Credible connection method and system of software defined network

Abstract

The invention relates to the field of software defined network security, and specifically provides a credible connection method and system of a software defined network. The method comprises the following steps: a controller sends a first authentication request to a switch, the switch sends first feedback information to the controller based on the first authentication request, the controller authenticates whether the switch is credible based on a first preset PCR value, the first authentication request and the first feedback information, and sends a configuration query request to the switch when the switch is credible, the switch sends a second authentication request to the controller, the controller sends second feedback information to the switch based on the received second authentication request, the switch authenticates whether the controller is credible based on a second preset PCR value, the second authentication request and the second feedback information, and feeds back configuration information to the controller based on the configuration query request when the controller is credible. By means of the above settings, a credible connection between the switch and the controller is established in the software defined network, thereby avoiding the situation that the network is affected to be paralyzed.

Description

technical field [0001] The present invention relates to the field of software-defined network security, in particular to a trusted connection method and system for software-defined networks. Background technique [0002] The control layer and data forwarding layer of Software Defined Networking (SDN) are separated, and the data forwarding layer is usually managed by the control layer in a unified manner to simplify network management, improve network flexibility, and reduce network adjustment and configuration costs. [0003] The inventors have found that in the existing software-defined network, the controller at the control layer and the OVS (switch) at the data forwarding layer only perform handshakes of protocol versions when establishing a connection, and do not perform a handshake on the peer device to be connected. Perform platform integrity authentication, which in turn may cause the controller or OVS (switch) to be attacked by connecting with risky devices. As the ...

AI Technical Summary

Problems solved by technology

[0003] The inventor found that in the existing software-defined network, the controller at the control layer and the OVS (switch) at the data forwarding layer only perform an interactive handshake of the protocol version when establishing a connection, and do not communicate with the peer device to be connected. Perform platform integrity authentication, which may cause the controller or OVS (switch) to be attacked by connecting with risky devices

As the core of SDN, the controller in the control layer has a particularly important security status. Once it is attacked, it will not work normally, and even cause the network to be paralyzed.

As the executor of data forwarding work, OVS (switch) may be used by dangerous devices to affect functions such as data forwarding and even cause network paralysis

Images