KR20180115883A - Method and apparatus for traffic detour for server protection - Google Patents

Abstract

The present disclosure relates to a method and an apparatus for detouring a traffic for server security which detour or re-detour a path without a service interruption. According to an embodiment of the present disclosure, a method for detouring a path by a controller in a controller centralized network includes the steps of: setting a first path to a protection target server via a relay server; determining whether an attack suspicious traffic for the protection target server is detected; and setting a second path to a replica server via the relay server when the attack suspicious traffic is detected.

Description

METHOD AND APPARATUS FOR TRAFFIC DETOUR FOR SERVER PROTECTION FIELD OF THE INVENTION [0001]

This disclosure is directed to server security, and specifically to methods and apparatus for traffic bypassing for server security.

According to the conventional server security measures, when the suspicious traffic is detected, the traffic to be transmitted to the attack server can be blocked or the suspicious traffic can be bypassed to the duplicate server of the attack server. In the case of the traffic bypass method, there is a problem that the service is disconnected if the routing path is simply changed.

However, there is no concrete method for bypassing suspicious traffic without service interruption.

SUMMARY OF THE INVENTION It is a technical object of the present disclosure to provide a method and apparatus for bypassing or bypassing a path without interruption of service.

The technical objects to be achieved by the present disclosure are not limited to the above-mentioned technical subjects, and other technical subjects which are not mentioned are to be clearly understood from the following description to those skilled in the art It will be possible.

A method of bypassing a path in a controller centralized network according to an aspect of the present disclosure includes: setting a first path to a protected server via a relay server; Determining whether an attack suspicious traffic to the protected server is detected; And setting the second path to the duplicate server via the relay server when the suspect traffic is detected.

According to a further aspect of the present disclosure, a controller device supporting path diversion in a controller centralized network comprises: an attack detection unit; And a path control unit, wherein the path control unit sets a first path from the relay server to the protection target server; Wherein the attack detection unit determines whether an attack suspicious traffic to the protected server is detected; When the suspicious traffic is detected by the attack detection unit, the path control unit may set the second path from the relay server to the replication server.

According to a further aspect of the present disclosure, a method for supporting a path bypass by a relay server includes: transmitting traffic to the protected server through the first path according to a first path setup to a protected server; And transferring traffic to the replica server through the second path in accordance with a second path setting up to the replica server, wherein in the first path setting or the second path setting, The path to the server can be maintained.

According to a further aspect of the present disclosure, a repeater apparatus for supporting a path bypass includes a path setting instruction receiver; A traffic receiver; Wherein the traffic receiving unit and the traffic transmitting unit transmit the traffic to the protected server through the first path when receiving the first path setting instruction from the path setting instruction receiving unit to the protection target server Wherein the traffic receiving unit and the traffic transmitting unit transmit traffic to the replica server through the second path when receiving a second path setting instruction from the path setting instruction receiving unit to the replica server, In the second path setting, the path from the outside to the repeater device can be maintained.

In various aspects of the present invention, if it is determined that the suspect traffic is normal traffic, the first path may be reset.

In various aspects of the present invention, the step of setting the second path may comprise stopping the first path.

In various aspects of the present invention, resetting the first path may comprise stopping the second path.

In another aspect of the present invention, in the first path and the second path, the path from the outside to the relay server is the same, and the path from the relay server to the protection target server, The path to the replica server may be different.

In various aspects of the present invention, in the setting of the first path or the setting of the second path, a path from the outside to the relay server can be maintained.

In various aspects of the present invention, detection of the suspect traffic may be performed by the controller, the protected server, or one or more switches included in the controller-centric network.

In various aspects of the present invention, the duplicate server may determine that the suspect traffic is normal traffic.

The features briefly summarized above for this disclosure are only exemplary aspects of the detailed description of the disclosure which follow, and are not intended to limit the scope of the disclosure.

According to the present disclosure, a method and apparatus for bypassing or re-bypassing a path without interruption of service can be provided.

The effects obtainable from the present disclosure are not limited to the effects mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the description below will be.

1 is a diagram for explaining packet routing in a controller-intensive network.
FIG. 2 is a diagram for explaining a route bypassing method when an attack suspect traffic is detected according to the present disclosure. FIG.
FIG. 3 is a diagram for explaining a route re-routing scheme in the case of normal determination of attack suspicious traffic according to the present disclosure.
4 is a flow chart illustrating the operation of the SDN controller according to the present disclosure;
5 is a flowchart for explaining the operation of the relay server according to the present disclosure.
6 is a diagram showing a configuration of a controller device according to the present disclosure.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings, which will be easily understood by those skilled in the art. However, the present disclosure may be embodied in many different forms and is not limited to the embodiments described herein.

In the following description of the embodiments of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present disclosure rather unclear. Parts not related to the description of the present disclosure in the drawings are omitted, and like parts are denoted by similar reference numerals.

In the present disclosure, when an element is referred to as being "connected", "coupled", or "connected" to another element, it is understood that not only a direct connection relationship but also an indirect connection relationship May also be included. Also, when an element is referred to as " comprising "or" having "another element, it is meant to include not only excluding another element but also another element .

In the present disclosure, the terms first, second, etc. are used only for the purpose of distinguishing one element from another, and do not limit the order or importance of elements, etc. unless specifically stated otherwise. Thus, within the scope of this disclosure, a first component in one embodiment may be referred to as a second component in another embodiment, and similarly a second component in one embodiment may be referred to as a first component .

In the present disclosure, the components that are distinguished from each other are intended to clearly illustrate each feature and do not necessarily mean that components are separate. That is, a plurality of components may be integrated into one hardware or software unit, or a single component may be distributed into a plurality of hardware or software units. Thus, unless otherwise noted, such integrated or distributed embodiments are also included within the scope of this disclosure.

In the present disclosure, the components described in the various embodiments are not necessarily essential components, and some may be optional components. Thus, embodiments consisting of a subset of the components described in one embodiment are also included within the scope of the present disclosure. Also, embodiments that include other elements in addition to the elements described in the various embodiments are also included in the scope of the present disclosure.

The definitions of the terms used in the present disclosure are as follows.

- Controller centralized network structure: A network structure in which the role is clearly divided into a control unit and a transmission unit. For example, a software defined network (SDN) that includes a controller and a switch.

- controller: A block defined in the control plane, which is responsible for the main control of the network, switches, flow, and routing.

- switch: a block defined in the data plane, which receives data from another block and transfers it to another block. A switch may be referred to as a router, a gateway, or the like. In the present disclosure, a switch, a router, a gateway, and the like are collectively referred to as a packet processing device.

- path: The order of the blocks to which data is transferred in the network, or a unit corresponding to a set of blocks.

- block: collectively referred to as a unit that may be configured as a physical node or as a software-implemented application.

- server: A block that is the subject of data transmission or reception. May be both endpoints of communication over the network.

- Protected server: A server that is the destination of suspicious traffic.

- Replication Server: The server that is the destination when the attack suspicious traffic is bypassed. It is configured the same as the protected server.

- Bypass: Change of destination or change of route to destination.

- Relay server: A server that relays traffic to a protected or replicated server.

The definitions of the above terms are merely illustrative, and the scope of the present invention is not limited by these definitions. For example, the definition of such terms does not exclude the basic meaning that is easily understood by those skilled in the art.

Hereinafter, a method and an apparatus for bypassing traffic for server security according to the present disclosure will be described.

In order to secure the server, it is possible to apply a method of blocking traffic suspected of attack and then passing traffic that has been confirmed as having access right to the protected server. Alternatively, the forensic traffic of the attack may be bypassed to the duplication server, and the forensic check may be performed in the duplication server. There is a problem that the connection service is interrupted when the server security method is applied.

Specifically, in a protocol such as UDP (User Datagram Protocol) in which packets are not considered in order, when an attacker suspects traffic to a duplicate server, an attacker or a normal user receiving a service through the protected server recognizes a traffic bypass It may not be possible. However, in protocols such as Transmission Control Protocol (TCP), in which a packet is tracked and managed during a time when a connection is established and maintained (for example, a session), the connection is disconnected when detouring suspicious traffic to the duplication server. Or a normal user receiving the service through the protected server can recognize the traffic bypass. Therefore, when the traffic bypassing method is applied, the connection service provided by the user is interrupted, so that there is a problem that the connection service should be restarted.

According to the present disclosure, it is possible to provide server security that is transparent to an attacker or a normal user by bypassing the suspicious traffic directed to the protected server through the relay server without bypassing the replication server without directly bypassing the service .

In addition, when the duplicated traffic is determined to be normal traffic as a result of a forensic analysis in the duplicate server, the traffic detoured to the duplicate server through the relay server may bypass the traffic to the protected server again via the relay server.

Thus, according to various examples of the present disclosure, it is possible to bypass traffic from a protected server to a replicated server and re-bypass from a replicated server to a protected server without interruption of services provided to normal users. In addition, an attacker may not be aware of traffic bypass and re-bypass, so it may support attacker tracking or detection.

Attack suspicious The subject that detects traffic is not limited to the protected server. The switch, the controller, etc. may also detect the suspicious traffic. For example, an attack suspicious traffic may be detected by an IDS (Intrusion Detection System) mounted on the switch. As a further example, the controller may detect suspicious traffic based on packet statistics received from the switch (s).

The attack suspicious traffic detection may be, for example, a session in which there is no long data transmission / reception, an attack suspicious traffic, a traffic from a user included in the suspicious user list as an attack suspicious traffic, or a scanning attempt is detected May be determined as an attack suspect traffic, or signature-based attack detection may be applied. Here, the scanning may correspond to a method of sending a short message sequentially to a destination belonging to a specific address or a port group and collecting a response, and may be determined as an attack suspicious traffic when suspicious traffic occurs. In addition, the signature-based attack detection may include a method of detecting a signal having a predetermined pattern or value.

1 is a diagram for explaining packet routing in a controller-intensive network.

The controller-centric network 100 of FIG. 1 may be an SDN using an open-flow protocol, but this is merely an example, and the scope of the present disclosure is not limited thereto.

FIG. 1 illustrates a normal user 110, an SDN controller 120, a switch 130, a protected server 140, and an attacker 150. The switch 130 may include one or more open flow switches 131, 132, 133, ....

In step S101, the normal user 110 can transmit a packet whose destination is set to the protected server 140. [ Packets transmitted by normal user 110 may be transmitted over the Internet and SDN 100.

In step S102, the open flow switch 131 can inquire the SDN controller 120 of the path to the protection target server. The first switch on the path in the SDN 100 may be referred to as an edge switch. In the example of FIG. 1, the edge switch may be an open flow switch 131. The edge switch may be referred to as an ingress switch.

In step S103, the SDN controller 120, in response to the inquiry from the edge switch, may establish a path in the SDN 100 and send a routing message to the switch 130 included in the path. For example, the SDN controller 120 may send a routing message to each of the one or more switches 131, 132, 133, ... included in the path.

In step S104, the SDN controller 120 can transmit a path response message to the open flow switch 131 that made the path inquiry, indicating that the path setting is completed.

In step S105, the open flow switch 131 delivers the packet to the open flow switch 132 corresponding to the next block on the set route, and the open flow switch 132 sets the open flow switch 133 And the packet can be transmitted to the protected server 140 through the path thus set.

In this way, when a path is established from the normal user 110 to the protected server 140 and a service is provided, the attacker 150 may attempt to access the protected server 140 on the other hand.

Hereinafter, the route bypass method of the present disclosure will be described in detail in the case where suspicious traffic from the attacker 150 is detected.

FIG. 2 is a diagram for explaining a route bypassing method when an attack suspect traffic is detected according to the present disclosure. FIG.

2 illustrates the normal user 110, the SDN controller 120, the switch 130, the protected server 140, the attacker 150, the relay server 160, and the replica server 170. In the example of FIG. 2, the relay server 160 and the replica server 170 are additionally shown in comparison with the example of FIG.

2 may include an attack detection unit 122, a protection target server management unit 124, a path control unit 126, and a replica server management unit 128. The SDN controller 120 of FIG.

In addition, FIG. 2 shows that a packet delivered from the last switch on the path of the SDN 100 is not directly transferred to the protection target server 140. That is, the packet transmitted from the open flow switch 133 corresponding to the egress switch of the SDN 100 may be transmitted to the protection target server 140 via the relay server 160.

Here, the relay server 160 is transparent to the normal user 110 and the attacker 150. That is, the relay server 160 is not recognized by all users accessing the protected server 140, but is immediately recognized as accessing the protected server 140. For this purpose, the relay server 160 may process a request or a response on behalf of the protected server 160. Alternatively, all the users who access the protected server 140 actually access the relay server 160, but can recognize that the protected server 140 is accessed. That is, the relay server 160 may hide the location of the protected server 140.

That is, the relay server 160 provided on the protected server 140 side may be configured as a transparent relay through which all traffic accessing the protected server 140 passes.

In step S201, the protection target server 140 may detect an attack suspicious traffic from the attacker 150. [ 2 exemplarily shows that the protected server 140 detects an attack suspect traffic, the scope of the present disclosure is not limited thereto, and any of the switches 131, 132, 133, ..., Or the SDN controller 120 may detect an attack suspicious traffic.

In step S202, the server or block (for example, the protected server 140) that has detected the suspect traffic can notify the SDN controller 120 of the detection result. For example, the protected server 140 may send a suspicious user notification message to the SDN controller 120 that includes information about the sender of the suspicious attack traffic.

In step S203, the SDN controller 120 can register the information included in the suspicious user notification message as additional information for the protected server 140 in the list of protected servers. For example, the side information may include the IP address of the sender of attack suspicious traffic (e.g., attacker 150), the nature of attack suspect traffic (e.g., repetition of short messages, etc.). In addition, when the SDN controller 120 determines that the suspicious attack traffic is inputted to the protection target server, the replication server 170 can be allocated. Here, the replica server 170 is configured in the same manner as the protected server 140, and is a destination of the suspect traffic. When the duplication server 170 is prepared, the SDN controller 120 can set the path so that suspicious traffic of the attack is transmitted to the duplication server 170 via the relay server 160. [

In step S204, after the path is bypassed by the SDN controller 120 to the replica server 170, the suspicious traffic of the subsequent attack can be transmitted from the attacker 150. [

The traffic from the attacker 150 may be transmitted to the relay server 160 via the switches 131, 132, and 133 in step S205.

In step S206, the path control unit 126 of the SDN controller 120 may transmit the suspect traffic to the path set in the replica server 170. [ Accordingly, the duplication server 170 can perform forensic analysis on suspicious traffic of the attack.

As described above, the relay server 160 is a relay server that transfers the traffic to the protected server 140 and the replica server 170, or to the protected server 140 and the replica server 170 via the all- And may be configured as a repeater.

That is, while the first session from the outside to the relay server 160 is maintained, the second session between the relay server 160 and the protected server 140 is stopped and the relay server 160 and the replication server 170 are stopped. Lt; / RTI > session can be created. In this case, the session to the relay server 160, which is recognized as the protected server 140, remains uninterrupted in terms of the external (for example, the attacker 150 or the normal user 110) 170). ≪ / RTI >

As described with reference to FIG. 2, if an attack suspicious traffic destined for the protected server 140 occurs via the relay server 160, the attack suspicious traffic that occurs thereafter is transmitted through the relay server 160 And is transferred to the duplication server 170. As described above, the traffic path via the relay server 160 maintains connectivity with the outside despite the path bypass or route change over the relay server 160, so that the normal user 110 needs to reset the connection service And the attacker 150 can not recognize the bypass route.

FIG. 3 is a diagram for explaining a route re-routing scheme in the case of normal determination of attack suspicious traffic according to the present disclosure.

Referring to FIG. 3, after the path detour for attack suspect traffic is set up as in the example of FIG. 2, the duplicate server 170 determines whether the suspect traffic is normal traffic (that is, not attack traffic) , A method of returning the path back to the original protected server 140 will be described.

In step S301, the duplication server 170 can notify the SDN controller 120 that it has confirmed that it is normal traffic as a result of analysis of suspicious attack traffic. For example, the duplication server 170 may send a suspicious user release notification message to the SDN controller 120.

In step S302, on the basis of the information included in the suspicious user release notification message, the SDN controller 120 transmits the additional information registered for the protected server 140 included in the list of protected servers (for example, The IP address of the sender (e.g., attacker 150), and the nature of the suspect traffic (e. G., Repetition of short messages)). If the SDN controller 120 determines that the suspect traffic is normal traffic, the SDN controller 120 determines that the traffic from the attacker 150 determined as a normal user is transmitted to the protected server 140 via the relay server 160 Can be set. In addition, the SDN controller 120 can deallocate the replica server 170.

In step S303, after the path is re-routed to the protected server 170 by the SDN controller 120, subsequent traffic is transmitted from the attacker 150 determined as a normal user, and the switches 131, 132, 133 And may be transmitted to the relay server 160 via the Internet.

In step S204, the path control unit 126 of the SDN controller 120 may transmit the traffic to the path set in the protected server 140. [

As described above, the relay server 160 is a transceiver that passes all the traffic destined for the protected server 140 and the replica server 170, or from the protected server 140 and the replica server 170 to the outside, May be configured as a parent relay.

That is, the third session between the relay server 160 and the replication server 170 is stopped while the first session from the outside to the relay server 160 is maintained, and the relay server 160 and the protected server 140 are stopped. Lt; / RTI > session can be regenerated. In this case, in the case of the external (for example, the attacker 150 or the normal user 110 judged as the normal user), the session to the relay server 160 recognized as the protected server 140 remains uninterrupted It can not recognize that the path is bypassed to the replica server 170 and then the path is re-bypassed to the protection target server 140 again.

As described with reference to FIG. 3, when the suspicious traffic destined for the protected server 140 occurs via the relay server 160, the path bypassed to the replica server 170 is determined to be normal traffic The traffic generated thereafter is transmitted to the protected server 140 via the relay server 160. In this case, Since the traffic path via the relay server 160 maintains connectivity with the outside despite the path bypass, re-bypass or route change over the relay server 160, the normal user 110 re-establishes the connection service The attacker 150 determined to be a normal user can not recognize the path bypass.

4 is a flow chart illustrating the operation of the SDN controller according to the present disclosure;

In step S410, the SDN controller 120 can establish a path to the protected server 140 via the relay server 160. [ Here, the direction of the path is not limited to one direction but may be a path to the protected server 140 via the relay server 160 and / or a path from the protected server 140 via the relay server 160 Directional path, including the < RTI ID = 0.0 >

In step S420, the SDN controller 120 may determine whether or not to detect suspicious traffic targeting the protected server 140. [ Here, the SDN controller 120 itself may detect attack suspicious traffic, but suspicious traffic is detected by another entity (for example, the protected server 140 or the switch 130) The SDN controller 120 may determine whether to detect suspicious traffic based on the received message.

If it is determined in step S420 that an attack suspicious traffic is not detected, the flow returns to step S410 to maintain the path to the protected server 140 via the relay server 160. [

If it is determined in step S420 that an attack suspicious traffic has occurred, the process proceeds to step S430 where the SDN controller 120 sets a path to the duplicate server 170 via the relay server 160 (i.e., bypasses the path) . Here, the direction of the path is not limited to one direction but may include a path to the replication server 170 via the relay server 160 and / or a path from the replication server 170 to the relay server 160 , And can be set as a bi-directional path.

In step S440, the SDN controller 120 may determine whether the suspect traffic is traffic originating from a normal user. For example, the duplication server 170 may perform a forensic analysis or the like on attack suspect traffic, and may transmit a message including the result to the SDN controller 120. The SDN controller 120 may determine whether the suspicious traffic of the attack is normal traffic based on the message received from the replica server 170. [

If it is determined in step S440 that the traffic is not normal, the process returns to step S430, and the SDN controller 120 can maintain the path to the replica server 170 via the relay server 160. [

If it is determined to be the normal traffic in step S440, the process returns to step S430, and the SDN controller 120 can reset (i.e., route back) the path to the protected server 140 via the relay server 160 .

5 is a flowchart for explaining the operation of the relay server according to the present disclosure.

In step S510, the relay server 160 may forward the traffic to the protection target server 140 to the protection target server 140 or may forward the traffic from the protection target server 140 to another entity.

In step S520, the relay server 160 can determine whether there is an instruction to change the path to the replica server 170. [

If there is no instruction to change the route in step S520, the relay server 160 may return to step S510 to forward the traffic to / from the protected server 140. [

If there is an instruction to change the route in step S520, the relay server 160 proceeds to step S530 and transfers the traffic to the protection server 140 to the replication server 170 or the traffic from the replication server 170 To another entity. Here, the relay server 160 stops the second session between the relay server 160 and the protected server 140 while the first session from the outside to the relay server 160 is maintained, and the relay server 160 And the clone server 170. In this case,

In step S540, the relay server 160 may determine whether there is an instruction to change the path to the protected server 140. [

If there is no instruction to change the route in step S540, the relay server 160 may return to step S530 to forward traffic to / from the replica server 170. [

If there is an instruction to change the route in step S540, the relay server 160 proceeds to step S510 and transfers the traffic to the protection target server 140 to the protection target server 140 or from the protection target server 140 Of traffic to another entity. Here, the relay server 160 stops the third session between the relay server 160 and the replica server 170 while the first session from the outside to the relay server 160 is maintained, and the relay server 160 stops the third session between the relay server 160 and the replica server 170, The second session between the protected server 140 and the protected server 140 can be created.

6 is a diagram showing a configuration of a controller device according to the present disclosure.

Controller device 600 may include a transceiver 610, a memory 620, and a processor 630. The configuration of the controller device 600 is only exemplary and is not limited to the example of FIG. 6, and may include some or all of the components of FIG. 6, and may further include additional components.

The transceiver 610 can transmit control information or the like to another device or receive control information or the like from another device.

The memory 620 may store control information, calculation results, and the like necessary for the operation of the controller device 600. [ For example, the memory 620 may store a list of protected servers or the like.

The processor 630 may control the overall operation of the controller device 600. [

For example, the processor 630 may include an attack detection unit 632, a protected server management unit 634, a path control unit 636, and a replica server management unit 638.

First, a case where the processor 630 of the controller device 600 performs control to bypass the path from the protected server 140 to the replica server 170 will be described.

When the protection target server 140, the switch 130, or the SDN controller 120 detects an attack suspicious traffic, a suspicious user notification message may be received at the controller device 600. [

The attack detection unit 632 of the controller device 600 may transmit the information included in the suspicious user notification message to the protection target server management unit 634. [

The protected server management unit 634 can register the suspicious user information as the additional information for the protected server 140 included in the list of protected servers. For example, the side information may include the IP address of the sender of attack suspicious traffic (e.g., attacker 150), the nature of attack suspect traffic (e.g., repetition of short messages, etc.).

The path control unit 636 receives from the attack detection unit 632 or the protection target server management unit 634 the fact that the suspect traffic is inputted to the protection target server 140, (170). Here, the replica server 170 is configured in the same manner as the protected server 140, and is a destination of the suspect traffic.

When the replica server 170 is prepared, the path controller 636 can set the path so that suspicious traffic of the attack is transmitted to the replica server 170 via the relay server 160. [

Next, a case where the processor 630 of the controller device 600 performs control so as to bypass the path from the replication server 170 to the protection target server 140 will be described.

When the duplication server 170 confirms that it is normal traffic as a result of the analysis of the suspicious traffic, the suspicious user release notification message may be received at the controller device 600.

The attack detection unit 632 of the controller device 600 may forward the information included in the suspect user release notification message to the protection target server management unit 634. [

The protection target server management unit 634 compares the additional information registered with the protected server 140 included in the list of protected servers 140 (for example, the IP address of the sender of attack suspect traffic (for example, attacker 150) Addresses, attributes of suspicious traffic (e.g., repetition of short messages, etc.)).

When the attack control unit 636 receives from the attack detection unit 632 or the protection target server management unit 634 that the suspicious traffic destined for the protected server is normal traffic, The path can be set so that the traffic is transmitted to the protection target server 140 via the relay server 160. [

Further, the path control unit 636 can control to cancel the allocation of the replica server 170 through the replica server management unit 638. [

The attack detecting unit 632, the protected server managing unit 634, the path controlling unit 636 and the replica server managing unit 638 according to the present disclosure are configured as an application that is not a component of the processor 630, Lt; / RTI >

The controller device 600 having the processor 630 including the attack detection unit 632, the protection target server management unit 634, the path control unit 636 and the replica server management unit 638 according to the present invention may be an SDN May be included in the controller 120.

In addition, the controller device 600 having the processor 630 including the attack detection unit 632, the protected server management unit 634, the path control unit 636, and the replica server management unit 638 is connected to the SDN controller 120, (E.g., an upper application server of the SDN controller 120, etc.) that is different from the external server (e.g., the SDN controller 120). Alternatively, some of the attack detection unit 632, the protected server management unit 634, the path control unit 636, and the replica server management unit 638 may be included in the SDN controller 120 and some of them may be included in an external server An upper application server of the SDN controller 120, etc.). In this case, the processor 630 of the controller device 600 may control the interlocking operation between the SDN controller 120 and the components of the external server. For example, the processor 630 of the controller device 600 may control to communicate with an external server via a REST API standard interface via the transceiver 610.

7 is a diagram showing a configuration of a repeater device according to the present disclosure.

The relay apparatus 700 of FIG. 7 may include a path setting instruction receiving unit 710, a traffic receiving unit 720, a traffic transmitting unit 730, a memory 740, and the like. The configuration of this repeater device 700 is only exemplary and is not limited to the example of FIG. 7, and may include some or all of the components of FIG. 7, and may further include additional components.

For example, after receiving an instruction to set the first path from the path setting instruction receiving unit 710 to the protection target server 140, traffic from / to the protection target server 140 is received from the traffic receiving unit 720 Upon receipt, the traffic transmission unit 730 can forward the received traffic to the protected server 140 or to another block.

For example, after receiving the instruction for the second path setting from the path setting instruction receiving unit 710 to the replica server 170, the traffic receiving unit 720 receives the traffic from / to the replica server 170 , The traffic transmission unit 730 can forward the received traffic to the replication server 170 or another block.

The memory 740 of the relay server 160 may temporarily store routing information, traffic, and the like.

The repeater device 700 including the routing instruction receiver 710, the traffic receiver 720, the traffic transmitter 730, and the memory 740 according to the present invention may be included in the repeater server 160.

Although the exemplary methods of this disclosure are represented by a series of acts for clarity of explanation, they are not intended to limit the order in which the steps are performed, and if necessary, each step may be performed simultaneously or in a different order. In order to implement the method according to the present disclosure, the illustrative steps may additionally include other steps, include the remaining steps except for some steps, or may include additional steps other than some steps.

The various embodiments of the disclosure are not intended to be all-inclusive and are intended to illustrate representative aspects of the disclosure, and the features described in the various embodiments may be applied independently or in a combination of two or more.

In addition, various embodiments of the present disclosure may be implemented by hardware, firmware, software, or a combination thereof. In the case of hardware implementation, one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays A general processor, a controller, a microcontroller, a microprocessor, and the like.

The scope of the present disclosure is to be accorded the broadest interpretation as understanding of the principles of the invention, as well as software or machine-executable instructions (e.g., operating system, applications, firmware, Instructions, and the like are stored and are non-transitory computer-readable medium executable on the device or computer.

100 ... controller intensive network
110 ... normal users
120 ... SDN controller
130 ... switch
131, 132, 133 ... open flow switch
140 ... protected server
150 ... Attacker
160 ... relay server
170 ... Replication Server
600 ... controller device
610 ... transceiver
620 ... memory
630 ... processor
632 ... attack detection unit
634 ... Protection target server management section
636 ... path control section
638 ... Replication Server Management Section

Claims (20)

A method of bypassing a path in a controller centralized network by a controller,
Setting a first path to a protected server via a relay server;
Determining whether an attack suspicious traffic to the protected server is detected; And
And setting a second path from the relay server to the replica server when the suspect traffic is detected. The method according to claim 1,
Further comprising resetting the first path if it is determined that the suspicious traffic is normal traffic. 3. The method of claim 2,
Wherein setting the second path comprises interrupting the first path. The method of claim 3,
Wherein resetting the first path comprises interrupting the second path. The method according to claim 1,
In the first path and the second path,
The path from the outside to the relay server is the same,
Wherein the path from the relay server to the protection target server is different from the path from the relay server to the replication server. The method according to claim 1,
Wherein the route from the outside to the relay server is maintained in the setting of the first route or the setting of the second route. The method according to claim 1,
Wherein detection of the suspicious traffic is performed by one or more switches included in the controller, the protected server, or the controller-intensive network. 3. The method of claim 2,
And the duplicate server determines that the suspect traffic is normal traffic. 1. A controller device supporting path bypass in a controller intensive network,
An attack detection unit; And
And a path control unit,
The path control unit sets a first path from the relay server to the protected server;
Wherein the attack detection unit determines whether an attack suspicious traffic to the protected server is detected;
And when the suspicious traffic is detected by the attack detection unit, the path control unit sets a second path from the relay server to the replication server. 10. The method of claim 9,
Wherein the path control unit resets the first path when the attack detection unit determines that the suspect traffic is normal traffic. 11. The method of claim 10,
And the path control unit stops the first path when setting the second path. 12. The method of claim 11,
And the path control unit suspends the second path when resetting the first path. 10. The method of claim 9,
The path control unit,
In the first path and the second path,
The path from the outside to the relay server is the same,
And sets a path such that a path from the relay server to the protection target server and a path from the relay server to the replication server are different. 10. The method of claim 9,
The path control unit,
And sets the path so that the path from the outside to the relay server is maintained in the setting of the first path or the setting of the second path. 10. The method of claim 9,
The attack detection unit may directly detect the suspect traffic,
Wherein the attack detection unit detects the suspicious traffic by receiving a message indicating an attack suspicious traffic detection by the at least one switch included in the protected server or the controller intensive network. 11. The method of claim 10,
Wherein the attack detection unit determines whether the normal traffic is received by receiving a message indicating that the suspect traffic is normal traffic by the replication server. A method for supporting a bypass of a path by a relay server,
Delivering traffic to the protected server through the first path according to a first path setup to the protected server; And
And forwarding traffic to the replica server via the second path in accordance with a second path setting to the replica server,
Wherein the path from the outside to the relay server is maintained in the first path setting or the second path setting. 18. The method of claim 17,
And forwarding the traffic to the protected server through the first path in accordance with the resetting of the first path. A repeater device supporting path bypass, comprising:
A path setting instruction receiving unit;
A traffic receiver;
And a traffic transmission unit,
Wherein the traffic receiving unit and the traffic transmitting unit transmit traffic to the protected server through the first path when receiving the first path setting instruction from the path setting instruction receiving unit to the protection target server,
Wherein the traffic receiving unit and the traffic transmitting unit transmit traffic to the replica server through the second path when receiving the second path setting instruction from the path setting instruction receiving unit to the replica server,
Wherein in the first path setting or the second path setting, the path from the outside to the repeater device is maintained. 20. The method of claim 19,
Wherein the traffic receiving unit and the traffic transmitting unit transmit traffic to the protected server through the first path when receiving the reset instruction of the first path from the path setting instruction receiving unit.

Images