Flow cleaning framework and device and flow lead and reinjection method

Abstract

The invention discloses a flow cleaning framework and device and a flow lead and reinjection method. The flow lead and reinjection method comprises the steps that a flow cleaning flow table and a flow reinjection flow table are generated by an OpenFlow controller and are issued to an OpenFlow cleaning switcher; a flow lead flow table is generated and is issued to an OpenFlow core router. When a server is attacked, flow of the attacked server led according to the flow lead flow table is matched by the OpenFlow cleaning switcher according to the flow cleaning flow table to carry out flow cleaning; the cleaned clean flow is forwarded according to the flow reinjection flow table to achieve flow reinjection. According to the flow cleaning framework based on OpenFlow, flow lead and flow reinjection are achieved uniformly; an abnormal flow cleaning component is composed of the OpenFlow controller and the OpenFlow cleaning switcher to achieve separation of control over a flow cleaning system and forwarding of the flow cleaning system; when service requirements are changed, all kinds of flow tables can be updated just through the OpenFlow controller, and accordingly reconfiguration and redeploy of a network are easily and flexibly achieved.

Description

technical field [0001] The invention relates to a flow cleaning technology, in particular to a flow cleaning structure, a flow cleaning device, and a flow traction and flow reinjection method. Background technique [0002] Distributed Denial of Service (DDoS, Distributed Denial of Service) has become the most common attack type on the Internet. Attack tools are easily available on the Internet, and the technical threshold for launching attacks is very low. Recently, the traffic of DDoS attacks has increased significantly. The attack traffic of tens of gigabytes appears frequently, and the highest has reached 300 gigabytes. It has even gradually developed into an open service. [0003] At present, the relatively mature means of defending against DDoS attacks is traffic cleaning, that is, operators connect or side-connect a traffic cleaning center in the MAN to clean up the DDoS attack traffic that occurs in the MAN without affecting normal services. Filter to realize the pro...

AI Technical Summary

Problems solved by technology

However, in this traffic reinjection method, when the route of the aggregation device changes, the core device and abnormal traffic cleaning components cannot perceive it, so automatic adjustment cannot be performed, which affects the realization of traffic reinjection

[0013] To sum up, in the existing traffic cleaning solution, traffic diversion and traffic reinjection need to consider various implementation methods according to different deployment scenarios, routing protocols, and actual services on the live network. It is difficult to manage in a unified manner, and it is impossible to achieve separation of control and forwarding

In particular, when the user's business requirements change, it is necessary to re-configure and deploy the network, or even replace the traffic cleaning hardware device, which is difficult and inflexible

Images