A flow rule conflict detection method and system based on a prefix tree and a forwarding path

Abstract

The application provides a flow rule conflict detection method and system based on a prefix tree and a forwarding path, and the conflict types of flow rules are divided into explicit conflicts and implicit conflicts, wherein the explicit conflicts can be further divided into static conflicts and dynamic conflicts; first, a flow rule interception module intercepts flow rules sent to a switch by a northbound interface, then the intercepted flow rules are detected for three kinds of conflicts, then the flow rules with conflicts are sent to a flow rule conflict resolution module for conflict resolution, and finally, the flow rules after conflict resolution are sent to flow tables in a data plane. The application guarantees that all possible conflict situations are detected, improves the detection accuracy, reduces the time consumption of conflict detection, and provides an effective solution for flow rule conflict detection and conflict resolution in an SDN (Software Defined Network).

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a flow rule conflict detection method and system based on a prefix tree and a forwarding path. Background Art

[0002] Software-defined networking (SDN) is an emerging technology architecture that enables network management and configuration through network virtualization. By separating the control plane from the data plane, it allows network administrators to program and dynamically adjust network traffic through a centralized controller. This architecture enables networks to more flexibly adapt to various application requirements while simplifying network management and configuration. The programmability of SDN brings significant advantages, including efficient utilization of network resources, flexible traffic management, and rapid fault response. However, this centralized control model also introduces new challenges, particularly in security management and flow rule management. In SDN, flow rules are defined using protocols such as OpenFlow and are used to determine how packets are processed and forwarded within the network. As network scale and complexity increase, flow rules issued by different applications and policies may conflict, affecting the normal operation and security of the network.

[0003] Flow rule conflicts can generally be categorized into two types: static, explicit, and implicit. Explicit conflicts can be divided into static and dynamic. Static conflicts refer to errors or inconsistencies in the definition and configuration of flow rules, including overlapping matching domains or conflicting action domains. Static conflicts typically occur when flow rules are first issued or modified.

[0004] Dynamic conflicts refer to conflicts between flow rules that arise during network operation due to policy changes between applications or changes in network status. These conflicts primarily involve conflicts between flow rules. Implicit conflicts arise when dependencies or logical associations exist between rules, leading to unexpected behavior during packet forwarding and making them difficult to detect.

[0005] Existing flow rule conflict detection methods mostly focus on static and explicit conflict detection, relying primarily on direct comparisons between the rule's matching domain and action domain. Typical approaches include binary decision diagrams (BDDs), headspace analysis (HSA), and logical reasoning tools. However, these methods often suffer from low detection efficiency, poor real-time performance, and high false positive rates. This is particularly true when dealing with dynamic and implicit conflicts, making them difficult to meet the efficiency and accuracy requirements of real-world network environments. Summary of the Invention

[0006] The purpose of the present invention is to overcome the shortcomings of existing research technology and propose a flow rule conflict detection method and system based on prefix tree and forwarding path. This method improves the efficiency and accuracy of conflict detection, reduces the time overhead by about 40%-50% under different conflict types, and improves the accuracy of implicit conflict detection by about 41%.

[0007] The technical solution for achieving the purpose of the present invention is: a flow rule conflict detection method based on prefix tree and forwarding path, comprising:

[0008] S1. Detect static conflicts based on the flow rules to be issued that are intercepted by the flow rule interception module. The matching fields of the flow rules to be issued are checked to determine whether there are any flow rules with incorrect syntax. If there is a static conflict, proceed to S7 for conflict resolution. If there is no static conflict, proceed to S2 for dividing the flow rule protocols in the flow table.

[0009] S2. Perform dynamic conflict detection on the flow rules that are detected as not statically conflicting in S1, and divide the flow rules in the flow table into different sets according to different protocol types;

[0010] S3: For each set divided in S2, a matching tree is constructed for each matching field of the flow rule, mainly including source IP address, destination IP address, source physical address, destination physical address, source port number, and destination port number. After the construction is completed, the process goes to S4 to classify the conflict type.

[0011] S4. Based on the matching tree constructed in S3, determine the relationship between the flow rules to be issued and the flow rules in the flow table. Then, determine the conflict type of the flow rules based on the relationship between the flow rules and the action field. After the conflict type is determined, if there is a dynamic conflict, go to S7 to resolve the corresponding dynamic conflict type. If there is no dynamic conflict, go to S5 to detect implicit conflicts.

[0012] S5: For the flow rules detected in S4 that do not have dynamic conflicts, the first stage of implicit conflict detection is performed. Using the alias set algorithm, the source address, destination address, and action fields of the flow rules and firewall rules in the flow table are represented as sets. Based on the set information, a preliminary determination is made as to whether an implicit conflict has occurred. If the preliminary determination is that no implicit conflict has occurred, the flow rule is sent to the switch. If the preliminary determination is that an implicit conflict has occurred, the process proceeds to S6 for the second stage of detection.

[0013] S6: Perform a second phase of implicit conflict detection based on the results of S5. Accurate detection is achieved based on the actual forwarding path of the data packet. After determining that a conflict has occurred, proceed to S7 for conflict resolution. If no implicit conflict has occurred, flow rules are issued.

[0014] S7. Resolve the conflicts that occurred in the above steps S1, S4, and S6 to eliminate potential safety hazards caused by flow rule conflicts.

[0015] Furthermore, the rule of the flow to be issued in step S1 is f, and the main detection indicators are as follows:

[0016] 1) Whether the source IP address field of f and the destination IP address field of f are the same, and whether their values ​​are in the range of 0-255;

[0017] 2) Whether the source physical address field of f and the destination physical address field of f are the same, and whether their values ​​are between 0 and 0xffff;

[0018] 3) Whether the source port number field of f and the destination port number field of f are the same, and whether their values ​​are between 0 and 65535.

[0019] Furthermore, the basis for dividing the sets in step S2 is to divide the flow rules into four sets based on the types of protocols of traffic in the network and their proportions, namely:

[0020] Set_Tcp, Set_Udp, Set_Oth, Set_WildCard

[0021] Set_Tcp indicates a set of flow rules whose protocol type is TCP, Set_Udp indicates a set of flow rules whose protocol type is UDP, Set_Oth indicates flow rules whose flow rule types are other than TCP and UDP, and Set_WildCard indicates a set of flow rules whose protocol type is wildcard.

[0022] Furthermore, determining the relationship between the flow rules in step S4 specifically includes:

[0023] S4-1. To determine the dynamic conflict type of flow rules, you first need to determine the relationship between the matching fields of the two flow rules. Suppose there are two flow rules R1 and R2. The matching domain of R1 is match1 and the action field is action1. The matching field of R2 is match2 and the action field is action2. Based on the coverage relationship between match1 and match2, determine whether they are equal, intersecting, contained, or unrelated.

[0024] S4-2. Based on the relationship between the flow rule matching fields determined in S4-1, the relationship between flow rules R1 and R2 is determined based on the action fields action1 and action2 to determine whether the types are conflicting, equal, redundant, masked, included, included, overlapped, or associated.

[0025] Furthermore, the first stage detection of implicit conflict of flow rules in step S5 specifically includes:

[0026] S5-1. Flow rules and firewall rules are collectively represented. The simplified forms of flow rules and firewall rules are as follows:

[0027] Switch 1: Source address: Host 1, Destination address: Host 6, Action: Change source address to Host 2

[0028] Switch 2: Source address: Host 2, Destination address: Host 6, Action: Change destination address to Host 5

[0029] Switch 2: Source address: Host 2, Destination address: Host 5, Action: Forward

[0030] Firewall: Source address: Host 1, Destination address: Host 5, Action: Deny communication

[0031] For the above flow rules, the flow rules in the flow table are represented as three sets: FTS = {host 1, host 2}, FTD = {host 5, host 6}, FTA = {forward, modify address}; where FTS represents the source address set of the flow rules in the flow table, FTD represents the destination address set of the flow rules in the flow table, and FTA represents the action set of the flow rules in the flow table.

[0032] Similarly, the firewall rules are also represented as three sets: FWS = {host 1}, FWD = {host 5}, FWA = {deny communication}; where FWS represents the firewall rule source address set, FWD represents the firewall rule destination address set, and FWA represents the firewall rule action field set.

[0033] S5-2: Based on the aggregated information of the flow rules in S5-1, make a preliminary judgment on whether an implicit conflict occurs, mainly based on the following:

[0034] 1) If FWS intersects FTS and is not empty, FWD intersects FTD and is not empty, and FWA intersects FTA and is empty, then an implicit conflict occurs.

[0035] 2) Except for the situations where conflicts are judged to occur as mentioned above, the remaining situations are judged to be non-conflicts.

[0036] Furthermore, the second-stage precise detection steps for implicit conflicts of flow rules in step S6 are as follows: first, the network topology G of the current network needs to be obtained. For each firewall rule fw, the forwarding path from the fw source host to the fw destination host is calculated based on G. Then, it is determined whether the data packet sent from the fw source host will be forwarded to the fw destination host through the indirect action of different switches. If it is sent to, it proves that there is an implicit conflict. If it is not sent to, there is no implicit conflict.

[0037] Furthermore, the flow rule conflict resolution step in step S7 is as follows:

[0038] S7-1. For static conflicts and implicit conflicts, the conflict resolution solution is to not issue the flow rules that cause the conflict.

[0039] S7-2. For dynamic conflicts, different solutions are made according to the conflict type. Suppose the rule to be issued is R1, its matching field is match1, and the conflicting flow rule in the flow table is R2, its matching field is match2.

[0040] A flow rule conflict detection system based on a prefix tree and a forwarding path for implementing the flow rule conflict detection method includes a static conflict detection unit, a dynamic conflict detection unit, an implicit conflict detection unit, and a flow rule conflict resolution unit. The static conflict detection unit is used to perform static conflict detection on intercepted flow rules to be issued; the dynamic conflict detection unit divides the flow rules in the flow table into different sets according to different protocol types, constructs a matching tree for each matching field of the flow rules in different sets, determines the relationship between the flow rules to be issued and the flow rules in the flow table based on the constructed matching tree, and then determines the conflict type of the flow rules based on the relationship between the flow rules and the action field; the implicit conflict detection unit includes a first-stage detection and a second-stage detection. The first-stage detection represents the source address, destination address, and action field of the flow rules and firewall rules in the flow table with a set according to the alias set algorithm, and preliminarily determines whether an implicit conflict occurs based on the set information. The second-stage detection performs conflict detection based on the actual forwarding path of the data packet; the flow rule conflict resolution unit is used to resolve flow rule conflicts.

[0041] Compared with the prior art, the present invention has the following beneficial effects: (1) a comprehensive conflict detection method. The existing solutions are all solutions for one of the three conflict types. The present invention provides a holistic and comprehensive conflict detection method for the three solutions; (2) efficient dynamic conflict detection. The present invention constructs a data structure of a prefix matching tree for protocol division by matching fields of flow rules in a flow table. While ensuring the detection accuracy, the time consumed by conflict detection is greatly shortened; (3) accurate implicit conflict detection. The present invention implements a two-stage detection method through an alias set method and a path-based detection method. The first stage preliminary detection is performed through the alias set method. If the alias set algorithm detects a conflict, the second stage detection is performed through a forwarding path-based detection method. Through the two-stage detection, the false alarm rate of the alias set method and the time consumption of the forwarding path-based method are effectively reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a schematic diagram of the operation flow of the present invention.

[0043] Figure 2 Schematic diagram of static conflict detection algorithm.

[0044] Figure 3 Schematic diagram of constructing a prefix tree.

[0045] Figure 4 A diagram showing the classification of flow rule conflict types.

[0046] Figure 5 Schematic diagram of the dynamic conflict detection algorithm.

[0047] Figure 6 Schematic diagram of implicit conflict detection algorithm.

[0048] Figure 7 Schematic diagram of the conflict resolution algorithm.

[0049] Figure 8 The figure is the experimental result. DETAILED DESCRIPTION

[0050] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0051] This paper analyzes the shortcomings of existing flow rule conflict detection technology by analyzing SDN, and designs a comprehensive flow rule conflict detection method. For dynamic conflicts, flow rules are matched by building a prefix tree divided by the protocol. For implicit conflicts, the alias set algorithm and the two-stage detection method based on the forwarding path are used to detect them. The specific process is as follows Figure 1 As shown, it mainly includes the following steps:

[0052] S1. According to the flow rule interception module, static conflict detection is performed on the flow rules to be issued. The matching fields of the flow rules to be issued will be detected to determine whether there are flow rules with incorrect syntax. The pseudo code is as follows: Figure 2 As shown; if there is a static conflict, go to S7 to resolve the conflict; if there is no static conflict, go to S2 to divide the flow rule protocol in the flow table.

[0053] Assume that the flow rule to be issued is f, and the main detection indicators are as follows:

[0054] 1) Whether the source IP address field of f and the destination IP address field of f are the same, and whether their values ​​are in the range of 0-255;

[0055] 2) Whether the source physical address field of f and the destination physical address field of f are the same, and whether their values ​​are between 0 and 0xffff;

[0056] 3) Whether the source port number field of f and the destination port number field of f are the same, and whether their values ​​are between 0 and 65535.

[0057] S2. Perform dynamic conflict detection on the flow rules that are detected to have no static conflict in S1, and divide the flow rules in the flow table into different sets according to different protocol types.

[0058] According to the types of protocols in the network traffic and their proportions, the present invention divides the flow rules into four sets, namely:

[0059] Set_Tcp, Set_Udp, Set_Oth, Set_WildCard

[0060] Set_Tcp indicates a set of flow rules whose protocol type is TCP, Set_Udp indicates a set of flow rules whose protocol type is UDP, Set_Oth indicates flow rules whose protocol types are other than TCP and UDP, and Set_WildCard indicates a set of flow rules whose protocol type is a wildcard.

[0061] S3. For each set, a matching tree is constructed for each matching field of the flow rules therein, mainly including the source IP address, destination IP address, source physical address, destination physical address, source port number, and destination port number. A prefix matching tree is constructed for each matching field of the flow rules in the four sets in the flow table. The information of some matching fields of the flow rules in the flow table is shown in Table 1.

[0062] Table 1: Partial matching field information of flow rules in the flow table

[0063] Flow Rules Source IP Destination IP 1 10.49.64.1 10.49.64.1 2 10.50.25.0 / 24 192.168.0.0 / 16 3 10.50.25.1 192.168.50.1 4 10.50.25.2 192.168.50.1 5 10.50.0.0 / 16 192.168.50.2 / 24 6 10.50.25.0 / 24 192.168.0.0 / 16 7 10.49.64.1 10.211.1.63 8 10.49.0.0 / 24 10.49.0.0 / 24 9 10.50.25.0 / 24 192.168.0.0 / 16 10 10.50.25.0 / 24 192.168.0.0 / 16

[0064] Taking the source IP field of the flow rule as an example, construct Figure 3 The prefix matching tree shown is constructed by building matching trees for all remaining fields according to the above construction method.

[0065] S4. Determine the relationship between the flow rules to be issued and the flow rules in the flow table based on the matching tree constructed in S3, and then determine the conflict type of the flow rules based on the relationship between the flow rules and the action field.

[0066] S4-1. To determine the dynamic conflict type of flow rules, we first need to determine the relationship between the matching fields of the two flow rules. Suppose there are two flow rules R1 and R2. The matching domain of R1 is match1 and the action field is action1. The matching field of R2 is match2 and the action field is action2. Based on the coverage relationship between match1 and match2, we determine whether they are equal, intersecting, containing, or unrelated. The relationship is as follows: Figure 4 As shown, the specific judgment method is:

[0067] 1) If each matching field of match1 and match2 is equal, then their relationship is called equal;

[0068] 2) If the intersection of each matching field of match1 and match2 is not empty, then their relationship is called intersection;

[0069] 3) If at least one matching field of match1 and match2 intersects and is empty, their relationship is called unrelated;

[0070] 4) If each matching field of match1 and match2 belongs to contain or is contained, then their relationship is called contain and be contained;

[0071] S4-2, based on the relationship between the flow rule matching fields determined in S4-1, and then based on the action fields action1 and action2, determine the relationship between flow rules R1 and R2, and whether the types are conflict, equal, redundant, masked, included, included, overlapped, or associated. After the conflict type determination is completed, if there is a dynamic conflict, go to S7 to resolve the corresponding dynamic conflict type. If there is no dynamic conflict, go to S5 to detect implicit conflicts. The specific determination pseudo code is as follows: Figure 4 、 Figure 5 The specific judgment basis is as follows:

[0072] 1) If the relationship between match1 and match2 is irrelevant, the conflict type between R1 and R2 is no conflict;

[0073] 2) If the relationship between match1 and match2 is equal, and the relationship between action1 and action2 is equal, then the conflict type of R1 and R2 is equal;

[0074] 3) If the relationship between match1 and match2 is containment or contained, and the relationship between action1 and action2 is equality, then the conflict type between R1 and R2 is redundancy;

[0075] 4) If the relationship between match1 and match2 is containment or contained, and the relationship between action1 and action2 is unequal, then the conflict type between R1 and R2 is masking;

[0076] 5) If the relationship between match1 and match2 is intersection, and the relationship between action1 and action2 is equality, then the conflict type between R1 and R2 is overlap;

[0077] 6) If the relationship between match1 and match2 is intersection, and the relationship between action1 and action2 is unequal, then the conflict type between R1 and R2 is association.

[0078] S5. For the flow rules detected in S4 that do not have dynamic conflicts, the first stage of implicit conflict detection is performed. The source address, destination address, and action fields of the flow rules and firewall rules in the flow table are represented by sets based on the alias set algorithm. Based on the set information, it is preliminarily determined whether an implicit conflict occurs.

[0079] S5-1. Flow rules and firewall rules are collectively represented. The simplified forms of flow rules and firewall rules are as follows:

[0080] Switch 1: Source address: Host 1, Destination address: Host 6, Action: Change source address to Host 2;

[0081] Switch 2: Source address: Host 2, Destination address: Host 6, Action: Change the destination address to Host 5;

[0082] Switch 2: Source address: Host 2, Destination address: Host 5, Action: Forward;

[0083] Firewall: Source address: Host 1, Destination address: Host 5, Action: Deny communication For the above flow rules, the flow rules in the flow table are represented as three sets:

[0084] FTS = {host 1, host 2}, FTD = {host 5, host 6}, FTA = {forwarding, modifying address}

[0085] Among them, FTS represents the source address set of flow rules in the flow table, FTD represents the destination address set of flow rules in the flow table, and FTA represents the action set of flow rules in the flow table.

[0086] Similarly, firewall rules are represented as three sets:

[0087] FWS={host 1}, FWD={host 5}, FWA={deny communication}, where FWS represents the firewall rule source address set, FWD represents the firewall rule destination address set, and FWA represents the firewall rule action field set.

[0088] S5-2: Based on the aggregated information of the flow rules in S5-1, make a preliminary judgment on whether an implicit conflict occurs, mainly based on the following:

[0089] 1) If the intersection of FWS and FTS is not empty, the intersection of FWD and FTD is not empty, and the intersection of FWA and FTA is empty, then it is determined that an implicit conflict occurs;

[0090] 2) Except for the situations where conflicts are judged to occur as mentioned above, the remaining situations are judged to be non-conflicts.

[0091] If it is preliminarily determined that no implicit conflict occurs, the flow rule is sent to the switch. If it is preliminarily determined that an implicit conflict occurs, the process goes to S6 for the second stage detection.

[0092] S6, perform the second phase of detection on implicit conflicts based on the results of S5. Accurate detection is achieved based on the actual forwarding path of the data packet. The specific algorithm is as follows: Figure 6 The pseudo code of the forwarding path-based detection algorithm is shown in the figure. The main judgment basis is as follows:

[0093] First, we need to obtain the network topology G of this network. For each firewall rule fw, we calculate the forwarding path from the source host fw to the destination host fw based on G. Then,

[0094] 1) For the first switch S1 on the forwarding path, check whether there is a flow rule f such that fsourcehost = fwsourcehost. If not, no conflict occurs. If so, construct a virtual packet p. If faction = forward, set the value of psourcehost to the value of fsourcehost and the value of pdestinationhost to the value of fdestinationhost. If faction = modify address, set the value of psourcehost to the value of fsourcehost and the value of pdestinationhost to the value after the modified address. Check the next-hop switch S2 for a flow rule that matches p.

[0095] 2) For the intermediate switch Si on the forwarding path, i belongs to [2, n-1]. When receiving the virtual data packet p forwarded by the previous switch, if no flow rule matches it, it is determined that there is no conflict. If f exists and f's action = forward, p is forwarded to the next-hop switch. If f's action = modify address, the source host value of p is set to the source host value of f, and the destination host value of p is set to the modified value. The next-hop switch Si+1 is checked to see if there is a flow rule matching p.

[0096] 3) For the last switch Sn on the forwarding path, when receiving the virtual data packet p forwarded by the previous switch, if there is no matching flow rule or there is a matching flow rule f, where the destination host value of f = the destination host value of fw, then it is determined that there is no conflict. If there is f, where the source host value of f = the source host value of p, the destination host value of f = the destination host value of p = the destination host value of fw, and the action is forwarding, then it is determined that there is an implicit conflict between the existing flow rule and the firewall rule.

[0097] S7. Resolve the conflicts that occurred in the above steps S1, S4, and S6 to eliminate potential safety hazards caused by flow rule conflicts.

[0098] S7-1. For static conflicts and implicit conflicts, the conflict resolution solution is to not issue the flow rules that cause the conflict.

[0099] S7-2. For dynamic conflicts, different solutions are made according to the conflict type. Suppose the rule to be issued is R1, its matching field is match1, and the conflicting flow rule in the flow table is R2, its matching field is match2. The specific conflict resolution logic is as follows: Figure 7 As shown, the main basis for judgment is:

[0100] 1) If the conflict type is equal, R1 is discarded;

[0101] 2) If the conflict type is redundancy and match1 contains match2, then R2 is deleted from the flow table and R1 is issued;

[0102] 3) If the conflict type is redundancy and match2 contains match1, R1 is discarded;

[0103] 4) If the conflict type is masking and match1 contains match2, then match1 = match1 - match2, and R1 is issued;

[0104] 5) If the conflict type is masking and match2 contains match1, then match2 = match2 - match1, and R1 is issued;

[0105] 6) If the conflict type is overlap, match2 = match2 + match1;

[0106] 7) If the conflict type is association, match1 = match1 - match2, and R1 is issued.

[0107] S8. Experimental Analysis

[0108] In order to evaluate the performance of the proposed conflict detection method, the experimental platform is a 4-core 12th Gen Core TM Verification was performed using an Ubuntu 20.04 LTS host with an i7-12700 CPU and 6GB of memory, and a mininet network for network simulation. Figure 8 The following is a time comparison chart of the alias set algorithm, the path detection algorithm, and the two-stage detection method proposed in this invention. It reduces the time overhead by about 40%-50% under different conflict types and improves the accuracy of implicit conflict detection by about 41%. It can be seen that the path-based two-stage detection method has achieved excellent results in both accuracy and time consumption. While ensuring that all possible conflict situations are detected, the present invention improves the accuracy of detection and reduces the time consumption of conflict detection, providing an effective solution for flow rule conflict detection and conflict resolution in SDN software-defined networks.

[0109] The present invention proposes an explicit conflict detection algorithm based on a prefix tree, and a two-stage implicit conflict detection algorithm combining path analysis and alias sets. These methods aim to improve the efficiency and accuracy of detection, especially when dealing with implicit conflicts, they can effectively reduce the false alarm rate and optimize the management and application of flow rules. Specifically: Explicit conflict detection algorithm: By dividing the protocol types of flow rules and constructing a prefix matching tree, the matching speed is accelerated. Experiments show that the detection time is significantly reduced compared with traditional methods. Implicit conflict detection algorithm: Combining the low false alarm rate of path analysis and the high efficiency advantages of the alias set method, it reduces the common false alarm problems in complex network environments and improves the accuracy of conflict detection. These new methods provide an efficient and comprehensive solution for flow rule conflict detection in SDN networks, which helps to further improve the security and reliability of SDN networks.

[0110] This embodiment also provides a flow rule conflict detection system based on a prefix tree and a forwarding path, comprising a static conflict detection unit, a dynamic conflict detection unit, an implicit conflict detection unit and a flow rule conflict resolution unit, wherein the static conflict detection unit is used to perform static conflict detection on the intercepted flow rules to be issued; the dynamic conflict detection unit divides the flow rules in the flow table into different sets according to different protocol types, constructs a matching tree for each matching field of the flow rules in different sets, determines the relationship between the flow rules to be issued and the flow rules in the flow table based on the constructed matching tree, and then determines the conflict type of the flow rules based on the relationship between the flow rules and the action field; the implicit conflict detection unit includes a first-stage detection and a second-stage detection, wherein the first-stage detection represents the source address, destination address, and action field of the flow rules and firewall rules in the flow table with a set based on the alias set algorithm, and preliminarily determines whether an implicit conflict occurs based on the set information, and the second-stage detection performs conflict detection based on the actual forwarding path of the data packet; the flow rule conflict resolution unit is used to resolve flow rule conflicts.

[0111] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0112] Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if such changes and modifications of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A flow rule conflict detection method based on prefix tree and forwarding path, characterized in that: The steps include: S1. Perform static conflict detection on the intercepted flow rules to be issued. If a static conflict exists, proceed to S7 for conflict resolution. If no static conflict exists, proceed to S2. S2. Perform dynamic conflict detection on the flow rules that are detected as not statically conflicting in S1, and divide the flow rules in the flow table into different sets according to different protocol types; S3. For each set divided in S2, a matching tree is constructed for each matching field of the flow rule therein; S4. Determine the relationship between the flow rule to be issued and the flow rules in the flow table based on the matching tree constructed in S3. Then, determine the conflict type of the flow rules based on the relationship between the flow rules and the action field. After the conflict type is determined, if there is a dynamic conflict, go to S7 to resolve the corresponding dynamic conflict type; if there is no dynamic conflict, go to S5; S5. For the flow rules detected in S4 that do not have dynamic conflicts, a first-stage implicit conflict detection is performed. The source address, destination address, and action fields of the flow rules and firewall rules in the flow table are represented by a set according to the alias set algorithm. A preliminary judgment is made based on the set information whether an implicit conflict occurs. If it is preliminarily determined that no implicit conflict occurs, the flow rule is sent to the switch. If it is preliminarily determined that an implicit conflict occurs, the process proceeds to S6. The first-stage implicit conflict detection in step S5 specifically includes: S5-1, the flow rules and firewall rules are collectively represented, each including a source address set, an action set, and a destination address set; the step 5-1 specifically includes: The flow rules and firewall rules are expressed as follows: Switch 1: Source address: Host 1, Destination address: Host 6, Action: Change source address to Host 2; Switch 2: Source address: Host 2, Destination address: Host 6, Action: Change the destination address to Host 5; Switch 2: Source address: Host 2, Destination address: Host 5, Action: Forward; Firewall: Source address: Host 1, Destination address: Host 5, Action: Deny communication; Based on the flow rule form, the flow rules in the flow table are represented as three sets: FTS = {host 1, host 2}, FTD = {host 5, host 6}, FTA = {forward, modify address}; Firewall rules are represented as three sets: FWS = {host 1}, FWD = {host 5}, FWA = {communication denied}; S5-2. Based on the aggregated representation of the flow rules in S5-1, a preliminary judgment is made on whether an implicit conflict occurs: if FWS intersects FTS and is not empty, FWD intersects FTD and is not empty, and FWA intersects FTA and is empty, an implicit conflict is determined to have occurred. FTS represents the source address set of the flow rules in the flow table, FTD represents the destination address set of the flow rules in the flow table, FTA represents the action set of the flow rules in the flow table, FWS represents the source address set of the firewall rules, FWD represents the destination address set of the firewall rules, and FWA represents the action field set of the firewall rules. S6: Perform the second phase of implicit conflict detection. Conflict detection is performed based on the actual forwarding path of the data packet. If an implicit conflict occurs, proceed to S7 for conflict resolution. If no implicit conflict occurs, flow rules are issued. The second phase of implicit conflict detection in step S6 is specifically as follows: Step S6-1: First, obtain the network topology G of the current network. For each firewall rule fw, calculate the forwarding path from the source host fw to the destination host fw based on G. Step S6-2: Determine whether the data packet sent from the source host of the firewall will be forwarded to the destination host of the firewall through the indirect action of different switches. If it is forwarded to the destination host of the firewall, then there is an implicit conflict; if it is not forwarded to the destination host of the firewall, then there is no implicit conflict. S7. Resolve flow rule conflicts and eliminate potential safety hazards caused by flow rule conflicts.

2. The flow rule conflict detection method based on prefix tree and forwarding path according to claim 1, characterized in that: The indicators for static conflict detection in step S1 specifically include: 1) Whether the source IP address field of flow rule f and the destination IP address field of f are the same, and whether their values ​​are in the range of 0-255; 2) Whether the source physical address field of flow rule f and the destination physical address field of f are the same, and whether their values ​​are in the range of 0 to 0xffff; 3) Whether the source port number field of flow rule f and the destination port number field of f are the same, and whether their values ​​are in the range of 0 to 65535.

3. The flow rule conflict detection method based on prefix tree and forwarding path according to claim 1, characterized in that: The flow rules in step S2 are divided into four sets, including Set_Tcp, Set_Udp, Set_Oth and Set_WildCard; Set_Tcp represents the flow rule set whose protocol type is TCP, Set_Udp represents the flow rule set whose protocol type is UDP, Set_Oth represents the flow rules whose protocol types are other than TCP and UDP, and Set_WildCard represents the flow rule set whose protocol type is wildcard.

4. The flow rule conflict detection method based on prefix tree and forwarding path according to claim 1, characterized in that: Determining the relationship between the flow rules to be issued and the flow rules in the flow table in step S4 specifically includes: S4-1: Determine the relationship between the matching fields of two flow rules. Suppose there are two flow rules, R1 and R2. R1's matching domain is match1 and its action field is action1. R2's matching field is match2 and its action field is action2. Based on the covering relationship between match1 and match2, determine whether they are equal, intersecting, containing, or unrelated. S4-2. Determine the relationship between flow rules R1 and R2 based on the action fields action1 and action2, including non-conflict, equality, redundancy, masking, inclusion, inclusion, overlap, and association.

5. The flow rule conflict detection method based on prefix tree and forwarding path according to claim 1, characterized in that: The step S6-2 specifically includes: 1) For the first switch S1 on the forwarding path, check whether there is a flow rule f such that fsourcehost = fwsourcehost. If not, no conflict occurs. If so, construct a virtual packet p. If faction = forward, set the value of psourcehost to the value of fsourcehost and the value of pdestinationhost to the value of fdestinationhost. If faction = modify address, set the value of psourcehost to the value of fsourcehost and the value of pdestinationhost to the value after the modified address. Check whether there is a flow rule matching p in the next-hop switch S2. 2) For the intermediate switch Si on the forwarding path, i belongs to [2, n-1]. When receiving the virtual data packet p forwarded by the previous switch, if no flow rule matches it, it is determined that there is no conflict. If f exists and f's action = forward, p is forwarded to the next-hop switch. If f's action = modify address, the source host value of p is set to the source host value of f, and the destination host value of p is set to the modified value. The next-hop switch Si+1 is checked to see if there is a flow rule matching p. 3) For the last switch Sn on the forwarding path, when receiving the virtual data packet p forwarded by the previous switch, if no flow rule matches it or if there is a matching flow rule f, where the destination host value of f = the destination host value of fw, then it is determined that there is no conflict. If there is f, where the source host value of f = the source host value of p, the destination host value of f = the destination host value of p = the destination host value of fw, and the action is forwarding, then it is determined that there is an implicit conflict between the existing flow rule and the firewall rule.

6. The flow rule conflict detection method based on prefix tree and forwarding path according to claim 1, characterized in that: The flow rule conflict resolution in step S7 is specifically as follows: S7-1: For static and implicit conflicts, the flow rules that cause the conflict are not issued. S7-2. For dynamic conflicts, resolve them based on the conflict type. For the rule R1 to be issued, its matching domain is match1. For the conflicting flow rule R2 in the flow table, its matching domain is match2. The specific resolution method is as follows: 1) If the conflict type is equal, R1 is discarded; 2) If the conflict type is redundancy and match1 contains match2, then R2 is deleted from the flow table and R1 is issued; 3) If the conflict type is redundancy and match2 contains match1, R1 is discarded; 4) If the conflict type is masking and match1 contains match2, then match1 = match1 - match2, and R1 is issued; 5) If the conflict type is masking and match2 contains match1, then match2 = match2 - match1, and R1 is issued; 6) If the conflict type is overlap, match2 = match2 + match1; 7) If the conflict type is association, match1 = match1 - match2, and R1 is issued.

7. A flow rule conflict detection system based on prefix tree and forwarding path for implementing the flow rule conflict detection method according to any one of claims 1 to 6, characterized in that: It includes a static conflict detection unit, a dynamic conflict detection unit, an implicit conflict detection unit and a flow rule conflict resolution unit. The static conflict detection unit is used to perform static conflict detection on the intercepted flow rules to be issued; The dynamic conflict detection unit divides the flow rules in the flow table into different sets according to different protocol types, constructs a matching tree for each matching field of the flow rules in the different sets, determines the relationship between the flow rules to be issued and the flow rules in the flow table based on the constructed matching tree, and then determines the conflict type of the flow rules based on the relationship between the flow rules and the action field; The implicit conflict detection unit includes a first-stage detection and a second-stage detection. The first-stage detection represents the source address, destination address, and action fields of the flow rules and firewall rules in the flow table as a set based on the alias set algorithm, and preliminarily determines whether an implicit conflict occurs based on the set information. The second-stage detection performs conflict detection based on the actual forwarding path of the data packet; the flow rule conflict resolution unit is used to resolve flow rule conflicts.

Images