Flow cleaning architecture, device and flow traction, flow reinjection method

Abstract

The invention discloses a flow cleaning architecture, device, and flow traction and flow reinjection method, including an OpenFlow controller that generates a flow cleaning flow table and a flow reinjection flow table and sends them to an OpenFlow cleaning switch; generates a flow traction flow table and Send it to the OpenFlow core router. When an attack occurs, the OpenFlow cleaning switch matches the traffic of the attacked server drawn according to the traffic pulling flow table according to the traffic cleaning flow table to perform traffic cleaning; forwards the cleaned "clean" traffic according to the traffic reinjection flow table to Realize flow reinjection. The present invention is based on the OpenFlow traffic cleaning architecture, and realizes traffic traction and traffic reinjection in a unified manner; the abnormal traffic cleaning component is composed of an OpenFlow controller and an OpenFlow cleaning switch, and realizes the separation of control and forwarding of the traffic cleaning system; when business requirements change , it only needs to update various flow tables through the OpenFlow controller, so that the reconfiguration and deployment of the network can be realized simply and flexibly.

Description

technical field [0001] The invention relates to a flow cleaning technology, in particular to a flow cleaning structure, a flow cleaning device, and a flow traction and flow reinjection method. Background technique [0002] Distributed denial of service (DDoS, DistributedDenialofService) has become the most common type of attack on the Internet. Attack tools are easily available on the Internet, and the technical threshold for launching attacks is very low. Recently, the traffic of DDoS attacks has increased significantly. The attack traffic of tens of gigabytes appears frequently, and the highest has reached 300 gigabytes. It has even gradually developed into an open service. [0003] At present, the relatively mature means of defending against DDoS attacks is traffic cleaning, that is, operators connect or side-connect a traffic cleaning center in the MAN to clean up the DDoS attack traffic that occurs in the MAN without affecting normal services. Filter to realize the pro...

AI Technical Summary

Problems solved by technology

However, in this traffic reinjection method, when the route of the aggregation device changes, the core device and abnormal traffic cleaning components cannot perceive it, so automatic adjustment cannot be performed, which affects the realization of traffic reinjection

[0013] To sum up, in the existing traffic cleaning solution, traffic diversion and traffic reinjection need to consider various implementation methods according to different deployment scenarios, routing protocols, and actual services on the live network. It is difficult to manage in a unified manner, and it is impossible to achieve separation of control and forwarding

In particular, when the user's business requirements change, it is necessary to re-configure and deploy the network, or even replace the traffic cleaning hardware device, which is difficult and inflexible

Images