Blockchain-based intrusion prevention method, system, electronic device, and storage medium

Abstract

The application provides a blockchain-based intrusion prevention method and system, an electronic device and a storage medium, which are suitable for an SDN cloud network controller. When a broadcast request sent by a target controller is detected, the broadcast request is verified through an LPBFT algorithm, and when the verification fails, a defense stage is entered, and a controller with the highest trust value in the SDN cloud network controller is determined as a master controller. In the defense stage, whether the target controller fails is determined by the master controller. If it is determined that the target controller does not fail, the attack type of the target controller is determined, and each slave controller is subjected to a defense operation matched with the attack type by the master controller. If it is determined that the target controller fails or each slave controller is subjected to a defense operation matched with the attack type, each switch managed by the target controller is subjected to a corresponding migration operation by the master controller.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, more particularly, to an intrusion prevention method and system based on a blockchain, an electronic device, and a storage medium. BACKGROUND

[0002] In recent years, with the acceleration of the cloudization of bank data centers, the traditional network technology architecture has been challenged: on the one hand, the emergence of the virtualization concept has overturned the original data center network model, resulting in that the traditional network technology has been insufficient to adapt to the new scenarios generated in the cloud environment, such as the emergence of virtual machines requiring the network granularity to be refined from the physical machine to the virtual machine level; on the other hand, the rapid development of Internet-oriented financial innovation businesses also puts forward higher requirements for the performance, flexibility, and other characteristics of the network. Among them, the software-defined network technology (Software Defined Network, SDN) separates the data plane and the control plane in the network through the distributed architecture concept, thereby realizing the flexible control of network traffic and providing a good platform for core network and application innovation. It is very consistent with the development trend of bank cloud networks and is an effective support technology for realizing bank cloud network services. SDN has been implemented in many commercial bank institutions such as the Industrial and Commercial Bank of China and the Postal Savings Bank,

[0003] However, as the controller layer of SDN, which has the view of the entire network and translates the upper-layer decisions into forwarding rules of the data plane, it acts like the brain of the network, but it also becomes the focus of network attacks. The security solutions of the current SDN cloud network controller are mostly prone to single-point failures due to centralized control, and these solutions are basically aimed at a single security problem without considering the whole control layer.

[0004] Therefore, how to provide an intrusion prevention method for the control layer of the SDN cloud network controller to avoid single-point failures and consider the whole control layer is a problem that needs to be solved urgently. SUMMARY

[0005] Therefore, the present application provides an intrusion prevention method and system based on a blockchain to avoid single-point failures and consider the whole control layer for the purpose of realizing the intrusion prevention of the SDN cloud network controller.

[0006] The first aspect of the present application provides an intrusion prevention method based on a blockchain, which is suitable for an SDN cloud network controller, and the method comprises the following steps:

[0007] When a broadcast request sent by a target controller is detected, the broadcast request is verified by an LPBFT algorithm, and when the verification fails, a defense stage is entered, and a controller with the highest trust value in the SDN cloud network controller is determined as a master controller;

[0008] In the defense stage, the master controller determines whether the target controller has failed;

[0009] If it is determined that the target controller has not failed, the type of attack of the target controller is determined, and each slave controller is subjected to a defense operation matching the type of attack by the master controller; wherein the slave controller is a controller in the SDN cloud network controller except the master controller and the target controller;

[0010] If it is determined that the target controller has failed, or after each slave controller is subjected to a defense operation matching the type of attack, the master controller performs a corresponding migration operation on each switch managed by the target controller.

[0011] Optionally, when a broadcast request sent by a target controller is detected, the broadcast request is verified by an LPBFT algorithm, and when the verification fails, a defense stage is entered, and a controller with the highest trust value in the SDN cloud network controller is determined as a master controller, comprising:

[0012] When the broadcast request of the target controller is detected, the broadcast request is forwarded to an initial controller; the initial controller is a controller except the other controllers in the SDN cloud network controller and the target controller;

[0013] When the preparation message matching of the initial controller is successful, a target preparation message is generated according to the preparation message and the identity information of the initial controller, and the target preparation message is distributed to each other controller;

[0014] Each of the other controllers verifies the target preparation message;

[0015] If each of the other controllers is verified, a corresponding reply is fed back to the target controller, so that the target controller stores the reply of each of the other controllers in a local block;

[0016] If any of the other controllers fails to verify, a defense stage is entered, and a controller with the highest trust value in the SDN cloud network controller is determined as a master controller.

[0017] Optionally, in the defense stage, the master controller determines whether the target controller has failed, comprising:

[0018] controlling the target controller to send transmission information to the master controller;

[0019] acquiring, by the master controller, a transmission time delay of the transmission information, and determining whether the transmission time delay of the transmission information is greater than a preset maximum time delay;

[0020] if the transmission time delay of the transmission information is greater than the maximum time delay, determining that the transmission of the transmission information fails, and determining that the target controller has a fault.

[0021] Optionally, the determining, by the master controller, whether the target controller has a fault in the defense stage, comprises:

[0022] receiving, by the master controller, controller timeout information sent by each slave controller to the target controller in the defense stage;

[0023] if the number of controllers sending the controller timeout information is determined to exceed a preset number, contacting, by the master controller, any one of the slave controllers with the target controller;

[0024] if the target controller cannot be contacted, determining that the target controller has a fault.

[0025] Optionally, the performing, by the master controller, corresponding migration operations on each switch managed by the target controller, comprises:

[0026] acquiring, by the master controller, a set of out-of-control switches, wherein the set of out-of-control switches comprises each switch managed by the target controller;

[0027] determining, by the master controller, a switch network domain based on a sub-network domain clustering algorithm according to a preset regulation and control parameter and the set of out-of-control switches;

[0028] dividing, by the master controller, a controller set that migrates each switch managed by the target controller from each slave controller based on a migration-in controller adjustment algorithm and the switch network domain;

[0029] determining, by the master controller, a controller matched with each switch managed by the target controller from the controller set based on a migration-in control algorithm, and migrating each switch managed by the target controller into the matched controller.

[0030] The second aspect of the present application provides an intrusion prevention system based on a block chain, which is suitable for an SDN cloud network controller, and the system comprises:

[0031] The verification unit is configured to verify the broadcast request sent by the target controller by using an LPBFT algorithm when detecting the broadcast request, and enter a defense stage when the verification fails, and determine a controller with the highest trust value in the SDN cloud network controller as a master controller.

[0032] The judgment unit is configured to determine whether the target controller fails by using the master controller when in the defense stage.

[0033] The defense unit is configured to determine an attack type of the target controller if it is determined that the target controller does not fail, and perform a defense operation matched with the attack type on each slave controller by using the master controller, wherein the slave controller is a controller other than the master controller and the target controller in the SDN cloud network controller.

[0034] The migration unit is configured to perform a corresponding migration operation on each switch managed by the target controller by using the master controller if it is determined that the target controller fails or after the defense operation matched with the attack type is performed on each slave controller.

[0035] Optionally, the verification unit comprises:

[0036] The forwarding unit is configured to forward the broadcast request to an initial controller when detecting the broadcast request of the target controller, wherein the initial controller is a controller other than the target controller and other controllers in the SDN cloud network controller.

[0037] The broadcast unit is configured to generate a target preparation message according to the preparation message and identity information of the initial controller and distribute the target preparation message to each other controller when the preparation message matches the target controller by using the initial controller.

[0038] The verification subunit is configured to verify the target preparation message by using each other controller.

[0039] The storage unit is configured to feed back a corresponding reply to the target controller if each other controller is verified, and store the reply fed back by each other controller to a local block by using the target controller.

[0040] The sending unit is configured to enter the defense stage and determine a controller with the highest trust value in the SDN cloud network controller as the master controller if any other controller fails.

[0041] Optionally, the judgment unit comprises:

[0042] The transmission information sending unit is configured to control the target controller to send transmission information to the main controller.

[0043] The judgment subunit is configured to acquire a transmission time delay of the transmission information by the main controller, and judge whether the transmission time delay of the transmission information is greater than a preset maximum time delay.

[0044] The first determination unit is configured to determine that the transmission of the transmission information fails and the target controller is faulty if the transmission time delay of the transmission information is greater than the maximum time delay.

[0045] The third aspect of the present application provides an electronic device, comprising: a processor and a memory, the processor and the memory are connected through a communication bus; wherein the processor is used to call and execute the program stored in the memory; the memory is used to store the program, and the program is used to realize the intrusion prevention method based on the block chain provided by the first aspect of the present application.

[0046] The fourth aspect of the present application provides a computer readable storage medium, the computer readable storage medium stores computer executable instructions, and the computer executable instructions are used to execute the intrusion prevention method based on the block chain provided by the first aspect of the present application.

[0047] The application provides a blockchain-based intrusion prevention method and system, an electronic device and a storage medium, which are suitable for an SDN cloud network controller. When a broadcast request sent by a target controller is detected, the broadcast request is verified through an LPBFT algorithm, and when the verification fails, a defense stage is entered, and a controller with the highest trust value in the SDN cloud network controller is determined as a master controller. In the defense stage, whether the target controller fails is determined by the master controller. If it is determined that the target controller does not fail, the attack type of the target controller is determined, and each slave controller is subjected to a defense operation matched with the attack type through the master controller. If it is determined that the target controller fails, or after each slave controller is subjected to a defense operation matched with the attack type, each switch managed by the target controller is subjected to a corresponding migration operation through the master controller. Therefore, the technical solution provided by the application can verify the target controller that broadcasts a request through an LPBFT algorithm, and can detect whether a controller that fails or attacks exists in time. In the case where it is determined that the target controller that attacks exists, the specific intrusion behavior and single-point failure problem are considered, and the network resources of the controller are consumed by the behavior of the attacker after the intrusion fails, so that the SDN cloud network controller cannot normally provide services. Each slave controller can be subjected to a defense operation matched with the attack type through the master controller, and each switch managed by the target controller can be subjected to a corresponding migration operation through the master controller, so that the controller with the problem can be effectively isolated, and the intrusion prevention of the SDN cloud network controller is realized. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of the provided drawings.

[0049] Figure 1 A flowchart of a blockchain-based intrusion prevention method provided by an embodiment of the present application;

[0050] Figure 2 An example diagram of a working process of a control plane of an SDN cloud network controller provided by an embodiment of the present application;

[0051] Figure 3 An example diagram of broadcasting messages between controllers by using an LPBFT algorithm provided by an embodiment of the present application;

[0052] Figure 4 A DDoS attack principle schematic diagram provided for an embodiment of the present application;

[0053] Figure 5 Another structure schematic diagram of a blockchain-based intrusion prevention system provided for an embodiment of the present application;

[0054] Figure 6 A structure schematic diagram of an electronic device provided for an embodiment of the present application. DETAILED DESCRIPTION

[0055] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0056] In the present application, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between the entities or operations. Moreover, the terms “include”, “contain” or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement “including a…” does not exclude the presence of another same element in the process, method, article or device including the element.

[0057] In order to better understand the present application, the technical names related to the present application are explained as follows:

[0058] Blockchain: In a narrow sense, blockchain is a chain-like data structure in which data blocks are sequentially combined, and is a distributed ledger that is guaranteed to be non-tamperable and non-forged by cryptography. In a broad sense, blockchain technology is a new distributed infrastructure and computing paradigm that uses block chain-like data structure to verify and store data, uses distributed node consensus algorithm to generate and update data, uses cryptography to guarantee the security of data transmission and access, uses smart contracts composed of automatic script code to program and operate data.

[0059] Software Defined Network (SDN): A new network innovation architecture proposed by the Clean-Slate research group at Stanford University. It is an implementation of network virtualization. Its core technology, OpenFlow, separates the control plane from the data plane of network devices, enabling flexible control of network traffic and making the network more intelligent, providing a good platform for innovation in core networks and applications.

[0060] Practical Byzantine Fault Tolerance (PBFT): An algorithm that enables a distributed system to reach consensus under the Byzantine fault model. PBFT was proposed by Castro and Liskov in 1999. It is a special processor mechanism that enables a distributed system to function normally and reach consensus even in the presence of malicious behavior. PBFT is widely used in various applications that use the Byzantine fault tolerance model, such as consensus algorithms in blockchain.

[0061] Distributed Denial of Service (DDoS): Multiple attackers at different locations simultaneously attack one or more targets, or an attacker controls multiple machines at different locations and uses them to attack the victim simultaneously. Since the attack is launched from different locations, this type of attack is called Distributed Denial of Service, and the attackers can be multiple.

[0062] Smart Contract: A special protocol designed to provide, verify, and execute contracts. Specifically, smart contracts are an important reason why blockchain is called "decentralized". They allow us to perform traceable, irreversible, and secure transactions without the need for a third party. Smart contracts contain all the information about the transaction and will only execute the result operation after the requirements are met. The difference between a smart contract and a traditional paper contract is that a smart contract is generated by a computer. Therefore, the code itself explains the obligations of the parties involved.

[0063] From the foregoing background art, in recent years, the rapid development of Internet finance has posed a strong impact on traditional banks, and has also promoted the pace of traditional banks to transform towards financial technology. At present, many commercial banks have clearly defined the development direction of "financial technology bank", aiming to realize business networking, online, digitization and intelligentization through Internet, cloud computing, big data, artificial intelligence, blockchain and other technological changes, and to improve the efficiency of financial services and provide inclusive, personalized and intelligent services to customers. The transformation process urgently needs new infrastructure to match it: the business requires rapid deployment online, and can be deployed flexibly without being limited by physical location; the infrastructure should be able to support business innovation and enable rapid changes; and it should be able to quickly diagnose and locate faults when they occur.

[0064] In the face of these problems, the banking industry needs to break through traditional ideas and use virtual pool technology such as computing virtualization, network virtualization and storage virtualization to promote the transformation of traditional data centers to cloud data centers. The most obvious feature of cloud data centers is the extensive use of virtual pool technology. The earliest developed computing virtualization technology has been widely used, solving the problems of low utilization of data center computing resources, high operation and maintenance costs, and conflicts between various business applications. The large-scale application of computing virtual pool technology has put new requirements on the network, such as network large Layer 2 interworking, multi-tenant business isolation, single-tenant business secure intercommunication, and network configuration automation visualization. SDN technology is mainly used to achieve network virtual pool. SDN technology has the following advantages: automation, enabling on-demand allocation of virtual network resources and flexible business delivery; business decoupling, enabling decoupling of virtual and physical networks, especially network location decoupling, enabling flexible scheduling of resources on a large scale; supporting multiple businesses while achieving isolation control between businesses; programmable, enabling network to quickly implement business logic and individualized network control; separation of control and forwarding, with the data forwarding layer focusing on data forwarding and the controller focusing on data forwarding logic, shielding underlying complexity.

[0065] As the core component of the SDN cloud network controller, the control plane plays a bridging role, interacts with various applications through the northbound interface, and communicates with the switches of the data plane through the southbound interface. The security of the control plane is directly related to the stability and reliability of the entire SDN cloud network controller. Although the hierarchical multi-controller distribution architecture of the SDN cloud network controller reduces the risk of single-point failure of the controller to some extent, the security of each SDN domain of the SDN cloud network controller cannot be effectively guaranteed, and regional controllers still face security threats such as illegal intrusion and DDoS attacks.

[0066] In order to improve the overall security and efficiency of the SDN control plane, the application provides a blockchain-based intrusion prevention method, system, electronic device and storage medium, which can use the LPBFT algorithm to verify the target controller requesting broadcast, and can detect whether there is a faulty or attacked controller in time; At the same time, the smart contract technology is used to deal with such security risks, that is, the master controller performs matching defense operations on each slave controller according to the attack type; Considering the possible out-of-control or failure of the controller, the master controller can perform corresponding migration operations on each switch managed by the target controller, which not only ensures the shortest communication delay between the switch and the migrated controller, but also avoids the load oscillation problem of the controller end, and improves the fault recovery efficiency.

[0067] Referring to Figure 1 , a flowchart of a blockchain-based intrusion prevention method provided by an embodiment of the application is shown, which is suitable for an SDN cloud network controller, and the method specifically includes the following steps:

[0068] S101: When detecting a broadcast request sent by a target controller, the broadcast request is verified by the LPBFT algorithm, and when the verification fails, the defense stage is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the master controller.

[0069] In the embodiment of the application, the LPBFT algorithm is a lightweight consensus algorithm based on the practical Byzantine fault tolerance (PBFT) algorithm of the blockchain, which makes up for the shortcomings of the traditional PBFT, such as low consensus efficiency, poor self-healing, and insufficient anti-destroying, etc., simplifies the PBFT consensus process, makes the message transmission and verification parallel, and classifies the requests to ensure that urgent requests can be handled quickly and effectively.

[0070] Specifically, the process of verifying the broadcast request by the LPBFT algorithm can be: when there is a target controller that wants to broadcast a request to other controllers, the broadcast request is verified by each of the other controllers within the SDN cloud network controller; if the other controllers confirm that the broadcast request is verified, that is, the target controller is valid, the broadcast request is continued to be processed, and a corresponding reply is sent to the target controller, and when the target controller receives multiple replies (results of request operations) with the same result from different other controllers, each reply received is written into the local block, so as to calculate the trust value and weight of each controller. Otherwise, it will enter the defense stage and stop processing the broadcast request; at the same time, the controller with the highest trust value in the SDN cloud network controller is taken as the master controller, and the master controller leads the normal controllers (controllers other than the master controller and the target controller) to resist the influence of the bad controller (the target controller); it can also clear the trust value of the target controller and restart the next view after the defense stage.

[0071] It should be noted that the target controller and each of the other controllers are controllers under the SDN cloud network controller. For each controller under the SDN cloud network controller, when the joining request of the controller is detected, in order to ensure the security of the control plane of the SDN cloud network controller, the joining of the controller needs to be verified by the administrator first, at this time, a controller randomly specified by the administrator can be taken as an initial controller, and the initial controller is used to verify the controller; in the case where it is determined that the verification of the controller is passed, the controller is added to the trusted list of the SDN cloud network controller.

[0072] For example, assuming that the joining controller is controller B and the initial controller is controller A; the process of verifying the controller by the controller A can be: the controller B sends a request to the controller A to obtain the public key of the controller A, and uses the public key to encrypt its own information and sends it to the controller A, so that the controller A verifies the received information. If the verification is successful, it is determined that the verification of the controller B is passed, and the controller A adds the controller B to the trusted list, so that the next controller can request the controller A or the controller B for identity verification to obtain access permission, and then realize full connection of the control plane.

[0073] It should also be noted that the workflow of the control plane of the SDN cloud network controller mainly includes four stages, see Figure 2 , and the specific content is as follows:

[0074] First, the controller verifies, records and parses the information from the switch. For example Figure 2As shown, the switch sends messages (packets) such as Stats_Reply, Features_Reply and Packet_In to the controller, and the analysis center uses the Stats_Reply in the packet to analyze the status of the local network, wherein the Features_Reply represents the own feature information of the switch, and the Packet_In and Flow_Mod are a corresponding set of messages, respectively used for requesting and replying the flow table information.

[0075] Secondly, the controller extracts the topology status of the route and the status set of the switch to construct a topology graph of the network flow, which dynamically displays the local traffic. Meanwhile, each information involved is stored in the local block so as to trace back to the source when a problem occurs.

[0076] Thirdly, the controller uploads the related data to the blockchain after verification by other blockchain nodes to form a global view, which is divided into a periodic mode and a triggered mode. When the network is normally running, the controller manages the respective domain and periodically updates the global network topology, but when the controller issues an alarm, the global view will be immediately updated, so that each controller can understand the general situation of the network and provide feedback about the alarm controller. The block will record every step of operation including the management and modification of the global view of the controller, and the trust value percentage of the controller will increase a little bit each time the block is successfully uploaded.

[0077] Finally, the analysis center analyzes the status information of each switch and controller in the block, so as to use the smart contract to automatically formulate the corresponding response strategy (defense operation) for different attack types.

[0078] As a preferred mode of the embodiment of the application, when the broadcast request sent by the target controller is detected, the broadcast request is verified by the LPBFT algorithm, and when the verification fails, the defense stage is entered, and the process of determining the controller with the highest trust value in the SDN cloud network controller as the master controller can be specifically: when the broadcast request of the target controller is detected, the broadcast request is forwarded to the initial controller; the initial controller is a controller other than the target controller and the other controllers in the SDN cloud network controller; when the initial controller matches the preparation message successfully, the target preparation message is generated according to the preparation message and the identity information of the initial controller, and the target preparation message is distributed to each other controller; the target preparation message is verified by each other controller; if each other controller is verified, the corresponding reply is fed back to the target controller, so that the target controller stores the reply of each other controller in the local block; if any other controller fails to verify, the defense stage is entered, and the controller with the highest trust value in the SDN cloud network controller is determined as the master controller.

[0079] In some embodiments, the trust value of each controller under the SDN cloud network controller can be evaluated by a corresponding trust evaluation rule, and the controller with the highest trust value is determined as the master controller.

[0080] Wherein, the trust evaluation rule can be: "service" as the standard for evaluating the trustworthiness of the controller, in the SDN cloud network controller, "service" can be considered as "transaction" stored in the blockchain. Here, the reputation in the SDN cloud network controller is defined from two aspects of utility and time respectively. Specifically, the reputation can be considered from the control layer and the data layer respectively. In the control layer, each "service" should be verified before storage, and the number of valid "services" represents the number of controllers that have been successfully verified. In the data layer, the more switches a controller manages, the more important the controller is. In terms of time, the normal working time and the number of rounds of the controller to some extent reflect its invulnerability. Therefore, the trust value of each controller can be defined as The trust value of each controller is calculated by the following parameters, by adding these evaluation criteria to the blockchain, the master-slave relationship of the controllers participating in the contract can be determined, that is, the master controller and the slave controller are determined from the various controllers, so that the system can solve the security hidden danger as soon as possible. The specific calculation method is shown in formula (1).

[0081] (1)

[0082] Wherein, in formula (1), , , , represent the proportion of valid "services", the number of managed switches, the duration of normal work and the round; , , , represent the weight parameters of the above four indexes.

[0083] It should be noted that the LPBFT algorithm includes three stages, namely the preparation stage prepare, the submission stage commit and the reply stage reply; wherein, the preparation stage mainly confirms the validity of the request and the controller, that is, the validity of the broadcast request sent by the target controller is verified; in the subsequent submission stage, the controllers reach an agreement and execute the request, and in the reply stage, the corresponding broadcast request of the controller is replied that it has been processed.

[0084] In actual use, in the preparation stage of the LPBFT algorithm, the corresponding verification can be carried out in the form of encryption and question and answer. Specifically, the controller A (target controller) sends the corresponding broadcast request to other controllers, wherein the broadcast request carries an encrypted preparation message, and the message format is represents the view in which controller A is located, is the sequence number sorted by controller A according to the request stored by itself, is the identity information of the controller, represents the answer to the question set by the main controller, is the content of the summary, subscript represents the encryption process. Controller A will send a broadcast request carrying the preparation message to the initial controller, and add the preparation message to its local block.

[0085] The initial controller After receiving the broadcast request sent by controller A, it confirms whether the preparation message in the broadcast request matches, and if it matches successfully, the controller enters the next commit phase and generates a goal preparation message according to the preparation message to broadcast the generated goal preparation message to other controllers except controller A, and then adds the preparation message and the generated commit message to the log. When other controllers receive the goal preparation message, if the view and number in the goal preparation message are the same, but the summary is different, the other controllers will reject the message and report the exception to the main controller, and then record the exception report in the blockchain, that is, step S103 is executed. If the view, number and summary in the goal preparation message are all the same, enter the corresponding reply phase, reply to the corresponding reply to controller A to inform controller A to complete the processing of the broadcast request, so that controller A stores the reply feedback from each other controller in the local block.

[0086] It should be noted that the broadcast of messages between controllers using the LPBFT algorithm is as shown in Figure 3 . Among them, the LPBFT algorithm uses a three-stage protocol (Prepare, Commit, Reply) to complete the broadcast of requests between controllers, from Figure 3 ​As can be seen, the dashed line represents the broadcast process of the LPBFT algorithm, and the solid line represents the broadcast process of the traditional PBFT algorithm. PBFT is originally mainly applied to a distributed system composed of state machine replicas, and the same serialization process must be completed on each distributed node, but this is not the case in the SDN cloud network controller. In PBFT (a five-phase protocol), there are two consensus in the preparation phase and the commit phase to ensure that the decisions and operations of each node are the same, but in LPBFT, only one consensus is needed to complete the authentication and decision of the controller. Because there are many different types of broadcast requests in the SDN cloud network controller, the broadcast requests can be queued according to the priority when processing the broadcast requests, so it is not necessary to sort each broadcast request received in the SDN cloud network controller, and the broadcast requests can be automatically processed according to the priority of each broadcast request and the principle of first come first served of the same level broadcast requests.

[0087] Further, in the embodiment of the present application, in the commit phase, for each controller, when the number of malicious controllers is limited, the controller will execute the request according to the principle of "majority rule". The controller collects the commit messages in the log, and verifies the view, digest and sequence number in the commit message to confirm whether the controller is ready. When the number of prepared commit messages of different controllers reaches N, it is true, and the request state on the controller is executable, and finally the corresponding operation is performed according to the request. Among them, the verification of the view, digest and sequence number in the commit message to confirm whether the controller is ready belongs to a common verification technology, which will not be described in detail.

[0088] S102: In the defense phase, determine whether the target controller fails by the master controller; if it is determined that the target controller does not fail, execute step S103; if it is determined that the target controller fails, execute step S104.

[0089] In the embodiment of the present application, the security of the SDN cloud network controller can be improved by limiting the communication time, adding a reply mechanism and evaluating the credibility, and the target controller can be detected whether it fails by limiting the communication time and adding the reply mechanism. If it is determined that the target controller fails, S104 can be executed; if it is determined that the target controller does not fail, the target controller can be determined as an attacker, and then S103 can be executed.

[0090] As a preferred manner of the embodiment of the present application, in the defense stage, the process of determining whether the target controller is faulty by the master controller can be specifically: the target controller sends transmission information to the master controller; the master controller acquires the transmission time delay of the transmission information, and determines whether the transmission time delay of the transmission information is greater than the preset maximum time delay; if the transmission time delay of the transmission information is greater than the maximum time delay, it is determined that the transmission of the transmission information fails, and it is determined that the target controller is faulty; if the transmission time of the transmission information is not greater than the maximum time delay, it is determined that the transmission of the transmission information succeeds, and it is determined that the target controller is not faulty, at this time, it can be considered that the target controller is likely to be an attacker.

[0091] Specifically, in order to ensure the integrity and security of the information (broadcast request, preparation message, target preparation message, etc.) in the transmission process, it is necessary to control the transmission time of each piece of information within a certain range, therefore, the maximum delay may be set. Whether the information is valid or not is related to the transmission delay, if the transmission delay of the information does not exceed the maximum delay , it can be considered that the information is valid, otherwise, it can be considered that the message may have been intercepted and tampered with, or a communication failure has occurred, that is, it can be considered that the target controller is faulty. In this case, the information will fail to be transmitted and be ignored; wherein, the maximum delay may be represented by the maximum arrival delay calculated in the previous view.

[0092] As another preferred manner of the embodiment of the present application, in the defense stage, the process of determining whether the target controller is faulty by the master controller can be: in the defense stage, the master controller receives the controller timeout information sent by each slave controller to the target controller; if it is determined that the number of controllers sending the controller timeout information exceeds the preset number, the master controller contacts the target controller based on any slave controller; if the target controller cannot be contacted, it is determined that the target controller is faulty; if the target controller can be contacted, it is determined that the target controller is not faulty, at this time, it can be considered that the target controller is likely to be an attacker.

[0093] It should be noted that the slave controller is a controller other than the master controller and the target controller in the SDN cloud network controller.

[0094] Specifically, the preset number can be 1 / 3 of the total number of slave controllers; if the master controller receives more than 1 / 3 of the slave controllers reporting that a certain controller is timeout, that is, receives the controller timeout information sent to the target controller more than 1 / 3 of the total number of slave controllers, the master controller will broadcast a message to other slave controllers to contact the target controller. If the slave controller finds that the target controller is working normally, it will receive a short message returned by the target controller to confirm the status of the target controller. Otherwise, a reply message is returned to the master controller, reporting that the target controller can have been compromised. In order to avoid further deterioration of the problem, the master controller generates a switch allocation request and issues it to the slave controllers, and when the number of slave controllers that agree to the switch allocation request reaches

[0095] S103: Determine the attack type of the target controller, and perform a defense operation matching the attack type on each slave controller through the master controller.

[0096] In the process of specifically performing step S103, in the case where it is determined that the target controller has not failed, the target controller can be considered to be an attacker, and at this time the attack type of the target controller can be determined, wherein the attack type is a DDoS attack type; a DDoS mitigation contract matching the DDoS attack type is generated through the master controller, and the DDoS mitigation contract is distributed to each slave controller, so that each slave controller reduces the attack of the target controller based on the DDoS mitigation contract.

[0097] It should be noted that, referring to Figure 4 In a DDoS attack, an attacker initiates an attack on a victim (slave controller) through multiple hosts distributed in a network, utilizes the asymmetry of resources, and generates a huge attack flow to cause the service of the other party to be paralyzed, so that legitimate users cannot normally access the target service. Among them, the controlled host is called a puppet machine, and the network composed of puppet machines is called a botnet. By utilizing the resource asymmetry between the victim and the botnet, a DDoS attack can generate a huge attack flow and cause serious damage.

[0098] The applicant has found that, for the special architecture of an SDN cloud network, an attacker can send a large number of meaningless data packets to an SDN switch. These data packets enter the switch but cannot match the flow table, and at this time they will be successively encapsulated as Packet_In messages and sent to the controller. A large number of Packet_In messages occupy the resources and bandwidth of the controller, thereby causing a denial of service of the controller.

[0099] The present application proposes corresponding solutions from two aspects of DDoS attack detection and mitigation and subsequent protection of the controller:

[0100] ​(1) Attack detection and mitigation: For DDoS attacks, the smart contract will periodically check the state of the controller and traverse the transactions, state machines, and trigger conditions contained in the contract, then put the transactions that meet the trigger conditions into the verification queue and wait for consensus, and the transactions that do not meet the trigger conditions will continue to be stored in the blockchain. The DDoS alarm contract will be generated and broadcast after the analysis center discovers abnormal traffic, first verifying the security and validity of each controller, then inputting the verified controllers into the consensus set, and after successfully reaching a consensus of the majority of nodes, the most reliable master controller is elected according to the trust mechanism of the LPBFT algorithm, so that in the case of determining that the target controller is an attacker, the master controller generates a DDoS mitigation contract and distributes it to other controllers (slave controllers) to help reduce the DDoS attacks on other controllers by the target controller. In order to ensure the overall fairness of the network, the same controller cannot be repeatedly elected as the master controller in two consecutive views.

[0101] (2) Subsequent protection: The smart contract is implemented based on the trust mechanism of the LPBFT algorithm, ensuring that the emergency can be effectively resolved. After the alarm is lifted, the alarm controller (slave controller) will perform multiple verification steps to ensure the safety and reliability of the control plane. At the same time, each slave controller will upload the corresponding state information to the block to analyze the current state of the controller, the mitigation effect, the attack source, and the impact on other controllers, and each attack interval event will be recorded in the block to facilitate the system to perform related analysis.

[0102] It should be noted that in order to better illustrate the advantages of the LPBFT algorithm compared to the traditional PBFT algorithm, the present application analyzes the LPBFT algorithm based on game theory. The game model is defined as wherein is the participant, represents the attacker, represents the defender (controller). The strategy set of the attacker and the controller is defined, is the utility function of the attacker and the controller.

[0103] The specific analysis process is as follows:

[0104] Assume that the attacker attacks controllers at the same time attack controllers in controllers, represents the time consumed by the attacker to break through the firewall of the controller and tamper with the controller information. represents the number of requests sent within time The request verification process is performed simultaneously with the request initiation, so the request initiation interval is equal to the verification interval. Assume that the time interval of request initiation is The negative exponential distribution is satisfied, with the distribution parameter The number of controllers recovered in each attack cycle is In the next attack time , the probability that a controller will send a request is In the next attack time , the probability that a controller will send more than one request is In an arbitrary attack time , the probability that an attacker will successfully attack is Therefore, during this period, there will be controllers that are compromised. As long as the proportion of controllers that are successfully compromised does not exceed 1 / 3, the network can still operate normally.

[0105] In the th attack cycle, assume that there are controllers that will be compromised, and can be expressed as Therefore, the likelihood of successfully attacking a certain controller can be obtained by the following equation: Thus, for a certain attacker, the defined cost includes the invasion cost (i.e., the cost of invading a controller) and the penalty cost (i.e., the cost of being detected). If the attack is successful, it will obtain the gain of successful invasion .

[0106] For a certain defender, the cost is defined as the cost of a controller being unable to resist invasion. If the controller is working normally, it will obtain the gain If the main controller successfully discovers the problem controller, it will obtain the gain .

[0107] Therefore, the utility function of an attacker can be expressed as: The utility function of a defender can be expressed as: .

[0108] Wherein, the PBFT algorithm and the LPBFT algorithm are compared, as shown in Table 1, compared with the PBFT algorithm, the LPBFT algorithm has more advantages in tolerating error nodes, although the PBFT algorithm can tolerate 1 / 3 of the invaded nodes, but it must meet the premise that the master node is not invaded, and the network can keep normal operation, while the LPBFT algorithm has a fair master node trust value election mechanism, and the trust value is closely related to the proportion of effective service and service time of each controller in daily work, and is uploaded to the block chain to ensure that the information is real and effective and cannot be tampered with, so it is more secure and robust. In addition, it can also be seen that the LPBFT algorithm is better in transaction performance, because the data volume in the bank SDN cloud network controller is large, the PBFT algorithm cannot meet its requirements for high message volume, while the LPBFT algorithm simplifies the verification and consensus process, greatly reducing the signaling quantity. Wherein, the consensus parameter comparison of the PBFT algorithm and the LPBFT algorithm.

[0109] Table 1:

[0110]

[0111] Wherein, from Table 1, it can be seen that in terms of invulnerability, unlike the PBFT algorithm, the LPBFT algorithm finds the invaded controller by analyzing the data recorded on the block chain, and has a mechanism for processing suspicious controllers. In this case, the LPBFT algorithm can obviously slow down the overall speed of the SDN cloud network controller being destroyed, and when attacked, it can also respond in time and perform the corresponding defense operation according to the attack type. Each block records the activity content and time stamp, so that each controller can realize self-checking and recovery under a specific attack, and after the attack is alleviated, activity analysis will be performed and the entity source generating the activity will be tracked.

[0112] In addition, in terms of architecture, the multi-controller trust election mechanism of the control plane of the SDN cloud network controller solves the "single point of failure" problem. In addition, other controllers can also help the problem controller (target controller) to get out of trouble, under this architecture, the focus of abnormal point monitoring can be placed on identity and traffic to ensure that the controller can operate normally, and at the same time, the programmable characteristics of the SDN cloud network controller and the scalability of the architecture can be improved.

[0113] In terms of privacy and integrity of information, each controller manages its own private key and distributes public key by using blockchain, and the encrypted fragments of controller information are stored on the blockchain and are not accessible and controllable by any third party, thus ensuring the privacy of data. The blockchain is composed of a distributed database that is readable, addable and non-deletable, and maintains a list of transactions in blocks. The blocks on the chain provide security by holding a timestamp and the hash value of the previous block, that is, once the block is successfully recorded, it is difficult to tamper with the data in the block, thus ensuring the integrity of the data.

[0114] S104: performing corresponding migration operations on each switch managed by the target controller through the master controller.

[0115] In the process of specifically performing step S104, after determining that the target controller has a short-time difficult-to-repair failure or determining that the target controller is an attacker, each switch managed by the target controller needs to be dynamically migrated to find a suitable migration-in controller, and in the process of dynamic migration, how to balance the load, latency and resource consumption is a problem that needs to be solved by the switch migration.

[0116] The applicant found through research that in an SDN cloud network controller, each SDN domain contains a controller , assuming that each switch matches only one controller, use to represent the set of controllers, wherein the set of controllers includes each slave controller. Then, the switch-controller relationship in the SDN cloud network controller is shown in formula (2) and formula (3):

[0117] (2)

[0118] (3)

[0119] Wherein, V is a switch, is a controller corresponding to an SDN domain, and M is a set of controllers.

[0120] However, since most of the control resources in the SDN cloud network controller are occupied by Packet_in messages, the applicant takes the reception speed of the Packet_in event as the main load factor of the controller, and the indicator variable represents whether the switch matches the controller . To ensure the normal operation of the SDN cloud network controller, the upper limit of the controller load capacity of the controller matched with the switch should always be greater than the total load of the switch, as shown in formula (4):

[0121] (4)

[0122] wherein, denotes the load of the switch, and is the load upper limit of the controller.

[0123] If the migration load of the taken-over switch exceeds the remaining load of the migrated-in controller, the controller will give up the excess load, thus, the present application uses load oscillation to describe this phenomenon that the switch load is repeatedly transferred. The real-time load of the controller is denoted by , to improve the recovery efficiency, it is necessary to ensure that the load of the controller after taking over the migrated switch is not greater than the load upper limit, that is, formula (5) is satisfied:

[0124] (5)

[0125] In the process of finding a suitable migrated-in controller for the out-of-control switch (the switch managed by the target controller), the overhead required for activating each controller is , therefore, the total overhead of activating the controller in the fault recovery process can be represented by formula (6):

[0126] (6)

[0127] As can be seen from formula (6), when the value of the indicator variable is equal to 1, the controller is selected as the migrated-in target, otherwise is equal to 0.

[0128] As the main factor limiting the efficiency of controller fault recovery, the communication delay between the controller and the switch can be represented by the delay matrix as shown in formula (7):

[0129] (7)

[0130] wherein, is the number of switches to be migrated (the number of switches managed by the target controller), the number of normal controllers is , and the communication delay between the controller and the switch is denoted by .

[0131] ​Assuming that the time taken for the controller to process Packet_in events is equal, the time taken to process a single request will be constrained by the communication latency. That is, the smaller the latency, the shorter the recovery time. Therefore, the total time required to recover all switches to be migrated can be expressed as shown in formula (8):

[0132] (8)

[0133] Among them, in formula (8) A request message indicating that the switch to be migrated has arrived at the controller. The time taken can be expressed by formula (9):

[0134] (9)

[0135] in, Representative switch The number of Packet_in messages generated.

[0136] Assuming the total load of the out-of-control switch is always less than the total load of the normal controller, based on the above analysis, the controller fault recovery problem under the SDN cloud network controller needs to focus on achieving the following three objectives: 1. Minimize the time spent on the migration process and reduce network packet loss rate. 2. Ensure no load oscillation occurs and improve recovery efficiency. 3. Limit the number of controllers activated during migration to reduce recovery overhead.

[0137] In summary, the set of all switches within the SDN domain to which the uncontrolled controller belongs can be used... This indicates the use of indicator variables. Representative controller Has the switch been taken over? Indicator variable This represents the controller. Whether it is used as an inbound controller. Therefore, the objective function can be obtained as shown in the following formula (10):

[0138] (10)

[0139] Subject to:

[0140] (11)

[0141] (12)

[0142] (13)

[0143] (14)

[0144] For any , there is , and , for any , there is ; formula (11) ensures that the fault recovery process does not involve additional controllers, that is, all the migrated controllers belong to the original SDN domain. Formula (12) ensures that there is no load oscillation phenomenon when performing fault recovery; formula (13) indicates that the activation cost of the migrated controller must not be higher than the upper limit of the budget. Formula (14) ensures that all out-of-control switches are migrated to the appropriate migrated controller, thereby completing the fault recovery.

[0145] As a preferred mode of an embodiment of the present application, in the case of determining that the target controller fails or each slave controller performs a defense operation matching the attack type, the process of performing a corresponding migration operation on each switch managed by the target controller by the master controller can be specifically: obtaining, by the master controller, an out-of-control switch set, wherein the out-of-control switch set includes each switch managed by the target controller; determining, by the master controller, a switch network domain based on a sub-network domain clustering algorithm according to a preset regulation parameter and the out-of-control switch set; dividing, by the master controller, a controller set of each switch managed by the target controller from each slave controller based on a migrated controller adjustment algorithm and the switch network domain; determining, by the master controller, a controller matching each switch managed by the target controller from the controller set based on a migrated control algorithm, and migrating each switch managed by the target controller to the controller matching the same.

[0146] In some embodiments, when performing the selection and migration of the out-of-control switch to the migrated controller, the activated number of the migrated controller (slave controller) needs to be controlled, and a certain amount of capital expenditure must be paid for the process. In order to save the repair expenditure as much as possible, the number of activated controllers for migration needs to be controlled, and a proper number of controllers is used to perform the migration of the switch. Based on this problem, the present application provides a sub-network domain clustering algorithm, which combines binary search and division of the network domain, and after determining the number of migrated controllers, divides all out-of-control switches in the network into network domains consistent with the number of migrated controllers according to the shortest delay principle. The process of determining the switch network domain by the master controller based on the sub-network domain clustering algorithm according to the preset regulation parameter and the out-of-control switch set is specifically shown in Table 2:

[0147] Table 2:

[0148]

[0149] As can be seen from Table 2, in each loop, the sub-network domain clustering algorithm calculates the network delay under the current sub-network division, and compares it with the result of the last loop until the difference the solution of the problem, the solution should be corrected. Some controllers in the division result may not work properly, so these controllers do not meet the actual repair requirements. In addition, although the shortest time delay is met, too many switches are connected to the same migration controller, which may cause the load of the controller to exceed the upper limit of the load, and then cause load oscillation.

[0150] In some embodiments, the process of dividing the controller set of each switch managed by the migration target controller from each slave controller by the master controller based on the migration controller adjustment algorithm and the switch network domain is shown in Table 3:

[0151] Table 3:

[0152]

[0153] In some embodiments, for each switch network domain, if there is a controller near the solution position and the remaining load of the controller is sufficient to receive the switch load in the current domain, it is considered that the position of the controller is valid, and the remaining available load of the controller is updated. If the above conditions are not met, the controller with the shortest network communication time delay is considered as the migration target, and its remaining load is updated after migration, that is, the master controller determines the controller matched with each switch managed by the target controller from the controller set based on the migration control algorithm, and migrates each switch managed by the target controller to the matched controller. The specific execution process is shown in Table 4:

[0154] Table 4:

[0155]

[0156] In summary, for each switch, the controller with the minimum network communication time delay and sufficient available load is selected as the migration target of the switch (the matched controller of the switch), and the remaining load of the selected controller is updated after the selection. Through the adjustment of the migration controller, all switches can be normally migrated to the surrounding appropriate controllers, not only ensuring the shortest communication time delay between the switches and the migration controller, but also avoiding the load oscillation problem at the controller end, improving the fault repair efficiency, and ensuring the normal operation of the network.

[0157] Based on the above blockchain-based intrusion prevention method provided by the embodiments of the present application, the embodiments of the present application also provide a blockchain-based intrusion prevention system, as shown in Figure 5 The blockchain-based intrusion prevention system comprises:

[0158] The verification unit 51 is configured to verify the broadcast request by using the LPBFT algorithm when detecting the broadcast request sent by the target controller, and enter a defense stage when the verification fails, and determine the controller with the highest trust value in the SDN cloud network controller as the master controller;

[0159] The judgment unit 52 is configured to determine whether the target controller fails by the master controller in the defense stage.

[0160] The defense unit 53 is configured to determine the attack type of the target controller if it is determined that the target controller does not fail, and perform a defense operation matched with the attack type on each slave controller by the master controller, wherein the slave controller is a controller other than the master controller and the target controller in the SDN cloud network controller.

[0161] The migration unit 54 is configured to perform a corresponding migration operation on each switch managed by the target controller by the master controller if it is determined that the target controller fails or after the defense operation matched with the attack type is performed on each slave controller.

[0162] The specific principles and execution processes of each unit in the blockchain-based intrusion prevention system disclosed in the embodiments of the present application are the same as those in the blockchain-based intrusion prevention method disclosed in the embodiments of the present application, and can be referred to the corresponding parts in the blockchain-based intrusion prevention method disclosed in the embodiments of the present application, which will not be repeated here.

[0163] The application provides a blockchain-based intrusion prevention system applicable to an SDN cloud network controller, which verifies a broadcast request through an LPBFT algorithm when detecting the broadcast request sent by a target controller, and enters a defense stage when the verification fails, and determines a controller with the highest trust value in the SDN cloud network controller as a master controller; in the defense stage, the master controller determines whether the target controller fails; if it is determined that the target controller does not fail, the type of attack of the target controller is determined, and the master controller performs a defense operation matched with the type of attack on each slave controller; if it is determined that the target controller fails, or after the defense operation matched with the type of attack is performed on each slave controller, the master controller performs a corresponding migration operation on each switch managed by the target controller; therefore, the application uses the LPBFT algorithm to verify the target controller that broadcasts a request, can detect whether a controller that fails or attacks exists in time, and when it is determined that the target controller that attacks exists, performs a defense operation matched with the type of attack on each slave controller through the master controller, and performs a corresponding migration operation on each switch managed by the target controller through the master controller, effectively isolates the controller with problems, and realizes intrusion prevention of the SDN cloud network controller.

[0164] Optionally, the verification unit comprises:

[0165] The forwarding unit is configured to forward the broadcast request to an initial controller when detecting the broadcast request of the target controller; the initial controller is a controller other than the other controllers and the target controller in the SDN cloud network controller;

[0166] The broadcast unit is configured to generate a target preparation message according to the preparation message and the identity information of the initial controller, and distribute the target preparation message to each other controller when the preparation message is matched successfully by the initial controller;

[0167] The verification subunit is configured to verify the target preparation message by each other controller;

[0168] The storage unit is configured to feed back a corresponding reply to the target controller if each other controller is verified, so that the target controller stores the reply fed back by each other controller into a local block;

[0169] The sending yard is used for entering a defense stage if any other controller fails to be verified, and determining a controller with the highest trust value in the SDN cloud network controller as a master controller.

[0170] Optionally, the judging unit comprises:

[0171] The transmission information sending unit is configured to control the target controller to send the transmission information to the master controller.

[0172] The judging sub-unit is configured to acquire a transmission time delay of the transmission information by the master controller, and judge whether the transmission time delay of the transmission information is greater than a preset maximum time delay.

[0173] The first determining unit is configured to determine that the transmission of the transmission information fails and the target controller is faulty if the transmission time delay of the transmission information is greater than the maximum time delay.

[0174] Optionally, the judging unit comprises:

[0175] The controller timeout information sending unit is configured to receive controller timeout information sent by each slave controller to the target controller by the master controller in the defense stage.

[0176] The contacting unit is configured to contact the target controller based on any slave controller by the master controller if it is determined that the number of controllers sending the controller timeout information exceeds a preset number.

[0177] The second determining unit is configured to determine that the target controller is faulty if the target controller cannot be contacted.

[0178] Optionally, the judging unit comprises:

[0179] The controller timeout information sending unit is configured to receive controller timeout information sent by each slave controller to the target controller by the master controller in the defense stage.

[0180] The contacting unit is configured to contact the target controller based on any slave controller by the master controller if it is determined that the number of controllers sending the controller timeout information exceeds a preset number.

[0181] The second determining unit is configured to determine that the target controller is faulty if the target controller cannot be contacted.

[0182] Optionally, the migration unit comprises:

[0183] The acquiring unit is configured to acquire a set of out-of-control switches by the master controller, wherein the set of out-of-control switches comprises each switch managed by the target controller.

[0184] The second determination unit is configured to determine the switch network domain based on the preset regulation and control parameters and the set of out-of-control switches according to a sub-network domain clustering algorithm through the master controller.

[0185] The division unit is configured to divide the controller set of each switch managed by the migration target controller from each slave controller based on a migration-in controller adjustment algorithm and the switch network domain through the master controller.

[0186] The migration unit is configured to determine the controller matched with each switch managed by the target controller from the controller set based on a migration-in control algorithm through the master controller, and migrate each switch into the matched controller.

[0187] Embodiments of the present application provide an electronic device, such as Figure 6 As shown in the figure, the electronic device includes a processor 601 and a memory 602, the memory 602 is used to store the program code and data of the blockchain-based intrusion prevention method, and the processor 601 is used to call the program instructions in the memory to execute the steps shown in the above embodiment of the blockchain-based intrusion prevention method.

[0188] Embodiments of the present application provide a storage medium, the storage medium includes a storage program, wherein when the program runs, the device where the storage medium is located executes the blockchain-based intrusion prevention method shown in the above embodiment.

[0189] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the difference from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, it is described more simply, and the relevant part can be referred to the part of the method embodiment. The above-described system and system embodiment are only illustrative, and the units described as separate components can be or can not be physically separated, and the components shown as units can be or can not be physical units, that is, they can be located in one place or distributed on multiple network units. According to the actual needs, some or all of the modules can be selected to achieve the purpose of the embodiment. Those skilled in the art can understand and implement without creative labor.

[0190] Those skilled in the art will further appreciate that the functionality of the various examples described herein can be implemented by one or more circuits such as, for example, a combination of analog and / or digital circuitry. The term "circuitry" as used herein covers all of these potential implementations and should not be construed as necessarily requiring the use of integrated circuits or discrete circuitry. Unless otherwise specified, the use of the ordinal adjectives "first", "second", "third", etc., are to modify distinct elements of a single element. The use of the articles "a", "an", "the" and / or "said" are to be construed as referring to one or more elements unless otherwise specified by the context of use. The use of the indefinite article "a" or "an" is not intended to refer to only a singular entity but includes the plural entities as well, unless otherwise specifically indicated by the context of use.

[0191] The above description of disclosed embodiments is intended to be illustrative and not restrictive. Many embodiments of the application will be apparent to those of skill in the art upon reviewing the above description. The scope of the application should, therefore, be determined not with reference to the above description, but instead should be given with reference to the appended claims, along with their full scope of equivalents.

[0192] The above description is intended to be illustrative and not restrictive. Many modifications and variations of the application will be apparent to those skilled in the art from the teachings herein. It is, therefore, to be understood that changes can be made in the form, details, and / or arrangements of the preferred embodiments without departing from the spirit and scope of the application.

Claims

1. A blockchain-based intrusion prevention method, characterized in that, The method is suitable for an SDN cloud network controller, and comprises the following steps: When a broadcast request sent by a target controller is detected, the broadcast request is verified by an LPBFT algorithm, and when the verification fails, a defense stage is entered, and a controller with the highest trust value in the SDN cloud network controller is determined as a master controller; In the defense stage, whether the target controller fails is determined by the master controller; If it is determined that the target controller does not fail, an attack type of the target controller is determined, and each slave controller is subjected to a defense operation matched with the attack type by the master controller; wherein the slave controller is a controller other than the master controller and the target controller in the SDN cloud network controller; If it is determined that the target controller fails, or after each slave controller is subjected to a defense operation matched with the attack type, each switch managed by the target controller is subjected to a corresponding migration operation by the master controller; The method comprises the following steps: When a broadcast request of the target controller is detected, the broadcast request is forwarded to an initial controller; the initial controller is a controller other than the target controller and other controllers in the SDN cloud network controller; When a preparation message is matched successfully by the initial controller, a target preparation message is generated according to the preparation message and identity information of the initial controller, and the target preparation message is distributed to each other controller; The target preparation message is verified by each other controller; If each other controller is verified, a corresponding reply is fed back to the target controller, so that the target controller stores the reply fed back by each other controller into a local block; If any other controller fails to verify, a defense stage is entered, and a controller with the highest trust value in the SDN cloud network controller is determined as a master controller.

2. The method of claim 1, wherein, The method comprises the following steps: The target controller is controlled to send transmission information to the master controller; The transmission time delay of the transmission information is obtained by the master controller, and whether the transmission time delay of the transmission information is greater than a maximum time delay set in advance is determined; If the transmission time delay of the transmission information is greater than the maximum time delay, it is determined that the transmission of the transmission information fails, and it is determined that the target controller fails.

3. The method of claim 1, wherein, The method comprises the following steps: In the defense stage, controller timeout information sent by each slave controller for the target controller is received by the master controller; If it is determined that the number of controllers sending the controller timeout information exceeds a preset number, the master controller contacts any of the slave controllers with the target controller; If the target controller cannot be contacted, it is determined that the target controller has failed.

4. The method of claim 1, wherein, The master controller performs corresponding migration operations on each switch managed by the target controller, including: The master controller obtains a set of out-of-control switches, wherein the set of out-of-control switches includes each switch managed by the target controller; The master controller determines a switch network domain based on a sub-network domain clustering algorithm according to preset control parameters and the set of out-of-control switches; The master controller divides a controller set that migrates each switch managed by the target controller from each slave controller based on a migration controller adjustment algorithm and the switch network domain; The master controller determines a controller that matches each switch managed by the target controller from the controller set based on a migration control algorithm, and migrates each switch managed by the target controller into the matching controller.

5. A blockchain-based intrusion prevention system, characterized in that, The system is suitable for an SDN cloud network controller, and the system includes: A verification unit configured to verify a broadcast request sent by a target controller using an LPBFT algorithm when the broadcast request is detected, and enter a defense stage when the verification fails, and determine a controller with the highest trust value in the SDN cloud network controller as a master controller; A judgment unit configured to determine whether the target controller has failed using the master controller when in the defense stage; A defense unit configured to determine an attack type of the target controller using the master controller when it is determined that the target controller has not failed, and perform a defense operation matching the attack type on each slave controller; wherein the slave controller is a controller other than the master controller and the target controller in the SDN cloud network controller; A migration unit configured to perform corresponding migration operations on each switch managed by the target controller using the master controller when it is determined that the target controller has failed or after performing the defense operation matching the attack type on each slave controller. The verification unit includes: A forwarding unit configured to forward the broadcast request to an initial controller when the broadcast request of the target controller is detected; the initial controller is a controller other than the other controllers in the SDN cloud network controller and the target controller; A broadcast unit configured to generate a target preparation message based on the preparation message and identity information of the initial controller and distribute the target preparation message to each other controller when the preparation message matches the initial controller; A verification subunit configured to verify the target preparation message using each other controller; A storage unit configured to feed back a corresponding reply to the target controller when each other controller is verified, and store the reply of each other controller in a local block by the target controller. The sending unit is configured to enter a defense stage if any of the other controllers fails to pass the verification, and determine a controller with the highest trust value in the SDN cloud network controller as the master controller.

6. The system of claim 5, wherein, The judging unit comprises: The transmission information sending unit is configured to control the target controller to send transmission information to the master controller. The judging sub-unit is configured to acquire a transmission time delay of the transmission information by the master controller, and judge whether the transmission time delay of the transmission information is greater than a preset maximum time delay. The first determining unit is configured to determine that the transmission of the transmission information fails and the target controller is faulty if the transmission time delay of the transmission information is greater than the maximum time delay.

7. An electronic device, comprising: The processor and the memory are connected through a communication bus; wherein the processor is configured to call and execute a program stored in the memory; The memory is configured to store a program, and the program is configured to implement the intrusion prevention method based on the block chain according to any one of claims 1-4. The computer readable storage medium stores computer executable instructions, and the computer executable instructions are used to execute the intrusion prevention method based on the block chain according to any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, ​

Images