Strategy conflict detection and solution method based on graphic representation in SDN environment

Abstract

The invention discloses a strategy conflict detection and solution method based on graphic representation in an SDN environment, and the method comprises the steps: storing a flow rule through an extended multi-bit prefix tree, generating a corresponding equivalence class EC and a configuration graph, displaying a network strategy in the form of a strategy graph, firstly applying strategy change generated by each network updating to a network model, and calculating an affected EC from the network model; secondly, checking whether each affected EC in the network model has strategy violation ornot through a violation detection module; if any violation occurs, compressing the configuration graph and the physical topological graph and transmitting the configuration graph and the physical topological graph to a violation solving module; then, enabling the optimizer to return a group of edges of the EC configuration diagram to be added or deleted, applying the edges to the network model andconverting the edges into specific OpenFlow rules; and finally, realizing optimal deployment of the rule on the forwarding equipment by utilizing a heuristic algorithm. According to the method, the correctness condition of the network strategy is expressed as a graph instead of a path set of a traditional method, so that richer strategy sets can be processed, and the detected violation behavior can be optimally repaired. Meanwhile, a heuristic rule layout algorithm is adopted, and the number of rules in the switch is minimized. According to the method, illegal flow rules are rejected with relatively low overhead, so that all policy violation problems are solved, rule conflicts of a large number of endpoint policies are avoided, and certain network service quality is ensured.

Description

technical field [0001] The invention relates to network security technology, in particular to a strategy conflict detection and resolution method based on graphic representation in an SDN environment. Background technique [0002] Software Defined Networking (SDN) is a new type of network architecture that helps to better manage the network and simplify the deployment of new network functions by separating the control module from the forwarding device. The network control logic is composed of bloated routing protocols running on physical devices, which work in conjunction with the network topology information and device configuration information in traditional networks, while the network control logic is implemented by the SDN controller, and the logic is centrally controlled in the SDN. OpenFlow is one of the most well-known southbound interface protocols, which empowers the controller to rely on the forwarding path of packets in the switch. Network availability, security,...

AI Technical Summary

Problems solved by technology

To make matters worse, SDN applications programmed in high-level languages ​​such as Java or Python can be very complex

Images