A SAVA-based IP governance method suitable for a cloud-native system

Abstract

The application discloses an IP governance method based on SAVA suitable for a cloud native system and belongs to the technical field of network security, and is characterized in that the method comprises the following steps: S1, a virtual SAVA device is used to abstract the function of the SAVA device into a capability in the cloud native system; S2, the capability is combined into a micro-service chain; S3, in a false source identification stage of source address identification, a false source address is identified; S4, in a real source identification stage of source address identification, an existing real source identification function is abstracted into a capability, and real source identification is performed; S5, in a black and white list generation stage, an IP address black and white list is generated according to intelligence of source address identification; S6, the cloud native system blocks a black list IP address according to the generated IP address black and white list; and S7, finally, intelligence is shared. The application can break through the restriction of an existing network structure, realize IP address governance based on SAVA in the cloud native system, and improve efficiency and flexibility.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to an IP management method based on SAVA suitable for a cloud native system. BACKGROUND

[0002] DDoS attack, which is a distributed denial of service attack, is one of the most important attack means in current network attacks. The characteristic of DDoS attack is that it can quickly exhaust the resources of the target system through a large number of requests, resulting in the inability of the target system to provide normal services. This attack method may cause economic losses and reputation damage to enterprises, organizations or individuals. With the popularity of the Internet and the increase in the connection of various devices, the scale and frequency of DDoS attacks are also growing, bringing greater challenges to network security.

[0003] Cloud network convergence refers to the combination of cloud computing and communication network, which fully utilizes the advantages of cloud computing and network. Cloud computing can dynamically adjust resources according to demand, and network realizes fast data transmission and wider coverage, with high flexibility and elasticity. Cloud network convergence develops super computing power to the user end, realizes cloud edge convergence, and realizes full network coverage through central cloud and edge cloud, and maximizes the cloud network capability.

[0004] Cloud native aims to utilize cloud computing, containerization and microservice technology to build high flexibility and easy-to-manage application programs, and fully utilize the potential of cloud computing. Cloud native can deploy application programs according to demand, and application programs can be flexibly combined and linked, automatically managed, and network functions flexibly deployed to improve the response speed and efficiency of application programs.

[0005] Cloud network convergence provides flexible and sufficient basic conditions for various cloud native businesses. On the basis of cloud native, with the help of software concept, the constraints of existing network structure are broken through, the flexible combination and linkage of system functions are realized, and the characteristics of deployment, arrangement, expansion and updating are possessed, solving the problems of rigid deployment and high cost of traditional hardware.

[0006] SAVA is a source address verification mechanism, which can be deployed at different levels to implement strict false source address verification to eliminate false source DDoS attacks in the network. Specifically, SAVA can be deployed to implement source address verification at three levels of access network, autonomous system and between autonomous systems. Among the current many source address verification frameworks, SAVA can manage IP from the source.

[0007] IP governance refers to the activities of managing and regulating IP addresses in the Internet, involving the allocation principles and usage specifications of IP addresses, usually jointly participated by international organizations, government agencies, network service providers and other stakeholders to ensure fair allocation of address resources. Once IP addresses are found to be used for network attacks, various means are used to govern them to ensure the stable and healthy development of the Internet.

[0008] Traditional IP governance methods include source address verification based on various source address verification frameworks to trace the source address, but due to the current network structure, SAVA devices are difficult to deploy in large quantities in the network, resulting in low IP governance efficiency, lack of flexibility and elasticity, and further extension of the problem of being unable to deploy on demand.

[0009] The Chinese patent document with publication number CN114640610A and publication date of June 17, 2022 discloses a cloud-native service governance method, device and storage medium, which includes: receiving service information of a service provider, and generating a registration list based on the service information, a cloud-native microservice platform is used to implement service registration and service discovery; in response to a service invocation request sent by a service consumer, a service list is retrieved according to the registration list, a service invocation connection between the service consumer and a target service provider in the service list is created to realize fast remote service invocation of the target service provider by the service consumer; local native executable code of the service provider and the service consumer is constructed, and the local native executable code is deployed and run on the cloud-native microservice platform to realize fast dynamic elastic scaling of the cloud-native microservice platform, improve resource utilization, and save cost.

[0010] The cloud-native service governance method, device and storage medium disclosed in the patent document reduce three-party dependence and middleware deployment through cloud-native service registration and discovery, use existing service discovery methods, and reduce the deployment of other service discovery components. However, there are still problems of low IP governance efficiency and lack of flexibility. SUMMARY

[0011] To overcome the defects of the prior art, the present application provides a SAVA-based IP governance method suitable for a cloud-native system. The present application is based on a cloud-native system and uses the concept of software to abstract traditional SAVA devices into capabilities in the cloud-native system, which can break through the constraints of the existing network structure and implement SAVA-based IP address governance in the cloud-native system, improving efficiency and flexibility.

[0012] The present application is implemented by the following technical solutions:

[0013] A SAVA-based IP governance method suitable for a cloud-native system, characterized by the following steps:

[0014] S1, virtualize the SAVA device, abstract the functions of the SAVA device into capabilities in the cloud native system;

[0015] S2, combine the capabilities into a microservice chain;

[0016] S3, in the false source identification stage of source address identification, identify the false source address;

[0017] S4, in the real source identification stage of source address identification, abstract the existing real source identification function into a capability, and perform real source identification;

[0018] S5, in the black and white list generation stage, generate IP address black and white lists according to the intelligence of source address identification;

[0019] S6, in the IP address blocking stage, the cloud native system blocks the black list IP address according to the generated IP address black and white list;

[0020] S7, finally, share the intelligence.

[0021] In step S1, abstracting the functions of the SAVA device into capabilities in the cloud native system means that the SAVA source address verification function, the black and white list generation function and the alarm push function are respectively abstracted into SAVA source address verification capability, black and white list generation capability and alarm push capability.

[0022] In step S2, combining the capabilities into a microservice chain means that the SAVA source address verification capability, the black and white list generation capability and the alarm push capability are combined into a microservice chain.

[0023] In step S3, identifying the false source address means that the cloud native system perceives user demand through the control center, sends the user demand to the cloud native system, verifies the IP address of the traffic according to the user demand, identifies the false source address contained in the traffic, and generates a black and white list.

[0024] In step S4, abstracting the existing real source identification function into a capability means that the tracing function and the detection function are respectively abstracted into the corresponding tracing capability and detection capability in the cloud native system; performing real source identification means that the cloud native system perceives user demand through the control center, identifies the real source address of the attack traffic in the network, and cooperates with the false source identification to share the intelligence with the black and white list generation capability.

[0025] In the step S5, the generating of the IP address black and white list refers to abstracting the identification function and the intelligence collection function into corresponding identification ability and intelligence collection ability under the unified control of the cloud native control center and the SAVA control center, and deploying to the cloud server, and generating the IP address black and white list according to the intelligence information shared in the source address identification stage.

[0026] In the step S6, the blocking of the black list IP address refers to abstracting the identification function and the analysis function into corresponding identification ability and analysis ability in the cloud native system, and deploying to the cloud server, and under the unified control of the cloud native control center and the SAVA control center, combining the abilities to form an IP address blocking ability, and identifying the new traffic in cooperation with the IP address black and white list generated by the source address identification, and if the IP address of the new traffic is in the black list, the new traffic is blocked.

[0027] In the step S7, the intelligence sharing includes direct sharing and indirect sharing.

[0028] The direct sharing refers to sharing and transmitting the intelligence of the cloud native system under the control of the control center through the micro service chain between the various abilities.

[0029] The indirect sharing refers to forming an intelligence sharing ability by connecting the various abilities in the cloud native system through the micro service chain under the unified control of the cloud native control center and the SAVA control center, and sharing the intelligence through the intelligence sharing ability.

[0030] The ability in the application refers to a virtualized component abstracted from the traditional anti-DDoS function, which decouples the traditional anti-DDoS function from the hardware, realizes the network function in the virtualized environment through network programming, uses a management and arrangement system to configure, manage and optimize the virtual network function, and deploys the function in any position of the physical network in the cloud native system in the form of a container.

[0031] The beneficial effects of the application mainly include the following aspects:

[0032] 1、S1, virtualize the SAVA device, abstract the function of the SAVA device as a capability in the cloud native system; S2, combine the capabilities into a microservice chain; S3, in the false source identification stage of source address identification, identify the false source address; S4, in the real source identification stage of source address identification, abstract the existing real source identification function as a capability, and identify the real source; S5, in the blacklist generation stage, generate IP address black and white lists according to the intelligence of source address identification; S6, in the IP address blocking stage, the cloud native system blocks the IP address on the blacklist according to the generated IP address black and white list; S7, finally, share the intelligence, compared with the prior art, based on the cloud native system, with the help of the software concept, the traditional SAVA device is abstracted as a capability in the cloud native system, which can break through the restriction of the existing network structure, realize IP address management based on SAVA in the cloud native system, and improve the efficiency and flexibility.

[0033] 2、The present application, in view of the problem that the SAVA device in the current network is difficult to deploy flexibly, abstracts the function of the SAVA device as a capability in the cloud native system with the help of the software concept, and then can be deployed on demand, improving the flexibility.

[0034] 3、The present application, in view of the problem that the SAVA device in the current network has high deployment cost, the function of the SAVA device is deployed in the cloud native system, which effectively reduces the deployment cost.

[0035] 4、The present application, in view of the problem that the false source address management in the current network is difficult, the function of the SAVA device is introduced to verify the source address, improving the efficiency of false source address management. BRIEF DESCRIPTION OF DRAWINGS

[0036] The present application will be further specifically explained in combination with the drawings and specific embodiments in the specification:

[0037] Figure 1 The flowchart of the present application. DETAILED DESCRIPTION

[0038] Embodiment 1

[0039] Referring to Figure 1 A SAVA-based IP management method suitable for a cloud native system, comprising the following steps:

[0040] S1, virtualize the SAVA device, abstract the function of the SAVA device as a capability in the cloud native system;

[0041] S2, combine the capabilities into a microservice chain;

[0042] S3, in the false source identification stage of source address identification, identify the false source address;

[0043] S4, in the real source identification stage of source address identification, abstracting the existing real source identification function into a capability, and performing real source identification;

[0044] S5, in the black and white list generation stage, generating IP address black and white lists according to the intelligence of source address identification;

[0045] S6, in the IP address blocking stage, the cloud native system blocks the IP addresses on the black list according to the generated IP address black and white lists;

[0046] S7, finally, intelligence sharing is performed.

[0047] The embodiment is the most basic implementation, S1, virtualizing the SAVA device, abstracting the functions of the SAVA device into capabilities in the cloud native system; S2, combining the capabilities into a microservice chain; S3, in the false source identification stage of source address identification, identifying false source addresses; S4, in the real source identification stage of source address identification, abstracting the existing real source identification function into a capability, and performing real source identification; S5, in the black and white list generation stage, generating IP address black and white lists according to the intelligence of source address identification; S6, in the IP address blocking stage, the cloud native system blocks the IP addresses on the black list according to the generated IP address black and white lists; S7, finally, intelligence sharing is performed. Compared with the prior art, based on the cloud native system, with the help of the software concept, the traditional SAVA device is abstracted into a capability in the cloud native system, which can break through the constraints of the existing network structure, realize IP address management based on SAVA in the cloud native system, and improve the efficiency and flexibility.

[0048] Embodiment 2

[0049] Referring to Figure 1 A SAVA-based IP management method suitable for a cloud native system, comprising the following steps:

[0050] S1, virtualizing the SAVA device, abstracting the functions of the SAVA device into capabilities in the cloud native system;

[0051] S2, combining the capabilities into a microservice chain;

[0052] S3, in the false source identification stage of source address identification, identifying false source addresses;

[0053] S4, in the real source identification stage of source address identification, abstracting the existing real source identification function into a capability, and performing real source identification;

[0054] S5, in the black and white list generation stage, generating IP address black and white lists according to the intelligence of source address identification;

[0055] S6, in the IP address blocking phase, the cloud native system blocks the blacklisted IP addresses according to the generated IP address black and white list;

[0056] S7, finally, intelligence sharing is performed.

[0057] Preferably, in the step S1, the function of the SAVA device is abstracted as a capability in the cloud native system, which means that the SAVA source address verification function, the black and white list generation function and the alarm pushing function are respectively abstracted as a SAVA source address verification capability, a black and white list generation capability and an alarm pushing capability.

[0058] In the step S2, the capabilities are combined into a microservice chain, which means that the SAVA source address verification capability, the black and white list generation capability and the alarm pushing capability are combined into a microservice chain.

[0059] In the step S3, the false source address is identified, which means that the cloud native system perceives user demand through the control center, sends the user demand to the cloud native system, and according to the user demand, the microservice chain verifies the IP address of the traffic, identifies the false source address contained in the traffic, and generates a black and white list.

[0060] This embodiment is a preferred implementation, which is aimed at the problem that the SAVA device is difficult to be flexibly deployed in the current network, and by means of the software concept, the function of the SAVA device is abstracted as a capability in the cloud native system, so that it can be deployed on demand, and the flexibility is improved.

[0061] Embodiment 3

[0062] Referring to Figure 1 A SAVA-based IP management method suitable for a cloud native system, comprising the following steps:

[0063] S1, virtualizing the SAVA device, abstracting the function of the SAVA device as a capability in the cloud native system;

[0064] S2, combining the capabilities into a microservice chain;

[0065] S3, in the false source identification phase of source address identification, identifying the false source address;

[0066] S4, in the real source identification phase of source address identification, abstracting the existing real source identification function as a capability to identify the real source;

[0067] S5, in the black and white list generation phase, generating an IP address black and white list according to the intelligence of source address identification;

[0068] S6, in the IP address blocking stage, the cloud native system blocks the black list IP address according to the generated IP address black and white list;

[0069] S7, finally, intelligence is shared.

[0070] In the step S1, the function of the SAVA device is abstracted as the capability in the cloud native system, which means that the SAVA source address verification function, the black and white list generation function and the alarm pushing function are respectively abstracted as the SAVA source address verification capability, the black and white list generation capability and the alarm pushing capability.

[0071] In the step S2, the capabilities are combined into the micro service chain, which means that the SAVA source address verification capability, the black and white list generation capability and the alarm pushing capability are combined into the micro service chain.

[0072] In the step S3, the false source address is identified, which means that the cloud native system perceives the user demand through the control center, sends the user demand to the cloud native system, verifies the IP address of the traffic according to the user demand, identifies the false source address contained in the traffic, and generates the black and white list.

[0073] Further preferably, in the step S4, the existing real source identification function is abstracted as the capability, which means that the tracing function and the detection function are respectively abstracted as the corresponding tracing capability and detection capability in the cloud native system; the real source is identified, which means that the cloud native system perceives the user demand through the control center, identifies the real source address of the attack traffic in the network, and cooperates with the false source identification to share the intelligence to the black and white list generation capability.

[0074] In the step S5, the IP address black and white list is generated, which means that the identification function and the intelligence collection function are abstracted as the corresponding identification capability and intelligence collection capability under the unified control of the cloud native control center and the SAVA control center, and are deployed to the cloud server, and the IP address black and white list is generated according to the intelligence information shared in the source address identification stage.

[0075] In the step S6, the black list IP address is blocked, which means that the identification function and the analysis function are abstracted as the corresponding identification capability and analysis capability in the cloud native system, and are deployed to the cloud server, the capabilities are combined and linked as the IP address blocking capability under the unified control of the cloud native control center and the SAVA control center, the new traffic is identified in cooperation with the IP address black and white list generated by the source address identification, and if the IP address of the new traffic is in the black list, the new traffic is blocked.

[0076] The embodiment is another preferred embodiment, and the deployment cost of the SAVA device in the current network is high, and the functions of the SAVA device are deployed in the cloud native system, so that the deployment cost is effectively reduced.

[0077] Embodiment 4

[0078] Referring to Figure 1 A SAVA-based IP management method suitable for a cloud-native system, comprising the following steps:

[0079] S1, virtualizing a SAVA device, abstracting functions of the SAVA device into capabilities in the cloud-native system;

[0080] S2, combining the capabilities into a micro-service chain;

[0081] S3, in a false source identification stage of source address identification, identifying false source addresses;

[0082] S4, in a real source identification stage of source address identification, abstracting existing real source identification functions into capabilities, and performing real source identification;

[0083] S5, in a blacklist generation stage, generating IP address blacklists according to intelligence of source address identification;

[0084] S6, in an IP address blocking stage, the cloud-native system blocks blacklisted IP addresses according to the generated IP address blacklists;

[0085] S7, finally, sharing intelligence.

[0086] In the step S1, abstracting functions of the SAVA device into capabilities in the cloud-native system means that SAVA source address verification functions, blacklist generation functions, and alarm pushing functions are respectively abstracted into SAVA source address verification capabilities, blacklist generation capabilities, and alarm pushing capabilities.

[0087] In the step S2, combining the capabilities into a micro-service chain means that SAVA source address verification capabilities, blacklist generation capabilities, and alarm pushing capabilities are combined into a micro-service chain.

[0088] In the step S3, identifying false source addresses means that the cloud-native system perceives user demands through a control center, sends the user demands to the cloud-native system, according to the user demands, the micro-service chain verifies IP addresses of traffic, identifies false source addresses contained in the traffic, and generates blacklists.

[0089] In the step S4, abstracting existing real source identification functions into capabilities means that tracing functions and detection functions are respectively abstracted into corresponding tracing capabilities and detection capabilities in the cloud-native system; performing real source identification means that the cloud-native system perceives user demands through a control center, identifies real source addresses of attack traffic in a network, and cooperates with false source identification to share intelligence with blacklist generation capabilities.

[0090] In the step S5, the generating of the IP address black and white list refers to abstracting the identification function and the intelligence collection function into corresponding identification ability and intelligence collection ability under the unified control of the cloud native control center and the SAVA control center, and deploying to the cloud server, and generating the IP address black and white list according to the intelligence information shared in the source address identification stage.

[0091] Further preferably, in the step S6, the blocking of the black list IP address refers to abstracting the identification function and the analysis function into corresponding identification ability and analysis ability in the cloud native system, and deploying to the cloud server, and under the unified control of the cloud native control center and the SAVA control center, combining the abilities to form an IP address blocking ability, and identifying the new traffic according to the IP address black and white list generated by the source address identification, and if the IP address of the new traffic is in the black list, the new traffic is blocked.

[0092] In the step S7, the intelligence sharing includes direct sharing and indirect sharing.

[0093] The direct sharing refers to sharing and transmitting the intelligence of the cloud native system under the control of the control center through the micro service chain connected between various abilities.

[0094] The indirect sharing refers to connecting the various abilities in the cloud native system through the micro service chain under the unified control of the cloud native control center and the SAVA control center to form an intelligence sharing ability, and sharing the intelligence through the intelligence sharing ability.

[0095] The embodiment is the best mode of implementation, and the function of the SAVA device is introduced to verify the source address and improve the efficiency of the false source address management.

[0096] The basic principle of the application is as follows:

[0097] The function of the SAVA device and the IP address management function are abstracted into the ability in the cloud native system, and the SAVA-based IP address management function is realized in the cloud native system under the unified control of the cloud native system control center and the SAVA control center, and the whole management process includes three stages, i.e. source address identification, formation of a black and white list and IP blocking, wherein the source address identification includes false source identification and real source identification, and also has an intelligence sharing ability, which is divided into direct sharing and indirect sharing.

[0098] Compared with the prior art, the SAVA-based IP management can break through the restriction of the existing network structure, realize the SAVA-based IP address management in the cloud native system, and improve the efficiency and flexibility.

[0099] The capability refers to a virtualized component abstracted from a traditional anti-DDoS function, decoupling the traditional anti-DDoS function from hardware, implementing network functions in a virtualized environment through network programming, using a management and orchestration system such as MANO to configure, manage and optimize virtual network functions, and deploying in a container manner at any location of a physical network in a cloud-native system.

[0100] MANO refers to a unified framework for managing various virtual network functions and a basic network virtualization architecture, for service orchestration and device management.

Claims

1. A SAVA-based IP governance method suitable for cloud-native systems, characterized in that, The method comprises the following steps: S1, virtualizing the SAVA device, abstracting the functions of the SAVA device into capabilities in the cloud native system; In the step S1, the functions of the SAVA device are abstracted into capabilities in the cloud native system, which means that the SAVA source address verification function, the black and white list generation function and the alarm pushing function are respectively abstracted into the SAVA source address verification capability, the black and white list generation capability and the alarm pushing capability; S2, the above capabilities are combined into a micro service chain; S3, in the false source identification stage of source address identification, the false source address is identified; In the step S3, the false source address is identified, which means that the cloud native system perceives user demand through the control center, sends the user demand to the cloud native system, verifies the IP address of the traffic according to the user demand, identifies the false source address contained in the traffic, and generates a black and white list; S4, in the real source identification stage of source address identification, the existing real source identification function is abstracted into a capability, and real source identification is performed; In the step S4, the existing real source identification function is abstracted into a capability, which means that the tracing function and the detection function are respectively abstracted into the corresponding tracing capability and detection capability in the cloud native system; real source identification is performed, which means that the cloud native system perceives user demand through the control center, identifies the real source address of the attack traffic in the network, and cooperates with the false source identification to share intelligence with the black and white list generation capability; S5, in the black and white list generation stage, IP address black and white lists are generated according to the intelligence of the source address identification; S6, in the IP address blocking stage, the cloud native system blocks the IP address in the blacklist according to the generated IP address black and white list; S7, finally, intelligence is shared.

2. The SAVA-based IP governance method for cloud-native systems according to claim 1, wherein: In the step S2, the capabilities are combined into a micro service chain, which means that the SAVA source address verification capability, the black and white list generation capability and the alarm pushing capability are combined into a micro service chain.

3. The SAVA-based IP governance method for cloud-native systems of claim 1, wherein: In the step S5, the IP address black and white list is generated, which means that under the unified control of the cloud native control center and the SAVA control center, the identification function and the intelligence collection function are abstracted into the corresponding identification capability and intelligence collection capability, and are deployed to the cloud server, and the IP address black and white list is generated according to the intelligence information shared in the source address identification stage.

4. The SAVA-based IP governance method for cloud-native systems of claim 1, wherein: In the step S6, the IP address in the blacklist is blocked, which means that the identification function and the analysis function are abstracted into the corresponding identification capability and analysis capability in the cloud native system, and are deployed to the cloud server, under the unified control of the cloud native control center and the SAVA control center, the capabilities are combined and linked into the IP address blocking capability, and the new traffic is identified in cooperation with the IP address black and white list generated by the source address identification, if the IP address of the new traffic is in the blacklist, the new traffic is blocked.

5. The SAVA-based IP governance method for cloud-native systems according to claim 4, wherein: In the step S7, intelligence sharing includes direct sharing and indirect sharing.

6. The SAVA-based IP governance method for cloud-native systems according to claim 5, wherein: The direct sharing means that various intelligence of the cloud native system is controlled by the control center, and the intelligence is shared and transmitted through the micro service chain between the capabilities.

7. The SAVA-based IP governance method for cloud-native systems of claim 5, wherein: The indirect sharing refers to that under unified control of the cloud native control center and the SAVA control center, various capabilities in the cloud native system are connected through a micro-service chain to form an intelligence sharing capability, and intelligence sharing is performed through the intelligence sharing capability.

Images