Park network security area isolation method based on flow authorization label verification

Abstract

The invention relates to a park network security area isolation method based on flow authorization label verification, and belongs to the technical field of network security research. A secure area isolation application of a park network based on flow authorization label verification is developed in an SDN controller, a user database is established by collecting user information of the park network, a unique authorization code is generated for each user, and meanwhile, a secure area range allowed to be accessed by the user in the park network is delimited for the user; the SDN control issues an access control flow table based on flow authorization label verification to the access switch after sensing user access, and the access switch performs access control on communication of the user in the specified security area according to the flow table, so that a guarantee is provided for preventing the user from illegally crossing the security area to access resources of the park network in the park network.

Description

Technical Field

[0001] The invention relates to a campus network security area isolation method based on flow authorization label verification, and belongs to the technical field of network security research. Background Art

[0002] Campus network usually refers to the campus network of a university and the intranet of an enterprise. In the campus network, security areas are usually divided according to the importance of protection. Different security areas correspond to network resources with different security levels. The traffic between security areas must be strictly controlled. Only allowed traffic can enter the corresponding security area. This can avoid malicious traffic attacks to a certain extent and ensure the healthy and stable operation of the campus network. At present, the isolation of traffic between security areas can only be achieved by pre-configuring a large number of access control rules on key network devices by administrators. Administrators need to have a large amount of information about users and the resources they want to access in order to specify accurate access control rules, which makes this work time-consuming and laborious.

[0003] Therefore, how to automatically send access control flow tables carrying user authorization information to network devices in the campus network, and at the same time, how network devices add or verify authorization information to data packets generated by campus network users to achieve campus network security area traffic isolation based on flow authorization label verification, is an urgent problem to be solved in campus network security. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a campus network security area isolation method based on flow authorization label verification, which implements security area isolation based on flow authorization label verification under the campus network access switch, and provides an economical and efficient method for authorizing secure access to campus network resources. The method generates a unique flow authorization label function for each user in the campus network in the SDN controller, and the SDN controller sends a flow table to the access switch to add and verify the flow authorization label for communication between users, thereby achieving the goal of authorizing secure access to campus network resources.

[0005] Specifically, a campus network security zone isolation application based on flow authorization tag verification is developed in the SDN controller. By collecting campus network user information, a user database is established, and a unique authorization code is generated for each user. At the same time, the security zone range that the user is allowed to access in the campus network is defined for the user. After sensing user access, the SDN control sends an access control flow table based on flow authorization tag verification to the access switch. The access switch performs access control on user communications in the designated security zone based on the flow table, which provides a guarantee for preventing users from illegally crossing security zones to access campus network resources in the campus network.

[0006] The technical solution of the present invention is as follows:

[0007] A campus network security zone isolation method based on flow authorization tag verification, the steps are as follows:

[0008] (1) Create a campus network user information table in the SDN controller system;

[0009] (2) The access hosts communicate with each other through switches to create a communication flow table;

[0010] (3) After the switch receives the ARP request message sent by the host, it submits it to the SDN controller system through the openflow protocol;

[0011] (4) The SDN controller system extracts the MAC address and IP address of the communication initiating host from the ARP request message information, scans and updates the campus network user information table;

[0012] (5) The SDN controller system extracts the destination host IP address from the ARP request message and scans the campus network user information table;

[0013] (6) Using the user ID in the table entry recorded in step (5), scan the list of resources that the user is allowed to access in the table entry recorded in step (4), and create a communication flow table based on the matching records;

[0014] (7) The SDN controller system sends the communication flow table to the access switch;

[0015] (8) After the access switch receives the communication data flow entering the switch, it compares it with the matching items in the communication flow table. After matching, it performs vxlan tunnel encapsulation according to the action items;

[0016] (9) When forwarding communication data, the access switch compares it with the matching items in the communication flow table. If a match is found, the flow label is removed according to the action item and the message is forwarded out of the port.

[0017] Preferably, according to the present invention, in step (1), the user information table includes user ID, host IP address, host MAC address, user name, user unit, user flow authorization tag ID, user allowed access to resources list, vxlan tunnel number and user access port number, wherein user ID is the current user's unique identifier, host IP address is the IP address assigned to the current user in the campus network, host MAC address is the current host network card's unique identifier, user name is the current user's name, user unit is the current user's unit name, user authorization tag ID is the network-wide unique flow authorization tag information generated by the system for the current user, the user allowed access to resources list is the set of user IDs that the current user in the campus network is allowed to access, vxlan tunnel number is the tunnel number through which the current user communicates with the target host through the vxlan tunnel, and the user access port number is the access switch interface number to which the user host is connected. The initialized campus network user information table is entered into the system by the administrator through the web interface.

[0018] According to the preferred embodiment of the present invention, in step (2), the communication flow table includes two parts: a matching item and an action item. The matching item is used to match key information in the data flow. After matching, the action item is executed to modify and forward the flow.

[0019] The matching item includes several optional fields: flow table number, source host MAC address, source host IP address, destination host MAC address, destination host IP address, flow authorization tag ID, and interface number;

[0020] The action item includes several optional fields: add flow authorization tag ID, remove flow authorization tag ID, and forwarding port number;

[0021] Among them, the flow table number is the unique identifier of the current table entry, the source host MAC address is the network card MAC address of the host initiating the communication, the source host IP address is the IP address of the host initiating the communication, the destination host MAC address is the network card MAC address of the host to be accessed for communication, the destination host IP address is the IP address of the host to be accessed, the flow authorization tag ID is the flow label embedded in the data flow that matches the interface number, the interface number for the data entering or leaving the switch, the flow authorization tag ID for adding is the flow authorization tag ID added to the data flow, the flow authorization tag removal identifier is the need to remove the flow authorization tag in the data flow after the access switch matches the table entry, the forwarding port number is the port number for forwarding the data flow, and the user communication flow table is initialized to be empty.

[0022] Preferably, according to the present invention, in step (3), the protocol also carries the access switch port number of the ARP request message.

[0023] Preferably, in step (4), specifically, the SDN controller system extracts the MAC address of the communication initiating host from the Sender Mac Address field in the ARP request message and the IP address of the communication initiating host extracted from the Sender IP address field in the message, scans the campus network user information table, and records the contents of the hit campus network user information table entry. At the same time, the access switch port number obtained in step (3) is used to update the user access port number in the table entry.

[0024] Preferably, in step (5), the SDN controller system extracts the target host IP address in the Target IP Address field in the ARP request message, scans the campus network user information table, and records the content of the hit campus network user information table entry;

[0025] Preferably, in step (6), specifically, the user ID in the table item recorded in step (5) is used to scan the user's allowed access resource list in the table item recorded in step (4), and if there is no match, step (6.1) is executed; if there is a match, steps (6.2) and (6.3) are executed;

[0026] (6.1): Record the log information that the current user cannot access the target user, and return to step (3) to continue execution;

[0027] (6.2): ​​Create a user communication flow table with a flow label added, use the host IP address, host MAC address and user access port number in the table item recorded in step (4), and the host IP address and host MAC address of the table item recorded in step (5), fill in the source host MAC address, source host IP address, destination host MAC address, destination host IP address and interface number of the matching item in the table item, and use the user flow authorization tag ID and vxlan tunnel number of the table item recorded in step (4) in the action item, fill in the added flow authorization tag ID and vxlan tunnel number;

[0028] (6.3): Create a user communication flow table for verifying the flow label. Use the host IP address, host MAC address and user flow authorization label ID in the table item recorded in step (4), and the host IP address and host MAC address of the table item recorded in step (5) to fill in the source host MAC address, source host IP address, destination host MAC address, destination host IP address and flow authorization label ID of the matching item in the table item. The action item uses the user access port number of the table item recorded in step (5) to fill in the forwarding port number, and sets the remove flow authorization label flag.

[0029] Preferably, according to the present invention, in step (7), specifically, the SDN controller system sends the communication flow table generated in step (6.2) and step (6.3) to the access switch.

[0030] According to a preferred embodiment of the present invention, in step (8), specifically, after the access switch receives the communication data flow entering the switch, it matches the communication flow table (S mac +S ip +D mac +D ip +I port ) for comparison;

[0031] Among them, S mac Indicates the MAC address of the source host of the communication data flow, S ip Indicates the source host IP address of the communication data flow, D mac Indicates the MAC address of the destination host of the communication data flow, D ip Indicates the destination host IP address of the communication data flow, I port Indicates the interface number when the communication data stream enters the switch;

[0032] After matching, the action item (F id +V id ) performs vxlan tunnel encapsulation, where F id Indicates the user flow authorization tag ID, V id Indicates the vxlan tunnel identifier to be encapsulated, and F id Fill in the VNID field of the vxlan tunnel.

[0033] According to a preferred embodiment of the present invention, in step (9), specifically, when the access switch forwards the communication data, it matches the communication flow table (S mac +S ip +D mac +D ip +F id ) to compare, and after matching, according to the action item (M id +O port ) removes the flow label, where M id Indicates that the flow authorization tag flag is removed. 1 indicates that it is set, 0 indicates that it is not set, and O port Indicates the number of the interface through which the message is forwarded from the switch, and forwards the message from port O port Forward it.

[0034] The beneficial effects of the present invention are:

[0035] The present invention realizes security zone isolation based on flow authorization tag verification under the campus network access switch, and provides an economical and efficient method for authorizing secure access to campus network resources. The method generates a unique flow authorization tag function for each user in the campus network in the SDN controller, and the SDN controller sends a flow table to the access switch to add and verify the flow authorization tag for communication between users, thereby achieving the goal of authorizing secure access to campus network resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of a connection topology according to an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of the architecture of a campus network security isolation system based on flow authorization tag verification according to an embodiment of the present invention;

[0038] Figure 3 This is a schematic diagram of the campus network user information representation in an embodiment of the present invention;

[0039] Figure 4 The user communication flow of the embodiment of the present invention is shown schematically;

[0040] Figure 5 Schematic diagram of a flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0041] The present invention will be further described below by way of embodiments in conjunction with the accompanying drawings, but is not limited thereto.

[0042] Embodiment 1:

[0043] like Figure 5 As shown, this embodiment provides a campus network security zone isolation method based on flow authorization tag verification, and a connection topology diagram of campus network security zone isolation based on flow authorization tag verification is shown in Figure 1 , the top shows the location of the SDN controller in the network. The SDN controller is used to manage network traffic and configuration rules, generate a unique flow authorization label function for each user in the campus network, and send a flow table to the access switch to add and verify the flow authorization label for communication between users, so as to achieve the goal of authorizing secure access to campus network resources; the bottom shows the connection between the switch and the terminal device (i.e., the host). The terminal device accesses the switch through the port, and the switches are interconnected through tunnels to achieve cross-network area communication. The core of this structure is to use the SDN controller to achieve fine control of the access network, ensure the isolation of the network's security area, and provide real-time defense against potential security threats.

[0044] The isolation method steps are as follows:

[0045] S100: The SDN controller system creates a campus network user information table and configures initial values. The campus network user information table is as follows: Figure 3 As shown, it includes user ID, host IP address, host MAC address, user name, user unit, user flow authorization tag ID, user allowed access to resource list, vxlan tunnel number and user access port number.

[0046] S200: The access switch creates a user communication flow table and configures initial values. The user communication flow table is as follows: Figure 4 As shown, it includes table item one, the matching items are source MAC, source IP, target MAC, target IP, and ingress port. The Vxlan tunnel is encapsulated according to the action item Vxlan tunnel number and flow authorization tag ID, and the flow authorization tag ID is added to the VNID field of the tunnel; table item two, the matching items are source MAC, source IP, target MAC, target IP, and flow authorization tag ID. The flow authorization tag ID and egress port are removed according to the action item, the flow label is removed, and the message is forwarded from the egress port.

[0047] S300: The access switch sends the ARP request message sent by the host and the access switch interface number of the received message to the SDN controller system;

[0048] S400: The SDN controller system scans the campus network user information table according to the origin host information in the ARP request message received in step S300, records the matching table entry, and updates the recorded user access port number field according to the access switch interface number obtained in step S300;

[0049] S500: The SDN controller system scans the campus network user information table according to the target host information in the ARP request message received in step S300, and records the table entry content;

[0050] S600: According to the user ID recorded in the table item in step S500, scan the user's allowed access resource list in the table item in S400, if there is no match, execute step S601, if there is a match, execute S602 and step S603;

[0051] S601: record log information and return to step S300 to continue execution;

[0052] S602: Create a user communication flow table with a flow authorization tag added, and fill in the table entries according to the information obtained in step S400 and step S500;

[0053] S603: Create a user communication flow table that deletes the flow authorization tag, and fill in the table entries according to the information obtained in step S400 and step S500;

[0054] S700: The SDN controller system sends the table entries generated in step S602 and step S603 to the access switch;

[0055] S800: When the access switch receives the communication data flow entering the switch, it matches it with the matching items in the communication flow table. After the match is successful, the flow authorization tag is added to the vxlan according to the action item and forwarded;

[0056] S900: When forwarding communication data, the access switch matches the matching items in the flow table. After the match succeeds, the flow authorization tag is removed according to the action item and the data is forwarded from a specific port.

[0057] The schematic diagram of the campus network security isolation system architecture based on flow authorization tag verification is shown in Figure 2 The basic design idea is as follows: it is mainly composed of five parts: front-end display layer, access control layer, front-end application layer, service layer and data layer. Among them, the front-end display layer is the carrier of the flow authorization tag access control system, including access devices and their front-end architecture to realize data transmission and result display; the access control layer uses a series of agents and gateway execution programs to realize the interaction between the front and back ends; the front-end application layer deploys a variety of practical functions for user access needs; the service layer implements the flow authorization tag access control logic through the RYU controller and the Django background application; the data layer network equipment and user information data are obtained by the upper layer. Through the detailed design of each layer module, the front end calls an API interface through the front-end and back-end interaction of the access control layer to reach the functional module of the front-end application layer, and then uses the service layer background application to reach the data layer to find relevant data information, and then aggregates the query results to the front-end display layer for users to view.

[0058] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A campus network security zone isolation method based on flow authorization tag verification, characterized in that: Here are the steps: (1) Create a campus network user information table in the SDN controller system; (2) The access hosts communicate with each other through switches to create a communication flow table; (3) After the switch receives the ARP request message sent by the host, it submits it to the SDN controller system through the protocol; (4) The SDN controller system extracts the MAC address and IP address of the communication initiating host from the ARP request message information, scans and updates the campus network user information table; (5) The SDN controller system extracts the destination host IP address from the ARP request message and scans the campus network user information table; (6) Using the user ID in the table entry recorded in step (5), scan the list of resources that the user is allowed to access in the table entry recorded in step (4), and create a communication flow table based on the matching records; (7) The SDN controller system sends the communication flow table to the access switch; (8) After the access switch receives the communication data flow entering the switch, it compares it with the matching items in the communication flow table. After matching, it performs vxlan tunnel encapsulation according to the action items; (9) When the access switch forwards communication data, it compares it with the matching items in the communication flow table. If a match is found, the flow label is removed according to the action item and the message is forwarded out of the port.

2. The campus network security area isolation method based on flow authorization tag verification as described in claim 1 is characterized in that: In step (1), the user information table includes user ID, host IP address, host MAC address, user name, user unit, user flow authorization tag ID, user allowed access resource list, vxlan tunnel number and user access port number, wherein user ID is the unique identifier of the current user, host IP address is the IP address assigned to the current user in the campus network, host MAC address is the unique identifier of the current host network card, user name is the current user name, user unit is the unit name of the current user, user authorization tag ID is the network-wide unique flow authorization tag information generated by the current user, the user allowed access resource list is the user ID set that the current user is allowed to access in the campus network, vxlan tunnel number is the tunnel number through which the current user communicates with the target host through the vxlan tunnel, and the user access port number is the access switch interface number to which the user host is connected.

3. The campus network security area isolation method based on flow authorization tag verification as described in claim 2 is characterized in that: In step (2), the communication flow table includes two parts: matching items and action items. The matching items are used to match key information in the data flow. After matching, the action items are executed to modify and forward the flow. The matching item includes several optional fields: flow table number, source host MAC address, source host IP address, destination host MAC address, destination host IP address, flow authorization tag ID, and interface number; The action item includes several optional fields: add flow authorization tag ID, remove flow authorization tag ID, and forwarding port number; Among them, the flow table number is the unique identifier of the current table entry, the source host MAC address is the network card MAC address of the host initiating the communication, the source host IP address is the IP address of the host initiating the communication, the destination host MAC address is the network card MAC address of the host to be accessed for communication, the destination host IP address is the IP address of the host to be accessed, the flow authorization tag ID is the flow label embedded in the data flow that matches the interface number, the interface number for the data entering or leaving the switch, the flow authorization tag ID for adding is the flow authorization tag ID added to the data flow, the flow authorization tag removal identifier is the need to remove the flow authorization tag in the data flow after the access switch matches the table entry, the forwarding port number is the port number for forwarding the data flow, and the user communication flow table is initialized to be empty.

4. The campus network security area isolation method based on flow authorization tag verification as described in claim 3 is characterized in that: In step (3), the protocol also carries the access switch port number of the ARP request message.

5. The campus network security area isolation method based on flow authorization tag verification as described in claim 4 is characterized in that: In step (4), specifically, the SDN controller system extracts the MAC address of the communication initiating host and the IP address of the communication initiating host from the ARP request message, scans the campus network user information table, records the content of the hit campus network user information table entry, and at the same time, uses the access switch port number obtained in step (3) to update the user access port number in the table entry.

6. The campus network security area isolation method based on flow authorization tag verification as described in claim 5 is characterized in that: In step (5), specifically, the SDN controller system extracts the target host IP address in the ARP request message, scans the campus network user information table, and records the content of the hit campus network user information table entry.

7. The campus network security area isolation method based on flow authorization tag verification as described in claim 6 is characterized in that: In step (6), specifically, the user ID in the table item recorded in step (5) is used to scan the list of resources that the user is allowed to access in the table item recorded in step (4). If there is no match, step (6.1) is executed. If there is a match, steps (6.2) and (6.3) are executed. (6.1): Record the log information that the current user cannot access the target user, and return to step (3) to continue execution; (6.2): ​​Create a user communication flow table with a flow label added, use the host IP address, host MAC address and user access port number in the table item recorded in step (4), and the host IP address and host MAC address of the table item recorded in step (5), fill in the source host MAC address, source host IP address, destination host MAC address, destination host IP address and interface number of the matching item in the table item, and use the user flow authorization tag ID and vxlan tunnel number of the table item recorded in step (4) in the action item, fill in the added flow authorization tag ID and vxlan tunnel number; (6.3): Create a user communication flow table for verifying the flow label. Use the host IP address, host MAC address and user flow authorization label ID in the table item recorded in step (4), and the host IP address and host MAC address of the table item recorded in step (5) to fill in the source host MAC address, source host IP address, destination host MAC address, destination host IP address and flow authorization label ID of the matching item in the table item. The action item uses the user access port number of the table item recorded in step (5) to fill in the forwarding port number, and sets the remove flow authorization label flag.

8. The campus network security area isolation method based on flow authorization tag verification as described in claim 7 is characterized in that: In step (7), specifically, the SDN controller system sends the communication flow table generated in step (6.2) and step (6.3) to the access switch.

9. The campus network security area isolation method based on flow authorization tag verification as claimed in claim 8 is characterized in that: In step (8), specifically, after the access switch receives the communication data flow entering the switch, it matches the communication flow table (S mac +S ip +D mac +D ip +I port ) for comparison; Among them, S mac Indicates the MAC address of the source host of the communication data flow, S ip Indicates the source host IP address of the communication data flow, D mac Indicates the MAC address of the destination host of the communication data flow, D ip Indicates the destination host IP address of the communication data flow, I port Indicates the interface number when the communication data stream enters the switch; After matching, the action item (F id +V id ) performs vxlan tunnel encapsulation, where F id Indicates the user flow authorization tag ID, V id Indicates the vxlan tunnel identifier to be encapsulated, and F id Fill in the VNID field of the vxlan tunnel.

10. The campus network security area isolation method based on flow authorization tag verification as claimed in claim 9, characterized in that: In step (9), specifically, when the access switch forwards the communication data, it matches the communication flow table (S mac +S ip +D mac +D ip +F id ) to compare, and after matching, according to the action item (M id +O port ) removes the flow label, where M id Indicates that the flow authorization tag flag is removed. 1 indicates that it is set, 0 indicates that it is not set, and O port Indicates the number of the interface through which the message is forwarded from the switch, and forwards the message from port O port Forward it.

Images