Implementation method of software-defined firewall system

Abstract

The invention discloses an implementation method of a software-defined firewall system, which belongs to the technical field of computer networks. The method comprises the following steps: establishing connection between an OpenFlow switch and an SDN controller, and receiving a table-miss flow table entry and an initial flow table entry; sending the data packet by the OpenFlow switch to the SDN controller; performing state detection filtering on the TCP data packet by a state detection filtering module in the SDN controller through combinations with the firewall rule and the state of the datapacket, and maintaining a state connection table; and performing packet filtering on the stateless IP protocol data packet by a packet filtering module in the SDN controller according to a firewall rule, and issuing a flow table entry to the OpenFlow switch to guide subsequent data packet processing. According to the method, stateless packet filtering and stateful state detection filtering can berespectively carried out on data packets of different protocol types, the state firewall function is achieved, the operand of the SDN controller is reduced by issuing the flow table item in the packetfiltering process, in addition, an OpenFlow protocol does not need to be modified when state detection filtering is achieved, and higher universality is achieved.

Description

technical field [0001] The invention belongs to the technical field of computer networks, and in particular relates to an implementation method of a software-defined firewall system. Background technique [0002] SDN (Software Defined Networking) proposes the idea of ​​separating the control plane and data plane of network equipment, and strips the software part that originally runs on proprietary hardware equipment, making network equipment a white box that no longer runs any network protocols. It is only responsible for the matching and forwarding of network data packets. The OpenFlow protocol is a standard southbound interface protocol for communication between OpenFlow switches and controllers. SDN technology makes the control plane of network equipment programmable, and centrally manages and controls network equipment through controllers, which greatly facilitates network configuration management, reduces the cost of hardware equipment, and shortens the cycle of networ...

AI Technical Summary

Problems solved by technology

At present, the Floodlight controller has a firewall module. The firewall module implements a stateless packet filtering firewall. It monitors the first data packet of the network flow to realize the access control function. However, this purely stateless firewall cannot The state of the packet filters the data packet, which has great limitations. For example, it cannot realize the one-way TCP access of the internal and external network

Wang Juan and others added a state table to the SDN controller and the OpenFlow switch, and realized the synchronization state connection table between the SDN controller and the OpenFlow switch by modifying the OpenFlow protocol. However, this method needs to modify the OpenFlow protocol. In practical applications, It is necessary to modify the hardware of the OpenFlow switch, which increases the complexity of data packet processing at the data layer. In addition, this method performs state detection on all types of data packets in the network. For stateless protocol data packets such as UDP protocol data packets , the method of establishing a virtual connection increases the additional burden of the SDN controller and the OpenFlow switch

Images