KR101993875B1 - Method, system and computer program for host secretion in software defined networking environment - Google Patents

Abstract

The present invention relates to a server conceal method, system and computer program in software defined networking. The present invention provides a server concealment method of a client operating in a software defined networking environment, the method comprising: requesting a name server for a service name list including at least one service name of a concealed server; receiving the service name list from the name server Receiving a selection input for one of service names included in the service name list from a user, requesting a virtual address of a first hidden server corresponding to the selection input to the name server, Receiving a virtual address of the first concealment server from the first concealment server, and setting the virtual address of the concealment server as a destination of the packet, and transmitting the packet. According to the present invention, it is possible to transmit / receive data without exposing the address of the concealed server to the outside, and it is difficult to distinguish the actual address and the virtual address of the concealed server from the outside.

Description

METHOD, SYSTEM AND COMPUTER PROGRAM FOR HOST SECRETION IN SOFTWARE DEFINED NETWORKING ENVIRONMENT IN A SOFTWARE-DEFINED NETWORKING ENVIRONMENT

The present invention relates to a server concealment method, system and computer program, and more particularly to a server concealment method, system, and computer program in a software defined networking environment.

Software Defined Networking (SDN) is a technology that manages all the network devices in the network by an intelligent central management system. In the SDN technology, a controller provided in a form of software can perform processing instead of a control operation related to the packet processing performed by itself in a conventional hardware type network device, so that various functions can be developed and given over the existing network structure. The SDN system generally comprises a controller server for controlling the entire network, a plurality of open flow switches controlled by the controller server for processing packets, and a host corresponding to a lower layer of the open flow switch. Here, the open flow switch is only responsible for transmitting and receiving packets, and routing, management, and control of the packets are all performed in the controller server. In other words, separating the data planes and control planes that form the network equipment is the basic structure of the SDN system.

On the other hand, MTD (Moving Target Defense) is a strategy that makes it difficult for the attacker to find the vulnerability of the target system by actively and continuously changing the configuration of the attacking system itself. In the SDN environment, Therefore, the MTD can be implemented using the controller.

One of the MTD application techniques in the SDN environment proposed in the past is a method of concealing the actual address of the host by generating a virtual address of the packet destination and sending a flow rule with the virtual address as a destination to the open flow switch. According to this method, the address of the client can be concealed on the network, and only the address of the client is hidden but the address of the server is exposed on the network. This method is ineffective in that the target of a real network-based attack becomes a server. In the case of Ddos or worm propagation, which is the most problematic in network security, it is common to attack a server with a large amount of damage in an attack.

On the other hand, in the method of using the DNS server among the conventional host concealment methods, communication can not be performed without the domain name, and the controller is overloaded because the controller performs IP conversion, flow installation, and DNS query / response. In addition, this method has the limitation that the virtual IP is set in the currently unused IP band, and the virtual IP which is not overlapped is not allowed.

Therefore, there is a need for server hiding technology that solves the problem of the conventional host hiding method and overcomes the limit.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a server concealment method, system, and computer program capable of transmitting and receiving data without exposing the address of a concealed server to the outside.

In addition, it is not necessary to install a separate library or module in the hidden server and the host client, and the object of the present invention is to effectively hide information of the hidden server on the network without modifying the hidden server or client.

It is another object of the present invention to provide a server concealment method and system capable of detecting violation of a policy of a host and concealing an actual address of the server throughout the network.

Another object of the present invention is to provide a service name to a host and hiding the server more stably and effectively using a name server that generates a virtual address of a hidden server using host information.

According to another aspect of the present invention, there is provided a server concealment method for a client operating in a software defined networking environment, the method comprising: requesting a name server for a service name list including at least one service name of a concealed server; Receiving a selection input for one of service names included in the service name list from a user, receiving a virtual address of a first hidden server corresponding to the selection input from the name server, Receiving the virtual address of the first concealment server from the name server, and setting the virtual address of the first concealment server as the destination of the packet to transmit the packet .

In addition, the present invention provides a server concealment method of a name server operating in a software defined networking environment, comprising the steps of: receiving a service name list request from an arbitrary client, receiving a service name list including at least one service name of the concealment server Generating a virtual address of a first hidden server corresponding to the first service name when a virtual address request including a first service name is received from the client, And transmitting the generated management information to the client; and generating host management information including the identification information of the client, the first service name, and the virtual address of the first secret server, and transmitting the generated management information to the controller.

The present invention also provides a server concealment method for a controller operating in a software defined networking environment, the method comprising: receiving a packet-in message having a virtual address as a destination from an arbitrary network equipment; Comprising the steps of: identifying an actual address of a concealment server to which the concealment server is connected; calculating a path of a packet corresponding to the packet-in message using the actual address; And transmitting the flow rule to one or more network devices connected to the controller, wherein the mapping information is managed by host management information received from a name server generating the virtual address And the virtual address of the hidden server is updated It characterized in that it comprises one virtual address of the hidden server's physical address, and the hidden server of corresponding to the specific information, service name of the hidden server.

In addition, the present invention provides a name server operating in a software defined networking environment, wherein, when a virtual address request including a first service name is received from an arbitrary client, A virtual address generating unit for generating a virtual address of the first hidden server corresponding to the first service name, host management information including the identification information of the client, the first service name, and the virtual address of the first hidden server A host management unit, a storage unit for storing a service name list and host management information including at least one service name of the hidden server, the service name list and the virtual address to the client, and transmits the host management information to the controller And a communication unit.

The present invention also relates to a controller operating in a software defined networking environment, the controller comprising: means for receiving a packet-in message from any network device, sending a flow rule to one or more network devices, An application for generating mapping information using the host management information received from the name server and generating a flow rule using the mapping information and a storage unit for storing the mapping information, An address mapping unit for confirming an actual address of a hidden server corresponding to the first virtual address using previously stored mapping information when receiving a packet-in message having a first virtual address as a destination from the network equipment, Corresponding to the packet-in message And a flow rule generation unit for generating a flow rule that defines a processing of the packet in accordance with the calculated route, the mapping information including the first virtual address, And a virtual address of the hidden server, the virtual address of the hidden server being updated by the host management information, the identification information of the client requesting the virtual address of the hidden server, the actual address of the hidden server corresponding to the service name of the hidden server, do.

According to the present invention as described above, data can be transmitted and received without exposing the address of the hidden server to the outside.

In addition, according to the present invention, it is difficult to distinguish between an actual address and a virtual address of the hidden server from the outside, thereby effectively protecting the server from external attacks.

Further, according to the present invention, it is not necessary to install a separate library or module in the hidden server and the host client, and information of the hidden server can be effectively hidden on the network without modifying the hidden server or client.

In addition, according to the present invention, it is possible to detect whether a host is violating a policy, and to hide the actual address of the server from across the network.

In addition, the present invention uses a name server that provides a service name to a host and generates a virtual address of a hidden server using host information, so that the server can be stably and efficiently concealed according to the present invention.

1 is a diagram illustrating a software defined networking environment in accordance with one embodiment of the present invention;
2 is a block diagram illustrating a controller according to an embodiment of the present invention.
3 is a block diagram illustrating a name server according to an embodiment of the present invention.
FIG. 4 is a flowchart illustrating a server concealment method according to an embodiment of the present invention. FIG.
5 is a view for explaining a server concealment method according to an embodiment of the present invention;
FIG. 6 is a diagram illustrating communication between a client, a name server, and a controller to execute a server concealment method according to an embodiment of the present invention;
7 is a view for explaining a server concealing method according to an embodiment of the present invention;
8 is a diagram for explaining an embodiment of host-to-host communication in executing the server concealment method of the present invention,
9 is a diagram for explaining an embodiment of host-to-host communication in executing the server concealment method of the present invention.

The above and other objects, features, and advantages of the present invention will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings, which are not intended to limit the scope of the present invention. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, the same reference numerals are used to designate the same or similar components, and all combinations described in the specification and claims can be combined in any manner. It is to be understood that, unless the context requires otherwise, references to singular forms may include more than one, and references to singular forms may also include plural forms.

The term 'flow rule' in the description of the present invention should be understood to mean a network policy applied by a controller server in a software definition network in the ordinary artisan's field. Further, the term " flow rule " can be interpreted to mean a flow entry according to the network policy for an open flow switch. Further, the transmission or updating of a flow rule in this specification should be understood as including the addition of a new flow rule, the deletion or modification of an old flow rule.

The 'address' described herein is for identifying a host, a device, or a process. The address includes a logical address such as an IP address, which is a host address in a network layer, and a port address, which is a process address in a host. It may be understood to include a physical address. Also, the 'virtual address' in the present specification should be understood as a concept that the name server is allocated in the virtual address pool or newly generated virtual address information and is distinguished from the 'real address'.

1 is a diagram for explaining a software defined networking environment according to an embodiment of the present invention. Referring to FIG. 1, a software defined networking environment may include a controller 100, network equipment 200, and hosts 300 and 400. The network equipment 200 and the hosts 300 and 400 may be referred to as a node and a link may mean a connection between two nodes.

The controller 100 functions to manage the network equipment 200 and centrally manages and controls the plurality of network equipment 200. Specifically, the controller 100 is an application (software, firmware, etc.) that performs functions such as topology management, path management related to packet processing, link discovery, and packet flow in- 130 may be mounted.

The switch 200 functions to process packets under the control of the controller 100. The switch 200 shown in the figure can be exchanged with a network device such as a mobile communication base station, a base station controller, a gateway device, a router, etc. for packet processing. For convenience of explanation, a network device is a switch 200, and a switch 200 according to an embodiment of the present invention will be described with reference to an open flow switch 200.

In the software-defined network, the controller 100 and the open flow switch 200 exchange information with each other, and the open flow protocol is widely used as a protocol for the exchange. That is, the open flow protocol is a standard that allows the controller 100 and the open flow switch 200 to communicate with each other.

More specifically, the open flow switch 200 is largely divided into a software layer and a hardware layer. The software layer exchanges information with the controller 100 through a secure channel. The secure channel is a communication channel between the open flow switch 200 and the remote controller 100. Information exchanged between the controller 100 and the open flow switch 200 is encrypted.

The hardware layer has a flow table that defines and processes packets and includes statistical information related to the packets. The flow table includes a flow rule that defines packet processing. The flow rule is generated by a flow mode message (Flow-Mode Message) generated by the controller 100 and transmitted to the open flow switch 200 Added, modified or deleted. The open flow switch 200 processes the packet with reference to the flow table.

The flow table can largely include three pieces of information: packet header information (Rule) defining a flow, operation information (Action) defining processing of a packet, and stat information (Stats) per flow. Each row constituting the flow table is referred to as a flow entry.

The hosts 300 and 400 refer to a terminal or the like corresponding to a lower layer of the open flow switch 200 and can be used to mean a client 300 and a server 400 collectively. The host 300 can generate a packet for sending to another host via a software defined network and transmit the packet to the open flow switch 200 through a port of the network interface. In this specification, for convenience of description, a client 300, which is a user using a certain service or a terminal of a user, and a server 400, which is a computer providing a service, are separately described. However, the configuration and functions of the client 300 according to an embodiment of the present invention are applicable to all kinds of hosts including the server 400, and the present invention relates to a method of concealing server information in a network Herein, the server 400 is also referred to as a concealed server 400.

In general, when the client 300 desires to transmit a packet to the server 400, the client 300 sets the identification address of the server 400 as a destination, and transmits a packet having the identification address of the client 300 as its source And transmits the packet to the open flow switch 200 connected to the client 300. When the open flow switch 200 has a flow table defining the processing of the packet, the open flow switch 200 processes the packet according to the rule. However, when there is no flow table related to the packet in the open flow switch 200, the open flow switch 200 transmits a packet-in message informing the controller 100 of the packet flow. The controller 100 generates a flow table for specifying the processing of the packet according to an operator's policy or a predetermined algorithm and transmits the generated flow table to the open flow switch 200. The open flow switch 200 receives the flow table To process the packet.

The present invention can prevent the actual address of the server 400 from being exposed in the process of transmitting the packet when the client 300 transmits the packet to the server 400. [ The actual address of the server 400 is stored only in the controller 100 and the controller 100 only uses the actual address of the server 400 for route calculation. Only the virtual address of the server 400 is included and information of the server 400 can not be known outside or inside the network. Since the virtual address of the server 400 is set as a destination in the packet transmitted through each open flow switch 200, even if the packet is captured, the deederator can receive the server 400 information including the actual address of the server 400 Can not be confirmed.

The present invention includes a name server 500 for generating a virtual address. The address of the name server may be public information, but the address may be periodically and / or irregularly changed. Accordingly, the client 300 can access the name server 500 through an installed application. If the address of the name server 500 is set to be periodically and / or irregularly changed, It is possible to access the name server 500 using an address change algorithm shared with the server 500.

Hereinafter, the operation of the controller 100, the client 300, and the name server 500 according to an embodiment of the present invention will be described in detail.

2, the controller 100 according to an embodiment of the present invention includes an application 130, a communication unit 150, and a storage unit 170. The application 130 includes an address mapping unit 133, A path calculation unit 135, and a flow rule generation unit 137. [

The application 130 generates mapping information using the host management information received from the name server, and generates a flow rule using the mapping information. Also, the communication unit 150 controls the flow-table change item to be transmitted to the open-flow switch 200 according to the flow rule. The application 130 may send a flow-mode message for the flow table change to the open flow switch 200 and the flow-mode message sent to some open flow switches 200 may include a set-field action ) May be included.

The set-field action is an action for rewriting the header field of the flow entry (or the flow rule constituting the flow table). When the switch 200 receives a packet whose destination is the virtual address of the hidden server 400 , And changes the destination of the packet header field to the actual address of the concealment server 400 so that the packet can be finally transmitted to the concealment server 400 correctly.

When the address mapping unit 133 receives the packet-in message having the virtual address as a destination from the client 300, the address mapping unit 133 identifies the actual address of the hidden server corresponding to the virtual address using the stored mapping information.

The mapping information is information updated by the host management information. The mapping information includes identification information of the client 300 requesting the virtual address of the hidden server, the actual address of the hidden server 400 corresponding to the service name of the hidden server 400, The virtual address of the hidden server 400 may be included.

The host management information is information generated and received by the name server 500 and includes identification information of the client 300 requesting the virtual address of the hidden server 400, service name of the hidden server 400, .

The route calculation unit 135 calculates the route of the packet corresponding to the packet-in message using the actual address of the concealment server 400. [ If the destination of the packet is the name server 500, the path calculation unit 135 calculates the path of the packet using the actual address of the name server 500. [

The flow rule generation unit 137 includes a virtual address, and generates a flow rule that defines the processing of the packet according to the calculated route. A flow rule is generated so as to include the virtual address in place of the actual address in the destination included in the flow rule following the path calculated using the actual address so that the actual address of the hidden server 400 is not exposed on the network.

The communication unit 150 receives a packet-in message having a virtual address of the server as a destination from the open flow switch 200 and transmits the generated flow rule to one or more open flow switches 200 managed by the controller 100 do. More specifically, the controller 100 transmits a flow-table change according to a flow rule, and the controller 100 can transmit a flow-table change using a flow-mode message.

The open flow switch 200 can modify and delete the flow rules included in the flow table according to the flow mode message received by the controller 100 and add a new flow rule to the flow table. Then, the open flow switch 200 can process the packet with reference to the flow table including the changed flow table, that is, the flow rule including the virtual address.

Also, the communication unit 150 may receive the host management information from the name server that generates the virtual address.

The storage unit 170 stores various information including the state of the application 130 and information necessary for the operation of the application 130, the command sent by the controller 100 to the switch 200, the state of the switch 200, . In particular, in one embodiment of the present invention, the storage unit 170 may store mapping information. The storage unit 170 may be included in the controller 100 as shown in the figure, but may be implemented as a distributed storage unit or an external storage unit.

3 is a block diagram illustrating a name server 500 according to an embodiment of the present invention. 3, the name server 500 according to an exemplary embodiment of the present invention may include a virtual address generator 510, a host manager 530, a communication unit 550, and a storage unit 570.

When a virtual address request including a first service name is received from an arbitrary client, the virtual address generating unit 510 generates a virtual address using the identification information of the client and the first service name, Create a virtual address.

In this specification, 'generating a virtual address' is a method of generating a virtual address pool such as an IP pool, assigning one virtual address in a virtual address pool, and generating a virtual address according to a predetermined algorithm It was used in a sense to include both methods.

When the host management information includes the access information indicating the time when the client accesses the name server, the virtual address generator 510 uses the access information to determine whether the difference between the client's access time and the current access time is greater than or equal to a preset virtual address It can be determined whether or not the change period is within the change period.

If the difference between the connection time of the client 300 and the current connection time is less than the virtual address change period, the virtual address generation unit 510 holds the generated address as the virtual address of the first hidden server, If the change period is larger than the change period, the new address can be generated as the virtual address of the first hidden server.

The host management unit 530 generates host management information including the identification information of the client, the first service name, and the virtual address of the first secret server. The host management information may further include connection information indicating a time when the client accesses the name server. If the host management unit 530 determines that there is no client connection for a predetermined period of time using the connection information, Can be deleted.

The communication unit 550 may transmit the service name list and the virtual address to the client, and may transmit the host management information to the controller.

For example, the name server 500 stores a service name such as a source IP address and a request URL of the client 300 requesting the service name list in the storage unit 570, a virtual IP address of the concealment server 400 indicated by the service name, The connection time information may be included in the host management information and stored in the storage unit 570. The communication unit 550 transmits the information to the controller 100 every time a new client 300 is stored in the storage unit 570 .

The controller 100 generates mapping information using the host management information received from the concealment server 400. That is, the controller 100 generates mapping information using the host management information received from the concealment server 400 can do.

The storage unit 570 may store a service name list including at least one service name of the hidden server and host management information.

Hereinafter, an embodiment of the server concealment method of the present invention will be described with reference to FIGS. 4 to 9. FIG.

4 is a flowchart illustrating a server concealment method according to an embodiment of the present invention. Referring to FIG. 4, a client that wishes to transmit a packet to a server may request a name server that includes at least one service name of the hidden server from the name server (S100). A service name is virtual identification information capable of identifying a server, and may be expressed in a URL format or a numeric or text format. For example, in FIG. 1, the service name of the concealment server 400 may be a virtual URL such as www.test.com. When the client requests the service name list from the name server, The service name "www.test.com" of the hidden server 2, the service name "www.test2.com" of the hidden server 2, the service name "server3" of the hidden server 3, Lt; / RTI >

When the name server transmits the service name list (S200), the client can receive a selection input for any one of the service names included in the service name list from the user (S300). In the above example, it is assumed that a user who wants to access the concealment server A selects the URL A corresponding to the concealed server A out of the four service names using an application installed in the client. The client 300 may send a virtual address request including URL A, which is a service name, to the name server (S400).

The client can request the virtual address using the previously stored or known service name in step 400 without performing steps 100 to 300. [

According to another embodiment, when there is only one hidden server, a virtual address can be automatically received when accessing the name server 500 without a separate virtual address request. In this case, Lt; / RTI > (S600).

The service name list request (S100) and the virtual address request (S400) of the client 300 may be performed through an application installed in the client, and the application may be installed and operated only for the authorized host.

In step 100 or 400, the client 300 may access the name server 500 using the virtual address of the name server 500. The virtual address of the name server 500 may be randomly allocated to the real address of the name server 500 Value, and the random value may be a value determined by an algorithm shared with the controller. For example, when the address of the name server 500 is NS_RIP, the virtual address NS_VIP = NS_RIP + of the name server 500 used by the client 300 to access the name server may be a random value, Time, origin address (client address), and the like.

When the name server 500 receives the virtual address request from the client in step 400, the name server 500 can generate a virtual address of the hidden server corresponding to the service name included in the virtual address request (hereinafter, referred to as the first hidden server) S500), and can transmit the virtual address to the requesting client (S600).

Let's look more specifically at step 500 where the name server 500 generates a virtual address. The name server 500 can assign any value in the preset IP band using the CIDR. In particular, the name server 500 can generate an address of a band same as the address of the name server 500 as a virtual address of the first hidden server, which can distinguish the virtual address from the real address of the hidden server It is to be avoided.

If the service names are the same, the name server 500 can allocate duplicate virtual addresses to different hosts (clients) as shown in Table 1.

Client IP Service name Virtual IP of hidden server Connection time 10.0.0.1 www.test1.com 172.23.255.100 T1 10.0.0.5 www.test1.com 172.23.255.100 T2 10.0.0.17 www.test1.com 172.23.255.100 T3

If a virtual address request including a different service name is received from the same host (client), the name server 500 can assign a virtual IP that is not duplicated to each hidden server as shown in Table 2. [

Client IP Service name Virtual IP of hidden server Connection time 10.0.0.1 www.test1.com 172.23.255.100 T1 10.0.0.1 www.test2.com 172.23.255.110 T2 10.0.0.1 www.test3.com 172.23.255.120 T3

In step 500, the name server 500 can use the connection information to determine whether the difference between the connection time of the client 300 and the current connection time is within a predetermined virtual address change period. If the difference is smaller than the virtual address change period, the generated address is maintained as the virtual address of the first hidden server. If the difference is larger than the virtual address change period, the new address can be generated as the virtual address of the first hidden server have.

The name server 500 not only generates the virtual address of the first hidden server and transmits the virtual address to the client, but also includes the identification information of the client 300 requesting the virtual address, the service name included in the virtual address request ), The host management information including the virtual address of the first hidden server can be generated (S800), and the host management information can be stored in the name server (S850) or transmitted to the controller (S900).

The host management information may further include connection information indicating the time at which the client 300 accesses the name server. This means that the name server 500 does not have access to the client 300 for a predetermined period of time And may be used to delete the host management information if it is determined. The access information may also be used in step 500 to determine whether the name server 500 is to update the virtual address.

If the virtual address of the first hidden server is received from the name server in step 600, the client 300 sets the virtual address of the first hidden server as the destination of the packet and transmits the packet (S700).

The open flow switch 200 receiving the packet with the virtual address of the first hidden server as the destination from the client 300 can perform the following operations. As described above, the open flow switch 200 defines and processes a packet, and there is one or more flow tables including statistical information related to the packet. The flow table includes a flow rule (Flow rule. Since the open flow switch 200 does not have a flow rule for the virtual address of the first concealment server, the open flow switch 200 transmits a packet-in message to the controller 100, The controller 100 is inquired of the path of the packet whose destination is the virtual address of the first hidden server (S1000). Since the packet-in message is composed of the header information of the packet, the packet-in message has the virtual address of the first hidden server set as the destination and the identification address of the client 300 as the origin.

When the controller 100 receives a packet-in message destined for a virtual address from a certain network device, the controller 100 checks the actual address of the hidden server corresponding to the virtual address using the stored mapping information (S1100) (Step S1200). In step S1200, the path of the packet corresponding to the packet-in message is calculated. Here, the mapping information is information updated by the host management information received from the name server that generates the virtual address. The mapping information includes identification information of the client requesting the virtual address of the hidden server, the actual address of the hidden server corresponding to the service name of the hidden server, And may include the virtual address of the hidden server.

In step 1100, the controller 100 can check the validity of the virtual address, and use the mapping information only when the virtual address is valid, to confirm the real address of the hidden server corresponding to the virtual address. If the virtual address is not valid, it is possible to detect whether the host (client) is violating the policy by not performing the subsequent step.

The controller 100 generates a flow rule including a virtual address and defines the processing of the packet according to the calculated path (S1300), and may transmit the flow rule to one or more network devices connected to the controller (S1400). If the network equipment is the open flow switch 200, the flow rule transmitted to the open flow switch 200 at step 1400 can be understood as a flow table change according to the flow rule, and the flow- Message (flow-mode message).

The controller 100 may further include a step of calculating a random value preset in the virtual address after receiving the packet-in message having the virtual address as a destination, and when the destination address according to the calculation result is received by the name server 500, The controller 100 calculates the path of the packet using the actual address of the name server and transmits the packet to the name server 500 so that each open flow switch 200 processes the packet A flow rule can be generated. That is, if the virtual address is a virtual address of the name server, the packet is processed to be transmitted to the name server. Since the address of the name server is exposed externally, it can be changed regularly and / or irregularly, so that the controller 100 can share the name server's address change algorithm with the application of the name server and / or client, The algorithm or the random value may be used to identify whether the address of the name server has been changed.

If the network device 200 is connected to the concealed server 400 in steps 1300 to 1400, the controller 100 adds the flow table change information of the packet with the virtual address of the concealed server 400 as a destination An action for changing the destination to the actual address of the concealment server 400 and an action for changing the origin of the packet originating from the concealment address of the concealment server 400 to the virtual address of the concealment server 400 Can be included.

5 to 7 will be described in more detail with reference to the drawings. Referring to FIG. 5, a host client A 300 having an IP address of 10.0.0.2 can request a service name list from a name server 500 having an IP address of 90.10.10.20 (S100). The service name list (URL List) stored in the name server 500 can be transmitted to the host A 300. In the embodiment of FIG. 5, the name server stores three URLs as service names: URL A: 90.10.10.5, URL B: 90.10.10.6, and URL C: 90.10.10.7.

6 shows an embodiment in which the user selects connection to the hidden server corresponding to the URL A. FIG. The host A 300 may request the name server for the virtual address of the hidden server corresponding to the URL A, which is the service name (S400). The name server 500 generates a virtual address corresponding to the URL A (S500). In the embodiment of FIG. 6, the name server 500 assigns 90.10.10.5 to the virtual address of the hidden server having the service name of URL A And transmits it to the Host A 300 (S600) so that the client 300 can transmit a packet having a virtual address as a destination. The name server can generate and store the host management information 530A including the client identification information (Host IP), the service name (URL A), and the virtual address (90.10.10.5: 9999) corresponding to the service name, (100) so that the controller can use the host management information to generate the flow rule.

The subsequent steps refer to FIG. Referring to FIG. 7, the Host A 300 sets a virtual address (90.10.10.5: 9999) of the hidden server (S600) received from the name server as a destination and transmits the packet (S700). Since the open flow switch 200A receiving the packet does not have a flow rule for the newly created virtual address, it sends a packet-in message to the controller 100 (S1000), and the application 130 of the controller And confirms the actual address of the hidden server corresponding to the virtual address using the stored mapping information. In the embodiment of FIG. 7, the real address corresponding to the virtual address (90.10.10.5) is 90.10.10.10, and the controller (100) calculates the route using the real address and then updates the flow rule change That is, a flow-mode message is transmitted to each switch 200 (S1400).

Upon receiving the packet with the destination of the virtual address 90.10.10.5, each of the switches 200 receiving the flow-mode message processes the packet by referring to the flow rule which is a processing rule for the packet in the flow table. However, the flow-mode message transmitted to the open flow switch 200B connected to the host B 400, which is a hidden server, is transmitted to the concealed server 400 as a destination of a packet destined for the virtual address 90.10.10.5 of the host B 400. [ (Set-field Action) to change the destination address to 90.10.10.10 when receiving the packet with the destination of 90.10.10.5, the packet can be transmitted to Host B. .

Therefore, according to the present invention, since the actual address of the hidden server is not known other than the controller 100, the actual address information of the hidden server is not exposed, so the information of the hidden server can be effectively hidden, As the address information is changed, uncertainty and attack complexity are increased, so that the system can be reliably protected from the attacker.

5 to 7 are for communication between a client, a name server and a controller. Hereinafter, an embodiment of a host-to-host communication method according to the present invention will be described with reference to FIGS. 8 to 9. FIG.

FIG. 8 shows an embodiment in which the Host A receiving the virtual address (90.10.10.5) of the concealment server transmits the ARP request packet with the virtual address as the destination. When the open flow switch 200A receives the ARP request packet destined for the virtual address (S700A), the open flow switch 200A transmits a packet-in message to the controller 100 (S1000A).

The controller 100 converts the virtual address included in the ARP request packet into the real address (90.10.10.10) if the packet-in message is a packet-in message relating to an ARP (Address Resolution Protocol) request packet, The re-generated ARP request packet may be broadcast to one or more network devices connected to the controller (S2000).

As a result, as shown in FIG. 9, the concealed-server Host B 400 transmits the ARP response packet corresponding to the regenerating ARP request packet to the open flow switch 200B connected thereto, The switch 200B transmits a packet-in message to the controller 200B (S2400). It can be understood that the controller has received the ARP response packet corresponding to the regenerating ARP request packet from the concealed-server Host B (400).

Next, the controller 100 converts the real address included in the ARP response packet into a virtual address, generates a regenerative ARP response packet including the virtual address, and transmits a regenerative ARP response packet to the client Host A 300 as a unicast (S2500).

On the other hand, the server concealment method described above can be implemented in the host 300 or the controller 100 through a server concealed application stored in a computer-readable medium in order to execute any one of the embodiments.

Some embodiments omitted in this specification are equally applicable if their implementation subject is the same. It is to be understood that both the foregoing general description and the following detailed description of the present invention are exemplary and explanatory and are intended to be exemplary and explanatory only and are not restrictive of the invention, The present invention is not limited to the drawings.

100: controller
200: Switch
300: Client
400: hidden server
500: Name Server

Claims (19)

In a server concealment method in a software defined networking environment,
The client requesting the name server for the virtual address of the first hidden server having the first service name;
Generating a virtual address of the first hidden server by the name server;
The name server transmits the virtual address of the first hidden server to the client, generates host management information including the identification information of the client, the first service name, and the virtual address of the first hidden server, Transmitting;
Wherein the client sets the virtual address of the first concealment server as a destination of the packet and transmits the packet.
The method according to claim 1,
The client requesting a name server for a service name list including at least one service name of the concealed server;
The name server transmitting the service name list to the client;
Further comprising the client receiving from the user a selection input for one of the service names included in the service name list,
Wherein the first service name is a service name corresponding to the selection input.
3. The method of claim 2,
Wherein the step of the client requesting the service name list to the name server includes accessing the name server using the virtual address of the name server,
Wherein the virtual address of the name server is generated by adding a random value to an actual address of the name server, and the random value is a value determined by an algorithm shared with the controller.
The method according to claim 1,
Further comprising the step of deleting the host management information if it is determined that there is no connection of the client for a predetermined period of time using the connection information indicating the time when the client accesses the name server .
The method according to claim 1,
Wherein the name server generates the virtual address of the first hidden server,
Determining whether a difference between a connection time of the client and a current connection time is within a preset virtual address change cycle using connection information indicating the name server connection time of the client;
If the difference is less than the virtual address change period, the pre-generated address is maintained as a virtual address of the first concealment server. If the difference is larger than the virtual address change period, And generating the virtual address as a virtual address.
The method according to claim 1,
Wherein the name server generates the virtual address of the first hidden server,
And generating an address of a same band as an address of the name server as a virtual address of the first hidden server.
A method of server concealment of a controller operating in a software defined networking environment,
Receiving a packet-in message having a virtual address as a destination from an arbitrary network equipment, confirming an actual address of the hidden server corresponding to the virtual address using the stored mapping information;
Calculating a path of a packet corresponding to the packet-in message using the physical address;
Generating a flow rule that includes the virtual address and defines processing of the packet according to the computed path;
Sending the flow rules to one or more network devices connected to the controller,
Wherein the mapping information is updated by host management information received from a name server that generates the virtual address, and the virtual address of the hidden server is stored in the storage unit according to the identification information of the requesting client, the physical address of the hidden server corresponding to the service name of the hidden server And a virtual address of the hidden server,
Wherein the host management information includes identification information of the client, the service name, and a virtual address of the hidden server.
8. The method of claim 7,
The step of verifying the actual address of the hidden server comprises:
Confirming the validity of the virtual address;
And if the virtual address is valid, checking an actual address of the hidden server corresponding to the virtual address using the mapping information.
8. The method of claim 7,
The step of verifying the actual address of the hidden server
And calculating a random value preset in the virtual address to confirm whether a destination address corresponding to the operation result corresponds to an actual address of the hidden server.
8. The method of claim 7,
The flow rule transmitted to the network equipment connected to the hidden server
And changing an address of a packet whose destination is a virtual address of the hidden server to an actual address of the hidden server.
8. The method of claim 7,
If the packet-in message is a packet-in message regarding an ARP (Address Resolution Protocol) request packet,
Converting the virtual address included in the ARP request packet into the physical address;
Broadcasting a regenerating ARP request packet including the real address to one or more network devices connected to the controller;
Converting the real address included in the ARP response packet into the virtual address when receiving an ARP response packet corresponding to the regenerating ARP request packet from the hidden server;
Further comprising the step of unicasting the regenerating ARP response packet including the virtual address to the client.
For a name server operating in a software defined networking environment,
When receiving a virtual address request including a first service name from an arbitrary client, generates a virtual address of the first hidden server corresponding to the first service name using the identification information of the client and the first service name A virtual address generator;
A host management unit for generating host management information including identification information of the client, the first service name, and the virtual address of the first secret server;
A storage unit for storing a service name list and host management information including at least one service name of the hidden server;
And a communication unit for transmitting the service name list and the virtual address to the client and transmitting the host management information to the controller.
13. The method of claim 12,
Wherein the host management information further includes connection information indicating a time when the client accesses the name server,
Wherein the host management unit deletes the host management information when it is determined that the client is not connected for a preset time using the access information.
13. The method of claim 12,
The virtual address generating unit
Determining whether a difference between a connection time of the client and a current connection time is within a preset virtual address modification cycle using connection information indicating a time when the client accesses the name server, And stores the generated address as a virtual address of the first hidden server, and generates a new address as a virtual address of the first hidden server if the difference is larger than the virtual address change period.
In a controller operating in a software defined networking environment,
A communication unit for receiving a packet-in message from any network equipment, transmitting a flow rule to one or more network devices, and receiving host management information from a name server for generating a virtual address of the hidden server;
An application for generating mapping information using the host management information and generating a flow rule using the mapping information;
And a storage unit for storing the mapping information,
The application comprises:
An address mapping unit for confirming an actual address of a hidden server corresponding to the first virtual address using previously stored mapping information when receiving a packet-in message from the network equipment with a first virtual address as a destination;
Calculating a path of a packet corresponding to the packet-in message using the physical address;
And a flow rule generation unit for generating a flow rule including the first virtual address and defining a processing of the packet according to the calculated path,
The mapping information is updated by the host management information, and includes the identification information of the client requesting the virtual address of the hidden server, the actual address of the hidden server corresponding to the service name of the hidden server, and the virtual address of the hidden server and,
Wherein the host management information includes identification information of the client, the service name, and a virtual address of the secret server.
11. A server concealment program in combination with hardware stored in a computer-readable medium for executing the method of any one of claims 1 to 11.
delete delete delete

Images