KR102415998B1 - Sdp controller and method capable of load balancing of control channels in software-defined perimeter network system - Google Patents

Abstract

Provided is a load balancing method of a control channel in an SDP controller of a software-defined perimeter network system. The load balancing method of the present invention comprises the steps of: receiving an authentication message from at least one of an initiating host (IH) and an accepting host (AH); verifying the validity of the authentication message and generating a token used when transceiving a message; selecting and mapping a control proxy corresponding to the host; transmitting the token and address information on the selected control proxy to an authentication proxy; transmitting the token to the selected control proxy; and transceiving the message with the host using the token on the basis of the selected control proxy. Therefore, the burden caused by an increase in simultaneous access sessions of hosts can be minimized.

Description

SDP CONTROLLER AND METHOD CAPABLE OF LOAD BALANCING OF CONTROL CHANNELS IN SOFTWARE-DEFINED PERIMETER NETWORK SYSTEM

The present invention relates to an SDP controller and method capable of load balancing of a control channel of a software-defined boundary network system.

With the recent development of network systems, the demand for zero-trust network configuration to enhance the security of network access to private and public services is increasing significantly. In order to configure a Zero-Trust network, a Software Defined Perimeter Network (SDP) has been proposed as a configuration method.

The software-defined perimeter network pre-defines the connection information between IH-AH in the SDP controller based on the whitelist-based IH (Initiating Host) and AH (Accepting Host) devices, and distributes control channels to each IH and AH. It is operated in the form provided.

Software-defined boundary network technology is a trend to introduce and utilize IoT, car-sharing, smart factory, and telecommuting systems in addition to public and private network configurations.

As the number of IHs and AHs increases in such a software-defined boundary network, various problems such as control channel establishment failure and message transmission/reception delay occur.

Registered Patent Publication No. 10-2007913 (2019.07.31)

The problem to be solved by the present invention is to minimize the burden on the concurrent access session of the SDP controller by adding a control channel load balancing structure between the SDP controller and the host in configuring a software-defined boundary network, and establish a control channel and transmit/receive messages It is an object of the present invention to provide an SDP controller and method capable of load balancing of a control channel of a software-defined perimeter network system, which improves performance.

However, the problems to be solved by the present invention are not limited to the problems described above, and other problems may exist.

In a method for balancing a control channel in an SDP controller of a software-defined boundary network system according to an aspect of the present invention for solving the above-mentioned problems, authentication from at least one host of an Initiating Host (IH) and an Accepting Host (AH) receiving a message; generating a token used when transmitting and receiving a message by verifying the validity of the authentication message; selecting and mapping a control proxy corresponding to the host; transmitting the token and address information of the selected control proxy to the authentication proxy; sending the token to the selected control proxy; and transmitting and receiving a message to and from the host using the token based on the selected control proxy.

In some embodiments of the present invention, the step of receiving the authentication message from the at least one host of the IH and the AH includes designating any one of predetermined authentication proxies from the at least one host to the corresponding authentication proxy. As the authentication message is transmitted, the authentication message may be received from the corresponding authentication proxy.

In some embodiments of the present invention, the selecting and mapping of the control proxy corresponding to the host may include selecting and mapping the control proxy having the fewest control channels established with the IH and AH, respectively.

In some embodiments of the present invention, the step of transmitting and receiving a message to and from the host using the token based on the selected control proxy includes checking mapping information of an ID of a host included in the message received from the control proxy. step; performing verification based on the token included in the message when the mapping information between the control proxy and the host matches; and processing the message when it is determined that the verification result is valid.

In some embodiments of the present invention, the host may include the token in a message and transmit it to a corresponding control proxy, and the control proxy may verify the validity of the message by comparing the token included in the message with a stored token. have.

In some embodiments of the present invention, the step of transmitting and receiving a message to and from the host using the token based on the selected control proxy includes the control address and token of the host to be transmitted (hereinafter referred to as a transmission target host) as the message. including in the; and transmitting the message through a control proxy accessed by the transmission target host based on the mapped information.

In some embodiments of the present invention, the control proxy transmits the message based on a control address of a transmission target host included in the message, and the transmission target host verifies a token upon receiving the message and, if valid, message can be processed.

In some embodiments of the present invention, the method includes: checking mapping information of an ID of a host included in a logout message received from the control proxy; performing verification based on the token included in the logout message when the mapping information between the control proxy and the host matches; when it is determined that the verification result is valid, destroying the token corresponding to the host to logout; and transmitting a token destruction command corresponding to the logout-processed host to the control proxy.

In some embodiments of the present invention, the host includes the token in a logout message and transmits it to a corresponding control proxy, and the control proxy compares the token included in the logout message with a stored token to send the logout message After verifying the validity of , if valid, it is transmitted to the SDP controller, and upon receiving the destruction command, the token corresponding to the host can be destroyed.

In addition, the SDP controller capable of load balancing of a control channel of a software-defined boundary network system according to the second aspect of the present invention includes a host, an authentication proxy, a control proxy, and a message of at least one of an Initiating Host (IH) and an Accepting Host (AH). It includes a communication module for transmitting and receiving, a memory in which a program for load balancing of the control channel is stored, and a processor for executing the program stored in the memory. At this time, when the processor executes the program and receives an authentication message from the at least one host, the processor verifies the validity of the authentication message to generate a token used for message transmission and reception, and controls corresponding to the host. After selecting and mapping a proxy, the token and address information of the selected control proxy are transmitted to the authentication proxy, the token is transmitted to the selected control proxy, and the host uses the token based on the selected control proxy. send and receive messages with

A computer program according to another aspect of the present invention for solving the above problems is combined with a computer, which is hardware, to execute a control channel load balancing method in the SDP controller, and is stored in a computer-readable recording medium.

Other specific details of the invention are included in the detailed description and drawings.

According to the above-described embodiment of the present invention, since the SDP controller only needs to manage the connection sessions of the proxies, it is possible to minimize the burden caused by the increase of the simultaneous connection sessions of the hosts.

In addition, even when the number of hosts increases during system operation and additional load balancing configuration is required, it is easy to expand by simply installing a control proxy.

In addition, by operating the SDP controller inside the firewall and only proxies outside the firewall, the SDP controller can be reliably protected from external attacks.

Effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1A to 1C are diagrams for explaining a conventional software-defined boundary network.
2 is a diagram for explaining a software-defined boundary network system according to an embodiment of the present invention.
3 is a flowchart of a control channel load balancing method in an SDP controller according to an embodiment of the present invention.
4 is a diagram for explaining a process of transmitting a message from a host to an SDP controller.
5 is a diagram for explaining a process of transmitting a message from a message to a host by an SDP controller.
6 is a diagram for explaining a procedure for canceling a control channel.
7 is a block diagram of an SDP controller capable of load balancing of a control channel of a software-defined boundary network system.

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the present embodiments allow the disclosure of the present invention to be complete, and those of ordinary skill in the art to which the present invention pertains. It is provided to fully understand the scope of the present invention to those skilled in the art, and the present invention is only defined by the scope of the claims.

The terminology used herein is for the purpose of describing the embodiments and is not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and/or “comprising” does not exclude the presence or addition of one or more other components in addition to the stated components. Like reference numerals refer to like elements throughout, and "and/or" includes each and every combination of one or more of the recited elements. Although "first", "second", etc. are used to describe various elements, these elements are not limited by these terms, of course. These terms are only used to distinguish one component from another. Accordingly, it goes without saying that the first component mentioned below may be the second component within the spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used herein will have the meaning commonly understood by those of ordinary skill in the art to which this invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless specifically defined explicitly.

1A to 1C are diagrams for explaining a conventional software-defined boundary network.

A software-defined perimeter network developed by Cloud Security Alliance (CSA) is performed by a workflow as shown in FIG. 1A.

First, when the SDP controller 10 goes online, it connects to an optional authentication and authorization service (eg, PKI, fingerprint, geolocation, SAML, OpenID, LDAP, Kerberosm, multi-factor authentication and other services) (S11) .

Next, as the SDP controller 10 goes online, the accepting host 30 connects to the SDP controller 10 and performs authentication, does not approve communication with other hosts, and does not respond to unprovisioned requests. not (S12).

Next, the online initiating host 20 (Initiating Host) connects to the SDP controller 10 and performs authentication (S13).

Next, after authenticating the IH 20, the SDP controller 10 designates a list of 'accepted hosts' with which the IH 20 is authorized to communicate (S14).

Next, the SDP controller 10 provides an optional policy required for the accepting host 30, Accepting Host, for communication and encrypted communication of the IH 20 (S15).

Next, the SDP controller 10 provides the IH 20 with an AH 30 list and an optional policy required for encrypted communication (S16).

Thereafter, the IH 20 forms a mutual TLS tunnel for all approved AH 30 (S17).

A software-defined network formed through this series of processes is shown in FIG. 1B. The SDP controller 10 is directly connected to a plurality of IHs 20 and AH 30 to form a control channel.

However, since the SDP controller 10 is directly connected to a plurality of IHs 20 and AH 30 as shown in FIG. 1c to form a control channel, even if the SDP controller 10 is built in an enterprise-class server environment, the As the number of concurrent access sessions increases, performance may deteriorate, and problems such as failure to establish a control channel and delay in transmission and reception of control messages may occur.

In this case, the SDP controller 10 can be solved by the clustering configuration method in the enterprise server environment, but it must be solved by installing a separate physical device (Load Balancer) or configuring the linkage software between the clusters. The cost and difficulty of operation and maintenance follow, and the structure of the software-defined boundary network that operates according to a simple service provider server environment and requires bidirectional communication between the SDP controller 10 and the hosts 20 and 30 It is not suitable for the characteristics.

To this end, an embodiment of the present invention adds a load balancing structure of the control channel between the SDP controller and the host in the software-defined boundary network configuration, thereby minimizing the burden on the concurrent access session of the SDP controller and establishing the control channel. And it is possible to improve the transmission and reception performance of the control message.

Hereinafter, a load balancing method of a control channel in the SDP controller of the software-defined boundary network system 1 according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram for explaining a software-defined boundary network system 1 according to an embodiment of the present invention.

The software-defined perimeter network system 1 according to an embodiment of the present invention includes an SDP controller 110 , an authentication proxy 120 , a control proxy 130 , and at least one host 200 , 300 .

The hosts 200 and 300 mean at least one of the IH 200 and the AH 300, and the hosts 200 and 300 in an embodiment of the present invention each have one control proxy 130 and one Each of the authentication proxy 120 is connected and connected.

The authentication proxy 120 is used for authentication between the hosts 200 and 300 and the SDP controller 110, and the control proxy 130 is used for authentication between the SDP controller server 110 and the hosts 200 and 300 as the authentication is completed. It is used to transmit and receive messages according to the established control channel between the two.

The SDP controller 110 forms a channel with each host 200 and 300 through the authentication proxy 120 and the control proxy 130 to transmit and receive messages, and after verifying the validity based on the token, processing corresponding to the message carry out

Through this structure, an embodiment of the present invention is characterized in that the number of simultaneous connections to the SDP controller 110 is minimized and a control channel with the IH/AH 200 and 300 is created and maintained.

3 is a flowchart of a control channel load balancing method in the SDP controller 110 according to an embodiment of the present invention.

First, in an embodiment of the present invention, the following pre-conditions are defined and applied.

1. The SDP controller 110 registers and manages the control addresses (IP, Port) of the accessible hosts 200 and 300 in advance.

2. The SDP controller 110 registers and manages the accessable authentication proxy 120 and the control proxy 130 in advance. That is, the SDP controller 110 is in a state in which pre-authentication of the control proxies 130 to the authentication proxy 120 is completed, and the availability status can be monitored.

3. The SDP controller 110 collects and monitors the performance status of the connected control proxies 130 . Here, the performance state of the control proxies 130 means the number of control channels with the hosts 200 and 300 formed for each control proxy 130 .

The control channel load balancing method in the SDP controller 110 according to an embodiment of the present invention includes the authentication of the hosts 200 and 300 and the control proxy 120 and 130 assignment procedure, the message transmission/reception procedure, and the control channel destruction procedure. carry out

First, the authentication and control proxy assignment procedures of the hosts 200 and 300 will be described.

First, at least one host 200 , 300 transmits an authentication message (Host ID, Auth Value) to the corresponding authentication proxy 120 by designating one of the predetermined authentication proxies 120, respectively (S111). Upon receiving the authentication message, the authentication proxy 120 transmits the authentication message to the SDP controller 110 (S113).

Next, the SDP controller 110 verifies the validity of the authentication message as it receives the authentication message from the hosts 200 and 300 ( S115 ), and if the validation result is valid, generates a token used for transmission and reception of the control message do (S117).

Next, the SDP controller 110 selects the control proxy 130 corresponding to the hosts 200 and 300 and maps the corresponding hosts 200 and 300 to the control proxy 130 ( S119 ). At this time, the SDP controller 110 selects the control proxy 130 with the smallest number of established control channels with each host 200 and 300 from among the control proxies 130 monitored in advance to reduce the load during message transmission and reception. to be minimized. In this way, the control proxy 130 selected to correspond to each host 200 and 300 is recorded (Host ID-control proxy ID mapping).

Next, the SDP controller 110 transmits the authentication result message to the authentication proxy 120 (S121). Here, the authentication result message includes the generated token and address information (such as IP, Port, or URL) of the control proxy selected in step S119.

Next, the authentication proxy 120 transmits the authentication result message to the hosts 200 and 300 in step S111 (S123). The hosts 200 and 300 that have received this store the token (S125). The tokens stored by the hosts 200 and 300 are used later when transmitting messages and verifying received messages.

Next, the SDP controller 110 server transmits the generated token to the control proxy 130 selected in step S119 (S127), and the control proxy 130 receiving the token transmits the received token to each host 200 and 300. Store (Host ID-token) and manage (S129).

Through this series of processes, the authentication procedure and the control channel establishment of the IH and AH hosts 120 and 130 are completed, and as the control channel establishment is completed, the SDP controller 110 and the hosts 200 and 300 control proxy Based on (130), a message is transmitted and received using a token.

4 is a diagram for explaining a process of transmitting a message from the hosts 200 and 300 to the SDP controller 110 .

First, the hosts 200 and 300 transmit the message to the corresponding control proxy 130 by including the token stored in step S125 in the message (S211).

Upon receiving this, the control proxy 130 verifies the validity of the message by comparing the token included in the message with the token stored in step S127 (Host ID-Token) (S213).

Next, if the verification result is valid, the control proxy 130 transmits the 'Host ID-token' included in the message to the SDP controller 110 (S215).

Next, the SDP controller 110 checks the mapping information of the IDs of the hosts 200 and 300 included in the message received from the control proxy 130, and the control proxy mapped in step S119 by the Host ID included in the message. It is verified whether it has been received from (130) (S217).

If the verification result matches the mapping information between the control proxy 130 and the hosts 200 and 300, the SDP controller 110 compares them based on the token included in the message (Host ID-token) and performs verification (S219). ), if it is determined that the verification result is valid, the message is processed (S221).

FIG. 5 is a diagram for explaining a process of transmitting a message from a message to the hosts 200 and 300 to the SDP controller 110 .

First, the SDP controller 110 includes the control addresses of the transmission target hosts 200 and 300 to be transmitted in the message (S311). At this time, the SDP controller 110 registers and manages the control addresses (IP, Port) of the hosts 200 and 300 as described in the precondition.

Next, the token generated in step S117 is included in the message (S313), and the control proxy accessed by the transmission target hosts 200 and 300 based on the information mapped according to step S119 (Host ID-control proxy ID mapping) (130) is selected (S315). Thereafter, the SDP controller 110 transmits a message to the selected control proxy 130 (S317).

Next, the control proxy 130 transmits the message to the transmission target hosts 200 and 300 based on the control address of the transmission target hosts 200 and 300 included in the message (S319), and the transmission target host 200, 300) receives a message (S321).

Thereafter, the transmission target hosts 200 and 300 verify the token upon receiving the message (S323), and if the verification result is valid, process the received message (S325).

6 is a diagram for explaining a procedure for canceling a control channel.

First, the hosts 200 and 300 include the token stored in step S125 in the logout message and then transmit it to the corresponding control proxy 130 (S411).

Upon receiving the logout message, the control proxy 130 verifies the validity of the logout message by comparing the token included in the logout message with the token stored in step S127 (Host ID-token) (S414), and the verification result If valid, 'Host ID-token' is included in the logout message and transmitted to the SDP controller 110 (S415).

Next, the SDP controller 110 checks whether the ID mapping information of the hosts 200 and 300 included in the logout message received from the control proxy 130 has been received from the control proxy 130 according to step S119 . Confirm (S417).

As a result of the check, if the mapping information between the control proxy 130 and the hosts 200 and 300 matches, it compares with the token stored in step S127 (Host ID-token) and performs verification (S419).

Next, if it is determined that the verification result is valid, the SDP controller 110 logs out the hosts 200 and 300 based on the logout message (S421). In this case, the logout process destroys the tokens issued to the corresponding hosts 200 and 300 .

Next, the SDP controller 110 server transmits a token destruction command for the corresponding hosts 200 and 300 to the control proxy 130 mapped in step S119 (S423), and the control proxy 130 that has received it The tokens corresponding to the hosts 200 and 300 are destroyed (S425)

Meanwhile, in the above description, steps S111 to S425 may be further divided into additional steps or combined into fewer steps according to an embodiment of the present invention. In addition, some steps may be omitted if necessary, and the order between steps may be changed. In addition, the contents of the control channel load balancing method in the SDP controller 110 of FIGS. 2 to 6 may also be applied to the contents of FIG. 7 even if other contents are omitted.

7 is a block diagram of the SDP controller 110 capable of load balancing of the control channel of the software-defined boundary network system 1 .

The SDP controller 110 according to an embodiment of the present invention includes a communication module 111 , a memory 112 , and a processor 113 .

The communication module 111 transmits/receives messages to and from at least one host 200 , 300 of an Initiating Host (IH) and an Accepting Host (AH), the authentication proxy 120 , and the control proxy 130 .

A program for load balancing of the control channel is stored in the memory 112 , and the processor 113 executes the program stored in the memory.

When the processor 113 receives the authentication message from the at least one host 200 and 300 , the processor 113 verifies the validity of the authentication message to generate a token used for message transmission and reception, and controls corresponding to the hosts 200 and 300 . After the proxy 130 is selected and mapped, the token and address information of the selected control proxy 130 are transmitted to the authentication proxy 120 . Then, the processor 113 transmits the token to the selected control proxy 130 , and transmits and receives messages to and from the hosts 200 and 300 using the token based on the selected control proxy 130 .

The control channel load balancing method in the SDP controller according to an embodiment of the present invention described above may be implemented as a program (or application) and stored in a medium to be executed in combination with a computer, which is hardware.

The above-mentioned program, in order for the computer to read the program and execute the methods implemented as a program, C, C++, JAVA, Ruby, which the processor (CPU) of the computer can read through the device interface of the computer; It may include code coded in a computer language such as machine language. Such code may include functional code related to a function defining functions necessary for executing the methods, etc., and includes an execution procedure related control code necessary for the processor of the computer to execute the functions according to a predetermined procedure. can do. In addition, this code may further include additional information necessary for the processor of the computer to execute the functions or code related to memory reference for which location (address address) in the internal or external memory of the computer should be referenced. have. In addition, when the processor of the computer needs to communicate with any other computer or server located remotely in order to execute the functions, the code uses the communication module of the computer to determine how to communicate with any other computer or server remotely. It may further include a communication-related code for whether to communicate and what information or media to transmit and receive during communication.

The storage medium is not a medium that stores data for a short moment, such as a register, a cache, a memory, etc., but a medium that stores data semi-permanently and can be read by a device. Specifically, examples of the storage medium include, but are not limited to, ROM, RAM, CD-ROM, magnetic tape, floppy disk, and an optical data storage device. That is, the program may be stored in various recording media on various servers accessible by the computer or in various recording media on the computer of the user. In addition, the medium may be distributed in a computer system connected to a network, and a computer-readable code may be stored in a distributed manner.

The description of the present invention described above is for illustration, and those of ordinary skill in the art to which the present invention pertains can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive. For example, each component described as a single type may be implemented in a dispersed form, and likewise components described as distributed may also be implemented in a combined form.

The scope of the present invention is indicated by the following claims rather than the above detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be interpreted as being included in the scope of the present invention. do.

1: Software-Defined Perimeter Network System
110: SDP controller
120: authentication proxy
130: control proxy
200: start host
300: accept host

Claims (9)

A method for balancing a control channel load in an SDP controller of a software-defined boundary network system, the method comprising:
Receiving an authentication message from at least one host of an Initiating Host (IH) and an Accepting Host (AH);
generating a token used when transmitting and receiving a message by verifying the validity of the authentication message;
selecting and mapping a control proxy corresponding to the host;
transmitting the token and address information of the selected control proxy to an authentication proxy;
sending the token to the selected control proxy; and
Transmitting and receiving a message to and from the host using the token based on the selected control proxy;
Control channel load balancing method in SDP controller. According to claim 1,
Receiving an authentication message from at least one host of the IH and the AH comprises:
Wherein the at least one host transmits an authentication message to the corresponding authentication proxy by designating any one of the predetermined authentication proxies, respectively, and receives the authentication message from the corresponding authentication proxy,
Control channel load balancing method in SDP controller.
According to claim 1,
Selecting and mapping a control proxy corresponding to the host comprises:
That the IH and AH and each of the established control channels to select and map the least control proxy,
Control channel load balancing method in SDP controller.
According to claim 1,
Transmitting and receiving a message with the host using the token based on the selected control proxy comprises:
checking mapping information of the host ID included in the message received from the control proxy;
performing verification based on the token included in the message when the mapping information between the control proxy and the host matches; and
Comprising the step of processing the message when it is determined that the verification result is valid,
Control channel load balancing method in SDP controller.
5. The method of claim 4,
wherein the host includes the token in a message and transmits it to a corresponding control proxy, wherein the control proxy verifies the validity of the message by comparing the token included in the message with a stored token,
Control channel load balancing method in SDP controller.
According to claim 1,
Transmitting and receiving a message with the host using the token based on the selected control proxy comprises:
including a control address and token of the host to be transmitted (hereinafter, a transmission target host) in a message; and
Transmitting the message through a control proxy accessed by the transmission target host based on the mapped information,
Control channel load balancing method in SDP controller.
7. The method of claim 6,
The control proxy transmits the message based on the control address of the transmission target host included in the message, and the transmission target host validates the token upon receiving the message and processes the message if valid,
Control channel load balancing method in SDP controller.
The method of claim 1,
checking mapping information of the host ID included in the logout message received from the control proxy;
performing verification based on the token included in the logout message when the mapping information between the control proxy and the host matches;
if it is determined as valid as a result of the verification, destroying the token corresponding to the host to logout; and
The method further comprising the step of transmitting a token destruction command corresponding to the logout-processed host to the control proxy;
Control channel load balancing method in SDP controller.
9. The method of claim 8,
the host includes the token in a logout message and sends it to a corresponding control proxy;
The control proxy compares the token included in the logout message with a stored token to verify the validity of the logout message, and if valid, transmits it to the SDP controller. to destroy the token,
Control channel load balancing method in SDP controller.

Images