A communication network dynamic protection method and platform

Abstract

A communication network dynamic protection method and platform, comprising: a switch forwards a data request received from an external host to the controller; the controller forwards the data request to an internal host; the internal host performs attack detection on the data request, generates an attack report if the data request is an attack request, and sends the attack report to the controller; the controller formulates a protection strategy for the internal host according to the attack report. This solution enables the internal host to formulate an attack report in real time according to the data request sent by the external host, and can formulate a protection strategy in real time, thereby improving the flexibility of power communication network protection. The switch sends the data request and attack report to the controller instead of autonomously judging and forwarding, thereby improving the security of power communication network protection.

Description

Technical Field

[0001] The present invention relates to the field of software defined networks, and in particular to a communication network dynamic protection method and platform. Background Art

[0002] With the continuous advancement and development of power communication networks, traditional power communication networks cannot meet the requirements of full coverage of communication networks, and the flexibility and security of existing power communication networks are difficult to meet the "simplified structure, ubiquitous security, and centralized control" required for the further development of power communication networks. With the rapid development of smart grids, the dependence of power systems on information systems is also showing an increasing trend. The power system is even about to evolve into a physical system of power information. The transmission of massive information data will affect the performance of the power communication network. In this situation, protecting the power communication network is very critical and necessary. Summary of the invention

[0003] In order to solve the problem of attack threats faced by power communication networks in the prior art, the present invention provides a communication network dynamic protection method and platform.

[0004] The technical solution provided by the present invention is:

[0005] A communication network dynamic protection method, comprising:

[0006] The switch forwards the data request received from the external host to the controller;

[0007] The controller forwards the data request to an internal host;

[0008] The internal host performs attack detection on the data request, generates an attack report if the data request is an attack request, and sends the attack report to the controller;

[0009] The controller formulates a protection strategy for the internal host according to the attack report.

[0010] Preferably, the switch forwards the received data request sent by the external host to the controller, including:

[0011] According to the data request, a request forwarding flow table is formulated through a switch, and the request forwarding flow table is sent to the controller.

[0012] Preferably, the controller forwards the data request to the internal host, comprising:

[0013] According to the received request and the pre-defined downlink flow table, the switch forwards the data request to the destination host;

[0014] The internal host includes the destination host, and the internal host address in the accepted request is the destination host address.

[0015] Preferably, the internal host performs attack detection on the data request, including:

[0016] The internal host detects the data request. If the destination host corresponding to the request is a data packet sent for the first time, the request is forwarded through the switch and a forwarding flow table is requested from the controller. The address in the downlink flow table is set to the address of the destination host in the data packet. Based on the downlink flow table, the data packet is sent to the destination host.

[0017] Otherwise, detect whether the request is a network attack according to the set rules, and if so, formulate an attack report and send the attack report to the controller; otherwise, send the data packet to the destination host based on the downlink flow table.

[0018] Preferably, the controller formulates a protection strategy for the internal host according to the attack report, including:

[0019] Based on the attack report, the controller modifies the destination address in the downlink flow table to a backup host address;

[0020] Based on the modified downlink flow table, the switch forwards the attack request to the backup host;

[0021] The standby host performs an ignoring process;

[0022] The internal host also includes a backup host.

[0023] Preferably, the standby host performs the ignoring process, including:

[0024] The standby host receives the attack request and determines whether the attack address in the attack request is consistent with the address of the current standby host. If they are inconsistent, the attack request is ignored.

[0025] Preferably, the controller formulates a protection strategy for the internal host according to the attack report, further comprising:

[0026] Based on the attack report, the controller modifies the destination address in the downlink flow table to the address of the switch;

[0027] The switch ignores the received attack request.

[0028] Preferably, the controller formulates a protection strategy for the internal host according to the attack report, and before that, it also includes:

[0029] The controller is used to add or delete nodes in the communication network topology and set the internal host.

[0030] A communication network dynamic protection platform, the platform comprising: a forwarding module, an attack detection module and a dynamic protection module;

[0031] The attack detection module is installed on the internal host and is used to determine whether the data request received from the external host is an attack request; and is also used to formulate an attack report if the data request is an attack request, and send the attack report to the controller;

[0032] The forwarding module is installed on the switch and is used to forward the data request of the external host to the internal host; and is also used to send the attack report formulated by the internal host to the controller;

[0033] The dynamic protection module is installed on the controller and is used to formulate a protection strategy for the internal host that formulates the attack report according to the attack report;

[0034] The switch, the internal host and the controller are communicatively connected.

[0035] Preferably, the internal host includes: a destination host and a backup host;

[0036] The destination host and the backup host are connected to the switch and are both equipped with the attack detection module.

[0037] Preferably, the attack detection module includes: a judgment submodule and a forwarding submodule;

[0038] The judgment submodule is used to cyclically receive the data request sent by the external host and perform attack detection. If the data request is an attack request from the external host to the current host, an attack report is prepared; otherwise, the data request is ignored;

[0039] The forwarding submodule is used to forward the attack report to the controller.

[0040] Preferably, a topology management module is also installed on the controller;

[0041] Used to view information about nodes in the communication network topology, and to add and delete the nodes.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] The present invention provides a communication network dynamic protection platform, including: the switch forwards the data request received from the external host to the controller; the controller forwards the data request to the internal host; the internal host performs attack detection on the data request, generates an attack report if the data request is an attack request, and sends the attack report to the controller; the controller formulates a protection strategy for the internal host according to the attack report. This solution enables the internal host to formulate an attack report in real time according to the data request sent by the external host, and can formulate a protection strategy in real time, thereby improving the flexibility of power communication network protection. The switch sends the data request and attack report to the controller instead of autonomously judging and forwarding, thereby improving the security of power communication network protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flow chart of a communication network dynamic protection method in the present invention;

[0045] Figure 2 This is a schematic diagram of the structure of a communication network dynamic protection platform in the present invention;

[0046] Figure 3 A module exchange diagram for transferring attacks in an embodiment of the present invention;

[0047] Figure 4 This is a module exchange diagram for offline isolation in an embodiment of the present invention;

[0048] Figure 5 It is a judgment flow chart of the present invention. DETAILED DESCRIPTION

[0049] In order to better understand the present invention, the content of the present invention is further described below in conjunction with the accompanying drawings and examples.

[0050] Embodiment 1:

[0051] This embodiment provides a communication network dynamic protection method, the method flow chart is as follows Figure 1 shown.

[0052] S1: The switch forwards the data request received from the external host to the controller.

[0053] When the switch forwards a data packet for the first time, it requests the controller to send a flow table. When forwarding data packets subsequently, it determines whether the flow table has been modified by the controller. If it has been modified, it forwards normally. When the host is attacked, the data packet carrying the attack information is forwarded to the destination host after passing through the switch. The destination host detects the data packet and finds that it contains attack information and reports to the controller that the attack has been detected. After receiving the warning, the controller modifies the switch flow table to divert the attack or isolate the destination host. When subsequent data packets carrying attack information arrive, the switch flow table has been modified or the destination host is offline, thereby protecting the host.

[0054] S2: The controller forwards the data request to the internal host.

[0055] S3: The internal host performs attack detection on the data request, generates an attack report if the data request is an attack request, and sends the attack report to the controller.

[0056] The judgment flow chart based on SDN is as follows Figure 5 As shown in Figure 2, the modules of the protection process of transfer attack interact as follows: Figure 3 As shown, the attacking host sends request data carrying a network attack to the forwarding module. After the forwarding module requests the controller to forward the flow table, the controller sends the flow table, and then the data is forwarded to the destination host. After that, the attack detection module of the destination host detects the network attack and reports it to the dynamic protection module. The dynamic protection module modifies the flow table to isolate the victim host, and the subsequent network attack is transferred to a backup host and ignored.

[0057] S4: The controller formulates a protection strategy for the internal host according to the attack report.

[0058] The specific steps for protecting against the diversion attack are as follows:

[0059] Step 1: The attacking host sends an attack data packet for the first time, which is forwarded by the switch forwarding module. The forwarding module needs to request a forwarding flow table from the controller for the first forwarding of the destination address. After the controller sends the flow table, the data packet can be directly transmitted through the forwarding module, and then the data packet is sent to the destination host.

[0060] Step 2: The attacking host cyclically sends attack data packets to the attacked host. The attack detection module of the destination host runs in real time. The address of the attack data is judged by the judgment submodule in the attack detection module against the address of the current host. If the addresses are consistent, the request is a network attack and is reported to the dynamic protection module of the controller. The dynamic protection module modifies the flow table of the forwarding module of the switch and modifies the destination address in the flow table to the address of the backup host, thereby transferring the network attack to the backup host. The judgment submodule in the attack detection module of the backup host parses the destination address of the data packet and ignores the data packet, thereby achieving protection against transferred attacks.

[0061] The interaction between the modules in the offline isolation protection process is as follows: Figure 3 As shown, the attacking host sends request data carrying a network attack to the forwarding module. After the forwarding module requests the controller to forward the flow table, the controller sends the flow table, and then the data is forwarded to the destination host. After that, the attack detection module of the destination host detects the network attack and reports it to the dynamic protection module. The dynamic protection module modifies the flow table to isolate the victim host. Since the network attack after the flow table is modified cannot be forwarded to the destination host and is ignored.

[0062] The specific steps of offline isolation protection are as follows:

[0063] Step 1: The attacking host sends an attack data packet for the first time, which is forwarded by the switch forwarding module. The forwarding module needs to request a forwarding flow table from the controller for the first forwarding of the destination address. After the controller sends the flow table, the data packet can be directly transmitted through the forwarding module, and then the data packet is sent to the destination host.

[0064] Step 2: The attacking host cyclically sends attack data packets to the attacked host. The attack detection module of the destination host runs in real time. The address of the attack data is judged by the judgment submodule in the attack detection module against the address of the current host. If the addresses are consistent, the request is a network attack and is reported to the dynamic protection module of the controller. The dynamic protection module modifies the flow table of the forwarding module of the switch and modifies the destination address in the flow table to the address of the switch. Data packets forwarded to the destination host are no longer forwarded, so the subsequent data packets received by the switch are ignored, thereby achieving offline isolation protection.

[0065] Embodiment 2:

[0066] This embodiment provides a communication network dynamic protection platform, the platform structure diagram is as follows Figure 2 shown.

[0067] The platform is mainly composed of a switch, an internal host and a controller, which are connected by communication.

[0068] A forwarding module is set in the switch, and a dynamic protection module and a topology management module are set in the controller.

[0069] Internal hosts, including the destination host and the backup host, are equipped with attack detection modules.

[0070] The entire platform runs in each node of the power communication network. The controller runs the topology management module and the dynamic protection module, which is responsible for managing each node and link in the power communication network topology and dynamically protecting the attacked nodes; the switch runs the forwarding module, which is responsible for forwarding data packets and command packets in the power communication network; each host runs the attack detection module, which can detect the attack information in time when attacked and report it to the controller for protection; the backup host is used to replace those hosts that are attacked and have no time to maintain, to ensure the robustness of the power communication network.

[0071] The topology management module in the controller mainly manages the topology structure in the network. It can view information, add nodes, and delete nodes in the network. The dynamic protection module can adopt different strategies to protect against network attacks received in the network. It can accept attack reports from victim hosts. The main protection method is to modify the configuration of the forwarding module.

[0072] The forwarding module of the switch is mainly responsible for forwarding data packets in the network, and forwarding datagrams according to the flow table information in the module.

[0073] The attack detection module of the network host is in real-time running in the host. Its main function is to determine whether a large number of network requests received by the host are network attacks. If so, the notification method of the dynamic protection module is called to inform.

[0074] Obviously, the described embodiments are only some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0075] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0076] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0077] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0078] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0079] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. A communication network dynamic protection method, characterized in that: include: The switch receives the data request sent by the external host, and requests the controller to send the flow table for forwarding the first data request; The controller sets the address in the flow table as the address of the destination host of the internal host in the data request, and sends it to the switch; The switch sends the data request to the destination host based on the set flow table; When the external host cyclically sends data requests to the destination host, the destination host performs attack detection on the data request in real time, by judging the address of the data request and the address of the current host. If the addresses are consistent, the data request is a network attack, and the destination host generates an attack report and sends the attack report to the controller to warn the controller; After receiving the warning, the controller modifies the flow table according to the attack report, modifies the destination address in the flow table to the address of the backup host in the internal host, and the switch transfers the network attack to the backup host; The standby host receives the attack request and determines whether the attack address in the attack request is consistent with the address of the current standby host. If they are inconsistent, the attack request is ignored.

2. The method according to claim 1, characterized in that The controller modifies the flow table according to the attack report, and the method further includes: The controller is used to add or delete nodes in the communication network topology and to set the internal host.

3. A communication network dynamic protection platform, characterized in that: The platform includes: a forwarding module, an attack detection module and a dynamic protection module; The attack detection module is installed on the destination host of the internal host, and is used to determine whether the data request received from the external host is an attack request; and is also used to formulate an attack report if the data request is an attack request, and send the attack report to the controller; The forwarding module is installed on the switch and is used to forward the data request of the external host to the destination host in the internal host; and is also used to send the attack report formulated by the destination host to the controller; The dynamic protection module is installed on the controller and is used to formulate a protection strategy for the internal host according to the attack report; The switch, the internal host and the controller are communicatively connected; Wherein, the forwarding module forwards the data request of the external host to the destination host; The target host and the backup host are connected to the switch and are both equipped with the attack detection module. piece; The forwarding module receives a data request sent by an external host, and requests the controller to send a flow table for forwarding the first data request; The controller sets the address in the flow table as the address of the destination host of the internal host in the data request, and sends it to the forwarding module; The forwarding module sends the data request to the destination host based on the set flow table; When the external host cyclically sends a data request to the destination host, the attack detection module of the destination host runs in real time, and the address of the data request is judged by the judgment submodule in the attack detection module with the address of the current host. If the addresses are consistent, the request is a network attack. The attack detection module generates an attack report and sends the attack report to the dynamic protection module on the controller to warn the dynamic protection module; After receiving the warning, the dynamic protection module modifies the flow table according to the attack report, modifies the destination address in the flow table to the address of the backup host in the internal host, and the forwarding module transfers the network attack to the backup host; The standby host receives the attack request and determines whether the attack address in the attack request is consistent with the address of the current standby host. If they are inconsistent, the attack request is ignored.

4. The platform according to claim 3, characterized in that The controller is also equipped with a topology management module; Used to view information about nodes in the communication network topology, and to add and delete the nodes.

Images