Intrusion prevention method and system based on block chain, electronic equipment and storage medium

Abstract

The invention provides an intrusion prevention method and system based on a block chain, electronic equipment and a storage medium, which are suitable for an SDN cloud network controller, and are characterized in that when a broadcast request sent by a target controller is detected, the broadcast request is verified through an LPBFT algorithm, and when verification fails, a defense stage is entered; meanwhile, the controller with the highest trust value in the SDN cloud network controllers is determined as a main controller; in the defense stage, whether the target controller breaks down or not is judged through the main controller; if it is determined that the target controller does not fail, determining an attack type of the target controller, and performing attack type matching defense operation on each slave controller through the master controller; and if it is determined that the target controller breaks down, or after attack type matching defense operation is carried out on each slave controller, corresponding migration operation is carried out on each switch managed by the controller through the master controller.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to an intrusion defense method, system, electronic device, and storage medium based on blockchain. Background Art

[0002] In recent years, with the acceleration of cloudification of bank data centers, traditional network technology architecture has been challenged: on the one hand, the emergence of virtualization ideas has overturned the original data center network model, resulting in traditional network technology being insufficient to adapt to new scenarios generated in the cloud environment. For example, the emergence of virtual machines requires the network granularity to be refined from the physical machine level to the virtual machine level; on the other hand, the rapid development of Internet-oriented financial innovation services will also place higher demands on network performance, elasticity and other characteristics. Among them, Software Defined Network (SDN) technology separates the data plane and the control plane in the network through the concept of distributed architecture, thereby achieving flexible control of network traffic and providing a good platform for core network and application innovation. It is in line with the development trend of bank cloud networks and is an effective supporting technology for realizing bank cloud network services. SDN has been implemented in many commercial banking institutions such as Industrial and Commercial Bank of China and Postal Savings Bank of China.

[0003] However, the controller layer, as the core of SDN, controls the view of the entire network and translates upper-layer decisions into forwarding rules on the data plane. It acts like the brain of the network, but it has also become the focus of network attacks. Most of the current security solutions for SDN cloud network controllers are prone to single point failures due to centralized control, and these solutions are basically aimed at single security issues without considering the overall control layer.

[0004] Therefore, how to provide an intrusion defense method for the control layer of the SDN cloud network controller to avoid single point failure, and to consider the control layer as a whole to achieve intrusion defense of the SDN cloud network controller is a problem that urgently needs to be solved in this application. Summary of the invention

[0005] In view of this, the present application provides a blockchain-based intrusion defense method, system, electronic device and storage medium to avoid single point failures and consider the control layer as a whole to achieve intrusion defense of the SDN cloud network controller.

[0006] The first aspect of the present application provides a blockchain-based intrusion prevention method, which is applicable to an SDN cloud network controller. The method includes:

[0007] When a broadcast request sent by the target controller is detected, the broadcast request is verified by the LPBFT algorithm, and when the verification fails, the defense phase is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller;

[0008] In the defense stage, determining by the main controller whether the target controller fails;

[0009] If it is determined that the target controller has not failed, determine the attack type of the target controller, and perform defense operations matching the attack type on each slave controller through the master controller; wherein the slave controller is a controller other than the master controller and the target controller in the SDN cloud network controller;

[0010] If it is determined that the target controller fails, or after a defense operation matching the attack type is performed on each slave controller, a corresponding migration operation is performed on each switch managed by the controller through the master controller.

[0011] Optionally, when a broadcast request sent by the target controller is detected, the broadcast request is verified by using an LPBFT algorithm, and when the verification fails, a defense phase is entered, and a controller with the highest trust value in the SDN cloud network controller is determined as a main controller, including:

[0012] When a broadcast request of the target controller is detected, the broadcast request is forwarded to an initial controller; the initial controller is a controller other than other controllers in the SDN cloud network controller; the other controllers are controllers in the SDN cloud network controller other than the target controller and the initial controller;

[0013] When the preparation message is successfully matched by the initial controller, a target preparation message is generated according to the preparation message and the identity information of the initial controller, and the preparation message is distributed to each other controller;

[0014] verifying, by each of the other controllers, the target preparation message;

[0015] If each of the other controllers passes the verification, a corresponding response is fed back to the target controller, so that the target controller stores the response values ​​fed back by each of the other controllers in the local block;

[0016] If any of the other controllers fails the verification, the defense phase is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller.

[0017] Optionally, in the defense stage, determining by the main controller whether the target controller fails includes:

[0018] Controlling the target controller to send transmission information to the main controller;

[0019] Acquire the transmission delay of the transmission information through the main controller, and determine whether the transmission delay of the transmission information is greater than a preset maximum delay;

[0020] If the transmission delay of the transmission information is greater than the maximum delay, it is determined that the transmission of the transmission information fails, and it is determined that the target controller fails.

[0021] Optionally, in the defense stage, determining by the main controller whether the target controller fails includes:

[0022] In the defense phase, the master controller receives controller timeout information sent by each slave controller to the target controller;

[0023] If it is determined that the number of controllers that sent the controller timeout information exceeds a preset number, the master controller contacts the target controller based on any one of the slave controllers;

[0024] If the target controller cannot be contacted, it is determined that the target controller fails.

[0025] Optionally, the performing corresponding migration operations on each switch managed by the target controller by the main controller includes:

[0026] Acquire a set of out-of-control switches through the main controller, wherein the set of out-of-control switches includes each switch managed by the target controller;

[0027] Determine the switch network domain by the main controller based on the sub-network domain clustering algorithm according to preset control parameters and the set of out-of-control switches;

[0028] By means of the master controller, based on the migration controller, the switch network domain is divided from each of the slave controllers into a controller set of each switch managed by the target controller;

[0029] The main controller determines a controller matching each switch managed by the target controller from the controller set based on a migration control algorithm, and migrates each switch to the controller matching it.

[0030] The second aspect of the present application provides a blockchain-based intrusion prevention system, which is applicable to an SDN cloud network controller, and the system includes:

[0031] A verification unit, configured to verify the broadcast request sent by the target controller by using an LPBFT algorithm when the broadcast request is detected, and to enter a defense phase when the verification fails, and to determine the controller with the highest trust value in the SDN cloud network controller as a main controller;

[0032] a judgment unit, used for judging whether the target controller fails by the main controller in the defense stage;

[0033] A defense unit, configured to determine the attack type of the target controller if it is determined that the target controller has not failed, and perform defense operations matching the attack type on each slave controller through the master controller; wherein the slave controller is a controller other than the master controller and the target controller in the SDN cloud network controller;

[0034] The migration unit is used to perform corresponding migration operations on each switch managed by the controller through the master controller if it is determined that the target controller fails, or after performing defense operations matching the attack type on each slave controller.

[0035] Optionally, the verification unit includes:

[0036] a forwarding unit, configured to forward the broadcast request to an initial controller when a broadcast request of the target controller is detected; the initial controller is a controller other than other controllers in the SDN cloud network controller; the other controllers are controllers in the SDN cloud network controller;

[0037] a broadcast unit, configured to generate a target preparation message according to the preparation message and the identity information of the initial controller when the preparation message is successfully matched by the initial controller, and distribute the preparation message to each other controller;

[0038] a verification subunit, configured to verify the target preparation message through each of the other controllers;

[0039] A storage unit, configured to feed back a corresponding response to the target controller if each of the other controllers passes the verification, so that the target controller stores the responses fed back by each of the other controllers in a local block;

[0040] The sending unit is used to enter the defense phase if any of the other controllers fails verification, and at the same time determine the controller with the highest trust value in the SDN cloud network controller as the main controller.

[0041] Optionally, the judging unit includes:

[0042] A transmission information sending unit, used for controlling the target controller to send transmission information to the main controller;

[0043] A determination subunit, configured to obtain a transmission delay of the transmission information through the main controller, and determine whether the transmission delay of the transmission information is greater than a preset maximum delay;

[0044] The first determining unit is configured to determine that the transmission of the transmission information fails if the transmission delay of the transmission information is greater than the maximum delay, and to determine that a failure occurs in the target controller.

[0045] The third aspect of the present application provides an electronic device, comprising: a processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; and the memory is used to store a program, wherein the program is used to implement the blockchain-based intrusion defense method provided in the first aspect of the present application.

[0046] The fourth aspect of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored, and the computer-executable instructions are used to execute the blockchain-based intrusion defense method provided in the first aspect of the present application.

[0047] The present application provides an intrusion defense method, system, electronic device and storage medium based on blockchain, which are applicable to SDN cloud network controllers. When a broadcast request sent by a target controller is detected, the broadcast request is verified by the LPBFT algorithm, and when the verification fails, the defense phase is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller; in the defense phase, the main controller is used to determine whether the target controller fails; if it is determined that the target controller has not failed, the attack type of the target controller is determined, and the main controller is used to perform defense operations matching the attack type on each slave controller; wherein, the slave controller is a controller other than the main controller and the target controller in the SDN cloud network controller. If it is determined that the target controller fails, or after performing defense operations matching the attack type on each slave controller, the main controller is used to perform defense operations matching the attack type on each slave controller. The controller performs corresponding migration operations on each switch managed by the controller; it can be seen that the technical solution provided by the present application uses the LPBFT algorithm to verify the target controller for the requested broadcast, and can promptly detect whether there is a controller that is currently faulty or attacked; and, in the case of determining that there is currently an attacked target controller, for specific intrusion behaviors and single point failure problems, and taking into account that the attacker may turn to traffic attacks to exhaust the network resources of the controller after the intrusion fails, making the SDN cloud network controller unable to provide services normally, the master controller can be used to perform defense operations matching the attack type on each slave controller, and the master controller can be used to perform corresponding migration operations on each switch managed by the controller, so as to achieve effective isolation of the problematic controller, thereby realizing intrusion defense of the SDN cloud network controller. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0049] Figure 1 A flowchart of a blockchain-based intrusion prevention method provided in an embodiment of the present application;

[0050] Figure 2 An example diagram of a control plane workflow of an SDN cloud network controller provided in an embodiment of the present application;

[0051] Figure 3 An example diagram of using the LPBFT algorithm to broadcast messages between controllers provided in an embodiment of the present application;

[0052] Figure 4A schematic diagram of a DDoS attack principle provided in an embodiment of the present application;

[0053] Figure 5 A schematic diagram of the structure of another blockchain-based intrusion prevention system provided in an embodiment of the present application;

[0054] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0056] In this application, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0057] In order to better understand this application, the technical names involved in this application are explained below:

[0058] Blockchain: In a narrow sense, blockchain is a chain data structure that combines data blocks in a sequential manner in chronological order, and a distributed ledger that is cryptographically guaranteed to be tamper-proof and unforgeable. In a broad sense, blockchain technology is a new distributed infrastructure and computing paradigm that uses a block chain data structure to verify and store data, a distributed node consensus algorithm to generate and update data, cryptography to ensure the security of data transmission and access, and smart contracts composed of automated script codes to program and operate data.

[0059] Software Defined Network (SDN): A new network innovation architecture proposed by the Clean-Slate research group of Stanford University in the United States. It is a way to implement network virtualization. Its core technology OpenFlow separates the control plane and data plane of network devices, thereby achieving flexible control of network traffic, making the network more intelligent, and providing a good platform for innovation of core networks and applications.

[0060] Practical Byzantine Fault Tolerance (PBFT): An algorithm that achieves consensus in a distributed system under the Byzantine fault model. PBFT was proposed by Castro and Liskov in 1999. It is a special processor mechanism that enables a distributed system to operate normally and reach consensus in the presence of malicious behavior. PBFT is widely used in various applications that use the Byzantine fault tolerance model, such as the consensus algorithm in blockchain.

[0061] Distributed Denial of Service (DDoS): Multiple attackers in different locations simultaneously attack one or more targets, or an attacker controls multiple machines in different locations and uses them to attack the victim simultaneously. Since the attack originates from different places, this type of attack is called a distributed denial of service attack, in which there can be multiple attackers.

[0062] Smart Contract: A special protocol designed to provide, verify and execute contracts. Specifically, smart contracts are an important reason why blockchain is called "decentralized" and allow us to perform traceable, irreversible and secure transactions without the need for a third party. Smart contracts contain all the information about the transaction and will only execute the resulting actions after the requirements are met. The difference between smart contracts and traditional paper contracts is that smart contracts are computer-generated. Therefore, the code itself explains the relevant obligations of the parties involved.

[0063] From the above background technology, it can be seen that the rapid development of Internet finance in recent years has posed a strong impact on traditional banks, and has also promoted traditional banks to accelerate the pace of transformation towards financial technology. At present, many commercial banks have clarified the development direction of "financial technology banks", aiming to achieve business networking, online, digital and intelligent through technological changes such as the Internet, cloud computing, big data, artificial intelligence, and blockchain, improve the efficiency of financial services, and provide customers with inclusive, personalized and intelligent services. The transformation process urgently needs a new infrastructure to match it: the business requires rapid deployment and online, and can be unrestricted by physical location; the business is flexibly deployed and can dynamically adjust resources according to load conditions; the infrastructure must be able to support business innovation and achieve rapid changes; and it can quickly diagnose and locate faults when they occur.

[0064] In the face of these problems, the banking industry needs to break through traditional thinking and use virtual pooling technologies such as computing virtualization, network virtualization, and storage virtualization to promote the transformation of traditional data centers to cloud data centers. The most obvious feature of cloud data centers is the extensive application of virtual pooling technology. The earliest developed computing virtualization technology has become popular, solving the pain points of low computing resource utilization in data centers, high operation and maintenance costs, and conflicts between multiple business applications. The large-scale application of computing virtual pooling has put forward new requirements for the network, such as large-scale Layer 2 interconnection of the network, isolation of multiple tenants and multiple services, secure mutual access of services within a single tenant, and automatic visualization of network configuration. Network virtual pooling is mainly achieved through SDN technology.

[0065] SDN technology has the following advantages: automation, which enables on-demand allocation of virtual network resources and flexible delivery of services; service decoupling, which enables decoupling of virtual and physical networks, especially decoupling of network locations, and flexible scheduling of resources over a large range; it carries multiple services while achieving isolation and control between services; it is programmable, so that the network can quickly implement business logic and personalized network control; and it separates forwarding and control, so that the data forwarding layer focuses on data forwarding, and the controller focuses on data forwarding logic, shielding the underlying complexity.

[0066] As the core component of the SDN cloud network controller, the control plane plays a connecting role. It uses the northbound interface to interact with various applications and uses the southbound interface to communicate with the switch of the data plane. The security of the control plane is directly related to the stability and reliability of the entire SDN cloud network controller. Although the hierarchical multi-controller distribution architecture of the SDN cloud network controller has reduced the single point failure risk of the controller to a certain extent, the security of each SDN domain of the SDN cloud network controller cannot be effectively guaranteed. The regional controller still faces security threats such as illegal intrusion and DDoS attacks.

[0067] In order to improve the overall security and efficiency of the SDN control plane, the present application provides a blockchain-based intrusion defense method, system, electronic device and storage medium, which can use the LPBFT algorithm to verify the target controller of the requested broadcast, and can promptly detect whether there is a controller that is currently faulty or attacked; at the same time, smart contract technology is used to deal with such security risks, that is, the master controller performs defense operations on each slave controller that match the attack type; considering the possible loss of control or failure of the controller, the master controller can perform corresponding migration operations on each switch managed by the controller, which not only ensures the shortest communication delay between the switch and the migrated controller, but also avoids the load oscillation problem on the controller side, thereby improving the fault recovery efficiency.

[0068] See also Figure 1 , shows a flow chart of a blockchain-based intrusion defense method provided in an embodiment of the present application, the method is applicable to an SDN cloud network controller, and the method specifically includes the following steps:

[0069] S101: When a broadcast request sent by a target controller is detected, the broadcast request is verified by the LPBFT algorithm, and when the verification fails, the defense phase is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller.

[0070] In the embodiment of the present application, the LPBFT algorithm is a lightweight consensus algorithm based on the blockchain practical Byzantine fault tolerance (PBFT) algorithm. This algorithm makes up for the shortcomings of traditional PBFT, namely, low consensus efficiency, poor self-healing, insufficient anti-destruction, etc. By simplifying the PBFT consensus process, message transmission and verification are carried out in parallel, and requests are graded to ensure that emergency requests can be processed quickly and efficiently.

[0071] Specifically, the process of verifying the broadcast request through the LPBFT algorithm can be as follows: when there is a target controller that wants to broadcast a request to other controllers, the broadcast request is verified by each other controller in the SDN cloud network controller; if other controllers confirm that the verification of the broadcast request is passed, that is, the target controller is determined to be valid, then continue to process the official blog request and send a corresponding reply to the target controller. When the target controller receives multiple replies with the same result (the result of the request operation) from different other controllers, it writes each received reply into the local block to calculate the trust value and weight of each controller. Otherwise, it will enter the defense phase and stop processing the broadcast request; at the same time, the controller with the highest trust value in the SDN cloud network controller is used as the main controller, and the main controller leads the ordinary controllers (controllers other than the main controller and the target controller) to resist the influence of the bad controller (target controller); after the defense phase, the trust value of the target controller can be cleared and the next view can be restarted.

[0072] It should be noted that the target controller and other controllers are all controllers under the SDN cloud network controller. For each controller under the SDN cloud network controller, when a request to join the controller is detected, in order to ensure the security of the control plane of the SDN cloud network controller, the joining of the controller needs to be verified by the administrator first. At this time, a controller randomly designated by the administrator can be used as the initial controller, and the controller is verified using the initial controller; when it is determined that the verification of the controller is passed, the controller is added to the trusted list of the SDN cloud network controller.

[0073] For example, assuming that the added controller is controller B and the initial controller is controller A; the process of using controller A to verify the controller can be: controller B sends a request to controller A to obtain the public key of controller A, and uses the public key to encrypt its own information and send it to controller A, so that controller A verifies the received information. If the verification is successful, it is determined that the verification of controller B has passed, and controller A adds controller B to the trusted list, so that the next controller can obtain access rights by requesting controller A or controller B for identity authentication, and then achieve full connectivity of the control plane.

[0074] It should also be noted that the control plane workflow of the SDN cloud network controller is mainly divided into four stages, see Figure 2 , the specific contents are as follows:

[0075] First, the controller verifies, records, and parses the information from the switch. Figure 2As shown, the switch sends messages (data packets) such as Stats_Reply, Features_Reply and Packet_In to the controller, and uses the Stats_Reply in the data packet to analyze the status of the local network through the analysis center, where Features_Reply represents the switch's own feature information, and Packet_In and Flow_Mod are a group of corresponding messages, which are used to request and reply flow table information respectively.

[0076] Secondly, the controller extracts the topological state of the routing and the state set of the switch to construct a topological map of the network flow, which dynamically displays the local traffic. At the same time, the various information involved is stored in the local block so that it can be traced back to the source when a problem occurs.

[0077] Thirdly, after verification by other blockchain nodes, the controller uploads relevant data to the blockchain to form a global view. This step is divided into periodic mode and trigger mode. When the network is operating normally, the controllers manage their own domains and update the global network topology regularly. However, when the controller issues an alarm, the global view will be updated immediately, so that each controller can understand the general situation of the network and provide feedback to the alarm controller. The block will truthfully record every step of the operation, including the management and modification of the controller's global view. Every time the controller successfully uploads a block, its trust value percentage will increase a little.

[0078] Finally, the analysis center will analyze the status information of each switch and controller in the block, so as to use smart contracts to automatically formulate corresponding response strategies (defense operations) for different attack types.

[0079] As a preferred method of an embodiment of the present application, when a broadcast request sent by a target controller is detected, the broadcast request is verified by the LPBFT algorithm, and when the verification fails, the defense phase is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller. The specific process can be: when a broadcast request of the target controller is detected, the broadcast request is forwarded to the initial controller; the initial controller is a controller other than other controllers in the SDN cloud network controller; other controllers are controllers in the SDN cloud network controller other than the target controller and the initial controller; when the initial controller successfully matches the preparation message, a target preparation message is generated according to the preparation message and the identity information of the initial controller, and the preparation message is distributed to each other controller; the target preparation message is verified by each other controller; if each other controller passes the verification, a corresponding reply is fed back to the target controller, so that the target controller stores the reply values ​​fed back by each other controller in the local block; if any other controller fails to verify, the defense phase is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller.

[0080] In some embodiments, the trust value of each controller under the SDN cloud network controller can be evaluated through corresponding trust evaluation rules, and the controller with the highest trust value can be determined as the main controller.

[0081] Among them, the trust evaluation rule can be: "Service" is used as the standard for evaluating the trustworthiness of the controller. In the SDN cloud network controller, "service" can be considered as a "transaction" stored in the blockchain. Here, the reputation in the SDN cloud network controller is defined from the two aspects of utility and time. Specifically, it can be considered from the control layer and the data layer respectively. In the control layer, each "service" should be verified before storage, and the number of valid "services" represents the number of successfully verified controllers. In the data layer, the more switches a controller manages, the more important the controller is. In terms of time, the normal working time and number of rounds of the controller reflect its anti-destruction ability to a certain extent. Therefore, Trust can be defined as the trust value of each controller calculated by the following parameters. By adding these evaluation criteria to the blockchain, the master-slave relationship of the controllers participating in the contract can be determined, that is, the master controller and the slave controller can be determined from each controller so that the system can solve the security risks as soon as possible. The specific calculation method is shown in formula (1).

[0082]

[0083] In formula (1), S, W, M, and R represent the proportion of effective "services", the number of managed switches, the duration of normal operation, and the number of rounds, respectively; α, β, χ, and δ represent the weight parameters of the above four indicators.

[0084] It should be noted that the LPBFT algorithm consists of three stages, namely the preparation stage prepare, the commit stage commit and the reply stage reply; the preparation stage is mainly to confirm the validity of the request and the controller, that is, to verify the validity of the broadcast request sent by the target controller; in the subsequent commit stage, the controller reaches a consensus and executes the request, and the reply stage mainly replies to the controller that the corresponding broadcast request has been processed.

[0085] In actual use, in the preparation phase of the LPBFT algorithm, corresponding verification can be performed in the form of encryption and question-answering. Specifically, controller A (target controller) sends a corresponding broadcast request to other controllers, where the broadcast request carries an encrypted preparation message in the format of <(prepare,v,n,h,a,d) en ,m>, v represents the view where controller A is located, n is the serial number of controller A sorted downward according to the requests stored by itself, h is the identity information of the controller, a represents the answer to the question set by the main controller, d is the summary of the content m, and the subscript en represents the encryption process. Controller A sends the broadcast request carrying the prepare message to the initial controller and adds the prepare message to its own local block.

[0086] After the initial controller i receives the broadcast request sent by controller A, it confirms whether the prepare message in the broadcast request matches. If the match is successful, controller i enters the next commit phase and generates a target prepare message based on the prepare message <(commit,v,n,d,i) en >, to broadcast the generated target preparation message to other controllers except controller A, and then append the preparation message and the generated submission message to the log. When other controllers receive the target preparation message, if the view and number are the same as those in the target preparation message, but the summary is different, the other controllers will reject the message and generate an exception report to the main controller, and then record the exception report in the blockchain, that is, execute step S103. If the view, number and summary are the same as those in the target preparation message, enter the corresponding reply stage, and reply to controller A with the corresponding reply to inform the controller to complete the processing of the broadcast request, so that the controller stores the replies fed back by each other controller in the local block.

[0087] It should be noted that the LPBFT algorithm is used to broadcast messages between controllers. Figure 3 As shown in the figure, the LPBFT algorithm uses a three-stage protocol (Prepare, Commit, Reply) to complete the broadcast of requests between controllers. Figure 3As can be seen in the figure, the dotted line represents the broadcast process of the LPBFT algorithm, and the solid line represents the broadcast process of the traditional PBFT algorithm. PBFT was originally mainly used in distributed systems composed of state machine replicas, and the same serialization process must be completed on each distributed node, but this is not the case in SDN cloud network controllers. In PBFT (a five-phase protocol), there are two consensuses in the preparation phase and the submission phase to ensure that the decisions and operations of each node are the same, but in LPBFT, only one consensus is needed to complete the authentication and decision-making of the controller. Because there are many different types of broadcast requests in the SDN cloud network controller, the queue can be interrupted according to the priority when processing the broadcast request, so there is no need to sort the received broadcast requests in the SDN cloud network controller, and the broadcast requests can be automatically processed according to the priority of each broadcast request and the first-come-first-served principle of broadcast requests of the same level.

[0088] Furthermore, in an embodiment of the present application, in the submission phase, for each controller, when the number of malicious controllers is relatively limited, the controller will execute the request in accordance with the "majority rule". The controller collects submission messages in the log, and confirms whether the controller is ready by verifying the view, summary, and sequence number in the submission message. When the number of submissions prepared for different controllers reaches, it is expressed as true, then the request status on the controller is executable, and finally the corresponding operation is performed according to the request. Among them, confirming whether the controller is ready by verifying the view, summary, and sequence number in the submission message is a relatively common verification technology, which will not be elaborated in this application.

[0089] S102: In the defense stage, the main controller determines whether a target controller fails; if it is determined that the target controller does not fail, step S103 is executed; if it is determined that the target controller fails, step S104 is executed.

[0090] In the embodiment of the present application, the security of the SDN cloud network controller can be improved by limiting the communication time, adding a reply mechanism and evaluating the credibility, and the target controller can also be detected by limiting the communication time and adding a reply mechanism. If it is determined that the target controller has failed, S104 can be executed; if it is determined that the target controller has not failed, it can be determined that the target controller is an attacker, and then step S103 can be executed.

[0091] As a preferred method of an embodiment of the present application, in the defense stage, the process of determining whether a target controller fails through the main controller can be specifically as follows: controlling the target controller to send transmission information to the main controller; obtaining the transmission delay of the transmission information through the main controller, and determining whether the transmission delay of the transmission information is greater than the preset maximum delay; if the transmission delay of the transmission information is greater than the maximum delay, it is determined that the transmission of the transmission information has failed, and it is determined that the target controller has failed; if the transmission time of the transmission information is not greater than the valve time, it is determined that the transmission of the transmission information is successful, and it is determined that the target controller has not failed, and it can be considered that the target controller may be an attacker.

[0092] Specifically, in order to ensure the integrity and security of information (broadcast request, preparation message, target preparation message, etc.) during transmission, it is necessary to control the transmission time of each piece of information within a certain range. Therefore, a maximum delay Δ can be set. The validity of information is related to the transmission delay. If the transmission delay of the information does not exceed the maximum delay Δ, the information can be considered valid. Otherwise, it can be considered that the message may have been intercepted and tampered with, or a communication failure has occurred, that is, it can be considered that the target controller has failed. In this case, the information will fail to transmit and be ignored; wherein the maximum delay Δ can be represented by the maximum arrival delay calculated in the previous view.

[0093] As another preferred method of an embodiment of the present application, in the defense stage, the process of determining whether a target controller fails by the main controller may be as follows: in the defense stage, the main controller receives controller timeout information sent by each slave controller to the target controller; if it is determined that the number of controllers sending controller timeout information exceeds a preset number, the main controller contacts the target controller based on any slave controller; if the target controller cannot be contacted, it is determined that the target controller fails; if the target controller can be contacted, it is determined that the target controller does not fail, and it can be considered that the target controller may be an attacker.

[0094] It should be noted that the slave controller is a controller other than the master controller and the target controller under the SDN cloud network controller.

[0095] Specifically, the preset number can be 1 / 3 of the total number of slave controllers; if the master controller receives reports from more than 1 / 3 of the slave controllers that a controller has timed out, that is, if the controller timeout information received for the target controller exceeds 1 / 3 of the total number of slave controllers, the master controller will broadcast a message to other slave controllers to contact the target controller. If the slave controller finds that the target controller is working properly, it will receive a short message <(OK,v,n) returned by the target controller en> to confirm the status of the target controller. Otherwise, a reply message will be sent to the main controller to report that the target controller may have been compromised. In order to avoid further deterioration of the problem, the main controller will generate a switch allocation request and send it to the slave controller. When the number of slave controllers that agree to the switch allocation request reaches f+1, the identity certificate will be used to inform the switch managed by the target controller to perform the migration operation, that is, execute step S104, and return the corresponding migration result to the main controller to achieve effective isolation of the problem controller. Subsequent inspection and maintenance of the problem controller are performed by the attack processing center.

[0096] S103: Determine the attack type of the target controller, and perform defense operations matching the attack type on each slave controller through the master controller.

[0097] In the specific process of executing step S103, when it is determined that the target controller has not failed, the target controller can be considered to be an attacker. At this time, the attack type of the target controller can be determined, where the attack type is a DDos attack type; a DDos mitigation contract matching the DDos attack type is generated by the master controller, and the DDos mitigation contract is distributed to each slave controller, so that each slave controller reduces the attack on the target controller based on the DDos mitigation contract.

[0098] It should be noted that see Figure 4 In a DDoS attack, the attacker controls multiple hosts distributed in the network to launch attacks on the victim (from the controller) at the same time, taking advantage of the asymmetry of resources to generate huge attack traffic that paralyzes the other party's service, making it impossible for legitimate users to access the target service normally. Among them, the controlled host is called a puppet machine, and the network composed of puppet machines is called a botnet. By taking advantage of the asymmetry of resources between the victim and the botnet, a DDoS attack can generate huge attack traffic and cause serious damage.

[0099] The applicant has discovered through research that, due to the special architecture of the SDN cloud network, attackers can send a large number of meaningless data packets to the SDN switch. These data packets enter the switch but cannot match the flow table. At this time, they will be encapsulated as Packet_In messages and sent to the controller. A large number of Packet_In messages occupy the resources and bandwidth of the controller, thereby causing a denial of service of the controller.

[0100] This application proposes corresponding solutions from two aspects: DDoS attack detection and mitigation and subsequent controller protection:

[0101] (1) Attack detection and mitigation: In response to DDoS attacks, the smart contract will periodically check the status of the controller and traverse the transactions, state machines, and trigger conditions contained in the contract. Transactions that meet the trigger conditions will then be placed in the verification queue and wait for consensus, while transactions that do not meet the conditions will continue to be stored in the blockchain. The DDoS alert contract will be generated and broadcast after the analysis center finds abnormal traffic. First, the security and validity of each controller will be verified, and then the verified controller will be entered into the consensus set. After successfully reaching a consensus among the majority of nodes, the most reliable master controller will be elected according to the trust mechanism of the LPBFT algorithm. In order to determine that the target controller is an attacker, the master controller generates a DDoS mitigation contract and distributes it to other controllers (slave controllers) to help mitigate the DDoS attack on other controllers from the target controller. For the overall fairness of the network, the same controller cannot be repeatedly elected as the master controller in two consecutive views.

[0102] (2) Subsequent protection: Smart contracts are implemented based on the trust mechanism of the LPBFT algorithm to ensure that emergencies can be effectively resolved. After the alarm is lifted, the alarm controller (slave controller) will perform multiple verification steps to ensure the security and reliability of the control plane. At the same time, each slave controller will upload the corresponding status information to the block to analyze the current status of the controller, mitigation effect, attack source, and impact on other controllers. Events occurring at each attack interval will also be recorded in the block to facilitate relevant analysis by the system.

[0103] It should be noted that in order to better illustrate the advantages of the LPBFT algorithm over the traditional PBFT algorithm, this application analyzes the LPBFT algorithm based on game theory. The game model is defined as Γ={I,S,U}, where I={a,d} is the participant, a represents the attacker, and d represents the defender (controller). S={t a ,t d} defines the strategy set of the attacker and the controller, U = {u a ,u d} are the utility functions of the attacker and the controller.

[0104] The specific analysis process is as follows:

[0105] Assume that the attacker simultaneously attacks at time t a Attack r controllers out of n controllers, t a It indicates the time it takes for an attacker to break through the firewall of the controller and tamper with the controller information. N(t a ) indicates that at time t aThe total attack time is T. The request verification process is performed simultaneously after the request is initiated, so the request initiation interval is equal to the verification interval. Assume that the time interval between request initiation is t d It satisfies the negative exponential distribution, the distribution parameter is λ, and the number of controllers recovered in each attack cycle is Y. a The probability that the controller will send a request is: Next attack time t a The probability that the controller sends more than one request can be expressed as: At any attack time t a The probability of an attacker successfully attacking is: Therefore, X×r controllers will be hacked during this period. As long as the proportion of successfully hacked controllers does not exceed 1 / 3, the network can still operate normally.

[0106] In the i-th attack cycle, assume that there are M(i) controllers to be invaded, and M(i) can be expressed as Therefore, the probability of successfully attacking a controller can be obtained by the following formula: It can be seen that for a certain attacker, the definition cost includes the invasion cost C a1 (i.e., the cost of intruding the controller) and the penalty cost C a2 (i.e. the cost of the attack being detected). If the attack is successful, it will gain a gain of B for the successful invasion a .

[0107] For a defender, the cost C d Defined as the cost of the controller failing to resist the invasion. If the controller works properly, it will gain B d1 If the master controller successfully finds the problem controller, it will gain B d2 .

[0108] Therefore, the attacker’s utility function can be expressed as: a =B a ×PT-C a1 -C a2 ×(1-PT); the defender’s utility function can be expressed as:

[0109] Among them, the PBFT algorithm and the LPBFT algorithm are compared. As shown in Table 1, compared with the PBFT algorithm, the LPBFT algorithm has more advantages in tolerating faulty nodes. Although the PBFT algorithm can tolerate the same number of invaded nodes of 1 / 3, it must meet the premise that the master node is not invaded, so that the network can maintain normal operation. The LPBFT algorithm has a fair master node trust value election mechanism, and the improvement of the trust value is closely related to the proportion of effective services and service duration of each controller in daily work, and it is uploaded to the blockchain to ensure that the information is true and valid and cannot be tampered with, so it is more secure and robust. In addition, it can be seen that the LPBFT algorithm is better in transaction performance. Due to the large amount of data in the bank's SDN cloud network controller, the PBFT algorithm cannot meet its requirements for high message volume, and the LPBFT algorithm greatly reduces the number of signaling by simplifying the verification and consensus process. Among them, the consensus parameters of the PBFT algorithm and the LPBFT algorithm are compared.

[0110] Table 1:

[0111]

[0112] Among them, it can be seen from Table 1 that in terms of anti-destruction, unlike the PBFT algorithm, the LPBFT algorithm finds the hacked controller by analyzing the data recorded on the blockchain, and has a mechanism to deal with suspicious controllers. In this case, the LPBFT algorithm can obviously slow down the overall speed of the SDN cloud network controller being destroyed. When attacked, it can also respond in time and perform defense operations corresponding to the attack type. Each block records the content of each activity and the timestamp, so that each controller can achieve self-checking and recovery under a specific attack. After mitigating the attack, activity analysis will be performed and the entity source that generated the activity will be tracked.

[0113] In addition, in terms of architecture, the multi-controller trust election mechanism of the control plane of the SDN cloud network controller solves the "single point failure" problem. In addition, other controllers can also assist the problematic controller (target controller) to get out of trouble. Under this architecture, the focus of abnormal point monitoring can be placed on identity and traffic to ensure that the controller can operate normally, while also improving the programmability of the SDN cloud network controller and the scalability of this architecture.

[0114] In terms of the privacy and integrity of information, each controller manages its own private key and uses blockchain to distribute public keys. The encrypted fragments of controller information are stored on the blockchain and are not accessible or controlled by any third party, thus ensuring the privacy of the data. The blockchain consists of a readable, addable and non-deletable distributed database, and maintains a list of transactions in the block. The on-chain block provides security by holding the timestamp and the hash value of the previous block, that is, once the block is successfully recorded, it is difficult to tamper with the data in it, thereby ensuring the integrity of the data.

[0115] S104: Perform corresponding migration operations on each switch managed by the target controller through the main controller.

[0116] In the process of executing step S104, after determining that the target controller has a fault that is difficult to repair in a short period of time, or after determining that the target controller is an attacker, and performing defense operations matching the attack type on each slave controller, each switch managed by the target controller needs to be dynamically migrated to find a suitable controller to migrate to. In the process of dynamic migration, how to balance load, latency and resource consumption is a problem that needs to be urgently solved in switch migration in this application.

[0117] The applicant has found that in the SDN cloud network controller, each SDN domain S i Each contains a controller c i , assuming that each switch matches only one controller, and M represents the set of controllers, where the set of controllers includes each slave controller. Then, the switch-controller relationship in the SDN cloud network controller is shown in formula (2) and formula (3):

[0118]

[0119] Among them, V is the switch, S i For controller c i Corresponding SDN domain, M is the set of controllers.

[0120] However, since most of the control resources in the SDN cloud network controller are occupied by Packet_in messages, this application uses the receiving speed of Packet_in events as the main load factor of the controller, and the indicator variable x j,i Represents switch v j Is it related to controller c i To ensure the normal operation of the SDN cloud network controller, the controller load capacity upper limit of the controller matched with the switch should always be greater than the total switch load of the switch, as shown in formula (4):

[0121]

[0122] in, Indicates switch v j The load, For controller c i The upper limit of load.

[0123] If the migration load of the taken-over switch exceeds the remaining load of the controller, the controller will abandon the excess load. Therefore, this application uses load oscillation to describe the phenomenon of repeated transfer of switch load. In order to improve the recovery efficiency, it is necessary to ensure that the controller load after taking over the migration switch is not greater than the load limit, that is, to satisfy formula (5):

[0124]

[0125] In the process of finding a suitable controller to migrate to for the out-of-control switch (the switch managed by the target controller), each time a controller c is activated i The required cost is ξ i , therefore, the total cost of activating the controller during fault recovery can be expressed as formula (6):

[0126]

[0127] It can be seen from formula (6) that when the indicator variable y i When the value is equal to 1, the controller c i is selected as the migration target, otherwise y i is equal to 0.

[0128] As the main factor limiting the efficiency of controller failure recovery, the communication delay between the controller and the switch can be expressed as the delay matrix of the following formula as shown in formula (7):

[0129]

[0130] Where n is the number of switches to be migrated (the number of switches managed by the target controller), the number of normal controllers is m, and the number of controllers c is i With switch v j The communication delay between j,i express.

[0131] Assuming that the controller takes the same amount of time to process Packet_in events, the time it takes to process a single request will be constrained by the communication delay. That is, the smaller the delay, the shorter the recovery time. Therefore, the total time required to recover all switches to be migrated can be expressed as formula (8):

[0132]

[0133] Among them, T in formula (8) i The request message indicating the switch to be migrated arrives at the controller c i The time used can be expressed by formula (9):

[0134]

[0135] Among them, φ j Represents switch v j The number of Packet_in messages generated.

[0136] Assuming that the total load of the out-of-control switch is always less than the total load of the normal controller, based on the above analysis, the controller failure recovery problem under the SDN cloud network controller needs to focus on achieving the following three goals: 1. Minimize the time spent on the migration process and reduce the network packet loss rate. 2. Ensure that there is no load oscillation and improve the recovery efficiency. 3. Limit the number of activated migration controllers to reduce the recovery overhead.

[0137] In summary, the set of all switches in the SDN domain to which the out-of-control controller belongs can be represented by S uc Indicates that, using the indicator variable x j,i Represents controller c i Has the switch been taken over? j , indicator variable y i It represents the controller c i Whether it is used as a migration controller. Therefore, the objective function can be obtained as shown in the following formula (10):

[0138]

[0139] Subject to:

[0140]

[0141] Among them, for any i∈M,j∈S uc , there are x j,i ≤y i And x j,i ∈{0,1}, for any i∈M, there is y i ∈{0,1}; Formula (11) ensures that the fault recovery process does not involve additional controllers, that is, all the migration controllers used belong to the controllers in the original SDN domain. Formula (12) ensures that there will be no load oscillation when performing fault recovery; Formula (13) indicates that the activation cost of the migration controller must not exceed the budget limit. Formula (14) ensures that all out-of-control switches are migrated to the appropriate migration controller, thereby completing the fault recovery.

[0142] As a preferred method of an embodiment of the present application, when it is determined that a target controller fails, or defense operations matching the attack type are performed on each slave controller, the process of performing corresponding migration operations on each switch managed by the controller through the main controller can be specifically as follows: obtaining a set of out-of-control switches through the main controller, wherein the set of out-of-control switches includes each switch managed by the target controller; determining a switch network domain through the main controller based on a sub-network domain clustering algorithm according to preset control parameters and the set of out-of-control switches; dividing a controller set of each switch managed by the target controller from each slave controller based on a migration controller adjustment algorithm through the main controller; determining a controller matching each switch managed by the target controller from the set of slave controllers based on a migration control algorithm through the main controller, and migrating each switch to a controller matching it.

[0143] In some embodiments, when executing the selection and migration of the uncontrolled switch to the incoming controller, the migrated controller (slave controller) needs to be activated, and this process must pay a certain amount of capital expenditure. In order to save repair expenses as much as possible, it is necessary to control the number of activated controllers to be migrated, and use an appropriate number of controllers to perform the migration of switches. Based on this problem, the present application provides a sub-network domain clustering algorithm, which combines binary search and the division of network domains. After clarifying the number of migrated controllers, all out-of-control switches in the network are divided into network domains consistent with the number of migrated controllers according to the principle of shortest delay. Among them, the process of determining the switch network domain by the main controller based on the sub-network domain clustering algorithm according to preset control parameters and the set of out-of-control switches is specifically shown in Table 2:

[0144] Table 2:

[0145]

[0146] Among them, it can be seen from Table 2 that in each cycle, the subnetwork domain clustering algorithm calculates the network delay under the current subnet division and compares it with the result of the previous cycle until the difference Δ reaches the allowable error range. After obtaining the solution to the problem, the solution should also be appropriately corrected. Some controllers in the division results may not work properly, so these controllers do not meet the actual repair requirements. In addition, although the premise of the shortest delay is met, too many switches connected to the same migration controller may cause the controller load to exceed the load limit, which in turn causes load oscillation.

[0147] In some embodiments, the process of dividing the controller set of each switch managed by the migration target controller from each slave controller by the master controller based on the migration controller adjustment algorithm pattern switch network domain is shown in Table 3:

[0148] Table 3:

[0149]

[0150] In some embodiments, for each switch network domain, if there is a controller near its solution location and the remaining load of the controller is sufficient to receive the switch load in the current domain, the location of the controller can be considered valid, and the remaining available load of the controller is updated. If the above conditions are not met, the controller at the location with the shortest network communication delay is used as the migration target and its remaining load is updated after the migration is performed, that is, the main controller determines the controller that matches each switch managed by the target controller from the controller set based on the migration control algorithm, and migrates each switch to the controller that matches it. The specific execution process is shown in Table 4:

[0151] Table 4:

[0152]

[0153]

[0154] In summary, for each switch, the controller with the shortest communication delay and sufficient available load in the network is selected as the migration target of the switch (the controller matched by the switch), and its remaining load is updated after a controller is selected. By adjusting the migration controller, all switches can be normally migrated to the appropriate controller in the surrounding area, which not only ensures the shortest communication delay between the switch and the migration controller, but also avoids the load oscillation problem on the controller side, improves the efficiency of fault repair, and ensures the normal operation of the network.

[0155] Based on the blockchain-based intrusion prevention method provided in the above-mentioned embodiment of the present application, correspondingly, the embodiment of the present application also provides a blockchain-based intrusion prevention system, such as Figure 5 As shown, the blockchain-based intrusion prevention system includes:

[0156] The verification unit 51 is used to verify the broadcast request sent by the target controller by using the LPBFT algorithm when the broadcast request is detected, and enter the defense phase when the verification fails, and determine the controller with the highest trust value in the SDN cloud network controller as the main controller;

[0157] A judging unit 52, used to judge whether a target controller fails through the main controller in the defense stage;

[0158] The defense unit 53 is used to determine the attack type of the target controller if it is determined that the target controller has not failed, and perform defense operations matching the attack type on each slave controller through the master controller; wherein the slave controller is a controller other than the master controller and the target controller in the SDN cloud network controller;

[0159] The migration unit 54 is used to perform corresponding migration operations on each switch managed by the controller through the master controller if it is determined that the target controller fails, or after performing defense operations matching the attack type on each slave controller.

[0160] The specific principles and execution processes of each unit in the blockchain-based intrusion prevention system disclosed in the above-mentioned embodiment of the present application are the same as the blockchain-based intrusion prevention method disclosed in the above-mentioned embodiment of the present application. Please refer to the corresponding parts of the blockchain-based intrusion prevention method disclosed in the above-mentioned embodiment of the present application, and no further details will be given here.

[0161] The present application provides an intrusion prevention system based on blockchain, which is applicable to SDN cloud network controllers. When a broadcast request sent by a target controller is detected, the broadcast request is verified by the LPBFT algorithm, and when the verification fails, the defense phase is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller; in the defense phase, the main controller is used to determine whether the target controller fails; if it is determined that the target controller has not failed, the attack type of the target controller is determined, and the main controller is used to perform defense operations matching the attack type on each slave controller; wherein, the slave controller is a controller other than the main controller and the target controller in the SDN cloud network controller. If it is determined that the target controller fails, or after performing defense operations matching the attack type on each slave controller, the main controller is used to perform defense operations matching the attack type on the controller. The corresponding migration operations are performed on each switch managed by the SDN cloud network controller; it can be seen that the technical solution provided by the present application uses the LPBFT algorithm to verify the target controller for requesting broadcast, and can promptly detect whether there is a controller that is currently faulty or attacked; and, in the case of determining that there is currently an attacked target controller, for specific intrusion behaviors and single point failure problems, and taking into account that the attacker may turn to traffic attacks to exhaust the network resources of the controller after the intrusion fails, making it impossible for the SDN cloud network controller to provide services normally, the master controller can be used to perform defense operations matching the attack type on each slave controller, and the master controller can be used to perform corresponding migration operations on each switch managed by the controller, so as to effectively isolate the problematic controller, thereby realizing intrusion defense of the SDN cloud network controller.

[0162] Optionally, the verification unit includes:

[0163] A forwarding unit, configured to forward the broadcast request to an initial controller when a broadcast request of a target controller is detected; the initial controller is a controller other than other controllers in the SDN cloud network controller; and the other controllers are controllers in the SDN cloud network controller;

[0164] A broadcast unit, configured to generate a target preparation message according to the preparation message and the identity information of the initial controller when the preparation message is successfully matched by the initial controller, and distribute the preparation message to each other controller;

[0165] a verification subunit for verifying the target preparation message by each other controller;

[0166] The storage unit is used to feed back a corresponding response to the target controller if each other controller passes the verification, so that the target controller stores the responses fed back by each other controller in the local block;

[0167] The sending compound is used to enter the defense phase if any other controller fails to verify, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller.

[0168] Optionally, the judging unit comprises:

[0169] A transmission information sending unit, used for controlling the target controller to send transmission information to the main controller;

[0170] A determination subunit, used to obtain the transmission delay of the transmission information through the main controller, and determine whether the transmission delay of the transmission information is greater than a preset maximum delay;

[0171] The first determining unit is configured to determine that the transmission of the transmission information fails if the transmission delay of the transmission information is greater than the maximum delay, and to determine that a failure occurs in the target controller.

[0172] Optionally, the judging unit comprises:

[0173] A controller timeout information sending unit, used for receiving controller timeout information sent by each slave controller to a target controller through the master controller in a defense phase;

[0174] A contact unit, configured to contact a target controller through a master controller based on any slave controller if it is determined that the number of controllers that send controller timeout information exceeds a preset number;

[0175] The second determining unit is used to determine that a target controller fails if the target controller cannot be contacted.

[0176] Optionally, the judging unit comprises:

[0177] A controller timeout information sending unit, used for receiving controller timeout information sent by each slave controller to a target controller through the master controller in a defense phase;

[0178] A contact unit, configured to contact a target controller through a master controller based on any slave controller if it is determined that the number of controllers that send controller timeout information exceeds a preset number;

[0179] The second determining unit is used to determine that a target controller fails if the target controller cannot be contacted.

[0180] Optional, Migration Unit, including:

[0181] The obtained element is used to obtain a set of out-of-control switches through a main controller, wherein the set of out-of-control switches includes each switch managed by a target controller;

[0182] A second determining unit is used to determine the switch network domain according to preset control parameters and the set of out-of-control switches through the main controller based on the sub-network domain clustering algorithm;

[0183] A partitioning unit, used for partitioning the switch network domain of each switch managed by the migration target controller from each slave controller through the master controller based on the migration controller adjustment algorithm pattern;

[0184] The migration unit is used to determine a controller matching each switch managed by the target controller from the controller set through the main controller based on the migration control algorithm, and migrate each switch to the controller matching it.

[0185] The present application embodiment provides an electronic device, such as Figure 6 As shown, the electronic device includes a processor 601 and a memory 602, the memory 602 is used to store program code and data of the blockchain-based intrusion defense method, and the processor 601 is used to call the program instructions in the memory to execute the steps shown in the blockchain-based intrusion defense method in the above embodiment.

[0186] An embodiment of the present application provides a storage medium, which includes a storage program, wherein when the program is running, the device where the storage medium is located is controlled to execute the blockchain-based intrusion defense method shown in the above embodiment.

[0187] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, in which the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0188] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0189] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

[0190] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A blockchain-based intrusion prevention method, characterized in that: Applicable to an SDN cloud network controller, the method includes: When a broadcast request sent by the target controller is detected, the broadcast request is verified by the LPBFT algorithm, and when the verification fails, the defense phase is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller; In the defense stage, determining by the main controller whether the target controller fails; If it is determined that the target controller has not failed, determine the attack type of the target controller, and perform defense operations matching the attack type on each slave controller through the master controller; wherein the slave controller is a controller other than the master controller and the target controller in the SDN cloud network controller; If it is determined that the target controller fails, or after a defense operation matching the attack type is performed on each slave controller, a corresponding migration operation is performed on each switch managed by the controller through the master controller.

2. The method according to claim 1, characterized in that When a broadcast request sent by the target controller is detected, the broadcast request is verified by the LPBFT algorithm, and when the verification fails, the defense phase is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller, including: When a broadcast request of the target controller is detected, the broadcast request is forwarded to an initial controller; the initial controller is a controller other than other controllers in the SDN cloud network controller; the other controllers are controllers in the SDN cloud network controller other than the target controller and the initial controller; When the preparation message is successfully matched by the initial controller, a target preparation message is generated according to the preparation message and the identity information of the initial controller, and the preparation message is distributed to each other controller; verifying, by each of the other controllers, the target preparation message; If each of the other controllers passes the verification, a corresponding response is fed back to the target controller, so that the target controller stores the response values ​​fed back by each of the other controllers in the local block; If any of the other controllers fails the verification, the defense phase is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the main controller.

3. The method according to claim 1, characterized in that In the defense stage, determining by the main controller whether the target controller fails includes: Controlling the target controller to send transmission information to the main controller; Acquire the transmission delay of the transmission information through the main controller, and determine whether the transmission delay of the transmission information is greater than a preset maximum delay; If the transmission delay of the transmission information is greater than the maximum delay, it is determined that the transmission of the transmission information fails, and it is determined that the target controller fails.

4. The method according to claim 1, characterized in that: In the defense stage, determining by the main controller whether the target controller fails includes: In the defense phase, the master controller receives controller timeout information sent by each slave controller to the target controller; If it is determined that the number of controllers that sent the controller timeout information exceeds a preset number, the master controller contacts the target controller based on any one of the slave controllers; If the target controller cannot be contacted, it is determined that the target controller fails.

5. The method according to claim 1, characterized in that: The performing corresponding migration operations on each switch managed by the target controller by the main controller includes: Acquire a set of out-of-control switches through the main controller, wherein the set of out-of-control switches includes each switch managed by the target controller; Determine the switch network domain by the main controller based on the sub-network domain clustering algorithm according to preset control parameters and the set of out-of-control switches; By means of the master controller, based on the migration controller, the switch network domain is divided from each of the slave controllers into a controller set of each switch managed by the target controller; The main controller determines a controller matching each switch managed by the target controller from the controller set based on a migration control algorithm, and migrates each switch to the controller matching it.

6. A blockchain-based intrusion prevention system, characterized in that: Applicable to an SDN cloud network controller, the system includes: A verification unit, configured to verify the broadcast request sent by the target controller by using an LPBFT algorithm when the broadcast request is detected, and to enter a defense phase when the verification fails, and to determine the controller with the highest trust value in the SDN cloud network controller as a main controller; a judgment unit, used for judging whether the target controller fails by the main controller in the defense stage; A defense unit, configured to determine the attack type of the target controller if it is determined that the target controller has not failed, and perform defense operations matching the attack type on each slave controller through the master controller; wherein the slave controller is a controller other than the master controller and the target controller in the SDN cloud network controller; The migration unit is used to perform corresponding migration operations on each switch managed by the controller through the master controller if it is determined that the target controller fails, or after performing defense operations matching the attack type on each slave controller.

7. The system according to claim 6, characterized in that The verification unit comprises: a forwarding unit, configured to forward the broadcast request to an initial controller when a broadcast request of the target controller is detected; the initial controller is a controller other than other controllers in the SDN cloud network controller; the other controllers are controllers in the SDN cloud network controller; a broadcast unit, configured to generate a target preparation message according to the preparation message and the identity information of the initial controller when the preparation message is successfully matched by the initial controller, and distribute the preparation message to each other controller; a verification subunit, configured to verify the target preparation message through each of the other controllers; A storage unit, configured to feed back a corresponding response to the target controller if each of the other controllers passes the verification, so that the target controller stores the responses fed back by each of the other controllers in a local block; The sending unit is used to enter the defense phase if any of the other controllers fails verification, and at the same time determine the controller with the highest trust value in the SDN cloud network controller as the main controller.

8. The system according to claim 6, characterized in that The judging unit comprises: A transmission information sending unit, used for controlling the target controller to send transmission information to the main controller; A determination subunit, configured to obtain a transmission delay of the transmission information through the main controller, and determine whether the transmission delay of the transmission information is greater than a preset maximum delay; The first determining unit is configured to determine that the transmission of the transmission information fails if the transmission delay of the transmission information is greater than the maximum delay, and to determine that a failure occurs in the target controller.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the processor and the memory are connected via a communication bus; wherein the processor is used to call and execute a program stored in the memory; The memory is used to store a program, and the program is used to implement the blockchain-based intrusion defense method as described in any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to execute the blockchain-based intrusion defense method as described in any one of claims 1 to 5.

Images