KR102132490B1 - Method and apparatus for trust network configurations of mobile devices in software-defined network - Google Patents

Abstract

A method for configuring a software-defined network-based trust network of mobile devices is disclosed. The method includes the steps of: transmitting, by a plurality of network nodes, authentication information to a TA protector protecting a Trust Access (TA) manager from a DDoS attack, and forwarding the authentication information to the TA manager; The TA manager performing an authentication process for the plurality of network nodes based on the authentication information, and transmitting an authentication result indicating whether authentication is successful to the TA protector; The TA protector transmits connection information for connection with the TA manager to authenticated network nodes among a plurality of network nodes according to the authentication result, so that the authenticated network nodes are based on the connection information to the TA manager And opening a control channel; And the TA manager transmits data channel establishment information for establishing a data channel through the open control channel to the authenticated network nodes, so that the authenticated network nodes establish a data channel based on the data channel establishment information. It includes the steps.

Description

METHOD AND APPARATUS FOR TRUST NETWORK CONFIGURATIONS OF MOBILE DEVICES IN SOFTWARE-DEFINED NETWORK

The present invention relates to a reliable network configuration between mobile devices.

Recently, technologies for guaranteeing and managing network connectivity have appeared. Examples include software defined network (SDN) technology and software defined perimeter (SDP) technology.

SDN technology is a technology that is being studied in terms of network configuration, construction and management, and SDP technology is a technology that is focused on the security aspects of the network.

SDP technology has three components: Controller, Initiator, and Acceptor, and is a technology that manages data channels that cannot be established for nodes that are not authenticated through the control channel.

In SDP technology, a component mounted on a terminal node requesting network service is called an initiator, and a service component mounted on a gateway or server to directly provide a data network is called an acceptor.

In the existing SDP technology, a complicated network environment, server-to-server, or GW-to-GW due to the disadvantage of the controller being exposed to the outside and focusing on cyber attacks and asymmetric processes and components such as initiator and acceptor The disadvantage is that it is ambiguous to apply to the service environment.

Moreover, methods and procedures for providing appropriate and secure network services in a mobile device-oriented environment are also unclear. Due to these shortcomings, in the case of a mobile GW, it is impossible to simultaneously perform the roles of an initiator and an acceptor.

The object of the present invention in one aspect is to provide a control channel establishment process in the same procedure without distinction between an initiator and an acceptor to overcome the above problems, and to construct a secure trust network in a mobile environment as well as an existing fixed network environment. It is intended to provide a safer method and device for software-based connection management and trust network configuration of mobile devices.

In other words, the present invention improves the existing problems of software-defined boundary (SDP) technology and provides a safer network management structure even in a mobile environment where the physical network environment of the terminal is limited, so that network and service development trends such as the IoT environment in the future. It is intended to provide a structure and method of connection management of a trusted network that can be more easily matched.

A method for configuring a software-defined network-based trust network of mobile devices according to an aspect of the present invention for achieving the above object, multiple network nodes are authenticated to a TA protector that protects a TA (Trust Access) manager from DDoS attacks Transmitting information, and the TA protector forwarding the authentication information to the TA manager; The TA manager performing an authentication process for the plurality of network nodes based on the authentication information, and transmitting an authentication result indicating whether authentication is successful to the TA protector; The TA protector transmits connection information for connection with the TA manager to authenticated network nodes among a plurality of network nodes according to the authentication result, so that the authenticated network nodes are based on the connection information to the TA manager And opening a control channel; And the TA manager transmits data channel establishment information for establishing a data channel through the open control channel to the authenticated network nodes, so that the authenticated network nodes establish a data channel based on the data channel establishment information. It includes the steps.

According to the present invention, it is possible to provide a control channel establishment process in the same procedure without distinction between an existing initiator and an acceptor, and to construct a secure trust network in a mobile network environment as well as a fixed network environment.

Furthermore, in view of the current mobile service trend, since the usability of devices in a mobile network environment, for example, a mobile terminal and a mobile gateway, is increasing, various networks are added and hyper-connection is possible at anytime and anywhere. It is expected to be more useful as a core network technology in society.

1 is a diagram showing a service structure for configuring a trust network connection according to an embodiment of the present invention.
2 is a flowchart illustrating a registration process performed between a fixed GW/server and a TA manager in a control channel establishment procedure according to an embodiment of the present invention.
3 is a flowchart illustrating a registration process performed between a mobile GW and a TA manager in a control channel establishment procedure according to an embodiment of the present invention.
4 is a flowchart illustrating a network connection request and a data channel establishment process between a mobile terminal and a fixed GW/server according to an embodiment of the present invention.

Hereinafter, various embodiments of the present invention will be described in connection with the accompanying drawings. Various embodiments of the present invention may have various modifications and various embodiments, and specific embodiments are illustrated in the drawings and related detailed descriptions are described. However, this is not intended to limit the various embodiments of the present invention to specific embodiments, and should be understood to include all modifications and/or equivalents or substitutes included in the spirit and scope of the various embodiments of the present invention. In connection with the description of the drawings, similar reference numerals have been used for similar elements. Expressions such as “include” or “can include” that may be used in various embodiments of the present invention indicate the existence of a corresponding function, operation, or component disclosed, and additional one or more functions, operations, or The components and the like are not limited. In addition, in various embodiments of the present invention, terms such as “include” or “have” are intended to designate the existence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but one Or further features or numbers, steps, actions, components, parts, or combinations thereof, should not be excluded in advance.

1 is a diagram showing a service structure for configuring a trust network connection according to an embodiment of the present invention.

Referring to FIG. 1, a service structure (or entire system) according to an embodiment of the present invention includes devices (or mobile network nodes) in a mobile network environment composed of a mobile terminal, a mobile gateway (mobile GW), and a mobile router. ) And a procedure and method for securing a reliable network management structure based on software definition between devices (fixed network nodes) in a fixed network environment composed of a fixed gateway (fixed GW), fixed router, and server.

To this end, the service structure (or the entire system) 100 according to an embodiment of the present invention, as shown in Figure 1, the network node (110, 120), TA protector (Trust Access Protector, 130), TA manager 140 and the authentication server 150.

The network nodes 110 and 120 include a first network node 110 and a second network node 120. The first network node 110 includes devices in a mobile network environment, such as a mobile terminal, a mobile gateway, and a mobile router. The second network node 120 includes devices in a fixed network environment, such as a fixed gateway, a fixed router, and a fixed server. A first TA (Trust Access) agent 112 is mounted inside the first network node 110. The second TA agent 112 is mounted inside the second network node 120.

The TA protector 130 performs the initial authentication procedure according to the authentication request (①) for the TA agents 112 and 122 to access the network. In addition, the TA protector 130 protects the TA manager 140 from a Distributed Denial of Service (DDoS) attack. The TA protector 130 may be a computing device or a server device configured to include a processor, memory, and communication interface.

The TA manager 140 receives the authentication information of the TA agents 112 and 122 from the TA protector 130 and, after authentication through the authentication server 150, when the authentication is successful, the TA agents 112 and 122 ) And control channel (②). In addition, the TA manager 140 manages data channel establishment information between network nodes 110 and 120 such that the authenticated TA agents 112 and 122 establish a data channel ③ between each other. Data channel establishment information means information required to provide a data-based connection service between two nodes. The TA manager 140 may be a computing device or a server device configured to include a processor, a memory, and a communication interface.

The authentication server 150 receives authentication information of the TA agents 112 and 122 from the TA manager 140 and performs an authentication procedure based on the received authentication information.

In the service structure for configuring a trust network connection composed of these configurations 110 to 150, a control channel ② is generated after authentication of the TA agents 112 and 122, and the TA agents 112 and 122 Data channel connection (③) between the TA agents 112 and 122 is provided by the control command and policy received through the generated control channel ②.

Hereinafter, a service embodiment according to the service structure shown in FIG. 1 will be described in detail, and for simplicity of explanation, the authentication server 150 will be described with a configuration included in the TA manager 140, and the It is assumed that the connection between the TA protector 130 and the TA manager 140 is safely established.

Service example

The main procedure provided in the service structure shown in FIG. 1 is an authentication request procedure performed between the TA agents 112 and 122 and the TA protector 130, the TA agents 112 and 122 and the TA manager ( 140) between the control channel establishment procedure (or control channel configuration procedure) and the first TA agent 112 and the second TA agent 122 data channel establishment procedure (or data channel configuration procedure) It includes.

Authentication request process

First, the authentication request procedure occurs between the network nodes 110 and 120 (or TA agents 112 and 122) and TA protector 130 that want to communicate. The network node 110 existing on the network must first authenticate itself through a communication interface provided by the TA protector 130 to establish a data channel with the other network node 120 to communicate with.

The TA protector 130 transmits the authentication information included in the authentication request message from the network nodes 110 and 120 to the TA manager 140 together with the node information, and the TA manager 140 receiving the authentication information authenticates Through the process, the authentication process for the corresponding nodes 110 and 120 is performed.

If authentication is successful, the TA protector 130 connects information (eg, IP, port information, etc.) of the TA manager 140 so that network nodes 110 and 120 can establish a control channel with the TA manager. ) And channel authentication tokens to network nodes 110 and 120 requesting their authentication. The process of transmitting the connection information is to prevent the TA manager 140 from being exposed to a denial of service attack such as DDoS.

Thereafter, a control channel establishment procedure between the TA manager 140 and the corresponding nodes 110 and 120 is started.

For the authentication request procedure, the TA protector 130 must provide a secure channel so that the network nodes 110 and 120 requesting authentication can trust their 130 and perform the authentication request procedure.

Control Channel Construction Procedure

The control channel establishment procedure takes place between the TA agents 112 and 122 and the TA manager 140. The most basic device for establishing a reliable connection of the network is the TA manager 140.

The TA manager 140 authenticates network nodes 110 and 120 attempting to connect, and a control channel ② with the authenticated nodes 110 and 120 (or TA agents 112 and 122). It plays a role of maintaining and managing, and manages related information necessary for maintenance and management.

The TA manager 140 manages related information that enables the authenticated nodes 110, 120 or TA agents 112 and 122 to establish a mutual data channel ③.

The relevant information is as follows.

-Service and access control information of network nodes 110 and 120

-Address information of network nodes 110 and 120

-Authentication information of network nodes 110 and 120 (eg, ID, secret information, certificate, etc.)

-Control channel information of network nodes 110 and 120

-Data channel management information of network nodes 110 and 120 (data channel connection management information, security attribute information, tunneling information, etc.)

-Service access control information of network nodes 110 and 120

-Registered TA protector registration information and secure connection management information (TA protector authentication information, TA protector connection information, etc.)

The control channel information includes identification information, login address information, connection node information, connection status information, session identification information, login information, channel authentication token, etc. of logged nodes (110, 120) among registered network nodes after authentication. It includes.

The data channel management information means management information required for the TA manager 140 to establish a data channel ③ between any two nodes. That is, the data channel management information may include both end node information for establishing the data channel ③, security attribute information if security is required, and tunneling information between ends when tunneling is required.

The security attribute information is a security-related parameter and includes information related to a key value, a key size, and an algorithm used.

The tunneling information is information for connecting to a source and a destination like a tunnel without being aware of a router or the like existing in a path in a network connection method, and examples include setup information, IP_in_IP tunnel, and IPsec tunnel.

This information is information to be managed by the TA manager 140 in order to overcome the asymmetry of the existing software defined perimeter (SDP), and by using this information, the TA manager 140 is configured for the terminal or equipment. It enables symmetric and reliable connection management regardless of which communication is requested first.

In practice, the data channel connection of devices in the network of operators that provide Internet services is usually [terminal-to-server], [terminal-to-gateway], [gateway-to-gateway], [gateway-to-server], etc. In the same way, it is managed and built at the network topology level.

In order to reliably manage this, the TA agent mounted on the gateway, server, etc., which is a device that provides connectivity to the resource where the resource to be protected is located, first authenticates with the TA manager 140 and then checks whether the device is available to the TA manager 140. Have them register. If the availability of real devices is not registered and managed in the TA manager 140, it should be managed so that no terminal or device can access the network.

The TA manager 140 grasps channel state information through the formation of a control channel ② for registered devices, and establishes a data channel with the currently available registered device when requesting network access from any device or terminal in the future Information.

To establish and release the control channel, the established control channel (②) is maintained or terminated based on the login/logout of devices, and must be protected by https or TLS.

The registration process of fixed network nodes (fixed GW/server in a fixed network environment) for resource protection in the TA manager 140 is shown in FIG. 2.

Referring to FIG. 2, first, in step S201, the network node (fixed GW/server 120) or the TA agents 112 and 122 embedded in the network node 120 transmit their authentication information to the TA protector 130 To the TA protector 130 to request authentication of itself (fixed GW/servers 110 and 120).

Subsequently, in step S203, the TA protector 130 forwards the authentication information of the fixed GW/server 120 received from the fixed GW/server 120 to the TA manager 140.

Subsequently, in step S205, the TA manager 140 performs an authentication process based on authentication information of the fixed GW/server 120 forwarded from the TA protector 130, and upon successful authentication, the fixed GW/server ( Node information of the fixed GW/server 120 included in the authentication information of 120), for example, identification information, IP information, etc., is registered in a database (not shown).

Subsequently, in step S207, the TA manager 140 transmits the result of performing the authentication process, that is, an authentication result indicating whether authentication is successful or unsuccessful, to the TA protector 130. At this time, upon successful authentication of the fixed GW/server 120, the TA manager 140 issues a channel authentication token, and transmits the issued channel authentication token to the TA protector 130 together with the authentication result. do. The channel authentication token is used to manage the control channel between the TA manager 140 and the fixed GW/server 120 so as not to be lost. To this end, the TA manager 140, as described in step S209 below, when authentication of the fixed GW/server 120 is finished, issues a channel authentication token related to the control channel and delivers it to the fixed GW/server 120 Is done. Thereafter, when the fixed GW/server 120 transmits a message to the TA manager 140 through the control channel, the channel authentication token is transmitted together with the message, so that the authenticated control channel can be maintained. The channel authentication token is deleted when the fixed GW/server 120 is logged out, and sequentially performs steps S201, S203, and S205, and when authentication succeeds in step S207, is reissued, and the fixed GW through the TA protector 130 / It is transmitted to the server 120 and used.

Subsequently, in step S209, when the TA protector 130 receives the authentication result indicating the authentication success and the channel authentication token from the TA manager 140, the TA manager 140 responds to the authentication result indicating the authentication success. ) And the connection information (IP information of the TA manager 140, port information of the TA manager 140, etc.) and the channel authentication token are transmitted to the fixed GW/server 120 for connection with. If the TA protector 130 receives the authentication result indicating the authentication failure from the TA manager 140, although not shown in the figure, the TA protector 130 authenticates the fixed GW/server 120 Sending a re-request message for information, and in response to the re-request message, the fixed GW/server 120 passes the TA protector 130 to the TA manager 140 to authenticate the authentication information of the person 120 Transmission, and the TA manager 140 repeatedly performs the authentication procedure of the fixed GW/server 120 based on the authentication information retransmitted from the fixed GW/server 120.

The connection information (IP information of the TA manager 140, port information of the TA manager 140, etc.) to be connected to the TA manager 140 may be information registered in advance in the TA protector 130. Alternatively, the TA manager 140 may transmit the authentication result indicating authentication success to the TA protector 130 together with the authentication result at the time of transmitting the authentication result indicating the authentication success.

Subsequently, in step S211, the fixed GW/servers 110 and 120 use the connection information (IP information of the TA manager 140, port information of the TA manager 140, etc.) and the channel authentication token. The control channel with the manager 140 is opened.

Subsequently, in step S213, simultaneously with the opening of the control channel or after the opening of the control channel, the TA manager 140 controls control channel information related to the opened control channel, for example, a fixed GW registered after authentication. / Among the servers, the node information for the logged-in fixed GW/server (identification information, IP of the logged-in fixed GW/server 120), session identification information, channel authentication token, login information, etc. are registered in the database.

Subsequently, in step S215, the fixed GW/servers 110 and 120 periodically report the Keep Alive status message indicating their availability to the TA manager 140.

Meanwhile, the process performed between the mobile GW and the TA manager 140 for requesting a network connection service of the terminal in an environment where fixed network nodes (mobile terminal or mobile GW) exist is almost the same as the registration process of FIG. 2. Is performed.

In more detail, first, in a mobile network environment, the mobile GW must provide a network service so that the mobile terminal can perform data communication through itself. Therefore, first, a procedure is required to secure the connectivity between the network and the data channel in which the mobile gateway is established. This is performed by the network connection request process for the [mobile GW-to-GW] data channel connection. From the standpoint of the TA protector 130, the registration process of the mobile GW will be viewed the same as the service connection request of the terminal.

However, if the mobile GW operates at a location with different IP information before logout, a method for controlling and managing it is needed. That is, as described above, when the control channel with an unauthenticated node is established or authenticated so that the control channel is not lost due to movement, the TA manager ends the authentication with the mobile gate, and then authenticates the channel with respect to the established control channel. Tokens are issued and delivered to mobile terminals (or mobile devices). Thereafter, when the mobile terminal (or mobile devices) transmits a message to the TA manager 140 through the control channel, the channel authentication token is transmitted together with the message so that the authenticated control channel can be maintained. These channel authentication tokens should be used when mobile terminals (or mobile devices) are logged out and reissued when logged in.

The service embodiment including the registration process of the mobile GW and the control channel establishment process is illustrated in FIG. 3.

Steps S301 to S315 of FIG. 3 correspond to steps S201 to S215 of FIG. 2, and those skilled in the art will fully understand steps S301 to S315 of FIG. 3 with description of steps S201 to S215 of FIG. 2. Therefore, the description of steps S301 to S315 of FIG. 3 will be omitted.

However, between steps S309 and S311, the TA agent 112 of the mobile GW 110 connects itself to the TA manager through the TA protector 130 and the connection information transmitted from the TA manager 140 (IP, port, etc.) to set-up (set-up) procedure (step S309A) may be further performed.

The TA agent 112 of the mobile GW 110 receives an authentication request of nodes (mobile terminals or mobile devices) attempting to communicate through the mobile GW 110, and transmits their authentication information to the TA protector 130 Is sent to. At this time, the mobile GW 110 should be managed to be always open to the communication channel directed to the TA protector 130.

On the other hand, in Figures 2 and 3, the TA protector 130 and the TA manager 140 need a secure connection configuration. This is to prevent requests for authentication of devices (fixed GW/server, mobile GW, or mobile terminal) directly to the TA manager without going through the TA protector 130. That is, the TA manager 140 should always be managed to receive authentication information for authentication requests of devices (fixed GW/server, mobile GW, or mobile terminal) through the predetermined TA protector 130.

Data channel establishment procedure

2 and 3, when the control channel establishment procedure including the registration process of the fixed GW device or the mobile GW is completed, a network service connection request process and a data channel establishment procedure of the mobile terminal may be started.

When a mobile terminal does not have a network environment available to it, it is forced to use a network service using a mobile GW device. For this case, it is necessary to establish a network between the mobile terminal and the mobile GW. This process is not specifically mentioned in this specification.

After the network setup between the mobile terminal and the mobile GW is finished, the mobile terminal can perform a network service connection request process and a data channel establishment procedure by starting an authentication request process through the mobile GW. This process is as shown in FIG. 4.

Referring to FIG. 4, first, in step S401, the first TA agent 112 embedded in the mobile terminal 110-1 transmits an authentication request message including authentication information of the mobile terminal 110 to the TA protector 130 Send to the request for authentication of yourself (110).

Next, in step S403, the TA protector 130 forwards the authentication information received from the mobile terminal 110 to the TA manager 140.

Subsequently, in step S405, the TA manager 140 performs an authentication process for the mobile terminal 110 based on the authentication information of the mobile terminal 110 forwarded from the TA protector 130, and the mobile terminal 110 of the mobile terminal 110 If authentication is successful, node information (identification information, IP information) of the mobile terminal 110 is registered in the database.

Subsequently, in step S407, the TA manager 140 transmits an authentication result message indicating the authentication success of the mobile terminal 110 and a channel authentication token to the TA protector 130.

Subsequently, in step S409, the TA protector 130 responds to an authentication result message indicating authentication success, and connection information (IP, Port, etc. of the TA manager) for communication connection between the mobile terminal 110 and the TA manager 140. The channel authentication token is transmitted to the mobile terminal 110-1.

Subsequently, in step 411, the first TA agent 112 embedded in the mobile terminal 110 opens a control channel with the TA manager 140 using the connection information and the channel authentication token.

Subsequently, in step S413, at the same time as the control channel is opened or after the control channel is opened, the TA manager 140 controls control channel information related to the opened control channel, for example, a mobile terminal registered after authentication. Among 110), node information (identification information, IP information), connection address information, connection status information, session identification information, channel authentication token, login information, etc. for logged-in mobile terminals are registered in a database (not shown). .

Then, in step S415, the first TA agent 112 embedded in the mobile terminal 110 periodically displays a keep alive status message to the TA manager 140 indicating the availability of the mobile terminal 110 through an open control channel. report.

Subsequently, in step S417, the TA manager 140 searches for service information and data channel establishment information corresponding to IDs of devices that have been previously registered, and based on the service information and data channel establishment information of the mobile terminal 110. In this way, the mobile terminal 110 searches for an accessible gateway/server 140.

Subsequently, in step S419, the TA manager 140 transmits data channel establishment information and a network connection command (or an interface open command) for establishing a data channel with the mobile terminal 110 to the searched gateway/server 140. At the same time or later, in step S421, the TA manager 140 transmits data channel establishment information for data channel establishment to the mobile terminal 110.

The gateway/server 140 receiving the data channel establishment information and the network connection command (or the interface open command) from the TA manager 140 is a data channel from the first TA agent 112 embedded in the mobile terminal 110. Wait for a request message for a connection.

In step S423, the first TA agent 112 embedded in the mobile terminal 110 requests a data channel connection to the other node, that is, the GW/server 140 based on the data channel establishment information (secure connection, tunneling, etc.) ), and the gateway/server 140 accepts the request message, thereby establishing a data channel connecting the mobile terminal and the gateway/server 140.

On the other hand, for a more reliable connection network configuration, although not shown in FIG. 4, GW devices including a mobile GW connected to the mobile terminal 110 must block all data channels with mobile terminals or other GW devices. That is, all data channels must be managed in a closed state before the TA manager's data channel establishment information is activated by the GW.

As described above, the existing SDP network technology has no specific procedures and methods to be applied in a mobile environment, and it is a certification to prevent DDoS attacks by proposing a structure in which the controller having the control function of all networks is exposed to the outside. It may be difficult to provide structural safety by design only for protocols.

In addition, while the SDP has different procedures for the asymmetric structures such as initiator and acceptor in the control channel establishment process, the present invention simplifies the complex network environment in that the control channel establishment process is designed to operate identically without such a distinction. Make it manageable.

In view of the current mobile service trend, as the usability of mobile terminals and mobile gateways is increasing, various networks are added and it is expected to be more highly utilized as a core technology of a hyper-connected society that can be connected at any time and anywhere.

In the above, the present invention has been mainly described with reference to examples, but this is merely an example and does not limit the present invention, and those skilled in the art to which the present invention pertains are not limited to the essential characteristics of the present invention. It will be appreciated that various modifications and applications not illustrated in FIG. For example, each component specifically shown in the embodiments of the present invention can be implemented by modification. And differences related to these modifications and applications should be construed as being included in the scope of the invention defined in the appended claims.

Claims (10)

A plurality of network nodes transmitting authentication information to a TA protector protecting a Trust Access (TA) manager from a DDoS attack, and the TA protector forwarding the authentication information to the TA manager;
The TA manager performing an authentication process for the plurality of network nodes based on the authentication information, and transmitting an authentication result indicating whether authentication is successful to the TA protector;
The TA protector transmits connection information including IP information and port information of the TA manager to be connected to the TA manager to authenticated network nodes among a plurality of network nodes according to the authentication result. Network nodes opening the TA manager and a control channel based on the connection information; And
The TA manager transmits data channel establishment information for establishing a data channel through the open control channel to the authenticated network nodes, so that the authenticated network nodes establish a data channel based on the data channel establishment information. step
Method for configuring a software-defined network-based trust network comprising a. delete The method of claim 1, wherein the step of transmitting an authentication result indicating whether the authentication is successful is transmitted to the TA protector,
And the TA manager issuing a channel authentication token and transmitting the issued channel authentication token together with the authentication result to the TA protector. The method of claim 3, wherein the step of opening the control channel with the TA manager based on the connection information by the authenticated network nodes is:
And the TA protector transmitting the authentication result and the channel authentication token from the TA manager to the authenticated network nodes. The method of claim 3, wherein the step of establishing a control channel with the TA manager based on the connection information by the authenticated network nodes is:
When the control channel is established, when the authenticated network nodes transmit a message to the TA manager through the control channel, by transmitting the channel authentication token issued by the TA manager through the TA protector together with the message, the A method for configuring a software-defined network-based trust network, which is a step of maintaining a control channel. In claim 1, The data channel establishment information,
A method for configuring a software-defined network-based trusted network that includes node information on both sides of the authenticated network nodes, security attribute information, and tunneling information between the authenticated network nodes. In claim 1,
And the authenticated network nodes periodically transmitting a Keep Alive status message indicating their availability to the TA manager. A Trust Access (TA) protector that receives authentication information from multiple network nodes; And
And a TA manager performing an authentication process for the plurality of network nodes based on the authentication information, and transmitting an authentication result indicating whether authentication is successful to the TA protector,
The TA protector includes IP information and port information of the TA manager for connecting to the TA manager to authenticated network nodes among the network nodes according to the authentication result, in order to protect the TA manager from DDoS attacks. Send connection information,
The TA manager opens a control channel with the authenticated network nodes based on the connection information, and establishes a data channel for establishing a data channel through the opened control channel so that the authenticated network nodes establish a data channel. Device for configuring a software-defined network-based trust network, characterized in that for transmitting to the authenticated network nodes. delete In claim 8, the TA manager,
Device for issuing a channel authentication token and transmitting the issued channel authentication token together with the authentication result to the TA protector.

Images