System and method of automatically preventing and arranging processing strategy conflicts

Abstract

The invention discloses a system and a method of automatically preventing and arranging processing strategy conflicts. The method of solving the processing strategy conflicts comprises steps that (1) when a first packet of a new business flow is transmitted to a controller, and the security authorization module of the controller is used for the safety rule matching of the data packet, and a network entry switch is used to admit or reject the new business flow; (2) a flow path is established by acquiring network flow information; (3) the strategy conflicts are detected, and different processing methods are adopted according to the different strategy conflicts. The system and the method are used to detect the safety strategy conflicts or application strategy conflicts caused by changes of network states and flow accurately. The system is capable of effectively and timely solve the conflicts according to the concrete states of the conflicts such as partial rule conflicts or full conflicts. The system and the method are used to detect and solve the strategy conflicts actively, and therefore the safety and high-efficiency operation of the network is realized.

Description

technical field [0001] The invention belongs to the technical field of network policy conflict resolution, in particular to a dynamic management method of a cloud host network interface. Background technique [0002] Software Defined Networking SDN (Software Defined Networking) is a new network innovation architecture proposed by the CleanSlate research group of Stanford University in the United States. Its core concept is the separation of data forwarding and control planes. OpenFlow is a software-defined network SDN solution, which greatly increases the flexibility of the network. [0003] A basic OpenFlow technology networking structure such as figure 1 As shown, it includes OpenFlow switches and controllers. When the first data packet arrives at the OpenFlow switch, the switch uses the OpenFlow protocol to forward it to the controller through a secure channel. The software on the controller makes a forwarding decision and sends the policy to the flow table of the switc...

AI Technical Summary

Problems solved by technology

There is also a rule conflict between applications. Application 1 sends flow table 11 to switch 1, and sends the IPv4 data packet with source address A to port 1. Application 2 also sends flow table 21. To switch 1, send the TCP data packet whose source address is A to port 2. If the priority of the two is different, follow the rule with the higher priority. If the priority of the two is the same, it will cause a conflict. This is the flow rule problems caused by dependencies

[0006] The current policy conflict resolution solution only implements conflict detection in the running state, that is, only when the policy is deployed, the network fails at runtime, and the performance deteriorates, security vulnerabilities and other issues are exposed

And this is just a kind of conflict detection, which cannot prevent policy conflicts, let alone implement policy orchestration and resolve policy conflicts

Images