SD-WAN-based network security supervision method

Abstract

The invention discloses a network security supervision method based on an SD-WAN, and relates to the technical field of BBs. The SD-WAN-based network security supervision method comprises the following specific steps: establishing a central controller to deploy equipment in a jurisdiction area, collecting control plane information of each jurisdiction area, issuing flow table data to a centralized transponder according to an OPENLOW protocol and an SD-WAN controller, and establishing a security data evaluation standard; user identity confirmation: identity element confirmation of the user terminal is completed based on identity authentication, and a safety-related data acquisition system in the user terminal is established; and evaluating behavior data information of the user. According to the invention, centralized calculation is carried out by adopting each level of controller through deployment of various protocols, and the central controller is established, so that the transponder gets rid of a tedious operation process when various associated equipment and network state information are collected in a huge network, and convenience is brought to unified supervision of subsequent network security; and the situation that the intranet equipment is temporarily exposed in the public network is avoided.

Description

Technical Field

[0001] The present invention relates to the field of BB technology, and in particular to a network security supervision method based on SD-WAN. Background Art

[0002] SD-WAN is a software-defined wide area network technology that optimizes network performance, reliability, and security through centralized control and dynamic routing. It simplifies network management, improves connectivity and reliability, and is suitable for enterprises of all sizes. SD-WAN provides a variety of benefits, including reduced costs, improved performance, and optimized management. It is combined with other technologies such as IoT, MPLS, VPN, and SASE to provide enterprises with more efficient and secure network solutions. With the acceleration of digital transformation, SD-WAN has become a key component of enterprise network architecture.

[0003] Large companies usually have many branches scattered around the country, each with its own network, and they need to use the Internet in their actual work. Building a dedicated network security server is costly and requires dedicated maintenance, which causes considerable trouble. Technical exchanges often rely on third-party (public network) communication tools, which have problems such as low communication efficiency and poor security.

[0004] For example, a network security supervision method based on SD-WAN is disclosed in China Invention Publication No. CN117955669A. This network security supervision method uses the GNS3 network simulator for simulation, plans the connection of all devices, configures IP addresses, and deploys NAT technology at the exit of each site to ensure that all sites can access the Internet; deploys tunnel technology between sites, establishes logical link channels for each branch site, deploys OSPF routing protocol in the entire network, deploys backbone areas on tunnel links, and deploys other branches in non-backbone areas. Using IPsec-VPN technology and tunnel separation technology, the internal network return traffic is transmitted through the tunnel, and access to external network resources is normally accessed through NAT technology.

[0005] However, the single-user tunnel link adopted by the above-mentioned supervision method needs to go through the tunnel separation technology to complete the disconnection, reception and sending of the single tunnel. Therefore, there is a risk that the intranet equipment will be briefly exposed to the public network. In addition, the tunnel technology deployed between the sites causes the SD-WAN controller to complete the flow table data and send it to the centralized forwarder. There is too much docking data, its calculations are complicated, and it is impossible to complete the dynamic adjustment of network security monitoring. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a network security supervision method based on SD-WAN, which solves the problems raised in the above background technology.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: a network security supervision method based on SD-WAN, comprising the following specific steps:

[0008] S1: Unified calculation of various protocols in the distributed architecture; establish a central controller to control and deploy the devices within the jurisdiction, collect the control plane information of each jurisdiction, and send the flow table data to the centralized forwarder according to the OPENLOW protocol and SD-WAN controller;

[0009] It should be noted that the existing technology uses various levels of controllers for centralized calculation for the deployment of various protocols, and the establishment of a central controller allows the forwarder to get rid of the cumbersome calculation process when collecting various related devices and network status information in a huge network, which is convenient for the subsequent unified supervision of network security;

[0010] S2: Establish security data evaluation standards; Based on the node and text features of the historical database and manually typed security data, construct quantifiable security data as the security data evaluation standard, and before the SD-WAN flow data in S1 is sent to the centralized forwarder, the behavior data of each network object access, authorization, and authority is checked for security data evaluation annotations;

[0011] From the above, it can be seen that the use of a central controller to complete unified data collection allows the integration of data, and the use of the established security data evaluation standards as security strategies to check all access, authorization, and authority behavior data, breaking the traditional network security monitoring architecture, and supervising all data behaviors in the region, increasing the intensity of security monitoring, and the security data evaluation standards can be arbitrarily changed according to different given time windows, completing the dynamic adjustment of network security monitoring;

[0012] As for user terminals, in order to ensure whether user behavior threatens network security, a network security supervision method for user terminals is provided;

[0013] S3: Confirmation of user identity; completing identity element confirmation of the user terminal based on identity authentication;

[0014] S4: Establish a security-related data collection system in the user terminal; collect relevant information of users entering the network, store the behavior data information of users after each entry into the network, and summarize the behavior data information based on a given time range;

[0015] Every time a user enters the internal network, all requests and data behaviors must be collected by the security-related data collection system. When the given event windows mentioned above change, they must be summarized to avoid periodic covert attacks.

[0016] S5: Evaluate the user's behavior data information; complete the threat assessment of the user's behavior data information based on the user's historical behavior data in real time, and the SD-WAN controller chooses to disconnect the reception and delivery based on the evaluation results.

[0017] Furthermore, the single-user tunnel link used in the prior art needs to go through tunnel separation technology to complete the disconnection, reception and sending of the single tunnel. Therefore, there is a risk that the intranet device will be briefly exposed to the public network. The present application is based on centralized computing to avoid the occurrence of this situation of brief exposure to the public network.

[0018] A further improvement of the technical solution of the present invention is that the flow table data in S1 includes routing information, label information and related data forwarding layer information, and the protocols in S1 include I GP, BGP, LDP, VPN4, and EVPN.

[0019] A further improvement of the technical solution of the present invention is that the identity element confirmation in S3 specifically includes:

[0020] Complete the verification of user identity and access control rights according to the RAD I US protocol, install the authentication and authorization database based on the original RAD I US system, and change the encryption protocol between the communication parties according to the authorization database;

[0021] The confirmation of identity elements specifically refers to the confirmation of users, devices, applications and related elements.

[0022] A further improvement of the technical solution of the present invention is that the user-related information in S4 includes the destination IP address, source MAC address, source used, destination port number, data packet size, session connection duration, geographic location, protocol used, user position, post, department, and organizational structure information.

[0023] A further improvement of the technical solution of the present invention is that it should be noted that the latent threats of network attack behaviors with long latency and high concealment in the intranet, scanning attacks, password attacks, flooding attacks, and DDS attacks are explicit threats, so the speed of evaluating and identifying explicit threats is rapid, but the evaluation and identification of implicit threats is more difficult, so the threat evaluation in S5 includes implicit threat evaluation and explicit threat evaluation, wherein the evaluation and identification of implicit threats is that after the user's behavior data information exceeds the threshold given by the historical behavior data, the user's behavior data information is checked by the security data evaluation standard established in S2, and the user's access to specific resources is authorized or prohibited by the flow table during the verification process;

[0024] From the above, we can see that the explicit threat assessment is short, so how to quickly respond and block it during identification becomes more important. Therefore:

[0025] The assessment and identification of explicit threats is that the central controller directly sends the corresponding flow table information to complete and resolve the attack event and prevent the user from continuing to access the network resources.

[0026] A further improvement of the technical solution of the present invention is that the threshold setting given by the behavior data information is given by the security-related data acquisition system in combination with the data behavior index and the request behavior index, and the security data evaluation standard established in S2 checks the user's behavior data information and includes the following specific steps:

[0027] T1: The security-related data collection system dynamically collects the characteristics of users sending and receiving data packets in the network in real time, compares the security data evaluation standards and historical behavior data, and evaluates user behavior;

[0028] T2: Record the potentially suspicious behaviors of users when requesting network resources through the security-related data collection system, and collect statistics and analyze the data within a specified time period;

[0029] T3: Through the security-related data collection system, the actual role status of users, key process information of other application systems, and human information are collected to analyze whether users have illegally entered the network or attempted to connect to network resources that are not within their scope of use.

[0030] A further improvement of the technical solution of the present invention is that the data behavior indicator includes:

[0031] The number of suspicious packets sent by users in the network segment per unit time, the size of the data packet, the MTU size, and fragmentation anomalies;

[0032] The number of abnormal throughput rates of users in the network segment per unit time.

[0033] A further improvement of the technical solution of the present invention is that the request behavior indicator is given including:

[0034] Statistics of restricted resources that users still attempt to access after being restricted within a certain period of time;

[0035] Statistics of users who have been restricted but still attempt to access sensitive applications and databases within a unit of time;

[0036] Statistics of users connecting to sensitive ports per unit time;

[0037] Statistics of user session duration that is too long per unit time.

[0038] Compared with the prior art, the beneficial effect of the present invention is that, by adopting various levels of controllers for centralized calculation for the deployment of various protocols, the establishment of a central controller enables the forwarder to get rid of the cumbersome calculation process when collecting various related devices and network status information in a huge network, which is convenient for subsequent unified supervision of network security and avoids the occurrence of the situation where the intranet device is temporarily exposed to the public network;

[0039] The use of a central controller to complete unified data collection allows for integration of data. The established security data assessment standards are used as security strategies to check all access, authorization, and authority behavior data, breaking the traditional network security monitoring architecture, and supervising all data behaviors in the region, increasing the intensity of security monitoring. The security data assessment standards can be changed at will according to different given time windows, completing the dynamic adjustment of network security monitoring.

[0040] By establishing a security-related data collection system in the user terminal, relevant information of users entering the network is collected, and the behavioral data information of the user each time entering the network is stored. The behavioral data information is summarized based on a given time range and the user's behavioral data information is evaluated, thereby achieving security monitoring and identification on the terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart of a network security supervision method based on SD-WAN;

[0042] Figure 2 Schematic diagram of the process of verifying user behavior data information for security data assessment standards in the SD-WAN-based network security supervision method. DETAILED DESCRIPTION

[0043] Various exemplary embodiments, features and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0044] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0045] In addition, in order to better illustrate the present application, numerous specific details are provided in the specific examples below. It should be understood by those skilled in the art that the present application can also be implemented without certain specific details. In some examples, methods, means, and elements well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present application.

[0046] The present invention provides a network security supervision method based on SD-WAN, comprising the following specific steps:

[0047] S1: Unified calculation of various protocols in the distributed architecture; establish a central controller to control and deploy the devices within the jurisdiction, collect the control plane information of each jurisdiction, and send the flow table data to the centralized forwarder according to the OPENLOW protocol and SD-WAN controller;

[0048] It should be noted that the deployment of various protocols uses controllers at all levels for centralized computing, and the establishment of a central controller allows the forwarder to get rid of the cumbersome computing process of collecting various related devices and network status information in a huge network, which facilitates the convenience of subsequent unified network security supervision;

[0049] S2: Establish security data evaluation standards; Based on the node and text features of the historical database and manually typed security data, construct quantifiable security data as the security data evaluation standard, and before the SD-WAN flow data in S1 is sent to the centralized forwarder, the behavior data of each network object's access, authorization, and authority are checked for security data evaluation annotations;

[0050] From the above, it can be seen that the use of a central controller to complete unified data collection allows the integration of data, and the use of the established security data evaluation standards as security strategies to check all access, authorization, and authority behavior data, breaking the traditional network security monitoring architecture, and supervising all data behaviors in the region, increasing the intensity of security monitoring, and the security data evaluation standards can be arbitrarily changed according to different given time windows, completing the dynamic adjustment of network security monitoring;

[0051] As for user terminals, in order to ensure whether user behavior threatens network security, a network security supervision method for user terminals is provided;

[0052] S3: Confirmation of user identity; completing the confirmation of identity elements of the user terminal based on identity authentication;

[0053] S4: Establish a security-related data collection system in the user terminal; collect relevant information of users entering the network, store the behavior data information of users after each entry into the network, and summarize the behavior data information based on a given time range;

[0054] Every time a user enters the internal network, all requests and data behaviors must be collected by the security-related data collection system. When the given event windows mentioned above change, they must be summarized to avoid periodic covert attacks.

[0055] S5: Evaluate the user's behavior data information; complete the threat assessment of the user's behavior data information based on the user's historical behavior data in real time, and the SD-WAN controller chooses to disconnect the reception and delivery based on the evaluation results.

[0056] Furthermore, the single-user tunnel link used in the prior art needs to go through tunnel separation technology to complete the disconnection, reception and sending of the single tunnel. Therefore, there is a risk that the intranet device will be briefly exposed to the public network. The present application is based on centralized computing to avoid the occurrence of this situation where the intranet device is briefly exposed to the public network.

[0057] The flow table data in S1 includes routing information, label information, and related data forwarding layer information, and the protocols in S1 include I GP, BGP, LDP, VPN4, and EVPN.

[0058] The identity element confirmation in S3 specifically includes:

[0059] Complete the verification of user identity and access control rights according to the RAD I US protocol, install the authentication and authorization database based on the original RAD I US system, and change the encryption protocol between the communication parties according to the authorization database;

[0060] The confirmation of identity elements specifically refers to the confirmation of users, devices, applications and related elements.

[0061] The user-related information in S4 includes the destination IP address, source MAC address, source used, destination port number, packet size, session connection duration, geographic location, protocol used, user position, job title, department, and organizational structure information.

[0062] It should be noted that the latent threats of network attack behaviors with long latency and high concealment in the intranet, such as scanning attacks, password attacks, flooding attacks, and DDS attacks, are explicit threats. Therefore, the evaluation and identification speed of explicit threats is rapid, but the evaluation and identification of implicit threats is more difficult. Therefore, the threat assessment in S5 includes implicit threat assessment and explicit threat assessment. The evaluation and identification of implicit threats is that after the user's behavior data information exceeds the threshold given by the historical behavior data, the user's behavior data information is checked by the security data evaluation standard established in S2. During the verification process, the user's access to specific resources is authorized or prohibited by the flow table.

[0063] From the above, we can see that the explicit threat assessment is short, so how to quickly respond and block it during identification becomes more important. Therefore:

[0064] The assessment and identification of explicit threats is that the central controller directly sends the corresponding flow table information to complete and resolve the attack event and prevent the user from continuing to access the network resources.

[0065] The threshold setting given by the behavior data information is given by the security-related data collection system in combination with the data behavior index and the request behavior index, and the security data evaluation standard established in S2 checks the user's behavior data information and includes the following specific steps:

[0066] T1: The security-related data collection system dynamically collects the characteristics of users sending and receiving data packets in the network in real time, compares the security data evaluation standards and historical behavior data, and evaluates user behavior;

[0067] T2: Record the potentially suspicious behaviors of users when requesting network resources through the security-related data collection system, and collect and analyze the data within a specified time period;

[0068] T3: Through the security-related data collection system, the actual role status of users, key process information of other application systems, and human information are collected to analyze whether users have illegally entered the network or attempted to connect to network resources that are not within their scope of use.

[0069] The data behavior indicators include:

[0070] The number of suspicious packets sent by users in the network segment per unit time, the size of the data packet, the MTU size, and fragmentation anomalies;

[0071] The number of abnormal throughput rates of users in the network segment per unit time.

[0072] The request behavior indicators include:

[0073] Statistics of restricted network resources that users attempt to access after being restricted within a certain period of time;

[0074] Statistics of users who have been restricted but still attempt to access sensitive applications and databases within a certain period of time;

[0075] Statistics of users connecting to sensitive ports per unit time;

[0076] Statistics of user session duration that is too long per unit time.

[0077] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0078] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network security supervision method based on SD-WAN, characterized in that: The specific steps include: S1: Unified calculation of various protocols in the distributed architecture; establish a central controller to control and deploy the devices within the jurisdiction, collect the control plane information of each jurisdiction, and send the flow table data to the centralized forwarder according to the OPENLOW protocol and SD-WAN controller; S2: Establish security data evaluation standards; Based on the node and text features of the historical database and manually typed security data, construct quantifiable security data as the security data evaluation standard, and before the SD-WAN flow data in S1 is sent to the centralized forwarder, the behavior data of each network object access, authorization, and authority is checked for security data evaluation annotations; S3: Confirmation of user identity; completing identity element confirmation of the user terminal based on identity authentication; S4: Establish a security-related data collection system in the user terminal; collect relevant information of users entering the network, store the behavior data information of users after each entry into the network, and summarize the behavior data information based on a given time range; S5: Evaluate user behavior data information; Based on the real-time monitoring of the user's historical behavior data, the threat assessment of the user's behavior data information is completed. The SD-WAN controller chooses to disconnect the reception and delivery based on the assessment results.

2. A network security supervision method based on SD-WAN according to claim 1, characterized in that: The flow table data in S1 includes routing information, label information and related data forwarding layer information, and the protocols in S1 include IGP, BGP, LDP, VPN4, and EVPN.

3. A network security supervision method based on SD-WAN according to claim 1, characterized in that: The identity element confirmation in S3 specifically includes: Complete the verification of user identity and access control rights according to the RADIUS protocol, install the authentication and authorization database based on the original RADIUS system, and change the encryption protocol between the communication parties according to the authorization database; The confirmation of identity elements specifically refers to the confirmation of users, devices, applications and related elements.

4. The network security supervision method based on SD-WAN according to claim 1 is characterized in that: The user-related information in S4 includes the destination IP address, source MAC address, source used, destination port number, data packet size, session connection duration, geographic location, protocol used, user position, job title, department, and organizational structure information.

5. The network security supervision method based on SD-WAN according to claim 1 is characterized in that: The threat assessment in S5 includes implicit threat assessment and explicit threat assessment, wherein the implicit threat assessment is identified as follows: after the user's behavior data information exceeds the threshold given by the historical behavior data, the user's behavior data information is checked by the security data assessment standard established in S2, and during the checking process, the user's access to specific resources is authorized or prohibited by means of a flow table; The assessment and identification of explicit threats is that the central controller directly sends the corresponding flow table information to complete and resolve the attack event and prevent the user from continuing to access the network resources.

6. A network security supervision method based on SD-WAN according to claim 5, characterized in that: The threshold setting given by the behavior data information is given by the security-related data acquisition system in combination with the data behavior index and the request behavior index, and the security data evaluation standard established in S2 checks the user's behavior data information and includes the following specific steps: T1: The security-related data collection system dynamically collects the characteristics of users sending and receiving data packets in the network in real time, compares the security data evaluation standards and historical behavior data, and evaluates user behavior; T2: Record the potentially suspicious behaviors of users when requesting network resources through the security-related data collection system, and collect statistics and analyze the data within a specified time period; T3: Through the security-related data collection system, the actual role status of users, key process information of other application systems, and human information are collected to analyze whether users have illegally entered the network or attempted to connect to network resources that are not within their scope of use.

7. A network security supervision method based on SD-WAN according to claim 6, characterized in that: The data behavior indicators include: The number of suspicious packets sent by users in the network segment per unit time, the size of the data packet, the MTU size, and fragmentation anomalies; The number of abnormal throughput rates of users in the network segment per unit time.

8. A network security supervision method based on SD-WAN according to claim 7, characterized in that: The request behavior indicators include: Statistics of restricted network resources that users attempt to access after being restricted within a certain period of time; Statistics of users who have been restricted but still attempt to access sensitive applications and databases within a certain period of time; Statistics of users connecting to sensitive ports per unit time; Statistics of user session duration that is too long per unit time.

Images