TWI730925B - Time management system based on software defined network and method thereof - Google Patents

Abstract

The present invention is a time management system based on a software-defined network and method thereof. A network controller predefines the time range of network access in a service and defines information of legal terminal equipment through a network controller, thereby the network controller controls the network access time of legal terminal equipment. The network controller also provides network access that can be combined with an external authentication mechanism outside of the control time, so as to meet the demand for network access in non-time control. In the present invention, the network controller is used to control the rules on the network switch to limit the network access time of legal terminal equipment, it can be effectively limit the network access time and management control mechanism of legal terminal equipment, and combine the authentication mechanism to increase network security in the control domain.

Description

Network time management system and method based on software-defined network

The present invention relates to the technology of network time management, in particular to a network time management system and method based on a software-defined network.

When it comes to network security management and control, in the current complex information security environment, it is often difficult to define the aspects of network security, but from a technical point of view, network time management is currently the most direct network. One of the safety management methods. For enterprises, the common threat comes from Trojan horses or malicious programs that may be brought by users connecting to the Internet, and the other is a device brought by users themselves, causing the same virus threat. However, in either case, if The introduction of time management and control over the network usage of the equipment will reduce the threat of the corporate intranet.

In a prior art, the patent of Taiwan Patent No. I353137 "Internet Connection Time Management Method and System" discloses that when a client requests to obtain a connection, the client’s identity data is used to capture the preset restricted Internet time period. And compare the current requested connection time with the pre-stored time management connection restriction time period to confirm whether the current time falls within the restricted time period. If it is, the client is restricted from accessing the Internet. Otherwise, the client is allowed to go online. Periodically monitor whether the connection time of the connected client has reached or exceeded the restricted period, and then automatically decide to restrict or open the Internet. The time management mechanism of the case is divided into three Types: immediate restriction, immediate access to the Internet, and time setting. However, this mechanism is managed with an Internet service provider (ISP) account. Compared with the corporate network, it is Ethernet Plug-and-Play (Ethernet Plug-and-Play). n-Play) feature, this time management mechanism cannot be applied to the corporate local area network; in addition, the network control method of this mechanism is to discard the "destination" IP address belonging to the user's packet that is forbidden to access the Internet, so as to achieve the purpose of unable to use the network However, this method cannot immediately discard the packets with the "source" IP address belonging to users who want to prohibit Internet access, resulting in many invalid "source" IP address packets on the network, occupying network bandwidth resources.

For the time management and control of mobile terminals, another prior art proposes a patent (CN103825898A) for "Management and Control of Internet Time of Mobile Terminals", in which the administrator opens a user account and password on the service platform, and sets the Internet time and time based on the user account. The control strategy includes the time period when the Internet is allowed and the time when the Internet is allowed. An application for online time control needs to be installed on the controlled mobile terminal, and the user account and password are required to be authenticated with the service platform. If the identity is legal, then Start the application so that the mobile terminal can use the Internet. The application determines in real time that the Internet access time of the mobile terminal has expired. If so, the Internet access function of the mobile terminal is controlled to be in a dormant state. However, the above method must install software on the terminal. With a large number of terminals or frequent changes, software installation becomes complicated and difficult to manage, and it is easy to cause inconvenience to users.

In yet another prior art, Taiwan Patent No. I259371 "Time Management System and Method" patent uses time to control the use time of information equipment to improve the confidentiality of information equipment. The system includes a security verification module and a Set up a management module and a control execution module. The method is to create a usage time setting program inside the information equipment, so that managers with usage rights can set the usage time of the information equipment through the setting program, so that the information equipment can be based on The set time determines the open permission, so that it will automatically shut down when it exceeds the set use time range, so as to achieve the effect of limiting the use time of information equipment and preventing the internal storage of data from being easily peeked. However, the above-mentioned time management The method is still to install software on the information equipment, and you will also face the need to change the client device to perform time management. In addition, if you want to change the time setting, there is no unified management mechanism, and you must log in one by one to set it up. It would be very inconvenient.

In view of this, how to provide a network time management technology, if it can be controlled from the source device IP address, it can also avoid many invalid packets on the network and affect the network, especially, it does not need to be on the user equipment Any software can be installed at the end to achieve the purpose of network management, which will become a goal pursued by those skilled in the art.

In order to solve the above-mentioned problems in the prior art, the present invention proposes a software-defined network-based network time management method, which includes: creating a subnet in a network controller, setting a network service gateway, and setting a network time And time-out connection service information; when the terminal device is connected to the network controller, the network controller will enable the terminal device based on the information of the subnet, and set the network transmission rule to The network switch is used for the terminal device to use the networking function; and the network controller is made to detect according to the network time, so that the terminal device can use the terminal device normally when the terminal device is within the network time. Networking function, and when the terminal device is outside the network time and the timeout network service is provided, the network access control system executes timeout processing.

In one embodiment, the steps of creating a subnet in the network controller, setting the network service gateway, and setting the information of the connection time and the timeout connection service include the following sub-steps: setting the The range of the terminal equipment under the control of the network controller becomes the subnet; according to the service gateway that the terminal device needs to connect to, set the subnet to connect to the service gateway in the network controller And the parameters connected to the service gateway; create a network time service cluster, a timeout network service cluster, and the network An access control system and a set of permanent connection service clusters, wherein the network access control system is used to manage and control the connection function authentication of the terminal device; and set the time period of the connection time and the timeout connection service The usage time of the network and the network and authentication system accessed by the network access control system.

In one embodiment, the step of enabling the terminal device by the network controller based on the information of the subnet includes the following sub-steps: importing the terminal device data or automatically detecting the terminal device. The terminal device joins the service cluster created when the subnet is created; and based on the service cluster that each terminal device joins and the parameters and ports of the service gateway, the network controller is made based on the service that the terminal device joins The cluster opens the network service of the terminal device and generates the corresponding network transmission rule to set the network transmission rule in the network switch.

In one embodiment, the step of detecting by the network controller according to the connection time includes making the network controller periodically check whether the current time is within the set connection time, so that the current time is within the connection time. During the network time, it is further determined whether the service has been activated, and if the current time is not within the network time, the timeout process is executed.

In one embodiment, the step of determining whether the service has been activated includes: enabling the network controller to determine whether the terminal device in the network time service cluster has been activated and passed the service, and if it has passed, continuously and periodically checking whether the service has expired, If it is not activated, the service activation of the terminal device will be performed.

In one embodiment, the step of executing timeout processing by the network access control system includes: when the network controller is configured with the network access control system and the timeout networking service, the terminal device Connect to the network access control system to be authenticated by the network access control system; and after the terminal device is successfully authenticated, enable the network controller to enable the terminal device's network connection function, and periodically check Whether to reach the timeout connection time.

In the above embodiment, the step of making the terminal device connect to the network access control system to be authenticated by the network access control system includes the following sub-steps: making the network controller clear the terminal device The network transmission rules located in the network switch; and the network controller is configured to connect to the network access control in the network switch based on the additional services set when the subnet is created The network transmission rules of the system, so that the terminal device can only connect to the network access control system for authentication.

In the above embodiment, the step of enabling the network controller to enable the terminal device's networking function includes the following sub-steps: enabling the network controller to add the terminal devices that have passed authentication to the timeout networking service cluster and enable Service, to generate a timeout network transmission rule for the terminal device that passed the authentication to connect to the service gateway, and transmit the timeout network transmission rule to the network switch, so that the terminal device that passed the authentication Use the network function normally during the timeout service time; and enable the network controller to continuously detect the timeout period of the terminal equipment in the timeout network service cluster, so as to enable the authentication within the use time The passed terminal device continues to use the networking function, and after the time is up, the network controller removes the timeout network transmission rule of the authenticated terminal device.

In the above method, it also includes using a network traffic detection tool to detect the port of the network switch, so that when the terminal device continues to send more than a predetermined number of packets outside the network time or the overtime network service , Determine that the terminal device is abnormal.

The present invention further proposes a network time management system based on a software-defined network, which includes: a server, which is used to store information about the connection time and overtime connection service of terminal equipment; and a network switch, which is used for Transmit packets; the physical controller is used to set the network transmission rules to the network switch, and the physical controller has a timer for periodically checking the time; and the network access control system is used When the terminal device is outside the network time and the timeout network service is set, the terminal is executed The network authentication of the terminal device, where the timer is used to confirm whether the current time is within the network time, so that when the current time is within the network time, the packet sent by the terminal device is sent to the network switch through the network switch The service gateway and the response packet returned by the service gateway are received through the network switch, and when the current time is outside the network time and the timeout network service is set up, through the network The access control system performs authentication to record the new network transmission rules on the server and update the original network transmission rules in the network switch so that the packets sent by the terminal device are sent by the network switch Transmit.

In summary, the present invention is a way to control and manage network access time using a software-defined network architecture. It focuses on uniformly controlling the network access time of legal terminal devices under the network switch through a network controller. After the network access time is exceeded, the use of the network function will be stopped, and the external authentication mechanism will be combined to meet the network requirements outside the network access time. In addition, it will be used as a software-defined network architecture to control and manage the network access time. , You can define multiple sets of different network access time ranges or define services without time management, and add legal terminal devices with different network access time requirements to different services, and effectively control through the network The device manages legal terminal devices with different access time requirements, which increases the convenience and flexibility of network control for network administrators to control the network access time of different terminal devices. In addition, the network time management system and method based on the software-defined network disclosed in the present invention utilize the characteristics of the software-defined network to centrally manage the network activation time of the equipment, and there is no need to install any software on the user equipment. , The purpose of network management can be achieved. Furthermore, the time management method of the present invention is to manage and control from the source device IP address, and will not cause many invalid packets on the network to affect the network.

11-15: Stage

111-114: Process

121-122: Process

131-132: Process

141-142: Process

151-153: Process

211-216: Process

311-319: Process

31: network manager

32, 42: network controller

33, 43: terminal equipment

34, 44: network switch

35, 45: service gateway

36, 46: Network access control system

321, 421: Timer

322, 422: Server

S11-S13: steps

Fig. 1 is a step diagram of the network time management method based on software-defined network of the present invention.

FIG. 2 is a time sequence flow chart of the software-defined network-based network time management method of the present invention.

3 is a schematic diagram of the network time management and activation process of the software-defined network-based network time management system and method of the present invention.

FIG. 4 is a schematic diagram of the out-of-time control and activation process of the software-defined network-based network time management system and method of the present invention.

Fig. 5 is a structural diagram of the network time management system based on the software-defined network of the present invention.

The following describes the technical content of the present invention with specific specific embodiments. Those familiar with the art can easily understand the advantages and effects of the present invention from the content disclosed in this specification. However, the present invention can also be implemented or applied by other different specific embodiments.

There is no concept of time management and control in traditional switch equipment, and it is more difficult to manage and control in a unified way, and there is no dynamic opening and blocking of terminal equipment. The present invention is based on the network controller to define various services with different access times to provide different needs Users of, can give different users dynamic network access time for operating legal terminal equipment according to user-defined services, and can be additionally set and combined with external authentication mechanisms to meet network access requirements during uncontrolled hours .

Fig. 1 is a step diagram of the network time management method based on software-defined network of the present invention. The present invention proposes a network time management method for centralized management and control of terminal equipment networking functions. According to the needs of network managers, subnets and network time management rules are set in the network controller to restrict normal networking Function time, and can set the network access control system authentication as required, so that the authentication device can use the network function outside the time.

In step S11, create a subnet in the network controller, set up a network service gateway, and set up information about the connection time and the timeout connection service. In this step, it can be regarded as the stage of creating a subnet. The network administrator creates the subnet in the network controller, and sets the network service gateway and configures additional services and related time settings.

In one embodiment, step S11 further includes the following steps: setting the range of the terminal device under the control of the network controller to become the subnet; according to the service gateway that the terminal device needs to connect to, in the network Set the parameters of the subnet connected to the service gateway and the service gateway in the controller; create a network time service cluster, a timeout network service cluster, the network access control system, and set permanent Networking service cluster, in which the network access control system is used to manage and control the network function authentication of the terminal device; and set the network time period, the use time of the overtime network service, and the network Access control system access to the network and authentication system.

In step S12, when the terminal device is connected, the network controller is made to activate the terminal device according to the information of the subnet, and the network transmission rule is set to the network switch for the terminal device to use Networking function. In this step, it can be regarded as the terminal device activation stage. When the terminal device is connected, the network controller will activate the terminal device according to the applied subnet, and set the network transmission rule to the network switch for the terminal The device uses the networking function.

In one embodiment, step S12 further includes the following steps: import the terminal device data or automatically detect the terminal device to join the service cluster created when the subnet is created; and based on each terminal The service cluster that the device joins and the parameters and ports of the service gateway enable the network controller to enable the terminal device’s network service based on the service cluster that the terminal device joins, and generate corresponding network transmission rules to Set the network transmission rule in the network switch.

In step S13, the network controller is made to perform detection based on the network connection time, so that when the terminal device is within the network connection time, the terminal device can use the network function normally, and the terminal device is in the connection time. When the network time is outside and the timeout service is set up, the network access control system will execute the timeout process. In this step, it can be regarded as the time detection stage. The network controller will perform the detection based on the connection time. If the connection function can be used normally within the time, if the time exceeds the connection time, it will perform a timeout process.

In one embodiment, step S13 further includes the following steps: the network controller periodically checks whether the current time is within the set network time, and when the current time is within the network time, it further determines whether it is enabled Service, and if the current time is not within the networking time, the timeout process is executed. In addition, the aforementioned method of determining whether the service has been activated is to make the network controller determine whether the terminal device in the network time service cluster has activated the service. If it has passed, it will continue to periodically check whether the service has expired, and if it is not activated, Then proceed to the service activation of the terminal device.

Regarding the steps of performing timeout processing by the aforementioned network access control system, it includes: when the network controller is configured with the network access control system and the timeout connection service, the terminal device is connected to the The network access control system is authenticated by the network access control system, and after the terminal device is successfully authenticated, the network controller is enabled to enable the network connection function of the terminal device, and periodically checks whether the timeout is reached Network time. In short, the above can be regarded as the timeout processing phase and the timeout activation phase. The network controller will depend on whether the network access control system and the timeout connection service are set. If there is a setting, the terminal device will be used to connect to the network. The network transmission rules of the access control system, that is, the terminal device must be authenticated by the access control system to use the networking function. Then, after the terminal device is successfully authenticated, the network controller will enable the terminal device networking function, and Regularly check whether the timeout connection time has elapsed.

The foregoing step of enabling the terminal device to connect to the network access control system for authentication by the network access control system includes: the network controller clears that the terminal device is located on the network access control system The network transmission rules of the switch; and the network controller sets the network transmission connected to the network access control system in the network switch according to the additional services set when the subnet is created Rules so that the terminal device can only connect to the network access control system for authentication.

The aforementioned step of enabling the network controller to enable the terminal device's networking function includes: the network controller adds the certified terminal device to the timeout networking service cluster and activates the service to generate the certified terminal The device is connected to the timeout network transmission rule of the service gateway, and the timeout network transmission rule is transmitted to the network switch, so that the terminal device that has passed the authentication will be connected to the service for the timeout period The network function is normally used within the network; and the network controller continuously detects the timeout period of the terminal equipment in the timeout network service cluster, so that the terminal equipment that has passed the certification can continue to use the network function within the use time , And after the time is up, the network controller removes the timeout network transmission rule of the terminal device that has passed the authentication.

The present invention can set the scope of jurisdiction and required service functions and service time through the creation of the sub-network stage, and in the terminal device activation stage, the terminal equipment in the jurisdiction can be imported or automatically detected to the corresponding In the service cluster, the terminal device starts to detect whether the set time has been exceeded during the activation phase. If it exceeds the timeout processing phase, the terminal device cannot use the network function or can only connect to the network access control system for authentication, and the timeout is activated. At this stage, the authenticated terminal device networking function will be opened to help network administrators to efficiently manage terminal devices and increase network security.

The following specific examples illustrate the present invention. The present invention is a network time management system and method based on software-defined network, centralized management and control of terminal equipment networking functions, which can set the subnet and network time in the network controller according to the network manager Management system, the terminal devices in this subnet setting can use the networking function normally according to the time set by the network time management system, and will be stopped using the networking function beyond the time set by the network time management system. This network time management The management system and its method can integrate the network access control system. If the user needs to use the network function outside the time set by the network time management system, the network controller can be authenticated by the network access control system. Then open the terminal equipment networking function service and record the log.

Figure 2 is a time sequence flow chart of the software-defined network-based network time management method of the present invention. As shown in the figure, the system process of the present invention is mainly divided into five stages, namely the creation of sub-network stage 11, terminal equipment The opening phase 12, the time detection phase 13, the timeout processing phase 14, and the timeout opening phase 15.

In the creation of the subnet stage 11, the network administrator sets up the network time management system for the subnet and various services according to the network segment and terminal equipment under the jurisdiction of the network controller, which includes the process 111 Create a subnet, set the external service gateway in the process 112, set the additional service in the process 113, and set the additional service content in the process 114.

First, in the process 111, the network administrator needs to create a subnet in the network controller, and the network administrator needs to set the range of terminal equipment under jurisdiction, including but not limited to IPv4 network segment, IPv6 network segment, and source network Switch ports and other ranges to set the subnet, and when terminal devices within the set range join the network, the subnet that matches the setting will be added. Then, in the process 112, the network administrator sets the external service gateway connected to this subnet in the network controller, and can set the parameters for connecting to this service gateway, including but not limited to VLAN, network Switch port and other information, and remember the port location of the service gateway. After that, in the process 113, the network administrator creates a network time service cluster, and can also choose to create a timeout network service cluster and a network access control system, so that the terminal devices under control can use the network function through authentication In addition, you can also set up a permanent network service cluster, add terminal devices that do not need to be controlled, and permanently use the network function. Finally, in the process 114, the network administrator sets the network time management at this stage, and sets the time period of the network time service. If there is a timeout connection in the process 113, The network service and the network access control system must also be set together with the use time of the overtime network service, and the network and authentication system accessed by the network access control system.

After completing the subnet creation phase 11, it will enter the terminal device activation phase 12. The network administrator starts to use the import or detection method to add the terminal devices under the jurisdiction to the subnet, and select each terminal device to be added to the service separately After the clustering, the network controller downloads the network transmission rules to the network switch to achieve the terminal device networking function, including the terminal device in the process 121 into the subnet and the process 122 to activate the service function. In short, in the process 121, the network administrator will import the terminal device data or the subnet set in the subnet creation stage 11 through automatic detection, and join the service cluster created in the subnet creation stage 11 After that, in the process 122, the network controller adds the parameters and ports of the service gateway set in the subnet stage 11 according to the service cluster that each terminal device joins, and the network controller joins according to the terminal device The service cluster opens the network service and generates the corresponding network transmission rules, and sets the network transmission rules in the network switch, so that the terminal devices that apply the service cluster can use the network function normally, if there is a setting of the network time For service clusters, it is necessary to enter the time detection stage 13 for time management judgment. If only the permanent connection service cluster is set, there is no need to enter the time detection stage 13 to permanently enable the connection function.

In the time detection phase 13, the network controller will start to detect the status of the connection time service cluster according to the connection time set in the subnet creation phase 11, which includes whether the detection of the process 131 has timed out and the judgment of the process 132 Whether the service has been activated. In short, in process 131, the network controller will periodically check whether the current time is within the network time service set by the network administrator based on the normal network time set by the network time service in the subnet creation phase 11. During the connection time, if the current time is within the connection time of the connection time service, the process 132 is entered; otherwise, the timeout processing stage 14 is entered. In the process 132 of determining whether the service has been activated, the network controller will Determine the terminal in this network time service cluster Whether the device has been opened and passed the service, if it has been opened, return to the process 131 and continue to determine whether it is within the time limit, if it has not been opened, then return to the process 122 of the terminal device provisioning stage 12.

When the time exceeds the network time, it will enter the timeout processing stage 14. The network controller will need to process the network transmission rules of the terminal device because the time has exceeded the time set by the network time service, which includes the process 141 Cut off the network function and the additional service processing and authentication of the process 142. In the process 141, because the network controller has been set up in the subnet stage 11 of the establishment of the network time, the network controller according to the terminal device information in the network time service cluster, clear the above-mentioned terminal device is located in the network switch network At this time, all the terminal devices in the service cluster will cut off the network function during the network time. If the network administrator has set up additional services (such as timeout connection) during the creation of the subnet stage 11, It will enter the process 142, the network controller will set up the additional services in the subnet creation phase 11, and set the network transmission rules (ie timeout network transmission rules) connected to the network access control system, and the terminal device will try When using the network connection function, you can only connect to the network access control system authentication. If the authentication is unsuccessful, it will go back to the time detection stage 13 to determine whether the time is within the network time and then open the network. If the authentication is successful, go to Overtime opening phase 15.

In the timeout activation phase 15, the network controller will set the network transmission rules according to the timeout connection service set in the subnet creation phase 11, and remove the corresponding network transmission after the timeout of the timeout service setting. Rules, which include the activation of the timeout networking service in the process 151, the detection of whether the process 152 is within the timeout valid time limit, and the clearing of the timeout networking function in the process 153. In the process 151, after the authentication is successful in the timeout processing stage 14, the network controller will add the authenticated terminal devices to the timeout networking service cluster according to the information from the network access control system and activate the service, and generate the authentication The successful terminal device is connected to the service gateway's timeout network transmission rule to the network switch, so that the terminal device can use the network function normally within the time set for the timeout connection, and then in the process 152, the network The controller continuously detects the timeout time of the terminal equipment in the timeout network service cluster. If it is within the use time, you can continue to use the network function. If the time is up, the process 153 is entered, and the network controller will remove the timeout network transmission rule of the terminal device. At this time, the terminal device will cut off the network function and return to the time detection stage 13.

Figure 3 is a schematic diagram of the network time management and activation process of the software-defined network-based network time management system and method of the present invention, illustrating the sub-network setting and activation process. As shown in the figure, first, in the process 211, the network manager 31 sets the subnet, the service used, the network time management system and the network controller 32 according to the network segment and terminal equipment under the jurisdiction of the network controller 32. After the network access control system, in process 212, the network controller 32 sets the network transmission rules to the network switch based on the terminal device 33 activation data imported by the network manager 31, and in process 213, when When the terminal device 33 is connected to the network, it passes through the network switch 34. In the process 214, the network switch 34 will send the packet to the service gateway 35 according to the network transmission rules. In the process 215, the service gateway 35 returns the response packet to the network switch 34. Finally, in the process 216, the response packet is sent back to the terminal device 33 in accordance with the network transmission rules set by the activation, so that the terminal device 33 can be normal Use the networking function.

Since there is no concept of time management and control in traditional switch equipment, the present invention can record network access time information in the network controller 32 through a software-defined network architecture. The network controller 32 classifies different legal The terminal device 33 performs time management and control, and since a single network controller 32 can control all network switches 34 under the software-defined network architecture, the network administrator 31 can conveniently and flexibly control any legal terminal device 33 access capacity and time.

4 is a schematic diagram of the out-of-time control and activation process of the software-defined network-based network time management system and method of the present invention, illustrating the overtime activation process of the network access control system. As shown in the figure, in the process 311, the timer 321 inside the network controller 32 will periodically check the time. If the time has exceeded the network connection time, the process 312 is entered, that is, the network controller 32 needs to be removed. Network transmission rules during connection time, then in process 313, the network controller 32 will remove the network switch according to the setting The network transmission rule of the network time of 34 and the network transmission rule of the network access control system 36 are set. Then, in the process 314, when the terminal device 33 uses the network function at this time, the process 315 is entered. The network switch 34 will send the packet to the network access control system 36. If the authentication is successful, it will enter the process 316. The network access control system 36 will send the terminal equipment 33 information to the network controller 32. The physical server 322 stores, and the network controller 32 generates a network transmission rule for the terminal device 33 to connect to the service gateway 35 based on the terminal device 33 activated by the network access control system 36, and sets it in the network switch In the device 34, after the terminal device 33 uses the networking function, that is, the process 318, the network switch 34 will send the packet to the service gateway 35, that is, the process 319, and the terminal device 33 can use the network function normally. .

The purpose of the present invention is to use the user’s legal terminal equipment as a time decentralized management and control mechanism, and define the network access time of different users according to the network administrator, and the network access time can be required outside the network access time according to the usage requirements. When there are additional networking requirements, time control access can be combined with the authentication mechanism to facilitate recording of the user's connection time. In addition, general passive network devices or Internet of Things (IoT) devices can be used with services without time management , So that such devices are not restricted by the time of network access.

The network controller 32 pre-sets the service content of the network access time, and adds the legal terminal device 33 to this service. After the addition, the network controller 32 will periodically check whether the current time is set by the network administrator 31 The network time service is within the network time. If it is within the time, no processing is performed. If the time is exceeded, the network disconnection function will be triggered through the network controller 32, and the blocking rule will be sent to the network switch 34 for connection The terminal device 33 that is blocked by the network cannot access the network. If the service to which the legal terminal device 33 has joined provides an external authentication mechanism, the user can enter the authentication through the web page and then log in to the network. The router controller 32 transmits the rules for enabling the legal terminal device to the network switch 34. Therefore, the network administrator 31 only needs to operate the network controller 32 to control the legal terminal device 33 under the global network architecture. And through the software-defined network architecture to control and manage network access time to provide network security and convenience.

Fig. 5 is a structural diagram of the network time management system based on the software-defined network of the present invention. As shown in the figure, the network time management system includes the server 422 and the network controller 42 of the timer 421, the network switch 44 is connected to the server 422, the terminal device 43, the service gateway 45 and the network access Control system 46, server 422 is a schematic diagram of a software-defined network (SDN) controller, including software and hardware, and is not limited to a hardware server. The network switch 44 is a schematic diagram of an SDN switch, including software and hardware. Anything, not limited to hardware switches, this system can be generalized to multiple SDN switch architectures, and the terminal device 43 is not limited to software and hardware, and can be generalized to multiple terminal device architectures.

The server 422 will set the corresponding network transmission rules to the network switch 44 according to the network connection, timeout service and other information set by the network administrator, and cooperate with the timer 421 to periodically check the time, and set the corresponding network transmission rules to the network switch 44. The switch 44 serves as a packet transmission function. The terminal device 43 can send packets to the service gateway 45 during the network time. If the timeout service is set outside the network time, it can only be connected to the network access control The system 46 performs authentication, and after authentication, it records on the server 422 and updates the network transmission rules of the network switch 44 so that the terminal device 43 can send packets to the service gateway 45. The detailed operation steps and processes are As described in the previous method.

The design of the present invention focuses on the centralized management of terminal equipment and the setting of a network time management system to control the network connection function of the terminal equipment, and can cooperate with the network controller supporting the same method to set the subnet to form a multi-domain terminal equipment Network time management system, and according to the network time management system set by the network administrator, the terminal equipment normally uses the network function in the network time management, and the network time management is based on whether there is an additional timeout and authentication The service implements the functions set by the network administrator. This method can enable the network administrator to more effectively manage the terminal equipment and increase network security.

The present invention can be applied to several different terminal devices for network administrators to set up, such as workplaces. When network administrators set up the network time management system, they can vary according to different terminal devices. The time setting requirements of the general worker terminal equipment need to meet the network time management function. The network administrator can create a network time service cluster in the subnet, and set the normal working network time, and use the general worker terminal equipment Join the network time service cluster, which is only allowed to use the network function during working hours. Passive terminal devices, including but not limited to access control card readers and other IoT terminal devices, need to be able to use the network function at any time. Therefore, set the permanent connection Network service cluster, terminal devices that join this service cluster can use the networking function at any time, and IoT terminal devices such as access control card readers can be added to the permanent network service cluster. If the general worker needs to work overtime, the terminal device needs to use the networking function outside the time set by the networking time service cluster. The network administrator can set the network access control system and the timeout networking service cluster in the subnet. Function, and set the network usage time of the timeout network service cluster, and the network and authentication system that the network access control can access. If the general worker needs to use the network function after the time set by the network time service cluster, only the network access control system is allowed. If the system is authenticated, the log will be recorded in the network controller and the user terminal The device joins the timeout connection service cluster, and the connection function can be used normally during the usage time. After the set time expires, the terminal device will be removed from the timeout connection service cluster and the connection function will be cut off. It needs to be accessed again on the network Control system authentication or wait for the time set by the network time service cluster to return to normal use of the network function. This function can be widely used in school or company networks, so that ordinary users can only use the network function within the set time of the network time service cluster. If you need to use the network function outside the set time of the network time service cluster, you need to go through the network. The access control system can only be used after obtaining the authentication, and will record a log in the network controller for the network administrator to confirm the identity, effectively manage the terminal equipment and increase network security. General passive terminal equipment including but not limited to access control systems, projectors, etc. are added to the permanent network service cluster.

In addition to using the network time management system method to achieve control of the terminal equipment, the present invention can also be used to detect whether the control network terminal equipment has an abnormal state. Control terminal equipment in the network time service After the time set by the service cluster, use the network traffic detection tool to detect through the port of the network switch. If the terminal device continues to send a large number of packets outside the management time, the network administrator can To confirm whether this terminal device is abnormal, or whether illegal users try to use the network function outside of time, or even intend to attack other terminal devices or network systems such as distributed blocking services, the network administrator can deal with it and solve it in time The terminal equipment problem or the illegal use of terminal equipment is detected.

The core of the method of the present invention lies in the management of the network connection function of the terminal equipment. By setting the normal network time service cluster, the terminal equipment that joins the service cluster can only use the network function normally during the time set by the network time service cluster. You must be approved by the network administrator to use the networking function, otherwise you will have to wait until the next normal networking time is up before you can use the networking function again, and you can set the network access control system and timeout networking services.

The implementation of the present invention is based on a software-defined network architecture, using the programmable characteristics of the software-defined network architecture and the characteristics of the network controller to centrally manage the network switch, which is set by the network controller according to the network administrator The service and network time management system manages its terminal equipment and network controllers to effectively manage terminal equipment and increase network security to meet the needs of terminal equipment control.

In summary, the present invention is a network time management system and method based on a software-defined network that centrally manage and control the networking functions of terminal equipment. Compared with the prior art, it has the following advantages: (1) The present invention It does not need to be bound to the ISP system and can be applied to the corporate local area network. (2) The present invention does not need to install software on the terminal, but only needs the network administrator to set related services on the network controller, and the terminal equipment can be controlled. (3) Compared with the prior art, which still installs software on information equipment and does not have a unified management mechanism, the present invention only needs to operate the network controller to modify the relevant functions of the time management system. (4) The present invention can give different users the network access time for operating legal terminal equipment dynamically according to the user-defined service, and can be additionally set and combined with an external authentication mechanism to achieve network access during uncontrolled time need begging. (5) The present invention is based on the network time management system set by the network administrator. The terminal device normally uses the networking function in the network time management, and outside the network time management, it depends on whether there are additional services of timeout and authentication. Implement the function set by the network administrator, this method can enable the network administrator to more effectively manage the terminal equipment and increase network security.

The above-mentioned embodiments are only illustrative descriptions, and are not used to limit the present invention. Anyone who is familiar with this technique can modify and change the above-mentioned embodiments without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the rights of the present invention is defined by the scope of the patent application attached to the present invention. As long as it does not affect the effect and implementation purpose of the present invention, it should be covered in the technical content of this disclosure.

S11-S13: steps

Claims (9)

A software-defined network-based network time management method, which includes: creating a subnet in a network controller, setting a network service gateway, and setting information about the connection time and timeout connection service; in the terminal When the device is connected with the network controller, the network controller will enable the terminal device according to the information of the subnet, and set the network transmission rule to the network switch for the terminal device to use Networking function, where the steps of opening include importing the terminal device data or automatically detecting the terminal device to join the service cluster created when the subnet is created, and adding each terminal device based on The service cluster and the parameters and ports of the service gateway enable the network controller to activate the terminal device’s network service based on the service cluster that the terminal device joins, and generate corresponding network transmission rules to set the The network transmission rule is in the network switch; and the network controller is made to detect according to the network time, so that the terminal device can use the network function normally when the terminal device is within the network time , And when the terminal device is outside the network time and the timeout network service is provided, the network access control system executes the timeout process. The software-defined network-based network time management method as described in claim 1, wherein the network controller is to create a subnet, set a network service gateway, and set a network time and a timeout connection The information step of the network service includes the following sub-steps: setting the range of the terminal device under the jurisdiction of the network controller to become the subnet; according to the service gateway that the terminal device needs to connect to, in the network Set the parameters of the subnet connected to the service gateway and connected to the service gateway in the router controller; create a network time service cluster, a timeout network service cluster, the network access control system and settings Permanent network service cluster, where the network access control system is used to control the network connection of the terminal device Functional authentication; and setting the time period of the connection time, the use time of the overtime connection service, and the network and authentication system accessed by the network access control system. The network time management method based on software-defined network as described in claim 1, wherein the step of the network controller detecting according to the network time includes making the network controller periodically check whether the current time is set During the network connection time, when the current time is within the network connection time, it is further determined whether the service has been activated, and if the current time is not within the network connection time, the timeout process is executed. The software-defined network-based network time management method according to claim 3, wherein the step of determining whether the service has been activated includes: enabling the network controller to determine whether the terminal device in the network time service cluster has been activated Through the service, if it has been passed, it will continue to periodically check whether it has timed out, and if it has not been activated, the service of the terminal device will be activated. The software-defined network-based network time management method according to claim 1, wherein the step of executing timeout processing by the network access control system includes: setting the network access in the network controller Under the control system and the time-out networking service, the terminal device is connected to the network access control system to be authenticated by the network access control system; and after the terminal device is successfully authenticated, the network The circuit controller activates the network connection function of the terminal device, and regularly detects whether the timeout connection time has been reached. The network time management method based on software-defined network according to claim 5, wherein the step of connecting the terminal device to the network access control system to be authenticated by the network access control system is It includes the following sub-steps: making the network controller clear the network transmission rule of the terminal device located in the network switch; And make the network controller set the network transmission rules connected to the network access control system in the network switch based on the additional services set when the subnet was created, so that the terminal device is only Can connect to the network access control system for authentication. The software-defined network-based network time management method according to claim 5, wherein the step of enabling the network controller to enable the network connection function of the terminal device includes the following sub-steps: making the network controller Add the authenticated terminal device to the timeout networking service cluster and activate the service to generate a timeout network transmission rule for the terminal device that has passed the authentication to connect to the service gateway, and then transmit the timeout network transmission rule To the network switch, to enable the terminal device that has passed the authentication to normally use the networking function within the timeout service time; and to make the network controller continue to detect the timeout connection service cluster The terminal device timeout period is to allow the terminal device that has passed the authentication to continue to use the networking function within the use time, and after the time is up, the network controller removes the overtime of the terminal device that has passed the authentication. Time network transmission rules. The network time management method based on software-defined network as described in claim 1, which further includes using a network traffic detection tool to detect the port of the network switch, so that the terminal device is in the network time or the timeout If there are still more than a predetermined number of packets that continue to be sent outside the network service, the terminal device is judged to be abnormal. A network time management system based on a software-defined network, which includes: a server, which is used to store the terminal equipment's network time and timeout service information; a network switch, which is used to transmit packets; and entity The controller is used to set the network transmission rules to the network switch, and the physical controller has a timer for periodically checking the time, wherein the physical controller is connected to the terminal device The terminal device is opened based on the information of the subnet when online, to import the terminal device data or automatically detect the terminal device to join the service cluster created when the subnet is created, and based on The parameters and ports of the service cluster and service gateway that each terminal device joins, so that the network controller activates the terminal device's network service based on the terminal device's joined service cluster, and generates the corresponding network transmission Rules to set the network transmission rules in the network switch; and a network access control system to execute when the terminal device is outside the network time and the timeout network service is set The network authentication of the terminal device, wherein the timer is used to confirm whether the current time is within the network time, so that when the current time is within the network time, the packet sent by the terminal device is transmitted through the network switch To the service gateway and receive the response packet returned by the service gateway through the network switch, and when the current time is outside the network time and the timeout network service is set up, through The network access control system performs authentication to record the new network transmission rules on the server and update the original network transmission rules in the network switch so that the packets sent by the terminal device are transmitted by the network Switch transmission.

Images