Saturation attack defending method, device and system of buffer queue in outlet gateway

Abstract

The invention discloses a saturation attack defending method, device and system of a buffer queue in an outlet gateway, and belongs to the field of network safety. The method comprises the steps of receiving a data packet transmitted by a terminal; when flow table items in a data packet static flow table and a dynamic flow table are unmatched, transmitting the data packet to a central controller; and forwarding the data packet based on a flow table item fed back by the central controller. According to the saturation attack defending method, device and system of the buffer queue in the outlet gateway, the problem that buffer queue overflow is resulted easily to enable the whole SDN (Software Defined Network) to be supersaturated when a malicious user transmits a large number of data packets having different destinations and carrying with relatively great loads is solved, and the effect of avoiding buffer queue overflow due to that the outlet gateway suddenly receives a large number of data packets having different destinations when a mobile network suffers from network attack of an illegal terminal is realized as frequently-used data packets are directly matched in the outlet gateway rather than being added into the buffer queue to be transmitted to the central controller.

Description

Technical field [0001] The invention relates to the field of network security, and in particular to a method, device and system for defending against saturation of buffer queues in an egress gateway. Background technique [0002] In order to better provide reliable Internet services for the fourth generation of mobile communication users, in the future mobile Internet design, centralized control is proposed for mobile communication users' access. Software Defined Network (English: SoftwareDefinedNetwork, abbreviated as: SDN) adopts the idea of ​​centralized control. Its core technology, OpenFlow, separates the control plane of network equipment from the data plane, thereby realizing flexible control of network traffic. [0003] When the data flow from the user plane arrives at the switch, if there is a flow table matching the data flow on the switch, it will be forwarded. If there is no flow table matching the data flow, the data packets will be temporarily cached in the cache queu...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the limited size of the cache queue of the switch in the prior art, when a malicious user sends a large number of data packets with different destinations and a large load, it is easy to cause the cache queue to overflow, which in turn increases the processing burden of the controller, making the entire SDN network To solve the problem of oversaturation, the embodiment of the present invention provides a method, device and system for defending against cache queue saturation attacks in egress gateways

Images