A layered type distributed sdn network security protection method and system

Abstract

The application discloses a layered distributed sdn network security protection method and system, and belongs to the technical field of network space security. The system comprises an authentication client module, an authentication forwarding module, an sdn exchange module, an sdn area control module, an area authentication module, an sdn management control module and a management authentication module. The authentication client module is arranged on a communication terminal node of the network, the authentication forwarding module and the sdn exchange module are arranged on an sdn switch of the network, the area authentication module and the sdn area control module are arranged on an area controller, and the management authentication module and the sdn management control module are arranged on a management controller. The application can effectively provide reliable protection for real users in the network, reduce the communication time delay between the network controller and the switch, solve the processing bottleneck of a single controller, and improve the network performance, scalability and security.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security technology, specifically to a layered distributed SDN network security protection method and system. Background Technology

[0002] With the continuous development of network technology, network services are becoming increasingly complex, and the number of communication units is exploding. Software-defined networking (SDN) is being used more and more widely in network architecture. SDN decouples the control layer and data layer. The control layer is responsible for controlling the network and maintaining a global network topology view, while the data layer is responsible for data forwarding. This decoupling simplifies network management, enables network programmability, and provides conditions for the deployment of new network services and rapid network innovation. However, when SDN is deployed to large-scale networks such as data centers and wide area networks, the SDN control plane faces significant challenges in terms of performance, scalability, and security.

[0003] In SDN networks, controllers need to communicate frequently with switches to distribute forwarding rules according to control policies. As the number of communication nodes in the network increases, the number of switches also increases significantly. On the one hand, the communication latency between the controller and distant switches increases dramatically, reducing the control plane's control speed and the data plane's response speed. On the other hand, the massive number of network events and processing requests poses a severe challenge to the controller's computing and bandwidth resources, greatly limiting network scalability.

[0004] Attackers may target a switch node from within the network itself, thereby affecting the normal operation of that switch; the SDN controller is the most prominent target, as attackers can launch resource-consuming attacks such as denial-of-access control against the controller, reducing the controller's efficiency in processing messages and affecting the communication of the entire network. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a hierarchical distributed SDN network security protection method and system, which can effectively provide reliable protection for real users within the network, reduce communication latency between network controllers and switches, solve the processing bottleneck of a single controller, and improve network performance, scalability, and security.

[0006] The technical solution adopted in this invention is as follows:

[0007] A layered distributed SDN network security protection system includes an authentication client module, an authentication forwarding module, an SDN switching module, an SDN area control module, an area authentication module, an SDN management control module, and a management authentication module. The authentication client module is deployed on the network's communication terminal nodes; the authentication forwarding module and the SDN switching module are deployed on the network's SDN switches; the area authentication module and the SDN area control module are deployed on area controllers; and the management authentication module and the SDN management control module are deployed on management controllers.

[0008] The authentication client module is used to continuously authenticate communication terminals, including continuously monitoring the usage status of communication terminals and sending communication authentication requests intermittently; it is also used to determine whether the communication exceeds the set threshold. If it exceeds the threshold, it stops sending communication authentication requests; if it does not exceed the threshold, it continues to send communication authentication requests to maintain the communication link.

[0009] The authentication forwarding module is used to forward communication authentication requests sent by the authentication client module from the network to the regional authentication module; it is also used to return authentication failure messages to the authentication client module.

[0010] The regional authentication module, upon receiving a communication authentication request, determines whether the initiator and destination of the request are in the same region. If they are in the same region, it checks whether the initiator has permission to access the destination. If permission is granted, the authentication request is sent to the SDN regional control module; otherwise, the authentication failure message is returned to the authentication client module via the authentication forwarding module. If they are not in the same region, the authentication request is forwarded to the management authentication module. It is also used to request the SDN regional control module to issue flow rules and cancel the communication link in the SDN exchange module's flow table if no authentication request is received within a set time.

[0011] The SDN zone control module is used to calculate the communication link from the initiator to the destination of the communication request based on the zone view after receiving a communication authentication request, and to issue flow rules to the SDN exchange module in the communication link, update the zone view, and synchronize with the SDN management control module; it is also used to cancel the communication link in the flow table of the SDN exchange module after receiving a cancellation request from the zone authentication module.

[0012] The SDN exchange module is used to add flow rules to the flow table and complete the communication between the communication initiator and the communication destination according to the flow table;

[0013] The management authentication module is used to determine whether the communication initiator has permission to access the communication destination after receiving the communication authentication request forwarded by the regional authentication module. If the initiator has permission, the communication authentication request is sent to the SDN management control module; if the initiator does not have permission, the authentication failure message is returned to the authentication client module through the regional authentication module and the authentication forwarding module.

[0014] The SDN management and control module, upon receiving a communication authentication request, calculates the communication link from the initiator to the destination of the communication request based on the global view, and issues flow rules to the SDN exchange module through the SDN area control module in the communication link, updates the global view, and synchronizes with each SDN area control module.

[0015] A layered distributed SDN network security protection method includes the following steps:

[0016] S101. The authentication client module monitors the usage status of the communication terminal and sends a communication authentication request to the authentication forwarding module in the SDN switch;

[0017] S102. After receiving and recognizing the communication authentication request, the authentication forwarding module forwards the communication authentication request to the area authentication module;

[0018] S103. After receiving the communication authentication request, the regional authentication module determines whether the initiator and the destination of the communication authentication request are in the same region. If they are in the same region, proceed to S104; otherwise, proceed to step S112.

[0019] S104. The regional authentication module determines whether the communication initiator has permission to access the communication destination. If it has permission, it sends the communication authentication request to the SDN regional control module and proceeds to S105. If it does not have permission, it returns an authentication failure message to the authentication client module through the authentication forwarding module.

[0020] The S105.sdn area control module calculates the communication link from the initiator to the destination of the communication request based on the area view.

[0021] S106. The SDN area control module issues flow rules to the SDN switching module in the communication link, updates the area view, and synchronizes with the SDN management and control module.

[0022] S107. The SDN switching module in the communication link adds flow rules to the flow table;

[0023] S108. The communication initiator can normally access the communication destination through the communication link;

[0024] S109. The authentication client module continuously monitors the usage of the communication terminal and periodically checks whether the communication exceeds the set threshold. If it does not exceed the threshold, proceed to S110; if it does exceed the threshold, proceed to S111.

[0025] S110. The authentication client module continuously sends communication authentication requests to maintain the communication link and then terminates this process;

[0026] S111. The authentication client module stops sending communication authentication requests. When the regional authentication module does not receive a communication authentication request after a set time, it requests the SDN regional control module to issue flow rules, cancel the communication link in the SDN exchange module flow table, and request the initiator to interrupt the continued access to the destination, thus ending this process.

[0027] S112. The regional authentication module forwards the communication authentication request to the management authentication module. The management authentication module determines whether the communication initiator has permission to access the communication destination. If it has permission, it sends the communication authentication request to the SDN management control module and proceeds to S113. If it does not have permission, it returns an authentication failure message to the authentication client module through the regional authentication module and the authentication forwarding module.

[0028] The S113.sdn management and control module calculates the communication link from the initiator to the destination of the communication request based on the global view.

[0029] S114. The SDN management and control module sends flow rules to the SDN switching module through the SDN area control module in the communication link, updates the global view, and synchronizes with each SDN area control module, then enters S107.

[0030] The advantages of this invention are:

[0031] 1. This invention is based on the zero-trust concept and provides reliable protection for real users within the network. Only authenticated users can access resources within the network, and they can only access resources they have the authority to access.

[0032] 2. The hierarchical distributed SDN control plane design of this invention features a management controller with a global view of the network, while area controllers only have a local area view of the network. Area controllers handle communication requests and node authentication within their respective areas, while the management controller is responsible for cross-area communication requests and authentication between nodes across areas. This design addresses the processing bottleneck of a single controller, reduces communication latency between the controller and switches, and improves network performance and scalability. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art are briefly introduced below. The accompanying drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart of a layered distributed SDN network security protection method according to an embodiment of the present invention.

[0035] Figure 2 This is a schematic diagram of a layered distributed SDN network security protection system in an embodiment of the present invention.

[0036] Figure 3 This is a network model of a hierarchical distributed SDN network in an embodiment of the present invention. Detailed Implementation

[0037] To make the objectives and advantages of this invention clearer, the invention will be further described below with reference to the accompanying drawings and specific embodiments. It should be understood that the following text is merely used to describe one or more specific embodiments of the invention and does not strictly limit the scope of protection specifically claimed by the invention.

[0038] like Figure 3 As shown, a hierarchical distributed SDN network consists of several communication terminal nodes, several SDN switches, multiple area controllers, and one management controller. The hierarchical distributed SDN network is divided into a data plane and a control plane. The data plane refers to the interconnected structure formed by the communication terminal nodes and SDN switches. The data plane is divided into multiple areas according to the distribution of the communication terminal nodes. Each area has one area controller. Area controllers in different areas are not interconnected; all area controllers are connected to the management controller. The management controller acts as the first layer, and the area controllers act as the second layer, forming a two-layer structure that together constitutes the control plane of the hierarchical distributed SDN network.

[0039] like Figure 2 As shown, a layered distributed SDN network security protection system includes an authentication client module, an authentication forwarding module, an SDN switching module, an SDN area control module, an area authentication module, an SDN management control module, and a management authentication module. The authentication client module is deployed on the network's communication terminal nodes; the authentication forwarding module and the SDN switching module are deployed on the network's SDN switches; the area authentication module and the SDN area control module are deployed on the area controller; and the management authentication module and the SDN management control module are deployed on the management controller.

[0040] The authentication client module is used to continuously authenticate communication terminals, including continuously monitoring the usage status of communication terminals and sending communication authentication requests intermittently; it is also used to determine whether the communication exceeds the set threshold. If it exceeds the threshold, it stops sending communication authentication requests; if it does not exceed the threshold, it continues to send communication authentication requests to maintain the communication link.

[0041] The authentication forwarding module is used to forward communication authentication requests sent by the authentication client module from the network to the regional authentication module; it is also used to return authentication failure messages to the authentication client module.

[0042] The regional authentication module, upon receiving a communication authentication request, determines whether the initiator and destination of the request are in the same region. If they are in the same region, it checks whether the initiator has permission to access the destination. If permission is granted, the authentication request is sent to the SDN regional control module; otherwise, the authentication failure message is returned to the authentication client module via the authentication forwarding module. If they are not in the same region, the authentication request is forwarded to the management authentication module. It is also used to request the SDN regional control module to issue flow rules and cancel the communication link in the SDN exchange module's flow table if no authentication request is received within a set time.

[0043] The SDN zone control module is used to calculate the communication link from the initiator to the destination of the communication request based on the zone view after receiving a communication authentication request, and to issue flow rules to the SDN exchange module in the communication link, update the zone view, and synchronize with the SDN management control module; it is also used to cancel the communication link in the flow table of the SDN exchange module after receiving a cancellation request from the zone authentication module.

[0044] The SDN exchange module is used to add flow rules to the flow table and complete the communication between the communication initiator and the communication destination according to the flow table;

[0045] The management authentication module is used to determine whether the communication initiator has permission to access the communication destination after receiving the communication authentication request forwarded by the regional authentication module. If the initiator has permission, the communication authentication request is sent to the SDN management control module; if the initiator does not have permission, the authentication failure message is returned to the authentication client module through the regional authentication module and the authentication forwarding module.

[0046] The SDN management and control module, upon receiving a communication authentication request, calculates the communication link from the initiator to the destination of the communication request based on the global view, and issues flow rules to the SDN exchange module through the SDN area control module in the communication link, updates the global view, and synchronizes with each SDN area control module.

[0047] Based on the above system, a layered distributed SDN network security protection method can be implemented. For example... Figure 1 As shown, the process is as follows:

[0048] S101. The authentication client module monitors the usage status of the communication terminal and sends a communication authentication request to the authentication forwarding module in the SDN switch;

[0049] S102. After receiving and recognizing the communication authentication request, the authentication forwarding module forwards the communication authentication request to the area authentication module;

[0050] S103. After receiving a communication authentication request, the regional authentication module determines whether the initiator and destination of the communication authentication request are in the same region, as follows:

[0051] 1) If the initiator and the destination are in the same region, proceed to S104;

[0052] 2) If the initiator and the destination are not in the same region, proceed to S112;

[0053] S104. The regional authentication module determines whether the communication initiator has permission to access the communication destination, as follows:

[0054] 1) If authorized to access, the regional authentication module sends the communication authentication request to the SDN regional control module, and enters S105;

[0055] 2) If access is denied, the authentication failure message will be returned to the authentication client module via the authentication forwarding module;

[0056] S105. The SDN area control module calculates the link from the initiator to the destination of the communication request based on the area view, and then proceeds to S106.

[0057] S106. The SDN area control module issues flow rules to the SDN switching module in the link, updates the area view, and synchronizes with the SDN management control module, then proceeds to S107.

[0058] S107. The SDN switching module in the communication link adds the flow rules to the flow table, and proceeds to S108;

[0059] S108. The communication initiator, i.e. the terminal where the authentication client module is located, normally accesses the communication destination through the communication link;

[0060] S109. The authentication client module continuously monitors the user terminal usage and periodically checks whether the communication exceeds the set threshold. If it does not exceed the threshold, proceed to S110; if it does exceed the threshold, proceed to S111.

[0061] S110. The authentication client module continuously sends communication authentication requests to maintain the communication link and then terminates this process;

[0062] S111. The authentication client module stops sending communication authentication requests. When the regional authentication module does not receive a communication authentication request after a set time, it requests the SDN regional control module to issue flow rules, cancel the communication link in the SDN exchange module flow table, and request the initiator to interrupt the continued access to the destination, thus ending this process.

[0063] S112. The regional authentication module forwards the communication authentication request to the management authentication module. The management authentication module determines whether the communication initiator has permission to access the communication destination, as follows:

[0064] 1) If authorized to access, the communication authentication request will be sent to the SDN management and control module, and the process will proceed to S113;

[0065] 2) If access is denied, the authentication failure message will be returned to the authentication client module through the regional authentication module and the authentication forwarding module;

[0066] S113. The SDN management and control module calculates the communication link from the initiator to the destination of the communication request based on the global view, and then proceeds to S114.

[0067] S114. The SDN management and control module sends flow rules to the SDN switching module through the SDN area control module in the communication link, updates the global view, and synchronizes with each SDN area control module, then enters S107.

[0068] At this point, legitimate users can access network resources normally according to their permissions, effectively preventing access by illegitimate users. At the same time, it can effectively improve the performance and scalability of the SDN network.

Claims

1. A layered distributed SDN network security protection system, characterized in that, It includes an authentication client module, an authentication forwarding module, an SDN switching module, an SDN area control module, an area authentication module, an SDN management control module, and a management authentication module. The authentication client module is deployed on the network's communication terminal nodes; the authentication forwarding module and the SDN switching module are deployed on the network's SDN switches; the area authentication module and the SDN area control module are deployed on the area controller; and the management authentication module and the SDN management control module are deployed on the management controller. The authentication client module is used to continuously authenticate communication terminals, including continuously monitoring the usage status of communication terminals and sending communication authentication requests intermittently; it is also used to determine whether the communication exceeds the set threshold. If it exceeds the threshold, it stops sending communication authentication requests; if it does not exceed the threshold, it continues to send communication authentication requests to maintain the communication link. The authentication forwarding module is used to forward communication authentication requests sent by the authentication client module from the network to the regional authentication module; it is also used to return authentication failure messages to the authentication client module. The regional authentication module, upon receiving a communication authentication request, determines whether the initiator and destination of the request are in the same region. If they are in the same region, it checks whether the initiator has permission to access the destination. If permission is granted, the authentication request is sent to the SDN regional control module; otherwise, the authentication failure message is returned to the authentication client module via the authentication forwarding module. If they are not in the same region, the authentication request is forwarded to the management authentication module. It is also used to request the SDN regional control module to issue flow rules and cancel the communication link in the SDN exchange module's flow table if no authentication request is received within a set time. The SDN zone control module is used to calculate the communication link from the initiator to the destination of the communication request based on the zone view after receiving a communication authentication request, and to issue flow rules to the SDN exchange module in the communication link, update the zone view, and synchronize with the SDN management control module; it is also used to cancel the communication link in the flow table of the SDN exchange module after receiving a cancellation request from the zone authentication module. The SDN exchange module is used to add flow rules to the flow table and complete the communication between the communication initiator and the communication destination according to the flow table; The management authentication module is used to determine whether the communication initiator has permission to access the communication destination after receiving the communication authentication request forwarded by the regional authentication module. If the initiator has permission, the communication authentication request is sent to the SDN management control module; if the initiator does not have permission, the authentication failure message is returned to the authentication client module through the regional authentication module and the authentication forwarding module. The SDN management and control module, upon receiving a communication authentication request, calculates the communication link from the initiator to the destination of the communication request based on the global view, and issues flow rules to the SDN exchange module through the SDN area control module in the communication link, updates the global view, and synchronizes with each SDN area control module.

2. A layered distributed SDN network security protection method, characterized in that, Includes the following steps: S101. The authentication client module monitors the usage status of the communication terminal and sends a communication authentication request to the authentication forwarding module in the SDN switch; S102. After receiving and recognizing the communication authentication request, the authentication forwarding module forwards the communication authentication request to the area authentication module; S103. After receiving the communication authentication request, the regional authentication module determines whether the initiator and the destination of the communication authentication request are in the same region. If they are in the same region, proceed to S104; otherwise, proceed to S112. S104. The regional authentication module determines whether the communication initiator has permission to access the communication destination. If it has permission, it sends the communication authentication request to the SDN regional control module and proceeds to S105. If it does not have permission, it returns an authentication failure message to the authentication client module through the authentication forwarding module. The S105.sdn area control module calculates the communication link from the initiator to the destination of the communication request based on the area view. S106. The SDN area control module issues flow rules to the SDN switching module in the communication link, updates the area view, and synchronizes with the SDN management and control module. S107. The SDN switching module in the communication link adds flow rules to the flow table; S108. The communication initiator can normally access the communication destination through the communication link; S109. The authentication client module continuously monitors the usage of the communication terminal and periodically checks whether the communication exceeds the set threshold. If it does not exceed the threshold, proceed to S110. If it exceeds, proceed to S111; S110. The authentication client module continuously sends communication authentication requests to maintain the communication link and then terminates this process; S111. The authentication client module stops sending communication authentication requests. When the regional authentication module does not receive a communication authentication request after a set time, it requests the SDN regional control module to issue flow rules, cancel the communication link in the SDN exchange module flow table, and request the initiator to interrupt the continued access to the destination, thus ending this process. S112. The regional authentication module forwards the communication authentication request to the management authentication module. The management authentication module determines whether the communication initiator has permission to access the communication destination. If it has permission, it sends the communication authentication request to the SDN management control module and proceeds to S113. If access is denied, the authentication failure message will be returned to the authentication client module through the regional authentication module and the authentication forwarding module. The S113.sdn management and control module calculates the communication link from the initiator to the destination of the communication request based on the global view. S114. The SDN management and control module sends flow rules to the SDN switching module through the SDN area control module in the communication link, updates the global view, and synchronizes with each SDN area control module, then enters S107.

Images