CN110839037A - Attack scene mining method and system for SDN network - Google Patents
Attack scene mining method and system for SDN network Download PDFInfo
- Publication number
- CN110839037A CN110839037A CN201911136058.8A CN201911136058A CN110839037A CN 110839037 A CN110839037 A CN 110839037A CN 201911136058 A CN201911136058 A CN 201911136058A CN 110839037 A CN110839037 A CN 110839037A
- Authority
- CN
- China
- Prior art keywords
- switch
- controller
- network
- trusted authority
- digital signature
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1458—Denial of Service
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides an attack scene mining method and system of an SDN (software defined network), wherein a secure encryption channel is established between a controller and a switch, a trusted authority CA (certificate authority) is added to authenticate and sign the controller and the switch, so that bidirectional authentication between the controller and the switch is realized, key negotiation is performed between the controller and the switch, and the purpose of improving SDN vulnerabilities in a targeted manner is realized; the attack scene can be mined without a prior template, and the attack scene can be more conveniently obtained by clustering the attack graphs of the same attack mode.
Description
Technical Field
The application relates to the technical field of network security, in particular to an attack scene mining method and system for an SDN.
Background
In the existing SDN, a TLS security channel is not forcibly established between a controller and a switch, and a default state is a non-open state, so that the network becomes vulnerable, clear text communication may occur between the controller and the switch, and any third party can intercept or modify communication contents of both parties and is easily attacked by a man-in-the-middle. Lack of authentication of the certificate between the controller and the switch makes it easy for an attacker to intercept the request sent by the controller to the switch, disguise that the controller is communicating with the switch, and thus obtain all the content of the communication between the switch and the controller.
Meanwhile, the existing attack scene mining needs a large amount of prior information aiming at the correlation process, but the cost for acquiring the large amount of prior information is very high.
Therefore, an attack scene mining method and system for pertinently improving the SDN are urgently needed.
Disclosure of Invention
The invention aims to provide an attack scene mining method and system of an SDN network, wherein a secure encryption channel is established between a controller and a switch, a trusted authority CA (certificate authority) is added to authenticate and sign the controller and the switch, so that bidirectional authentication between the controller and the switch is realized, key negotiation is performed between the controller and the switch, and the purpose of improving the SDN network vulnerability in a targeted manner is realized; the attack scene can be mined without a prior template, and the attack scene can be more conveniently obtained by clustering the attack graphs of the same attack mode.
In a first aspect, the present application provides an attack scenario mining method for an SDN network, where the method includes:
acquiring network flow data, and identifying the type of a network according to network characteristics;
when the network is identified to be the SDN network, a control instruction is issued to a controller and a switch, and the control instruction carries an identifier and an address of a trusted authority CA in the middle of the network;
the controller and the switch receive the control instruction and respectively send identity authentication requests to a trusted authority CA in the middle of the network, wherein the identity authentication requests carry respective public keys, user identity information and equipment identification of the controller and the switch;
the trusted authority CA receives the identity authentication request, queries a database according to the equipment identifier, judges whether the controller and the switch are legal, and returns a plaintext message and a digital signature certificate of the plaintext message by using a CA private key to the controller and the switch if the judgment result is legal; if the judgment result is illegal, the trusted authority CA returns a notice of authentication failure;
the controller and the switch receive the digital signature certificate sent by the trusted authority CA, the public key of the trusted authority CA is used for verifying the digital signature certificate, and if the verification is successful, the controller and the switch replace the digital signature certificate with respective identity information; if the verification is unsuccessful, the controller and the switch send a notice of authentication error to the trusted authority CA;
after the controller and the switch are successfully verified, the switch sends an encryption security connection request to the controller, wherein the encryption security connection request carries version information, a supported encryption algorithm and a first random number;
after receiving the encryption security connection request, the controller returns a response message to the switch, wherein the response message comprises a confirmed encryption algorithm, a randomly generated second random number and a digital signature certificate of the controller;
after the switch receives the response message, the switch verifies the digital signature certificate of the controller by using the public key of the trusted authority CA, if the verification is successful, a third random number is generated, the public key of the controller is used for encrypting the third random number, and the third random number and the digital signature certificate of the switch are sent to the controller;
after the controller receives the message sent by the switch, the public key of the trusted authority CA is used for verifying the digital signature certificate of the switch, if the verification is successful, the private key of the controller is used for decrypting the third random number ciphertext in the message, and the key agreement between the controller and the switch is completed;
the controller and the switch carry out encryption communication on the established encryption security connection by using the negotiated encryption algorithm and key;
judging whether DDos attack occurs between the controller and the current switch or not, and if the judgment result is true, generating a corresponding alarm log;
acquiring the quantity of Packet-in messages uploaded by at least one neighbor switch of the current switch, and calculating the rate of uploading the Packet-in messages; sequencing Packet-in message rates of the at least one neighbor switch, determining a neighbor switch with the minimum Packet-in message rate, and acquiring an identifier DPID of the neighbor switch with the minimum rate;
acquiring content, an input port and a path set of a network flow data packet according to a destination IP address, selecting a path meeting a preset condition from the path set according to an identification DPID and the input port of a neighbor switch, and issuing an updated flow rule to an attacked current switch according to the path;
waiting for a preset time interval, judging whether DDos attack occurs between the controller and the neighbor switch again, and if the judgment result is true, generating a new alarm log;
normalizing all alarm logs, removing redundant information to obtain combined alarm logs, and associating similar alarms based on attribute similarity to obtain a candidate attack graph set;
and calculating the internal characteristics of the attack graph, obtaining an attack graph set of the same attack scene based on characteristic clustering processing, and obtaining the attack scene through attack scene mining processing.
With reference to the first aspect, in a first possible implementation manner of the first aspect, the digital signature certificate employs a hash operation.
With reference to the first aspect, in a second possible implementation manner of the first aspect, the encryption algorithm includes any one of DES, MD5, and AES.
With reference to the first aspect, in a third possible implementation manner of the first aspect, the network intermediary trusted authority CA may be any one of a certificate server, a key server, and a digital certificate server.
In a second aspect, the present application provides an attack scenario mining system for an SDN network, the system including: the system comprises a gateway server, an analysis server, a trusted authority CA in the middle of a network, at least one SDN controller and at least one SDN switch;
the gateway server acquires network flow data and identifies the type of a network according to network characteristics;
when the network is identified to be the SDN network, issuing a control instruction to at least one controller and at least one switch, wherein the control instruction carries an identifier and an address of a trusted authority CA in the middle of the network;
the at least one controller and the at least one switch receive the control instruction and respectively send identity authentication requests to a trusted authority CA in the middle of the network, wherein the identity authentication requests carry respective public keys, user identity information and equipment identifications of the controller and the switch;
the trusted authority CA receives the identity authentication request, queries a database according to the equipment identification, judges whether the at least one controller and the at least one switch are legal or not, and returns a plaintext message and a digital signature certificate of the plaintext message by using a CA private key to the at least one controller and the at least one switch if the judgment result is legal; if the judgment result is illegal, the trusted authority CA returns a notice of authentication failure;
the at least one controller and the at least one switch receive the digital signature certificate sent by the trusted authority CA, the public key of the trusted authority CA is used for verifying the digital signature certificate, and if the verification is successful, the at least one controller and the at least one switch replace the digital signature certificate with respective identity information; if the verification is unsuccessful, the at least one controller and the at least one switch send a notification of authentication error to the trusted authority CA;
after the at least one controller and the at least one switch are successfully verified, the switch sends an encryption security connection request to the corresponding controller, wherein the encryption security connection request carries version information, a supported encryption algorithm and a first random number;
after receiving the encryption security connection request, the controller returns a response message to the switch, wherein the response message comprises a confirmed encryption algorithm, a randomly generated second random number and a digital signature certificate of the controller;
after the switch receives the response message, the switch verifies the digital signature certificate of the controller by using the public key of the trusted authority CA, if the verification is successful, a third random number is generated, the public key of the controller is used for encrypting the third random number, and the third random number and the digital signature certificate of the switch are sent to the controller;
after the controller receives the message sent by the switch, the public key of the trusted authority CA is used for verifying the digital signature certificate of the switch, if the verification is successful, the private key of the controller is used for decrypting the third random number ciphertext in the message, and the key agreement between the controller and the switch is completed;
the controller and the switch carry out encryption communication on the established encryption security connection by using the negotiated encryption algorithm and key;
the analysis server judges whether DDos attack occurs between the controller and the current switch or not, and if the judgment result is true, a corresponding alarm log is generated;
acquiring the quantity of Packet-in messages uploaded by at least one neighbor switch of the current switch, and calculating the rate of uploading the Packet-in messages; sequencing Packet-in message rates of the at least one neighbor switch, determining a neighbor switch with the minimum Packet-in message rate, and acquiring an identifier DPID of the neighbor switch with the minimum rate;
acquiring content, an input port and a path set of a network flow data packet according to a destination IP address, selecting a path meeting a preset condition from the path set according to an identification DPID and the input port of a neighbor switch, and issuing an updated flow rule to an attacked current switch according to the path;
waiting for a preset time interval, judging whether DDos attack occurs between the controller and the neighbor switch again, and if the judgment result is true, generating a new alarm log;
normalizing all alarm logs, removing redundant information to obtain combined alarm logs, and associating similar alarms based on attribute similarity to obtain a candidate attack graph set;
and calculating the internal characteristics of the attack graph, obtaining an attack graph set of the same attack scene based on characteristic clustering processing, and obtaining the attack scene through attack scene mining processing.
With reference to the second aspect, in a first possible implementation manner of the second aspect, the digital signature certificate employs a hash operation.
With reference to the second aspect, in a second possible implementation manner of the second aspect, the encryption algorithm includes any one of DES, MD5, and AES.
With reference to the second aspect, in a third possible implementation manner of the second aspect, the network intermediary trusted authority CA may be any one of a certificate server, a key server, and a digital certificate server.
The invention provides an attack scene mining method and system of an SDN (software defined network), wherein a secure encryption channel is established between a controller and a switch, a trusted authority CA (certificate authority) is added to authenticate and sign the controller and the switch, so that bidirectional authentication between the controller and the switch is realized, key negotiation is performed between the controller and the switch, and the purpose of improving SDN vulnerabilities in a targeted manner is realized; the attack scene can be mined without a prior template, and the attack scene can be more conveniently obtained by clustering the attack graphs of the same attack mode.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the embodiments will be briefly described below, and it is obvious for those skilled in the art that other drawings can be obtained according to these drawings without creative efforts.
Fig. 1 is a flowchart of an attack scenario mining method of an SDN network according to the present invention;
fig. 2 is an architecture diagram of an attack scene mining system of an SDN network according to the present invention.
Detailed Description
The preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, and the scope of the present invention will be more clearly and clearly defined.
Fig. 1 is a flowchart of an attack scenario mining method for an SDN network provided in the present application, where the method includes:
acquiring network flow data, and identifying the type of a network according to network characteristics;
when the network is identified to be the SDN network, a control instruction is issued to a controller and a switch, and the control instruction carries an identifier and an address of a trusted authority CA in the middle of the network;
the controller and the switch receive the control instruction and respectively send identity authentication requests to a trusted authority CA in the middle of the network, wherein the identity authentication requests carry respective public keys, user identity information and equipment identification of the controller and the switch;
the trusted authority CA receives the identity authentication request, queries a database according to the equipment identifier, judges whether the controller and the switch are legal, and returns a plaintext message and a digital signature certificate of the plaintext message by using a CA private key to the controller and the switch if the judgment result is legal; if the judgment result is illegal, the trusted authority CA returns a notice of authentication failure;
the controller and the switch receive the digital signature certificate sent by the trusted authority CA, the public key of the trusted authority CA is used for verifying the digital signature certificate, and if the verification is successful, the controller and the switch replace the digital signature certificate with respective identity information; if the verification is unsuccessful, the controller and the switch send a notice of authentication error to the trusted authority CA;
after the controller and the switch are successfully verified, the switch sends an encryption security connection request to the controller, wherein the encryption security connection request carries version information, a supported encryption algorithm and a first random number;
after receiving the encryption security connection request, the controller returns a response message to the switch, wherein the response message comprises a confirmed encryption algorithm, a randomly generated second random number and a digital signature certificate of the controller;
after the switch receives the response message, the switch verifies the digital signature certificate of the controller by using the public key of the trusted authority CA, if the verification is successful, a third random number is generated, the public key of the controller is used for encrypting the third random number, and the third random number and the digital signature certificate of the switch are sent to the controller;
after the controller receives the message sent by the switch, the public key of the trusted authority CA is used for verifying the digital signature certificate of the switch, if the verification is successful, the private key of the controller is used for decrypting the third random number ciphertext in the message, and the key agreement between the controller and the switch is completed;
the controller and the switch carry out encryption communication on the established encryption security connection by using the negotiated encryption algorithm and key;
judging whether DDos attack occurs between the controller and the current switch or not, and if the judgment result is true, generating a corresponding alarm log;
acquiring the quantity of Packet-in messages uploaded by at least one neighbor switch of the current switch, and calculating the rate of uploading the Packet-in messages; sequencing Packet-in message rates of the at least one neighbor switch, determining a neighbor switch with the minimum Packet-in message rate, and acquiring an identifier DPID of the neighbor switch with the minimum rate;
acquiring content, an input port and a path set of a network flow data packet according to a destination IP address, selecting a path meeting a preset condition from the path set according to an identification DPID and the input port of a neighbor switch, and issuing an updated flow rule to an attacked current switch according to the path;
waiting for a preset time interval, judging whether DDos attack occurs between the controller and the neighbor switch again, and if the judgment result is true, generating a new alarm log;
normalizing all alarm logs, removing redundant information to obtain combined alarm logs, and associating similar alarms based on attribute similarity to obtain a candidate attack graph set;
and calculating the internal characteristics of the attack graph, obtaining an attack graph set of the same attack scene based on characteristic clustering processing, and obtaining the attack scene through attack scene mining processing.
In some preferred embodiments, the digitally signed certificate employs a hash operation.
In some preferred embodiments, the encryption algorithm comprises any one of DES, MD5, AES.
In some preferred embodiments, the network intermediary trusted authority CA may be any one of a certificate server, a key server, and a digital certificate server.
Fig. 2 is an architecture diagram of an attack scenario mining system of an SDN network provided in the present application, where the system includes: the system comprises a gateway server, an analysis server, a trusted authority CA in the middle of a network, at least one SDN controller and at least one SDN switch;
the gateway server acquires network flow data and identifies the type of a network according to network characteristics;
when the network is identified to be the SDN network, issuing a control instruction to at least one controller and at least one switch, wherein the control instruction carries an identifier and an address of a trusted authority CA in the middle of the network;
the at least one controller and the at least one switch receive the control instruction and respectively send identity authentication requests to a trusted authority CA in the middle of the network, wherein the identity authentication requests carry respective public keys, user identity information and equipment identifications of the controller and the switch;
the trusted authority CA receives the identity authentication request, queries a database according to the equipment identification, judges whether the at least one controller and the at least one switch are legal or not, and returns a plaintext message and a digital signature certificate of the plaintext message by using a CA private key to the at least one controller and the at least one switch if the judgment result is legal; if the judgment result is illegal, the trusted authority CA returns a notice of authentication failure;
the at least one controller and the at least one switch receive the digital signature certificate sent by the trusted authority CA, the public key of the trusted authority CA is used for verifying the digital signature certificate, and if the verification is successful, the at least one controller and the at least one switch replace the digital signature certificate with respective identity information; if the verification is unsuccessful, the at least one controller and the at least one switch send a notification of authentication error to the trusted authority CA;
after the at least one controller and the at least one switch are successfully verified, the switch sends an encryption security connection request to the corresponding controller, wherein the encryption security connection request carries version information, a supported encryption algorithm and a first random number;
after receiving the encryption security connection request, the controller returns a response message to the switch, wherein the response message comprises a confirmed encryption algorithm, a randomly generated second random number and a digital signature certificate of the controller;
after the switch receives the response message, the switch verifies the digital signature certificate of the controller by using the public key of the trusted authority CA, if the verification is successful, a third random number is generated, the public key of the controller is used for encrypting the third random number, and the third random number and the digital signature certificate of the switch are sent to the controller;
after the controller receives the message sent by the switch, the public key of the trusted authority CA is used for verifying the digital signature certificate of the switch, if the verification is successful, the private key of the controller is used for decrypting the third random number ciphertext in the message, and the key agreement between the controller and the switch is completed;
the controller and the switch carry out encryption communication on the established encryption security connection by using the negotiated encryption algorithm and key;
the analysis server judges whether DDos attack occurs between the controller and the current switch or not, and if the judgment result is true, a corresponding alarm log is generated;
acquiring the quantity of Packet-in messages uploaded by at least one neighbor switch of the current switch, and calculating the rate of uploading the Packet-in messages; sequencing Packet-in message rates of the at least one neighbor switch, determining a neighbor switch with the minimum Packet-in message rate, and acquiring an identifier DPID of the neighbor switch with the minimum rate;
acquiring content, an input port and a path set of a network flow data packet according to a destination IP address, selecting a path meeting a preset condition from the path set according to an identification DPID and the input port of a neighbor switch, and issuing an updated flow rule to an attacked current switch according to the path;
waiting for a preset time interval, judging whether DDos attack occurs between the controller and the neighbor switch again, and if the judgment result is true, generating a new alarm log;
normalizing all alarm logs, removing redundant information to obtain combined alarm logs, and associating similar alarms based on attribute similarity to obtain a candidate attack graph set;
and calculating the internal characteristics of the attack graph, obtaining an attack graph set of the same attack scene based on characteristic clustering processing, and obtaining the attack scene through attack scene mining processing.
In some preferred embodiments, the digitally signed certificate employs a hash operation.
In some preferred embodiments, the encryption algorithm comprises any one of DES, MD5, AES.
In some preferred embodiments, the network intermediary trusted authority CA may be any one of a certificate server, a key server, and a digital certificate server.
In specific implementation, the present invention further provides a computer storage medium, where the computer storage medium may store a program, and the program may include some or all of the steps in the embodiments of the present invention when executed. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM) or a Random Access Memory (RAM).
Those skilled in the art will readily appreciate that the techniques of the embodiments of the present invention may be implemented as software plus a required general purpose hardware platform. Based on such understanding, the technical solutions in the embodiments of the present invention may be embodied in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the method according to the embodiments or some parts of the embodiments.
The same and similar parts in the various embodiments of the present specification may be referred to each other. In particular, for the embodiments, since they are substantially similar to the method embodiments, the description is simple, and the relevant points can be referred to the description in the method embodiments.
The above-described embodiments of the present invention should not be construed as limiting the scope of the present invention.
Claims (8)
1. An attack scenario mining method for an SDN network, the method comprising:
acquiring network flow data, and identifying the type of a network according to network characteristics;
when the network is identified to be the SDN network, a control instruction is issued to a controller and a switch, and the control instruction carries an identifier and an address of a trusted authority CA in the middle of the network;
the controller and the switch receive the control instruction and respectively send identity authentication requests to a trusted authority CA in the middle of the network, wherein the identity authentication requests carry respective public keys, user identity information and equipment identification of the controller and the switch;
the trusted authority CA receives the identity authentication request, queries a database according to the equipment identifier, judges whether the controller and the switch are legal, and returns a plaintext message and a digital signature certificate of the plaintext message by using a CA private key to the controller and the switch if the judgment result is legal; if the judgment result is illegal, the trusted authority CA returns a notice of authentication failure;
the controller and the switch receive the digital signature certificate sent by the trusted authority CA, the public key of the trusted authority CA is used for verifying the digital signature certificate, and if the verification is successful, the controller and the switch replace the digital signature certificate with respective identity information; if the verification is unsuccessful, the controller and the switch send a notice of authentication error to the trusted authority CA;
after the controller and the switch are successfully verified, the switch sends an encryption security connection request to the controller, wherein the encryption security connection request carries version information, a supported encryption algorithm and a first random number;
after receiving the encryption security connection request, the controller returns a response message to the switch, wherein the response message comprises a confirmed encryption algorithm, a randomly generated second random number and a digital signature certificate of the controller;
after the switch receives the response message, the switch verifies the digital signature certificate of the controller by using the public key of the trusted authority CA, if the verification is successful, a third random number is generated, the public key of the controller is used for encrypting the third random number, and the third random number and the digital signature certificate of the switch are sent to the controller;
after the controller receives the message sent by the switch, the public key of the trusted authority CA is used for verifying the digital signature certificate of the switch, if the verification is successful, the private key of the controller is used for decrypting the third random number ciphertext in the message, and the key agreement between the controller and the switch is completed;
the controller and the switch carry out encryption communication on the established encryption security connection by using the negotiated encryption algorithm and key;
judging whether DDos attack occurs between the controller and the current switch or not, and if the judgment result is true, generating a corresponding alarm log;
acquiring the quantity of Packet-in messages uploaded by at least one neighbor switch of the current switch, and calculating the rate of uploading the Packet-in messages; sequencing Packet-in message rates of the at least one neighbor switch, determining a neighbor switch with the minimum Packet-in message rate, and acquiring an identifier DPID of the neighbor switch with the minimum rate;
acquiring content, an input port and a path set of a network flow data packet according to a destination IP address, selecting a path meeting a preset condition from the path set according to an identification DPID and the input port of a neighbor switch, and issuing an updated flow rule to an attacked current switch according to the path;
waiting for a preset time interval, judging whether DDos attack occurs between the controller and the neighbor switch again, and if the judgment result is true, generating a new alarm log;
normalizing all alarm logs, removing redundant information to obtain combined alarm logs, and associating similar alarms based on attribute similarity to obtain a candidate attack graph set;
and calculating the internal characteristics of the attack graph, obtaining an attack graph set of the same attack scene based on characteristic clustering processing, and obtaining the attack scene through attack scene mining processing.
2. The method of claim 1, wherein the digitally signed certificate employs a hash operation.
3. The method according to any of claims 1-2, wherein the encryption algorithm comprises any of DES, MD5, AES.
4. The method according to any one of claims 1 to 3, wherein the network intermediary trusted authority (CA) can be any one of a certificate server, a key server and a digital certificate server.
5. An attack scenario mining system for an SDN network, the system comprising: the system comprises a gateway server, an analysis server, a trusted authority CA in the middle of a network, at least one SDN controller and at least one SDN switch;
the gateway server acquires network flow data and identifies the type of a network according to network characteristics;
when the network is identified to be the SDN network, issuing a control instruction to at least one controller and at least one switch, wherein the control instruction carries an identifier and an address of a trusted authority CA in the middle of the network;
the at least one controller and the at least one switch receive the control instruction and respectively send identity authentication requests to a trusted authority CA in the middle of the network, wherein the identity authentication requests carry respective public keys, user identity information and equipment identifications of the controller and the switch;
the trusted authority CA receives the identity authentication request, queries a database according to the equipment identification, judges whether the at least one controller and the at least one switch are legal or not, and returns a plaintext message and a digital signature certificate of the plaintext message by using a CA private key to the at least one controller and the at least one switch if the judgment result is legal; if the judgment result is illegal, the trusted authority CA returns a notice of authentication failure;
the at least one controller and the at least one switch receive the digital signature certificate sent by the trusted authority CA, the public key of the trusted authority CA is used for verifying the digital signature certificate, and if the verification is successful, the at least one controller and the at least one switch replace the digital signature certificate with respective identity information; if the verification is unsuccessful, the at least one controller and the at least one switch send a notification of authentication error to the trusted authority CA;
after the at least one controller and the at least one switch are successfully verified, the switch sends an encryption security connection request to the corresponding controller, wherein the encryption security connection request carries version information, a supported encryption algorithm and a first random number;
after receiving the encryption security connection request, the controller returns a response message to the switch, wherein the response message comprises a confirmed encryption algorithm, a randomly generated second random number and a digital signature certificate of the controller;
after the switch receives the response message, the switch verifies the digital signature certificate of the controller by using the public key of the trusted authority CA, if the verification is successful, a third random number is generated, the public key of the controller is used for encrypting the third random number, and the third random number and the digital signature certificate of the switch are sent to the controller;
after the controller receives the message sent by the switch, the public key of the trusted authority CA is used for verifying the digital signature certificate of the switch, if the verification is successful, the private key of the controller is used for decrypting the third random number ciphertext in the message, and the key agreement between the controller and the switch is completed;
the controller and the switch carry out encryption communication on the established encryption security connection by using the negotiated encryption algorithm and key;
the analysis server judges whether DDos attack occurs between the controller and the current switch or not, and if the judgment result is true, a corresponding alarm log is generated;
acquiring the quantity of Packet-in messages uploaded by at least one neighbor switch of the current switch, and calculating the rate of uploading the Packet-in messages; sequencing Packet-in message rates of the at least one neighbor switch, determining a neighbor switch with the minimum Packet-in message rate, and acquiring an identifier DPID of the neighbor switch with the minimum rate;
acquiring content, an input port and a path set of a network flow data packet according to a destination IP address, selecting a path meeting a preset condition from the path set according to an identification DPID and the input port of a neighbor switch, and issuing an updated flow rule to an attacked current switch according to the path;
waiting for a preset time interval, judging whether DDos attack occurs between the controller and the neighbor switch again, and if the judgment result is true, generating a new alarm log;
normalizing all alarm logs, removing redundant information to obtain combined alarm logs, and associating similar alarms based on attribute similarity to obtain a candidate attack graph set;
and calculating the internal characteristics of the attack graph, obtaining an attack graph set of the same attack scene based on characteristic clustering processing, and obtaining the attack scene through attack scene mining processing.
6. The system of claim 5, wherein the digitally signed certificate employs a hash operation.
7. The system according to any of claims 5-6, wherein the encryption algorithm comprises any of DES, MD5, AES.
8. The system according to any one of claims 5-7, wherein the network intermediary trusted authority CA can be any one of a certificate server, a key server, a digital certificate server.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911136058.8A CN110839037A (en) | 2019-11-19 | 2019-11-19 | Attack scene mining method and system for SDN network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911136058.8A CN110839037A (en) | 2019-11-19 | 2019-11-19 | Attack scene mining method and system for SDN network |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110839037A true CN110839037A (en) | 2020-02-25 |
Family
ID=69576775
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911136058.8A Pending CN110839037A (en) | 2019-11-19 | 2019-11-19 | Attack scene mining method and system for SDN network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110839037A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112532573A (en) * | 2020-09-02 | 2021-03-19 | 中国银联股份有限公司 | Authentication method for authenticating relevance and safety device |
| CN114070636A (en) * | 2021-11-22 | 2022-02-18 | 迈普通信技术股份有限公司 | Security control method, security control device, switch, server and network system |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20130283374A1 (en) * | 2012-04-18 | 2013-10-24 | Radware, Ltd. | Techniques for separating the processing of clients' traffic to different zones in software defined networks |
| CN104780069A (en) * | 2015-04-16 | 2015-07-15 | 中国科学院计算技术研究所 | SDN-oriented self-configuration method and system for communication channel between control layer and data layer |
| CN104883356A (en) * | 2015-04-24 | 2015-09-02 | 北京邮电大学 | Target model-based network attack detection method |
| CN106209897A (en) * | 2016-07-28 | 2016-12-07 | 重庆邮电大学 | A kind of software defined network distributed many Task-size Controlling device safety communicating method based on agency |
| CN106341330A (en) * | 2016-08-30 | 2017-01-18 | 广州西麦科技股份有限公司 | Topology discovery method and system of SDN controller |
| US20180288126A1 (en) * | 2017-03-28 | 2018-10-04 | Indigovision Limited | Monitoring devices and methods for ip surveillance networks |
-
2019
- 2019-11-19 CN CN201911136058.8A patent/CN110839037A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20130283374A1 (en) * | 2012-04-18 | 2013-10-24 | Radware, Ltd. | Techniques for separating the processing of clients' traffic to different zones in software defined networks |
| CN104780069A (en) * | 2015-04-16 | 2015-07-15 | 中国科学院计算技术研究所 | SDN-oriented self-configuration method and system for communication channel between control layer and data layer |
| CN104883356A (en) * | 2015-04-24 | 2015-09-02 | 北京邮电大学 | Target model-based network attack detection method |
| CN106209897A (en) * | 2016-07-28 | 2016-12-07 | 重庆邮电大学 | A kind of software defined network distributed many Task-size Controlling device safety communicating method based on agency |
| CN106341330A (en) * | 2016-08-30 | 2017-01-18 | 广州西麦科技股份有限公司 | Topology discovery method and system of SDN controller |
| US20180288126A1 (en) * | 2017-03-28 | 2018-10-04 | Indigovision Limited | Monitoring devices and methods for ip surveillance networks |
Non-Patent Citations (3)
| Title |
|---|
| 孟庆月: "SDN网络南向安全防护系统研究与实现", 《中国优秀硕士学位论文全文数据库信息科技辑》 * |
| 李可一: "基于报警关联的多步攻击场景挖掘方法的研究与实现", 《中国优秀硕士学位论文全文数据库信息科技辑》 * |
| 陶蒙恩: "面向SDN的DDoS攻击防御技术研究与系统实现", 《中国优秀硕士学位论文全文数据库信息科技辑》 * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112532573A (en) * | 2020-09-02 | 2021-03-19 | 中国银联股份有限公司 | Authentication method for authenticating relevance and safety device |
| CN112532573B (en) * | 2020-09-02 | 2023-07-07 | 中国银联股份有限公司 | Authentication method for authentication relevance and safety device |
| CN114070636A (en) * | 2021-11-22 | 2022-02-18 | 迈普通信技术股份有限公司 | Security control method, security control device, switch, server and network system |
| CN114070636B (en) * | 2021-11-22 | 2023-08-11 | 迈普通信技术股份有限公司 | Security control method and device, switch, server and network system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11223480B2 (en) | Detecting compromised cloud-identity access information | |
| CN109309565B (en) | Security authentication method and device | |
| US11336641B2 (en) | Security enhanced technique of authentication protocol based on trusted execution environment | |
| US8307208B2 (en) | Confidential communication method | |
| US6064736A (en) | Systems, methods and computer program products that use an encrypted session for additional password verification | |
| CN110808836A (en) | Network authentication attack prediction method and system | |
| US9491174B2 (en) | System and method for authenticating a user | |
| US20090240936A1 (en) | System and method for storing client-side certificate credentials | |
| CN110855695A (en) | Improved SDN network security authentication method and system | |
| CN110839036B (en) | Attack detection method and system for SDN (software defined network) | |
| KR20080050040A (en) | Method for user authentication | |
| CN115473655A (en) | Terminal authentication method, device and storage medium for access network | |
| CN110839037A (en) | Attack scene mining method and system for SDN network | |
| CN110572392A (en) | Identity authentication method based on HyperLegger network | |
| CN110855693A (en) | Network authentication method and system based on CNN | |
| KR102413497B1 (en) | Systems and methods for secure electronic data transmission | |
| CN110650012A (en) | Improved SDN network attack detection method and system | |
| CN110855694A (en) | Improved network authentication detection method and system | |
| CN110830498A (en) | Continuous attack detection method and system based on mining | |
| CN114553557A (en) | Key calling method, key calling device, computer equipment and storage medium | |
| Bozkurt et al. | Exploring the Vulnerabilities and Countermeasures of SSL/TLS Protocols in Secure Data Transmission Over Computer Networks | |
| Aftab et al. | Towards a distributed ledger based verifiable trusted protocol for VANET | |
| CN110719301A (en) | Attack defense method and system for flow adaptive scheduling | |
| CN111865568A (en) | Data transmission oriented certificate storing method, transmission method and system | |
| CN118233218B (en) | Remote authentication system and method based on distributed trusted execution environment application |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20200225 |