A security control method and system based on an SDN architecture

Abstract

The application discloses a kind of security control method and system based on SDN architecture, it is related to security control technical field, including: user end is authenticated by sending first handshake request to edge computing device to realize the identity authentication of user end, and corresponding master key is issued to user end and SDN controller by edge computing device, user end is encrypted to access request by master key, and sends the encrypted access request to SDN controller, after SDN controller is parsed encrypted access request, determine its data transmission route path, i.e. which switch is sent to user end by the data stream collected by distributed data acquisition terminal the security control method based on SDN architecture provided by the application realizes the unified control of network, wisdom arrangement and collaborative scheduling, provides various automation, intelligent capacity, provides high-speed, reliable, safe communication service guarantee for power system.

Description

Technical Field

[0001] This invention relates to the field of security control technology, specifically to a security control method and system based on SDN architecture. Background Technology

[0002] With the development of network technology, existing network structures can no longer meet the demands of rapidly expanding network scale and increasingly diverse application types. Countries worldwide have researched future network architectures and made some progress. Software Defined Networking (SDN) has received widespread attention from industry and academia. It is a novel network architecture and a method for implementing network virtualization. Its core technology (OpenFlow) achieves flexible control of network traffic by separating the control plane and data plane of network devices, making the network, as a conduit, more intelligent.

[0003] Control functions are separated from network devices via SDN. Flow table structures are maintained on SDN-DN switches, data packets are forwarded according to the flow tables, and the generation, maintenance, and configuration of flow tables are managed by the management controller. The flow table structure flattens the network processing hierarchy, enabling fine-grained processing of network data.

[0004] In this forwarding and control separation architecture, the network's logical control functions and advanced policies can be dynamically and flexibly managed and configured by the management controller. Furthermore, novel network architectures can be implemented and deployed in existing networks without affecting the normal services of traditional networks. However, SDN technology still suffers from low data transmission security and unbalanced network scheduling. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problem solved by this invention is that existing network control and data transmission methods suffer from low data transmission security and unbalanced network scheduling, and how to improve data transmission security and optimize network scheduling.

[0007] To address the aforementioned technical problems, this invention provides the following technical solution: a security control method based on SDN architecture, comprising:

[0008] The user sends the first handshake request to the edge computing device for authentication. The edge computing device returns the authentication information and distributes the master key.

[0009] The user uses the master key to encrypt the second handshake request and sends it to the SDN controller. The second handshake request contains multiple destination IP addresses and cookie values.

[0010] The SDN controller decrypts the second handshake request, plans the routing path through different SDN switches, and sends a message containing the cookie value to the corresponding SDN switch.

[0011] SDN switches monitor data flow and check the cookie value in data packets. If the value is correct, the data is allowed to pass through; otherwise, the data flow is discarded and the SDN controller is notified to re-plan.

[0012] The distributed data acquisition terminal transmits data to the user end through the SDN switch network, and the SDN controller continuously monitors network traffic and updates security policies.

[0013] As a preferred embodiment of the security control method based on SDN architecture described in this invention, the first handshake request includes a Hello message of the DTLS handshake protocol, wherein the Hello message contains supported cipher suites, as well as the user's source MAC address, user's IP address, timestamp, and behavior signature.

[0014] The authentication process includes the edge computing device receiving a DTLS Hello message sent by the user terminal, and extracting the supported cipher suites, the user terminal source MAC address, the user terminal IP address, the timestamp, and the behavior signature from the Hello message;

[0015] Validation is performed using a multi-factor dynamic validation model, which includes a time window model, a Bayesian network model, a cosine similarity model, and a hash validation model.

[0016] The time window model is used to calculate the time window, and the timestamp is checked to see if it is within the allowed time range. If the timestamp is not within the allowed range, the request is rejected directly.

[0017] If the timestamp is within the allowed range, the credibility of the behavior signature is evaluated through a Bayesian network model, incorporating user historical behavior data and contextual information. If the credibility of the behavior is less than the first credibility threshold, the request is rejected directly. If the credibility threshold of the behavior is greater than or equal to the first credibility threshold and less than or equal to the second credibility threshold, additional verification steps are added for secondary confirmation.

[0018] If the credibility of the behavior is greater than the second credibility threshold, the cosine similarity model is used to verify the device fingerprint. If the device fingerprint verification fails, the request is rejected directly.

[0019] The IP address is verified using a hash verification model. If the first IP address does not contain the client's IP address, the request is rejected directly. If the first IP address contains the client's IP address, the authentication is successful, and the key negotiation stage is entered to complete the authentication.

[0020] The key negotiation phase includes preliminary key negotiation and multi-step key negotiation;

[0021] The initial key negotiation uses an asymmetric encryption algorithm to exchange initial keys and generate a temporary key pair;

[0022] Multi-step key negotiation is based on temporary key pairs and gradually generates the final symmetric encryption master key, including generating an initial session key, further encrypting communication to generate intermediate keys, and finally generating the master key;

[0023] The generated master key is encrypted using an encryption algorithm selected based on the supported encryption suites. The encrypted master key is then returned to the user terminal as the first verification information, and the master key is distributed to the SDN controller.

[0024] As a preferred embodiment of the security control method based on SDN architecture described in this invention, the time window model is represented as follows:

[0025] T a =T w +ΔT

[0026]

[0027] Among them, T w Given the base time window, ΔT is the dynamic adjustment factor, f(t) is the network delay function, and D... i Let N be the jitter value at the i-th time point, and N be the number of time points.

[0028] As a preferred embodiment of the SDN-based security control method described in this invention, the Bayesian network model is represented as follows:

[0029]

[0030] Among them, S c To score behavioral credibility, B i For behavioral feature i, H i For historical data i, C i Let P be the i-th context information, and w be the probability. i Let be the weight of the i-th term.

[0031] As a preferred embodiment of the security control method based on SDN architecture described in this invention, the cosine similarity model is expressed as follows:

[0032]

[0033]

[0034] Among them, f i For device fingerprint features i, fs,i Let i be the stored device fingerprint feature, and η be the noise suppression factor;

[0035] The hash verification model is represented as follows:

[0036]

[0037]

[0038] Among them, H u H is the hash value of the user's IP address. c H is the chained hash value in the event of a collision. i Let be the hash value of collision i, and k be the number of collisions.

[0039] As a preferred embodiment of the SDN-based security control method described in this invention, the multi-step key negotiation is represented as follows:

[0040]

[0041] Among them, K t K is a temporary key. i For key components i, K j Let j be the intermediate key component, n be the number of key components, and m be the number of intermediate key components.

[0042] As a preferred embodiment of the security control method based on SDN architecture described in this invention, the user terminal uses a master key to encrypt the second handshake request. The second handshake request includes multiple destination IP addresses and a HelloVerifyRequest message of the DTLS handshake protocol, wherein the HelloVerifyRequest message contains a cookie value, and the destination IP address is the IP address of the distributed data acquisition terminal.

[0043] After receiving the encrypted second handshake request, the SDN controller decrypts it using the master key to obtain the destination IP address, and plans the routing path through different SDN switches based on the destination IP address. At the same time, it sends the HelloVerifyRequest message containing the cookie value to the corresponding SDN switch.

[0044] When the first SDN switch on the routing path receives a communication data stream from the distributed data acquisition terminal, it parses the data packets in the communication data stream, checking the communication content of the flow ID, industrial communication protocol type, and application layer information item by item. If the check is correct, a cookie value is appended to the data packet. Other SDN switches on the routing path, after obtaining the communication data stream, check whether there is a cookie value on each data packet. If there is no cookie value, the SDN switch discards the entire communication data stream and notifies the SDN controller. The SDN controller then re-publishes the data transmission to the corresponding distributed data acquisition terminal.

[0045] Another objective of this invention is to provide a security control system based on SDN architecture, which solves the problems of low data transmission security and unbalanced network scheduling in existing network control and data transmission by constructing a security control system based on SDN architecture, and realizes efficient and secure network data transmission and intelligent network scheduling.

[0046] To address the aforementioned technical problems, the present invention provides the following technical solution: a security control system based on SDN architecture, comprising: a user terminal, an edge computing device, a distributed data acquisition terminal, an SDN controller, and an SDN switch network;

[0047] The user terminal sends a first handshake request to the edge computing device for authentication, and the edge computing device returns authentication information and distributes the master key.

[0048] The user terminal uses the master key to encrypt the second handshake request and sends it to the SDN controller. The second handshake request contains multiple destination IP addresses and cookie values.

[0049] The SDN controller decrypts the second handshake request, plans the routing path through different SDN switches, and sends a message containing the cookie value to the corresponding SDN switch.

[0050] The SDN switch monitors the data flow, checks the cookie value in the data packet, and allows the data to pass if it is correct, and discards the data flow and notifies the SDN controller to re-plan.

[0051] The distributed data acquisition terminal transmits data to the user terminal through the SDN switch network, and the SDN controller continuously monitors network traffic and updates security policies.

[0052] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the security control method based on the SDN architecture as described above.

[0053] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the security control method based on the SDN architecture as described above.

[0054] The beneficial effects of this invention are: the security control method based on SDN architecture provided by this invention improves the security of data transmission and the balance of network scheduling.

[0055] The edge computing device receives the first handshake request from the user terminal, authenticates the user's identity, and distributes the master key. The user terminal uses the master key to encrypt the access request, ensuring its security. After decrypting the access request, the SDN controller plans the optimal routing path, enabling efficient and secure data transmission. The SDN switch monitors the data flow in real time and verifies the legitimacy of data packets using cookie values, ensuring data integrity and security during transmission. The distributed data acquisition terminal transmits data to the user terminal through the SDN switch network. Throughout this process, the SDN controller dynamically adjusts and optimizes network policies to ensure efficient network operation.

[0056] It enables unified control and intelligent scheduling of the network, and provides high-speed, reliable and secure communication services, suitable for data transmission needs in power systems. Attached Figure Description

[0057] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 The present invention provides an overall flowchart of a security control method based on an SDN architecture, which is an embodiment of the present invention.

[0059] Figure 2 The second embodiment of the present invention provides an overall structural diagram of a security control system based on SDN architecture. Detailed Implementation

[0060] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0061] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0062] Example 1

[0063] Reference Figure 1 As an embodiment of the present invention, a security control method based on an SDN architecture is provided, comprising:

[0064] The user sends the first handshake request to the edge computing device for authentication. The edge computing device returns the authentication information and distributes the master key.

[0065] The user uses the master key to encrypt the second handshake request and sends it to the SDN controller. The second handshake request contains multiple destination IP addresses and cookie values.

[0066] The SDN controller decrypts the second handshake request, plans the routing path through different SDN switches, and sends a message containing the cookie value to the corresponding SDN switch.

[0067] SDN switches monitor data flow and check the cookie value in data packets. If the value is correct, the data is allowed to pass through; otherwise, the data flow is discarded and the SDN controller is notified to re-plan.

[0068] The distributed data acquisition terminal transmits data to the user end through the SDN switch network, and the SDN controller continuously monitors network traffic and updates security policies.

[0069] The first handshake request includes a Hello message of the DTLS handshake protocol, the Hello message containing supported cipher suites, as well as the user's source MAC address, user's IP address, timestamp, and action signature;

[0070] The authentication process includes the edge computing device receiving a DTLS Hello message sent by the user terminal, and extracting the supported cipher suites, the user terminal source MAC address, the user terminal IP address, the timestamp, and the behavior signature from the Hello message;

[0071] Validation is performed using a multi-factor dynamic validation model, which includes a time window model, a Bayesian network model, a cosine similarity model, and a hash validation model.

[0072] The time window model is used to calculate the time window, and the timestamp is checked to see if it is within the allowed time range. If the timestamp is not within the allowed range, the request is rejected directly.

[0073] If the timestamp is within the allowed range, the credibility of the behavior signature is evaluated through a Bayesian network model, incorporating user historical behavior data and contextual information. If the credibility of the behavior is less than the first credibility threshold, the request is rejected directly. If the credibility threshold of the behavior is greater than or equal to the first credibility threshold and less than or equal to the second credibility threshold, additional verification steps are added for secondary confirmation.

[0074] If the credibility of the behavior is greater than the second credibility threshold, the cosine similarity model is used to verify the device fingerprint. If the device fingerprint verification fails, the request is rejected directly.

[0075] The IP address is verified using a hash verification model. If the first IP address does not contain the client's IP address, the request is rejected directly. If the first IP address contains the client's IP address, the authentication is successful, and the key negotiation stage is entered to complete the authentication.

[0076] The key negotiation phase includes preliminary key negotiation and multi-step key negotiation;

[0077] The initial key negotiation uses an asymmetric encryption algorithm to exchange initial keys and generate a temporary key pair;

[0078] Multi-step key negotiation is based on temporary key pairs and gradually generates the final symmetric encryption master key, including generating an initial session key, further encrypting communication to generate intermediate keys, and finally generating the master key;

[0079] The generated master key is encrypted using an encryption algorithm selected based on the supported encryption suites. The encrypted master key is then returned to the user terminal as the first verification information, and the master key is distributed to the SDN controller.

[0080] The time window model is represented as follows:

[0081] T a =T w +ΔT

[0082]

[0083] Among them, T w Given the base time window, ΔT is the dynamic adjustment factor, f(t) is the network delay function, and D... i Let N be the jitter value at the i-th time point, and N be the number of time points.

[0084] By dynamically adjusting the time window model, the accuracy of timestamps is ensured based on network latency and jitter values. This effectively addresses latency fluctuations under different network environments, ensures message real-time performance, and prevents replay attacks. By dynamically adjusting the time window, the validity of messages is accurately determined, thereby improving the reliability of identity verification.

[0085] The Bayesian network model is represented as follows:

[0086]

[0087] Among them, S c To score behavioral credibility, B i For the i-th behavioral feature, H i For the i-th historical data, C i Let P be the i-th context information, and w be the probability. i Let be the weight of the i-th term.

[0088] By incorporating historical user behavior data and contextual information to assess the credibility of behavioral signatures, the accuracy and complexity of behavioral analysis are improved, facilitating more precise identification of user behavior. Simple behavioral signature verification may carry the risk of false positives; introducing historical behavior data and contextual information provides more verification dimensions, reduces the false positive rate, and enhances the reliability and security of identity verification.

[0089] The cosine similarity model is expressed as follows:

[0090]

[0091]

[0092] Among them, f i For device fingerprint characteristics, f s,i Here, η is a pre-stored feature vector, and η is a noise suppression factor.

[0093] The introduction of a noise suppression factor improves the traditional cosine similarity model, thereby enhancing the accuracy of device fingerprint verification, reducing misjudgments caused by changes in device fingerprints, and ensuring the uniqueness and accuracy of device identification. Device fingerprints may vary due to environmental changes or usage conditions. The introduction of the noise suppression factor can effectively reduce the impact of these changes on the verification results, providing more stable and accurate device fingerprint verification results.

[0094] The hash verification model is represented as follows:

[0095]

[0096]

[0097] Among them, H u H is the hash value of the user's IP address. c H is used to handle hash collisions in chaining. i is the hash verification value, and k is the collision number.

[0098] Chaining addresses to handle hash collisions enhances the reliability of IP address verification, ensures the uniqueness and accuracy of user IP addresses, and avoids security risks caused by hash collisions. Chaining addresses can effectively resolve hash collision problems, improve the reliability of IP address verification, and ensure the security and accuracy of the identity verification process.

[0099] The multi-step key negotiation is represented as follows:

[0100]

[0101] Among them, K t K is a temporary key. i For the i-th key component, K j Let be the j-th intermediate key component, n be the number of key components, and m be the number of intermediate key components.

[0102] Using an asymmetric encryption algorithm for the initial key exchange generates a temporary key pair, ensuring the security of the key exchange, preventing key leakage during transmission, and improving the overall system security. Asymmetric encryption algorithms possess high security and complexity, are suitable for the initial key exchange stage, and can effectively prevent eavesdropping and tampering with the key during transmission, guaranteeing the security of the key exchange.

[0103] The multi-step key negotiation mechanism generates the final symmetric encryption master key step by step through temporary key pairs. This includes generating an initial session key, further encrypting communication to generate intermediate keys, and finally generating the master key, thus improving the security and complexity of the key generation process. Multi-step key negotiation increases the complexity of the key generation process, reduces the risk of single points of failure, enhances the security and reliability of key generation, and ensures the security of the generated symmetric encryption master key.

[0104] Adding an extra verification step involves the edge computing device sending a secondary verification request to the user, requiring the user to provide additional authentication information.

[0105] After receiving the secondary verification request, the client generates additional verification information, including but not limited to: dynamic verification code (verification code sent via the user's registered mobile phone or email);

[0106] Biometric data (such as fingerprints and facial recognition data);

[0107] Additional password or PIN code.

[0108] The user-side client encrypts the generated secondary verification information using the master key and transmits it to the edge computing device through a secure channel.

[0109] After receiving the encrypted secondary authentication information, the edge computing device uses the master key to decrypt it and obtain the additional authentication information provided by the user.

[0110] Edge computing devices verify the secondary verification information provided by the user: verifying the validity and correctness of the dynamic verification code; verifying the matching degree of biometric data; and verifying the correctness of the additional password or PIN code.

[0111] If the secondary verification information is valid and correct, the edge computing device raises the user's behavior credibility to above the second credibility threshold and continues with subsequent verification steps. If the secondary verification information is invalid or incorrect, the request is rejected directly.

[0112] The user terminal uses a master key to encrypt the second handshake request. The second handshake request includes multiple destination IP addresses and a HelloVerifyRequest message of the DTLS handshake protocol. The HelloVerifyRequest message contains a cookie value, and the destination IP address is the IP address of the distributed data acquisition terminal.

[0113] After receiving the encrypted second handshake request, the SDN controller decrypts it using the master key to obtain the destination IP address, and plans the routing path through different SDN switches based on the destination IP address. At the same time, it sends the HelloVerifyRequest message containing the cookie value to the corresponding SDN switch.

[0114] When the first SDN switch on the routing path receives a communication data stream from the distributed data acquisition terminal, it parses the data packets in the communication data stream, checking the communication content of the flow ID, industrial communication protocol type, and application layer information item by item. If the check is correct, a cookie value is appended to the data packet. Other SDN switches on the routing path, after obtaining the communication data stream, check whether there is a cookie value on each data packet. If there is no cookie value, the SDN switch discards the entire communication data stream and notifies the SDN controller. The SDN controller then re-publishes the data transmission to the corresponding distributed data acquisition terminal.

[0115] Example 2

[0116] Reference Figure 2 As one embodiment of the present invention, a security control system based on an SDN architecture is provided, comprising:

[0117] User terminals, edge computing devices, distributed data acquisition terminals, SDN controllers, and SDN switch networks;

[0118] like Figure 2 As shown, the user terminal is configured to send a first handshake request to the edge computing device and a second handshake request to the SDN controller. The edge computing device is configured to return first authentication information to the user terminal based on the first handshake request. The SDN controller is configured to generate an access request and determine a routing path between the user terminal and the corresponding distributed data acquisition terminal based on the second handshake request. The SDN switch network includes multiple SDN switches, which are used to enable data interaction between the distributed data acquisition terminal and the user terminal through the SDN switches included in the routing path.

[0119] In this embodiment, the distributed data acquisition terminal is mainly the data acquisition terminal of the power system;

[0120] The SDN controller provides a centralized controller for the entire network, enabling real-time responses to constantly changing traffic patterns and automating network functions. This function can dynamically adjust traffic to improve overall network security and performance. Specifically, the user terminal first authenticates its identity by sending a first handshake request to the edge computing device. The edge computing device then issues a corresponding master key to both the user terminal and the SDN controller. The user terminal encrypts the access request using the master key and sends the encrypted access request to the SDN controller. After parsing the encrypted access request, the SDN controller determines the routing path for its data transmission, i.e., which switches the data stream collected by the distributed data acquisition terminal will be sent to the user terminal through.

[0121] In one possible implementation, the first handshake request is a Hello message of the DTLS handshake protocol sent by the user terminal to the edge computing device. If the user terminal's authentication is successful, the corresponding public key certificate is obtained according to the encryption suite supported by the user terminal, a master key is generated, and the master key is returned to the user terminal as the content of the first verification information. At the same time, the edge computing device distributes the master key to the SDN controller.

[0122] If the user sends a second handshake request to the SDN controller directly without encrypting the master key, the SDN controller will refuse to accept the second handshake request.

[0123] In one possible implementation, the user terminal encrypts the second handshake request using a master key. The second handshake request includes multiple destination IP addresses and a HelloVerifyRequest message of the DTLS handshake protocol, wherein the HelloVerifyRequest message contains a cookie value, and the destination IP addresses are the IP addresses of the distributed data acquisition terminal.

[0124] Furthermore, after receiving the encrypted second handshake request, the SDN controller decrypts it using the master key to obtain the destination IP address, and plans the routing path through different SDN switches based on the destination IP address. At the same time, it sends the HelloVerifyRequest message containing the cookie value to the corresponding SDN switch.

[0125] In one possible implementation, when the first SDN switch on the routing path receives a communication data stream from the distributed data acquisition terminal, the first SDN switch parses the data packets in the communication data stream, checking the communication content of the flow ID, industrial communication protocol type, and application layer information item by item. If the check is correct, a cookie value is appended to the data packet. Other SDN switches on the routing path, after obtaining the communication data stream, check whether there is a cookie value on each data packet. If there is no cookie value, the SDN switch discards the entire communication data stream and notifies the SDN controller. The SDN controller then re-publishes the data transmission to the corresponding distributed data acquisition terminal.

[0126] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. The scope of protection of the present invention should be determined by the scope of the claims.

[0127] Example 3

[0128] One embodiment of the present invention differs from the previous two embodiments in that:

[0129] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0130] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0131] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0132] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0133] Example 4

[0134] As an embodiment of the present invention, a security control method based on SDN architecture is provided. In order to verify the beneficial effects of the present invention, the performance of the security control method based on SDN architecture and traditional methods in terms of data transmission security and network scheduling balance is quantified and compared, and scientific demonstration is carried out through simulation experiments.

[0135] Network topology: Includes multiple SDN switches and traditional switches. Distributed data acquisition terminals. User terminals. SDN controller.

[0136] The testing tools include network performance testing tools, data transmission security testing tools, and network traffic monitoring tools.

[0137] Configure a hybrid network comprising SDN switches and traditional switches. Deploy the SDN controller and configure its communication with the SDN switches. Configure user terminals and distributed data acquisition terminals, ensuring they can communicate over the network.

[0138] Test transmission using both encrypted and unencrypted data streams. Set different traffic patterns (peak traffic, off-peak traffic, burst traffic).

[0139] Use iperf to test transmission latency. Use Wireshark to capture and analyze packets, checking packet loss rate and bit error rate. Use Nagios or Zabbix to monitor network traffic and calculate network utilization.

[0140] Traditional testing method: Configure forwarding rules for a traditional switch. Perform transmission tests on unencrypted data streams, recording transmission latency, data integrity, and network utilization. Perform transmission tests on encrypted data streams, recording the same metrics.

[0141] The method of this invention is tested as follows: Forwarding rules are configured for the SDN switch and SDN controller. The user terminal sends an initial handshake request, and the edge computing device returns verification information and distributes a master key. The user terminal uses the master key to encrypt a second handshake request and sends it to the SDN controller. The SDN controller decrypts the second handshake request, plans a routing path, and distributes it to the SDN switch. Transmission tests of unencrypted data streams are performed, recording transmission latency, data integrity, and network utilization. Transmission tests of encrypted data streams are then performed, recording the same metrics.

[0142] The performance of the two methods in terms of transmission delay, data integrity, and network utilization is compared. The experimental results are shown in Figure 1.

[0143] Table 1 Comparison of Experimental Results

[0144]

[0145] The SDN controller can dynamically plan the optimal routing path, avoiding suboptimal routing choices that may occur in traditional networks. Simultaneously, the SDN controller can monitor and adjust network traffic distribution in real time, reducing network congestion and thus lowering transmission latency.

[0146] SDN switches can monitor data flow in real time and avoid data packet loss due to path congestion or equipment failure during transmission by dynamically adjusting and optimizing routing paths.

[0147] The packet monitoring mechanism in the SDN architecture can promptly detect and correct errors in packets, ensuring data integrity during transmission.

[0148] SDN controllers can monitor network traffic in real time and dynamically adjust and optimize the allocation of network resources, avoiding the resource waste common in traditional networks.

[0149] Through intelligent and collaborative scheduling, the SDN architecture can maintain high network utilization under different traffic patterns (peak traffic, off-peak traffic, burst traffic) and fully leverage the potential of network resources.

[0150] The SDN controller provides unified control and management for the entire network, reducing coordination overhead between different devices and improving overall network efficiency.

[0151] By introducing time window models, Bayesian network models, cosine similarity models, and hash verification models, the security and accuracy of identity verification are enhanced. In particular, the combination of time window models and Bayesian network models effectively prevents replay attacks and abnormal behavior, improving data transmission security. A multi-step key negotiation mechanism ensures the security and reliability of key generation and distribution. Temporary key pairs are generated using asymmetric encryption algorithms, and then the final symmetric encryption master key is generated step-by-step, ensuring the encryption strength and security of data during transmission. The SDN controller can dynamically plan routing paths and monitor and adjust network traffic in real time, avoiding suboptimal routing and network congestion problems found in traditional networks. This not only reduces transmission latency but also improves network utilization and data transmission reliability. The SDN switch can monitor data flow in real time, ensuring data legitimacy and integrity by verifying cookie values ​​in data packets. This real-time monitoring mechanism effectively reduces packet loss and errors, ensuring high data transmission reliability.

[0152] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A security control method based on SDN architecture, characterized in that, include: The user sends the first handshake request to the edge computing device for authentication. The edge computing device returns the first authentication information and distributes the master key. The user uses the master key to encrypt the second handshake request and sends it to the SDN controller. The second handshake request contains multiple destination IP addresses and cookie values. The SDN controller decrypts the second handshake request, plans the routing path through different SDN switches, and sends a message containing the cookie value to the corresponding SDN switch. SDN switches monitor data flow and check the cookie value in data packets. If the value is correct, the data is allowed to pass through; otherwise, the data flow is discarded and the SDN controller is notified to re-plan. Distributed data acquisition terminals transmit data to user terminals through an SDN switch network, while the SDN controller continuously monitors network traffic and updates security policies. The first handshake request includes a Hello message of the DTLS handshake protocol, which contains supported cipher suites, the client's source MAC address, the client's IP address, a timestamp, and a signature. The authentication process includes the edge computing device receiving a DTLS Hello message sent by the user terminal, and extracting the supported cipher suites, the user terminal source MAC address, the user terminal IP address, the timestamp, and the behavior signature from the Hello message; Validation is performed using a multi-factor dynamic validation model, which includes a time window model, a Bayesian network model, a cosine similarity model, and a hash validation model. The time window model is used to calculate the time window, and the timestamp is checked to see if it is within the allowed time range. If the timestamp is not within the allowed range, the request is rejected directly. If the timestamp is within the allowed range, the credibility of the behavior signature is evaluated through a Bayesian network model, incorporating user historical behavior data and contextual information. If the credibility of the behavior signature is less than the first credibility threshold, the request is directly rejected. If the credibility threshold of the behavior signature is greater than or equal to the first credibility threshold and less than or equal to the second credibility threshold, additional verification steps are added for secondary confirmation. If the credibility of the behavior signature is greater than the second credibility threshold, the cosine similarity model is used to verify the device fingerprint. If the device fingerprint verification fails, the request is rejected directly. The IP address is verified using a hash verification model. If the first IP address does not contain the client's IP address, the request is rejected directly. If the first IP address contains the client's IP address, the authentication is successful, and the key negotiation stage is entered to complete the authentication. The key negotiation phase includes preliminary key negotiation and multi-step key negotiation; The initial key negotiation uses an asymmetric encryption algorithm to exchange initial keys and generate a temporary key pair; Multi-step key negotiation is based on temporary key pairs and gradually generates the final symmetric encryption master key, including generating an initial session key, further encrypting communication to generate intermediate keys, and finally generating the master key; The generated master key is encrypted using an encryption algorithm selected based on the supported encryption suites. The encrypted master key is then returned to the user terminal as the first verification information, and the master key is distributed to the SDN controller. The time window model is represented as follows: in, Based on the time window, As a dynamic adjustment factor, For network delay function, For the first The jitter value at each time point The number of time points; The Bayesian network model is represented as follows: in, To assess the credibility of behavioral signatures, For the first A behavioral characteristic, For the first Historical data For the first Context information For probability, For the first The weight of the item; The cosine similarity model is expressed as follows: in, For device fingerprint features For pre-stored feature vectors, It is a noise suppression factor; The hash verification model is represented as follows: in, The hash value of the user's IP address. To handle hash collisions using chaining, This is the hash verification value. Number of conflicts; The multi-step key negotiation is represented as follows: in, For temporary keys, For the first Key components For the first One intermediate key component For the number of key components, Number of intermediate key components; The user terminal uses a master key to encrypt the second handshake request. The second handshake request includes multiple destination IP addresses and a HelloVerifyRequest message of the DTLS handshake protocol. The HelloVerifyRequest message contains a cookie value, and the destination IP address is the IP address of the distributed data acquisition terminal. After receiving the encrypted second handshake request, the SDN controller decrypts it using the master key to obtain the destination IP address, and plans the routing path through different SDN switches based on the destination IP address. At the same time, it sends the HelloVerifyRequest message containing the cookie value to the corresponding SDN switch. When the first SDN switch on the routing path receives a communication data stream from the distributed data acquisition terminal, it parses the data packets in the communication data stream, checking the communication content of the flow ID, industrial communication protocol type, and application layer information item by item. If the check is correct, a cookie value is appended to the data packet. Other SDN switches on the routing path, after obtaining the communication data stream, check whether there is a cookie value on each data packet. If there is no cookie value, the SDN switch discards the entire communication data stream and notifies the SDN controller. The SDN controller then re-publishes the data transmission to the corresponding distributed data acquisition terminal.

2. A system employing the security control method based on SDN architecture as described in claim 1, characterized in that, include: User terminals, edge computing devices, distributed data acquisition terminals, SDN controllers, and SDN switch networks; The user terminal sends a first handshake request to the edge computing device for authentication, and the edge computing device returns the first authentication information and distributes the master key. The user terminal uses the master key to encrypt the second handshake request and sends it to the SDN controller. The second handshake request contains multiple destination IP addresses and cookie values. The SDN controller decrypts the second handshake request, plans the routing path through different SDN switches, and sends a message containing the cookie value to the corresponding SDN switch. The SDN switch monitors the data flow, checks the cookie value in the data packet, and allows the data to pass if it is correct, and discards the data flow and notifies the SDN controller to re-plan. The distributed data acquisition terminal transmits data to the user terminal through the SDN switch network, and the SDN controller continuously monitors network traffic and updates security policies.

3. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the security control method based on SDN architecture as described in claim 1.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the security control method based on SDN architecture as described in claim 1.

Images