated by using the private key of this node The result of the logical operation of the signature of the last hop node; wherein, the relevant information between the previous hop node and this node includes: the identity information of this node, the identity information of the previous hop node, and the challenge value generated by the previous hop node.

Optionally, the method also includes:

The node receiving the neighbor discovery response message verifies whether the address information and digital certificate of the next-hop node are valid, and verifies the challenge generated by the next-hop node through the public key carried in the digital certificate of the next-hop node Whether the signature in the response value is valid; if all are valid, the address information of the next-hop node is saved.

Optionally, after the step S103, it also includes:

S104, each intermediate node R _i performs the following steps respectively, and the intermediate node is a node other than the destination node that receives the discovery request message:

41. R _i takes the previous hop node of this node as the uplink request target node; if the current node saves the address information of the next hop node, the next hop node is used as the downlink request target node; the hop value is set to 1 ;

42. R _i sends a node address request message to the uplink request object node, which carries the hop value, a request for the address information of the previous hop node of the uplink request object node, the identity information of the current node, and the local The challenge value generated by the node;

If there is the downlink request object node, R _i sends a node address request message to the downlink request object node, which carries the hop value and a request for the address information of the next hop node of the downlink request object node , the identity information of this node and the challenge value generated by this node;

43. After the uplink/downlink request object node receives the node address request message sent by the R _i requesting the address information of the uplink/next hop node, if the node has the address information of the uplink/next hop node, then Constructing a node verification request message and returning it to R _i , which carries the identity information of the node, the digital certificate, the challenge value generated by the node and the challenge response value of the node for R _i ;

44. After receiving the node verification request message of the uplink/downlink request object node, R _i sends a node verification response message to the uplink/downlink request object node if the verification is passed, which carries the digital certificate of R _i and The challenge response value of R _i for the object node of the uplink/downlink request;

45. After the uplink/downlink request target node receives the node verification response message, if the verification is passed, the address information of the uplink/next hop node of the node is fed back to R _i ;

46. If the received address information does not belong to the target node R _i is looking for, then use the node corresponding to the address information received by R _i from the uplink request object node as the uplink request object node of R _i , and set The node corresponding to the address information received by R _i from the downlink request object node is used as the downlink request object node of R _i , the hop value is added by 1, and then returns to step 42; if the received address information belongs to R _i If the target node is found, the neighbor node discovery process ends.

The present invention also provides a node discovery system in a communication network, including:

A plurality of nodes, including at least a source node and a destination node for node discovery;

Each node includes:

The request sending module is used to send a discovery request message to the next hop node when the current node is used as the source node, and the discovery request message carries the address information of the source node, the identity information of the source node, and the address of the destination node Information and the challenge value generated by the source node;

The request response module is used to return to the source node the verification information submitted by the node to the source node after receiving the discovery request message, including: the address information and digital certificate of the node, and the verification information of the node for the source node. challenge response value;

The request forwarding module is used for judging whether the node is a destination node according to the address information therein after receiving the discovery request message; if the node is an intermediate node, forwarding the discovery request message to the next node of the node one hop node;

The verification module is used to verify each node according to the received verification information submitted by each node after receiving the verification information returned by the destination node when the node is used as the source node; Nodes are identified as trusted nodes.

Optionally, the challenge response value of a node to the source node is the result of logical operation between the source node and the node, and the signature generated by the node's private key; wherein, the source node and The relevant information between the nodes includes: the identity information of the node, the identity information of the source node, and the challenge value generated by the source node;

The verification module verifying each node according to the received verification information submitted by each node refers to:

The verification module respectively verifies whether the address information and the digital certificate in the verification information submitted by each node are valid; respectively verifies whether the signature in the challenge response value generated by the node is valid through the public key carried in the digital certificate of each node.

Optionally, the request forwarding module forwarding the discovery request message to the next hop node of this node refers to:

The request forwarding module saves the address information of the previous hop in the discovery request message, and then deletes the additional information of nodes other than the source node in the discovery request message, and in the discovery request message Add additional information of the node, and finally send it to the next hop node of the node; the additional information includes: the address information of the node, identity information and the challenge value generated by the node;

Each node also includes:

The proximity response module is configured to construct a proximity discovery response message and send it to the previous hop node when the previous hop node is not the source node, which carries the verification information submitted by the current node to the previous hop node, including: the current node Address information, digital certificates, and the node’s challenge response value for the previous hop node; the node’s challenge response value for the previous hop node is the relevant information between the previous hop node and this node, and the private The result of logical operations on the signature generated by the key to the relevant information; wherein, the relevant information between the previous hop node and this node includes: the identity information of the current node, the identity information of the previous hop node, and the previous The challenge value generated by jumping nodes.

Optionally, the verification module is further configured to verify whether the address information and the digital certificate of the next-hop node are valid after receiving the proximity discovery response message, and carry in the digital certificate of the next-hop node Verify whether the signature in the challenge response value generated by the next-hop node is valid; if all are valid, save the address information of the next-hop node.

Optionally, each node also includes:

Adjacent node discovery module, including:

address request unit;

The setting unit is used to use the previous hop node of the current node as the uplink request object node when the current node receives the discovery request message and the current node is not the destination node; if the current node saves the next hop node For the address information, the next hop node is used as the downlink request object node; the hop value is set to 1, and sent to the address request unit together with the uplink and downlink request object nodes;

The address request unit is configured to send a node address request message to the uplink request object node, which carries the hop value, a request for the address information of the previous hop node of the uplink request object node, and the identity of the node Information and the challenge value generated by this node; if there is a downlink request object node, then send a node address request message to the downlink request object node, which carries the hop value, the next hop node to the downlink request object node The address information request, the identity information of the node and the challenge value generated by the node;

The verification request unit is used to construct the address information of the upper/next hop node if the node saves the address information of the upper/next hop node after receiving the node address request message sent by the node R _a to request the address information of the upper/next hop node. The node verification request message is returned to the node R _a , which carries the identity information of the node, the digital certificate, the challenge value generated by the node and the challenge response value of the node for the node R _a ;

The verification response unit is used to send a node verification response message to the node R _{b if the verification is passed after receiving the node verification request message returned by the node R b ,} which carries the digital certificate of the node and the node A challenge response value for the node R _b ;

The verification request unit is also used to feed back the address information of the upper/next hop node of the node if the verification is passed after receiving the node verification response message;

The setting unit is further configured to use the node corresponding to the address information received by the node from the uplink request object node as the uplink request object when the received address information does not belong to the target node that the node is looking for A node, using the node corresponding to the address information received by the node from the downlink request object node as the downlink request object node, adding 1 to the hop value, and then combining with the uplink request object node and the downlink request object node The object node sends to the address request unit together; if the received address information belongs to the target node that the node is looking for, the adjacent node discovery process ends.

The technical scheme of the present invention is applicable to the discovery of trusted nodes in a communication network, and adopts a challenge-response method to ensure that all discovered nodes are credible by verifying the authenticity of the nodes on the path, thereby ensuring that the communication between network devices is reliable. The communication transmission is safe and reliable, and the process is simple, and there is no need to repeatedly send multiple data packets, so the communication delay is greatly reduced; the optimization scheme of the present invention is suitable for the discovery of adjacent nodes in the communication network, and the nodes on the path can store correlation The IP addresses of adjacent nodes find the location of other nodes on the path, and can realize mutual authentication between nodes on the path. The technical scheme of the present invention is also applicable to high-speed, large-scale, complex and multi-hop communication networks due to its simple process, safety and reliability.

Description of drawings

FIG. 1 is a schematic flow chart of a node discovery method in Embodiment 1;

FIG. 2 is a schematic flow chart of a trusted node discovery method in Embodiment 1;

FIG. 3 is a schematic flowchart of a method for discovering adjacent nodes in Embodiment 1.

detailed description

The technical solution of the present invention will be described in more detail below with reference to the drawings and embodiments.

It should be noted that, if there is no conflict, the embodiments of the present invention and various features in the embodiments can be combined with each other, and all are within the protection scope of the present invention. In addition, although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that shown or described herein.

Embodiment 1. A method for discovering nodes in a communication network, as shown in FIG. 1 , comprising:

S101. The source node sends a discovery request message to the next-hop node, and the discovery request message carries address information of the source node, identity information of the source node, address information of the destination node, and a challenge value generated by the source node;

S102. The node that receives the discovery request message returns to the source node the verification information submitted by the node to the source node, including: the address information and digital certificate of the node, and the challenge response of the node to the source node value; judging whether the current node is a destination node according to the address information therein, if not the destination node, forwarding the discovery request message to the next hop node of the current node;

S103. After receiving the verification information returned by the destination node, the source node verifies each node according to the received verification information submitted by each node; if all verifications pass, each node is determined as a trusted node.

In this embodiment, the nodes other than the source node and the destination node passed through during the entire discovery request message delivery process are called intermediate nodes; in step S101, usually the next hop node of the source node is the first intermediate node node, but it does not rule out that the next hop node is the destination node.

In this embodiment, the intermediate node may, but is not limited to, return the verification information submitted by the node to the source node to the source node through a non-terminal discovery response message; The response message returns to the source node the verification information submitted by the node to the source node.

In this embodiment, the address information may be, but not limited to, an IP address; the node receiving the discovery request message may determine whether the node's IP address is the same as that of the destination node by comparing the IP address of the node Whether it is the destination node.

This embodiment uses identity information and digital certificates and an asymmetric challenge-response authentication mechanism to ensure the security of the node discovery process. The source node can verify the address information, digital certificate, and challenge response value of the intermediate node/destination node Whether it is valid to judge whether each node in the discovery process is credible.

In an implementation of this embodiment, the challenge response value of a node to the source node can be, but not limited to, related information between the source node and the node, and the signature generated by using the private key of the node to generate the related information The result of logical operation; wherein, the relevant information between the source node and the node includes: the identity information of the node, the identity information of the source node, and the challenge value generated by the source node.

In this embodiment, the step of the source node verifying each node according to the received verification information submitted by each node may specifically include:

The source node respectively verifies whether the address information and the digital certificate in the verification information submitted by each node are valid; respectively verifies whether the signature in the challenge response value generated by the node is valid through the public key carried in the digital certificate of each node.

In this implementation manner, the node's identity information, digital certificate, and public-private key pair may be, but not limited to, applied by the node to a PKI (Public Key Infrastructure, public key infrastructure).

This embodiment is further based on the certificate-based PKI technical system to ensure the security of the node discovery process; all nodes will apply to PKI for relevant digital certificates and public-private key pairs during initialization, and only users who are considered legal by PKI can apply for relevant digital certificate and public-private key pair. In the process of trusted node discovery, all nodes on the path (intermediate nodes and destination nodes) send the digital certificate assigned to the node by PKI and the signature generated by the private key assigned to the node by PKI to the source node, and the source node The authenticity verification of the node identity is realized by verifying the validity of the certificate and signature. Only the legal user's digital certificate and the generated signature can pass the authentication of the source node.

In an implementation manner of this embodiment, the step of forwarding the discovery request message to the next-hop node of the current node may specifically include:

Save the address information of the last hop node in the discovery request message, then delete the additional information of other nodes other than the source node in the discovery request message, and add the address information of the current node in the discovery request message The additional information is finally sent to the next hop node of the node; the additional information includes: the address information of the node, the identity information and the challenge value generated by the node;

In this embodiment, in order to distinguish it from the original discovery request message sent by the source node, the discovery request message forwarded by each intermediate node and added with the additional information of the own node may be called a transit discovery request message.

In this embodiment, except for the first intermediate node that directly receives the discovery request message from the source node, all other intermediate nodes need to delete the additional information.

In this embodiment, the step S102 may further include:

When the previous hop node is not the source node, construct a proximity discovery response message and send it to the previous hop node, which carries the verification information submitted by this node to the previous hop node, including: address information of this node, digital certificate And the node's challenge response value for the previous hop node; the node's challenge response value for the previous hop node can be, but not limited to, the relevant information between the previous hop node and this node, and the private key pair using this node The result of the logical operation of the signature generated by the relevant information; wherein, the relevant information between the previous hop node and this node includes: the identity information of the current node, the identity information of the previous hop node, and the previous hop node Generated challenge value.

In this embodiment, the method may further include:

The node receiving the neighbor discovery response message verifies whether the address information and digital certificate of the next-hop node are valid, and verifies the challenge generated by the next-hop node through the public key carried in the digital certificate of the next-hop node Whether the signature in the response value is valid; if all are valid, the address information of the next-hop node is saved.

In this embodiment, only verified address information of adjacent nodes will be stored by the intermediate node for adjacent node discovery, which further ensures the security of the node discovery process.

The following uses a specific example of trusted node discovery to illustrate; in this example, it is assumed that PKI has issued the digital certificate and public-private key pair of the node to each legal intermediate node, and the address information is an IP address; The trusted node discovery process from the end to the receiving end is shown in Figure 2, which specifically includes the following steps:

Step 201, the initiator S discovers the source node carrying the initiator’s address IP_S, the IP address of the destination node IP_R _n to be searched, the hop value Hop, the initiator’s identity information ID_S, and the challenge value Random_S randomly selected by the initiator The request message is sent to the first intermediate node R ₁ , and Hop is 0 at this time.

Step 202, after receiving the source node discovery request message, the intermediate node R1 saves the IP address _{IP_S} of the source node, and performs the following operations:

2021. R ₁ verifies whether it is the destination node that the initiator S is looking for. R ₁ compares its own IP address with the IP address of the destination node in the source node discovery request message. If they are the same, proceed to step 205; if not same, then R ₁ adds additional information of R ₁ on the basis of the source node discovery request message; the additional information of R ₁ includes: IP address IP_R ₁ of R ₁ , identity information ID_R _{1 of R 1 and} an R ₁ generates the challenge value Random_R ₁ , and changes the Hop to 1, thereby obtaining a transit discovery request message, and sends the transit discovery request message to the next hop node R ₂ ;

2022. At the same time, R ₁ uses the private key issued to it by PKI to generate a signature for the related information between S and R ₁ ; the related information between S and R ₁ includes: S's identity information ID_S, R ₁ 's identity information ID_R ₁ and the challenge value Random_S generated by S; the obtained signature and the relevant information between S and R ₁ constitute the challenge response value of R ₁ for S:

TokenR ₁ S=ID_R ₁ ||ID_S||Random_S||Sign _R1 (ID_R ₁ ||ID_S||Random_S);

Where || represents a predetermined logical operation, and Sign _X (M) represents the signature generated by X’s private key on message M. The signature algorithm used here can be assigned by PKI or negotiated by each node. Then R ₁ constructs a non-terminal discovery response message and sends it to the initiator S, which carries the verification information submitted by R ₁ to S, including R ₁ ’s IP address IP_R ₁ , R ₁ ’s digital certificate Cert_R ₁ and R ₁ ’s certificate for S Challenge response value TokenR ₁ S.

Steps 2021 and 2022 may be performed in parallel, regardless of the sequence.

Step 203, after receiving the transit discovery request message, the intermediate node R ₂ saves the IP address IP_R ₁ of the previous hop node R ₁ , and performs the following operations:

2031, R ₂ is similar to the operation of R ₁ in step 2021, first judges whether it is the destination node, if so, proceeds to step 205; if it finds that the IP addresses do not match, then R ₂ forwards the received discovery request message The additional information of R ₁ is deleted, and the additional information of R ₂ is added (equivalent to adding the additional information of R ₂ on the basis of the source node discovery request message); the additional information of R ₂ includes: IP address of R ₂ IP_R ₂ , identity information ID_R ₂ of R ₂ and a challenge value Random_R ₂ generated by R ₂ , and set Hop to 2 to obtain a new transit discovery request message, and send the new transit discovery request message to The next hop node R ₃ ;

2032, R ₂ is similar to the operation of R ₁ in step 2022, except that the verification information submitted by R ₁ to S is replaced by the verification information submitted by R ₂ to S, and the relevant information between S and R ₁ is replaced by the above S and R ₂ related information; generate R ₂ ’s challenge response value for S TokenR ₂ S=ID_R ₂ ||ID_S||Random_S||Sign _R2 (ID_R ₂ ||ID_S||Random_S), and construct a new The non-terminal discovery response message is sent to the initiator S, which carries the verification information submitted by R ₂ to S, including R ₂ ’s IP address IP_R ₂ , digital certificate Cert_R ₂ and R ₂ ’s challenge response value TokenR ₂ S for S.

2033. R ₂ uses the private key issued to it by PKI to generate a signature for the related information between R ₁ and R ₂ ; the related information between R ₁ and R ₂ includes R ₁ 's identity information ID_R ₁ and R ₂ 's The identity information ID_R ₂ and the challenge value Random_R ₁ generated by R ₁ ; the obtained signature and the related information between R ₁ and R ₂ constitute R ₂ ’s challenge response value for R ₁ :

TokenR ₂ R ₁ =ID_R ₂ ||ID_R ₁ ||Random_R ₁ ||Sign _R2 (ID_R ₂ ||ID_R ₁ ||Random_R ₁ );

R ₂ constructs a proximity discovery response message and sends it to the previous hop node R ₁ , which carries the verification information submitted by R ₂ to R ₁ , including IP_R ₂ , Cert_R ₂ and R ₂ ’s challenge response value TokenR ₂ R ₁ for R ₁ .

In step 203, the steps of constructing and sending the transit discovery request message, the non-terminal discovery response message and the proximity discovery response message are in no particular order and can be parallelized, and the same is true in step 204.

Step 204, the subsequent intermediate node R _i (2<i≤n-1, where n-1 is the number of intermediate nodes through which the node discovery request message is transmitted from the initiator S to the destination node) receives After transferring the discovery request message and the neighbor discovery response message, save the IP address of the previous hop node in the received transfer discovery request message, and perform the following operations:

2041, R _i is similar to the operation of R ₂ in step 2031, and constructs a new transit discovery request message and sends it to the next hop node R _i+1 , here only need to replace all the additional information of R ₂ in step 2031 with R _i That is, R _i deletes the additional information of R _i-1 in the received transit discovery request message, and adds the additional information of R _i , so as to obtain a new transit discovery request message.

2042, R _i is similar to the operation of R ₂ in step 2032, constructing a non-terminal response message and sending it to S; here only need to replace the verification information submitted by R ₂ to S in step 2032 with the verification information submitted by R _i to S Can.

2043, R _i is similar to the operation of R ₂ in step 2033, constructing a new proximity discovery response message and sending it to the previous hop node R _i-1 , here only need to replace the relevant information between R ₁ and R ₂ in step 2033 For the relevant information between R i _{- 1} and R _i (including the identity information ID_R _i-1 of R _i -1, the identity information ID_R _i of R i and the challenge value Random_R i- ₁ generated by R i _-1 ) .

The intermediate node R _i (1≤i≤n-1) verifies the digital certificate in the proximity discovery response message from the next-hop node R _i+1 (where the next-hop node of R _n-1 is the destination node R _n ) Whether Cert_R _i+1 is valid, and use the public key in the digital certificate of R _{i +1} to verify whether the signature in R _i +1’s challenge response value TokenR _i+1 R _i is valid; if they are all valid, Then R _i stores the IP address IP_R _i+1 of R _i+1 in the neighbor discovery response message from the next hop, for the discovery of neighbor nodes between intermediate nodes. As long as one of the digital certificate and the signature is invalid, R _i will not store the IP address of the next-hop node.

Step 205, after the destination node R _n receives the transit discovery request message sent by the previous hop node R _n-1 (R _n-1 is the last intermediate node), it saves the IP address of the previous hop node, and performs the following operations :

2051. The destination node R _n uses the private key issued to it by PKI to generate a signature for the related information between S and R _n ; the related information between S and R _n includes: the identity information ID_S of S, the identity of R _n Information ID_R _n , and the challenge value Random_S generated by S, the obtained signature and the related information between S and R _n constitute R _n ’s challenge response value for S:

TokenR _n S=ID_R _n ||ID_S||Random_S||Sign _Rn (ID_R _n ||ID_S||Random_S);

R _n constructs a node discovery end response message and sends it to the initiator S, which carries R _n 's IP address IP_R _n , digital certificate Cert_R _n and R _n 's challenge response value TokenR _n S for S, indicating that the discovery process has ended.

2052, R _n is similar to the operation of R ₂ in step 2033, constructing a new proximity discovery response message and sending it to the previous hop node R _n-1 , here only need to replace the relevant information between R ₁ and R ₂ with R _n The relevant information between _-1 and R _n (including the identity information ID_R _n-1 of R _n -1, the identity information ID_R _n of R _n and the challenge value Random_R _{n- 1} generated by R n-1) is enough.

In step 205, the steps of constructing the node discovery end response message and the neighbor discovery response message are in no particular order and can be parallelized.

Step 206, the initiator S verifies whether the digital certificates in the non-terminal discovery response messages from all intermediate nodes and the node discovery end response messages from the destination node are valid, and uses the public keys in the digital certificates of each node to verify Whether the signature in the node’s challenge response value for S is valid; if the digital certificates and signatures of all nodes (intermediate nodes and destination nodes) are valid, all nodes will be determined as trusted nodes; as long as there is any node’s If the digital certificate or signature is invalid, S will not trust the searched path, and re-initiate the trusted node discovery process.

In an implementation manner of this embodiment, after the step S103, it may further include:

S104, each intermediate node R _i performs the following steps respectively, and the intermediate node is a node other than the destination node that receives the discovery request message:

41. R _i takes the previous hop node of this node as the uplink request target node; if the current node saves the address information of the next hop node, the next hop node is used as the downlink request target node; the hop value is set to 1 ;

42. R _i sends a node address request message to the uplink request object node, which carries the hop value, a request for the address information of the previous hop node of the uplink request object node, the identity information of the current node, and the local The challenge value generated by the node;

If there is the downlink request object node, R _i sends a node address request message to the downlink request object node, which carries the hop value and a request for the address information of the next hop node of the downlink request object node , the identity information of this node and the challenge value generated by this node;

43. After the uplink/downlink request object node receives the node address request message sent by the R _i requesting the address information of the uplink/next hop node, if the node has the address information of the uplink/next hop node, then Constructing a node verification request message and returning it to R _i , which carries the identity information of the node, the digital certificate, the challenge value generated by the node and the challenge response value of the node for R _i ;

In this step and subsequent steps, the operations of the uplink request object node and the downlink request object node are independent, and the operations of R _i with respect to the uplink request object node and the downlink request object node are also independent; independent means that they do not affect each other , and are independent of each other - it may happen both, or only the up/down part. For example, in this step, as the uplink request object node of R _i , it is only possible to receive the node address request message sent by R _i requesting the address information of the previous hop node, and it is only necessary to determine whether the current node has the address of the previous hop node Information; as for how to do the downlink request object node, whether to do it, or even whether there is a downlink request object node, it will not affect the operation of the uplink request object node.

44. After receiving the node verification request message of the uplink/downlink request object node, R _i sends a node verification response message to the uplink/downlink request object node if the verification is passed, which carries the digital certificate of R _i and The challenge response value of R _i for the object node of the uplink/downlink request;

45. After the uplink/downlink request target node receives the node verification response message, if the verification is passed, the address information of the uplink/next hop node of the node is fed back to R _i ;

46. If the received address information does not belong to the target node R _i is looking for, then use the node corresponding to the address information received by R _i from the uplink request object node as the uplink request object node of R _i , and set The node corresponding to the address information received by R _i from the downlink request object node is used as the downlink request object node of R _i , the hop value is added by 1, and then returns to step 42; if the received address information belongs to R _i If the target node is found, the neighbor node discovery process ends.

If the address information returned by the uplink/downlink request object node is not received, delete the original uplink/downlink request object node, so that after returning to step 42, only the updated request object node side (uplink or downlink) is performed; if the uplink If no address information is returned by the target node of the downlink request, the process of discovering the neighboring nodes can also end.

In this embodiment, the verification steps are similar to the previous ones, including verifying whether the received digital certificate is valid, and verifying whether the signature in the received challenge response value is valid according to the public key in the digital certificate, the digital certificate and The verification is passed when the signatures are all valid; the process of obtaining the challenge response value of the node to the communication peer node is similar to the previous one. First, the private key of the node is used to generate a signature for the relevant information between the communication peer node and the node. Perform logical operations on the obtained signature and the relevant information between the communication peer node and the own node to obtain the challenge response value of the own node to the communication peer node. For details, see the examples below.

In this embodiment, step S104 is the process of discovering neighboring nodes, which is also designed using the asymmetric challenge-response authentication mechanism based on PKI. The intermediate node sends a node address request message to the neighboring node to request the previous hop or next hop of the neighboring node. The IP address of the one-hop node; then the intermediate node and its adjacent nodes implement a challenge response mechanism to realize the authenticity verification between the two parties, only the legal requester can obtain the IP address information of the adjacent nodes of the relevant node, and also Only the IP address information provided by the credible requesting party can be accepted by the requesting party, thus achieving mutual authentication between adjacent nodes.

The following is a specific example of adjacent node discovery; this example describes the process after the completion of trusted node discovery in the previous example, using the feature that all intermediate nodes on the path know the IP addresses of the adjacent intermediate nodes of this node , any intermediate node R _i on the path can search for the upper or lower intermediate nodes in the path according to the stored IP addresses of adjacent nodes, as shown in Figure 3, the specific steps are as follows:

Step 301: Take the last hop node R _i-1 of the intermediate node R _i (2<i≤n) as the uplink request object node of R _i , if the IP address of the next hop node R _{i +1} is stored in R i , then take R _i+1 as the downlink request object node of R _i . Set the Hop value to 1.

Step 302: R _i sends a node address request message to the uplink request object node of this node according to the stored IP address, so as to request the IP address of the previous hop node of the uplink request object node (for example, the uplink request object node is R _{i- 1} , the request is the IP address of R _i-2 ), the node address request message carries the Hop, request information ReqInfo, R _i identity information ID_R _i and the challenge value Random_R _i generated by R _i ; The request information ReqInfo indicates that the request is the IP address of the previous hop node of the uplink request object node or the IP address of the next hop node of the downlink request object node.

Step 302', if there is a downlink request object node, as shown by the dotted line in Figure 3, then R _i also sends a node address request message to the downlink request object node of this node, requesting the next hop node of the downlink request object node IP address (for example, when the downlink request object node is R _i+1 , the request is the IP address of R _i+2 ), the process is the same as the previous hop node R _i-1 requesting R _i-1 ’s previous hop node R _{i- 2} IP address process is similar.

If R _i only stores the IP address of the previous hop node but not the IP address of the next hop node, then R _i can only request the IP address of its previous hop node R _i-2 from R i- ₁ .

In the following steps 303-305, the uplink request object node is described as R _i-1 . If the uplink request object node is another node, this node can be used to replace the R _i-1 involved in these steps:

Step 303: R _i-1 performs the following operations after receiving the node address request message:

(3.1) R _i-1 uses PKI to issue the private key pair R _i and R _i-1 related information (including R _i ’s identity information ID_R _i , R _i-1 ’s identity information ID_R _i-1 and The challenge value Random_R _i generated by R _i ) generates a signature, and the obtained signature and the related information between R _i and R _i-1 constitute R _i-1 ’s challenge response value TokenR _{i -1} R _i =ID_R _i-1 ||ID_R _i ||Random_R _i ||Sign _Ri-1 (ID_R _i-1 ||ID_R _i ||Random_R _i );

(3.2) Then R _i-1 constructs a node verification request message, and sends the node's identity information ID_R _i-1 , the generated challenge value Random_R _i-1 , digital certificate Cert_R _i-1 and R _i-1 to R _i The challenge response value TokenR _i-1 R _i is returned to the intermediate node R _i .

Step 303', the processing process of the downlink request object node after receiving the node address request message is similar to the above steps (3.1) and (3.2), as shown by the dotted line in Figure 3, only the uplink request object node is replaced by into a downlink request object node (for example, replace R _i-1 with R _i+1 ).

If the target node of the uplink/downlink request does not store the IP address of the uplink/next hop node, the received node address request message is not processed.

Step 304: After receiving the node verification request message from R _{i -1} , R i verifies whether the digital certificate of R _{i -1} is valid, and uses the public key in the certificate of R i-1 to verify that R _i-1 is against R Is the challenge response value of _i TokenR _i-1 whether the signature in R _i is valid, as long as one of the digital certificate and the signature is invalid, the node verification request message is discarded; if the digital certificate and the signature are both valid, the verification is passed, R _i uses the private key issued to it by PKI to pair the relevant information between R i _{- 1} and R _i (including the identity information ID_R _i-1 of R _i -1, the identity information ID_R _i of R i and the information generated by R _i-1 Challenge value Random_R _i-1 ) to generate a signature, and the obtained signature and the related information between R _i-1 and R _i form R _i ’s challenge response value for R _i-1 :

TokenR _i R _i-1 =ID_R _i ||ID_R _i-1 ||Random_R _i-1 ||Sign _Ri (ID_R _i ||ID_R _i-1 ||Random_R _i-1 ), and will carry the number of this node The node verification response message of the certificate Cert_R _i and TokenR _i R _i-1 is sent to the neighboring node R _i-1 .

Step 304', if R _i receives a node verification request message from the downlink request object node, the process is similar to the above step 304, as shown by the dotted line in Figure 3, only the uplink request object node is replaced with the downlink request object node .

Step 305: After receiving the node verification response message, R _i-1 verifies whether Cert_R _i is valid, and uses the public key in Cert_R _i to verify R _i 's challenge response value TokenR _i R i- ₁ for R _i-1 Whether the signature in is valid, if both the digital certificate and the signature are valid, then the verification is passed, and R _i-1 will feed back the IP address of its last hop node R _i-2 to the requester R _i ; the digital certificate and the signature As long as one is invalid, the node verification response message is discarded.

Step 305', if the downlink request object node receives the node verification response message, the process is similar to the above step 305, as shown by the dotted line in Figure 3, just replace the uplink request object node with the downlink request object node; if the number If the certificate and signature are both valid, the verification is passed, and the downlink request object node sends the IP address of the next hop node of this node to the requester R _i (for example, when the downlink request object node is R _i+1 , send R _i+2 IP address).

Step 306: If the received IP address is not the target node R _i wants to find, then use the node corresponding to the IP address received by R _i from the uplink request object node as the new uplink request object of R _i The node uses the node corresponding to the IP address received by R _i from the downlink request object node as the new R _i downlink request object node, adds 1 to Hop, and then returns to step 302 . If the received IP address is the target node that R _i wants to find, the neighbor node discovery process ends.

Embodiment 2, a node discovery system in a communication network, comprising:

A plurality of nodes, including at least a source node and a destination node for node discovery;

Each node includes:

The request sending module is used to send a discovery request message to the next hop node when the current node is used as the source node, and the discovery request message carries the address information of the source node, the identity information of the source node, and the address of the destination node Information and the challenge value generated by the source node;

The request response module is used to return to the source node the verification information submitted by the node to the source node after receiving the discovery request message, including: the address information and digital certificate of the node, and the verification information of the node for the source node. challenge response value;

The request forwarding module is used for judging whether the node is a destination node according to the address information therein after receiving the discovery request message; if the node is an intermediate node, forwarding the discovery request message to the next node of the node one hop node;

The verification module is used to verify each node according to the received verification information submitted by each node after receiving the verification information returned by the destination node when the node is used as the source node; Nodes are identified as trusted nodes.

In an implementation of this embodiment, the challenge response value of a node to the source node can be related information between the source node and the node, and the signature generated by using the private key of the node to perform logical operations on the related information Result; wherein, the relevant information between the source node and the node includes: the identity information of the node, the identity information of the source node, and the challenge value generated by the source node;

The verification module verifying each node according to the received verification information submitted by each node may specifically refer to:

The verification module respectively verifies whether the address information and the digital certificate in the verification information submitted by each node are valid; respectively verifies whether the signature in the challenge response value generated by the node is valid through the public key carried in the digital certificate of each node.

In an implementation manner of this embodiment, the next-hop node that the request forwarding module forwards the discovery request message to the current node may specifically refer to:

The request forwarding module saves the address information of the previous hop node in the discovery request message, and then deletes the additional information of other nodes other than the source node in the discovery request message, and in the discovery request message Add the additional information of this node in , and finally send it to the next hop node of this node; the additional information includes: the address information of this node, identity information and the challenge value generated by this node;

Each node can also include:

The proximity response module is configured to construct a proximity discovery response message and send it to the previous hop node when the previous hop node is not the source node, which carries the verification information submitted by the current node to the previous hop node, including: the current node Address information, digital certificates, and the node’s challenge response value for the previous hop node; the node’s challenge response value for the previous hop node is the relevant information between the previous hop node and this node, and the private The result of logical operations on the signature generated by the key to the relevant information; wherein, the relevant information between the previous hop node and this node includes: the identity information of the current node, the identity information of the previous hop node, and the previous The challenge value generated by jumping nodes.

In this embodiment, the verification module can also be used to verify whether the address information and digital certificate of the next-hop node are valid after receiving the proximity discovery response message, and pass the digital certificate of the next-hop node The public key carried in verifies whether the signature in the challenge response value generated by the next-hop node is valid; if all are valid, save the address information of the next-hop node.

In this embodiment, each node may also include a neighboring node discovery module, specifically including:

address request unit;

The setting unit is used to use the previous hop node of the current node as the uplink request object node when the current node receives the discovery request message and the current node is not the destination node; if the current node saves the next hop node For the address information, the next hop node is used as the downlink request object node; the hop value is set to 1, and sent to the address request unit together with the uplink and downlink request object nodes;

The address request unit is configured to send a node address request message to the uplink request object node, which carries the hop value, a request for the address information of the previous hop node of the uplink request object node, and the identity of the node Information and the challenge value generated by this node; if there is a downlink request object node, then send a node address request message to the downlink request object node, which carries the hop value, the next hop node to the downlink request object node The address information request, the identity information of the node and the challenge value generated by the node;

The verification request unit is used to construct the address information of the upper/next hop node if the node saves the address information of the upper/next hop node after receiving the node address request message sent by the node R _a to request the address information of the upper/next hop node. The node verification request message is returned to the node R _a , which carries the identity information of the node, the digital certificate, the challenge value generated by the node and the challenge response value of the node for the node R _a ;

The verification response unit is used to send a node verification response message to the node R _{b if the verification is passed after receiving the node verification request message returned by the node R b ,} which carries the digital certificate of the node and the node A challenge response value for the node R _b ;

The verification request unit is also used to feed back the address information of the upper/next hop node of the node (if the received node address request message requests is the address information of the previous hop node, the address information of the previous hop node is fed back; if the received node address request message requests the address information of the next hop node, the address information of the next hop node is fed back);

The setting unit is further configured to use the node corresponding to the address information received by the node from the uplink request object node as the uplink request object when the received address information does not belong to the target node that the node is looking for A node, using the node corresponding to the address information received by the node from the downlink request object node as the downlink request object node, adding 1 to the hop value, and then combining with the uplink request object node and the downlink request object node The object node sends to the address request unit together; if the received address information belongs to the target node that the node is looking for, the adjacent node discovery process ends.

Those skilled in the art can understand that all or part of the steps in the above method can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk or an optical disk, and the like. Optionally, all or part of the steps in the foregoing embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiments may be implemented in the form of hardware, or may be implemented in the form of software function modules. The present invention is not limited to any specific combination of hardware and software.

Of course, the present invention can also have other various embodiments, and those skilled in the art can make various corresponding changes and deformations according to the present invention without departing from the spirit and essence of the present invention, but these corresponding Changes and deformations should all belong to the protection scope of the claims of the present invention.

Claims (8)

1. the node discovery method in communication network, including:

S101, source node send and find that request message, to next-hop node, is taken in described discovery request message Address information, the identity information of source node, the address information of destination node and source node with source node are raw The challenging value become；

S102, receive the node of described discovery request message and return this node to described source node and submit to institute State the checking information of source node, including: the address information of this node and digital certificate, and this node pin Challenge responses value to source node；Judge to save for the purpose of whether this node according to described address information therein Point, then preserves the upper hop address of node letter in described discovery request message if not destination node Breath, then deletes in described discovery request message the additional information of other node beyond source node, in institute State the additional information finding to increase this node in request message, be last transmitted to the down hop joint of this node Point；Described additional information includes: the challenge that the address information of this node, identity information and this node generate Value；

When upper hop node is not described source node, structure is neighbouring finds that response message is sent to upper hop Node, wherein carries this node and submits to the checking information of upper hop node, including: this address of node Information, digital certificate and this node are for the challenge responses value of upper hop node；This node is for upper one The challenge responses value of hop node is the relevant information between upper hop node and this node, with this node of employing Private key signature that this relevant information is generated carry out the result of logical operations；Wherein, upper hop node With the relevant information between this node includes: the identity information of this node, the identity information of upper hop node, And the challenging value that described upper hop node generates；

S103, described source node are after receiving the checking information that destination node returns, each according to received Each node is verified by the checking information that node is submitted to；If be all verified, by each described node It is defined as trusted node.

2. the method for claim 1, it is characterised in that:

One node is the relevant information between source node and this node for the challenge responses value of source node, With the result that the signature using the private key of this node to generate this relevant information carries out logical operations；Wherein, Relevant information between source node and this node includes: the identity information of this node, the identity letter of source node The challenging value that breath and described source node generate；

Each node is verified by the checking information that described source node is submitted to according to each node received Step includes:

Described source node separately verifies the address information in the checking information that each node is submitted to and digital certificate The most effective；The challenge generated by this node of public key verifications carried in each node digital certificate respectively is rung Signature in should being worth is the most effective.

3. the method for claim 1, it is characterised in that also include:

Receive the described neighbouring node verification wherein next-hop node finding response message address information and Whether digital certificate is effective, and by the public key verifications carried in the digital certificate of this next-hop node under this Signature in the challenge responses value that one hop node generates is the most effective；If all effective, preserve this down hop Address of node information.

4. method as claimed in claim 3, it is characterised in that also include after described S103:

S104, each intermediate node R_iFollowing the steps below respectively, described intermediate node is described purpose joint The node receiving described discovery request message beyond Dian:

41、R_iUsing the upper hop node of this node as upstream request Object node；If this node preserves There is the address information of next-hop node, then using this next-hop node as downbound request Object node；To jump Numerical value is set to 1；

42、R_iTo described upstream request Object node sending node Address requests message, wherein carry described Jumping figure value, the request of upper hop address of node information to described upstream request Object node, this node Identity information and this node generate challenging value；

If there is described downbound request Object node, then R_iSend to described downbound request Object node Node address request message, wherein carries described jumping figure value, to next of described downbound request Object node The challenging value that the request of the address information of hop node, the identity information of this node and this node generate；

43, uplink/downlink request Object node receives described R_iThe request up/down one hop node address letter sent After the node address request message of breath, if this node has the address information of up/down one hop node, then structure Make node verification request message and return to R_i, wherein carry the identity information of this node, digital certificate, basis The challenging value of node generation and described node are for R_iChallenge responses value；

44、R_iAfter receiving the node verification request message of described uplink/downlink request Object node, if tested Demonstrate,prove and ask Object node by then sending node auth response message to described uplink/downlink, wherein carry R_i Digital certificate and R_iChallenge responses value for described uplink/downlink request Object node；

45, after described uplink/downlink request Object node receives described node verification response message, if tested Card passes through, then the address information of up/down one hop node of this node is fed back to R_i；

If 46 address informations received also are not belonging to R_iDestination node to be looked for, then by R_iFrom institute State node corresponding to address information that upstream request Object node received as R_iUpstream request object Node, by R_iNode corresponding to the address information that received from described downbound request Object node is as R_i Downbound request Object node, described jumping figure value is added 1, is then back to step 42；If the ground received Location information belongs to R_iDestination node to be looked for, then adjacent node discovery procedure terminates.

5. the node in communication network finds a system, including:

Multiple nodes, at least a part of which includes being ready for source node and the destination node that node finds；

It is characterized in that, each node includes respectively:

Request sending module, for when this node is as source node, sends and finds that request message is to next Hop node, carry in described discovery request message the address information of source node, the identity information of source node, The challenging value that the address information of destination node and source node generate；

Request respond module, for after receiving described discovery request message, returns this node to source node Submit to the checking information of described source node, including: the address information of this node and digital certificate, and This node is for the challenge responses value of source node；

Request forwarding module, for after receiving described discovery request message, according to address information therein Judge node for the purpose of this node is whether；If this node is intermediate node, preserves described discovery and ask report The address information of the upper hop in literary composition, then deletes described in described discovery request message beyond source node The additional information of other node, increases the additional information of this node, finally in described discovery request message It is sent to the next-hop node of this node；Described additional information includes: the address information of this node, identity The challenging value that information and this node generate；

Authentication module, for when this node is as source node, when receiving the checking letter that destination node returns After breath, according to the checking information that each node received is submitted to, each node is verified；If all tested Card is by being then defined as trusted node by each described node；

Neighbouring respond module, for when upper hop node is not described source node, the neighbouring discovery of structure is rung Answer message to be sent to upper hop node, wherein carry this node and submit to the checking information of upper hop node, Including: the address information of this node, digital certificate and this node are for the challenge responses of upper hop node Value；This node is being correlated with between upper hop node and this node for the challenge responses value of upper hop node Information, with the knot that the signature using the private key of this node to be generated this relevant information carries out logical operations Really；Wherein, the relevant information between upper hop node and this node includes: the identity information of this node, The challenging value that the identity information of upper hop node and described upper hop node generate.

6. system as claimed in claim 5, it is characterised in that:

One node is the relevant information between source node and this node for the challenge responses value of source node, With the result that the signature using the private key of this node to generate this relevant information carries out logical operations；Wherein, Relevant information between source node and this node includes: the identity information of this node, the identity letter of source node The challenging value that breath and described source node generate；

Each node is verified by the checking information that described authentication module is submitted to according to each node received Refer to:

Described authentication module separately verifies the address information in the checking information that each node is submitted to and numeral card Book is the most effective；The challenge generated by this node of public key verifications carried in each node digital certificate respectively Signature in response value is the most effective.

7. system as claimed in claim 5, it is characterised in that:

Described authentication module is additionally operable to, after receiving described neighbouring discovery response message, verify wherein down hop Address of node information and digital certificate are the most effective, and by the digital certificate of this next-hop node is taken Signature in the challenge responses value that this next-hop node of public key verifications of band generates is the most effective；If all had Effect then preserves the address information of this next-hop node.

8. system as claimed in claim 7, it is characterised in that also include in each node:

Adjacent node discovery module, including:

Address requests unit；

Unit is set, for receiving described discovery request message and this node is not described purpose when this section point During node, using the upper hop node of this node as upstream request Object node；If this node is preserved The address information of next-hop node, then using this next-hop node as downbound request Object node；By jumping figure Value is set to 1, and described up, downbound request Object node sends jointly to described Address requests unit；

Described Address requests unit is for described upstream request Object node sending node Address requests report Literary composition, wherein carries described jumping figure value, believes the upper hop address of node of described upstream request Object node The challenging value that the request of breath, the identity information of this node and this node generate；If there is downbound request pair As node, then to described downbound request Object node sending node Address requests message, wherein carry described Jumping figure value, the request of address information of next-hop node to described downbound request Object node, this node Identity information and this node generate challenging value；

Checking request unit, for when receiving node R_aThe request up/down one hop node address information sent Described node address request message after, if this node preserves the address information of up/down one hop node, Then structure node checking request message returns to described node R_a, wherein carry this node identity information, The challenging value of digital certificate, this node generation and described node are for described node R_aChallenge responses Value；

Auth response unit, for when receiving node R_bAfter the described node verification request message returned, The most then sending node auth response message gives described node R_b, wherein carry this node Digital certificate and this node are for described node R_bChallenge responses value；

Described checking request unit is additionally operable to after receiving described node verification response message, if checking is logical Cross, then feed back the address information of up/down one hop node of this node；

The described unit that arranges is additionally operable to work as received address information and be not belonging to the target that this section point is to be looked for During node, node corresponding to the address information that received from described upstream request Object node by this node is made For described upstream request Object node, the address that this node is received from described downbound request Object node Then and institute described jumping figure value, as described downbound request Object node, is added 1 by node corresponding to information, State upstream request Object node, described downbound request Object node sends jointly to described Address requests list Unit；If the address information received belongs to the destination node that this node is to be looked for, then adjacent node discovery procedure Terminate.