KR20180104376A - Method for supporting security function in software defined network, and network apparatus and controller for the same - Google Patents

Abstract

Disclosed is a method for processing a security function applicable to a software defined network (SDN) environment. The method for processing a security function of a network device comprises the steps of: transmitting a list of a security function supported by a network device to an SDN controller; receiving, from the SDN controller, an instruction of an application of the security function satisfying a security level required in accordance with at least one security or service level among terminals of a terminal-to-terminal path; and performing the security function satisfying the required security level as an end network device with respect to traffic of the terminal-to-terminal path. Accordingly, a high level of security can be achieved even without directly performing, by a terminal, a security function requiring a large amount of computing power by performing the security function (encryption and/or tunneling) in a network device (e.g. gateway) rather than the terminal.

Description

METHOD FOR SUPPORTING SECURITY FUNCTIONS IN A SOFTWARE DEFINED NETWORK, AND NETWORK DEVICE AND SOFTWARE DEFINED CONTROLLER FOR THE SAME

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a software-defined network (SDN), and more particularly, to an apparatus and method for encrypting data transmitted between a router, a switch and a gateway in an SDN environment comprising a network device including a router, And to a network device and a controller.

Recently, Open Networking Foundation (ONF), Internet Engineering Task Force (IETF), and Internet Engineering Task Force (IETF) have standardized on technologies to efficiently operate a communication system by separating the traffic forwarding function (data plane) , European Telecommunications Standards Institute (ETSI) ISG Network Function Virtualization (NFV), and International Telecommunications Union Telecommunication (ITU-T).

Software Defined Network (SDN) refers to a user-centric network in which a user has control over a basic network device such as a router or a switch, and a separate controller controls traffic flow.

In particular, SDN can provide software programmable centralized control by separating control planes and data planes from existing integrated networks and abstraction.

In SDN, after a topology configuration between network devices is completed, a new flow is inquired to the controller about how to forward the flow, and the controller sends the forwarding policy for the flow to the network devices.

At this time, the network device seeks to improve the security by separating the network devices from other networks by utilizing the tunneling function or the virtual network function in the communication between the network devices. End-to-end security using SSL / TLS technology between the terminal and the server for more robust security, but this method requires a lot of computing power for the user terminal do.

In addition, although IPSec communication is performed for IP-protected communication, there are cases where the IPSec communication is not widely used because of performance degradation.

According to an aspect of the present invention, there is provided a method of processing a security function of a software defined network controller, which enables a high level of security even when a heavy security function requiring a large amount of computing power is not performed in a terminal have.

Another object of the present invention is to provide a method of processing a security function of a network device that enables a high level of security even when a heavy security function requiring a large amount of computing power is not performed in a terminal .

Another object of the present invention is to provide a security function processing method of a software defined network environment that enables a high level of security even when a heavy security function requiring a large amount of computing power is not performed in a terminal, .

According to an aspect of the present invention, there is provided a method of processing a security function of an SDN controller for applying a security function to a terminal-to-terminal path in a Software-Defined Network (SDN) environment. A method of processing a security function of an SDN controller includes receiving a list of security functions supported by each network device from at least one network device constituting the SDN environment; A security function that satisfies a security level required according to the security or service class of at least one of the terminals in the terminal-to-terminal path based on the list of the received security functions, Selecting network devices; And instructing the selected end-point network devices to apply the selected security function to the traffic on the terminal-to-terminal path.

The list of security functions may be received at the start of operation of each of the network devices or periodically received during operation of each of the network devices.

The list of security functions may be received using a Link Layer Discovery Protocol (LLDP) or received using a message defined between the SDN controller and the at least one network device.

The at least one network device may be a router, a switch, or a gateway device.

The security function may include at least one of encryption and tunneling applied to the traffic on the terminal-to-terminal path.

On the other hand, if the change of the selected end-point network device or the change of the selected security function is required, the step of receiving the list of the security functions or the step of selecting the security function and the end-point network devices may be performed again.

According to another aspect of the present invention, there is provided a method of processing a security function of a network device for applying a security function to a terminal-to-terminal path in a Software Defined Network (SDN) environment. The method comprising: transmitting a list of security functions supported by the network device to an SDN controller in the SDN environment; Receiving from the SDN controller application of a security function satisfying a security level required according to a security or service class of at least one of the terminals in the terminal-to-terminal path; And performing, as an end-point network device for the terminal-to-terminal path, a security function that satisfies the required security level for the traffic on the terminal-to-terminal path.

The list of security functions may be transmitted at the start of operation of the network device, or may be periodically transmitted during operation of the network device.

The list of security functions may be transmitted using a Link Layer Discovery Protocol (LLDP), or may be transmitted using a message defined between the SDN controller and the network device.

The network device may be a router, a switch, or a gateway device.

The security function may include at least one of encryption and tunneling applied to the traffic on the terminal-to-terminal path.

When the security function satisfying the required security level is required or when the role or status of the network device is changed, a step of transmitting a list of the security functions or a step of instructing application of the security function Can be resumed.

According to another aspect of the present invention, there is provided a method of applying a security function to a terminal-to-terminal path in a Software Defined Network (SDN) environment. The method comprises the steps of: at least one network device transmitting to the SDN controller a list of security functions supported by each network device; Wherein the SDN controller provides a security function that satisfies a security level required according to a security or service class of at least one of terminals of the terminal-to-terminal path among the at least one network devices, Selecting end-to-end network devices; The SDN controller instructing the selected end-to-end network devices to apply the selected security function to traffic of the terminal-to-terminal path; And applying the security function instructed by the network device selected as the terminal device to the traffic of the terminal-to-terminal path.

Wherein the list of security functions is transmitted to the SDN controller at the start of operation of the at least one network device or periodically transmitted to the SDN controller during operation of the at least one network device, And transmitted to the SDN controller.

The list of security functions may be transmitted using a Link Layer Discovery Protocol (LLDP) or transmitted using a message defined between the SDN controller and the at least one network device.

The at least one network device may be a router, a switch, or a gateway device.

The security function may include at least one of encryption and tunneling applied to the traffic on the terminal-to-terminal path.

On the other hand, if the change of the selected end-point network device or the change of the selected security function is required, the step of transmitting the list of security functions to the SDN controller or the step of instructing application of the security function may be performed again.

Here, when the selected end-point network device needs to be changed, it may be at least one of a case where an error has occurred in the network device operating as the selected end-point network device, a case where the operation is interrupted, and a case where the load becomes large.

Here, when the selected security function needs to be changed, it may be the case that the security functional requirement level of at least one terminal in the terminal-to-terminal path is changed.

In the security function processing method according to the present invention as described above, a security function (encryption and / or tunneling) is performed at a network end (for example, a gateway) rather than a terminal so that even if a heavy security function is not performed in the terminal, Level security can be achieved. On the other hand, even when the security function is performed concurrently at the terminal level, the level of security function at the level of the network device responsible for the traffic transfer can be further performed, so that a stronger level of security can be achieved.

Therefore, the methods according to the present invention can reduce the worry about the security of the user in network transmission in the form of terminal-server, terminal-server-terminal, server-server, It is possible to apply a differentiated password policy, and to set a dynamic security function according to need.

In addition, when encryption or tunneling is required, the SDN controller that manages network devices enables such function setting, thereby making it possible to dynamically provide security services between specific gateways or specific gateways of a software defined network.

1 is a conceptual diagram for explaining an SDN environment to which a security function processing method according to embodiments of the present invention can be applied.
2 is a conceptual diagram for explaining a security function list information collection procedure in a security processing method in an SDN environment according to an embodiment of the present invention.
3 is a conceptual diagram illustrating a security function application instruction procedure in a security processing method in an SDN environment according to an embodiment of the present invention.
4 is a conceptual diagram for explaining another example of security function application in the security processing method in the SDN environment according to an embodiment of the present invention.
5 is a flowchart illustrating an operation method of an SDN controller supporting a security processing method in an SDN environment according to an embodiment of the present invention.
6 is a flowchart illustrating an operation method of a network device supporting a security processing method in an SDN environment according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

The terms first, second, A, B, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, terms used in this specification will be briefly summarized as follows.

A controller is an SDN controller and may refer to an entity that controls an associated component (e.g., a switch, a router, etc.) to control the flow of traffic.

Further, the controller is not limited by the physical implementation form or the location of the implementation. For example, the controller means a controller functional entity defined by ONF (OpenFlow), IETF (Internet Engineering Task Force), ETSI (International Telecommunication Standards Institute) and / or ITU-T (International Telecommunication Union Telecommunication) can do.

A "network device" may refer to a functional element that substantially forwards, switches or routes traffic (or packets), such as a 'switch', a 'router' or a ' Thus, the network device may be referred to herein as a switch or a router.

For example, a network device means a switch, a router, a switching element, a routing element, and a forwarding element defined in ONF, IETF, ETSI and / or ITU-T .

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a conceptual diagram for explaining an SDN environment to which a security function processing method according to embodiments of the present invention can be applied.

Referring to FIG. 1, in the SDN environment, terminals 10 and 40 exchanging data, routers or switches 11 through 14 and 31 through 34 connecting them, gateway devices 20 and 30, There is an SDN controller 100 that centrally manages router / switch / gateway devices.

In the SDN environment, the SDN controller 100 can centrally manage the network devices 11 to 14, 31 to 34, 20 and 30. 1, a connection relationship exists only between the SDN controller 100 and the gateway devices 20 and 30. However, the SDN controller 100 is connected to the routers or the switches 11 to 14 and 31 to 34 Have a connection relationship. In the following, a router / switch / gateway device is a component that substantially forwards, switches, or routes traffic (or packets) and is collectively referred to as a " network device " It should be noted that the parts described in the operation of the gateway apparatuses 20 and 30 in the following description can also be applied to the routers or the switches 11-14 and 31-34.

Also, at least one of the terminals 10 and 40 may be configured as a server, for example, a content server, in the sense of providing a service for a counterpart terminal. That is, the terminal used in FIG. 1 is referred to as a terminal in the meaning of the termination of data exchange, and is not limited to terminals in the terminal-server structure.

In the prior art network environment other than the SDN environment, there is no SDN controller 100 that performs centralized control. Accordingly, the network devices (existing switch / router / gateway devices) for packet transmission are distributedly operated with the IP addresses allocated to the respective interfaces, and communicate with peripheral network devices using an autonomous routing protocol The forwarding path for the packets is set.

On the other hand, in the SDN environment as illustrated in FIG. 1, after a topology configuration between network devices is completed (for example, using a protocol such as LLDP (Link Layer Discovery Protocol)), a packet of a new flow Upon ingestion, the network device asks the SDN controller 100 how to forward the flow (packet_in), and the controller sends a forwarding policy (i.e., a forwarding rule) to the network device do. For example, in the case of SDN controllers and network devices based on OpenFlow, a forwarding rule is set by adding or modifying a flow entry to a flow table of a network device. .

Meanwhile, in the above-described SDN environment, the security of data exchanged between the terminal 10 and the terminal 40 can be implemented by one or more of the following methods.

First, network devices can seek security enhancement by separating them from other networks by utilizing tunneling or virtual network functions in communication between network devices.

Second, end-to-end security is achieved using SSL (Secure Sockets Layer) or TLS (Transport Layer Security) technology between the terminal 10 and the terminal 40 for stronger security can do. However, this method has a disadvantage in that it requires a large amount of computing power for the terminals 10 and 40. Accordingly, in the case of a mobile terminal or a small terminal having weak computing power, the application of such a method may be difficult.

Third, for stronger security, IPSec (IP security protocol) communication can be performed at the IP terminals of the terminals 10 and 40 at both ends. However, this is also a problem of performance degradation.

Therefore, in the embodiment of the present invention, in order to solve the problem of the above-described security processing methods, encryption is performed at the network end rather than at the terminals 10 and 40 so that high computing power and complicated procedures are performed in the terminals It provides a security processing method that enables the same or higher level of security without requiring the required security function directly.

First, an operation of the SDN controller 100 and the network devices 20 and 30 will be described with reference to FIGS. 2 to 4. FIG. As described above, for convenience of description, in the following description, an embodiment will be described by an operation between the gateway devices 20 and 30 of the network devices and the SDN controller 100, but the SDN controller 100 May operate in conjunction with the routers or switches 11 to 14 and 31 to 34 instead of the gateway devices 20 and 30. For example, a router or switch may also be an application of the present invention if it can also function as an end-to-end terminal path.

2 is a conceptual diagram for explaining a security function list information collection procedure in a security processing method in an SDN environment according to an embodiment of the present invention.

2, in the SDN environment in which the terminals 10 and 40, the network devices 11 to 14, 20, 30 and 31 to 34 and the SDN controller 100 exist, all the network devices 20, and 30) are subjected to centralized control of the SDN controller 100.

In an embodiment of the present invention, the SDN controller 100 may be configured such that when a security function needs to be applied to a specific flow / packet between the terminal 10 and the terminal 40 Request or SDN controller 100 according to the decision of the SDN controller 100), the gateway device 20 may perform an encryption function and the gateway 30 may perform a decryption function . That is, it means that the gateways 20 and 30 function as an end gateway in the network devices 11 to 14, 20, 30 and 31 to 34.

For example, the SDN controller 100 may be configured to determine which encryption / decryption algorithm is to be applied in connection with the security function and key management for encryption / decryption.

The security function (for example, encryption) to be performed can be applied differently depending on the type of the flow / packet or the rights of the terminals 10 and 40 (or terminal users) and the service or security level. To this end, the network devices proceed to notify the SDN controller 100 of security functions that can be supported by the SDN controller 100 after the operation starts. For example, each of the gateway devices 20 and 30 may transmit a list of security functions 220 and 230 to the SDN controller 100 including a security function that can be serviced by the gateway devices 20 and 30.

In the configuration illustrated in FIG. 1, the gateway devices 20 and 30 provide a list of security functions to the SDN controller 100 at the time of starting operation (e.g., booting or initialization) . However, the list of security functions may be transmitted from the gateway devices to the SDN controller 100 according to a predetermined period or a period that is dynamically changed. In addition, each gateway device may provide the corresponding information to the SDN controller 100 when a change of the security function supported by the gateway device occurs or when a specific event occurs. In addition, each gateway device is requested to provide its own security function list from the SDN controller 100, and may provide the SDN controller 100 with a list of security functions based on the request.

The security function lists 220 and 230 described above may use extension fields or reserved fields defined in existing protocols such as the LLDP used for generating the network topology mentioned above, (E.g., an Openflow message) defined between the gateway 100 and the gateway 20,30.

3 is a conceptual diagram illustrating a security function application instruction procedure in a security processing method in an SDN environment according to an embodiment of the present invention.

3, the SDN controller 100 uses the security function lists 220 and 230 received from the gateways 20 and 30 to select one of the security functions supported by both the gateways 20 and 30 (320, 330) to apply a security function (e.g., encryption / decryption) that matches the desired level (authority or security level)

That is, the SDN controller 100 determines the security level according to the security / service level of the terminals 10 and 40 (or the users of the terminals 10 and 40) based on the security function list information received from the various network devices, The application of the security function to the gateways 20 and 30 located on the traffic / packet delivery path 300 between the terminals 10 and 40 that can satisfy the security function capable of satisfying the selected security function among the various network devices You can tell.

On the other hand, when there is a difference in the security functions supported by the gateway devices 20 and 30, the SDN controller 100 determines whether the security functions supported by both the gateway devices 20 and 30 ) Or the security level of the highest level that meets the security level. However, this is only an example. Depending on the preset policy, the SDN controller 100 may select the lowest level security function among security functions that are commonly supported or may perform a procedure for re-selecting an end gateway to support the security function There will be.

Both gateway devices 20 and 30 perform encryption / decryption of traffic / packets between the terminals 10 and 40 using the indicated encryption / decryption algorithm according to the security function that the SDN controller 100 instructs to apply . Further, if necessary, the gateway devices 10 and 30 may perform a tunneling function between them.

4 is a conceptual diagram for explaining another example of security function application in the security processing method in the SDN environment according to an embodiment of the present invention.

On the other hand, there may be a gateway that is not under the control of the SDN controller 100 on the traffic / packet transmission path between the terminal 10 and the terminal 40. In this case, the SDN controller 100 may reestablish the path so that traffic can be transferred between the terminals 10 and 40 via the gateway device under its control of the security function.

4, when the gateway device 60 connected to the terminal 40 is not under the control of the SDN controller 100 in the structure in which the terminal 10 is connected to the terminal 40, the SDN controller 100 The path including the gateway device 60 and the gateway device 60 may be selected by another path (the path composed of the gateway devices 20 and 30) in order to prevent the transmission of the traffic requiring the security function. Here, the meaning that the gateway device 60 is not under the control of the SDN controller 100 means that the gateway device 60 can collect the security function list information described with reference to Figs. 2 and 3 or the SDN controller 100 is a network device that is unable to receive an indication of a security function to be applied.

On the other hand, when there is a gateway 50 not under the control of the SDN controller 100 in the path set between the two end gateways 20 and 30 under the control of the SDN controller 100, So that the tunnel is configured between the end gateways 20 and 30.

The above-described change of the end gateway can be applied to a case where a new security method is used at the time of starting the transmission of traffic or at the time of start of transmission of traffic, or when the security is changed to a higher security level.

In addition, when the security function list is referred to in the collection procedure of the security function list information described in FIG. 2, it is possible to apply the above-described procedure even when the end gateway device needs to be changed to support the required level of security function . For example, when the gateway 20 and the gateway 30 are set as the end gateway between the terminal 10 and the terminal 40, and the gateway 30 does not satisfy the required level of security function, It is also possible to change the end gateway to a gateway that supports security functions.

Hereinafter, in order to realize the linking operation between the SDN controller and the network device described with reference to FIG. 2 and FIG. 3, an operation method of the SDN controller according to the embodiment of the present invention, which is performed in each of the SDN controller and the network device, Will be described.

5 is a flowchart illustrating an operation method of an SDN controller supporting a security processing method in an SDN environment according to an embodiment of the present invention.

Referring to FIG. 5, the SDN controller 100 receives security information from at least one SDN network device (for example, 11 to 14, 20, 30, and 31 to 34) The list information of the functions can be received (S510).

The list information of the security function may be collected at an operation start time (e.g., after booting or initialization procedure) of each network device, and may be periodically collected during operation of each network device. It may also be provided to the SDN controller 100 from each network device based on a request (explicit or implicit request) of the SDN controller 100. Here, the collection of the security function list may be performed using an extension field defined in an existing protocol such as LLDP used for generating a network topology, or using a separately defined message.

The SDN controller refers to the information on the security functions that each network device collected in step S510 can support, and the SDN controller determines whether the network devices exist on the terminal-to- The end network devices capable of providing a security function meeting a required security level according to at least one security or service class among the terminals in the terminal path may be selected (S520).

4 again, for example, the SDN controller 100 may control the gateway device 20, 30, 50 and 60 except for the gateway device 60 that can not perform the collection procedure of the security function list among the gateway devices 20, (20, 30) capable of providing a security function and a corresponding security function that satisfy the security level requested by the terminal (10) and the terminal (40) among the terminals (20, 30, 50) .

Next, the SDN controller 100 may instruct the selected end-to-end network devices to apply a security function that meets the required security level according to the security or service class of at least one of the terminals in the terminal-to-terminal path (S530). The application of the security function may also be performed using an extension field defined in existing protocols such as LLDP or using a message defined separately.

The selected end-point network devices may apply the security function indicated in step S530 to the traffic on the end-to-end path (S540). At this time, the security function applied may include encryption / securing of traffic and / or tunneling between end-point network devices.

Meanwhile, during the application of the security function according to the step S540, there may occur a case where the change of the end network devices or the security function determined in the steps S520 and S530 is required (S550). For example, when an error occurs in the network device operating as the end-point network device, when the operation is interrupted, when the load of the end-point network device becomes large, when the terminal (or the user) A change in the network device or the security function may be required.

In this case, the SDN controller 100 proceeds from step S510 to collect the security function list of the network devices belonging to the SDN environment managed by the SDN controller 100, or if the security function list is already collected periodically, And may proceed from step S520 again to determine the applied security function.

6 is a flowchart illustrating an operation method of a network device supporting a security processing method in an SDN environment according to an embodiment of the present invention.

6, at least one SDN network device (for example, 11 to 14, 20, 30, 31 to 34) belonging to the SDN environment transmits list information of security functions supported by each network device to the SDN controller 100, (S610).

The list information of the security function may be transmitted to the SDN controller 100 at an operation start time (e.g., after booting or initialization procedure) of each network device, but may be periodically transmitted to the SDN controller 100 during operation of each network device . It may also be provided to the SDN controller 100 from each network device based on a request (explicit or implicit request) of the SDN controller 100. Here, the collection of the security function list may be performed using an extension field defined in an existing protocol such as LLDP used for generating a network topology, or using a separately defined message.

In step S610, the SDN controller 100 refers to information on security functions that can be supported by the respective network devices collected from the respective network devices, and the SDN controller 100 determines whether the network devices exist on the terminal- End network devices capable of providing a security function meeting the required security level according to the security or service class of at least one of the terminals in the terminal-to-terminal path among the devices.

Accordingly, a network device determined as an end-to-end network device to process a security function for traffic on the terminal-to-terminal path may transmit a security function satisfying a security level required from the SDN controller 100 to the terminal- (S620). ≪ / RTI > The application of the security function may also be received using an extension field defined in existing protocols such as LLDP or using a separately defined message.

On the other hand, among the network devices providing the SDN controller 100 with a list of the security functions supported by the user in step S610, the network devices, which are instructed to apply the security function by the step S620, And is the network device selected as the terminating network device for traffic in the terminal path. That is, the network device not selected as the terminal network device does not advance from step S610 to step S620. Thus, a network device performing the method illustrated in FIG. 6 refers to a network device selected as an end-to-end network device for the end-to-end path of interest.

In step S620, the network device selected as the end-point network device for the target terminal-to-terminal path applies the indicated security function to the traffic on the corresponding terminal-to-terminal path in operation S630.

At this time, the application of the security function according to the step S630 can be continuously performed until the SDN controller 100 grasps the necessity of changing the security function to be applied or recognizes the necessity of changing the terminal network device (S640).

For example, the SDN controller 100 may determine the necessity of changing the end network device or the security function (S640). For example, when an error occurs in the network device operating as the end network device, when the operation is stopped, when the load of the end network device becomes large, when the security function requirement level of the terminal (or user) And a change of the terminal network device is required.

In this case, the SDN controller 100 proceeds from step S610 to collect the security function list of the network devices belonging to the SDN environment managed by the SDN controller 100, or if the security function list is already collected periodically, (S620) to determine the applied security function again.

The methods according to the present invention can be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium (memory or storage means). The computer readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer readable medium may be those specially designed and constructed for the present invention or may be available to those skilled in the computer software.

Examples of computer readable media include hardware devices that are specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate with at least one software module to perform the operations of the present invention, and vice versa. Accordingly, the methods according to the present invention may be performed by a network device having a computer-readable medium (memory or storage means) or at least one SDN controller in which at least one processor and methods according to the present invention are stored .

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims It can be understood that

10, 40: terminal
11-14, 31-34: Router or switch
20, 30: Gateway
100: SDN controller
220, 230: List of security functions
320, 330: Security function indication

Claims (20)

A security function processing method of an SDN controller for applying a security function to a terminal-to-terminal path in a Software-Defined Network (SDN) environment,
Receiving a list of security functions supported by each network device from at least one network device constituting the SDN environment;
A security function that satisfies a security level required according to the security or service class of at least one of the terminals in the terminal-to-terminal path based on the list of the received security functions, Selecting network devices; And
And instructing the selected end-to-end network devices to apply the selected security function to the traffic on the terminal-to-terminal path. The method according to claim 1,
Wherein the list of security functions is received at the start of operation of each network device or periodically received during operation of each network device. The method according to claim 1,
Wherein the list of security functions is received using a Link Layer Discovery Protocol (LLDP) or received using a message defined between the SDN controller and the at least one network device. The method according to claim 1,
Wherein the at least one network device is a router, a switch, or a gateway device. The method according to claim 1,
Wherein the security function includes at least one of encryption and tunneling applied to traffic of the terminal-to-terminal path. The method according to claim 1,
A step of receiving a list of the security functions or a step of selecting a security function and the termination network devices when a change of the selected end network device or a change of the selected security function is required, Processing method. A method of processing a security function of a network device for applying a security function to a terminal-to-terminal path in a software-defined network (SDN) environment,
Transmitting a list of security functions supported by the network device to an SDN controller in the SDN environment;
Receiving from the SDN controller application of a security function satisfying a security level required according to a security or service class of at least one of the terminals in the terminal-to-terminal path; And
Performing a security function satisfying the required security level for the traffic on the terminal-to-terminal path as an end-point network device for the terminal-to-terminal path; . The method of claim 7,
Wherein the list of security functions is transmitted at the start of operation of the network device or periodically transmitted during operation of the network device. The method of claim 8,
Wherein the list of security functions is transmitted using a Link Layer Discovery Protocol (LLDP) or transmitted using a message defined between the SDN controller and the network device. The method of claim 8,
Wherein the network device is a router, a switch, or a gateway device. The method of claim 8,
Wherein the security function includes at least one of encryption and tunneling applied to traffic of the terminal-to-terminal path. The method of claim 8,
When the security function satisfying the required security level is required or when the role or status of the network device is changed, the step of transmitting the list of the security functions or the step of instructing the application of the security function again A method for processing a security function of a network device, the method comprising: A method for applying a security function to a terminal-to-terminal path in a software-defined network (SDN) environment,
Transmitting at least one network device a list of security functions supported by each network device to an SDN controller;
Wherein the SDN controller provides a security function that satisfies a security level required according to a security or service class of at least one of terminals of the terminal-to-terminal path among the at least one network devices, Selecting end-to-end network devices;
The SDN controller instructing the selected end-to-end network devices to apply the selected security function to traffic of the terminal-to-terminal path; And
Wherein the network device selected as the end-point network device applies the security function instructed by the application to the traffic of the terminal-to-terminal path. 14. The method of claim 13,
Wherein the list of security functions is transmitted to the SDN controller at the start of operation of the at least one network device or periodically transmitted to the SDN controller during operation of the at least one network device, And transmitted to the SDN controller. 14. The method of claim 13,
Wherein the list of security functions is transmitted using a Link Layer Discovery Protocol (LLDP) or transmitted using a message defined between the SDN controller and the at least one network device. 14. The method of claim 13,
Wherein the at least one network device is a router, a switch, or a gateway device. 14. The method of claim 13,
Wherein the security function includes at least one of encryption and tunneling applied to traffic of the terminal-to-terminal path. 14. The method of claim 13,
If a change of the selected end-point network device or a change of the selected security function is required, the step of transmitting the list of the security functions to the SDN controller or the security function processing of the SDN Way. 19. The method of claim 18,
And when it is necessary to change the selected terminating network device, the security function processing of the SDN, which is at least one of a case where an error occurs in a network device operating as the selected terminating network device, Way. 19. The method of claim 18,
Wherein when a change of the selected security function is required, a security functional requirement level of at least one terminal in the terminal-to-terminal path is changed.

Images