Exeley Inc.

Evald, Therese A.

Møhl, Bo

Before the damage is done: Early childhood hyperactivity difficulties in adolescents with deliberate self-harm – findings from the DALSC cohort

Gęsicka, Aleksandra

Henschke, Agata

Barańska, Zuzanna

Wolna-Maruwka, Agnieszka

BACILLUS THURINGIENSIS – NOWY POTENCJAŁ APLIKACYJNY

Daniels, G.

An update on the Lutheran blood group system

Cooling, L.

An update on the I blood group system

Lee, Y.Q.

Storry, J.R.

Olsson, M.L.

The Xg blood group system: no longer forgotten

Mandal, S.

Malhotra, S.

Negi, G.

Tiwari, A.

Mitra, S.

Basu, S.

Singh, P.

Severe hemolytic disease of the fetus and newborn due to anti-E and anti-Jka

Stenfelt, L.

Hellberg, Å.

Westman, J.S.

The P1PK blood group system: revisited and resolved

Xie, Jianping

Nan, Xianghao

AliAb, Zoraghchin

International Journal of Advanced Network, Monitoring and Controls      Volume 05, No.01, 2020 
DOI: 10.21307/ijanmc-2020-002                                                           9 
Research on Real-Name Routing and Trusted Connection 
Based on IPV9 and CPK-card  
 
Xie Jianping  
1.
Chinese Decimal Network Working Group, 
Shanghai, China  
2.
Shanghai Decimal System Network Information 
Technology Ltd. Shanghai, China 
E-mail: 13386036170@189.cn 
Nan Xianghao 
1.
Chinese Decimal Network Working Group, 
Shanghai, China  
2.
Shanghai Decimal System Network Information 
Technology Ltd. Shanghai, China 
E-mail: nanxh2001@163. com  
AliAbZoraghchin 
Department of Computer Engineering Allame 
Mohaddes Noori Institute of Higher Education 
Mazandaran, Iran 
E-mail: aliab@yahoo.com 
 
 
 
 
 
 
 
 
 
 
Abstract—Router is the basic component of the Internet. In 
this scheme, identification technology is used for the first time 
in router design to provide address authenticity proof to 
prevent illegal access. Provide proof of connection freshness to 
prevent reissue attacks; the first use of software identification 
technology, to provide the credibility of the router operating 
environment, to prevent Trojan and other malicious software 
intrusion. The design also provides densification function to 
ensure privacy. This is a key security requirement for the next 
generation of Internet protocols. This design method will be 
combined with the new addressing technology of geographical 
location addressing to construct the next generation of Internet 
routers. The technology is also used in the design of new 
switches in telecommunications networks. 
Keyword-IPV9; CPK-card; Real-Name Routing; Trusted 
Connection 
I. INTRODUCTION 
Routers work in the network layer of the OSI 
seven-layer protocol. Their main function is to connect 
the network with the network and forward packets 
between the networks. Routers have become the most 
important network equipment, so the research on the 
new generation of routers will become the core 
technology of the next generation of Internet research. 
Due to the IPv4, IPv6 protocols that used in the 
Internet, the new requirements for trusted Cyber 
Security connections are not met. The TCP/IP protocol 
has no security concerns, it does not provide address 
authentication, does not prevent unauthorized access, 
and does not protect against DOS attacks. 
At present, all kinds of malicious software and 
spam information are rampant on the Internet, which 
seriously pollutes the use environment of the Internet 
and directly affects the survival of the Internet. As a 
result, all countries over the world have developed a 
new generation of green Internet research. In 2008 the 
European Union's 65 scientific institutions jointly 
issued the brad declaration, calling for a new 
generation of the Internet. The European Union has 
raised 9.1 billion Euros to support future Internet 
research and development. The U.S governments have 
also successive proposed identity authentication and 
Addressing system as major scientific research tasks, 
and emphasized international cooperation. ISO, the 
international standards body, put forward its plan for 
the future network in 2007. 
In 2007, Chinese researchers Xie Jianping proposed 
the IPv9 geographical location addressing method, 
which solved the problem of combining IP address 
with geographical location. Later, South Korea also 
proposed the idea of geographical location addressing, 
and becoming the second country to propose a new 
method of addressing. CPK (Combined Public Key) 
identity authentication technology is mature and can be 
used in Internet protocol to realize trusted connection. 
International Journal of Advanced Network, Monitoring and Controls      Volume 05, No.01, 2020 
10 
So far, China had already had the technology 
foundation that research and development next 
generation router and future network protocol. 
II. REQUIREMENTS FOR TRUSTED CONNECTIONS 
In order to realize the trusted connection between 
routers and users, the user name (Pc1) and route 
address (Alfa) are identified for identity authentication. 
Among routers, mutual authentication is made with IP 
address as identity, and mutual authentication is made 
with user name as identity between users. Suppose that 
Pc1ID is the user name of a client and AlfaID is the IP 
address of a router. Assume that AlfaID="china-
beijing-haidian-peking university" and BetaID="china-
beijing-haidian-tsinghua university". 
Now assume the starting address is AlfaID and the 
destination address is BetaID, and the connection 
process is shown in figure 1 (dotted lines indicate that 
CPK-card is used and the original address is 
identified).. 
 
Figure 1. Data workflow diagram 
The IP packet of the original router passes through 
multiple routing routers and finally arrives at the 
destination router. Illegal access is easy to access in the 
intermediate routing router. It can be seen from the 
working principle of the above router that previous 
routers only pay attention to the routing of the next hop 
and do not care where the packet comes from. 
Therefore, if we do not solve the origin address 
verification, we cannot overcome the illegal access. 
Some people try to solve the problem of illegal 
access by means of encryption, but under the condition 
of public key system, this is futile. For example, Beta 
is the receiving party, and its public key is public, so 
anyone can encrypt Beta, so Beta still doesn't know 
who the sender is. 
In order to achieve the trusted connection, the 
router must meet the following four conditions:  
1) The primary IP address must be given to send 
proof of address; it can be verified by any one place;  
2) All routing routers verify the original address, 
and reject forward if there is any discrepancy;  
3) It can prevent illegal access and resist DOS 
attacks.  
4) The internal computing environment of the 
router is reliable. 
III. IPV9 CONNECTION ENVIRONMENT 
The connection policy is as follows. 
Path 1 (all using IPV9 protocol and CPK-card) 
1) Pc1ID signs the data with pc1 and delivers the 
signed data to the router AlfaID. 
2) AlfaID signs the time with alfa and forwards it 
to the next router, which verifies the signature of the 
original address. If the verification passes, the data is 
forwarded to the next router. 
3) GamID, LamID, BetaID and other routing 
operations are the same as above. 
4) The BetaID route forwards the data to the 
receiving user Pc2ID. 
Path 2 (Client adopts IPV9 protocol, but does not 
use CPK-card) : 
International Journal of Advanced Network, Monitoring and Controls      Volume 05, No.01, 2020 
11 
1) Pc3ID does not use CPK-card but sends data to 
Pc4ID via routing AlfaID via PT converted to IPV9 
protocol. 
2) The AlfaID route obtains the packet source 
address as the public key and verifies the correctness of 
the source. 
Path 3 (The client does not use IPV9 protocol and 
CPK-card): 
1) Pc3ID does not use CPK-card and USES 
IPV4/IPV6 protocol to route data to Pc4ID via AlfaID. 
2) Route through the DeltaID and SigID routes to 
the BetaID route and forward the data to PC4ID. 
Path 4 (The client adopts IPV9 protocol and USES 
CPK-card, but the middle V9 route does not use CPK-
card): 
1) Pc1ID using the local address as the public key 
to sign the data and sends data to Pc2ID via route 
AlfaID. 
2) The AlfaID route takes the source address of the 
packet as the public key and verifies the correctness of 
the source. After verification of the source address, 
remove the original signature and use the local address 
as the public key signature. After the signature, 
forward the normal routing data. 
3) Instead of using CPK-card, GamID obtains the 
source address of the packet as the public key and 
verifies the correctness of the source. If the address is 
not legitimate, the data is discarded and the normal 
routing data is forwarded. 
4) LamID, BetaID and other routing operations are 
the same as above. 
5) The BetaID route forwards the data to the 
destination Pc2ID. 
The IPV9 v4/v6 compatible data forwarding 
process is shown in figure 2. 
 
Figure 2. Data forward process diagram 
IV. IPV9 AUTHENTICATION FUNCTION 
A. CPK-Card 
CPK is a public key-based cryptography system 
that takes the identity of any entity directly as the 
public key, while the private key is distributed in the 
form of ID-card. Now, for example PC1, ALFA 
(uppercase) and so on respectively represent their 
public keys, pc1, alfa (lowercase) and so on 
respectively represent their private keys. If it has been 
insert a CPK-card defined as AlfaID on any router, the 
router becomes the identified router as AlfaID. 
Similarly, any router inserts a CPK-card defined as 
BetaID, and the router becomes the identified router as 
BetaID. 
The router is configured with CPK-card, which has 
the functions of digital signature and key exchange. 
The contents of CPK-card are as follows: let the 
router's IP address be alfa (alfa may be the real name of 
China. Beijing. Haidian. Peking University etc. and it 
can be changed into machine executable code after the 
unified name translation). ID-card format and size is as 
table 1. 
International Journal of Advanced Network, Monitoring and Controls      Volume 05, No.01, 2020 
12 
B. Original address identification 
Suppose the original place is AlfaID, the next router 
is GammaID, AlfaID sends data, Mas1 
AlfaID→GammaID:{Alfa, sign1, Beta, time data, 
checksum} 
Where, sign1 is the signature of the original AlfaID 
address, that is sign1= SIGalfa (time), BetaID is the 
destination address, SIG is the signature function, and 
alfa is the private key of the signature, provided by 
CPK-card. Where data is data from the application 
layer, data may be plaintext or ciphertext. The router's 
job is to pass the data to the next router. 
TABLE I. ID-CARD FORMAT AND SIZE 
1 Z1: Validate parameter 16B EPWD(R1)=Z1 
2 Z2: Validate parameter 16B ER1(R1) ⊕ R1=Z2 
3 Identify definition 25B alfa 
5 Private key 1 32B ER1(csk1)=Y1 
6 Private key 2 32B ER1(csk2)=Y2 
10 Issue unit 25B KMC 
11 Signature of issue unit 48B SIGkmc （MAC） 
 
GammaID verifies the signature of original address: 
SIG -1ALFA(time )=sign1' 
Where SIG-1 is the validation function and ALFA 
is the public key. If sign1=sign1', allow this connection, 
forward Msg1, and audit. Identify replay attacks 
against time. 
V. IPV9 ENCRYPTION FUNCTION 
The structure of data is defined as follows: 
Data={Pc1ID,Pc2ID,data, mac}, Where Pc1ID is the 
sender and Pc2ID is the receiver. 
When the data is in plaintext: Data={ Pc1ID, Pc2ID, 
clear-text, mac}; 
When the data is in ciphertext: Data={Pc1ID, 
Pc2ID, coded-key, coded-data, mac}; 
If the encryption and decryption function is 
provided by the router, and Alfa encryption and Beta 
decryption are set, then data encryption can only be 
done in a non-online way. 
If the router is responsible for encryption and 
decryption, and this data is encrypted data, coded key 
and coded data need to be interpreted and a series of 
steps shall be performed: 
1) Generate random number R, AlfaID calculation 
key: key=R × (G); where G is the base point of the 
elliptic curve; key will be used to encrypt the data; 
2) 2) Calculate the sending key: R(BETA)=coded-
key, where BETA is the public key of BetaID and 
coded-key is sent to BetaID. 
3) 3) Encrypt data: Ekey (data) =cipher-text; 
Send ciphertext cipher=text and coded-key to 
BetaID. 
BetaID receives a signal from the AlfaID and 
automatically enters the decryption process. 
 BetaID computes the inverse of the private key: 
beta-1 ; 
 BetaID calculates the session key: beta-
1(coded-key)=key; 
 Data decryption：Dkey(cipher-text)= data. 
VI. IPV9 PACKET HEADER FORMAT AND ENCODING 
FORMAT 
A. Packet header format 
The new features require the development of a new 
IP header format that includes at least the original 
address, the start address identifier, the destination 
address, the data, and the checksum. Data encryption 
only affects the data format, not the IP packet header 
format. 
Version Category Flow label Payload Length Next Header Hop limit 
Source address 
Destination address 
time 
Identification code (signature) 40BYTE 
 
International Journal of Advanced Network, Monitoring and Controls      Volume 05, No.01, 2020 
13 
B. IPV9 coding format 
The encoding format of IPV9 is shown in the following table 2. 
TABLE II. ENCODING FORMAT OF IPV9 
segment 1 2 3 4 5 6 7 
Head 
segment 
Address area 
Entity 
code 
Vendor code Product code 
Product class code 
Country 
code 
District 
code 
Year code 
Single 
product 
code 
2 4 6 4bit 14bit 20bit 8bit 199bit 
  362300 3211 123345678912345 12345678912345678912 20090317 32564328 
 
When the industrial standard "business RFID label 
data format" is adopted, the enterprise product coding 
data format is as follows: 
1) The basic data format of enterprise products is as 
follows: 
12345678912345-12345678912345678912-
20090317-32564328 
2) When data exchange is used between 
management departments, the format of enterprise 
product data is: 
3221-12345678912345-12345678912345678912-
20090317-32564328 
3) When data is exchanged between regions and 
management departments, the format of enterprise 
product data is: 
362300-3221-12345678912345-
12345678912345678912-20090317-32564328  
4) When data are exchanged between countries: 
a) When exchanging with the itu-t E164 data 
system, the data format is: 
00-8600-36230 － 3221-12345678912345-
12345678912345678912-20090317-32564328. 
b) When exchanging with ISO's object identifier 
data system, the data format is: 
01-8600-362300 － 3221-12345678912345-
12345678912345678912-20090317-32564328. 
c) When exchanging with the object identifier 
data system of ISO/ITU, the data format is: 
02-8600-362300 － 3221-12345678912345-
12345678912345678912-20090317-32564328.  
 
C. Enterprise product IPV9 address format 
1) The basic IPV9 address format of enterprise 
products is: 
12345678912345]12345678912345678912]200903
17]32564328.  
2) When data exchange is used between 
management departments, the IPV9 format of 
enterprise product data is: 
3221]12345678912345]12345678912345678912]2
0090317]32564328.  
3) When data is exchanged between regions and 
management departments, the IPV9 format of 
enterprise product data is: 
362300]3221]12345678912345]123456789123456
78912]20090317]32564328 
4) When data are exchanged between countries, the 
IPV9 format is: 
a) When exchanging with the ITU-T, E164 data 
system, the IPV9 data format is: 
00]8600]362300]3221]12345678912345]12345678
912345678912]20090317]32564328 
b) When exchanging with ISO's object identifier 
data system, the IPV9 data format is: 
01]8600]362300]3221]12345678912345]12345678
912345678912]20090317]32564328 
c) When exchanging with the object identifier 
data system of ISO/ITU-T, the IPV9 data format is: 
02]8600]362300]3221]12345678912345]12345678
912345678912]20090317]32564328 
International Journal of Advanced Network, Monitoring and Controls      Volume 05, No.01, 2020 
14 
VII. IPV9 TRUSTED COMPUTING 
In order to ensure the credibility of the operation of 
the router, all the execution code in the router must be 
certified by the manufacturer (level 1 certification), 
that is, the manufacturer sign on the appearance of all 
the execution code. Each router has an authentication 
function (provided by CPK-card). 
A. Proof of software code 
The manufacturer has a CPK-card, which can carry 
out manufacturer signature on all system software in 
the router. Implementation software is divided into 
software identity (codeID) and software ontology 
(codeBD), which are signed by the manufacturer 
respectively: 
SIGmanufacturer (codeID) = sign1 
SIGmanufacturer (codeBD)＝sign2 
Where, SIG is the signature function, manufacturer 
is the private key of the manufacturer, codeID is the 
name of the executing code, and codeBD is the HASH 
value of the executing code ontology. Any executing 
code in the router has its own authentication codes, 
sign1 and sign2. 
B. Identification of software code 
The router inserts the CPK-card so that it has the 
CPK authentication function. There are two ways to 
verify the router: one is to uniformly verify when the 
router is turned on, and the code that fails to pass the 
verification is uniformly deleted to ensure that the 
router system returns to the original state; the other is 
that when software code is invoked, it is validated first 
and then executed. 
Verify sign1 and sign2 respectively: 
SIG
-1
MANUFACTURER (codeID)=sign1’ 
SIG
-1
MANUFACTURER (codeBD)=sign2’ 
Where MANUFACTURER is the public key, it is 
allowed execute if sign1=sign1'and sign2=sign2', 
otherwise it is rejected. In this way to ensure that the 
implementation of the router code is the manufacturer 
certification code, other code will not be executed, 
from the attack of viruses, Trojans. 
VIII. CONCLUSION 
The TCP/IP protocol does not guarantee trusted 
connections, so it must be modified. Based on 
geographical encoding and location addressing, three 
key techniques of trusted methods are proposed in this 
paper. Use address identification mechanism to prevent 
illegal connection; Adopt random Q&A mechanism to 
prevent replay attack; Software code can be identified 
by the mechanism, to prevent the intrusion of viruses, 
Trojans. 
The above design method is fully applicable to the 
trusted connection of the physical layer. There are two 
kinds of physical layer: one is the physical layer 
defined in the seven-layer information network 
protocol, and the platform supporting the information 
network is the application program interface (API). 
The second is the physical layer defined in the 
telecommunications network, and the platform 
supporting the telecommunications network is the 
telecommunications reference point (TRP). In the 
information network, if the network layer can 
guarantee the credibility of transmission, the security 
of the physical layer can be replaced by the network 
layer. However, the physical layer of the telecom 
network, without modification, cannot achieve trusted 
connection, cannot prevent illegal access. It is modified 
in exactly the same way as the router. 
 
REFERENCES 
[1] Tang Xiaodan etc. Computer Operating System (third edition) [M]. 
Xi’an: Xidian university press, 2010. 
[2] Nan Xiang-hao. CPK Combined Public Key System [J]. Information 
Security and Communication Confidentiality, 2013(03):39-41. 
[3] Xie Jianping etc. A method of assigning addresses to network 
computers using the full decimal algorithm [P]. CN: ZL00135182.6, 
2004.2.6. 
[4] Xie Jianping etc. Method of using whole digital code to assign 
address for computer [P]. US: 8082365, 2011.12. 
[5] Nan Xianghao. CPK Public Key System and Identification 
Identification. [M]. Beijing: People's Posts and Telecommunications 
Press, 2013. 
[6] Xie Jianping,  Xu Dongmei, etc. Digital domain name specification. 
SJ/T11271-2002, 2002.07.  
[7] Information technology-Future Network- Problem statement and 
requirement-Part 2: Naming and addressing, ISO/IEC DTR 29181-2, 
2014, 12.  
[8] Wang Wenfeng, Xie Jianping, etc. Product and service digital 
identification format for information procession. SJ/T11603-2016, 
2016. 06.  
[9] Radio frequency identification tag information query service network 
architecture technical specification.   SJ/T11606-2016, 2016. 06 
 


English

Research on Real-Name Routing and Trusted Connection Based on IPV9 and CPK-card

AYDIN, Dinçer

MIHLAYANLAR, Esma

A CASE STUDY ON THE IMPACT OF BUILDING ENVELOPE ON ENERGY EFFICIENCY IN HIGH-RISE RESIDENTIAL BUILDINGS

Ghazal, Louy

Nabi, Mohammed

Little, Christopher

Teh, James

Ultrasound assessment of extensor pollicis longus tendon rupture following distal radius fracture: a sonographic and surgical correlation

Not a member yet