Intelligent private network system based on SDN and zero trust

Abstract

The invention discloses an intelligent private network system based on an SDN (Software Defined Network) and zero trust, which belongs to the field of software defined networks and virtualization, and comprises an SDN and virtualization module used for separating a network control plane from a data forwarding plane, constructing a network resource pool and realizing pooling and sharing of network resources; the zero-trust security module is used for implementing multi-factor authentication, dynamic authority control and a micro-isolation strategy and constructing a dynamic self-adaptive security closed-loop system; the AI auxiliary security audit and threat prediction module is used for analyzing the security log based on a machine learning algorithm to realize abnormal behavior identification and threat prediction; the automatic operation and maintenance management module is used for realizing automation of system configuration, monitoring and fault processing; by separating a network control plane from a data forwarding plane, flexible scheduling and management of network traffic are realized, the problems of insufficient bandwidth and high transmission delay of a traditional private network are solved, and the demand of sharp increase of service volume is met.

Description

Technical Field

[0001] The present invention relates to the field of software-defined networking and virtualization technology, and in particular to an intelligent private network system based on SDN and zero trust. Background Art

[0002] SDN is an emerging network architecture that enables flexible configuration and management of network resources by separating the network control and data planes. Virtualization technology is a technology that divides computer physical entities (such as servers, storage devices, and network devices) into multiple virtual entities through software technology;

[0003] With the rapid development of information technology and the advancement of enterprise digital transformation, private network systems, as important infrastructure for ensuring critical business communications, face many challenges. Traditional private network systems have the following significant shortcomings:

[0004] Low communication efficiency and poor scalability: It is difficult to adapt to the bandwidth demand brought about by the surge in business volume. The access of new devices or services can easily lead to network congestion and increased transmission delays, affecting business efficiency and user experience.

[0005] Insufficient security and manageability: Weak security defense and operation and maintenance management capabilities make the system vulnerable to external attacks and internal failures, leading to data leakage, service interruptions, and other consequences. In addition, the operation and maintenance costs are high and the system stability is poor.

[0006] To solve the above problems, although existing technologies have attempted to introduce some new technologies, they have failed to achieve deep integration of network architecture, security policies and operation and maintenance management, making it difficult to comprehensively improve the intelligence, security and manageability of private network systems.

[0007] Therefore, an intelligent private network system based on SDN and zero trust is needed. Summary of the Invention

[0008] In response to the shortcomings of the existing technology, the present invention provides an intelligent private network system based on SDN and zero trust to solve the problems of low communication efficiency, poor scalability, insufficient security and manageability of traditional private network systems, and to realize the intelligent, efficient and secure operation of the private network system.

[0009] Technical Solution: To solve the above technical problems, according to one aspect of the present invention, more specifically, an intelligent private network system based on SDN and zero trust, including the following modules:

[0010] SDN and virtualization module: By separating the network control plane from the data forwarding plane, flexible scheduling and management of network traffic can be achieved. Virtualization technology is used to build a network resource pool, including computing resources, storage resources, and network resources, to achieve resource pooling and sharing, thereby improving resource utilization.

[0011] Zero Trust Security Module: Adopts multi-factor authentication, biometrics and other technologies to dynamically adjust access rights based on multi-dimensional factors such as user behavior, device status, and network environment, building a dynamic and adaptive closed-loop security system. At the same time, it formulates micro-isolation strategies within the data center to prevent lateral movement attacks.

[0012] AI-assisted security audit and threat prediction module: Use AI technology to build a behavior detection engine to conduct comprehensive scanning and feature extraction of audit events; use dynamic reasoning engines and heuristic analysis machines to parse and judge feature events and predict user behavior; build an intelligent prediction model based on machine learning and deep learning algorithms, combine historical data with real-time data, and achieve accurate prediction and assessment of risks.

[0013] Automated operation and maintenance management module: Develop an intelligent operation and maintenance management platform to implement functions such as system configuration, monitoring, fault warning and automated repair, reduce operation and maintenance costs, and improve system stability and availability.

[0014] Furthermore, the dynamic resource scheduling unit in the SDN and virtualization module implements intelligent resource allocation based on real-time traffic load and security trust score. The unit adopts a dynamic resource scheduling algorithm:

[0015] in: The resource allocation vector at the current moment (including the allocation ratio of computing, storage, and network resources);

[0016] is the real-time traffic load (unit: Mbps), Lmax is the maximum network load;

[0017] For the Class resources in The distribution ratio of time ( arrive is the resource type dimension);

[0018] Allocate a benchmark vector for basic resources;

[0019] is a dynamic adjustment coefficient (0≤η≤1), which is dynamically optimized by the reinforcement learning model based on historical resource utilization and business response time;

[0020] is a load sensitivity parameter used to adjust the weight of the impact of traffic load on resource allocation, satisfying ,in is the real-time trust score, is the sensitivity adjustment factor;

[0021] By deeply coupling the trust assessment mechanism with resource allocation strategies, and leveraging nonlinear load response functions and dynamic weighting optimized through reinforcement learning, this approach significantly improves network resource utilization efficiency and risk mitigation. Compared to traditional technologies, this approach can automatically adjust resource allocation priorities based on real-time security trends, enhancing network defense capabilities while ensuring business continuity.

[0022] The beneficial effects of the intelligent private network system based on SDN and zero trust of the present invention are:

[0023] (1) The present invention separates the network control plane from the data forwarding plane to achieve flexible scheduling and management of network traffic, solve the problems of insufficient bandwidth and high transmission delay in traditional private networks, and adapt to the demand for surging business volume.

[0024] Use virtualization technology to build computing, storage, and network resource pools to achieve resource pooling and sharing, improve resource utilization, and reduce resource idleness.

[0025] (2) The network controller of the present invention centrally manages topology and routing, schedules traffic in real time, avoids network congestion when new devices are added, and ensures business continuity and user experience;

[0026] Adopt multi-factor authentication (password, fingerprint, token, etc.) and dynamic permission control to adjust access rights in real time based on multi-dimensional factors such as user behavior, device status, network environment, etc. to prevent unauthorized access and abuse of permissions.

[0027] Implement a micro-segmentation strategy to isolate the internal network of the data center by business area, prevent the lateral movement of attackers, and effectively defend against internal threats and external infiltration.

[0028] (3) The present invention uses a dynamic trust evaluation algorithm to comprehensively consider user behavior compliance, device health status, network environment security level and historical behavior characteristics to generate a real-time trust score. When the trust score is lower than the threshold, secondary authentication or access blocking is triggered, thus achieving a closed-loop control of "behavior-trust-authority". BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The present invention will be further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0030] Figure 1 It is a structural schematic diagram of the present invention. DETAILED DESCRIPTION

[0031] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that, unless there is a conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0032] In order to make the technical solution of the present invention clearer, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] Reference Figure 1 The implementation steps of an intelligent private network system based on SDN and zero trust of the present invention are as follows:

[0034] Implementation of S1, SDN and virtualization modules

[0035] Design a network controller that interacts with underlying network devices and upper-layer applications through open interfaces to centrally manage network topology, routing calculation, and traffic scheduling.

[0036] Use virtualization technology to create virtual network devices such as virtual switches and virtual routers to realize the actual forwarding and processing of data.

[0037] Establish a network resource pool for private networks, and pool and share computing, storage, and network resources through virtualization technology.

[0038] S2. Implementation of Zero Trust Security Module

[0039] Deploy identity authentication and permission control modules, adopt multi-factor authentication technology (such as passwords, fingerprints, tokens, etc.), and dynamically adjust user access rights based on multi-dimensional factors such as user behavior trajectory, device health status, and network environment security level.

[0040] In the internal network of the data center, micro-segmentation strategies are formulated based on business types and data sensitivity to logically isolate different business areas or sensitive data areas to prevent lateral movement of attackers.

[0041] S3. Implementation of AI-assisted security audit and threat prediction modules

[0042] Build a behavior detection engine to collect and comprehensively scan the audit events generated by the system in real time, extract features such as user behavior and device operations, and form characteristic audit events.

[0043] A dynamic inference engine is used to comprehensively analyze characteristic events, combined with historical behavior patterns and security rule bases, and a heuristic analysis engine is used to make judgments on the analysis results and predict subsequent user behavior.

[0044] Collect data on historical risk events, market trends, user behavior, etc., build intelligent prediction models based on machine learning (such as neural networks, decision trees) and deep learning algorithms, monitor risk indicators in real time, and predict and evaluate future risks.

[0045] Dynamic trust assessment algorithm implementation

[0046] In the AI-assisted security audit and threat prediction module, the dynamic trust assessment algorithm executes the following steps:

[0047] Feature collection: Real-time acquisition of user behavior logs (such as access frequency and data operation types), device status (such as firmware version and hardware anomaly indicators), and network environment parameters (such as IP geographic location and network bandwidth fluctuations);

[0048] Normalization: 、 、 Map to the interval [0, 1] to eliminate the dimension effect;

[0049] Historical feature extraction: extract historical behavior features of nearly n time slices through sliding windows , such as the number of abnormal operations performed by the user in the past 24 hours;

[0050] Dynamic weight adjustment: The LSTM neural network periodically updates α, β, γ, and δ based on historical risk events (such as fluctuations in trust scores during data breaches). For example, when a ransomware attack is detected, the device health status weight β is automatically increased.

[0051] Trust score calculation: by formula Generate real-time trust scores when Trigger secondary authentication or access blocking.

[0052] This algorithm achieves closed-loop control of "behavior-trust-authority" through machine learning and dynamic weight mechanism, which is more adaptable to security needs in complex network environments than traditional static strategies.

[0053] S4. Implementation of automated operation and maintenance management module

[0054] Develop an intelligent private network system automated operation and maintenance management platform, deploy intelligent monitoring units, and collect real-time operating status data of each system component (such as traffic, load, error rate, etc.).

[0055] Establish a fault warning model, set risk thresholds based on real-time monitoring data and historical fault data, and issue warning signals in a timely manner when abnormal indicators are detected.

[0056] Develop an automated repair module, preset repair strategies and processes for common fault types, realize automatic diagnosis and repair of faults, and reduce manual intervention.

[0057] Through the collaborative work of the above modules, the present invention realizes the deep integration of SDN, zero-trust security architecture, AI technology and automated operation and maintenance, effectively solves the technical bottlenecks of traditional private network systems, and provides innovative solutions for the intelligent and secure operation of data center private networks.

[0058] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. An intelligent private network system based on SDN and zero trust, including an SDN and virtualization module, a zero trust security module, an AI-assisted security audit and threat prediction module, and an automated operation and maintenance management module, characterized by: The SDN and virtualization module is used to separate the network control plane from the data forwarding plane, build a network resource pool, and realize the pooling and sharing of network resources; The zero-trust security module is used to implement multi-factor authentication, dynamic permission control and micro-isolation strategies to build a dynamic and adaptive security closed-loop system; The AI-assisted security audit and threat prediction module is used to analyze security logs based on machine learning algorithms to achieve abnormal behavior identification and threat prediction; The automated operation and maintenance management module is used to automate system configuration, monitoring, and troubleshooting.

2. The intelligent private network system based on SDN and zero trust according to claim 1, characterized in that: The AI-assisted security audit and threat prediction module includes a dynamic trust assessment algorithm, the mathematical expression of which is: in: The trust score at the current moment (0-100); is the user behavior compliance indicator (normalized value); Score the device health status (normalized value); is the network environment security level (normalized value); is the historical behavior feature vector ( to n is the feature dimension); , , , is the dynamic weight coefficient, satisfying , which is dynamically adjusted by the LSTM neural network based on historical risk events.

3. The intelligent private network system based on SDN and zero trust according to claim 1, characterized in that: The SDN and virtualization module includes: Network controller, used to centrally manage network topology, routing calculation and traffic scheduling; Virtual network devices, including virtual switches and virtual routers, are used for data forwarding and processing; Network resource pool, including computing resources, storage resources and network resources.

4. The intelligent private network system based on SDN and zero trust according to claim 1, characterized in that: The zero-trust security module includes: Identity authentication and permission control unit, used to implement dynamic permission adjustment based on user behavior, device status and network environment; Micro-segmentation policy unit, used to isolate business areas within the data center network.

5. The intelligent private network system based on SDN and zero trust according to claim 1, characterized in that: The AI-assisted security audit and threat prediction module includes: Behavior detection engine, used to extract features from audit events; Intelligent prediction models for risk prediction based on historical and real-time data; Dynamic reasoning engine and heuristic analysis engine are used to analyze and judge characteristic events.

6. The intelligent private network system based on SDN and zero trust according to claim 1, characterized in that: The automated operation and maintenance management module includes: Intelligent monitoring unit, used to monitor the system operation status in real time; Fault warning and automatic repair unit, used to realize fault warning and repair.

7. The intelligent private network system based on SDN and zero trust according to claim 1, characterized in that: The system implementation method is as follows: Build an intelligent private network system architecture based on SDN and virtualization technologies to achieve separation of control plane and data plane and pooling of network resources; Deploy a zero-trust security architecture, implement multi-factor authentication, dynamic permission control, and micro-segmentation strategies; Use AI technology to build security audit and threat prediction models to identify abnormal behaviors and provide risk warnings; Develop an automated operation and maintenance management platform to realize intelligent and automated system operation and maintenance.

8. The intelligent private network system based on SDN and zero trust according to claim 7, characterized in that: The steps of building a network architecture based on SDN and virtualization technology include: designing a network controller, creating virtual network devices, and establishing a network resource pool; The steps of deploying the zero-trust security architecture include: setting up identity authentication and permission control modules and formulating micro-isolation strategies; The steps of using AI technology to build a security audit and threat prediction model include: using AI technology to build a behavior detection engine and building an intelligent prediction model based on machine learning and deep learning algorithms; The steps of developing the automated operation and maintenance management platform include: realizing intelligent monitoring, fault warning and automated repair functions.

9. The intelligent private network system based on SDN and zero trust according to claim 2, characterized in that: The SDN and virtualization module also includes a dynamic resource scheduling unit for intelligently allocating network resources based on real-time traffic load and resource utilization. The mathematical expression of its dynamic resource scheduling algorithm is: in: The resource allocation vector at the current moment (including the allocation ratio of computing, storage, and network resources); is the real-time traffic load (unit: Mbps), Lmax is the maximum network load; For the Class resources in The distribution ratio of time ( arrive is the resource type dimension); Allocate a benchmark vector for basic resources; is a dynamic adjustment coefficient (0≤η≤1), which is dynamically optimized by the reinforcement learning model based on historical resource utilization and business response time; is a load sensitivity parameter used to adjust the weight of the impact of traffic load on resource allocation, satisfying ,in is the real-time trust score, is the sensitivity adjustment factor.

Images