CN111586026B

CN111586026B - Software defined boundary implementation method and system based on SDN

Info

Publication number: CN111586026B
Application number: CN202010362581.9A
Authority: CN
Inventors: 刘忻; 林冬艺; 袁龙浩
Original assignee: Guangzhou Bingo Software Co Ltd
Current assignee: Guangzhou Bingo Software Co Ltd
Priority date: 2020-04-30
Filing date: 2020-04-30
Publication date: 2021-01-29
Anticipated expiration: 2040-04-30
Also published as: CN111586026A

Abstract

The invention discloses a software defined boundary implementation method and a system based on an SDN, wherein the SDN controller replaces an SDP controller, the SDN switch replaces an SDP gateway, and a flow table method of the SDN network is used for implementing SPA single-packet authorization service logic.

Description

Software defined boundary implementation method and system based on SDN

Technical Field

The invention belongs to the technical field of software defined boundaries, and particularly relates to a software defined boundary implementation method and system based on an SDN.

Background

Software defined boundaries (SDP) is a security framework developed by the Cloud Security Association (CSA) that controls access to resources based on identity. Each terminal must perform unicast authorization (SPA) authentication before connecting to the server to ensure that each device is allowed access. The core idea is to hide the core network assets and facilities through the SDP architecture, so that the core network assets and facilities are not directly exposed under the Internet, and the network assets and facilities are protected from external security threats. The conventional SDP architecture generally adopts a gateway mode due to a large range of protected services, as shown in fig. 1: the access rule established by the SDP controller is only open for authorized users and services, the key and the strategy are also dynamic and only used for a single time, through the access control form similar to a white list, unauthorized strange access in the network is completely shielded and rejected in a TCP link establishing stage, and through a single access control mode, the protected service is completely shielded from illegal users, so that external violent attacks (such as DDoS (distributed denial of service) flow attacks), accurate attacks (such as APT (android package) continuous threats), vulnerability utilization (such as heart hemorrhage vulnerabilities) and the like are greatly prevented, and the attacked surface of the network is reduced through the SDP software defined boundary.

However, the conventional SDP software-defined boundary architecture has several disadvantages:

the single point problem of the SDP gateway, the SDP gateway is used as a uniform flow inlet of protected service, and the network processing performance is insufficient.

2. Since the SDP controller acts as a unicast authority, it needs to be exposed to the external network, and is easily targeted by hackers, resulting in network crash or hijacking control of the SDP controller.

And 3, the SDP gateway defends illegal access or attack of an external network and cannot defend illegal access or attack between internal networks.

Disclosure of Invention

In order to overcome the technical defects, the invention provides a software defined boundary implementation method and system based on an SDN, wherein the method does not need to add extra SDP gateway equipment when a system of the software defined boundary is arranged, solves the problem of single-point processing performance, and can be used for security protection among internal networks to prevent illegal access or attack among the internal networks.

In order to solve the problems, the invention is realized according to the following technical scheme:

a software defined boundary implementation method based on SDN comprises the following steps:

the SDN controller issues an SPA acquisition flow table to the SDN switch;

the SDN switch collects SPA authorization messages from a client according to the SPA collection flow table and sends the collected SPA authorization messages to the SDN controller; the SPA authorization message comprises an encryption certificate, client information and target service information;

the SDN controller judges the validity of the encryption certificate according to preset registration information and the target service information, and when the encryption certificate is judged to be valid, the SDN controller generates an authorization forwarding flow table according to the client information and the target service information;

and the SDN switch matches the received access message according to the authorization forwarding flow table, and forwards the access message to the target service specified by the target service information when the matching is successful.

As a further improvement of the method, the method also comprises the following steps:

registering network information of a protected service to the SDN controller to generate the registration information and the encryption certificate; the registration information includes credentials for decrypting the encrypted certificate.

As a further improvement of the method, the method also comprises the following steps: and the client acquires the encryption certificate and generates the SPA authorization message according to the encryption certificate and the target service information of the protected service to be accessed.

As a further improvement of the method, the SPA authorization message further includes encryption information corresponding to the encryption certificate.

As a further improvement of the method, the encryption information includes an encryption type, an encryption mode, signature data, and encryption authentication data.

As a further improvement of the method, before the step of generating the authorization forwarding flow table by the SDN controller, the method further includes the steps of: and the SDN controller issues a default interception flow table to the SDN switch according to the network information of the protected service, wherein the default interception flow table is set to discard an access message with a target address as the protected service.

As a further improvement of the method, the SDN switch matches the received access packet according to the authorized forwarding flow table, and discards the access packet according to the default interception flow table when the matching is unsuccessful.

As a further improvement of the method, the target service information includes IP address and port information of the target service.

As a further improvement of the method, the manner in which the client acquires the encryption certificate is offline acquisition.

The invention also discloses a software defined boundary implementation system based on the SDN, which comprises an SDN controller and an SDN switch, wherein the SDN controller and the SDN switch are used for executing the software defined boundary implementation method based on the SDN to implement the software defined boundary.

Compared with the prior art, the invention has the beneficial effects that:

Drawings

Fig. 1 is a schematic structural diagram of the conventional SDP architecture described in the background of the invention.

Fig. 2 is a schematic step diagram of a software defined boundary implementation method based on SDN in embodiment 1 of the present invention.

Fig. 3 is a system architecture and data flow diagram of the specific application described in embodiment 2 of the present invention.

Fig. 4 is a data transmission flow chart of the specific application scheme described in embodiment 2 of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. The components of embodiments of the present invention generally described and illustrated in the figures herein may be arranged and designed in a wide variety of different configurations.

Thus, the following detailed description of the embodiments of the present invention, presented in the figures, is not intended to limit the scope of the invention, as claimed, but is merely representative of selected embodiments of the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures. Meanwhile, in the description of the present invention, the terms "first", "second", and the like are used only for distinguishing the description, and are not to be construed as indicating or implying relative importance. In addition, the drawings in the present invention are only for illustrating the structure or function of the embodiments in the present invention, and the size, length, and ratio thereof are not particularly limited to the structure or function in the embodiments unless otherwise stated or noted.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

In the description of the present invention, it should be noted that the terms "upper", "lower", "inside", "outside", and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the drawings or orientations or positional relationships conventionally put in use of products of the present invention, and are only for convenience of description and simplification of description, but do not indicate or imply that the devices or elements referred to must have specific orientations, be constructed in specific orientations, and be operated, and thus, should not be construed as limiting the present invention.

In the description of the present invention, it should also be noted that, unless otherwise explicitly specified or limited, the terms "disposed" and "connected" are to be interpreted broadly, e.g., as being either fixedly connected, detachably connected, or integrally connected; can be mechanically or electrically connected; they may be connected directly or indirectly through intervening media, or they may be interconnected between two elements. The specific meanings of the above terms in the present invention can be understood in specific cases to those skilled in the art.

Example 1

As shown in fig. 2 and fig. 4, the embodiment discloses a software defined boundary implementation method based on SDN, which includes the steps of:

s1, registering the network information of the protected service to the SDN controller to generate registration information and an encryption certificate.

Specifically, the registration information includes a credential for decrypting the encrypted certificate. The SDN controller may subsequently verify the legitimacy of the received cryptographic certificate from the credentials in the registration information.

And S2, the SDN controller issues a default interception flow table to the SDN switch according to the network information of the protected service.

Specifically, the default interception flow table is set to discard the access packet whose target address is the protected service. In this embodiment, the purpose of this setup is that when a protected service is registered with the SDN controller, the SDN controller confirms that the service is a protected service, and for security, the SDN controller may intercept all unauthorized clients attempting to access the protected service through a default interception flow table before no client attempts to send an SPA authorization message.

S3, the client side obtains the encrypted certificate and generates the SPA authorization message according to the encrypted certificate and the target service information of the protected service to be accessed.

Specifically, in this embodiment, the manner in which the client acquires the encryption certificate is offline acquisition. The purpose of this setting is that the conventional manner of acquiring the certificate online may cause the SDN controller to be exposed, so that the SDN controller is easily targeted for network attack, and therefore, the client may effectively reduce the probability of the SDN controller being attacked by acquiring the encryption certificate offline, thereby improving the security of the entire system.

Specifically, the SPA authorization message includes an encryption certificate, client information, and target service information. Specifically, the target service information is related network information of a protected service to be accessed by the client. Specifically, in this embodiment, the target service information includes an IP address and port information of the target service.

Specifically, in this embodiment, the SPA authorization message further includes encryption information corresponding to the encryption certificate. Specifically, in this embodiment, the encryption information includes an encryption type, an encryption mode, signature data, and encryption authentication data.

And S4, issuing the SPA acquisition flow table to the SDN switch by the SDN controller.

And S5, the SDN switch collects the SPA authorization message from the client according to the SPA collection flow table and sends the collected SPA authorization message to the SDN controller.

And S6, judging the validity of the encryption certificate by the SDN controller, and generating an authorization forwarding flow table by the SDN controller according to the client information and the target service information when the encryption certificate is judged to be valid.

Specifically, the SDN controller determines the encrypted certificate according to preset registration information and target service information, and optionally, the SDN controller decrypts the encrypted certificate through credentials in the registration information and determines that the encrypted certificate is legal when decryption is successful and verification is successful.

And S7, the SDN switch matches the received access message according to the authorized forwarding flow table, and forwards the access message to the target service specified by the target service information when the matching is successful.

Specifically, in this embodiment, the SDN switch matches the received access packet according to the authorized forwarding flow table, and discards the access packet according to the default interception flow table when the matching is unsuccessful.

The embodiment discloses a software defined boundary implementation method based on an SDN, the SDN controller replaces an SDP controller, the SDN switch replaces an SDP gateway, and the SDP gateway replaces an SDP gateway, so that an SPA single-packet authorization service logic is implemented through a flow table method of the SDN.

Example 2

As shown in fig. 3 and 4, this embodiment discloses a specific application scheme of the method, which corresponds to the SDN-based software defined boundary implementation method disclosed in embodiment 1.

Specifically, the application scheme comprises the following steps:

the administrator registers the user to the SDN controller and generates a certificate.

And the client acquires the user certificate in a offline mode, so that the SDN controller is not required to be exposed to an external network, and the SDN controller is prevented from being attacked by hackers.

The client generates an SPA single packet authorization message according to the certificate and sends the message to the protected service. The SPA message is a UDP protocol message, the message target IP is the IP address of the protected service, and the data content of the message comprises: user name, timestamp, encryption type, encryption mode, signature data, encryption authentication data, source IP address (the emulated client IP is modified by the NAT), etc.

And fourthly, the SDN switch receives the SPA single-packet authorization message and sends the SPA message to the SDN controller through an SPA single-packet authorization acquisition flow table.

And fifthly, the SDN controller extracts the encryption certificate of the SPA message and judges the legality of the certificate. If not, discarding, and if yes, extracting the client IP address, the target port and other information carried in the SPA message to generate an authorized forwarding flow table.

Issuing the authorization forwarding flow table to the SDN switch by the SDN controller

The client accesses the protected service.

And allowing the authorized forwarding flow table of the SDN switch to match the IP address, the target IP address and the target port information of the message, and forwarding the message to the specified protected service if the matching is hit.

And ninthly, if the matching is not successful, the SDN switch discards the message according to a default interception flow table so as to intercept the access of the unauthorized client to the protected service.

Example 3

The present embodiment discloses a software defined boundary implementation system based on SDN, and the structure of the system may refer to fig. 3, and the system includes an SDN controller and an SDN switch, where the SDN controller controls a plurality of virtual machines in a service group through the SDN switch, and specifically, the SDN controller and the SDN switch in the present embodiment are configured to execute the software defined boundary implementation method based on SDN according to embodiment 1 to implement a software defined boundary. Specifically, the technical effect of the technical solution in this embodiment is similar to that in embodiment 1, and is not described herein again.

Those of ordinary skill in the art will appreciate that the various illustrative method steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.

The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer-viewable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: various media capable of storing program codes, such as a U disk, a removable hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

While the preferred embodiments of the present invention have been illustrated and described in detail, it should be understood that modifications and variations can be effected by one skilled in the art in light of the above teachings without undue experimentation. Therefore, any technical solutions that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the prior art according to the present inventive concept should be within the scope of protection defined by the present claims.

Claims

1. A software defined boundary implementation method based on SDN is characterized by comprising the following steps:

the SDN controller issues unicast authorization SPA to acquire a flow table to the SDN switch;

the SDN switch collects unicast authorization SPA authorization messages from a client according to the unicast authorization SPA collection flow table and sends the collected unicast authorization SPA authorization messages to the SDN controller; the unicast authorization SPA authorization message comprises an encryption certificate, client information and target service information;

2. The SDN based software defined boundary implementation method of claim 1, further comprising the steps of:

3. The SDN based software defined boundary implementation method of claim 2, further comprising the steps of:

and the client acquires the encryption certificate and generates the unicast authorization SPA authorization message according to the encryption certificate and the target service information of the protected service to be accessed.

4. The SDN-based software defined boundary implementation method of claim 3, wherein the unicast authorized SPA authorization message further comprises encryption information corresponding to the encryption certificate.

5. The SDN-based software defined boundary implementation method of claim 4, wherein the encryption information comprises encryption type, encryption mode, signature data and encryption authentication data.

6. The SDN based software defined boundary implementation method of claim 2, further comprising, before the step of generating the authorization forwarding flow table by the SDN controller, the steps of:

and the SDN controller issues a default interception flow table to the SDN switch according to the network information of the protected service, wherein the default interception flow table is set to discard an access message with a target address as the protected service.

7. The SDN-based software-defined boundary implementation method of claim 6, wherein the SDN switch matches the received access packet according to the authorized forwarding flow table, and discards the access packet according to the default interception flow table when the matching is unsuccessful.

8. The SDN-based software defined boundary implementation method of claim 1, wherein the target service information comprises an IP address and port information of a target service.

9. The SDN-based software defined boundary implementation method of claim 3, wherein the client obtains the encryption certificate by offline acquisition.

10. An SDN-based software-defined boundary implementation system comprising an SDN controller and an SDN switch, the SDN controller and the SDN switch being configured to execute the SDN-based software-defined boundary implementation method according to any one of claims 1 to 9 to implement a software-defined boundary.