Trusted virtual host identification method, electronic device and storage medium

Abstract

The present disclosure relates to a method for identifying a trusted virtual host, an electronic device and a storage medium. The method includes receiving a first request message sent by a first source virtual host and starting the timing of a response time, wherein the first request message carries a first network address of the first source virtual host and a second network address of the first target virtual host, and the first request message is used to request the physical address of the first target virtual host; sending the first request message to a trusted host identification device to identify the first source virtual host as a trusted virtual host using a network address list of trusted virtual hosts maintained in the trusted host identification device; if a first response message sent by the trusted host identification device is received within a preset response time, only the first response message is sent to the first source virtual host within the preset response time, and the first response message carries an invalid physical address of the first target virtual host. The method ensures the security of network communication.

Description

Technical Field

[0001] This disclosure relates to the field of computer network technology, specifically to methods for identifying trusted virtual hosts, electronic devices, and storage media. Background Technology

[0002] In existing Software Defined Network (SDN) security architectures, to ensure secure network communication, trusted virtual hosts are typically added to the same security group. This prevents virtual hosts outside the security group from accessing those within it. However, this approach places high demands on the hardware resources of access devices. For example, if virtual hosts VM1 and VM2 are added to the same security group, the corresponding entries on the device would match the source and destination IPs of VM1 and VM2, respectively, with a permission action for a successful match. These matching entries require hardware Access Control List (ACL) resources. As the number of security group mutual access configurations increases, the number of ACL resource entries becomes increasingly critical, limiting the application scale of this approach to the sheer number of ACL resource entries. Summary of the Invention

[0003] In view of this, the present disclosure provides a method for identifying a trusted virtual host, an electronic device, and a storage medium to solve the security problem of network communication.

[0004] According to a first aspect, embodiments of this disclosure provide a method for identifying a trusted virtual host, applied in an access device for a first source virtual host, the method comprising:

[0005] The system receives a first request message sent by the first source virtual host and starts timing the response time. The first request message carries the first network address of the first source virtual host and the second network address of the first target virtual host. The first request message is used to request the physical address of the first target virtual host.

[0006] The first request message is sent to the trusted host identification device to identify the first source virtual host as a trusted virtual host using the network address list of trusted virtual hosts maintained in the trusted host identification device.

[0007] If a first response message is received from the trusted host identification device within a preset response time, the first response message is sent only to the first source virtual host within the preset response time. The first response message carries an invalid physical address of the first target virtual host.

[0008] The trusted virtual host identification method provided in this embodiment involves the access device of the first source virtual host sending the first request message received from the first source virtual host to the trusted host identification device. Since the trusted host identification device maintains a list of network addresses of trusted virtual hosts, the first source virtual host can be identified as a trusted virtual host using this list. Based on this, if the access device receives the first response message sent by the trusted host identification device within a preset response time, it only sends the first response message to the first source virtual host. This ensures that the first source virtual host can only obtain the invalid physical address of the first target virtual host. That is, when the first source virtual host is an untrusted virtual host, the first source virtual host can only obtain the invalid physical address, thus preventing it from initiating normal business access and improving the security of network communication.

[0009] According to a second aspect, this disclosure also provides a method for identifying trusted virtual hosts, applied in an SDN controller or a third-party security device, wherein the SDN controller maintains a list of network addresses of trusted virtual hosts, and the method includes:

[0010] The system receives a second request message sent by the access device of the second source virtual host. The second request message carries a third network address of the second source virtual host and a fourth network address of the second target virtual host. The second request message is used to request the physical address of the second target virtual host. In the case where the method is applied to a third-party security device, the request-response function of the access device of the virtual host in the virtual network is turned off.

[0011] When the third network address is not in the network address list of the trusted virtual host, a second response message is sent to the access device, so that the access device sends the second response message only to the second source virtual host within a preset response time. The second response message carries an invalid physical address of the second target virtual host. The response time of the access device starts from the time the access device receives the second request message.

[0012] The trusted virtual host identification method provided in this disclosure involves configuring the network address of the trusted virtual host in the SDN controller or a third-party security device. If the third network address of the second source virtual host is not among the network addresses of the trusted virtual host, it indicates that the second source virtual host is an untrusted virtual host. The untrusted virtual host sends a second response message carrying an invalid physical address, causing the access device to send the second response message only to the second source virtual host within a preset response time. Accordingly, the second source virtual host can only obtain the invalid physical address of the second target virtual host, preventing the untrusted second source virtual host from obtaining the correct physical address of the second target virtual host and thus preventing it from initiating normal business access, thereby improving the security of network communication.

[0013] According to a third aspect, embodiments of this disclosure provide a trusted virtual host identification device, applied in an access device for a first source virtual host, the device comprising:

[0014] The first receiving module is used to receive the first request message sent by the first source virtual host and start the response timer. The first request message carries the first network address of the first source virtual host and the second network address of the first target virtual host. The first request message is used to request the physical address of the first target virtual host.

[0015] The first sending module is used to send the first request message to the trusted host identification device, so as to identify the first source virtual host as a trusted virtual host by using the network address list of trusted virtual hosts maintained in the trusted host identification device;

[0016] The second sending module is configured to, if it receives a first response message from the trusted host identification device within a preset response time, send the first response message only to the first source virtual host within the preset response time, wherein the first response message carries an invalid physical address of the first target virtual host.

[0017] According to the fourth aspect, this disclosure also provides a trusted virtual host identification device, applied in an SDN controller or a third-party security device, wherein the SDN controller maintains a list of network addresses of trusted virtual hosts, and the device includes:

[0018] The second receiving module is used to receive a second request message sent by the access device of the second source virtual host. The second request message carries a third network address of the second source virtual host and a fourth network address of the second target virtual host. The second request message is used to request the physical address of the second target virtual host. In the case where the method is applied to a third-party security device, the request-response function of the access device of the virtual host in the virtual network is turned off.

[0019] The third sending module is used to send a second response message to the access device when the third network address is not in the network address list of the trusted virtual host, so that the access device sends the second response message only to the second source virtual host within a preset response time. The second response message carries an invalid physical address of the second target virtual host. The response time of the access device starts from the time when the access device receives the second request message.

[0020] According to a fifth aspect, this disclosure provides an electronic device, including: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the first aspect or any implementation thereof, or to perform the trusted virtual host identification method described in the second aspect.

[0021] According to a sixth aspect, embodiments of this disclosure provide a computer-readable storage medium storing computer instructions for causing the computer to perform the first aspect or any implementation thereof, or to perform the trusted virtual host identification method described in the second aspect.

[0022] It should be noted that the corresponding beneficial effects of the electronic device and computer-readable storage medium provided in the embodiments of this disclosure can be found in the description of the corresponding beneficial effects of the trusted virtual host identification device above, and will not be repeated here. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the specific embodiments of this disclosure or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 A block diagram of the virtual network is shown;

[0025] Figure 2 This is a structural block diagram of a trusted virtual host identification system according to an embodiment of the present disclosure;

[0026] Figure 3 This is a flowchart of a method for identifying a trusted virtual host according to an embodiment of the present disclosure;

[0027] Figure 4 This is a flowchart of a method for identifying a trusted virtual host according to an embodiment of the present disclosure;

[0028] Figure 5 This is a flowchart of a method for identifying a trusted virtual host according to an embodiment of the present disclosure;

[0029] Figure 6 This is a flowchart of a method for identifying a trusted virtual host according to an embodiment of the present disclosure;

[0030] Figure 7 This is a structural block diagram of a trusted virtual host identification device according to an embodiment of the present disclosure;

[0031] Figure 8 This is a structural block diagram of a trusted virtual host identification device according to an embodiment of the present disclosure;

[0032] Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this disclosure. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0034] In some networking methods of SDN EVPN, such as Figure 1As shown, virtual hosts VM1 through VM4 belong to the same virtual subnet. VM1 and VM2 belong to the same packet, and VM3 and VM4 belong to the same packet. Forwarding device Leaf1 is used for data forwarding between VM1 / VM2 and the SDN controller, while forwarding device Leaf2 is used for data forwarding between VM3 / VM4 and the SDN controller. If VM1 is an untrusted virtual host, then VM2 through VM4 are trusted virtual hosts. Trusted virtual hosts can successfully connect via ARP / ND request packets. The SDN controller is configured with a network address range for the virtual network. As long as VM1 is configured with any IP address within the virtual network and simultaneously sends an ARP / ND request to another trusted destination, the packet will successfully connect to the controller via packet in. For the SDN controller, upon receiving the request packet, if it identifies that the network address belongs to the network address range of the virtual network, it determines that the virtual subnet belongs to it and registers it, thus enabling subsequent service access. Meanwhile, the Leaf1 device converts received ARP / ND requests into EVPN Category 2 routes for routing within the overlay network, eliminating the need for additional access configuration from the controller. ARP / ND response packets are then answered by the Leaf1 device. This answering by the Leaf1 device has no impact on the SDN controller's processing; the two operate independently. Consequently, the untrusted virtual host VM1 can access services on other trusted hosts, creating a security vulnerability within the SDN network.

[0035] exist Figure 1 In the network topology shown, an untrusted virtual host under an EVPN network only needs to be configured with any network address within a trusted network segment and send an ARP / ND request message. This allows the untrusted virtual host to access the network and access other trusted hosts, posing a security risk to critical information within the organization. Therefore, this disclosure provides a method for identifying trusted virtual hosts. By setting the network address of the trusted virtual host, the method uses the network address of the trusted virtual host as the smallest unit of discrimination for identifying trusted virtual hosts. When an untrusted host is identified, a response message carrying an incorrect physical address is sent to overwrite the response message carrying the correct physical address. This avoids the security problems caused by using the virtual network as the smallest unit of discrimination and effectively protects trusted hosts within the virtual network from untrusted access.

[0036] According to an embodiment of this disclosure, a method for identifying a trusted virtual host is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0037] This embodiment provides a method for identifying trusted virtual hosts, which can be used in the access device of a first source virtual host. Figure 3 This is a flowchart of a trusted virtual host identification method according to embodiments of the present disclosure, such as... Figure 3 As shown, the process includes the following steps:

[0038] S11, Receive the first request message sent by the first source virtual host and start the response timer.

[0039] The first request message carries a first network address of the first source virtual host and a second network address of the first target virtual host. The first request message is used to request the physical address of the first target virtual host.

[0040] Combination Figure 1 As shown, if the first source virtual host is VM1, and the access device for the first source virtual host is Leaf1, after receiving the first request message from the first source virtual host, the access device Leaf1 forwards the first request message to the trusted host identification device and starts timing the response duration. Specifically, for the response duration, a maximum response duration is set in the access device Leaf1, i.e., a preset response duration. The current response duration is compared with the maximum response duration to determine whether the maximum response duration has been reached.

[0041] The first request message is used to request the physical address of the first target virtual host. Only after the first source virtual host obtains the physical address of the first target virtual host can it conduct business access with the first target virtual host.

[0042] S12, the first request message is sent to the trusted host identification device to identify the first source virtual host as a trusted virtual host using the network address list of trusted virtual hosts maintained in the trusted host identification device.

[0043] Access device Leaf1 sends the first request message to the trusted virtual host identification device. The trusted virtual host identification device maintains a list of network addresses for trusted virtual hosts. The device matches the first network address in the first request message against this list to determine if it is present. If the first network address is in the list, the first source virtual host is considered a trusted virtual host; otherwise, it is considered an untrusted virtual host.

[0044] S13, if a first response message is received from a trusted host identification device within a preset response time, the first response message is sent only to the first source virtual host within the preset response time. The first response message carries an invalid physical address of the first target virtual host.

[0045] When the first source virtual host is determined to be an untrusted virtual host, the access device will receive a first response message from the trusted host identification device within a preset response time. This first response message carries an invalid physical address of the first target virtual host. The invalid physical address includes incorrect physical addresses or null addresses, etc.

[0046] If a first response message is received within the preset response time, the access device will send the first response message to the first source virtual host. During the preset response time and before receiving the first response message, the access device will not send the correct physical address to the first source virtual host. Therefore, if the first source virtual host is an untrusted virtual host, it can only receive the first response message sent by the access device, that is, it can only receive the invalid physical address of the first target virtual host.

[0047] The trusted virtual host identification method provided in this embodiment, for the access device of the first source virtual host, sends the first request message received from the first source virtual host to the trusted host identification device. Since the trusted host identification device maintains a list of network addresses of trusted virtual hosts, the first source virtual host can be identified as a trusted virtual host using this list. Based on this, if the access device receives the first response message sent by the trusted host identification device within a preset response time, it only sends the first response message to the first source virtual host, so that the first source virtual host can only obtain the invalid physical address of the first target virtual host. That is, when the first source virtual host is an untrusted virtual host, the first source virtual host can only obtain the invalid physical address, thereby being unable to initiate normal business access, thus improving the security of network communication.

[0048] In some implementations, the method further includes:

[0049] (1) If the first response message is not received within the preset response time, obtain the physical address of the first target virtual host.

[0050] (2) Send a real response message to the first source virtual host, wherein the real response message carries the physical address of the first target virtual host.

[0051] The preset response time is the maximum response time. The current response time is compared with the preset response time. If the current response time has reached the preset response time and no first response message has been received, the first source virtual host can be considered a trusted virtual host. At this time, the access device obtains the physical address of the first target virtual host and sends a real response message to the first source virtual host, which carries the physical address of the first target virtual host.

[0052] For access devices, by setting a preset response timeout, if a first response message is received within the preset timeout, it is sent only to the first source virtual host; if no first response message is received within the preset timeout, the actual response message is sent to the first source virtual host. Under this mechanism, if the first source virtual host is an untrusted virtual host, it will only receive an invalid physical address; if the first source virtual host is a trusted virtual host, it will receive the correct physical address, thus ensuring the security of network communication.

[0053] In some implementations, if the trusted host identification device mentioned above is an SDN controller, the method of obtaining the physical address of the first target virtual host in step (1) above includes: querying locally based on the second network address to determine the physical address of the first target virtual host.

[0054] For access devices in each virtual subnet of a virtual network, the physical addresses of each virtual host within the virtual subnet can be obtained during route synchronization. Therefore, after determining that the first source virtual host is a trusted virtual host, the access device uses the network address of the first target virtual host to perform a local query, thereby determining the physical address of the first target virtual host.

[0055] In other implementations, if the trusted host identification device is a third-party security device, the method of obtaining the physical address of the first target virtual host in step (2) includes: receiving a response message sent by the first target virtual host to determine the real response message, wherein the response message is sent by the first target virtual host after receiving the first request message, and the response message carries the physical address of the first target virtual host.

[0056] If the trusted host identifies the device as a third-party security device, the request-response function of the access device within the virtual network is disabled. In this case, the first request message is flooded within the virtual network, i.e., broadcast within the virtual network. Accordingly, the first target virtual host receives the first request message, sends the correct physical address to the access device, and the access device receives the response message sent by the first target virtual host. Based on this, the access device can directly send the response message as the real response message to the first source virtual host, or the access device can extract the correct physical address from the response message, form a real response message based on the correct physical address, and send the real response message to the first source virtual host.

[0057] This embodiment provides a method for identifying trusted virtual hosts, which can be used in the aforementioned SDN controller or third-party security device, wherein the SDN controller or third-party security device includes the network address of the trusted virtual host. Figure 4 This is a flowchart of a trusted virtual host identification method according to embodiments of the present disclosure, such as... Figure 4 As shown, the process includes the following steps:

[0058] S21, Receive the second request message sent by the access device of the second source virtual host.

[0059] The second request message carries the third network address of the second source virtual host and the fourth network address of the second target virtual host. The second request message is used to request the physical address of the second target virtual host. When the method is applied to a third-party security device, the request proxy function of the access device of the virtual host in the virtual network is turned off.

[0060] The third network address of the second source virtual host can also be called the source network address, and the fourth network address of the second target virtual host can also be called the target network address. This indicates that the second source virtual host needs to interact with the second target virtual host. Before this, it is necessary to determine whether the second source virtual host is a trusted host. Therefore, the second source virtual host first sends a second request message, which includes the source network address and the target network address.

[0061] When the method is applied to the SDN controller, the request response function of the access device of the virtual host in the virtual network is enabled to ensure that the access device sends the second request message to the SDN controller.

[0062] When the method is applied to a third-party security device, to obtain the second request message from the second source virtual host, the proxy answering function of the access device within the virtual network must be disabled. Only by disabling the proxy answering function can the second request message be flooded within the virtual network, that is, broadcast in the virtual network, thus becoming accessible to the third-party security device. Disabling the proxy answering function of the access device can be implemented through pre-configuration, by the SDN controller, or by other methods; no specific limitations are imposed here, and the configuration should be based on actual needs.

[0063] S22, when the third network address is not in the network address list of the trusted virtual host, a second response message is sent to the access device so that the access device sends the second response message only to the second source virtual host within a preset response time.

[0064] The second response message carries an invalid physical address of the second target virtual host, and the response time of the access device starts from the time the access device receives the second request message.

[0065] Combination Figure 1 As shown, if the second source virtual host is VM2, the second request message sent by VM2 is forwarded to the SDN controller via the forwarding device Leaf1. The SDN controller then identifies whether VM2 is a trusted virtual host. Specifically, the SDN controller maintains a list of trusted virtual host network addresses. When the SDN controller receives the second request message, it extracts the third network address from the message and queries the list. If the address is found, the second source virtual host is considered a trusted host; otherwise, it is considered an untrusted host.

[0066] When the second source virtual host is an untrusted host, the SDN controller sends a second response message to the access device of the first source virtual host. This second response message carries an invalid physical address corresponding to the fourth network address. The purpose of the second source virtual host sending the first access request is to obtain the correct physical address corresponding to the second network address. For the second source virtual host to enable subsequent business access, it needs to first go online with the SDN controller and use the correct physical address to access the second target virtual host.

[0067] Combination Figure 2As shown, the third-party security device has a list of trusted virtual host network addresses. After obtaining the second request message, it matches the third network address in the second request message with the list of trusted virtual host network addresses. When it is determined that the third network address is not in the list of trusted virtual host network addresses, it sends a second response message carrying an invalid physical address to the access device.

[0068] Specifically, when a third-party security device determines that the second source virtual host is an untrusted virtual host, it sends a second response message carrying an invalid physical address, which is similar to the first response message and will not be described in detail here. Since the second request message is broadcast in the virtual network, the second target virtual host, upon receiving the second request message, sends a response message to the access device of the second source virtual host, in which the response message carries the correct physical address.

[0069] For the primary virtual host, a preset response time is set to process the received response messages, determining whether to send a response message carrying an invalid physical address or a response message carrying the correct physical address. For the processing methods of access devices, please refer to the above description, which will not be repeated here.

[0070] In some implementations, the determination of the trusted virtual host network address list includes: obtaining the network addresses of the created virtual hosts to determine the trusted virtual host network address list. Specifically, for virtual hosts that require approval to create, the network addresses of the created virtual hosts are first recorded, and then these network addresses are read and added to the trusted virtual host network address list. Constructing the trusted virtual host network address list using the network addresses of the created virtual hosts ensures the reliability of the trusted virtual host network address list.

[0071] In other implementations, the determination of the network address of a trusted virtual host includes: determining a list of trusted virtual host network addresses in response to an input operation for the network address of the trusted virtual host. For some virtual hosts that do not require approval for creation, this embodiment also supports manually inputting the network address of the trusted virtual host. Specifically, in response to an input operation for the network address of the trusted virtual host, the input network address is added to the list of trusted virtual host network addresses, thereby obtaining the list of trusted virtual host network addresses. The implementation also provides a manual input function for the network address of the trusted virtual host to meet the needs of different application scenarios.

[0072] The trusted virtual host identification method provided in this embodiment, by setting the network address of the trusted virtual host in the SDN controller or third-party security device, indicates that the second source virtual host is an untrusted virtual host if the third network address of the second source virtual host is not in the network address of the trusted virtual host. For the untrusted virtual host, a second response message carrying an invalid physical address is sent, so that the access device only sends the second response message to the second source virtual host within a preset response time. Accordingly, the second source virtual host can only obtain the invalid physical address of the second target virtual host, so that the untrusted second source virtual host cannot obtain the correct physical address of the second target virtual host, thereby failing to initiate normal business access and improving the security of network communication.

[0073] In some embodiments, the above method further includes:

[0074] (1) Obtain the status of the trusted identification tag corresponding to the first source virtual host.

[0075] (2) When the trusted identification mark is in the state of being closed, access to all virtual hosts in the virtual network is restricted.

[0076] For SDN controllers or third-party security devices, the status of trusted identification tags determines whether trusted virtual host identification is currently enabled. If enabled, trusted virtual host identification is performed; if disabled, access to all virtual hosts within the virtual network is restricted to further ensure network communication security.

[0077] In some embodiments, the above method further includes:

[0078] (1) Use the third network address to determine the target virtual subnet to which the third network address belongs, wherein the virtual network includes at least one virtual subnet;

[0079] (2) Based on the identifier of the target virtual subnet, determine the network address of the trusted virtual host in the network address list of the trusted virtual host;

[0080] (3) Based on the network address of the trusted virtual host in the target virtual subnet, identify the trusted virtual host and determine the identification result.

[0081] The network addresses of trusted virtual hosts can be configured at the group, virtual subnet, or virtual network level. Hierarchical configuration of network addresses for trusted virtual hosts can reduce the efficiency of network address lookups.

[0082] In this embodiment, the network addresses of trusted virtual hosts are set on a per-virtual-subnet basis. If the SDN controller or third-party security device is connected to multiple virtual subnets, each virtual subnet corresponds to a list of trusted virtual host network addresses. After receiving the second request message, the SDN controller or third-party security device first determines the target virtual subnet to which the second source virtual host that sent the second request message belongs. Then, it uses the identifier of the target virtual subnet to determine the network address of the trusted virtual host under the target virtual subnet from the list of trusted virtual host network addresses. Finally, it uses the third network address to identify the trusted virtual host and determine the identification result.

[0083] The method for determining the target virtual subnet is as follows: the SDN controller or third-party security device pre-configures VLAN-to-VXLAN mappings, with each VXLAN corresponding to a virtual network controller that binds this mapping to the leaf device. The VLAN information received in the ARP / ND packet can determine which virtual network it belongs to. A virtual network can have multiple virtual subnets, and the subnet segments do not overlap. The source network address in the ARP / ND packet can be used to locate the specific virtual subnet.

[0084] When identifying trusted virtual hosts, a hierarchical query approach is adopted for querying third-party network addresses. That is, the query is performed using virtual subnets as the query unit, which can reduce the number of network address queries and improve the efficiency of trusted virtual host identification.

[0085] In some embodiments, the above method further includes:

[0086] (1) When the third network address is in the network address list of trusted virtual hosts, determine whether the second source virtual host and the second target virtual host belong to the same virtual subnet based on the third network address and the fourth network address.

[0087] (2) When they belong to the same virtual subnet, determine whether the third network address and the fourth target virtual host are interoperable network addresses.

[0088] (3) When the third network address and the fourth network address are not interoperable network addresses, a second response message is sent to the access device.

[0089] For SDN controllers or third-party security devices, in addition to identifying trusted virtual hosts, they can also identify and isolate traffic from virtual hosts belonging to the same virtual subnet. For example, if C is an untrusted virtual host, its access can be blocked; if D is a trusted virtual host, but we do not want D to access trusted virtual host E in the same subnet, we can pre-specify access control policies on the SDN controller to achieve traffic isolation.

[0090] Specifically, first determine whether the third network address and the fourth network address belong to the same virtual subnet. If they belong to the same virtual subnet, query whether the third network address and the fourth network address are interoperable network addresses. If they are, it means that traffic can be exchanged; otherwise, it means that the second source virtual host cannot access the second target virtual host. At this time, the SDN controller or third-party security device handles the situation in the same way as when an untrusted virtual host is determined, that is, it sends a second response message to the access point.

[0091] For virtual hosts within the same virtual subnet, in addition to identifying trusted virtual hosts, it is also necessary to identify traffic isolation in order to determine whether the source virtual host and the target virtual host can communicate with each other, thereby further ensuring the security of network communication.

[0092] In some implementations, the method further includes: when a virtual host is reclaimed, deleting the network address of the reclaimed virtual host from the network addresses of the trusted virtual host. When a virtual host needs to be reclaimed, the network address of the reclaimed virtual host needs to be removed from the network addresses of the trusted virtual host to further ensure the security of network communication.

[0093] This disclosure provides a method for identifying trusted virtual hosts, applicable to... Figure 1 In the network system shown, such as Figure 5 As shown, the method includes:

[0094] S301, the first source virtual host sends the first request message to the access device.

[0095] S302, the access device receives the first request message and starts timing the response duration.

[0096] S303, the access device sends the first request message to the SND controller.

[0097] The S304 SND controller uses a maintained list of trusted virtual host network addresses to identify the first source virtual host as a trusted virtual host.

[0098] S305, when the first network address of the first source virtual host is not in the list of trusted virtual host network addresses, the SND controller sends a first response message to the access device.

[0099] S306, the access device determines whether it has received a first response message from the SDN controller within a preset response time period, the first response message carrying an invalid physical address of the first target virtual host. If received, proceed to S307; otherwise, proceed to S308.

[0100] S307, the access device will only send the first response message to the first source virtual host within the preset response time.

[0101] S308, the access device performs a local query based on the second network address of the first target virtual host to determine the physical address of the first target virtual host, and sends a real response message to the first source virtual host, wherein the real response message carries the physical address of the first target virtual host.

[0102] This disclosure provides a method for identifying trusted virtual hosts, applicable to... Figure 2 In the network system shown, such as Figure 6 As shown, the method includes:

[0103] S401, the second source virtual host sends a second request message to the access device.

[0104] S402, the access device receives the second request message and starts timing the response duration. In this case, the request-response function of the access device within the virtual network is disabled.

[0105] S403, the access device sends the second request message to the third-party security device.

[0106] S404, a third-party security device uses a maintained list of trusted virtual host network addresses to identify a second-source virtual host as a trusted virtual host.

[0107] S405, when the third network address of the second source virtual host is not in the list of trusted virtual host network addresses, the third-party security device sends a second response message to the access device.

[0108] S406, the second target virtual host receives the second request message and sends a response message to the access device, which carries the correct physical address of the second target virtual host.

[0109] S407, the access device determines whether it has received a second response message from a third-party security device within a preset response time period, the second response message carrying an invalid physical address of the second target virtual host. If received, proceed to S408; otherwise, proceed to S409.

[0110] S408, the access device will only send the second response message to the second source virtual host within the preset response time.

[0111] S409, the access device sends a real response message to the second source virtual host based on the response message sent by the second target virtual host, and the real response message carries the physical address of the second target virtual host.

[0112] The trusted virtual host identification method provided in this disclosure sets up a network address list for trusted virtual hosts in an SDN controller or a third-party security device. For illegal ARP / ND requests outside the network address list of trusted virtual hosts, the SDN controller or the third-party security device responds with a response packet carrying an invalid physical address through the OpenFlow channel, thereby restricting untrusted hosts from illegally accessing trusted hosts and protecting the information security of trusted hosts.

[0113] This embodiment also provides a trusted virtual host identification device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0114] This embodiment provides a trusted virtual host identification device, applied in the access device of a first source virtual host, such as... Figure 7 As shown, the device includes:

[0115] The first receiving module 51 is used to receive the first request message sent by the first source virtual host and start the response timer. The first request message carries the first network address of the first source virtual host and the second network address of the first target virtual host. The first request message is used to request the physical address of the first target virtual host.

[0116] The first sending module 52 is used to send the first request message to the trusted host identification device, so as to identify the first source virtual host as a trusted virtual host by using the network address list of trusted virtual hosts maintained in the trusted host identification device.

[0117] The second sending module 53 is configured to, if it receives a first response message from the trusted host identification device within a preset response time, send the first response message only to the first source virtual host within the preset response time, wherein the first response message carries an invalid physical address of the first target virtual host.

[0118] In some embodiments, the apparatus further includes:

[0119] The first acquisition module is used to acquire the physical address of the first target virtual host if the first response message is not received within the preset response time.

[0120] The message sending module is used to send a real response message to the first source virtual host, wherein the real response message carries the physical address of the first target virtual host.

[0121] In some implementations, the first acquisition module includes:

[0122] The query unit is used to perform a query locally based on the second network address to determine the physical address of the first target virtual host;

[0123] or,

[0124] The determining unit is configured to receive a response message sent by the first target virtual host to determine the real response message, wherein the response message is sent by the first target virtual host after receiving the first request message, and the response message carries the physical address of the first target virtual host.

[0125] This embodiment provides a trusted virtual host identification device, applied in an SDN controller or a third-party security device, wherein the SDN controller or the third-party security device maintains a list of network addresses of trusted virtual hosts, such as... Figure 8 As shown, the device includes:

[0126] The second receiving module 61 is used to receive a second request message sent by the access device of the second source virtual host. The second request message carries a third network address of the second source virtual host and a fourth network address of the second target virtual host. The second request message is used to request the physical address of the second target virtual host. In the case where the method is applied to a third-party security device, the request-response function of the access device of the virtual host in the virtual network is turned off.

[0127] The third sending module 62 is used to send a second response message to the access device when the third network address is not in the network address list of the trusted virtual host, so that the access device sends the second response message only to the second source virtual host within a preset response time. The second response message carries an invalid physical address of the second target virtual host. The response time of the access device starts from the time when the access device receives the second request message.

[0128] In some embodiments, the apparatus further includes:

[0129] The second acquisition module is used to acquire the status of the trusted identification mark of the virtual network;

[0130] The access restriction module is used to restrict access to all virtual hosts within the virtual network when the trusted identification tag is in a state of disabled trusted virtual host identification.

[0131] In some embodiments, the apparatus further includes:

[0132] The first determining module is used to determine the target virtual subnet to which the third network address belongs using the third network address, wherein the virtual network includes at least one virtual subnet;

[0133] The second determining module is used to determine the network address of the trusted virtual host in the target virtual subnet based on the identifier of the target virtual subnet in the list of trusted virtual host network addresses;

[0134] The third determining module is used to identify trusted virtual hosts in the target virtual subnet based on the third network address and to determine the identification result.

[0135] In some embodiments, the apparatus further includes:

[0136] The fourth determining module is used to determine, based on the third network address and the fourth network address, whether the second source virtual host and the second target virtual host belong to the same virtual subnet when the third network address is in the network address list of trusted virtual hosts;

[0137] The judgment module is used to determine whether the third network address and the fourth network address are interoperable network addresses when they belong to the same virtual subnet.

[0138] The fourth sending module is used to send the second response message to the access device when the third network address and the fourth network address are not interoperable network addresses.

[0139] In some embodiments, the apparatus further includes:

[0140] The recycling module is used to delete the network address of the reclaimed virtual host from the network address list of the trusted virtual hosts when the virtual host is reclaimed.

[0141] In this embodiment, the trusted virtual host identification device is presented in the form of a functional unit. Here, a unit refers to an ASIC circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0142] Further functional descriptions of the above modules are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0143] This disclosure also provides an electronic device having the above-described features. Figure 7 or Figure 8 The device shown is for identifying trusted virtual hosts.

[0144] Please see Figure 9 , Figure 9 This is a schematic diagram of the structure of an electronic device provided in an optional embodiment of this disclosure, such as... Figure 9 As shown, the electronic device may include: at least one processor 71, such as a CPU (Central Processing Unit), at least one communication interface 73, memory 74, and at least one communication bus 72. The communication bus 72 is used to enable communication between these components. The communication interface 73 may include a display screen or a keyboard; optionally, the communication interface 73 may also include a standard wired interface or a wireless interface. The memory 74 may be high-speed RAM (Random Access Memory) or non-volatile memory, such as at least one disk storage device. Optionally, the memory 74 may also be at least one storage device located remotely from the aforementioned processor 71. The processor 71 may be combined with... Figure 7 or Figure 8 The described apparatus has an application program stored in memory 74, and the processor 71 calls the program code stored in memory 74 to perform any of the above method steps.

[0145] The communication bus 72 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The communication bus 72 can be divided into an address bus, a data bus, and a control bus, etc. For ease of representation, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0146] The memory 74 may include volatile memory, such as random-access memory (RAM); the memory may also include non-volatile memory, such as flash memory, hard disk drive (HDD) or solid-state drive (SSD); the memory 74 may also include a combination of the above types of memory.

[0147] The processor 71 can be a central processing unit (CPU), a network processor (NP), or a combination of CPU and NP.

[0148] The processor 71 may further include a hardware chip. This hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0149] Optionally, the memory 74 is also used to store program instructions. The processor 71 can invoke the program instructions to implement the trusted virtual host identification method as shown in any embodiment of this application.

[0150] This disclosure also provides a non-transitory computer storage medium storing computer-executable instructions that can execute the trusted virtual host identification method in any of the above method embodiments. The storage medium may be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0151] Although embodiments of the present disclosure have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present disclosure, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for identifying a trusted virtual host, characterized in that: Applied in an access device of a first source virtual host, the method comprises: Receive a first request message sent by the first source virtual host and start timing of a response time, wherein the first request message carries a first network address of the first source virtual host and a second network address of the first target virtual host, and the first request message is used to request a physical address of the first target virtual host; Sending the first request message to a trusted host identification device, so as to identify the first source virtual host as a trusted virtual host by using a network address list of trusted virtual hosts maintained in the trusted host identification device; If a first response message sent by the trusted host identification device is received within a preset response time, indicating that the first source virtual host is an untrusted virtual host, then only the first response message is sent to the first source virtual host within the preset response time, and the first response message carries an invalid physical address of the first target virtual host; If the first response message is not received within the preset response time, obtaining the physical address of the first target virtual host; A real response message is sent to the first source virtual host, where the real response message carries the physical address of the first target virtual host.

2. The method according to claim 1, characterized in that The obtaining the physical address of the first target virtual host includes: Performing a query locally based on the second network address to determine the physical address of the first target virtual host; or, Receive a response message sent by the first target virtual host to determine the real response message, wherein the response message is sent by the first target virtual host after receiving the first request message, and the response message carries the physical address of the first target virtual host.

3. A method for identifying a trusted virtual host, characterized in that: Applied to an SDN controller or a third-party security device, the SDN controller or the third-party security device maintains a network address list of a trusted virtual host, and the method includes: Receive a second request message sent by an access device of a second source virtual host, wherein the second request message carries a third network address of the second source virtual host and a fourth network address of the second target virtual host, and the second request message is used to request the physical address of the second target virtual host, wherein, when the method is applied to a third-party security device, a request answering function of the access device of the virtual host in the virtual network is in a closed state; When the third network address is not in the network address list of the trusted virtual host, it indicates that the second source virtual host is an untrusted virtual host, and a second response message is sent to the access device, so that the access device only sends the second response message to the second source virtual host within a preset response time, and the second response message carries an invalid physical address of the second target virtual host. The response time of the access device is counted from the time when the access device receives the second request message; When the third network address is in the network address list of the trusted virtual host, determining whether the second source virtual host and the second target virtual host belong to the same virtual subnet based on the third network address and the fourth network address; When they belong to the same virtual subnet, determining whether the third network address and the fourth network address are interoperable network addresses; When the third network address and the fourth network address are not interoperable network addresses, the second response message is sent to the access device.

4. The method according to claim 3, characterized in that The method further comprises: Get the status of the trusted identification tag of the virtual network; When the state of the trusted identification mark is to close the identification of the trusted virtual host, the access of all virtual hosts in the virtual network is restricted.

5. The method according to claim 4, characterized in that The method further comprises: Determine, by using the third network address, a target virtual subnet to which the third network address belongs, wherein the virtual network includes at least one virtual subnet; Based on the identifier of the target virtual subnet, determining the network address of the trusted virtual host in the target virtual subnet in the network address list of the trusted virtual host; Based on the third network address, the trusted virtual host is identified in the network address of the trusted virtual host in the target virtual subnet, and an identification result is determined.

6. The method according to claim 3, characterized in that The method further comprises: When a virtual host is recycled, the network address of the recycled virtual host is deleted from the network address list of the trusted virtual host.

7. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for identifying a trusted virtual host according to any one of claims 1 to 2 or any one of claims 3 to 6 by executing the computer instructions.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for identifying a trusted virtual host according to any one of claims 1 to 2 or any one of claims 3 to 6.

Images