SDN security enhancement system and method
By configuring multiple network nodes in SDN and dynamically deferring forwarding policies and security policies based on their roles, traditional SDNs are solved, and the problems of poor scalability and insufficient security in large-scale networks and multi-tenant environments are achieved, achieving more efficient and secure data forwarding.
Patent Information
- Application Number
- CN202411735224.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-03-18
AI Technical Summary
Traditional SDNs have problems such as poor scalability and low forwarding efficiency when dealing with large-scale networks or multi-tenant environments. At the same time, SDNs are also weak in security, especially the vulnerability of the control plane and the increase in attack surface of the data plane.
By configuring multiple network nodes in the SDN, each node can have one or more roles. The controller dynamically issues forwarding policies and security policies based on the network status and node roles. The network node performs message forwarding and security checks based on the received policy.
It improves the forwarding efficiency and security of SDN, enhances the defense capabilities of network attacks, reduces the single point of vulnerability of SDN, and protects the confidentiality and integrity of data through encryption technology and security monitoring.
Smart Images
Figure CN119652578A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of software defined network (SDN), and in particular to an SDN security enhancement system and method. Background Art
[0002] In traditional SDN, message forwarding depends on the forwarding strategy (flow table) issued by the centralized controller. This method has problems of poor scalability and low forwarding efficiency when dealing with large-scale networks or multi-tenant environments. At the same time, SDN security issues are becoming increasingly prominent, including the vulnerability of the control plane and the increase in the attack surface of the data plane. Summary of the invention
[0003] The purpose of the present invention is to provide a SDN security enhancement system and method, which can improve the forwarding efficiency and security of the network.
[0004] The technical solution of the present invention is:
[0005] In a first aspect, the present application provides an SDN security enhancement system;
[0006] The SDN includes multiple network nodes, each of which is configured as one or more roles;
[0007] The network node may be a switch, a router or other network devices.
[0008] The role type can be customized by the user.
[0009] The system administrator can define the role of each network node and write the network node configuration.
[0010] Different types of roles have different functional characteristics and security features, which can be set by the role forwarding module.
[0011] Each network node can have one or more roles at the same time.
[0012] The system includes a controller;
[0013] The multiple network nodes are all connected to the controller;
[0014] The controller dynamically sends corresponding forwarding strategies and security strategies to each network node according to the network status and the role type of the network node;
[0015] The forwarding strategy includes a flow table, which includes the path for forwarding messages, message flow restrictions, etc., and is used to determine how to forward each message on a network node.
[0016] Among them, the network status includes network topology and network traffic. The controller determines the forwarding path and traffic limit between specific devices based on the network topology and network traffic. At the same time, the role of the network node has a great influence on the forwarding path and traffic limit. For example, financial messages cannot be transferred through network nodes of other departments. When there is traffic congestion at the core node, the traffic of the aggregation node will be restricted, and the congestion of the aggregation node will affect the speed limit of the edge node. The traffic of the finance and the president's office will be guaranteed first.
[0017] Different network node roles have different forwarding strategies and security policies.
[0018] All network node roles may change and transfer. When the role of a network node changes, the controller will update the forwarding strategy and security policy accordingly, that is, the forwarding strategy and security policy will change dynamically with the change and transfer of the network node role. The physical location of the network node will not affect the forwarding strategy and security policy of the role, so the network node can still work quickly after the physical location changes. For example, the edge node placed in the finance room can be physically migrated when there are not enough network nodes in the R&D room, and it can be used as the core node of the R&D room by changing the role. Only the role needs to be changed. It will not generate a lot of configuration work like traditional SDN networks due to physical location and role changes, avoiding errors caused by complex configuration work.
[0019] The network node forwards and performs security checks on the message according to the received forwarding strategy and security policy.
[0020] In a possible implementation, the controller includes a flow table updating module and a network element monitoring module, which are respectively used to manage and issue forwarding policies and security policies.
[0021] In a possible implementation, the system further includes a role forwarding module;
[0022] The role forwarding module is connected to the controller and is used to collaborate with the controller to complete role verification and role forwarding strategy issuance.
[0023] In a possible implementation, the role forwarding module stores role type definitions, role verification rules, and role forwarding strategies.
[0024] The system administrator can define the role type and write the role verification rules and role forwarding strategy into the role forwarding module.
[0025] After the network node is started, the node-related information is sent to the controller, wherein the node-related information includes the role information and connection information of the network node; wherein the connection information of the network node refers to the connection status of the network node with other devices;
[0026] The controller sends the role information of the network node to the role forwarding module;
[0027] The role forwarding module verifies the role of the network node to determine whether the role of the network node is reasonable and correct;
[0028] For example, the role forwarding module can perform role verification based on the verification information configured by the system administrator and the network node connection status to determine whether the network node role is reasonable;
[0029] The role forwarding module sends the role verification result to the controller; including: if the role verification is successful, the verification success information and the forwarding strategy of the corresponding role are sent to the controller; if the role verification fails, the verification failure information is sent to the controller; if the verification failure information is sent to the controller, the network node cannot become the specified role for data forwarding, and the role needs to be changed or the data cannot be forwarded;
[0030] After receiving the verification success information, the controller determines the final forwarding strategy for each role according to the received forwarding strategy of the corresponding role and the network status, and sends the final forwarding strategy to each corresponding network node whose role verification is successful.
[0031] Therefore, all forwarding strategies (including access paths) and security policies (including access rights) will be sent to the network nodes after the network node role authentication is passed. There is no need to wait for the device to access and then find the controller to send them down (the traditional SDN network method), thereby ensuring the security and speed of network access.
[0032] In a possible implementation, the system further includes a security monitoring module, which is connected to the controller and is used to cooperate with the controller to complete a security monitoring function;
[0033] The security monitoring module monitors the roles of network messages and network nodes, and performs analysis, such as whether the message from the Finance Department enters the Information Department in violation of regulations, whether the message has been specifically audited, whether the message from the R&D Department is forwarded by the Finance Office, and whether the forwarding is the only path and has been specifically isolated; based on the analysis results, generates a security log; based on the security log, updates the security policy, and sends the updated security policy to the controller; wherein the security log may include illegal messages, security events, security inspection frequency and inspection results;
[0034] The controller determines the final security policy for each role according to the security policy sent by the security monitoring module and the role type of the network node, and sends the final security policy to each corresponding network node whose role verification is successful.
[0035] For specific violations and security issues recorded in the security log, the controller sends forwarding policies to prohibit the transmission of corresponding messages.
[0036] System administrators can conduct security audits based on security logs, such as conducting further manual reviews of illegal messages.
[0037] In a second aspect, the present application provides an SDN security enhancement method, comprising:
[0038] Determine the role of each network node in SDN;
[0039] Dynamically deliver corresponding forwarding strategies and security strategies to each network node based on different network status and network node roles;
[0040] The network node forwards and performs security checks on the message according to the received forwarding strategy and security policy.
[0041] The specific implementation method of the second aspect can refer to the implementation method of the first aspect, which will not be repeated here.
[0042] Beneficial effects:
[0043] This application not only improves the forwarding efficiency of SDN, but also significantly enhances the security and scalability of the network and reduces the load on the controller by configuring the roles of network nodes and determining the corresponding forwarding strategy and security strategy according to the role type. The technical solution of the present invention can achieve more efficient and secure SDN data forwarding, especially in multi-tenant and large-scale network environments, and the technical solution of the present invention has significant advantages.
[0044] Compared with the prior art, the present invention has the following advantages:
[0045] Improves the forwarding efficiency of the network, because each network node can quickly make forwarding decisions based on its role;
[0046] Enhanced network security, by combining forwarding strategies with security strategies, and improved the ability to defend against network attacks;
[0047] Enhanced security protection for controllers and network nodes, reducing single-point vulnerability of SDN;
[0048] Through encryption technology and security monitoring, the confidentiality and integrity of data are protected and the reliability of the network is improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0049] Attached Figure 1 It is a schematic diagram of the system architecture of an embodiment of the present application;
[0050] Attached Figure 2 is a method flow chart of an embodiment of the present application;
[0051] Attached Figure 3It is a schematic diagram of issuing a forwarding strategy when a network node role is transferred and changed in an embodiment of the present application. DETAILED DESCRIPTION
[0052] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.
[0053] The following will refer to Figures 1 to 3 Specific embodiments according to the present application are described.
[0054] Embodiment 1
[0055] This embodiment provides an SDN security enhancement system;
[0056] SDN includes multiple network nodes, each of which is configured as one or more roles;
[0057] The network node may be a switch, a router or other network devices.
[0058] The role type can be customized by the user.
[0059] The system administrator can define the role of each network node and write the network node configuration.
[0060] For example, for a company, roles can be divided according to departments, including finance department, information department, R&D department, president's office, etc., and roles can be divided according to functions into edge nodes, aggregation nodes and core nodes. The network node roles formed include edge nodes in the finance department, core nodes in the R&D department, etc.
[0061] Different types of roles have different functional characteristics and security features. For example, by default, the finance department can access each other's equipment, the president's office equipment can be read and accessed, and other departments cannot access it. The equipment on the edge node must be authenticated, and all new equipment on the edge node must be authenticated before accessing the network. Functional characteristics and security features can be set by the role forwarding module.
[0062] Each network node can have one or more roles at the same time. Each role has a corresponding priority. For a network node with multiple roles at the same time, the controller will merge the forwarding strategies and security policies of all roles of the network node; if the forwarding strategies and security policies of different roles conflict, the forwarding strategy and security policy of the role with higher priority will be used.
[0063] The system includes a controller;
[0064] Multiple network nodes are connected to the controller;
[0065] The controller dynamically sends corresponding forwarding strategies and security strategies to each network node based on the network status and the role of the network node.
[0066] The forwarding strategy includes a flow table, which includes the path for forwarding messages, message flow restrictions, etc., and is used to determine how to forward each message on a network node.
[0067] Among them, the network status includes network topology and network traffic. The controller determines the forwarding path and traffic limit between specific devices based on the network topology and network traffic. At the same time, the role of the network node has a great influence on the forwarding path and traffic limit. For example, financial messages cannot be transferred through network nodes of other departments. When there is traffic congestion at the core node, the traffic of the aggregation node will be restricted, and the congestion of the aggregation node will affect the speed limit of the edge node. The traffic of the finance and the president's office will be guaranteed first.
[0068] Different network node roles have different forwarding strategies and security strategies. For example, for edge nodes, forwarding strategies based on source / destination IP and security strategies of intrusion detection systems (IDS) may be issued; while for core nodes, forwarding strategies based on QoS and distributed denial of service (DDoS) attack defense strategies may be issued.
[0069] like Figure 3 As shown in the figure, the role of each network node can change at different times. When the role of the network node changes, the controller will update the forwarding strategy and security policy accordingly, that is, the forwarding strategy and security policy will change dynamically with the change and transfer of the role of the network node. The physical location of the network node will not affect the forwarding strategy and security policy of the role, so the network node can still work quickly after the physical location changes. For example, the edge node placed in the finance room can be physically migrated when there are not enough network nodes in the R&D room, and it can be used as the core node of the R&D room by changing the role, and only the role needs to be changed. It will not generate a lot of configuration work like traditional SDN networks due to physical location and role changes, avoiding errors caused by complex configuration work.
[0070] The network node forwards and performs security checks on the message according to the received forwarding strategy and security policy.
[0071] In some embodiments, the controller includes a flow table update module and a network element monitoring module, which are respectively used to manage and issue forwarding policies and security policies.
[0072] In some embodiments the system further comprises a role forwarding module;
[0073] The role forwarding module is connected to the controller and is used to collaborate with the controller to complete role verification and role forwarding strategy issuance.
[0074] In some embodiments, the role forwarding module stores role type definitions, role verification rules, and role forwarding strategies.
[0075] The system administrator can define the role type and write the role verification rules and role forwarding strategy into the role forwarding module.
[0076] After the network node is started, it sends node-related information to the controller, where the node-related information includes the role information and connection information of the network node; where the connection information of the network node refers to the connection status of the network node with other devices;
[0077] The controller sends the role information of the network node to the role forwarding module;
[0078] The role forwarding module verifies the roles of network nodes to determine whether the roles of network nodes are reasonable (whether they can become the corresponding roles) and correct (whether the role configuration has not been tampered with);
[0079] For example, the role forwarding module can perform role verification based on the verification information configured by the system administrator and the network node connection status to determine whether the network node role is reasonable;
[0080] The role forwarding module sends the role verification result to the controller, including: if the role verification is successful, the verification success information and the forwarding strategy of the corresponding role are sent to the controller; if the role verification fails, the verification failure information is sent to the controller; if the verification failure information is sent to the controller, the network node cannot become the specified role for data forwarding, and the role needs to be changed or the data cannot be forwarded;
[0081] The forwarding strategy of a role may include information such as which network nodes the network node under the role is allowed to communicate with and which network nodes it is not allowed to communicate with, traffic control, QoS (Quality of Service), and security settings (such as whether encrypted transmission is required).
[0082] After receiving the successful verification information, the controller determines the final forwarding strategy for each role based on the forwarding strategy and network status of the received corresponding role, and sends the final forwarding strategy to each corresponding network node where the role verification is successful.
[0083] Therefore, all forwarding strategies (including access paths) and security policies (including access rights) will be sent to the network nodes after the network node role authentication is passed. There is no need to wait for the device to access and then find the controller to send them down (the traditional SDN network method), thereby ensuring the security and speed of network access.
[0084] In some embodiments, the system further includes a security monitoring module, which is connected to the controller and is used to cooperate with the controller to complete the security monitoring function;
[0085] The security monitoring module monitors the roles of network messages and network nodes and performs analysis, such as whether the messages from the Finance Department enter the Information Department in violation of regulations, whether the messages have been specifically audited, whether the messages from the R&D Department are forwarded by the Finance Office, and whether the forwarding is the only path and has been specifically isolated; based on the analysis results, a security log is generated; based on the security log, the security policy is updated and the updated security policy is sent to the controller; the security log may include illegal messages, security events, security inspection frequency, and inspection results;
[0086] The controller determines the final security policy for each role according to the security policy sent by the security monitoring module and the role type of the network node, and sends the final security policy to each corresponding network node whose role verification is successful.
[0087] For specific violations and security issues recorded in the security log, the controller can issue forwarding policies to prohibit the transmission of corresponding messages.
[0088] System administrators can conduct security audits based on security logs, such as conducting further manual reviews of illegal messages.
[0089] In addition, security measures can be used to enhance the security of the security monitoring module itself. The security measures include: (1) enhancing the security protection of controllers and switches, including timely updating of software versions, configuring reasonable access control lists, and conducting regular security audits; (2) using encryption technology to protect data, such as using the TLS protocol to encrypt communications between controllers and switches; (3) establishing a complete log and monitoring mechanism to enable timely detection and handling of security incidents; and (4) conducting regular security training and drills to improve employees' safety awareness and response capabilities.
[0090] like Figure 1 As shown, the system of this embodiment may include multiple network nodes 10, a controller 20, a role forwarding module 30 and a security monitoring module 40. The network node 10 may be a switch, a router or other network device. The controller 20 is responsible for managing and issuing forwarding strategies and security strategies, the role forwarding module 30 is responsible for role verification and role forwarding strategy issuance, and the security monitoring module 40 is responsible for monitoring network messages and roles of network nodes, recording logs and performing security audits.
[0091] Embodiment 2
[0092] This embodiment provides a method for enhancing SDN security. Based on the system of embodiment 1, the method includes:
[0093] Determine the role of each network node in SDN;
[0094] Dynamically deliver corresponding forwarding strategies and security strategies to each network node based on different network status and network node roles;
[0095] The network node forwards and performs security checks on the message according to the received forwarding strategy and security policy.
[0096] like Figure 2 As shown, this embodiment may include:
[0097] After the network node is started, it sends node-related information to the controller, where the node-related information includes the role information and connection information of the network node; where the connection information of the network node refers to the connection status of the network node with other devices;
[0098] The controller sends the role information of the network node to the role forwarding module;
[0099] The role forwarding module verifies the roles of network nodes to determine whether the roles of network nodes are reasonable and correct;
[0100] The role forwarding module sends the role verification result to the controller; including: if the role verification is successful, the verification success information and the forwarding strategy of the corresponding role are sent to the controller; if the role verification fails, the verification failure information is sent to the controller; if the verification failure information is sent to the controller, the network node cannot become the specified role for data forwarding, and the role needs to be changed or the data cannot be forwarded;
[0101] After receiving the successful verification information, the controller determines the final forwarding strategy for each role based on the forwarding strategy and network status of the received corresponding role, and sends the final forwarding strategy to each corresponding network node where the role verification is successful.
[0102] At the same time, the security monitoring module monitors the roles of network messages and network nodes and conducts analysis, such as whether the message from the Finance Department enters the Information Department in violation of regulations, whether the message has undergone specific review, whether the message from the R&D Department has been forwarded by the Finance Office, and whether the forwarding is the only path and has undergone specific isolation; based on the analysis results, a security log is generated; based on the security log, the security policy is updated and the updated security policy is sent to the controller; the security log may include illegal messages, security events, security inspection frequency and inspection results;
[0103] The controller determines the final security policy for each role according to the security policy sent by the security monitoring module and the role type of the network node, and sends the final security policy to each corresponding network node whose role verification is successful.
[0104] For specific violations and security issues recorded in the security log, the controller sends forwarding policies to prohibit the transmission of corresponding messages.
[0105] Obviously, those skilled in the art should understand that the above-mentioned units or steps of the present application can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the present application is not limited to any specific combination of hardware and software.
[0106] The above description of the embodiments of the present application is only a partial embodiment of the present application, which is used to enable professionals in the field to implement or use the content of the present application, and is not used to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.
Claims
1. An SDN security enhancement system, characterized in that: The SDN includes multiple network nodes, each of which is configured as one or more roles; different types of roles have different functional characteristics and security characteristics; The system includes a controller; The multiple network nodes are all connected to the controller; The controller dynamically sends corresponding forwarding strategies and security strategies to each network node according to the network status and the role type of the network node; The network node forwards and performs security checks on the message according to the received forwarding strategy and security policy.
2. The system according to claim 1, characterized in that The system also includes a role forwarding module connected to the controller, which is used to cooperate with the controller to complete role verification and role forwarding strategy issuance.
3. The system according to claim 2, characterized in that The role forwarding module stores role type definitions, role verification rules and role forwarding strategies; After the network node is started, the node-related information is sent to the controller, wherein the node-related information includes the role information and connection information of the network node; wherein the connection information of the network node refers to the connection status of the network node with other devices; The controller sends the role information of the network node to the role forwarding module; The role forwarding module verifies the role of the network node to determine whether the role of the network node is reasonable and correct; The role forwarding module sends the role verification result to the controller, including: if the role verification is successful, sending the verification success information and the forwarding strategy of the corresponding role to the controller; If the role verification fails, the verification failure information is sent to the controller; if the verification failure information is sent to the controller, the network node cannot become the specified role to forward data, and the role needs to be changed or the data cannot be forwarded; After receiving the verification success information, the controller determines the final forwarding strategy for each role according to the received forwarding strategy of the corresponding role and the network status, and sends the final forwarding strategy to each corresponding network node whose role verification is successful.
4. The system according to any one of claims 1 to 3, characterized in that: The system also includes a safety monitoring module connected to the controller, which is used to cooperate with the controller to complete the safety monitoring function; The security monitoring module monitors network messages and roles of network nodes, analyzes them, and generates security logs; based on the security logs, updates security policies, and sends the updated security policies to the controller; The controller determines the final security policy for each role according to the security policy sent by the security monitoring module and the role type of the network node, and sends the final security policy to each corresponding network node whose role verification is successful.
5. The system according to any one of claims 4, characterized in that For specific violations and security issues recorded in the security log, the controller sends forwarding policies to prohibit the transmission of corresponding messages.
6. A method for enhancing SDN security, characterized in that: Based on the system according to any one of claims 1 to 5, the method comprises: Determine the role of each network node in SDN; Dynamically deliver corresponding forwarding strategies and security strategies to each network node based on different network status and network node roles; The network node forwards and performs security checks on the message according to the received forwarding strategy and security policy.
7. The method according to claim 6, characterized in that The method further comprises: completing role verification and issuing role forwarding strategies through collaboration between the role forwarding module and the controller.
8. The system according to claim 7, characterized in that The role forwarding module stores role type definitions, role verification rules and role forwarding strategies; The method further comprises: After the network node is started, the node-related information is sent to the controller, wherein the node-related information includes the role information and connection information of the network node; wherein the connection information of the network node refers to the connection status of the network node with other devices; The controller sends the role information of the network node to the role forwarding module; The role forwarding module verifies the role of the network node to determine whether the role of the network node is reasonable and correct; The role forwarding module sends the role verification result to the controller, including: if the role verification is successful, the verification success information and the forwarding strategy of the corresponding role are sent to the controller; if the role verification fails, the verification failure information is sent to the controller; if the verification failure information is sent to the controller, the network node cannot become the specified role for data forwarding, and the role needs to be changed or the data cannot be forwarded; After receiving the verification success information, the controller determines the final forwarding strategy for each role according to the received forwarding strategy of the corresponding role and the network status, and sends the final forwarding strategy to each corresponding network node whose role verification is successful.
9. The system according to any one of claims 6 to 8, characterized in that: The method further comprises: completing the security monitoring function by cooperating with the controller through the security monitoring module; The security monitoring module monitors network messages and roles of network nodes, analyzes them, and generates security logs; based on the security logs, updates security policies, and sends the updated security policies to the controller; The controller determines the final security policy for each role according to the security policy sent by the security monitoring module and the role type of the network node, and sends the final security policy to each corresponding network node whose role verification is successful.
10. The system according to any one of claims 9, characterized in that The method further includes: for specific violations and security issues recorded in the security log, issuing a forwarding policy through the controller to prohibit the transmission of corresponding messages.