Network element verification method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of network information security, in particular to a network element verification method and device, computer equipment and a storage medium. The method comprises the following steps: sending a security verification request to a to-be-verified network element; receiving a first security metric value fed back by the to-be-verified network element based on the security verification request, and performing security verification on the to-be-verified network element according to the first security metric value; and determining the to-be-verified network element as the security network element belonging to the trust domain under the condition that the security verification result is that the verification is passed. According to the method and the device, security detection can be carried out on the to-be-verified network element according to the first security metric value of the to-be-verified network element, one-to-one detection on the to-be-verified network element is ensured, untrusted network elements in a trust domain are prevented, SRv6 network security is ensured not to be influenced, and an SRv6 security model is prevented from losing a trust basis.

Description

Technical Field

[0001] The present application relates to the field of network information security technology, and in particular to a network element verification method, device, computer equipment and storage medium. Background Art

[0002] The development of 5G, cloud computing, and enterprise digital transformation has put forward higher requirements for network capabilities, such as massive connection expansion, arbitrary service access, differentiated services, and end-to-end reliability requirements. SRv6 (Segment Routing v6, segment routing based on IPv6 forwarding plane) simplifies and unifies traditional complex network protocols, combining the source routing advantages of segment routing and the simplicity and easy scalability of IPv6 (Internet Protocol version 6), which is in line with the SDN (Software Defined Network) concept and is a powerful tool for realizing intent-driven networks.

[0003] Based on the IETF (Internet Engineering Task Force) SRv6 trust domain protection principle, SRv6 network security protection can be effectively achieved through simple trust domain protection. However, when the network elements included in the SRv6 trust domain are untrustworthy, the SRv6 security model will lose its trust basis. Therefore, a trust verification method for network elements is urgently needed. Summary of the invention

[0004] Based on this, it is necessary to provide a network element verification method, apparatus, computer equipment and storage medium that can accurately implement trust verification for network elements in response to the above technical problems.

[0005] In a first aspect, the present application provides a network element verification method. The method comprises:

[0006] Sending a security verification request to the network element to be verified;

[0007] receiving a first security metric value fed back by the network element to be verified based on the security verification request, and performing security verification on the network element to be verified according to the first security metric value;

[0008] When the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain.

[0009] In one of the embodiments, performing security verification on the network element to be verified according to the first security metric value includes:

[0010] Obtaining a first security reference value corresponding to the network element to be verified;

[0011] Perform security verification on the network element to be verified according to the first security reference value and the first security metric value.

[0012] In one embodiment, the performing security verification on the network element to be verified according to the first security reference value and the first security metric value includes:

[0013] comparing the first safety reference value and the first safety metric value;

[0014] If the first security reference value and the first security metric value are the same, determining that the security verification result of the network element to be verified is verification passed;

[0015] If the first security reference value and the first security metric value are different, it is determined that the security verification result of the network element to be verified is verification failure.

[0016] In one of the embodiments, obtaining the first security reference value corresponding to the network element to be verified includes:

[0017] Based on the network element identifier of the network element to be verified, obtaining a first security reference value corresponding to the network element to be verified from a reference value database;

[0018] The reference value database stores a candidate security reference value corresponding to at least one candidate network element, and the at least one candidate network element includes the network element to be verified.

[0019] In one of the embodiments, the reference value database further stores a second security reference value corresponding to the SDN controller, and the sending of a security verification request to the network element to be verified includes:

[0020] When the second security metric value corresponding to the SDN controller is the same as the second security reference value, a security verification request is sent to the network element to be verified.

[0021] In one embodiment, the method further comprises:

[0022] If the security verification result is that the verification fails, the network element to be verified is determined as a network element with questionable security;

[0023] Performing secondary verification on the network element with questionable security according to the network element parameter information of the network element to be verified;

[0024] When the secondary verification result is that the verification is passed, the security-questionable network element is determined as a secure network element belonging to the trust domain.

[0025] In a second aspect, the present application further provides a network element verification device. The device comprises:

[0026] A sending module, used for sending a security verification request to the network element to be verified;

[0027] A receiving module, configured to receive a first security metric value fed back by the network element to be verified based on the security verification request, and perform security verification on the network element to be verified according to the first security metric value;

[0028] The determination module is used to determine the network element to be verified as a secure network element belonging to the trust domain when the security verification result is that the verification is passed.

[0029] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0030] Sending a security verification request to the network element to be verified;

[0031] receiving a first security metric value fed back by the network element to be verified based on the security verification request, and performing security verification on the network element to be verified according to the first security metric value;

[0032] When the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain.

[0033] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0034] Sending a security verification request to the network element to be verified;

[0035] receiving a first security metric value fed back by the network element to be verified based on the security verification request, and performing security verification on the network element to be verified according to the first security metric value;

[0036] When the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain.

[0037] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0038] Sending a security verification request to the network element to be verified;

[0039] receiving a first security metric value fed back by the network element to be verified based on the security verification request, and performing security verification on the network element to be verified according to the first security metric value;

[0040] When the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain.

[0041] In the above-mentioned network element verification method, device, computer equipment and storage medium, the SDN controller sends a security verification request to the network element to be verified, and receives a first security metric value fed back by the network element to be verified based on the security verification request, so as to realize security verification of the network element to be verified according to the first security metric value. Then, when the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain. According to the above content, the present application can obtain the first security metric value corresponding to the network element to be verified by sending a security verification request to the network element to be verified, and then, perform security detection on the network element to be verified according to the first security metric value of the network element to be verified, thereby ensuring one-to-one detection of the network element to be verified, preventing untrusted network elements from appearing in the trust domain, ensuring that the security of the SRv6 network is not affected, and preventing the SRv6 security model from losing its trust basis; further, since the first security metric value can effectively reflect whether the network element configuration file of the network element to be verified has been tampered with, therefore, in the process of performing security verification on the network element to be verified according to the first security metric value, the accuracy of the security verification of the network element to be verified can be effectively guaranteed, and misjudgment of the security verification of the network element to be verified can be prevented. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 An application environment diagram of a network element verification method provided in an embodiment of the present application;

[0043] Figure 2 A flowchart of a first network element verification method provided in an embodiment of the present application;

[0044] Figure 3 A flowchart of a second network element verification method provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of a flow chart of a third network element verification method provided in an embodiment of the present application;

[0046] Figure 5 A flowchart of a fourth network element verification method provided in an embodiment of the present application;

[0047] Figure 6 A structural block diagram of a network element verification device provided in an embodiment of the present application;

[0048] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. In the description of the present application, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms is not necessarily for the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples without contradicting each other.

[0051] The network element verification method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the SDN controller 102 communicates with the network element to be verified 104 through the network. The reference value database can store the reference value corresponding to the network element verification method. The reference value database can be integrated in the SDN controller 102, and can also be placed on the cloud or other network servers. The SDN controller sends a security verification request to the network element to be verified, and receives a first security metric value fed back by the network element to be verified based on the security verification request, so as to realize security verification of the network element to be verified according to the first security metric value, and then, when the security verification result is a verification pass, the network element to be verified is determined as a secure network element belonging to the trust domain.

[0052] In one embodiment, Figure 2 As shown, a network element verification method is provided, which is applied to Figure 1 Taking the SDN controller 102 in the example as an example, the following steps are included:

[0053] S201, sending a security verification request to a network element to be verified.

[0054] It should be noted that in order to ensure that the network element to be verified can be subsequently security verified based on the first security metric value corresponding to the network element to be verified, it is necessary to obtain the first security metric value corresponding to the network element to be verified in advance. Therefore, a security verification request can be sent to the network element to be verified, wherein the security verification request is used to instruct the network element to be verified to feedback the first security metric value to the SDN controller, thereby enabling the SDN controller to obtain the first security metric value corresponding to the network element to be verified.

[0055] In one embodiment of the present application, a security verification period for the network element to be verified can be pre-defined, wherein the security verification period is used to characterize the length of time between two adjacent security checks of the network element to be verified. Furthermore, if the time interval between the current time and the last time the network element to be verified performed a security verification is greater than or equal to the security verification period, the network element to be verified is controlled to actively execute an operation of feeding back a first security metric value to the SDN controller, so as to ensure that the subsequent SDN controller can perform security verification on the network element to be verified based on the first security metric value.

[0056] Further explanation: in order to further increase the security of network elements in the trust domain, the SDN controller may carry verification data when sending a security verification request to the network element to be verified. After receiving the security verification request, the network element to be verified may compare the security verification request with the verification benchmark agreed in advance with the SDN controller. If the two are the same, the step of feeding back the first security metric value to the SDN controller is executed; if the two are different, the step of feeding back the first security metric value to the SDN controller is not executed.

[0057] There are many types of verification data, for example, it can be a device identifier of an SDN controller, or a predefined random array. The data type of the verification data is not limited here.

[0058] S202: Receive a first security metric value fed back by the network element to be verified based on a security verification request, and perform security verification on the network element to be verified according to the first security metric value.

[0059] It should be noted that the first security metric value is calculated based on multiple network element configuration files of the network element to be verified, and administrator privileges are required when modifying the configuration file of the network element to be verified. Therefore, changes in the first security metric value can effectively reflect whether the network element to be verified has been maliciously tampered with.

[0060] The network element configuration file corresponding to the network element to be verified may include but is not limited to a current running configuration file and a startup configuration file.

[0061] To further illustrate, when calculating the first security metric value based on multiple network element configuration files of the network element to be verified, the first security metric value calculation for the network element to be verified can be implemented based on a pre-set first security metric value calculation formula, wherein the first security metric value calculation formula may contain many types of formulas, and the formula type of the security metric value calculation formula is not limited herein.

[0062] As an example, when it is necessary to calculate the first security metric value according to multiple network element configuration files of the network element to be verified, the first security metric value calculation formula may be as follows:

[0063] NE hashvalue =hash(hash(running_config_file)+hash(startup_config_file))

[0064] Among them, NE hashvalue It refers to the first security metric value of the network element to be verified, running_config_file refers to the current running configuration file of the network element to be verified, and startup_config_file refers to the startup configuration file of the network element to be verified.

[0065] In one embodiment of the present application, when it is necessary to perform security verification on the network element to be verified based on the first security metric value, it can be verified whether the first security metric value is a preset security reference value. If so, the security verification result of the network element to be verified is determined to be passed; if not, the security verification result of the network element to be verified is determined to be failed.

[0066] In one embodiment of the present application, when it is necessary to perform security verification on the network element to be verified based on the first security metric value, it can also be verified whether the first security metric value belongs to a pre-set security reference value range. If it does, the security verification result of the network element to be verified is determined to be passed; if not, the security verification result of the network element to be verified is determined to be failed.

[0067] S203: When the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain.

[0068] It should be noted that if the security verification result is verification passed, it means that the network element to be verified is a trusted network element. Therefore, the network element to be verified can be determined as a secure network element belonging to the trust domain. The network element to be verified will not affect the security of the SRv6 network, nor will it cause the SRv6 security model to lose its trust basis.

[0069] In the above network element verification method, the SDN controller sends a security verification request to the network element to be verified, and receives the first security metric value fed back by the network element to be verified based on the security verification request, so as to realize security verification of the network element to be verified according to the first security metric value, and then, when the security verification result is a verification pass, the network element to be verified is determined as a secure network element belonging to the trust domain. According to the above content, the present application can obtain the first security metric value corresponding to the network element to be verified by sending a security verification request to the network element to be verified, and then, it can realize security detection of the network element to be verified according to the first security metric value of the network element to be verified, ensuring one-to-one detection of the network element to be verified, preventing untrusted network elements from appearing in the trust domain, ensuring that the SRv6 network security is not affected, and preventing the SRv6 security model from losing its trust basis; further, since the first security metric value can effectively reflect whether the network element configuration file of the network element to be verified has been tampered with, therefore, in the process of security verification of the network element to be verified according to the first security metric value, the accuracy of the security verification of the network element to be verified can be effectively guaranteed, and the security verification of the network element to be verified can be prevented from being misjudged.

[0070] In one embodiment, if Figure 3 As shown, when it is necessary to perform security verification on the network element to be verified according to the first security metric value, the following contents may be specifically included:

[0071] S301: Obtain a first security reference value corresponding to a network element to be verified.

[0072] The first security reference value is used to represent the value that the first security metric value should be equal to when the network element to be verified is a secure network element belonging to the trust domain (that is, when the configuration file of the network element to be verified has not been maliciously tampered with).

[0073] It should be noted that when it is necessary to obtain the first security reference value corresponding to the network element to be verified, the following may be specifically included: based on the network element identifier of the network element to be verified, obtaining the first security reference value corresponding to the network element to be verified from the reference value database; wherein, the reference value database stores candidate security reference values ​​corresponding to at least one candidate network element, and at least one candidate network element includes the network element to be verified.

[0074] In one embodiment of the present application, a benchmark value database stores candidate security benchmark values ​​corresponding to at least one candidate network element, and each candidate security benchmark value is marked with a candidate identifier of the corresponding candidate network element. Therefore, in the process of obtaining the first security benchmark value corresponding to the network element to be verified from the benchmark value database based on the network element identifier of the network element to be verified, each candidate identifier can be compared in turn to see whether it is the same as the network element identifier of the network element to be verified. If a candidate identifier is the same as the network element identifier of the network element to be verified, the candidate security benchmark value corresponding to the candidate identifier is used as the first security benchmark value corresponding to the network element to be verified.

[0075] Among them, in order to ensure the accuracy of security verification of the network element to be verified based on the first security metric value, it is necessary to ensure that the determination process of the first security baseline value corresponding to the network element to be verified is the same as the determination process of the first security metric value. Therefore, the first security baseline value is also calculated based on multiple network element configuration files of the network element to be verified.

[0076] As an embodiment, when calculating the first security baseline value based on multiple network element configuration files of the network element to be verified, the first security baseline value calculation for the network element to be verified can be implemented based on a pre-set first security baseline value calculation formula, wherein the first security baseline value calculation formula may include many formula types, and the formula type of the security baseline value calculation formula is not limited herein.

[0077] As an example, when it is necessary to calculate the first security reference value according to multiple network element configuration files of the network element to be verified, the calculation formula of the first security reference value may be as follows:

[0078] NE benchmark =hash(hash(running_config_file)+hash(startup_config_file))

[0079] Among them, NE benchmar It refers to the first security benchmark value of the network element to be verified, running_config_file refers to the current running configuration file of the network element to be verified, and startup_config_file refers to the startup configuration file of the network element to be verified.

[0080] To further illustrate, before performing security verification on the network element to be verified, security verification needs to be performed on the SDN controller to ensure the credibility of the SDN controller. Therefore, the reference value database also stores a second security reference value corresponding to the SDN controller.

[0081] In one embodiment of the present application, before sending a security verification request to the network element to be verified, the second security metric value and the second security reference value corresponding to the SDN controller can be obtained, and it can be verified whether the second security metric value and the second security reference value are the same. If they are the same, it means that the security verification of the SDN controller has passed; if they are not the same, it means that the security verification of the SDN controller has failed. In order to ensure that the SDN controller that has passed the security verification can subsequently send a security verification request to the network element to be verified, it is necessary to send a security verification request to the network element to be verified when the second security metric value corresponding to the SDN controller is the same as the second security reference value.

[0082] Specifically, the second security baseline value of the SDN controller is calculated through multiple controller configuration files of the SDN controller, wherein the second security baseline value calculation formula for the controller configuration file can be in multiple calculation forms, and the calculation form of the second security baseline value calculation formula is not limited here; the controller configuration file can include but is not limited to: global configuration file, network policy configuration file, application configuration file, security configuration file, log and monitoring configuration file, etc.

[0083] As an example, the second safety reference value calculation formula may be:

[0084] SDN benchmark =hash(hash(global_config_file)+hash(net_config_file)+hash(app_co

[0085] nfig_file)+hash(sec_config_file)+hash(log_config_file))

[0086] Among them, SDN benchmark It refers to the second security baseline value of the SDN controller, global_config_file refers to the global configuration file of the SDN controller, net_config_file refers to the network policy configuration file of the SDN controller, app_config_file refers to the application configuration file of the SDN controller, sec_config_file refers to the security configuration file of the SDN controller, and log_config_file refers to the log and monitoring configuration file of the SDN controller.

[0087] Specifically, in order to ensure that the SDN controller can be successfully security verified based on the second security metric value and the second security reference value, it is necessary to ensure that the second security metric value and the second security reference value are calculated in the same way. Therefore, the second security metric value of the SDN controller is also calculated through multiple controller configuration files of the SDN controller, wherein the second security metric value calculation formula for the controller configuration file can be in multiple calculation forms, and the calculation form of the second security metric value calculation formula is not limited herein.

[0088] As another example, the second security metric value calculation formula may be:

[0089] SDN hashvalue =hash(hash(global_config_file)+hash(net_config_file)+hash(app_co

[0090] nfig_file)+hash(sec_config_file)+hash(log_config_file))

[0091] Among them, SDN hashvalue It refers to the second security metric of the SDN controller, global_config_file refers to the global configuration file of the SDN controller, net_config_file refers to the network policy configuration file of the SDN controller, app_config_file refers to the application configuration file of the SDN controller, sec_config_file refers to the security configuration file of the SDN controller, and log_config_file refers to the log and monitoring configuration file of the SDN controller.

[0092] S302: Perform security verification on the network element to be verified according to the first security reference value and the first security metric value.

[0093] In one embodiment of the present application, when it is necessary to perform security verification on the network element to be verified based on the first security reference value and the first security metric value, the first security reference value and the first security metric value can be compared, and then, the network element to be verified can be security verified based on the comparison result.

[0094] Specifically, when it is necessary to perform security verification on the network element to be verified, the following contents may be included: comparing the first security reference value and the first security metric value; if the first security reference value and the first security metric value are the same, determining that the security verification result of the network element to be verified is verification passed; if the first security reference value and the first security metric value are not the same, determining that the security verification result of the network element to be verified is verification failed.

[0095] The above-mentioned network element verification method obtains the first security reference value corresponding to the network element to be verified; then, based on the first security reference value and the first security measurement value, the network element to be verified is security verified, and security detection is performed on the network element to be verified based on the first security measurement value of the network element to be verified, thereby ensuring one-to-one detection of the network element to be verified, preventing untrusted network elements from appearing in the trust domain, ensuring that the security of the SRv6 network is not affected, and preventing the SRv6 security model from losing its trust basis.

[0096] In one embodiment, if Figure 4 As shown, when the security verification result is verification failure, the following contents may also be included:

[0097] S401: When the security verification result is failure, the network element to be verified is determined as a network element with questionable security.

[0098] It should be noted that if the security verification result of the network element to be verified is verification failure, it means that the configuration file of the network element to be verified may have been maliciously tampered with. Therefore, in order to ensure that the security of the SRv6 network is not affected, it is necessary to identify the network element to be verified as a security-questionable network element, and adjust the network path through the SDN controller to prevent the security-questionable network element from affecting the SRv6 network.

[0099] S402, performing secondary verification on the network element with questionable security according to the network element parameter information of the network element to be verified.

[0100] It should be noted that there are many methods for performing secondary verification on network elements with questionable security. For example, the above-mentioned network element verification method can be used again to verify the network elements with questionable security after a preset time. Alternatively, the network element identifier of the network element with questionable security can be fed back to the terminal device of the network element operation and maintenance personnel, so that the network element operation and maintenance personnel can perform manual inspection on the network elements with questionable security to achieve secondary verification of the network elements with questionable security.

[0101] From the above content, it can be seen that there are many methods for performing secondary verification on network elements with questionable security. Here, the method for performing secondary verification on network elements with questionable security is not limited.

[0102] S403: When the secondary verification result is that the verification is passed, the network element with questionable security is determined as a secure network element belonging to the trust domain.

[0103] It should be noted that if the secondary verification result is verification passed, it means that the network element with questionable security is a trusted network element. Therefore, the network element with questionable security can be determined as a secure network element belonging to the trust domain. The network element with questionable security will not affect the security of the SRv6 network, nor will it cause the SRv6 security model to lose its trust basis.

[0104] The above network element verification method prevents the appearance of untrusted network elements in the trust domain by determining the network element to be verified as a security-doubt network element, thereby ensuring that the security of the SRv6 network is not affected. Moreover, after performing a secondary verification on the security-doubt network element, if the secondary verification result is a passed verification, the security-doubt network element can also be determined as a secure network element belonging to the trust domain, thereby ensuring timely verification of the network element and preventing the situation where the secure network element cannot be confirmed to belong to the trust domain.

[0105] In one embodiment, if Figure 5 As shown, when it is necessary to determine the network element to be verified as a secure network element belonging to the trust domain, the following contents may be specifically included:

[0106] S501: Send a security verification request to a network element to be verified.

[0107] S502: Receive a first security metric value fed back by the network element to be verified based on a security verification request, and obtain a first security reference value corresponding to the network element to be verified.

[0108] S503: Compare the first safety reference value and the first safety metric value.

[0109] S504: If the first security reference value and the first security metric value are the same, determine that the security verification result of the network element to be verified is verification passed.

[0110] S505: When the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain.

[0111] In the above network element verification method, the SDN controller sends a security verification request to the network element to be verified, and receives the first security metric value fed back by the network element to be verified based on the security verification request, so as to realize security verification of the network element to be verified according to the first security metric value, and then, when the security verification result is a verification pass, the network element to be verified is determined as a secure network element belonging to the trust domain. According to the above content, the present application can obtain the first security metric value corresponding to the network element to be verified by sending a security verification request to the network element to be verified, and then, it can realize security detection of the network element to be verified according to the first security metric value of the network element to be verified, ensuring one-to-one detection of the network element to be verified, preventing untrusted network elements from appearing in the trust domain, ensuring that the SRv6 network security is not affected, and preventing the SRv6 security model from losing its trust basis; further, since the first security metric value can effectively reflect whether the network element configuration file of the network element to be verified has been tampered with, therefore, in the process of security verification of the network element to be verified according to the first security metric value, the accuracy of the security verification of the network element to be verified can be effectively guaranteed, and the security verification of the network element to be verified can be prevented from being misjudged.

[0112] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0113] Based on the same inventive concept, the embodiment of the present application also provides a network element verification device for implementing the network element verification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more network element verification device embodiments provided below can refer to the limitations of the network element verification method above, and will not be repeated here.

[0114] In one embodiment, Figure 6 As shown, a network element verification device is provided, comprising: a sending module 10, a receiving module 20 and a determining module 30, wherein:

[0115] The sending module 10 is used to send a security verification request to the network element to be verified.

[0116] The receiving module 20 is configured to receive a first security metric value fed back by the network element to be verified based on a security verification request, and perform security verification on the network element to be verified according to the first security metric value.

[0117] The determination module 30 is used to determine the network element to be verified as a secure network element belonging to the trust domain when the security verification result is that the verification is passed.

[0118] In one embodiment, performing security verification on a network element to be verified according to a first security metric value includes:

[0119] Obtaining a first security reference value corresponding to the network element to be verified;

[0120] Perform security verification on the network element to be verified according to the first security reference value and the first security metric value.

[0121] In one embodiment, performing security verification on a network element to be verified according to the first security reference value and the first security metric value includes:

[0122] comparing the first safety reference value and the first safety metric value;

[0123] If the first security reference value and the first security metric value are the same, determining that the security verification result of the network element to be verified is verification passed;

[0124] If the first security reference value and the first security metric value are different, it is determined that the security verification result of the network element to be verified is verification failure.

[0125] In one embodiment, obtaining a first security reference value corresponding to a network element to be verified includes:

[0126] Based on the network element identifier of the network element to be verified, obtaining a first security reference value corresponding to the network element to be verified from a reference value database;

[0127] The reference value database stores a candidate security reference value corresponding to at least one candidate network element, and the at least one candidate network element includes a network element to be verified.

[0128] In one embodiment, the reference value database further stores a second security reference value corresponding to the SDN controller, and sends a security verification request to the network element to be verified, including:

[0129] When the second security metric value corresponding to the SDN controller is the same as the second security reference value, a security verification request is sent to the network element to be verified.

[0130] In one embodiment, the method further comprises:

[0131] If the security verification result is failure, the network element to be verified is determined as a network element with questionable security;

[0132] Perform secondary verification on the network elements with questionable security based on the network element parameter information of the network element to be verified;

[0133] When the secondary verification result is that the verification is passed, the network element with questionable security is determined as a secure network element belonging to the trust domain.

[0134] In the above network element verification device, the SDN controller sends a security verification request to the network element to be verified, and receives the first security metric value fed back by the network element to be verified based on the security verification request, so as to realize security verification of the network element to be verified according to the first security metric value, and then, when the security verification result is a verification pass, the network element to be verified is determined as a secure network element belonging to the trust domain. According to the above content, the present application can obtain the first security metric value corresponding to the network element to be verified by sending a security verification request to the network element to be verified, and then, it can realize security detection of the network element to be verified according to the first security metric value of the network element to be verified, ensuring one-to-one detection of the network element to be verified, preventing untrusted network elements from appearing in the trust domain, ensuring that the SRv6 network security is not affected, and preventing the SRv6 security model from losing its trust basis; further, since the first security metric value can effectively reflect whether the network element configuration file of the network element to be verified has been tampered with, therefore, in the process of security verification of the network element to be verified according to the first security metric value, the accuracy of the security verification of the network element to be verified can be effectively guaranteed, and the security verification of the network element to be verified can be prevented from being misjudged.

[0135] Each module in the above network element verification device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0136] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 7As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a network element verification method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0137] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0138] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0139] Sending a security verification request to the network element to be verified;

[0140] Receiving a first security metric value fed back by the network element to be verified based on the security verification request, and performing security verification on the network element to be verified according to the first security metric value;

[0141] When the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain.

[0142] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0143] Obtaining a first security reference value corresponding to the network element to be verified;

[0144] Perform security verification on the network element to be verified according to the first security reference value and the first security metric value.

[0145] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0146] comparing the first safety reference value and the first safety metric value;

[0147] If the first security reference value and the first security metric value are the same, determining that the security verification result of the network element to be verified is verification passed;

[0148] If the first security reference value and the first security metric value are different, it is determined that the security verification result of the network element to be verified is verification failure.

[0149] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0150] Based on the network element identifier of the network element to be verified, obtaining a first security reference value corresponding to the network element to be verified from a reference value database;

[0151] The reference value database stores a candidate security reference value corresponding to at least one candidate network element, and the at least one candidate network element includes a network element to be verified.

[0152] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0153] When the second security metric value corresponding to the SDN controller is the same as the second security reference value, a security verification request is sent to the network element to be verified.

[0154] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0155] If the security verification result is failure, the network element to be verified is determined as a network element with questionable security;

[0156] Perform secondary verification on the network elements with questionable security based on the network element parameter information of the network element to be verified;

[0157] When the secondary verification result is that the verification is passed, the network element with questionable security is determined as a secure network element belonging to the trust domain.

[0158] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0159] Sending a security verification request to the network element to be verified;

[0160] Receiving a first security metric value fed back by the network element to be verified based on the security verification request, and performing security verification on the network element to be verified according to the first security metric value;

[0161] When the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain.

[0162] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0163] Obtaining a first security reference value corresponding to the network element to be verified;

[0164] Perform security verification on the network element to be verified according to the first security reference value and the first security metric value.

[0165] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0166] comparing the first safety reference value and the first safety metric value;

[0167] If the first security reference value and the first security metric value are the same, determining that the security verification result of the network element to be verified is verification passed;

[0168] If the first security reference value and the first security metric value are different, it is determined that the security verification result of the network element to be verified is verification failure.

[0169] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0170] Based on the network element identifier of the network element to be verified, obtaining a first security reference value corresponding to the network element to be verified from a reference value database;

[0171] The reference value database stores a candidate security reference value corresponding to at least one candidate network element, and the at least one candidate network element includes a network element to be verified.

[0172] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0173] When the second security metric value corresponding to the SDN controller is the same as the second security reference value, a security verification request is sent to the network element to be verified.

[0174] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0175] If the security verification result is failure, the network element to be verified is determined as a network element with questionable security;

[0176] Perform secondary verification on the network elements with questionable security based on the network element parameter information of the network element to be verified;

[0177] When the secondary verification result is that the verification is passed, the network element with questionable security is determined as a secure network element belonging to the trust domain.

[0178] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0179] Sending a security verification request to the network element to be verified;

[0180] Receiving a first security metric value fed back by the network element to be verified based on the security verification request, and performing security verification on the network element to be verified according to the first security metric value;

[0181] When the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain.

[0182] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0183] Obtaining a first security reference value corresponding to the network element to be verified;

[0184] Perform security verification on the network element to be verified according to the first security reference value and the first security metric value.

[0185] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0186] comparing the first safety reference value and the first safety metric value;

[0187] If the first security reference value and the first security metric value are the same, determining that the security verification result of the network element to be verified is verification passed;

[0188] If the first security reference value and the first security metric value are different, it is determined that the security verification result of the network element to be verified is verification failure.

[0189] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0190] Based on the network element identifier of the network element to be verified, obtaining a first security reference value corresponding to the network element to be verified from a reference value database;

[0191] The reference value database stores a candidate security reference value corresponding to at least one candidate network element, and the at least one candidate network element includes a network element to be verified.

[0192] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0193] When the second security metric value corresponding to the SDN controller is the same as the second security reference value, a security verification request is sent to the network element to be verified.

[0194] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0195] If the security verification result is failure, the network element to be verified is determined as a network element with questionable security;

[0196] Perform secondary verification on the network elements with questionable security based on the network element parameter information of the network element to be verified;

[0197] When the secondary verification result is that the verification is passed, the network element with questionable security is determined as a secure network element belonging to the trust domain.

[0198] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0199] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited thereto. The processors involved in each embodiment provided in this application may be general-purpose processors, central processing units, graphics processors, digital signal processors, programmable logic devices, data processing logic devices based on quantum computing, etc., but are not limited thereto.

[0200] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0201] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network element verification method, characterized in that: Applied to a software defined network (SDN) controller, the method comprises: Sending a security verification request to the network element to be verified; receiving a first security metric value fed back by the network element to be verified based on the security verification request, and performing security verification on the network element to be verified according to the first security metric value; When the security verification result is that the verification is passed, the network element to be verified is determined as a secure network element belonging to the trust domain.

2. The method according to claim 1, characterized in that The performing security verification on the network element to be verified according to the first security metric value includes: Obtaining a first security reference value corresponding to the network element to be verified; Perform security verification on the network element to be verified according to the first security reference value and the first security metric value.

3. The method according to claim 2, characterized in that The performing security verification on the network element to be verified according to the first security reference value and the first security metric value includes: comparing the first safety reference value and the first safety metric value; If the first security reference value and the first security metric value are the same, determining that the security verification result of the network element to be verified is verification passed; If the first security reference value and the first security metric value are different, it is determined that the security verification result of the network element to be verified is verification failure.

4. The method according to claim 2, characterized in that: The obtaining of the first security reference value corresponding to the network element to be verified includes: Based on the network element identifier of the network element to be verified, obtaining a first security reference value corresponding to the network element to be verified from a reference value database; The reference value database stores a candidate security reference value corresponding to at least one candidate network element, and the at least one candidate network element includes the network element to be verified.

5. The method according to claim 4, characterized in that The reference value database further stores a second security reference value corresponding to the SDN controller, and the sending of a security verification request to the network element to be verified includes: When the second security metric value corresponding to the SDN controller is the same as the second security reference value, a security verification request is sent to the network element to be verified.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: If the security verification result is that the verification fails, the network element to be verified is determined as a network element with questionable security; Performing secondary verification on the network element with questionable security according to the network element parameter information of the network element to be verified; When the secondary verification result is that the verification is passed, the security-questionable network element is determined as a secure network element belonging to the trust domain.

7. A network element verification device, characterized in that: Configured in a software defined network SDN controller, the device includes: A sending module, used for sending a security verification request to the network element to be verified; A receiving module, configured to receive a first security metric value fed back by the network element to be verified based on the security verification request, and perform security verification on the network element to be verified according to the first security metric value; The determination module is used to determine the network element to be verified as a secure network element belonging to the trust domain when the security verification result is that the verification is passed.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images