SAVA-based IP governance method suitable for cloud native system

Abstract

The invention discloses an SAVA-based IP management method suitable for a cloud native system, which belongs to the technical field of network security, and is characterized by comprising the following steps: S1, virtualizing SAVA equipment, and abstracting the function of the SAVA equipment into the capability in the cloud native system; s2, combining the capability linkage into a micro-service chain; s3, in a false source identification stage of source address identification, identifying a false source address; s4, in a real source identification stage of source address identification, abstracting an existing real source identification function into a capability, and carrying out real source identification; s5, in a black and white list generation stage, generating an IP address black and white list according to the information identified by the source address; s6, the cloud native system blocks the IP address in the blacklist according to the generated IP address blacklist and the generated IP address whitelist; and S7, finally performing information sharing. According to the invention, restriction of an existing network structure can be broken through, IP address governance based on SAVA is realized in the cloud native system, and efficiency and flexibility are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a SAVA-based IP governance method suitable for a cloud native system. Background Art

[0002] DDoS attack is a distributed denial of service attack. DDoS attack is one of the most important means of attack in current network attacks. Its characteristic is that DDoS attack can quickly exhaust the resources of the target system through a large number of requests, causing it to be unable to provide services normally. This type of attack may cause economic losses and reputation damage to enterprises, organizations or individuals. With the popularization of the Internet and the increase in the connection of various devices, the scale and frequency of DDoS attacks are also growing, bringing greater challenges to network security.

[0003] Cloud-network integration refers to the combination of cloud computing and communication networks, which fully utilizes the respective advantages of cloud computing and networks. Cloud computing can dynamically adjust resources according to demand, while the network achieves fast data transmission and wider coverage, with high flexibility and elasticity. Cloud-network integration development deploys supercomputing power to the user end, realizes cloud-edge integration, and achieves full network coverage through central cloud and edge cloud, bringing cloud-network capabilities to the extreme.

[0004] Cloud native aims to use cloud computing, containerization and microservice technologies to build highly flexible and easy-to-manage applications and give full play to the potential of cloud computing. Cloud native can deploy applications according to demand, flexibly combine and link applications, perform automated management, realize flexible deployment of network functions, and improve the response speed and efficiency of applications.

[0005] Cloud-network integration provides flexible and sufficient basic conditions for various cloud-native businesses. Based on cloud-native, with the help of software-based concepts, it breaks through the constraints of the existing network structure, realizes the flexible combination and linkage of system functions, and has the characteristics of deployment, orchestration, expansion and update, solving the problems of rigid deployment and high cost of traditional hardware.

[0006] SAVA is a source address verification mechanism that can be deployed at different levels to implement strict false source address verification to eliminate false source DDoS attacks in the network. Specifically, SAVA can be deployed at three levels: access network, within autonomous system, and between autonomous systems to implement source address verification. Among the many current source address verification frameworks, SAVA can perform IP governance from the source.

[0007] IP governance refers to the activities of managing and supervising IP addresses on the Internet, which involves the allocation principles and usage specifications of IP addresses. It is usually jointly participated by international organizations, government agencies, network service providers and other stakeholders to ensure the fair and just allocation of address resources. Once the use of IP addresses for network attacks is discovered, governance is carried out through various means to ensure the stable and healthy development of the Internet.

[0008] Traditional IP governance methods include source address tracing based on various source address verification frameworks. However, due to the rigidity of the current network structure, SAVA devices are difficult to deploy in large numbers in the network, resulting in low IP governance efficiency, lack of flexibility and elasticity, and further leading to the problem of inability to deploy on demand.

[0009] A Chinese patent document with publication number CN114640610A and publication date June 17, 2022 discloses a cloud-native service governance method, device and storage medium, including: receiving service information from a service provider, and generating a registration list based on the service information, a cloud-native microservice platform is used to implement service registration and service discovery; responding to a service call request sent by a service consumer, retrieving a service list according to the registration list, and creating a service call connection between the service consumer and the target service provider in the service list to enable the service consumer to quickly call the target service provider remotely; building local native executable code for service providers and service consumers, and deploying and running the local native executable code on the cloud-native microservice platform to achieve rapid dynamic elastic scaling of the cloud-native microservice platform, improve resource utilization, and save costs.

[0010] The cloud-native service governance method, device and storage medium disclosed in the patent document reduce the third-party dependency and middleware deployment through cloud-native service registration discovery, use the existing service discovery method, and reduce the additional deployment of other service discovery components. However, there are still problems such as low IP governance efficiency and lack of flexibility. Summary of the invention

[0011] In order to overcome the defects of the above-mentioned prior art, the present invention provides a SAVA-based IP governance method suitable for cloud native systems. The present invention is based on cloud native systems and, with the help of software concepts, abstracts traditional SAVA devices into capabilities in cloud native systems. It can break through the constraints of existing network structures and realize SAVA-based IP address governance in cloud native systems, thereby improving efficiency and flexibility.

[0012] The present invention is achieved through the following technical solutions: A SAVA-based IP governance method applicable to a cloud native system, characterized by comprising the following steps: S1. Virtualize the SAVA device and abstract the functions of the SAVA device into capabilities in the cloud native system. S2, then combine the capabilities into a microservice chain; S3, in the false source identification stage of source address identification, identifying the false source address; S4. In the real source identification stage of source address identification, the existing real source identification function is abstracted into a capability to perform real source identification; S5. In the blacklist and whitelist generation phase, an IP address blacklist and whitelist is generated based on the source address identification intelligence; S6. In the IP address blocking stage, the cloud native system blocks the blacklisted IP addresses based on the generated IP address blacklist and whitelist; S7. Finally, intelligence sharing is carried out.

[0013] In step S1, abstracting the functions of the SAVA device into capabilities in the cloud native system means abstracting the SAVA source address verification function, black and white list generation function and alarm push function into SAVA source address verification capability, black and white list generation capability and alarm push capability respectively.

[0014] In step S2, linking and combining capabilities into a microservice chain refers to linking and combining the SAVA source address verification capability, the blacklist and whitelist generation capability, and the alarm push capability into a microservice chain.

[0015] In step S3, identifying the false source address means that the cloud native system perceives the user demand through the control center and sends the user demand to the cloud native system. According to the user demand, the microservice chain verifies the IP address of the traffic, identifies the false source address contained in the traffic, and generates a black and white list.

[0016] In step S4, abstracting the existing real source identification function into a capability means abstracting the tracing function and the detection function into the corresponding tracing capability and detection capability in the cloud native system respectively; performing real source identification means that the cloud native system perceives user needs through the control center, identifies the real source address of the attack traffic in the network, and coordinates with the false source identification to share the intelligence with the black and white list generation capability.

[0017] In step S5, generating an IP address blacklist and whitelist means abstracting the identification function and intelligence collection function into corresponding identification capabilities and intelligence collection capabilities under the unified control of the cloud native control center and the SAVA control center, and deploying them to the cloud server, and generating an IP address blacklist and whitelist based on the intelligence information shared in the source address identification stage.

[0018] In step S6, blocking the blacklisted IP address means abstracting the identification function and the analysis function into the corresponding identification capability and analysis capability in the cloud native system, and deploying them to the cloud server. Under the unified control of the cloud native control center and the SAVA control center, the capabilities are combined and linked into an IP address blocking capability, and the IP address blacklist and whitelist generated by the coordinated source address identification are used to identify new traffic. If the IP address of the new traffic is on the blacklist, it is blocked.

[0019] In step S7, intelligence sharing includes direct sharing and indirect sharing.

[0020] Direct sharing refers to the sharing and transmission of various intelligence of the cloud native system under the control of the control center through the microservice chain connecting various capabilities.

[0021] The indirect sharing refers to connecting various capabilities in the cloud native system through microservice chains under the unified control of the cloud native control center and the SAVA control center to form intelligence sharing capabilities, and intelligence sharing is carried out through intelligence sharing capabilities.

[0022] The capability described in the present invention refers to a virtualized component abstracted from a traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, implements the network function in a virtualized environment through network programming, uses a management and orchestration system to configure, manage and optimize the virtual network function, and deploys it in a container at any location on the physical network in the cloud native system.

[0023] The beneficial effects of the present invention are mainly manifested in the following aspects: 1. The present invention, S1, virtualizes the SAVA device, and abstracts the function of the SAVA device into the capability in the cloud native system; S2, and then combines the capabilities into a microservice chain; S3, in the false source identification stage of source address identification, identifies the false source address; S4, in the real source identification stage of source address identification, abstracts the existing real source identification function into a capability, and performs real source identification; S5, in the blacklist and whitelist generation stage, generates an IP address blacklist and whitelist according to the intelligence of source address identification; S6, in the IP address blocking stage, the cloud native system blocks the blacklisted IP address according to the generated IP address blacklist and whitelist; S7, and finally shares intelligence. Compared with the existing technology, based on the cloud native system, with the help of software concept, the traditional SAVA device is abstracted into the capability of the cloud native system, which can break through the constraints of the existing network structure, realize SAVA-based IP address governance in the cloud native system, and improve efficiency and flexibility.

[0024] 2. In order to solve the problem that SAVA devices are difficult to flexibly deploy in current networks, the present invention uses the concept of software to abstract the functions of SAVA devices into capabilities in cloud-native systems, which can then be deployed on demand, thereby improving flexibility.

[0025] 3. In view of the high deployment cost of SAVA devices in the current network, the present invention effectively reduces the deployment cost by deploying the functions of SAVA devices in the cloud native system.

[0026] 4. In view of the difficulty in managing false source addresses in the current network, the present invention introduces the function of the SAVA device to verify the source address, thereby improving the efficiency of managing false source addresses. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments: Figure 1 It is a flowchart of the present invention. DETAILED DESCRIPTION

[0028] Example 1 See also Figure 1 , a SAVA-based IP governance method suitable for cloud native systems, including the following steps: S1. Virtualize the SAVA device and abstract the functions of the SAVA device into capabilities in the cloud native system. S2, then combine the capabilities into a microservice chain; S3, in the false source identification stage of source address identification, identifying the false source address; S4. In the real source identification stage of source address identification, the existing real source identification function is abstracted into a capability to perform real source identification; S5. In the blacklist and whitelist generation phase, an IP address blacklist and whitelist is generated based on the source address identification intelligence; S6. In the IP address blocking stage, the cloud native system blocks the blacklisted IP addresses based on the generated IP address blacklist and whitelist; S7. Finally, intelligence sharing is carried out.

[0029] This embodiment is the most basic implementation method, S1. Virtualize the SAVA device and abstract the functions of the SAVA device into capabilities in the cloud native system; S2. Then link and combine the capabilities into a microservice chain; S3. In the false source identification stage of source address identification, identify the false source address; S4. In the real source identification stage of source address identification, abstract the existing real source identification function into a capability to perform real source identification; S5. In the blacklist and whitelist generation stage, generate an IP address blacklist and whitelist based on the intelligence of source address identification; S6. In the IP address blocking stage, the cloud native system blocks the blacklisted IP addresses based on the generated IP address blacklist and whitelist; S7. Finally, share intelligence. Compared with the existing technology, based on the cloud native system, with the help of software concepts, the traditional SAVA device is abstracted into the capabilities of the cloud native system, which can break through the constraints of the existing network structure, realize SAVA-based IP address governance in the cloud native system, and improve efficiency and flexibility.

[0030] Example 2 See also Figure 1 , a SAVA-based IP governance method suitable for cloud native systems, including the following steps: S1. Virtualize the SAVA device and abstract the functions of the SAVA device into capabilities in the cloud native system. S2, then combine the capabilities into a microservice chain; S3, in the false source identification stage of source address identification, identifying the false source address; S4. In the real source identification stage of source address identification, the existing real source identification function is abstracted into a capability to perform real source identification; S5. In the blacklist and whitelist generation phase, an IP address blacklist and whitelist is generated based on the source address identification intelligence; S6. In the IP address blocking stage, the cloud native system blocks the blacklisted IP addresses based on the generated IP address blacklist and whitelist; S7. Finally, intelligence sharing is carried out.

[0031] Preferably, in step S1, abstracting the functions of the SAVA device into capabilities in the cloud native system means abstracting the SAVA source address verification function, black and white list generation function and alarm push function into SAVA source address verification capability, black and white list generation capability and alarm push capability respectively.

[0032] In step S2, linking and combining capabilities into a microservice chain refers to linking and combining the SAVA source address verification capability, the blacklist and whitelist generation capability, and the alarm push capability into a microservice chain.

[0033] In step S3, identifying the false source address means that the cloud native system perceives the user demand through the control center and sends the user demand to the cloud native system. According to the user demand, the microservice chain verifies the IP address of the traffic, identifies the false source address contained in the traffic, and generates a black and white list.

[0034] This embodiment is a preferred implementation method. In response to the problem that SAVA devices are difficult to flexibly deploy in the current network, with the help of software concepts, the functions of SAVA devices are abstracted into capabilities in the cloud-native system, which can then be deployed on demand, thereby improving flexibility.

[0035] Example 3 See also Figure 1 , a SAVA-based IP governance method suitable for cloud native systems, including the following steps: S1. Virtualize the SAVA device and abstract the functions of the SAVA device into capabilities in the cloud native system. S2, then combine the capabilities into a microservice chain; S3, in the false source identification stage of source address identification, identifying the false source address; S4. In the real source identification stage of source address identification, the existing real source identification function is abstracted into a capability to perform real source identification; S5. In the blacklist and whitelist generation phase, an IP address blacklist and whitelist is generated based on the source address identification intelligence; S6. In the IP address blocking stage, the cloud native system blocks the blacklisted IP addresses based on the generated IP address blacklist and whitelist; S7. Finally, intelligence sharing is carried out.

[0036] In step S1, abstracting the functions of the SAVA device into capabilities in the cloud native system means abstracting the SAVA source address verification function, black and white list generation function and alarm push function into SAVA source address verification capability, black and white list generation capability and alarm push capability respectively.

[0037] In step S2, linking and combining capabilities into a microservice chain refers to linking and combining the SAVA source address verification capability, the blacklist and whitelist generation capability, and the alarm push capability into a microservice chain.

[0038] In step S3, identifying the false source address means that the cloud native system perceives the user demand through the control center and sends the user demand to the cloud native system. According to the user demand, the microservice chain verifies the IP address of the traffic, identifies the false source address contained in the traffic, and generates a black and white list.

[0039] Further preferably, in step S4, abstracting the existing real source identification function into a capability means abstracting the tracing function and the detection function into the corresponding tracing capability and detection capability in the cloud native system respectively; performing real source identification means that the cloud native system perceives user needs through the control center, identifies the real source address of the attack traffic in the network, and coordinates with the false source identification to share the intelligence with the black and white list generation capability.

[0040] In step S5, generating an IP address blacklist and whitelist means abstracting the identification function and intelligence collection function into corresponding identification capabilities and intelligence collection capabilities under the unified control of the cloud native control center and the SAVA control center, and deploying them to the cloud server, and generating an IP address blacklist and whitelist based on the intelligence information shared in the source address identification stage.

[0041] In step S6, blocking the blacklisted IP address means abstracting the identification function and the analysis function into the corresponding identification capability and analysis capability in the cloud native system, and deploying them to the cloud server. Under the unified control of the cloud native control center and the SAVA control center, the capabilities are combined and linked into an IP address blocking capability, and the IP address blacklist and whitelist generated by the coordinated source address identification are used to identify new traffic. If the IP address of the new traffic is on the blacklist, it is blocked.

[0042] This embodiment is another preferred implementation method. To address the high deployment cost of SAVA devices in current networks, the deployment cost is effectively reduced by deploying the functions of SAVA devices in a cloud-native system.

[0043] Example 4 See also Figure 1 , a SAVA-based IP governance method suitable for cloud native systems, including the following steps: S1. Virtualize the SAVA device and abstract the functions of the SAVA device into capabilities in the cloud native system. S2, then combine the capabilities into a microservice chain; S3, in the false source identification stage of source address identification, identifying the false source address; S4. In the real source identification stage of source address identification, the existing real source identification function is abstracted into a capability to perform real source identification; S5. In the blacklist and whitelist generation phase, an IP address blacklist and whitelist is generated based on the source address identification intelligence; S6. In the IP address blocking stage, the cloud native system blocks the blacklisted IP addresses based on the generated IP address blacklist and whitelist; S7. Finally, intelligence sharing is carried out.

[0044] In step S1, abstracting the functions of the SAVA device into capabilities in the cloud native system means abstracting the SAVA source address verification function, black and white list generation function and alarm push function into SAVA source address verification capability, black and white list generation capability and alarm push capability respectively.

[0045] In step S2, linking and combining capabilities into a microservice chain refers to linking and combining the SAVA source address verification capability, the blacklist and whitelist generation capability, and the alarm push capability into a microservice chain.

[0046] In step S3, identifying the false source address means that the cloud native system perceives the user demand through the control center and sends the user demand to the cloud native system. According to the user demand, the microservice chain verifies the IP address of the traffic, identifies the false source address contained in the traffic, and generates a black and white list.

[0047] In step S4, abstracting the existing real source identification function into a capability means abstracting the tracing function and the detection function into the corresponding tracing capability and detection capability in the cloud native system respectively; performing real source identification means that the cloud native system perceives user needs through the control center, identifies the real source address of the attack traffic in the network, and coordinates with the false source identification to share the intelligence with the black and white list generation capability.

[0048] In step S5, generating an IP address blacklist and whitelist means abstracting the identification function and intelligence collection function into corresponding identification capabilities and intelligence collection capabilities under the unified control of the cloud native control center and the SAVA control center, and deploying them to the cloud server, and generating an IP address blacklist and whitelist based on the intelligence information shared in the source address identification stage.

[0049] Further preferably, in step S6, blocking the blacklisted IP address means abstracting the identification function and the analysis function into corresponding identification capability and analysis capability in the cloud native system, and deploying them to the cloud server. Under the unified control of the cloud native control center and the SAVA control center, the capabilities are combined and linked into an IP address blocking capability, and the IP address blacklist and whitelist generated by the coordinated source address identification are used to identify new traffic. If the IP address of the new traffic is on the blacklist, it is blocked.

[0050] In step S7, intelligence sharing includes direct sharing and indirect sharing.

[0051] Direct sharing refers to the sharing and transmission of various intelligence of the cloud native system under the control of the control center through the microservice chain connecting various capabilities.

[0052] The indirect sharing refers to connecting various capabilities in the cloud native system through microservice chains under the unified control of the cloud native control center and the SAVA control center to form intelligence sharing capabilities, and intelligence sharing is carried out through intelligence sharing capabilities.

[0053] This embodiment is the best implementation method. To address the difficulty in managing false source addresses in the current network, the function of the SAVA device is introduced to verify the source address, thereby improving the efficiency of managing false source addresses.

[0054] The basic principles of the present invention are as follows: The functions of SAVA devices and IP address management functions are abstracted into capabilities in the cloud native system, and under the unified control of the cloud native system control center and the SAVA control center, the SAVA-based IP address management function is implemented in the cloud native system. The entire management process includes three stages, namely source address identification, forming blacklists and whitelists, and IP blocking. Source address identification includes false source identification and real source identification. It also has the ability to share intelligence, which is divided into direct sharing and indirect sharing.

[0055] Compared with existing technologies, SAVA-based IP governance can break through the constraints of existing network structures and implement SAVA-based IP address governance in cloud-native systems, improving efficiency and flexibility.

[0056] The capability refers to the virtualized components abstracted from traditional anti-DDoS functions, which decouple traditional anti-DDoS functions from hardware, implement network functions in a virtualized environment through network programming, and use management and orchestration systems such as MANO to configure, manage and optimize virtual network functions, which are deployed in containers at any location on the physical network in the cloud native system.

[0057] MANO refers to a unified framework for managing various virtual network functions and basic network virtualization architecture, which is used for business orchestration and device management.

Claims

1. A SAVA-based IP governance method applicable to cloud native systems, characterized in that: The following steps are involved: S1. Virtualize the SAVA device and abstract the functions of the SAVA device into capabilities in the cloud native system. S2, then combine the capabilities into a microservice chain; S3, in the false source identification stage of source address identification, identifying the false source address; S4. In the real source identification stage of source address identification, the existing real source identification function is abstracted into a capability to perform real source identification; S5. In the blacklist and whitelist generation phase, an IP address blacklist and whitelist is generated based on the source address identification intelligence; S6. In the IP address blocking stage, the cloud native system blocks the blacklisted IP addresses based on the generated IP address blacklist and whitelist; S7. Finally, intelligence sharing is carried out.

2. According to claim 1, a SAVA-based IP governance method applicable to a cloud native system is characterized in that: In step S1, abstracting the functions of the SAVA device into capabilities in the cloud native system means abstracting the SAVA source address verification function, black and white list generation function and alarm push function into SAVA source address verification capability, black and white list generation capability and alarm push capability respectively.

3. According to claim 1, a SAVA-based IP governance method applicable to a cloud native system is characterized in that: In step S2, linking and combining capabilities into a microservice chain refers to linking and combining the SAVA source address verification capability, the blacklist and whitelist generation capability, and the alarm push capability into a microservice chain.

4. According to claim 1, a SAVA-based IP governance method applicable to a cloud native system is characterized in that: In step S3, identifying the false source address means that the cloud native system perceives the user demand through the control center and sends the user demand to the cloud native system. According to the user demand, the microservice chain verifies the IP address of the traffic, identifies the false source address contained in the traffic, and generates a black and white list.

5. According to claim 1, a SAVA-based IP governance method applicable to a cloud native system is characterized in that: In step S4, abstracting the existing real source identification function into a capability means abstracting the tracing function and the detection function into the corresponding tracing capability and detection capability in the cloud native system respectively; performing real source identification means that the cloud native system perceives user needs through the control center, identifies the real source address of the attack traffic in the network, and coordinates with the false source identification to share the intelligence with the black and white list generation capability.

6. The SAVA-based IP governance method applicable to a cloud native system according to claim 1, characterized in that: In step S5, generating an IP address blacklist and whitelist means abstracting the identification function and intelligence collection function into corresponding identification capabilities and intelligence collection capabilities under the unified control of the cloud native control center and the SAVA control center, and deploying them to the cloud server, and generating an IP address blacklist and whitelist based on the intelligence information shared in the source address identification stage.

7. The SAVA-based IP governance method applicable to a cloud native system according to claim 1, characterized in that: In step S6, blocking the blacklisted IP address means abstracting the identification function and the analysis function into the corresponding identification capability and analysis capability in the cloud native system, and deploying them to the cloud server. Under the unified control of the cloud native control center and the SAVA control center, the capabilities are combined and linked into an IP address blocking capability, and the IP address blacklist and whitelist generated by the coordinated source address identification are used to identify new traffic. If the IP address of the new traffic is on the blacklist, it is blocked.

8. The SAVA-based IP governance method applicable to a cloud native system according to claim 7, characterized in that: In step S7, intelligence sharing includes direct sharing and indirect sharing.

9. A SAVA-based IP governance method applicable to a cloud native system according to claim 8, characterized in that: Direct sharing refers to the sharing and transmission of various intelligence of the cloud native system under the control of the control center through the microservice chain connecting various capabilities.

10. The SAVA-based IP governance method applicable to a cloud native system according to claim 8, characterized in that: The indirect sharing refers to connecting various capabilities in the cloud native system through microservice chains under the unified control of the cloud native control center and the SAVA control center to form intelligence sharing capabilities, and intelligence sharing is carried out through intelligence sharing capabilities.

Images